Function at 0x409d90
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Print debug messages
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40c791
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1110
call fcn.0040be00
mov eax, dword [0x413024]
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 8]
mov esi, ecx
xor edx, edx
xor eax, eax
mov word [ebp - 0x25c], dx
mov ecx, 0x81
lea edi, [ebp - 0x25a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [ebp - 0x54], dx
xor eax, eax
mov ecx, 0xf
lea edi, [ebp - 0x52]
rep stosd dword es:[edi], eax
push ebx
stosw word es:[edi], ax
mov eax, dword [esi + 4]
push str.CVerSwitch::UpdateService
mov dword [ebp - 0x1068], edx
mov ecx, dword [eax]
push 0xd7
push eax
mov dword [ebp - 0x1074], esi
mov dword [ebp - 0x106c], ebx
mov dword [ebp - 0x1070], edx
mov dword [ebp - 0x1078], edx
call dword [ecx + 0xc]
mov edx, dword [esi + 0x40]
add esp, 0x10
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov ebx, eax
mov eax, dword [ebp - 0x106c]
neg ebx
sbb ebx, ebx
push 0
inc ebx
push eax
lea ecx, [ebp - 0x10d0]
mov dword [ebp - 0x1094], ebx
mov dword [ebp - 4], 0
call fcn.00405a10
lea ecx, [ebp - 0x10d0]
mov byte [ebp - 4], 1
call fcn.00405ba0
test eax, eax
jne 0x40a23d
mov ecx, dword [esi + 4]
mov edi, dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esi + 4]
push eax
push str.UpdateService___svc.Open
push 0x518
push 0xd6
push edx
call dword [edi + 0xc]
add esp, 0x14
test ebx, ebx
je 0x40a222
mov eax, dword [esi + 0x38]
test eax, eax
jne 0x409fcb
mov eax, dword [esi + 4]
mov ecx, dword [eax]
push 1
push str.UpdateService___NULL__m_lpszNewRoot
push 0x525
push 0xd6
push eax
call dword [ecx + 0xc]
add esp, 0x14
lea ecx, [ebp - 0x1090]
call fcn.004038a0
push 0xf003f
push str.SOFTWAREMicrosoftMSSQLserv80Setup
push 0x80000002
lea ecx, [ebp - 0x1090]
mov byte [ebp - 4], 2
call fcn.00403dc0
test al, al
jne 0x409f55
cmp dword [ebp - 0x1080], 5
jne 0x409f1f
mov ecx, dword [ebp - 0x1084]
mov eax, dword [esi + 4]
mov edx, dword [eax]
push ecx
push 0x52f
push 0xd9
push eax
call dword [edx + 0xc]
add esp, 0x10
mov byte [esi + 0x58], 1
mov ecx, dword [ebp - 0x1080]
push ecx
push str.UpdateService___reg.Open_MSSQLServ80Setup_
push 0x538
mov eax, dword [esi + 4]
mov edx, dword [eax]
push 0xd5
push eax
call dword [edx + 0xc]
add esp, 0x14
lea ecx, [ebp - 0x1090]
mov byte [ebp - 4], 1
call fcn.00403d80
jmp 0x40a459
push 0x105
push 0
push str.SQLPath
lea ecx, [ebp - 0x1090]
call fcn.00403a60
test eax, eax
mov dword [ebp - 0x1068], eax
jne 0x409f84
push 2
push str.UpdateService___NULL__lpszExePath
push 0x544
jmp 0x409f30
push eax
lea eax, [ebp - 0x25c]
push str._s_binn_sqlservr.exe
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x1068]
add esp, 0xc
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea ecx, [ebp - 0x1090]
mov dword [ebp - 0x1068], 0
mov byte [ebp - 4], 1
call fcn.00403d80
jmp 0x409fe1
push eax
lea edx, [ebp - 0x25c]
push str._s_binn_sqlservr.exe
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov eax, dword [esi + 4]
mov ecx, dword [eax]
lea edx, [ebp - 0x25c]
push edx
push str.UpdateService___szNewPath
push 0xd7
push eax
call dword [ecx + 0xc]
xor eax, eax
mov word [ebp - 0x464], 0
mov ecx, 0x81
lea edi, [ebp - 0x462]
rep stosd dword es:[edi], eax
add esp, 0x10
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x464]
push eax
lea ecx, [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
jne 0x40a042
push str.GetShortPathName_failed__using_szNewPath_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x40a056
lea edx, [ebp - 0x464]
push edx
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [esi + 4]
mov ecx, dword [eax]
lea edx, [ebp - 0x464]
push edx
push str.UpdateService___szShortPath
push 0xd7
push eax
call dword [ecx + 0xc]
mov eax, dword [esi + 4]
mov ecx, dword [eax]
add esp, 0x10
lea edx, [ebp - 0x25c]
push edx
push str.UpdateService___szNewPath
push 0xd7
push eax
call dword [ecx + 0xc]
xor edi, edi
add esp, 0x10
lea ecx, [ebp - 0x1120]
lea eax, [ebp - 0x25c]
push ecx
lea ecx, [ebp - 0x10d0]
mov dword [ebp - 0x1120], edi
mov dword [ebp - 0x111c], 0xf01ff
mov dword [ebp - 0x1118], 0x10
mov dword [ebp - 0x1114], 3
mov dword [ebp - 0x1110], 1
mov dword [ebp - 0x110c], eax
mov dword [ebp - 0x1108], edi
mov dword [ebp - 0x1104], edi
mov dword [ebp - 0x1100], edi
mov dword [ebp - 0x10fc], edi
mov dword [ebp - 0x10f8], edi
call fcn.004060b0
cmp eax, edi
je 0x40a459
push 5
push str.rundll32_shell32.dll_Control_RunDLL_srvmgr.cpl__1
mov dword [ebp - 0x1078], 1
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
mov eax, dword [esi + 4]
jbe 0x40a208
mov edx, dword [eax]
push 0xca
push eax
call dword [edx + 0xc]
add esp, 8
push 0x30
push 0xca
call fcn.00401100
add esp, 8
lea ecx, [ebp - 0x10d0]
call fcn.00405fd0
mov edi, eax
mov eax, dword [esi + 4]
mov edx, dword [eax]
push edi
push str.svc.GetStartType
push 0xd8
push eax
mov dword [ebp - 0x1098], edi
call dword [edx + 0xc]
mov eax, dword [ebp + 0xc]
add esp, 0x10
test eax, eax
je 0x40a2b0
cmp edi, 4
je 0x40a1ab
push 0xa
lea eax, [ebp - 0x54]
push eax
push edi
call dword [sym.imp.MSVCR71.dll__ltow]
mov edx, dword [ebp - 0x1068]
mov eax, dword [ebp - 0x106c]
add esp, 0xc
push str.vswitch.ini
lea ecx, [ebp - 0x54]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 1
lea ecx, [ebp - 0x10d0]
call fcn.00406550
push 4
push 0xffffffffffffffff
push 0
push 0
push 0
lea ecx, [ebp - 0x10d0]
call fcn.00405ed0
mov esi, dword [esi + 4]
mov ecx, dword [esi]
push eax
push str.svc.Modify
push 0xd8
push esi
call dword [ecx + 0xc]
add esp, 0x10
lea ecx, [ebp - 0x10d0]
call fcn.00405ac0
lea ecx, [ebp - 0x10d0]
mov byte [ebp - 4], 0
call fcn.00406060
mov eax, 1
jmp 0x40aa39
mov ecx, dword [eax]
push 0xc9
push eax
call dword [ecx + 0xc]
add esp, 8
push 0x30
push 0xc9
jmp 0x40a13c
mov edx, dword [esi + 4]
mov edi, dword [edx]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.UpdateService____bMSSQLServer
push 0x57f
jmp 0x40a44a
lea ecx, [ebp - 0x1068]
push ecx
lea ecx, [ebp - 0x10d0]
call fcn.00405f10
test eax, eax
jne 0x40a26e
mov edx, dword [esi + 4]
mov edi, dword [edx]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.UpdateService___svc.GetServiceBinaryPath
push 0x58d
jmp 0x40a44a
mov ecx, dword [ebp - 0x1068]
test ecx, ecx
mov eax, dword [esi + 4]
je 0x40a294
mov edx, dword [eax]
push ecx
push str.lpszExePath
push 0xd7
push eax
call dword [edx + 0xc]
add esp, 0x10
jmp 0x40a144
mov ecx, dword [eax]
push 2
push str.UpdateService___NULL__lpszExePath
push 0x599
push 0xd5
push eax
call dword [ecx + 0xc]
jmp 0x40a456
test ebx, ebx
je 0x40a423
mov eax, dword [ebp - 0x1078]
test eax, eax
jne 0x40a56f
mov eax, dword [esi + 0x20]
test eax, eax
je 0x40a2ee
mov edx, dword [ebp - 0x1068]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40a2ee
mov dword [ebp - 0x1070], 1
jmp 0x40a459
push 1
lea ecx, [ebp - 0x10d0]
call fcn.00406340
test eax, eax
je 0x40a3e9
mov eax, dword [esi + 4]
mov ecx, dword [eax]
push 1
push str.UpdateService___svc.IsRunning__
push 0xd8
push eax
call dword [ecx + 0xc]
add esp, 0x10
push 1
lea ecx, [ebp - 0x10d0]
call fcn.00406550
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
push 1
lea ecx, [ebp - 0x10d0]
call fcn.00406340
test eax, eax
je 0x40a37d
mov eax, dword [esi + 4]
mov edx, dword [eax]
push edi
push str.UpdateService___svc.IsRunning_____nWait
push 0xd8
push eax
call dword [edx + 0xc]
add esp, 0x10
push 0x3e8
inc edi
call ebx
cmp edi, 0xa
jl 0x40a330
mov eax, dword [esi + 4]
mov ecx, dword [eax]
push 1
push str.UpdateService___nWait___10
push 0xd8
push eax
call dword [ecx + 0xc]
add esp, 0x10
push 1
lea ecx, [ebp - 0x10d0]
call fcn.00406340
test eax, eax
je 0x40a3db
mov eax, dword [esi + 4]
mov edx, dword [eax]
push str.ExecShutdown__
push str.UpdateService___svc.IsRunning__
push 0xd7
push eax
call dword [edx + 0xc]
add esp, 0x10
mov ecx, esi
call fcn.004082d0
test eax, eax
jne 0x40a3db
mov eax, dword [esi + 0x20]
test eax, eax
jne 0x40a3ca
push 0x30
push 0xcd
call fcn.00401100
add esp, 8
mov eax, dword [esi + 4]
mov ecx, dword [eax]
push 0xcd
push eax
call dword [ecx + 0xc]
add esp, 8
mov eax, dword [ebp - 0x1078]
test eax, eax
jne 0x40a56f
mov ecx, dword [ebp - 0x1068]
push 0x5c
push ecx
call dword [sym.imp.MSVCR71.dll_wcsrchr]
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x40a496
mov edx, dword [esi + 0x44]
mov edi, dword [ebp - 0x106c]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
push edx
push edi
call ebx
test eax, eax
jne 0x40a474
mov ebx, str._sqlexec.exe
jmp 0x40a496
push 1
lea ecx, [ebp - 0x10d0]
call fcn.00406550
test eax, eax
jne 0x40a3db
mov edx, dword [esi + 4]
mov edi, dword [edx]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.UpdateService____svc.Stop__
push 0x607
mov eax, dword [esi + 4]
push 0xd5
push eax
call dword [edi + 0xc]
add esp, 0x14
lea ecx, [ebp - 0x10d0]
mov byte [ebp - 4], 0
call fcn.00406060
mov dword [ebp - 4], 0xffffffff
jmp 0x40aa00
mov eax, dword [esi + 0x48]
push eax
push edi
call ebx
test eax, eax
jne 0x40a486
mov ebx, str._sqlagent.exe
jmp 0x40a496
mov ecx, dword [esi + 0x40]
push ecx
push edi
call ebx
test eax, eax
jne 0x40a459
mov ebx, str._sqlservr.exe
