Function at 0x1001b940
Capabilities:
Create service
Get file size
Get hostname
Modify service
Persist via windows service
Read file on windows
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc20
mov eax, dword [0x1005e068]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0xf003f
push 0
mov edi, ecx
mov dword [ebp - 0xc18], eax
mov eax, dword [ebp + 0xc]
xor bl, bl
push 0
mov dword [ebp - 0xc1c], edx
mov dword [ebp - 0xc14], edi
mov dword [ebp - 0xc0c], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [ebp - 0xc20], esi
test esi, esi
je 0x1001bbee
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0xc0c]
push 0
push 2
push 0x10
push 0xf01ff
push dword [ebp - 0xc1c]
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edi, eax
test edi, edi
jne 0x1001b9f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x1001bbe5
push 0xf01ff
push dword [ebp - 0xc14]
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
je 0x1001bbe5
push esi
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
mov dword [ebp - 0xc14], eax
mov eax, dword [ebp - 0xc18]
mov dword [ebp - 0xc10], eax
lea eax, [ebp - 0xc10]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push 0
lea eax, [ebp - 0xc0c]
mov dword [ebp - 0xc0c], 0
push eax
push 1
push str.D:_D_OICI_GA___IU__A_OICI_GA___SY_
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x1001ba5b
push dword [ebp - 0xc0c]
push 4
push edi
call dword [sym.imp.ADVAPI32.dll_SetServiceObjectSecurity]
push dword [ebp - 0xc0c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0xc14]
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push str.C:ProgramData_templateWatch.dat
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc18], eax
test eax, eax
je 0x1001bbd6
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [ebp - 0xc08], 0
push esi
call fcn.1002e46d
add esp, 4
mov dword [ebp - 0xc14], eax
lea ecx, [ebp - 0xc08]
push 0
push ecx
push esi
mov esi, dword [ebp - 0xc18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0xc08]
lea eax, [ebp - 0x404]
push 0x400
push 0
push eax
mov dword [ebp - 0xc1c], esi
call fcn.10022540
add esp, 0xc
mov dword [ebp - 0xc18], 0x200
lea eax, [ebp - 0xc18]
push eax
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x1001bb28
push str.UnKnow
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x800
lea eax, [ebp - 0xc04]
push 0
push eax
call fcn.10022540
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0xc04]
push str.Software_s_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea edx, [ebp - 0xc04]
mov ecx, 0x80000002
push esi
mov esi, dword [ebp - 0xc14]
push esi
push 3
push str.ipData
call fcn.100186e0
add esp, 0x14
test eax, eax
setne cl
test eax, eax
jne 0x1001bba9
push ecx
push dword [ebp - 0xc1c]
lea edx, [ebp - 0xc04]
mov ecx, 0x80000001
push esi
push 3
push str.ipData
call fcn.100186e0
add esp, 0x14
test eax, eax
setne cl
test cl, cl
jne 0x1001bbb8
push esi
call fcn.1002916c
add esp, 4
jmp 0x1001bbd0
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
movzx ebx, bl
mov ecx, 1
cmovne ebx, ecx
mov esi, dword [ebp - 0xc20]
test edi, edi
je 0x1001bbe5
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
jmp 0x1001bbeb
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call edi
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001f7ed
mov esp, ebp
pop ebp
ret