Function at 0x1004028b0
Capabilities:
Acquire debug privileges
Create thread
Delete file
Get system information on windows
Terminate process

Disassembly:
push rbp
lea rbp, [rsp - 0x2080]
mov eax, 0x2180
call fcn.100412d40
sub rsp, rax
mov rax, qword [0x100422010]
xor rax, rsp
mov qword [rbp + 0x2040], rax
movups xmm0, xmmword [0x100414930]
mov qword [rsp + 0x2178], rsi
lea r9, [0x10044c038]
mov qword [rsp + 0x2170], rdi
mov rsi, rdx
mov qword [rsp + 0x2160], r13
lea rdi, [0x1004276d0]
mov qword [rsp + 0x2158], r14
xor edx, edx
movsxd r14, ecx
lea rcx, [0x10044c040]
mov qword [rsp + 0x2150], r15
mov r15d, r8d
xor r8d, r8d
mov qword [rsp + 0x70], rdi
movups xmmword [0x10044c040], xmm0
call qword [sym.imp.ADVAPI32.dll_EventRegister]
test eax, eax
jne 0x10040294b
mov eax, 1
xchg byte [0x10044c034], al
movzx eax, byte [0x10044c034]
test al, al
je 0x100402992
lea r9, str.SQLDumper.exe_starting
mov edx, 0x400
lea r8, str._SQL_Dumper:__s
lea rcx, [rbp + 0x840]
call fcn.100401090
test eax, eax
js 0x100402992
mov rcx, qword [0x10044c038]
lea r9, [rbp + 0x840]
xor r8d, r8d
mov dl, 1
call qword [sym.imp.ADVAPI32.dll_EventWriteString]
lea rax, str.Command_Arguments:
mov qword [rsp + 0x21a0], rbx
xor r13d, r13d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], 0x200
lea r8, [rsp + 0x40]
mov qword [rsp + 0x40], r13
mov edx, 0x400
mov qword [rsp + 0x48], r13
lea rcx, [rbp + 0x1040]
call fcn.100401160
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x100402a7a
mov qword [rsp + 0x2168], r12
mov ebx, 1
lea r12, [0x100414908]
cmp rbx, r14
jge 0x100402a36
mov rax, qword [rsi + rbx*8]
lea r9, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0x200
call fcn.100401160
mov rcx, qword [rsp + 0x40]
inc rbx
test rcx, rcx
jne 0x1004029f8
jmp 0x100402a6b
test rcx, rcx
je 0x100402a6b
mov rax, qword [rsi]
lea r9, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, str.._tCommand:__s.
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x200
call fcn.100401160
mov r12, qword [rsp + 0x2168]
lea rdi, [0x1004276d0]
movzx eax, byte [0x10044c034]
test al, al
je 0x100402ac1
lea r9, [rbp + 0x1040]
mov edx, 0x400
lea r8, str._SQL_Dumper:__s
lea rcx, [rbp + 0x1840]
call fcn.100401090
test eax, eax
js 0x100402ac1
mov rcx, qword [0x10044c038]
lea r9, [rbp + 0x1840]
xor r8d, r8d
mov dl, 5
call qword [sym.imp.ADVAPI32.dll_EventWriteString]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x58]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100402b6d
lea r8, [rbp + 0x824]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x100402b60
mov rcx, qword [rsp + 0x58]
lea r8, [rbp + 0x820]
mov qword [rsp + 0x28], r13
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], r13
mov dword [rbp + 0x820], 1
mov dword [rbp + 0x82c], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x100402b3f
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x100402b60
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.AdjustTokenPrivileges____completed_with_status___08x_
mov edx, 2
mov r9d, eax
lea rcx, [0x100422050]
call fcn.100401b20
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100402b8e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.OpenProcessToken____failed___08x_
mov edx, 1
mov r9d, eax
lea rcx, [0x100422050]
call fcn.100401b20
call fcn.10040e540
lea rcx, [0x1004276e0]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r8, rsi
mov edx, r14d
call fcn.100404860
mov r14, qword [rsp + 0x2158]
mov rsi, qword [rsp + 0x2178]
test eax, eax
je 0x100402bef
call fcn.100405d50
test eax, eax
je 0x100402bef
mov edx, r15d
call fcn.100404390
test eax, eax
jne 0x100402bef
call fcn.1004051b0
mov ecx, dword [0x1004276d0]
test eax, eax
mov edx, 3
cmovne ecx, edx
mov dword [0x1004276d0], ecx
cmp dword [0x10044bfd8], r13d
mov r15, qword [rsp + 0x2150]
je 0x100402db9
test byte [0x10044bda4], 0x20
je 0x100402db9
test dword [0x100427d40], 0x40000
jne 0x100402db9
cmp word [0x10044bdc4], r13w
