Function at 0x40c340
Capabilities:
Check if file exists
Enumerate services
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov esi, ecx
call fcn.0040c0c0
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea eax, [ebp - 0x1c]
push eax
push str.SOFTWAREGoyooi8desk
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x40c37f
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push str.I8DeskCliSvr.exe
mov ecx, esi
call fcn.0040c770
test eax, eax
jne 0x40c373
push 0xf003f
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [ebp - 0x20], ebx
test ebx, ebx
je 0x40c4a0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0x10], 0
push eax
push 0
push 0
push 3
push 0x30
push ebx
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
test eax, eax
jne 0x40c499
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x40c499
push dword [ebp - 4]
call fcn.005158f1
add esp, 4
mov dword [ebp - 0xc], eax
test eax, eax
je 0x40c499
push dword [ebp - 4]
push 0
push eax
call fcn.0050ce60
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xc]
push 3
push 0x30
push ebx
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
test eax, eax
je 0x40c499
xor ebx, ebx
mov dword [ebp - 0x18], 0
cmp dword [ebp - 8], ebx
jbe 0x40c479
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
jmp 0x40c450
push str.i8deskclisvr
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x40c472
mov eax, dword [ebp - 0x14]
inc ebx
add eax, 0x24
mov dword [ebp - 0x14], eax
cmp ebx, dword [ebp - 8]
jb 0x40c450
jmp 0x40c479
mov dword [ebp - 0x18], 1
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0xc]
call fcn.005158ec
add esp, 4
cmp dword [ebp - 0x18], 0
jne 0x40c373
jmp 0x40c4a0
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [ebp - 0x20]
push eax
push str.SOFTWAREiCafe8
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x40c4c9
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push str.BarServerView.exe
mov ecx, esi
call fcn.0040c770
test eax, eax
jne 0x40c373
push str.BarClientView.exe
mov ecx, esi
call fcn.0040c770
test eax, eax
jne 0x40c373
push str.BarChargesView.exe
mov ecx, esi
call fcn.0040c770
test eax, eax
jne 0x40c373
lea eax, [ebp - 0x20]
push eax
push str.SOFTWARESicentwx2004Clt
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x40c4b4
lea eax, [ebp - 0x1c]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunwxClient
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x40c36a
push str.clsmn.exe
mov ecx, esi
call fcn.0040c770
test eax, eax
jne 0x40c373
push str.wxclient.exe
mov ecx, esi
call fcn.0040c770
test eax, eax
jne 0x40c373
lea eax, [ebp - 0x20]
push eax
push str.SOFTWAREHintsoftPubwinClient
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x40c4b4
push str.pubwinclient.exe
mov ecx, esi
call fcn.0040c770
test eax, eax
jne 0x40c373
lea eax, [ebp - 0x20]
push eax
push str.SoftWareStntManager
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40c5c9
push dword [ebp - 0x20]
call ebx
lea eax, [ebp - 0x1c]
push eax
push str.SYSTEMCurrentControlSetServicesSTVDISKX
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x40c5c9
push dword [ebp - 0x1c]
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
push eax
push str.SOFTWAREEYOOCLIENTSTATUS
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x40c620
push dword [ebp - 0x18]
call ebx
lea eax, [ebp - 0x14]
push eax
push str.SYSTEMCurrentControlSetServices_stpdrive
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x40c620
push dword [ebp - 0x14]
call ebx
lea eax, [ebp - 0x10]
push eax
push str.SYSTEMCurrentControlSetServicesSTVDISKX
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x40c620
push dword [ebp - 0x10]
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push str.D:HintSoftGameMenu
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40c373
push str.ManagerConsole.exe
mov ecx, esi
call fcn.0040c770
test eax, eax
jne 0x40c373
push str.HintClient.exe
mov ecx, esi
call fcn.0040c770
test eax, eax
jne 0x40c373
lea eax, [ebp - 0x20]
push eax
push str.SOFTWARERzx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x40c680
push dword [ebp - 0x20]
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c]
push eax
push str.SOFTWARERzx_Network
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x40c5b8
push str.Rzxclient.exe
mov ecx, esi
call fcn.0040c770
test eax, eax
jne 0x40c373
push str.RzxMon.exe
mov ecx, esi
call fcn.0040c770
test eax, eax
jne 0x40c373
lea eax, [ebp - 0x20]
push eax
push str.SOFTWAREQYsoftYBTClient
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x40c66f
lea eax, [ebp - 0x1c]
push eax
push str.SOFTWARERainsoft
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x40c5b8
push str.RsClient.exe
mov ecx, esi
call fcn.0040c770
test eax, eax
jne 0x40c373
push str.YBTClient.exe
mov ecx, esi
call fcn.0040c770
test eax, eax
jne 0x40c373
lea eax, [ebp - 0x20]
push eax
push str.SOFTWARESunlike
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x40c66f
push str.entry.exe
mov ecx, esi
call fcn.0040c770
test eax, eax
jne 0x40c373
push str.iKeeper.exe
mov ecx, esi
call fcn.0040c770
test eax, eax
jne 0x40c373
push str.ssp.exe
mov ecx, esi
call fcn.0040c770
test eax, eax
jne 0x40c373
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret