Function at 0x4012f0
Capabilities:
Copy file
Create service
Get file attributes
Persist via windows service
Set file attributes
Start service
Terminate process

Disassembly:
push ecx
push ebx
push esi
push edi
push 0
call fcn.00401210
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 4
push 0
push 0x4084c0
push 0x408580
call ebx
test eax, eax
je 0x401552
push str._nCopy_sense3.sys_to_system_directory
call fcn.00401e82
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add esp, 4
push 0x4084c0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
and al, 0xf8
push eax
push 0x4084c0
call edi
push 0
push 0x408520
push 0x408460
call ebx
test eax, eax
je 0x401374
push str._nCopy_sense3.dll_to_system_directory
call fcn.00401e82
add esp, 4
push 0x408520
call esi
and al, 0xf8
push eax
push 0x408520
call edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x4013cf
push str._nFail_to_get_manager_
call fcn.00401e82
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x4013bb
cmp eax, 0x57
je 0x4013b4
cmp eax, 0x429
jne 0x4013c8
push str._nThe_specified_database_does_not_exist_
jmp 0x4013c0
push str._nA_specified_parameter_is_invalid_
jmp 0x4013c0
push str._nThe_requested_access_was_denied_
call fcn.00401e82
add esp, 4
push 1
call fcn.00401dad
push 0
push 0
lea eax, [esp + 0x14]
push 0
push eax
push str.Extended_Base
push str.SystemRootSystem32drivers_sense3.sys
push 1
push 2
push 1
push 0xf01ff
push str.Sense3
push str.Sense3
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
test esi, esi
jne 0x40145f
push str._nFail_to_get_service_
call fcn.00401e82
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7b
ja 0x40143d
je 0x401436
sub eax, 5
je 0x40142f
dec eax
jne 0x401451
push str._nThe_specified_handle_is_invalid_
jmp 0x401449
push str._nThe_specified_service_control_manager_database_handle_does_not_have_access_to_the_service_
jmp 0x401449
push str._nThe_specified_service_name_is_invalid_
jmp 0x401449
cmp eax, 0x424
jne 0x401451
push str._nThe_specified_service_does_not_exist_
call fcn.00401e82
add esp, 4
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 1
call fcn.00401dad
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x401534
push str._nFail_to_start_service_
call fcn.00401e82
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
ja 0x4014df
je 0x4014d8
cmp eax, 0x41d
ja 0x4014c0
je 0x4014b9
sub eax, 3
je 0x4014b2
sub eax, 2
je 0x4014ab
dec eax
jne case.0x4014f1.1063
push str._nThe_specified_handle_is_invalid_
jmp 0x401519
push str._nThe_specified_handle_was_not_opened_with_SERVICE_START_access_
jmp 0x401519
push str._nThe_service_binary_file_could_not_be_found_
jmp 0x401519
push str._nThe_service_did_not_respond_to_the_start_request_in_a_timely_fashion_
jmp 0x401519
sub eax, 0x41e
je 0x4014d1
dec eax
jne case.0x4014f1.1063
push str._nThe_database_is_locked_
jmp 0x401519
push str._nA_thread_could_not_be_created_for_the_service_
jmp 0x401519
push str._nAn_instance_of_the_service_is_already_running_
jmp 0x401519
add eax, 0xfffffbde
cmp eax, 0x11
ja case.0x4014f1.1063
xor ecx, ecx
mov cl, byte [eax + 0x40157c]
jmp dword [ecx*4 + 0x401564]
push str._nThe_service_depends_on_a_service_that_does_not_exist_or_has_been_marked_for_deletion_
jmp 0x401519
push str._nThe_service_depends_on_another_service_that_has_failed_to_start_
jmp 0x401519
push str._nThe_service_has_been_disabled_
jmp 0x401519
push str._nThe_service_could_not_be_logged_on_
jmp 0x401519
push str._nThe_service_has_been_marked_for_deletion_
call fcn.00401e82
add esp, 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
push 1
call fcn.00401dad
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
push str._n_nStart_Sense3_service_success_
call fcn.00401e82
add esp, 4
pop edi
pop esi
pop ebx
pop ecx
ret
push str._nError:_Can_not_copy_sense3.sys
call fcn.00401e82
add esp, 4
pop edi
pop esi
pop ebx
pop ecx
ret