jne 0x100402ccb
lea rbx, [0x10044bdc4]
mov edx, 0x105
lea r8, str.SQLDump_manual_
mov rcx, rbx
sub r8, rbx
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffef9]
test rax, rax
je 0x100402c73
movzx eax, word [r8 + rcx]
test ax, ax
je 0x100402c73
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x100402c50
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
lea rcx, [rbp + 0x830]
mov word [rax], r13w
call qword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
jne 0x100402ccb
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], r13
lea rcx, [rbp + 0x830]
call qword [sym.imp.RPCRT4.dll_UuidToStringW]
test eax, eax
jne 0x100402ccb
mov r8, qword [rsp + 0x50]
mov edx, 0x105
mov rcx, rbx
call fcn.1004016a0
lea rcx, [rsp + 0x50]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x10044bfe8], rax
test rax, rax
je 0x100402d8e
mov eax, dword [0x10044bfd8]
mov ebx, r13d
mov dword [0x10044bfe4], eax
test eax, eax
je 0x100402db9
nop dword [rax]
nop dword [rax + rax]
lea rax, [rsp + 0x60]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x10040aee0]
xor edx, edx
mov dword [rsp + 0x20], r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x100402d82
mov eax, 0xffffffff
lock xadd dword [0x10044bfe4], eax
cmp eax, 1
jne 0x100402d57
mov rcx, qword [0x10044bfe8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
or dword [0x100422040], 0x20008000
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.Unable_to_create_thread_for_remote_dump_launch___d_.
mov edx, 1
mov r9d, eax
lea rcx, [0x100422050]
call fcn.100401b20
inc ebx
cmp ebx, dword [0x10044bfd8]
jb 0x100402d10
jmp 0x100402db9
or dword [0x100422040], 0x20008000
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.Unable_to_create_event_for_remote_dump_launch___d_.
mov edx, 1
mov r9d, eax
lea rcx, [0x100422050]
call fcn.100401b20
call fcn.100406460
mov byte [0x1004264a0], r13b
call fcn.100407ab0
mov rcx, qword [0x100427d38]
mov r13, qword [rsp + 0x2160]
mov rdi, qword [rsp + 0x2170]
mov rbx, qword [rsp + 0x21a0]
cmp rcx, 0xffffffffffffffff
je 0x100402e16
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1004276d0], 5
mov qword [0x100427d38], 0xffffffffffffffff
jae 0x100402e16
lea rcx, [0x100427924]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.100407240
lea rcx, [0x100422050]
mov edx, 2
test eax, eax
je 0x100402e43
lea r8, str.Watson_Invoke:_Yes
call fcn.100401b20
lea rcx, [rsp + 0x70]
call fcn.10040c4f0
jmp 0x100402e4f
lea r8, str.Watson_Invoke:_No
call fcn.100401b20
call fcn.100406fb0
test dword [0x100427d40], 0x2000
je 0x100402e64
xor edx, edx
jmp 0x100402e75
test dword [0x100427d40], 0x800000
je 0x100402e7a
mov edx, 1
call fcn.100407ca0
mov rax, qword [0x10044bfe8]
test rax, rax
je 0x100402edc
nop word [rax + rax]
mov edx, 0xea60
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100402ecf
mov r9d, dword [0x10044bfe4]
lea r8, str._d_instances_of_remote_dump_are_sill_in_progress.
mov edx, 2
lea rcx, [0x100422050]
call fcn.100401b20
mov rax, qword [0x10044bfe8]
test rax, rax
jne 0x100402e90
jmp 0x100402edc
mov rcx, qword [0x10044bfe8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x10044c010]
test rcx, rcx
je 0x100402f3c
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x100402f00
lea rdx, str.Unable_to_set_service_thread_event
call fcn.10040a220
jmp 0x100402f3c
mov rcx, qword [0x10044c018]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100402f22
lea rdx, str.Unable_to_complete_wait_for_service_thread
call fcn.10040a220
mov rcx, qword [0x10044c018]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x10044c010]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test dword [0x100427d40], 0x200
je 0x100402f55
xor edx, edx
mov ecx, 0x3a98
call qword [sym.imp.KERNEL32.dll_SleepEx]
mov dl, 1
lea rcx, str.SQLDumper.exe_ending
call fcn.100401400
call fcn.100401480
mov ecx, dword [0x100422040]
call qword [sym.imp.KERNEL32.dll_ExitProcess]