Function at 0x100016e0
Capabilities:
Delete file
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x618
call fcn.10001aa0
test eax, eax
jne 0x100016f6
add esp, 0x618
ret
mov ecx, dword [0x10022bc0]
push 0x103
lea eax, [esp + 0x118]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1000176f
push 0x104
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
jne 0x10001740
mov cl, byte [esp + eax + 0x114]
mov byte [esp + eax + 0x10], cl
inc eax
test cl, cl
jne 0x10001730
push 1
call fcn.10001550
push 0
lea ecx, [esp + 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesAdaptive_Server_Anywhere_8Performance_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x1000177b
mov eax, 0x8000ffff
add esp, 0x618
ret
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10001782
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 8]
lea edx, [esp + 0x18]
push edx
push 1
push 0
push str.Library
push eax
call esi
test eax, eax
jne 0x1000182b
mov ecx, dword [esp + 4]
push 0x14
push 0x1001f8a8
push 1
push eax
push str.Open
push ecx
call esi
test eax, eax
jne 0x1000182b
mov edx, dword [esp + 4]
push 0x15
push 0x1001f888
push 1
push eax
push str.Close
push edx
call esi
test eax, eax
jne 0x1000182b
push 0x17
push 0x1001f868
push 1
push eax
mov eax, dword [esp + 0x14]
push str.Collect
push eax
call esi
test eax, eax
jne 0x1000182b
lea ecx, [esp + 8]
mov dword [esp + 8], str.dbctrs8.ini
mov dword [esp + 0xc], str._info__n____drivernameAdaptive_Server_Anywhere_8_n____symbolfilesqlactnm.h_n_n_languages__n____009English_n____00CFrench_n____007German_n____011Japanese_n____804Simplified_Chinese_n_n_text__n____OI_ENGINE_009_NAMEAdaptive_Server_Anywhere_8_Engine_n____OI_ENGINE_009_HELPThe_Adaptive_Server_Anywhere_engine_object._n____OI_DATABASE_009_NAMEAdaptive_Server_Anywhere_8_Database_n____OI_DATABASE_009_HELPThe_Adaptive_Server_Anywhere_database_object._n____OI_CONNECTION_009_NAMEAdaptive_Server_Anywhere_8_Connection_n____OI_CONNECTION_009_HELPThe_Adaptive_Server_Anywhere_connection_object._n____CI_CONN_COUNT_009_NAMEConnection_Count_n____CI_CONN_COUNT_009_HELPConnection_Count_is_the_total_number_of_active_connections_for_this_database._n____CI_IDLE_ACTIVE_009_NAMEIdle_Actives_sec_n____CI_IDLE_ACTIVE_009_HELPIdle_Actives_sec_is_the_rate_at_which_the_engines_idle_thread_becomes_active_to_do_idle_writes__idle_checkpoints__etc._n____CI_IDLE_WRITES_009_NAMEIdle_Writes_sec_n____CI_IDLE_WRITES_009_HELPIdle_Writes_sec_is_the_rate_at_which_disk_writes_are_being_issued_by_the_engines_idle_thread._n____CI_IDLE_CHECKPOINTS_009_NAMEIdle_Checkpoints_sec_n____CI_IDLE_CHECKPOINTS_009_HELPIdle_Checkpoints_sec_is_the_rate_at_which_checkpoints_are_completed_by_the_engines_idle_thread._An_idle_checkpoint_occurs_whenever_the_idle_thread_writes_out_the_last_dirty_page_in_the_cache._n____CI_IDLE_CHECKP_TIME_009_NAMEIdle_Checkpoint_Time_n____CI_IDLE_CHECKP_TIME_009_HELPIdle_Checkpoint_Time_is_the_total_time_in_seconds_spent_doing_idle_checkpoints._n____CI_CHECKPOINTS_009_NAMECheckpoints_sec_n____CI_CHECKPOINTS_009_HELPCheckpoints_sec_is_the_rate_at_which_checkpoints_are_being_performed._n____CI_CHECKPOINT_LOG_009_NAMEChkptLog:_Page_images_saved_sec_n____CI_CHECKPOINT_LOG_009_HELPChkptLog:_Page_images_saved_sec_is_the_rate_at_which_pages_are_being_saved_in_the_checkpoint_log_prior_to_modification._n____CI_CHECKPOINT_FLUSH_009_NAMECheckpoint_Flushes_sec_n____CI_CHECKPOINT_FLUSH_009_HELPCheckpoint_Flushes_sec_is_the_rate_at_which_ranges_of_adjacent_pages_are_being_written_out_during_a_checkpoint._n____CI_EXTEND_DB_009_NAMEDisk_Writes:_Database_Extends_sec_n____CI_EXTEND_DB_009_HELPDisk_Writes:_Database_Extends_sec_is_the_rate__in_pages_sec__at_which_the_database_file_is_being_extended._n____CI_EXTEND_TEMP_009_NAMEDisk_Writes:_Temp_Extends_sec_n____CI_EXTEND_TEMP_009_HELPDisk_Writes:_Temp_Extends_sec_is_the_rate__in_pages_sec__at_which_temporary_files_are_being_extended._n____CI_COMMIT_FILE_009_NAMEDisk_Writes:_Commit_Files_sec_n____CI_COMMIT_FILE_009_HELPDisk_Writes:_Commit_Files_sec_is_the_rate_at_which_the_engine_is_forcing_a_flush_of_the_disk_cache._On_NT_and_NetWare_platforms__the_disk_cache_does_not_need_to_be_flushed_since_unbuffered__direct__IO_is_used._n____CI_CURRENT_READ_009_NAMEDisk_Reads:_Active_n____CI_CURRENT_READ_009_HELPDisk_Reads:_Active_is_the_current_number_of_file_reads_issued_by_the_engine_which_have_not_yet_completed._n____CI_MAXIMUM_READ_009_NAMEDisk_Reads:_Maximum_Active_n____CI_MAXIMUM_READ_009_HELPDisk_Reads:_Maximum_Active_is_the_maximum_value_that__Current_Reads__has_reached._n____CI_CURRENT_WRITE_009_NAMEDisk_Writes:_Active_n____CI_CURRENT_WRITE_009_HELPDisk_Writes:_Active_is_the_current_number_of_file_writes_issued_by_the_engine_which_have_not_yet_completed._n____CI_MAXIMUM_WRITE_009_NAMEDisk_Writes:_Maximum_Active_n____CI_MAXIMUM_WRITE_009_HELPDisk_Writes:_Maximum_Active_is_the_maximum_value_that__Current_Writes__has_reached._n____CI_CURRENT_IO_009_NAMEDisk:_Active_I_Os_n____CI_CURRENT_IO_009_HELPDisk:_Active_I_Os_is_the_current_number_of_file_IOs_issued_by_the_engine_which_have_not_yet_completed._n____CI_MAXIMUM_IO_009_NAMEDisk:_Maximum_Active_I_Os_n____CI_MAXIMUM_IO_009_HELPDisk:_Maximum_Active_I_Os_is_the_maximum_value_that__Disk:_Active_I_O__has_reached._n____CI_JVM_NAMESPACE_SIZE_009_NAMEJVM:_Namespace_Size_n____CI_JVM_NAMESPACE_SIZE_009_HELPJVM:_Namespace_Size_is_the_total_bytes_allocated_to_java_VM_namespace._n____CI_IO_TO_RECOVER_009_NAMERecovery_I_O_Estimate_n____CI_
mov dword [esp + 0x10], 0x17636
call fcn.10001670
test eax, eax
jne 0x10001838
push str.dbctrs8.ini
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 0x8000ffff
pop esi
add esp, 0x618
ret
lea ecx, [esp + 8]
mov dword [esp + 8], str.sqlactnm.h
mov dword [esp + 0xc], str.ifndef__SQLACTNM_H__ndefine__SQLACTNM_H__n_ndefine_tOI_ENGINE_0_ndefine_tOI_DATABASE_2_ndefine_tOI_CONNECTION_4_ndefine_tCI_CONN_COUNT_t6_ndefine_tCI_IDLE_ACTIVE_t8_ndefine_tCI_IDLE_WRITES_t10_ndefine_tCI_IDLE_CHECKPOINTS_t12_ndefine_tCI_IDLE_CHECKP_TIME_t14_ndefine_tCI_CHECKPOINTS_t16_ndefine_tCI_CHECKPOINT_LOG_t18_ndefine_tCI_CHECKPOINT_FLUSH_t20_ndefine_tCI_EXTEND_DB_t22_ndefine_tCI_EXTEND_TEMP_t24_ndefine_tCI_COMMIT_FILE_t26_ndefine_tCI_CURRENT_READ_t28_ndefine_tCI_MAXIMUM_READ_t30_ndefine_tCI_CURRENT_WRITE_t32_ndefine_tCI_MAXIMUM_WRITE_t34_ndefine_tCI_CURRENT_IO_t36_ndefine_tCI_MAXIMUM_IO_t38_ndefine_tCI_JVM_NAMESPACE_SIZE_t40_ndefine_tCI_IO_TO_RECOVER_t42_ndefine_tCI_CHECKPOINT_URGENCY_t44_ndefine_tCI_RECOVERY_URGENCY_t46_ndefine_tCI_RELOCATABLE_HEAP_PAGES_t48_ndefine_tCI_PROCEDURE_PAGES_t50_ndefine_tCI_TRIGGER_PAGES_t52_ndefine_tCI_VIEW_PAGES_t54_ndefine_tCI_PAGE_RELOCATIONS_t56_ndefine_tCI_MAP_PAGES_t58_ndefine_tCI_LOCK_TABLE_PAGES_t60_ndefine_tCI_CHKPT_LOG_COMMIT_TO_DISK_t62_ndefine_tCI_CHKPT_LOG_SAVE_PREIMAGE_t64_ndefine_tCI_CHKPT_LOG_WRITES_t66_ndefine_tCI_CHKPT_LOG_WRITE_PAGES_t68_ndefine_tCI_CHKPT_LOG_RELOCATE_PAGES_t70_ndefine_tCI_CHKPT_LOG_SIZE_t72_ndefine_tCI_CHKPT_LOG_PAGES_IN_USE_t74_ndefine_tCI_CHKPT_LOG_BITMAP_SIZE_t76_ndefine_tCI_CHKPT_LOG_BITMAP_WRITE_PAGES_t78_ndefine_tCI_CACHE_HITS_t80_ndefine_tCI_CACHE_READ_t82_ndefine_tCI_DISK_READ_t84_ndefine_tCI_CACHE_TABLE_READ_t86_ndefine_tCI_CACHE_INDEXLEAF_READ_t88_ndefine_tCI_CACHE_INDEXINT_READ_t90_ndefine_tCI_DISK_TABLE_READ_t92_ndefine_tCI_DISK_INDEXLEAF_READ_t94_ndefine_tCI_DISK_INDEXINT_READ_t96_ndefine_tCI_DISK_WRITE_t98_ndefine_tCI_REDO_WRITE_t100_ndefine_tCI_REDO_FREE_COMMIT_t102_ndefine_tCI_INDEX_ADDS_t104_ndefine_tCI_INDEX_LOOKUPS_t106_ndefine_tCI_FULL_COMPARES_t108_ndefine_tCI_JVM_HEAP_SIZE_t110_ndefine_tCI_ROLLBACK_LOG_PAGES_t112_ndefine_tCI_GETDATA_t114_ndefine_tCI_TEMP_TABLE_PAGES_t116_ndefine_tCI_QUERY_LOW_MEMORY_STRATEGY_t118_ndefine_tCI_QUERY_CACHE_PAGES_t120_ndefine_tCI_QUERY_ROWS_MATERIALIZED_t122_ndefine_tCI_COMMIT_t124_ndefine_tCI_ROLLBACK_t126_ndefine_tCI_STATEMENT_t128_ndefine_tCI_STATEMENT_PREPARES_t130_ndefine_tCI_CURSOR_t132_ndefine_tCI_OPEN_CURSOR_t134_ndefine_tCI_CONTEXT_SWITCHES_t136_ndefine_tCI_PACKETS_RECEIVED_t138_ndefine_tCI_PACKETS_RECEIVED_UNCOMP_t140_ndefine_tCI_BYTES_RECEIVED_t142_ndefine_tCI_BYTES_RECEIVED_UNCOMP_t144_ndefine_tCI_PACKETS_SENT_t146_ndefine_tCI_PACKETS_SENT_UNCOMP_t148_ndefine_tCI_BYTES_SENT_t150_ndefine_tCI_BYTES_SENT_UNCOMP_t152_ndefine_tCI_MULTI_PACKETS_SENT_t154_ndefine_tCI_MULTI_PACKETS_RECEIVED_t156_ndefine_tCI_REMOTEPUT_WAIT_t158_ndefine_tCI_SEND_FAIL_t160_ndefine_tCI_FREE_BUFFERS_t162_ndefine_tCI_TOTAL_BUFFERS_t164_ndefine_tCI_LICENSES_IN_USE_t166_ndefine_tCI_SERVER_IDLE_WAITS_t168_ndefine_tCI_UNSCHEDULED_REQUESTS_t170_ndefine_tCI_ACTIVE_REQUESTS_t172_ndefine_tCI_REQUESTS_t174_ndefine_tCI_JVM_GLOBALFIXED_SIZE_t176_ndefine_tCI_CACHE_HITS_ENG_t178_ndefine_tCI_CACHE_READ_ENG_t180_ndefine_tCI_DISK_READ_ENG_t182_ndefine_tCI_LOCKED_HEAP_PAGES_t184_ndefine_tCI_AVAIL_IO_t186_ndefine_tCI_MAIN_HEAP_PAGES_t188_ndefine_tCI_MAIN_HEAP_BYTES_t190_ndefine_tCI_REQUEST_QUEUE_WAIT_t192_ndefine_tCI_CACHE_REPLACEMENTS_t194_ndefine_tCI_CURRENT_CACHE_SIZE_t196_ndefine_tCI_MIN_CACHE_SIZE_t198_ndefine_tCI_MAX_CACHE_SIZE_t200_ndefine_tCI_PEAK_CACHE_SIZE_t202_ndefine_tCI_MAP_PHYSICAL_MEMORY_ENG_t204_ndefine_tCI_EXPR_CACHE_STARTS_t206_ndefine_tCI_EXPR_CACHE_LOOKUPS_t208_ndefine_tCI_EXPR_CACHE_HITS_t210_ndefine_tCI_EXPR_CACHE_INSERTS_t212_ndefine_tCI_EXPR_CACHE_EVICTS_t214_ndefine_tCI_EXPR_CACHE_DROPS_TO_READ_ONLY_t216_ndefine_tCI_EXPR_CACHE_RESUMES_OF_READ_WRITE_t218_ndefine_tCI_EXPR_CACHE_ABANDONS_t220_ndefine_tCI_HASH_WORK_TABLES_t222_ndefine_tCI_HASH_ROWS_PARTITIONED_t224_ndefine_tCI_HASH_ROWS_FILTERED_t226_ndefine_tCI_SORT_WORK_TABLES_t228_ndefine_tCI_SORT_ROWS_MATERIALIZED_t230_ndefine_tCI_SORT_SORTED_RUNS_t232_ndefine_tCI_SORT_RUNS_WRITTEN_t234_ndefine_tCI_SORT_MERGE_PASSES_t236_ndefine_tCI_QUERY_
mov dword [esp + 0x10], 0xf2a
call fcn.10001670
test eax, eax
jne 0x1000187e
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.sqlactnm.h
call esi
push str.dbctrs8.ini
call esi
mov eax, 0x8000ffff
pop esi
add esp, 0x618
ret
mov ecx, dword [str.lodctr]
mov edx, dword [0x1001f844]
push edi
lea edi, [esp + 0x220]
mov dword [esp + 0x220], ecx
mov dword [esp + 0x224], edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100018a1
mov eax, dword [str.dbctrs8.ini]
mov ecx, dword [0x1001f858]
mov edx, dword [0x1001f85c]
mov dword [edi], eax
mov dword [edi + 4], ecx
push 0
mov dword [edi + 8], edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [esp + 0x220]
push eax
call fcn.10001910
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 4
test eax, eax
pop edi
push str.sqlactnm.h
je 0x10001868
call esi
push str.dbctrs8.ini
call esi
xor eax, eax
pop esi
add esp, 0x618
ret