Function at 0x48a340
Capabilities:
Check if file exists
Enumerate services
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov esi, ecx
call fcn.0048a0c0
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea eax, [ebp - 0x1c]
push eax
push str.SOFTWAREGoyooi8desk
push 0x80000002
call edi
test eax, eax
jne 0x48a37f
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push str.I8DeskCliSvr.exe
mov ecx, esi
call fcn.0048a770
test eax, eax
jne 0x48a373
push 0xf003f
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [ebp - 0x20], ebx
test ebx, ebx
je 0x48a4a0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0x10], 0
push eax
push 0
push 0
push 3
push 0x30
push ebx
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
test eax, eax
jne 0x48a499
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x48a499
push dword [ebp - 4]
call fcn.004c98ac
add esp, 4
mov dword [ebp - 0xc], eax
test eax, eax
je 0x48a499
push dword [ebp - 4]
push 0
push eax
call fcn.004c10f0
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xc]
push 3
push 0x30
push ebx
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
test eax, eax
je 0x48a499
xor ebx, ebx
mov dword [ebp - 0x18], 0
cmp dword [ebp - 8], ebx
jbe 0x48a479
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
jmp 0x48a450
push str.i8deskclisvr
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x48a472
mov eax, dword [ebp - 0x14]
inc ebx
add eax, 0x24
mov dword [ebp - 0x14], eax
cmp ebx, dword [ebp - 8]
jb 0x48a450
jmp 0x48a479
mov dword [ebp - 0x18], 1
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0xc]
call fcn.004c98a7
add esp, 4
cmp dword [ebp - 0x18], 0
jne 0x48a373
jmp 0x48a4a0
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [ebp - 0x20]
push eax
push str.SOFTWAREiCafe8
push 0x80000002
call edi
test eax, eax
jne 0x48a4c9
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push str.BarServerView.exe
mov ecx, esi
call fcn.0048a770
test eax, eax
jne 0x48a373
push str.BarClientView.exe
mov ecx, esi
call fcn.0048a770
test eax, eax
jne 0x48a373
push str.BarChargesView.exe
mov ecx, esi
call fcn.0048a770
test eax, eax
jne 0x48a373
lea eax, [ebp - 0x20]
push eax
push str.SOFTWARESicentwx2004Clt
push 0x80000002
call edi
test eax, eax
je 0x48a4b4
lea eax, [ebp - 0x1c]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunwxClient
push 0x80000002
call edi
test eax, eax
je 0x48a36a
push str.clsmn.exe
mov ecx, esi
call fcn.0048a770
test eax, eax
jne 0x48a373
push str.wxclient.exe
mov ecx, esi
call fcn.0048a770
test eax, eax
jne 0x48a373
lea eax, [ebp - 0x20]
push eax
push str.SOFTWAREHintsoftPubwinClient
push 0x80000002
call edi
test eax, eax
je 0x48a4b4
push str.pubwinclient.exe
mov ecx, esi
call fcn.0048a770
test eax, eax
jne 0x48a373
lea eax, [ebp - 0x20]
push eax
push str.SoftWareStntManager
push 0x80000002
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x48a5c9
push dword [ebp - 0x20]
call ebx
lea eax, [ebp - 0x1c]
push eax
push str.SYSTEMCurrentControlSetServicesSTVDISKX
push 0x80000002
call edi
test eax, eax
jne 0x48a5c9
push dword [ebp - 0x1c]
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
push eax
push str.SOFTWAREEYOOCLIENTSTATUS
push 0x80000002
call edi
test eax, eax
jne 0x48a620
push dword [ebp - 0x18]
call ebx
lea eax, [ebp - 0x14]
push eax
push str.SYSTEMCurrentControlSetServices_stpdrive
push 0x80000002
call edi
test eax, eax
jne 0x48a620
push dword [ebp - 0x14]
call ebx
lea eax, [ebp - 0x10]
push eax
push str.SYSTEMCurrentControlSetServicesSTVDISKX
push 0x80000002
call edi
test eax, eax
jne 0x48a620
push dword [ebp - 0x10]
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push str.D:HintSoftGameMenu
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x48a373
push str.ManagerConsole.exe
mov ecx, esi
call fcn.0048a770
test eax, eax
jne 0x48a373
push str.HintClient.exe
mov ecx, esi
call fcn.0048a770
test eax, eax
jne 0x48a373
lea eax, [ebp - 0x20]
push eax
push str.SOFTWARERzx
push 0x80000002
call edi
test eax, eax
jne 0x48a680
push dword [ebp - 0x20]
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c]
push eax
push str.SOFTWARERzx_Network
push 0x80000002
call edi
test eax, eax
je 0x48a5b8
push str.Rzxclient.exe
mov ecx, esi
call fcn.0048a770
test eax, eax
jne 0x48a373
push str.RzxMon.exe
mov ecx, esi
call fcn.0048a770
test eax, eax
jne 0x48a373
lea eax, [ebp - 0x20]
push eax
push str.SOFTWAREQYsoftYBTClient
push 0x80000002
call edi
test eax, eax
je 0x48a66f
lea eax, [ebp - 0x1c]
push eax
push str.SOFTWARERainsoft
push 0x80000002
call edi
test eax, eax
je 0x48a5b8
push str.RsClient.exe
mov ecx, esi
call fcn.0048a770
test eax, eax
jne 0x48a373
push str.YBTClient.exe
mov ecx, esi
call fcn.0048a770
test eax, eax
jne 0x48a373
lea eax, [ebp - 0x20]
push eax
push str.SOFTWARESunlike
push 0x80000002
call edi
test eax, eax
je 0x48a66f
push str.entry.exe
mov ecx, esi
call fcn.0048a770
test eax, eax
jne 0x48a373
push str.iKeeper.exe
mov ecx, esi
call fcn.0048a770
test eax, eax
jne 0x48a373
push str.ssp.exe
mov ecx, esi
call fcn.0048a770
test eax, eax
jne 0x48a373
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret