Function at 0x10040a680
Capabilities:
Query service status
Start service

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c60]
mov eax, 0x1d60
call fcn.100412d40
sub rsp, rax
mov rax, qword [0x100422010]
xor rax, rsp
mov qword [rbp + 0x1c50], rax
mov r13, rdx
mov r14, rcx
xor edx, edx
mov esi, edx
xor edx, edx
lea rcx, [r13 + 6]
mov r8d, 0xf0000
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r15, rax
test rax, rax
je 0x10040ae77
mov eax, dword [0x1004193f8]
lea rcx, [rbp + 0x16]
movups xmm0, xmmword [str.SQLDUMPER_]
mov dword [rbp + 0x10], eax
xor edx, edx
movzx eax, word [0x1004193fc]
mov r8d, 0x3fc
movaps xmmword [rbp], xmm0
mov word [rbp + 0x14], ax
call sub.VCRUNTIME140.dll_memset
lea rdi, [r13 + 0x316]
mov edx, 0x5c
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
test rax, rax
je 0x10040a72c
lea rdi, [rax + 2]
mov ecx, 0x209
lea rax, [rbp]
cmp word [rax], 0
je 0x10040a745
add rax, 2
sub rcx, 1
jne 0x10040a735
test rcx, rcx
mov r10d, 0
mov ebx, 0x80070057
mov eax, 0x209
cmovne ebx, r10d
mov r8d, r10d
sub rax, rcx
test rcx, rcx
cmovne r8, rax
je 0x10040a7c7
mov edx, 0x209
lea rcx, [rbp]
lea rcx, [rcx + r8*2]
sub rdx, r8
je 0x10040a7af
add r8, 0x7ffffdf5
mov r9, rdi
add r8, rdx
sub r9, rcx
nop dword [rax]
test r8, r8
je 0x10040a7af
movzx eax, word [rcx + r9]
test ax, ax
je 0x10040a7af
mov word [rcx], ax
dec r8
add rcx, 2
sub rdx, 1
jne 0x10040a790
test rdx, rdx
lea rax, [rcx - 2]
mov ebx, 0x8007007a
cmovne rax, rcx
cmovne ebx, r10d
mov word [rax], r10w
test ebx, ebx
jne 0x10040ae52
mov r8d, 0x80000010
lea rdx, [rbp]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
jne 0x10040a80c
mov r8d, 0x80000010
lea rdx, str.SQLDUMPER
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x10040ae0b
mov eax, dword [0x100414ef0]
lea rcx, [rbp + 0x426]
mov dword [rsp + 0x50], eax
xor edx, edx
mov eax, dword [0x1004194a8]
mov r8d, 0x40c
mov dword [rbp + 0x420], eax
movzx eax, word [0x1004194ac]
mov word [rbp + 0x424], ax
call sub.VCRUNTIME140.dll_memset
mov ecx, 0x209
lea rax, [rbp + 0x420]
cmp word [rax], 0
je 0x10040a860
add rax, 2
sub rcx, 1
jne 0x10040a850
test rcx, rcx
mov edx, 0
mov ebx, 0x80070057
mov eax, 0x209
cmovne ebx, edx
mov r8d, edx
sub rax, rcx
test rcx, rcx
cmovne r8, rax
je 0x10040a8e1
mov edx, 0x209
lea rcx, [rbp + 0x420]
lea rcx, [rcx + r8*2]
sub rdx, r8
je 0x10040a8c4
add r8, 0x7ffffdf5
add r8, rdx
sub rdi, rcx
test r8, r8
je 0x10040a8c4
movzx eax, word [rdi + rcx]
test ax, ax
je 0x10040a8c4
mov word [rcx], ax
dec r8
add rcx, 2
sub rdx, 1
jne 0x10040a8a6
test rdx, rdx
lea rax, [rcx - 2]
mov ebx, 0x8007007a
cmovne rax, rcx
xor edi, edi
test rdx, rdx
cmovne ebx, edi
mov word [rax], di
jmp 0x10040a8e3
xor edi, edi
test ebx, ebx
jne 0x10040ae49
mov eax, dword [r14 + 0x674]
lea r8, str._X:_X
mov r9d, dword [r14 + 0x1a10]
lea edx, [rbx + 0x20]
lea rcx, [rbp - 0x40]
mov dword [rsp + 0x20], eax
call fcn.100401090
mov ebx, eax
test eax, eax
jne 0x10040ae40
movups xmm0, xmmword [str._remoteservers:remoteinvoke:]
movzx eax, word [0x100419558]
xor edx, edx
movups xmm1, xmmword [0x100419530]
lea rcx, [rbp + 0x87a]
mov r8d, 0x7c6
movaps xmmword [rbp + 0x840], xmm0
movups xmm0, xmmword [0x100419540]
mov word [rbp + 0x878], ax
