Function at 0x40be40
Capabilities:
Query service status
Start service

Disassembly:
mov eax, 0x1ce0
call fcn.00415f70
mov eax, dword [0x429008]
xor eax, esp
mov dword [esp + 0x1cdc], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1cf0]
xor ebp, ebp
push edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], esi
lea ebx, [esi + 6]
push 0xf0000
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [esp + 0x20], eax
test eax, eax
je 0x40c797
mov eax, dword [0x41d4ec]
movups xmm0, xmmword [str.SQLDUMPER_]
mov dword [esp + 0x8b8], eax
mov ax, word [0x41d4f0]
push 0x3fc
mov word [esp + 0x8c0], ax
lea eax, [esp + 0x8c2]
push 0
push eax
movups xmmword [esp + 0x8b4], xmm0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ebx, [esi + 0x316]
push 0x5c
push ebx
call dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 8
test eax, eax
je 0x40bee3
lea ebx, [eax + 2]
mov ecx, 0x209
lea eax, [esp + 0x8a8]
nop
cmp word [eax], 0
je 0x40befe
add eax, 2
sub ecx, 1
jne 0x40bef0
mov eax, 0x209
mov edi, ecx
sub eax, ecx
mov esi, 0x80070057
neg edi
sbb edi, edi
and edi, eax
xor eax, eax
test ecx, ecx
cmovne esi, eax
je 0x40bf69
mov edx, 0x209
lea ecx, [esp + 0x8a8]
lea ecx, [ecx + edi*2]
sub edx, edi
je 0x40bf50
mov edi, ebx
mov eax, SysReAllocString
sub edi, ecx
test eax, eax
je 0x40bf50
movzx esi, word [edi + ecx]
test si, si
je 0x40bf50
mov word [ecx], si
dec eax
add ecx, 2
sub edx, 1
jne 0x40bf37
test edx, edx
lea eax, [ecx - 2]
mov esi, 0x8007007a
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
xor eax, eax
test edx, edx
cmovne esi, eax
test esi, esi
jne 0x40c70d
mov esi, dword [esp + 0x20]
lea eax, [esp + 0x8a8]
push 0x80000010
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebp, eax
test ebp, ebp
jne 0x40bfaa
push 0x80000010
push str.SQLDUMPER
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebp, eax
test ebp, ebp
je 0x40c4f1
mov eax, dword [0x419054]
mov dword [esp + 0x14], eax
mov eax, dword [0x41d598]
mov dword [esp + 0xcc0], eax
mov ax, word [0x41d59c]
push 0x40c
mov word [esp + 0xcc8], ax
lea eax, [esp + 0xcca]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0xcc0]
mov ecx, 0x209
cmp word [eax], 0
je 0x40bffe
add eax, 2
sub ecx, 1
jne 0x40bff0
mov eax, 0x209
mov edi, ecx
sub eax, ecx
mov esi, 0x80070057
neg edi
sbb edi, edi
and edi, eax
xor eax, eax
test ecx, ecx
cmovne esi, eax
je 0x40c067
mov edx, 0x209
lea ecx, [esp + 0xcc0]
lea ecx, [ecx + edi*2]
sub edx, edi
je 0x40c04e
mov eax, SysReAllocString
sub ebx, ecx
test eax, eax
je 0x40c04e
movzx esi, word [ebx + ecx]
test si, si
je 0x40c04e
mov word [ecx], si
dec eax
add ecx, 2
sub edx, 1
jne 0x40c035
test edx, edx
lea eax, [ecx - 2]
mov esi, 0x8007007a
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
xor eax, eax
test edx, edx
cmovne esi, eax
test esi, esi
jne 0x40c6b3
mov ebx, dword [esp + 0x24]
lea eax, [esp + 0x68]
push dword [ebx + 0xe7e8]
push dword [ebx + 0xf308]
push str._X:_X
push 0x20
push eax
call fcn.00401fd0
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x40c653
movups xmm0, xmmword [str._remoteservers:remoteinvoke:]
mov ax, word [0x41d648]
push 0x7c6
movups xmmword [esp + 0x10dc], xmm0