mov eax, dword [esi + 4]
mov edx, dword [eax]
push ebx
push str.lpszFile
push 0xd7
push eax
call dword [edx + 0xc]
xor eax, eax
mov word [ebp - 0x464], 0
mov ecx, 0x81
lea edi, [ebp - 0x462]
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0x38]
add esp, 0x10
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x464]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
jne 0x40a4ee
push str.GetShortPathName_failed__using_m_lpszNewRoot_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x40a4ff
mov eax, dword [esi + 0x38]
lea edx, [ebp - 0x464]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [esi + 0x38]
mov eax, dword [esi + 4]
mov ecx, dword [eax]
push edx
push str.m_lpszNewRoot
push 0xd7
push eax
call dword [ecx + 0xc]
mov edi, dword [esi + 0x38]
add esp, 0x10
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [edi + eax*2 - 2], 0x5c
push ebx
push edi
jne 0x40a53d
push str._sbinn_s
lea ecx, [ebp - 0x25c]
push ecx
jmp 0x40a549
push str._s_binn_s
lea edx, [ebp - 0x25c]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [esi + 4]
mov ecx, dword [eax]
add esp, 0x10
lea edx, [ebp - 0x25c]
push edx
push str.szNewPath
push 0xd7
push eax
call dword [ecx + 0xc]
add esp, 0x10
mov eax, dword [ebp - 0x1094]
test eax, eax
mov edi, dword [ebp - 0x106c]
je 0x40a5c8
mov ecx, dword [ebp - 0x1098]
push 0xa
lea eax, [ebp - 0x54]
push eax
push ecx
call dword [sym.imp.MSVCR71.dll__ltow]
mov eax, dword [ebp - 0x1068]
add esp, 0xc
push str.vswitch.ini
lea edx, [ebp - 0x54]
push edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push str.vswitch.ini
push 3
lea ecx, [ebp - 0x25c]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x413020], eax
jmp 0x40a5fc
mov eax, dword [0x413020]
cmp eax, 0xffffffff
jne 0x40a5e2
push str.vswitch.ini
push 3
lea edx, [ebp - 0x25c]
push edx
jmp 0x40a5f5
cmp eax, 2
jne 0x40a5fc
push str.vswitch.ini
push 3
lea eax, [ebp - 0x25c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push eax
or edi, 0xffffffff
push edi
push 0
push 0
lea ecx, [ebp - 0x25c]
push ecx
lea ecx, [ebp - 0x10d0]
call fcn.00405ed0
test eax, eax
jne 0x40a657
mov edx, dword [esi + 4]
mov ebx, dword [edx]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [esi + 4]
push str.UpdateService___svc.Modify_2
push 0x67a
push 0xd5
push eax
call dword [ebx + 0xc]
add esp, 0x14
lea ecx, [ebp - 0x10d0]
mov byte [ebp - 4], 0
call fcn.00406060
mov dword [ebp - 4], edi
jmp 0x40aa00
lea ecx, [ebp - 0x10d0]
call fcn.00405ac0
test eax, eax
lea ecx, [ebp - 0x10d0]
mov byte [ebp - 4], 0
jne 0x40a67d
call fcn.00406060
mov dword [ebp - 4], edi
jmp 0x40aa00
mov dword [ebp - 0x1070], 1
call fcn.00406060
mov dword [ebp - 4], 0xffffffff
jmp 0x40aa00
mov eax, dword [ebp - 0x1068]
test eax, eax
je 0x40aa1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0x1070]
mov esi, dword [esi + 4]
mov ecx, dword [esi]
push edi
push str.CVerSwitch::UpdateService
push 0xd8
push esi
call dword [ecx + 0xc]
add esp, 0x10
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.0040bc27
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8