Function at 0x560bf8
Capabilities:
Check if file exists
Copy file
Create service
Get common file path
Modify service
Persist via windows service
Query service configuration
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd98
call fcn.00560760
test eax, eax
jne 0x560c1b
mov dword [0x80d1a8], 1
xor eax, eax
jmp 0x5610c6
call fcn.00560bcc
test eax, eax
je 0x560c2d
mov dword [ebp - 0x1c], str.ISODrv64
jmp 0x560c34
mov dword [ebp - 0x1c], 0x80d46f
xor edx, edx
mov dword [0x80d1a8], edx
push str.ISODrive_initializing...
call fcn.004626fc
pop ecx
push 0x104
lea ecx, [ebp - 0x164]
push ecx
call sub.KERNEL32.DLL_GetSystemDirectoryA
push str.Drivers_
lea eax, [ebp - 0x164]
push eax
call fcn.0066c910
add esp, 8
push dword [ebp - 0x1c]
lea edx, [ebp - 0x164]
push edx
call fcn.0066c910
add esp, 8
push str..sys
lea ecx, [ebp - 0x164]
push ecx
call fcn.0066c910
add esp, 8
lea eax, [ebp - 0x164]
push eax
lea edx, [ebp - 0x268]
push edx
call fcn.0066c9ec
add esp, 8
lea ecx, [ebp - 0x164]
push ecx
push 0x80d4a0
call fcn.004626fc
add esp, 8
push 0
lea eax, [ebp - 0x164]
push eax
call fcn.0066e7cc
add esp, 8
test eax, eax
je 0x560d32
push dword [ebp - 0x1c]
push 0x822944
push 0x80d4b7
lea edx, [ebp - 0x164]
push edx
call fcn.00670e94
add esp, 0x10
lea ecx, [ebp - 0x164]
push ecx
push str.Trying_driver_path:__s
call fcn.004626fc
add esp, 8
push 0
lea eax, [ebp - 0x164]
push eax
call fcn.0066e7cc
add esp, 8
test eax, eax
je 0x560d32
push dword [ebp - 0x1c]
push 0x822840
push str._sdrivers_s.sys
lea edx, [ebp - 0x164]
push edx
call fcn.00670e94
add esp, 0x10
lea ecx, [ebp - 0x164]
push ecx
push str.Driver_path:__s
call fcn.004626fc
add esp, 8
mov dword [ebp - 0x20], 3
mov eax, dword [0x6e713c]
test eax, eax
je 0x560d5d
mov dword [ebp - 0x20], 1
push 0xf003f
push 0
push 0
call sub.ADVAPI32.DLL_OpenSCManagerA
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
test edx, edx
jne 0x560d88
push str.Open_SC_Manager_failed_
call fcn.0055feb8
pop ecx
or eax, 0xffffffff
jmp 0x5610c6
push 0xf01ff
push 0x80d51a
push dword [ebp - 4]
call sub.ADVAPI32.DLL_OpenServiceA
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
test edx, edx
je 0x560fd3
mov byte [ebp - 9], 0xff
lea ecx, [ebp - 0x3c]
push ecx
push dword [ebp - 8]
call sub.ADVAPI32.DLL_QueryServiceStatus
test eax, eax
je 0x560f7f
mov eax, dword [ebp - 0x38]
cmp eax, 4
je 0x560dd8
mov edx, dword [ebp - 0x38]
cmp edx, 2
je 0x560dd8
mov ecx, dword [ebp - 0x38]
cmp ecx, 5
jne 0x560dec
mov byte [ebp - 9], 0
push str.Service_is_running.
call fcn.004626fc
pop ecx
jmp 0x560f7f
lea eax, [ebp - 0x14]
push eax
push 0x24
lea edx, [ebp - 0x60]
push edx
push dword [ebp - 8]
call sub.ADVAPI32.DLL_QueryServiceConfigA
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
push dword [ebp - 0x18]
call fcn.0066c210
pop ecx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x10]
push dword [ebp - 8]
call sub.ADVAPI32.DLL_QueryServiceConfigA
test eax, eax
je 0x560e50
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 4]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
je 0x560e50
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [ebp - 0x20]
push 0xffffffffffffffff
push dword [ebp - 8]
call sub.ADVAPI32.DLL_ChangeServiceConfigA
push dword [ebp - 0x10]
call fcn.0066c220
pop ecx
push 0
push 0
push dword [ebp - 8]
call sub.ADVAPI32.DLL_StartServiceA
test eax, eax
je 0x560e7d
mov byte [ebp - 9], 0
push str.Service_is_started.
call fcn.004626fc
pop ecx
jmp 0x560f7f
push 0
lea edx, [ebp - 0x164]
push edx
call fcn.0066e7cc
add esp, 8
test eax, eax
jne 0x560f7f
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
jne 0x560ee0
push 1
lea ecx, [ebp - 0x268]
push ecx
lea eax, [ebp - 0x164]
push eax
call sub.KERNEL32.DLL_CopyFileA
push 0
lea edx, [ebp - 0x268]
push edx
call fcn.0066e7cc
add esp, 8
test eax, eax
jne 0x560ee0
lea ecx, [ebp - 0x268]
push ecx
lea eax, [ebp - 0x164]
push eax
call fcn.0066c9ec
add esp, 8
lea edx, [ebp - 0x164]
push edx
push str.Try_to_load___s_...
call fcn.004626fc
add esp, 8
lea ecx, [ebp - 0x14]
push ecx
push 0x24
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 8]
call sub.ADVAPI32.DLL_QueryServiceConfigA
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], edx
push dword [ebp - 0x18]
call fcn.0066c210
pop ecx
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp - 0x18]
push dword [ebp - 0x10]
push dword [ebp - 8]
call sub.ADVAPI32.DLL_QueryServiceConfigA
test eax, eax
je 0x560f7f
push str.ISO_CD_DVD_ROM_Device_Driver
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x164]
push eax
push 0
push dword [ebp - 0x20]
push 2
push dword [ebp - 8]
call sub.ADVAPI32.DLL_ChangeServiceConfigA
test eax, eax
je 0x560f7f
push 0
push 0
push dword [ebp - 8]
call sub.ADVAPI32.DLL_StartServiceA
test eax, eax
je 0x560f7f
mov byte [ebp - 9], 0
lea edx, [ebp - 0x164]
push edx
push str.Service___s__is_started.
call fcn.004626fc
add esp, 8
push dword [ebp - 8]
call sub.ADVAPI32.DLL_CloseServiceHandle
push dword [ebp - 4]
call sub.ADVAPI32.DLL_CloseServiceHandle
mov cl, byte [ebp - 9]
test cl, cl
jne 0x560fbe
call fcn.00560760
test eax, eax
jne 0x560fc9
mov dword [0x80d1a8], 1
call fcn.00560608
mov eax, dword [0x6e713c]
test eax, eax
je 0x560fc9
call fcn.00560010
jmp 0x560fc9
push str.Cannot_start_service.
call fcn.004626fc
pop ecx
xor eax, eax
mov al, byte [ebp - 9]
jmp 0x5610c6
push 0
lea edx, [ebp - 0x164]
push edx
call fcn.0066e7cc
add esp, 8
test eax, eax
je 0x561003
push str.Cannot_found_device_driver
call fcn.004626fc
pop ecx
push dword [ebp - 4]
call sub.ADVAPI32.DLL_CloseServiceHandle
or eax, 0xffffffff
jmp 0x5610c6
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x164]
push edx
push 0
push dword [ebp - 0x20]
push 2
push 0xf01ff
push str.ISO_CD_ROM_Device_Driver
push str.ISODrive
push dword [ebp - 4]
call sub.ADVAPI32.DLL_CreateServiceA
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
test ecx, ecx
jne 0x561054
push dword [ebp - 4]
call sub.ADVAPI32.DLL_CloseServiceHandle
push str.CreateService_failed_
call fcn.0055feb8
pop ecx
or eax, 0xffffffff
jmp 0x5610c6
mov byte [ebp - 9], 0
push 0
push 0
push dword [ebp - 8]
call sub.ADVAPI32.DLL_StartServiceA
test eax, eax
jne 0x561083
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x420
je 0x561083
push str.StartService_failure_
call fcn.0055feb8
pop ecx
mov byte [ebp - 9], 0xff
push dword [ebp - 8]
call sub.ADVAPI32.DLL_CloseServiceHandle
push dword [ebp - 4]
call sub.ADVAPI32.DLL_CloseServiceHandle
mov dl, byte [ebp - 9]
test dl, dl
jne 0x5610c1
call fcn.00560760
test eax, eax
jne 0x5610c1
mov dword [0x80d1a8], 1
call fcn.00560608
mov ecx, dword [0x6e713c]
test ecx, ecx
je 0x5610c1
call fcn.00560010
xor eax, eax
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret