Function at 0x100436080
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0xc80
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov rax, qword [0x100499010]
xor rax, rsp
mov qword [rsp + 0xc70], rax
xor edx, edx
mov r8d, 0x400
lea rcx, [r11 - 0x418]
call sub.VCRUNTIME140.dll_memset
cmp dword [0x10049b778], 0
jle 0x1004360e4
nop dword [rax + rax]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x10049b778], 0
jg 0x1004360d0
mov rcx, qword [0x1004a9100]
test rcx, rcx
je 0x1004360f6
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [0x1004a9c88]
test rcx, rcx
je 0x100436108
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1004a9240], 0
jne 0x100436388
lea rcx, [0x1004a9210]
call qword [sym.imp.SQLSVC.dll_SHRecMemFree]
lea rcx, [0x1004a91b0]
call qword [sym.imp.SQLSVC.dll_SHRecMemFree]
lea rcx, [0x1004a91e0]
call qword [sym.imp.SQLSVC.dll_SHRecMemFree]
lea rcx, [0x1004a8ec0]
call qword [sym.imp.SQLSVC.dll_SHRecMemFree]
lea rcx, [0x1004a90a0]
call qword [sym.imp.SQLSVC.dll_SHRecMemFree]
lea rcx, [0x1004a9cc0]
call qword [sym.imp.SQLSVC.dll_SHRecMemFree]
lea rcx, [0x1004a92e0]
call qword [sym.imp.SQLSVC.dll_SHRecMemFree]
lea rcx, [0x1004a9c90]
call qword [sym.imp.SQLSVC.dll_SHRecMemFree]
lea rcx, [0x1004a9248]
call qword [sym.imp.SQLSVC.dll_SHRecMemFree]
lea rcx, [0x1004a9070]
call qword [sym.imp.SQLSVC.dll_SHRecMemFree]
xor edi, edi
cmp qword [0x1004a9178], rdi
je 0x1004361b6
lea rcx, [0x1004a9bb0]
call qword [sym.imp.SQLSVC.dll_FreeCrossServiceSA]
mov qword [0x1004a9178], rdi
cmp qword [0x1004a9b00], rdi
je 0x1004361d3
lea rcx, [0x1004a9b30]
call qword [sym.imp.SQLSVC.dll_FreeCrossServiceSA]
mov qword [0x1004a9b00], rdi
lea rbx, [0x1004a90e0]
mov esi, 0x11
nop
mov rcx, qword [rbx]
test rcx, rcx
je 0x1004361f1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], rdi
add rbx, 8
sub rsi, 1
jne 0x1004361e0
mov esi, dword [0x1004a96ec]
test esi, esi
je 0x100436216
mov r9d, esi
xor edx, edx
lea ecx, [rdx + 1]
lea r8d, [rdx + 0x61]
call fcn.100432180
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0x470]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x200
lea r8, [rsp + 0x70]
mov edx, 0xfe
mov rcx, qword [0x1004a90d8]
call qword [sym.imp.USER32.dll_LoadStringW]
call fcn.10044da70
cmp byte [rax + 0xa8], dil
je 0x100436332
lea rax, [rsp + 0x40]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], di
mov r8d, VariantTimeToDosDateTime
lea rdx, str.TraceMemory
lea rcx, [rsp + 0x40]
call fcn.10040da90
nop
call fcn.10044da70
mov rcx, rax
lea rdx, [rsp + 0x40]
call fcn.10040a150
test al, al
je 0x100436332
mov eax, dword [0x1004a96b4]
test eax, eax
je 0x100436332
mov ebx, edi
jle 0x100436332
mov edi, 1
nop word [rax + rax]
mov edx, ebx
lea rcx, [0x1004a96a8]
call qword [sym.imp.SQLSVC.dll_SHRecMemLock]
test rax, rax
je 0x100436328
lea rdx, [rax + 0x10]
mov ecx, dword [rax + 0xc]
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], rdx
mov eax, dword [rax + 8]
mov dword [rsp + 0x20], eax
lea r9, str.SQLServerAgent
lea r8, [rsp + 0x70]
mov edx, 0x200
lea rcx, [rsp + 0x470]
call fcn.10040b460
xor edx, edx
lea rcx, [rsp + 0x470]
call fcn.100432ca0
inc ebx
cmp ebx, dword [0x1004a96b4]
jl 0x1004362d0
cmp dword [0x1004a8ebc], 0
jne 0x100436343
or edi, esi
je 0x100436400
mov r9d, dword [0x1004a96e8]
xor edx, edx
lea ecx, [rdx + 3]
lea r8d, [rdx + 0x60]
call fcn.100432180
mov r9d, dword [0x1004a96e4]
xor edx, edx
lea ecx, [rdx + 3]
mov r8d, 0x134
call fcn.100432180
mov r9d, dword [0x1004a96e0]
xor edx, edx
lea ecx, [rdx + 3]
mov r8d, 0x135
call fcn.100432180
jmp 0x100436400
mov r9d, 0x200
lea r8, [rsp + 0x870]
mov edx, 0xf3
mov rcx, qword [0x1004a90d8]
call qword [sym.imp.USER32.dll_LoadStringW]
lea rax, [rsp + 0x870]
mov qword [rsp + 0x20], rax
lea r9, str.SQLServerAgent
xor edx, edx
lea ecx, [rdx + 2]
lea r8d, [rdx + 0x62]
call fcn.100432180
mov rcx, qword [0x1004a9360]
test rcx, rcx
je 0x1004363dc
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor r9d, r9d
xor r8d, r8d
lea ecx, [r9 + 1]
call fcn.10044b960
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, dword [0x100499398]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0xc70]
xor rcx, rsp
call fcn.100469360
lea r11, [rsp + 0xc80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret