Function at 0x561014
Capabilities:
Check if file exists
Copy file
Create service
Get common file path
Modify service
Persist via windows service
Query service configuration
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd98
call fcn.00560b7c
test eax, eax
jne 0x561037
mov dword [0x81ab7c], 1
xor eax, eax
jmp 0x5614e2
call fcn.00560fe8
test eax, eax
je 0x561049
mov dword [ebp - 0x1c], str.ISODrv64
jmp 0x561050
mov dword [ebp - 0x1c], 0x81ae43
xor edx, edx
mov dword [0x81ab7c], edx
push str.ISODrive_initializing...
call fcn.004629e4
pop ecx
push 0x104
lea ecx, [ebp - 0x164]
push ecx
call sub.KERNEL32.DLL_GetSystemDirectoryA
push str.Drivers_
lea eax, [ebp - 0x164]
push eax
call fcn.0066cd2c
add esp, 8
push dword [ebp - 0x1c]
lea edx, [ebp - 0x164]
push edx
call fcn.0066cd2c
add esp, 8
push str..sys
lea ecx, [ebp - 0x164]
push ecx
call fcn.0066cd2c
add esp, 8
lea eax, [ebp - 0x164]
push eax
lea edx, [ebp - 0x268]
push edx
call fcn.0066ce08
add esp, 8
lea ecx, [ebp - 0x164]
push ecx
push 0x81ae74
call fcn.004629e4
add esp, 8
push 0
lea eax, [ebp - 0x164]
push eax
call fcn.0066ebe8
add esp, 8
test eax, eax
je 0x56114e
push dword [ebp - 0x1c]
push 0x830318
push 0x81ae8b
lea edx, [ebp - 0x164]
push edx
call fcn.006712b0
add esp, 0x10
lea ecx, [ebp - 0x164]
push ecx
push str.Trying_driver_path:__s
call fcn.004629e4
add esp, 8
push 0
lea eax, [ebp - 0x164]
push eax
call fcn.0066ebe8
add esp, 8
test eax, eax
je 0x56114e
push dword [ebp - 0x1c]
push 0x830214
push str._sdrivers_s.sys
lea edx, [ebp - 0x164]
push edx
call fcn.006712b0
add esp, 0x10
lea ecx, [ebp - 0x164]
push ecx
push str.Driver_path:__s
call fcn.004629e4
add esp, 8
mov dword [ebp - 0x20], 3
mov eax, dword [0x6eba04]
test eax, eax
je 0x561179
mov dword [ebp - 0x20], 1
push 0xf003f
push 0
push 0
call sub.ADVAPI32.DLL_OpenSCManagerA
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
test edx, edx
jne 0x5611a4
push str.Open_SC_Manager_failed_
call fcn.005602d4
pop ecx
or eax, 0xffffffff
jmp 0x5614e2
push 0xf01ff
push 0x81aeee
push dword [ebp - 4]
call sub.ADVAPI32.DLL_OpenServiceA
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
test edx, edx
je 0x5613ef
mov byte [ebp - 9], 0xff
lea ecx, [ebp - 0x3c]
push ecx
push dword [ebp - 8]
call sub.ADVAPI32.DLL_QueryServiceStatus
test eax, eax
je 0x56139b
mov eax, dword [ebp - 0x38]
cmp eax, 4
je 0x5611f4
mov edx, dword [ebp - 0x38]
cmp edx, 2
je 0x5611f4
mov ecx, dword [ebp - 0x38]
cmp ecx, 5
jne 0x561208
mov byte [ebp - 9], 0
push str.Service_is_running.
call fcn.004629e4
pop ecx
jmp 0x56139b
lea eax, [ebp - 0x14]
push eax
push 0x24
lea edx, [ebp - 0x60]
push edx
push dword [ebp - 8]
call sub.ADVAPI32.DLL_QueryServiceConfigA
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
push dword [ebp - 0x18]
call fcn.0066c62c
pop ecx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x10]
push dword [ebp - 8]
call sub.ADVAPI32.DLL_QueryServiceConfigA
test eax, eax
je 0x56126c
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 4]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
je 0x56126c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [ebp - 0x20]
push 0xffffffffffffffff
push dword [ebp - 8]
call sub.ADVAPI32.DLL_ChangeServiceConfigA
push dword [ebp - 0x10]
call fcn.0066c63c
pop ecx
push 0
push 0
push dword [ebp - 8]
call sub.ADVAPI32.DLL_StartServiceA
test eax, eax
je 0x561299
mov byte [ebp - 9], 0
push str.Service_is_started.
call fcn.004629e4
pop ecx
jmp 0x56139b
push 0
lea edx, [ebp - 0x164]
push edx
call fcn.0066ebe8
add esp, 8
test eax, eax
jne 0x56139b
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
jne 0x5612fc
push 1
lea ecx, [ebp - 0x268]
push ecx
lea eax, [ebp - 0x164]
push eax
call sub.KERNEL32.DLL_CopyFileA
push 0
lea edx, [ebp - 0x268]
push edx
call fcn.0066ebe8
add esp, 8
test eax, eax
jne 0x5612fc
lea ecx, [ebp - 0x268]
push ecx
lea eax, [ebp - 0x164]
push eax
call fcn.0066ce08
add esp, 8
lea edx, [ebp - 0x164]
push edx
push str.Try_to_load___s_...
call fcn.004629e4
add esp, 8
lea ecx, [ebp - 0x14]
push ecx
push 0x24
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 8]
call sub.ADVAPI32.DLL_QueryServiceConfigA
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], edx
push dword [ebp - 0x18]
call fcn.0066c62c
pop ecx
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp - 0x18]
push dword [ebp - 0x10]
push dword [ebp - 8]
call sub.ADVAPI32.DLL_QueryServiceConfigA
test eax, eax
je 0x56139b
push str.ISO_CD_DVD_ROM_Device_Driver
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x164]
push eax
push 0
push dword [ebp - 0x20]
push 2
push dword [ebp - 8]
call sub.ADVAPI32.DLL_ChangeServiceConfigA
test eax, eax
je 0x56139b
push 0
push 0
push dword [ebp - 8]
call sub.ADVAPI32.DLL_StartServiceA
test eax, eax
je 0x56139b
mov byte [ebp - 9], 0
lea edx, [ebp - 0x164]
push edx
push str.Service___s__is_started.
call fcn.004629e4
add esp, 8
push dword [ebp - 8]
call sub.ADVAPI32.DLL_CloseServiceHandle
push dword [ebp - 4]
call sub.ADVAPI32.DLL_CloseServiceHandle
mov cl, byte [ebp - 9]
test cl, cl
jne 0x5613da
call fcn.00560b7c
test eax, eax
jne 0x5613e5
mov dword [0x81ab7c], 1
call fcn.00560a24
mov eax, dword [0x6eba04]
test eax, eax
je 0x5613e5
call fcn.0056042c
jmp 0x5613e5
push str.Cannot_start_service.
call fcn.004629e4
pop ecx
xor eax, eax
mov al, byte [ebp - 9]
jmp 0x5614e2
push 0
lea edx, [ebp - 0x164]
push edx
call fcn.0066ebe8
add esp, 8
test eax, eax
je 0x56141f
push str.Cannot_found_device_driver
call fcn.004629e4
pop ecx
push dword [ebp - 4]
call sub.ADVAPI32.DLL_CloseServiceHandle
or eax, 0xffffffff
jmp 0x5614e2
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x164]
push edx
push 0
push dword [ebp - 0x20]
push 2
push 0xf01ff
push str.ISO_CD_ROM_Device_Driver
push str.ISODrive
push dword [ebp - 4]
call sub.ADVAPI32.DLL_CreateServiceA
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
test ecx, ecx
jne 0x561470
push dword [ebp - 4]
call sub.ADVAPI32.DLL_CloseServiceHandle
push str.CreateService_failed_
call fcn.005602d4
pop ecx
or eax, 0xffffffff
jmp 0x5614e2
mov byte [ebp - 9], 0
push 0
push 0
push dword [ebp - 8]
call sub.ADVAPI32.DLL_StartServiceA
test eax, eax
jne 0x56149f
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x420
je 0x56149f
push str.StartService_failure_
call fcn.005602d4
pop ecx
mov byte [ebp - 9], 0xff
push dword [ebp - 8]
call sub.ADVAPI32.DLL_CloseServiceHandle
push dword [ebp - 4]
call sub.ADVAPI32.DLL_CloseServiceHandle
mov dl, byte [ebp - 9]
test dl, dl
jne 0x5614dd
call fcn.00560b7c
test eax, eax
jne 0x5614dd
mov dword [0x81ab7c], 1
call fcn.00560a24
mov ecx, dword [0x6eba04]
test ecx, ecx
je 0x5614dd
call fcn.0056042c
xor eax, eax
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret