Function at 0x401bea
Capabilities:
Create service
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x850
mov dword [ebp - 0x634], 0
mov dword [ebp - 0x844], 0
mov dword [ebp - 0x848], 0
mov dword [ebp - 0x84c], 0
lea eax, [ebp - 0x848]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x84c], eax
cmp dword [ebp - 0x84c], 0
jne 0x401ca2
mov dword [ebp - 4], 0x104
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x418]
push edx
lea eax, [ebp - 8]
push eax
push 0
push str.ProgramFilesDir
mov ecx, dword [ebp - 0x848]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x84c], eax
mov edx, dword [ebp - 0x848]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x84c], 0
je 0x401ca0
push str.Cannot_query_ProgramFilesDir_value_n
call sub.MSVCRT.dll_wprintf
add esp, 4
jmp 0x401e80
jmp 0x401cb4
push str.Cannot_open_windows_currentversion_key_n
call sub.MSVCRT.dll_wprintf
add esp, 4
jmp 0x401e80
push str.Microsoft_SQL_Server_
lea eax, [ebp - 0x418]
push eax
call sub.MSVCRT.dll_wcscat
add esp, 8
push 0x40b624
lea ecx, [ebp - 0x418]
push ecx
call sub.MSVCRT.dll_wcscat
add esp, 8
push str.ToolsBinn_
lea edx, [ebp - 0x418]
push edx
call sub.MSVCRT.dll_wcscat
add esp, 8
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x840]
push ecx
call sub.MSVCRT.dll_wcscpy
add esp, 8
push str.sqladhlp.exe
lea edx, [ebp - 0x418]
push edx
call sub.MSVCRT.dll_wcscat
add esp, 8
push str.Resources_
lea eax, [ebp - 0x840]
push eax
call sub.MSVCRT.dll_wcscat
add esp, 8
cmp dword [ebp + 8], 0
je 0x401d3f
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x850], ecx
jmp 0x401d49
mov dword [ebp - 0x850], str.1033
mov edx, dword [ebp - 0x850]
push edx
lea eax, [ebp - 0x840]
push eax
call sub.MSVCRT.dll_wcscat
add esp, 8
push 0x40b62c
lea ecx, [ebp - 0x840]
push ecx
call sub.MSVCRT.dll_wcscat
add esp, 8
push str.sqladevn.rll
lea edx, [ebp - 0x840]
push edx
call sub.MSVCRT.dll_wcscat
add esp, 8
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0
je 0x401e57
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x418]
push eax
push 1
push 3
push 0x10
push 0xf01ff
push str.MSSQLServerADHelper
push str.MSSQLServerADHelper
mov ecx, dword [ebp - 0x420]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
je 0x401e1f
lea edx, [ebp - 0x840]
push edx
call fcn.00401a6b
add esp, 4
test eax, eax
jne 0x401e10
push str.MSSQLServerADHelper
push 0x40b630
call sub.MSVCRT.dll_wprintf
add esp, 8
mov eax, dword [ebp - 0x41c]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x401e48
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x104
lea ecx, [ebp - 0x630]
push ecx
call fcn.00402044
add esp, 0xc
push eax
push str.CreateService_failed____s_n
call sub.MSVCRT.dll_wprintf
add esp, 8
mov edx, dword [ebp - 0x420]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x401e80
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x104
lea eax, [ebp - 0x630]
push eax
call fcn.00402044
add esp, 0xc
push eax
push 0x40b688
call sub.MSVCRT.dll_wprintf
add esp, 8
mov esp, ebp
pop ebp
ret