movaps xmmword [rbp + 0x850], xmm1
movsd xmm1, qword [0x100419550]
movaps xmmword [rbp + 0x860], xmm0
movsd qword [rbp + 0x870], xmm1
call sub.VCRUNTIME140.dll_memset
lea rcx, [r14 + 0x246e0]
mov qword [rsp + 0x58], rdi
lea rdx, [rsp + 0x58]
call qword [sym.imp.RPCRT4.dll_UuidToStringW]
test eax, eax
jne 0x10040ae32
mov ecx, 0x400
lea rax, [rbp + 0x840]
cmp word [rax], 0
je 0x10040a9b1
add rax, 2
sub rcx, 1
jne 0x10040a9a1
test rcx, rcx
mov ebx, 0x80070057
cmovne ebx, edi
je 0x10040a9c8
mov eax, 0x400
sub rax, rcx
jmp 0x10040a9cb
mov rax, rdi
test rcx, rcx
je 0x10040aa2c
mov edx, 0x400
lea rcx, [rbp + 0x840]
lea rcx, [rcx + rax*2]
sub rdx, rax
je 0x10040aa16
mov r9, qword [rsp + 0x58]
lea r8, [rax + 0x7ffffbfe]
add r8, rdx
sub r9, rcx
test r8, r8
je 0x10040aa16
movzx eax, word [rcx + r9]
test ax, ax
je 0x10040aa16
mov word [rcx], ax
dec r8
add rcx, 2
sub rdx, 1
jne 0x10040a9f7
test rdx, rdx
lea rax, [rcx - 2]
mov ebx, 0x8007007a
cmovne rax, rcx
cmovne ebx, edi
mov word [rax], di
lea rcx, [rsp + 0x58]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
test ebx, ebx
jne 0x10040ae29
mov ecx, dword [r14 + 0x246d4]
lea r9, [r14 + 0x246f4]
movzx eax, word [r13 + 4]
lea r8, str._s_X_d_d_d
mov rdx, qword [r14 + 0x6e8]
and ecx, 0xffffffde
mov dword [rsp + 0x38], ecx
lea rcx, [rbp + 0x1040]
mov dword [rsp + 0x30], eax
mov eax, dword [r14 + 0x246f0]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov edx, 0x208
call fcn.100401090
mov ebx, eax
test eax, eax
jne 0x10040ae29
mov ecx, 0x400
lea rax, [rbp + 0x840]
cmp word [rax], 0
je 0x10040aab2
add rax, 2
sub rcx, 1
jne 0x10040aaa2
test rcx, rcx
mov ebx, 0x80070057
cmovne ebx, edi
je 0x10040aac9
mov eax, 0x400
sub rax, rcx
jmp 0x10040aacc
mov rax, rdi
test rcx, rcx
je 0x10040ab35
mov edx, 0x400
lea rcx, [rbp + 0x840]
lea rcx, [rcx + rax*2]
sub rdx, rax
je 0x10040ab1f
lea r8, [rax + 0x7ffffbfe]
add r8, rdx
lea r9, [rbp + 0x1040]
sub r9, rcx
nop word [rax + rax]
test r8, r8
je 0x10040ab1f
movzx eax, word [r9 + rcx]
test ax, ax
je 0x10040ab1f
mov word [rcx], ax
dec r8
add rcx, 2
sub rdx, 1
jne 0x10040ab00
test rdx, rdx
lea rax, [rcx - 2]
mov ebx, 0x8007007a
cmovne rax, rcx
cmovne ebx, edi
mov word [rax], di
test ebx, ebx
jne 0x10040ae29
lea rcx, str._SMSSQLSERVER
lea rax, [rsp + 0x50]
mov qword [rbp - 0x60], rcx
mov qword [rbp - 0x78], rax
lea r9, [r13 + 6]
lea rax, [rsp + 0x50]
mov qword [rbp - 0x70], rax
lea r8, str.Remote_dump_on__s_invoked_with_parameters__s__s__s__s__s__s
lea rax, [rbp + 0x420]
mov qword [rbp - 0x68], rax
lea edx, [rbx + 2]
lea rax, [rbp - 0x40]
mov qword [rbp - 0x58], rax
lea rax, [rbp + 0x840]
mov qword [rbp - 0x50], rax
lea rax, [rbp + 0x840]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x420]
mov qword [rsp + 0x38], rcx
lea rcx, [0x100422050]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.100401b20
lea r8, [rbp - 0x78]
mov rcx, rsi
lea edx, [rbx + 6]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x10040ac99
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x10040ac17
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [rbp - 0x78]
mov edx, 6
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x10040abe4
jmp 0x10040ac99