mov word [esp + 0x1114], ax
lea eax, [esp + 0x1116]
movups xmm0, xmmword [0x41d620]
push esi
push eax
movups xmmword [esp + 0x10f4], xmm0
movups xmm0, xmmword [0x41d630]
movups xmmword [esp + 0x1104], xmm0
movq xmm0, qword [0x41d640]
movq qword [esp + 0x1114], xmm0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x18], esi
lea eax, [esp + 0x18]
push eax
lea eax, [ebx + 0x2dca0]
push eax
call dword [sym.imp.rpcrt4.dll_UuidToStringW]
test eax, eax
jne 0x40c5ee
mov ecx, 0x400
lea eax, [esp + 0x10d8]
nop dword [eax]
cmp word [eax], 0
je 0x40c13e
add eax, 2
sub ecx, 1
jne 0x40c130
mov eax, 0x400
mov edi, ecx
sub eax, ecx
mov esi, 0x80070057
neg edi
sbb edi, edi
and edi, eax
xor eax, eax
test ecx, ecx
cmovne esi, eax
je 0x40c1b2
mov edx, 0x400
lea ecx, [esp + 0x10d8]
lea ecx, [ecx + edi*2]
sub edx, edi
je 0x40c199
mov edi, dword [esp + 0x18]
mov eax, SysReAllocString
sub edi, ecx
nop dword [eax]
test eax, eax
je 0x40c199
movzx esi, word [edi + ecx]
test si, si
je 0x40c199
mov word [ecx], si
dec eax
add ecx, 2
sub edx, 1
jne 0x40c180
test edx, edx
lea eax, [ecx - 2]
mov esi, 0x8007007a
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
xor eax, eax
test edx, edx
cmovne esi, eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.rpcrt4.dll_RpcStringFreeW]
test esi, esi
jne 0x40c58e
mov eax, dword [ebx + 0x2dc98]
and eax, 0xffffffde
push eax
mov eax, dword [esp + 0x20]
movzx eax, word [eax + 4]
push eax
push dword [ebx + 0x2dcb0]
lea eax, [ebx + 0x2dcb4]
push dword [ebx + 0xe82c]
push eax
push str._s_X_d_d_d
lea eax, [esp + 0x18f0]
push 0x208
push eax
call fcn.00401fd0
mov esi, eax
add esp, 0x20
test esi, esi
jne 0x40c58e
mov ecx, 0x400
lea eax, [esp + 0x10d8]
nop dword [eax + eax]
cmp word [eax], 0
je 0x40c22e
add eax, 2
sub ecx, 1
jne 0x40c220
mov eax, 0x400
mov edi, ecx
sub eax, ecx
mov esi, 0x80070057
neg edi
sbb edi, edi
and edi, eax
xor eax, eax
test ecx, ecx
cmovne esi, eax
je 0x40c2a2
mov edx, 0x400
lea ecx, [esp + 0x10d8]
lea ecx, [ecx + edi*2]
sub edx, edi
je 0x40c289
lea edi, [esp + 0x18d8]
mov eax, SysReAllocString
sub edi, ecx
nop dword [eax]
test eax, eax
je 0x40c289
movzx esi, word [edi + ecx]
test si, si
je 0x40c289
mov word [ecx], si
dec eax
add ecx, 2
sub edx, 1
jne 0x40c270
test edx, edx
lea eax, [ecx - 2]
mov esi, 0x8007007a
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
xor eax, eax
test edx, edx
cmovne esi, eax
test esi, esi
jne 0x40c58e
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 0x14]
mov dword [esp + 0x50], eax
add ebx, 6
mov dword [esp + 0x54], eax
lea eax, [esp + 0xcc0]
mov dword [esp + 0x58], eax
lea eax, [esp + 0x68]
mov dword [esp + 0x60], eax
lea eax, [esp + 0x10d8]
push eax
mov dword [esp + 0x68], eax
lea eax, [esp + 0x6c]
push eax
push str._SMSSQLSERVER
lea eax, [esp + 0xccc]
mov dword [esp + 0x68], str._SMSSQLSERVER
push eax
lea eax, [esp + 0x24]
push eax
push eax
push ebx
push str.Remote_dump_on__s_invoked_with_parameters__s__s__s__s__s__s
push 2
push 0x429048
call fcn.00404d90
add esp, 0x28
lea eax, [esp + 0x50]
push eax
push 6
push ebp
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x40c3c2
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x420
jne 0x40c350
push 0x64
call dword [sym.imp.kernel32.dll_Sleep]
lea eax, [esp + 0x50]
push eax
push 6
push ebp
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x40c327
jmp 0x40c3c2
call dword [sym.imp.kernel32.dll_GetLastError]
call dword [sym.imp.kernel32.dll_GetLastError]
push 0
push 0x400
mov esi, eax
lea eax, [esp + 0xb0]
push eax
push 0x400
push esi
push 0
push 0x1000
call dword [sym.imp.kernel32.dll_FormatMessageW]
test eax, eax
je 0x40c3a8
lea eax, [esp + 0xa8]
push eax
push esi
push str.Unable_to_start_service
push str._s_0x_x____ls
push 1
push 0x429048
call fcn.00404d90
add esp, 0x18
jmp 0x40c3c2
push esi
push str.Unable_to_start_service
push str._s_0x_x
push 1
push 0x429048
call fcn.00404d90
add esp, 0x14
xorps xmm0, xmm0
mov dword [esp + 0x4c], 0
movups xmmword [esp + 0x2c], xmm0
xor esi, esi
movups xmmword [esp + 0x3c], xmm0
nop dword [eax]
lea eax, [esp + 0x28]
mov dword [esp + 0x28], esi
push eax
push 0x24
lea eax, [esp + 0x34]
push eax
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x40c431
mov ecx, dword [esp + 0x30]
mov eax, ecx
sub eax, 2
je 0x40c416
sub eax, 2
je 0x40c416
sub eax, 0xc
jne 0x40c4ba
xorps xmm0, xmm0
mov dword [esp + 0x4c], esi
push 0x64
movups xmmword [esp + 0x30], xmm0
movups xmmword [esp + 0x40], xmm0
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x40c3e0
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40c446
movzx esi, si
or esi, 0x80070000
call dword [sym.imp.kernel32.dll_GetLastError]
push 0
push 0x400
mov edi, eax
lea eax, [esp + 0xb0]
push eax
push 0x400
push edi
push 0
push 0x1000
call dword [sym.imp.kernel32.dll_FormatMessageW]
test eax, eax
je 0x40c498
lea eax, [esp + 0xa8]
push eax
push edi
push str.Unable_to_query_service_state
push str._s_0x_x____ls
push 1
push 0x429048
call fcn.00404d90
add esp, 0x18
jmp 0x40c4b2
push edi
push str.Unable_to_query_service_state
push str._s_0x_x
push 1
push 0x429048
call fcn.00404d90
add esp, 0x14
test esi, esi
jne 0x40c4e0
mov ecx, dword [esp + 0x30]
push dword [esp + 0x40]
push dword [esp + 0x4c]
push dword [esp + 0x40]
push ecx
push dword [esp + 0x4c]
push ebx
push str.Remote_dump_on__s_completed_with_status__X__state__X__exitCode__X__process__d__step__d_
push 2
push 0x429048
call fcn.00404d90
add esp, 0x24
test ebp, ebp
jne 0x40c779
mov esi, dword [esp + 0x1c]
jmp 0x40be70
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40c506
movzx esi, si
or esi, 0x80070000
call dword [sym.imp.kernel32.dll_GetLastError]
push 0
push 0x400
mov edi, eax
lea eax, [esp + 0xb0]
push eax
push 0x400
push edi
push 0
push 0x1000
call dword [sym.imp.kernel32.dll_FormatMessageW]
test eax, eax
je 0x40c565
lea eax, [esp + 0xa8]
push eax
push edi
push str.Unable_to_locate_specific_SQLDUMPER_service
push str._s_0x_x____ls
push 1
push 0x429048
call fcn.00404d90
add esp, 0x18
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x40c818
push edi
push str.Unable_to_locate_specific_SQLDUMPER_service
push str._s_0x_x
push 1
push 0x429048
call fcn.00404d90
add esp, 0x14
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x40c818
call dword [sym.imp.kernel32.dll_GetLastError]
push 0
push 0x400
mov edi, eax
lea eax, [esp + 0xb0]
push eax
push 0x400
push edi
push 0
push 0x1000
call dword [sym.imp.kernel32.dll_FormatMessageW]
test eax, eax
je 0x40c5e3
lea eax, [esp + 0xa8]
push eax
push edi
push str.Unable_to_construct_launch_parameter
push str._s_0x_x____ls
push 1
push 0x429048
call fcn.00404d90
add esp, 0x18
jmp 0x40c779
push edi
push str.Unable_to_construct_launch_parameter
jmp 0x40c765
mov esi, 0x80004005
call dword [sym.imp.kernel32.dll_GetLastError]
push 0
push 0x400
mov edi, eax
lea eax, [esp + 0xb0]
push eax
push 0x400
push edi
push 0
push 0x1000
call dword [sym.imp.kernel32.dll_FormatMessageW]
test eax, eax
je 0x40c648
lea eax, [esp + 0xa8]
push eax
push edi
push str.Unable_to_serialize_guid
push str._s_0x_x____ls
push 1
push 0x429048
call fcn.00404d90
add esp, 0x18
jmp 0x40c779
push edi
push str.Unable_to_serialize_guid
jmp 0x40c765
call dword [sym.imp.kernel32.dll_GetLastError]
push 0
push 0x400
mov edi, eax
lea eax, [esp + 0xb0]
push eax
push 0x400
push edi
push 0
push 0x1000
call dword [sym.imp.kernel32.dll_FormatMessageW]
test eax, eax
je 0x40c6a8
lea eax, [esp + 0xa8]
push eax
push edi
push str.Unable_to_prepare_dumper_flags
push str._s_0x_x____ls
push 1
push 0x429048
call fcn.00404d90
add esp, 0x18
jmp 0x40c779
push edi
push str.Unable_to_prepare_dumper_flags
jmp 0x40c765
call dword [sym.imp.kernel32.dll_GetLastError]
push 0
push 0x400
mov edi, eax
lea eax, [esp + 0xb0]
push eax
push 0x400
push edi
push 0
push 0x1000
call dword [sym.imp.kernel32.dll_FormatMessageW]
test eax, eax
je 0x40c705
lea eax, [esp + 0xa8]
push eax
push edi
push str.Instance_name_too_long
push str._s_0x_x____ls
push 1
push 0x429048
call fcn.00404d90
add esp, 0x18
jmp 0x40c779
push edi
push str.Instance_name_too_long
jmp 0x40c765
call dword [sym.imp.kernel32.dll_GetLastError]
push 0
push 0x400
mov edi, eax
lea eax, [esp + 0xb0]
push eax
push 0x400
push edi
push 0
push 0x1000
call dword [sym.imp.kernel32.dll_FormatMessageW]
test eax, eax
je 0x40c75f
lea eax, [esp + 0xa8]
push eax
push edi
push str.Service_name_too_long
push str._s_0x_x____ls
push 1
push 0x429048
call fcn.00404d90
add esp, 0x18
jmp 0x40c779
push edi
push str.Service_name_too_long
push str._s_0x_x
push 1
push 0x429048
call fcn.00404d90
add esp, 0x14
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebp, ebp
je 0x40c818
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x40c818
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40c7ac
movzx esi, si
or esi, 0x80070000
call dword [sym.imp.kernel32.dll_GetLastError]
push 0
push 0x400
mov edi, eax
lea eax, [esp + 0xb0]
push eax
push 0x400
push edi
push 0
push 0x1000
call dword [sym.imp.kernel32.dll_FormatMessageW]
test eax, eax
je 0x40c7fe
lea eax, [esp + 0xa8]
push eax
push edi
push str.Unable_to_open_SCM_on_remote_box
push str._s_0x_x____ls
push 1
push 0x429048
call fcn.00404d90
add esp, 0x18
jmp 0x40c818
push edi
push str.Unable_to_open_SCM_on_remote_box
push str._s_0x_x
push 1
push 0x429048
call fcn.00404d90
add esp, 0x14
test esi, esi
je 0x40c826
or dword [0x429040], 0x20008000
mov ecx, dword [esp + 0x1cec]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00414600
add esp, 0x1ce0
ret 4