Function at 0x1001ca0
Capabilities:
Create service
Get disk information
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [0x100133c]
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0xc]
movsx eax, byte [eax + 1]
cmp eax, 0x3a
jne 0x1001cdb
mov eax, dword [ebp - 0xc]
movsx eax, byte [eax + 2]
cmp eax, 0x5c
je 0x1001cf2
push str.__The_fully_qualified_path_to_the_.EXE_must_be_given
push 0x1001330
call fcn.01002760
add esp, 8
jmp 0x1001f37
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
mov byte [ebp - 8], al
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 0x10], eax
jmp 0x1001d4e
jmp 0x1001d81
push str.__The_executable_must_be_on_a_fixed_disk__e.g.__not_a_net_drive_
push str.__The_fully_qualified_path_to_the_.EXE_must_be_given
push 0x1001320
call fcn.01002760
add esp, 0xc
jmp 0x1001f37
push str.__The_executable_must_be_on_a_fixed_disk__e.g.__not_a_net_drive_
push str.__The_fully_qualified_path_to_the_.EXE_must_be_given
push 0x1001310
call fcn.01002760
add esp, 0xc
jmp 0x1001f37
cmp dword [ebp - 0x10], 6
ja case.0x1001d63.3
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov cl, byte [eax + 0x1001d7a]
jmp dword [ecx*4 + 0x1001d6a]
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x1001dbd
push str.Unable_to_find_the_file_at_the_given_path.
push 0x1001330
call fcn.01002760
add esp, 8
jmp 0x1001f37
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
push 1
push 2
push 0x10
push 0xf01ff
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [0x1009678]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [0x100967c], eax
cmp dword [0x100967c], 0
jne 0x1001eea
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
jmp 0x1001ea7
push str.You_are_not_authorized_to_do_this___please_contact_your_system_Administrator
push 0x1001330
call fcn.01002760
add esp, 8
jmp 0x1001ee5
push str.This_service_has_already_been_started_
push 0x1001330
call fcn.01002760
add esp, 8
jmp 0x1001ee5
push str.The_account_name_does_not_exist.
push 0x1001308
call fcn.01002760
add esp, 8
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0x10012ec
call fcn.010027a0
add esp, 0xc
jmp 0x1001ee5
push str.The_specified_name_is_invalid.
push 0x1001330
call fcn.01002760
add esp, 8
jmp 0x1001ee5
push 0x8a
push 0x10012dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10012b8
push 0x1001294
call fcn.010027a0
add esp, 0x14
jmp 0x1001ee5
cmp dword [ebp - 0x14], 0x7b
ja 0x1001ec6
je 0x1001e68
cmp dword [ebp - 0x14], 5
je 0x1001e0e
jmp 0x1001e7f
cmp dword [ebp - 0x14], 0x421
je 0x1001e3c
cmp dword [ebp - 0x14], 0x431
je 0x1001e25
jmp 0x1001e7f
jmp 0x1001f37
push 0x1001248
call fcn.01002760
add esp, 4
push 0x10011dc
call fcn.01002760
add esp, 4
push 0x1001174
call fcn.01002760
add esp, 4
push 0x1001108
call fcn.01002760
add esp, 4
push 0x10010d0
call fcn.01002760
add esp, 4
mov eax, dword [0x100967c]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebx
leave
ret 0x10