Function at 0x41ccf0
Capabilities:
Get system information on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x778
push edi
mov eax, dword [str.main]
mov dword [ebp - 0x234], eax
mov ecx, dword [0x43e474]
mov dword [ebp - 0x230], ecx
mov dx, word [0x43e478]
mov word [ebp - 0x22c], dx
mov ax, word [0x4494e4]
mov word [ebp - 0x658], ax
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x656]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov cx, word [0x4494ec]
mov word [ebp - 0x76c], cx
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x76a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dx, word [0x4494f4]
mov word [ebp - 0x210], dx
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ax, word [0x4494fc]
mov word [ebp - 0x104], ax
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x102]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 4], 0
mov dword [ebp - 0x65c], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x664], 0
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x774], 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x224], 0x43e49c
mov dword [ebp - 0x220], 0x42eec5
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x660], 0
mov dword [ebp - 0x770], 0
call dword [sym.imp.SQLUNIRL.dll__GetUnicodeRedirectionLayer_0]
mov dword [0x449ba0], eax
mov dword [0x448b28], 1
push 0x1ad4
push 0
push 0x449e60
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [0x448b1c], 0
mov ecx, dword [0x448b1c]
mov dword [0x448b20], ecx
push 0
mov edx, dword [0x449ba0]
call dword [edx + 0x224]
mov dword [0x4492a8], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push eax
push 0x449ba4
push 0x4492ac
mov eax, dword [0x4492a8]
push eax
call dword [sym.imp.SQLRESLD.dll_SQLUILoadResourceDLL]
add esp, 0x10
test eax, eax
jne 0x41ce95
xor eax, eax
jmp 0x41d826
mov dword [ebp - 0x108], 0x10
lea ecx, [ebp - 0x108]
push ecx
push 0x448d5c
call dword [sym.imp.SQLUNIRL.dll__GetComputerName_8]
push 0
push 0
push 0
push 1
call fcn.0042f75e
add esp, 0x10
mov dword [0x448b1c], eax
mov dword [0x448b20], 0
push 0x200
lea edx, [ebp - 0x658]
push edx
push 0x12
mov eax, dword [0x4492ac]
push eax
call dword [sym.imp.SQLUNIRL.dll__LoadString_16]
push 0x43e4bc
push 0x43e4d0
lea ecx, [ebp - 0x658]
push ecx
call dword [sym.imp.MSVCRT.dll_wprintf]
add esp, 0xc
push 0x449d40
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x449d20
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x449d00
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x449ce0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x449cc0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x449ca0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x449c80
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x449c60
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x449c40
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x449c20
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x449c00
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x449be0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x449bc0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
cmp dword [0x448b1c], 0
jne 0x41cfa6
push 1
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea edx, [ebp - 0x258]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x244]
mov dword [0x448b50], eax