call qword [sym.imp.KERNEL32.dll_GetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], rdi
mov r9d, 0x400
mov ebx, eax
mov dword [rsp + 0x28], 0x400
lea rax, [rbp + 0x1450]
mov r8d, ebx
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
lea r9, str.Unable_to_start_service
mov edx, 1
lea rcx, [0x100422050]
test eax, eax
je 0x10040ac89
lea rax, [rbp + 0x1450]
mov qword [rsp + 0x28], rax
lea r8, str._s_0x_x____ls
mov dword [rsp + 0x20], ebx
call fcn.100401b20
jmp 0x10040ac99
lea r8, str._s_0x_x
mov dword [rsp + 0x20], ebx
call fcn.100401b20
xor eax, eax
mov ebx, edi
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov dword [rbp - 0x80], eax
nop dword [rax]
nop dword [rax + rax]
lea rax, [rsp + 0x54]
mov dword [rsp + 0x54], edi
mov r9d, 0x24
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x10040ad27
mov ecx, dword [rsp + 0x64]
cmp ecx, 0x10
ja 0x10040adc0
mov eax, 0x10014
bt eax, ecx
jae 0x10040adc0
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
lea ecx, [rax + 0x64]
mov qword [rsp + 0x78], rax
mov dword [rbp - 0x80], eax
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10040acc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x10040ad3c
movzx ebx, ax
or ebx, 0x80070000
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
mov r9d, 0x400
mov edi, eax
mov qword [rsp + 0x30], rdx
lea rax, [rbp + 0x1450]
mov dword [rsp + 0x28], 0x400
mov r8d, edi
mov qword [rsp + 0x20], rax
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
lea r9, str.Unable_to_query_service_state
mov edx, 1
lea rcx, [0x100422050]
test eax, eax
je 0x10040ada8
lea rax, [rbp + 0x1450]
mov qword [rsp + 0x28], rax
lea r8, str._s_0x_x____ls
mov dword [rsp + 0x20], edi
call fcn.100401b20
jmp 0x10040adb8
lea r8, str._s_0x_x
mov dword [rsp + 0x20], edi
call fcn.100401b20
test ebx, ebx
jne 0x10040ae00
mov ecx, dword [rsp + 0x64]
mov eax, dword [rsp + 0x74]
lea r9, [r13 + 6]
mov dword [rsp + 0x40], eax
lea r8, str.Remote_dump_on__s_completed_with_status__X__state__X__exitCode__X__process__d__step__d_
mov eax, dword [rsp + 0x7c]
mov edx, 2
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x28], ecx
lea rcx, [0x100422050]
mov dword [rsp + 0x20], eax
call fcn.100401b20
test rsi, rsi
je 0x10040a6c0
jmp 0x10040ae5e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x10040ae20
movzx ebx, ax
or ebx, 0x80070000
lea rdx, str.Unable_to_locate_specific_SQLDUMPER_service
jmp 0x10040ae59
lea rdx, str.Unable_to_construct_launch_parameter
jmp 0x10040ae59
mov ebx, 0x80004005
lea rdx, str.Unable_to_serialize_guid
jmp 0x10040ae59
lea rdx, str.Unable_to_prepare_dumper_flags
jmp 0x10040ae59
lea rdx, str.Instance_name_too_long
jmp 0x10040ae59
lea rdx, str.Service_name_too_long
call fcn.10040a220
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rsi, rsi
je 0x10040ae98
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10040ae98
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x10040ae8c
movzx ebx, ax
or ebx, 0x80070000
lea rdx, str.Unable_to_open_SCM_on_remote_box
call fcn.10040a220
test ebx, ebx
je 0x10040aea6
or dword [0x100422040], 0x20008000
mov rcx, qword [rbp + 0x1c50]
xor rcx, rsp
call fcn.1004119e0
mov rbx, qword [rsp + 0x1db0]
add rsp, 0x1d60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret