Function at 0x6900b720
Capabilities:
Create service
Get common file path
Query service status
Start service
Write file on windows

Disassembly:
sub esp, 0x12c
mov ecx, dword [0x690c0a6c]
lea eax, [esp + 8]
push ebx
push eax
push 0
push ecx
call fcn.6900a530
mov ebx, eax
add esp, 0xc
test ebx, ebx
mov dword [esp + 8], ebx
jne 0x6900b754
mov eax, 7
pop ebx
add esp, 0x12c
ret
push esi
push edi
mov edi, dword [esp + 0x14]
lea edx, [esp + 0x34]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov al, byte [esp + 0x34]
xor ecx, ecx
test al, al
je 0x6900b77d
mov al, byte [esp + ecx + 0x35]
inc ecx
test al, al
jne 0x6900b774
mov eax, str.drivers_
sub ecx, eax
lea ecx, [esp + ecx + 0x34]
mov dl, byte [eax]
mov byte [ecx + eax], dl
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x6900b788
mov al, byte [esp + 0x34]
xor ecx, ecx
test al, al
je 0x6900b7a7
mov al, byte [esp + ecx + 0x35]
inc ecx
test al, al
jne 0x6900b79e
mov eax, dword [str.prodrv04.sys]
sub ecx, eax
lea ecx, [esp + ecx + 0x34]
mov dl, byte [eax]
mov byte [ecx + eax], dl
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x6900b7b2
push 0
push 0x80
push 2
push 0
push 1
lea eax, [esp + 0x48]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x6900b7e9
or esi, eax
jmp 0x6900b962
lea ecx, [esp + 0xc]
push 0
push ecx
push edi
push ebx
push esi
mov dword [esp + 0x20], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x6900b80d
or esi, 0xffffffff
jmp 0x6900b962
cmp dword [esp + 0xc], edi
je 0x6900b81b
or esi, 0xffffffff
jmp 0x6900b962
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
jne 0x6900b83b
xor esi, esi
jmp 0x6900b962
mov eax, str.SystemRootSystem32drivers_
lea esi, [esp + 0x34]
sub esi, eax
mov dl, byte [eax]
mov cl, byte [eax]
mov byte [esi + eax], dl
inc eax
test cl, cl
jne 0x6900b846
mov al, byte [esp + 0x34]
xor ecx, ecx
test al, al
je 0x6900b865
mov al, byte [esp + ecx + 0x35]
inc ecx
test al, al
jne 0x6900b85c
mov eax, dword [str.prodrv04.sys]
sub ecx, eax
lea esi, [esp + ecx + 0x34]
mov cl, byte [eax]
mov byte [esi + eax], cl
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x6900b870
push 0
mov eax, dword [str.Star_Force_copy_protection_driver_v4]
push 0
mov ecx, dword [str.prodrv04]
push 0
push 0
lea edx, [esp + 0x44]
push str.Star_Force
push edx
push 1
push 1
push 1
push 0x14
push eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x6900b8ec
call edi
cmp eax, 0x431
je 0x6900b8cd
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor esi, esi
jmp 0x6900b962
mov edx, dword [str.prodrv04]
push 0x14
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x6900b8ec
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x6900b962
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x6900b93c
call edi
mov edi, eax
cmp edi, 0x3e5
jne 0x6900b93e
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [esp + 0x18]
push eax
push esi
call edi
test eax, eax
je 0x6900b92c
cmp dword [esp + 0x1c], 2
jne 0x6900b93c
lea ecx, [esp + 0x18]
push ecx
push esi
call edi
test eax, eax
jne 0x6900b919
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
xor esi, esi
jmp 0x6900b962
xor edi, edi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
test edi, edi
jne 0x6900b955
mov esi, 1
jmp 0x6900b962
xor edx, edx
cmp edi, 0x420
sete dl
mov esi, edx
mov eax, dword [esp + 0x10]
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x12c
ret