mov dword [0x449ba8], 0
push 1
push 0x449b20
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x41d01f
push 0
push 0
push 1
push 0x449b20
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x41d018
mov dword [0x449b40], 0xc
mov dword [0x449b44], 0x449b20
mov dword [0x449b48], 0
mov dword [0x449ba8], 0x449b40
jmp 0x41d01d
jmp 0x41d3fb
jmp 0x41d024
jmp 0x41d3fb
call dword [sym.imp.SQLSVC.dll_SQLSvcInit]
test eax, eax
jne 0x41d033
jmp 0x41d3fb
cmp dword [0x448b1c], 0
jne 0x41d07b
push str.KERNEL32.DLL
call dword [sym.imp.SQLUNIRL.dll__LoadLibrary_4]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
je 0x41d07b
push str.TryEnterCriticalSection
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.SQLUNIRL.dll__GetProcAddress__8]
mov dword [0x4492b4], eax
cmp dword [0x4492b4], 0
jne 0x41d07b
jmp 0x41d3fb
push 1
call fcn.0042040a
add esp, 4
mov dword [0x4494dc], eax
cmp dword [0x4494d8], 2
jne 0x41d0cb
cmp dword [0x4494dc], 0
jne 0x41d0cb
push 0x200
lea edx, [ebp - 0x658]
push edx
push 0x78
mov eax, dword [0x4492ac]
push eax
call dword [sym.imp.SQLUNIRL.dll__LoadString_16]
lea ecx, [ebp - 0x658]
push ecx
call dword [sym.imp.MSVCRT.dll_wprintf]
add esp, 4
jmp 0x41d3fb
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x76c]
push eax
push 0x448b4c
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0041d82b
add esp, 0x14
test eax, eax
jne 0x41d0f7
jmp 0x41d3fb
mov eax, dword [0x448b4c]
and eax, 0x20
cmp eax, 0x20
jne 0x41d119
cmp dword [0x448b20], 0
jne 0x41d119
mov dword [ebp - 0x778], 0
jmp 0x41d123
mov dword [ebp - 0x778], 1
mov ecx, dword [ebp - 0x778]
mov dword [0x448b2c], ecx
mov edx, dword [ebp - 0x210]
and edx, 0xffff
neg edx
sbb edx, edx
lea eax, [ebp - 0x210]
and edx, eax
push edx
mov ecx, dword [ebp - 0x76c]
and ecx, 0xffff
neg ecx
sbb ecx, ecx
lea edx, [ebp - 0x76c]
and ecx, edx
push ecx
push 0x449e60
call fcn.0042b980
add esp, 0xc
mov eax, dword [0x448b4c]
and eax, 1
test eax, eax
jne 0x41d18c
cmp dword [0x448b1c], 0
jne 0x41d18c
call dword [sym.imp.KERNEL32.dll_AllocConsole]
mov dword [ebp - 4], eax
cmp dword [0x448b1c], 0
jne 0x41d1a5
push 0
push 0x3ff
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
mov dword [ebp - 4], eax
push 0x104
push 0x448b54
push 0
call dword [sym.imp.SQLUNIRL.dll__GetModuleFileName_12]
push 0x448b54
call fcn.00421176
add esp, 4
push 0xa
push 0xb5c
push 0x449e40
call dword [sym.imp.SQLSVC.dll_SHRecMemInit]
add esp, 0xc
push 0xa
push 0xd08
push 0x449e20
call dword [sym.imp.SQLSVC.dll_SHRecMemInit]
add esp, 0xc
push 8
push 0x56c
push 0x449e00
call dword [sym.imp.SQLSVC.dll_SHRecMemInit]
add esp, 0xc
push 0xa
push 0x14
push 0x449de0
call dword [sym.imp.SQLSVC.dll_SHRecMemInit]
add esp, 0xc
push 0xa
push 0x24
push 0x449dc0
call dword [sym.imp.SQLSVC.dll_SHRecMemInit]
add esp, 0xc
push 5
push 0x28
push 0x449da0
call dword [sym.imp.SQLSVC.dll_SHRecMemInit]
add esp, 0xc
push 0xa
push 0x104
push 0x449d80
call dword [sym.imp.SQLSVC.dll_SHRecMemInit]
add esp, 0xc
push 0xa
push 0x59c
push 0x449d60
call dword [sym.imp.SQLSVC.dll_SHRecMemInit]
add esp, 0xc
mov ecx, dword [0x448b4c]
and ecx, 1
test ecx, ecx
jne 0x41d361
push str.MSSQLSERVER
call fcn.00420f80
add esp, 4
test eax, eax
je 0x41d291
mov dword [ebp - 0x224], 0x43e53c
jmp 0x41d2ad
push str.MSSQLSERVER
push 0x448f84
call fcn.00420fc0
add esp, 8
mov dword [ebp - 0x224], 0x448f84
lea edx, [ebp - 0x224]
push edx
call fcn.0042ec10
add esp, 4
test eax, eax
je 0x41d2cf
mov dword [0x43e460], 0
jmp 0x41d35f
cmp dword [ebp + 8], 1
jne 0x41d307
push 0x200
lea eax, [ebp - 0x658]
push eax
push 0xf
mov ecx, dword [0x4492ac]
push ecx
call dword [sym.imp.SQLUNIRL.dll__LoadString_16]
push 0x43e55c
lea edx, [ebp - 0x658]
push edx
call dword [sym.imp.MSVCRT.dll_wprintf]
add esp, 8
jmp 0x41d35f
push 0x200
lea eax, [ebp - 0x658]
push eax
push 0x10
mov ecx, dword [0x4492ac]
push ecx
call dword [sym.imp.SQLUNIRL.dll__LoadString_16]
call dword [sym.imp.KERNEL32.dll_GetLastError]
and eax, 0xffff
push eax
lea edx, [ebp - 0x658]
push edx
call dword [sym.imp.MSVCRT.dll_wprintf]
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
and eax, 0xffff
push eax
push 1
push 2
push 0xc0000064
push 1
push 1
call fcn.0041b0dc
add esp, 0x18
jmp 0x41d3d2
call fcn.0041dcdf
test eax, eax
jne 0x41d36f
jmp 0x41d3fb
push 0x43e57c
push 0x5e
push 0
push 4
call fcn.0041b8d1
add esp, 0x10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push 1
push 0x41f42f
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
call fcn.0041e21f
test eax, eax
je 0x41d3d2
call fcn.0041f0a4
test eax, eax
je 0x41d3d2
push 0xffffffffffffffff
mov eax, dword [0x44b940]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.004025da
push 0xf
call fcn.0040fd71
add esp, 4
mov dword [0x43e460], 0
call fcn.0041ff81
lea ecx, [ebp - 0x104]
push ecx
call fcn.00426ca2
add esp, 4
test eax, eax
je 0x41d3fb
push 1
lea edx, [ebp - 0x104]
push edx
call fcn.004234a8
add esp, 8
call fcn.00410106
cmp dword [0x44b950], 0
je 0x41d415
mov eax, dword [0x44b950]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [0x4492a4], 0
je 0x41d42b
mov ecx, dword [0x4492a4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x448b40], 0
jne 0x41d7c0
cmp dword [0x448b1c], 0
je 0x41d44e
push 0x449c60
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x41d48f
push 0x449c60
call dword [0x4492b4]
test eax, eax
jne 0x41d48f
cmp dword [0x448b20], 0
je 0x41d484
cmp dword [0x44b6e0], 0
je 0x41d484
lea edx, [ebp - 0x234]
push edx
push 0x43e59c
call dword [sym.imp.MSVCRT.dll_wprintf]
add esp, 8
push 0x449c60
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x448b20], 0
je 0x41d4b6
cmp dword [0x44b6e0], 0
je 0x41d4b6
lea eax, [ebp - 0x234]
push eax
push 0x43e5d8
call dword [sym.imp.MSVCRT.dll_wprintf]
add esp, 8
mov dword [ebp - 0x660], 0
jmp 0x41d4d1
mov ecx, dword [ebp - 0x660]
add ecx, 1
mov dword [ebp - 0x660], ecx
mov edx, dword [ebp - 0x660]
cmp edx, dword [0x449e48]
jge 0x41d534
mov dword [ebp - 0x774], 0
mov eax, dword [ebp - 0x660]
push eax
push 0x449e40
call dword [sym.imp.SQLSVC.dll_SHRecMemLock]
add esp, 8
mov dword [ebp - 0x774], eax
cmp dword [ebp - 0x774], 0
je 0x41d532
mov ecx, dword [ebp - 0x774]
cmp dword [ecx + 0x2a8], 0
je 0x41d532
mov edx, dword [ebp - 0x774]
add edx, 0x2a0
push edx
call dword [sym.imp.SQLSVC.dll_SHRecMemFree]
add esp, 4
jmp 0x41d4c2
push 0x449c60
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x448b20], 0
je 0x41d566
cmp dword [0x44b6e0], 0
je 0x41d566
lea eax, [ebp - 0x234]
push eax
push 0x43e60c
call dword [sym.imp.MSVCRT.dll_wprintf]
add esp, 8
push 0x449de0
call dword [sym.imp.SQLSVC.dll_SHRecMemFree]
add esp, 4
push 0x449e40
call dword [sym.imp.SQLSVC.dll_SHRecMemFree]
add esp, 4
push 0x449e20
call dword [sym.imp.SQLSVC.dll_SHRecMemFree]
add esp, 4
push 0x449e00
call dword [sym.imp.SQLSVC.dll_SHRecMemFree]
add esp, 4
push 0x449dc0
call dword [sym.imp.SQLSVC.dll_SHRecMemFree]
add esp, 4
push 0x449da0
call dword [sym.imp.SQLSVC.dll_SHRecMemFree]
add esp, 4
push 0x449d80
call dword [sym.imp.SQLSVC.dll_SHRecMemFree]
add esp, 4
push 0x449d60
call dword [sym.imp.SQLSVC.dll_SHRecMemFree]
add esp, 4
mov dword [ebp - 0x660], 0
jmp 0x41d5f1
mov ecx, dword [ebp - 0x660]
add ecx, 1
mov dword [ebp - 0x660], ecx
cmp dword [ebp - 0x660], 0x11
jge 0x41d620
mov edx, dword [ebp - 0x660]
cmp dword [edx*4 + 0x44b940], 0
je 0x41d61e
mov eax, dword [ebp - 0x660]
mov ecx, dword [eax*4 + 0x44b940]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41d5e2
mov edx, dword [0x4494c8]
mov dword [ebp - 0x664], edx
cmp dword [ebp - 0x664], 0
je 0x41d649
mov eax, dword [0x4494c8]
push eax
push 0x61
push 0
push 1
call fcn.0041b8d1
add esp, 0x10
call fcn.00420be4
mov ecx, dword [ebp - 0x664]
or ecx, eax
mov dword [ebp - 0x664], ecx
cmp dword [0x448b20], 0
jne 0x41d66e
cmp dword [ebp - 0x664], 0
je 0x41d6b2
mov edx, dword [0x4494cc]
push edx
push 0x60
push 0
push 3
call fcn.0041b8d1
add esp, 0x10
mov eax, dword [0x4494d0]
push eax
push 0x134
push 0
push 3
call fcn.0041b8d1
add esp, 0x10
mov ecx, dword [0x4494d4]
push ecx
push 0x135
push 0
push 3
call fcn.0041b8d1
add esp, 0x10
push 0x449d20
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x449d00
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x449ce0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x449cc0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x449ca0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x449c80
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x449c60
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x449c40
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x449c20
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x449c00
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x449be0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x449bc0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call dword [sym.imp.SQLSVC.dll_SQLSvcExit]
push 0x200
lea edx, [ebp - 0x658]
push edx
push 0xf2
mov eax, dword [0x4492ac]
push eax
call dword [sym.imp.SQLUNIRL.dll__LoadString_16]
lea ecx, [ebp - 0x658]
push ecx
push 0x43e640
push 0x62
push 0
push 4
call fcn.0041b8d1
add esp, 0x14
call fcn.00419797
mov edx, dword [0x4494dc]
push edx
call fcn.00420baa
add esp, 4
push 0x4492ac
mov eax, dword [0x4492a8]
push eax
call dword [sym.imp.SQLRESLD.dll_SQLUIUnloadResourceDLL]
add esp, 8
cmp dword [ebp - 0x214], 0
je 0x41d7b1
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [0x43e460]
push edx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x200
lea eax, [ebp - 0x658]
push eax
push 0xf3
mov ecx, dword [0x4492ac]
push ecx
call dword [sym.imp.SQLUNIRL.dll__LoadString_16]
lea edx, [ebp - 0x658]
push edx
push 0x43e660
push 0x62
push 0
push 2
call fcn.0041b8d1
add esp, 0x14
cmp dword [0x44929c], 0
je 0x41d80d
mov eax, dword [0x44929c]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [0x43e460]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [0x43e460]
pop edi
mov esp, ebp
pop ebp
ret