Function at 0x1006090
Capabilities:
Access the windows event log
Query or enumerate registry key

Disassembly:
push 0x658
push 0x1001998
call fcn.01009f68
mov eax, dword [0x1012070]
mov dword [ebp - 0x1c], eax
xor esi, esi
mov dword [ebp - 0x64c], esi
mov dword [ebp - 0x650], esi
mov dword [ebp - 0x648], esi
mov dword [ebp - 0x658], esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x64c]
push eax
push 0x20019
call fcn.010048d1
mov dword [ebp - 0x644], eax
cmp eax, esi
je 0x100612c
cmp eax, 2
jne 0x1006105
mov dword [ebp - 0x644], esi
cmp dword [ebp - 0x644], 0x103
jne 0x10060fc
mov dword [ebp - 0x644], esi
or dword [ebp - 4], 0xffffffff
jmp 0x1006345
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x644], eax
push esi
push esi
push esi
push esi
push esi
push 0xc00007d3
push esi
push 1
push dword [0x1012b30]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
jmp 0x10060ea
mov dword [ebp - 0x654], esi
mov word [ebp - 0x228], si
mov eax, 0x105
mov dword [ebp - 0x660], eax
mov word [ebp - 0x434], si
mov dword [ebp - 0x65c], eax
mov ebx, 0x104
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
lea eax, [ebp - 0x65c]
push eax
lea eax, [ebp - 0x434]
push eax
push esi
lea eax, [ebp - 0x660]
push eax
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x654]
push dword [ebp - 0x64c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x644], eax
cmp eax, 0x103
je 0x10060ea
lea eax, [ebp - 0x650]
push eax
push 0x2001b
push esi
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x64c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x644], eax
cmp eax, esi
jne 0x10062d0
inc dword [0x1012ff4]
push 0x1012fe0
push dword [0x1012fcc]
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
lea eax, [ebp - 0x228]
push eax
call edi
test eax, eax
jle 0x1006220
lea eax, [ebp - 0x228]
push eax
call edi
inc eax
cmp eax, ebx
jle 0x1006201
mov eax, ebx
jmp 0x100620b
lea eax, [ebp - 0x228]
push eax
call edi
inc eax
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x640]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x658]
push eax
lea eax, [ebp - 0x648]
push eax
push esi
push 0x1001930
push dword [ebp - 0x650]
call fcn.01009601
mov dword [ebp - 0x644], eax
cmp dword [ebp - 0x648], esi
je 0x10062af
push dword [ebp - 0x648]
call edi
test eax, eax
jle 0x1006287
push dword [ebp - 0x648]
call edi
inc eax
cmp eax, ebx
jle 0x100626a
mov eax, ebx
jmp 0x1006273
push dword [ebp - 0x648]
call edi
inc eax
push eax
push dword [ebp - 0x648]
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
cmp dword [ebp - 0x648], esi
je 0x10062a3
push dword [ebp - 0x648]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x648], esi
mov dword [ebp - 0x658], esi
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x640]
push eax
push dword [ebp - 0x650]
call fcn.01005e56
mov dword [ebp - 0x644], eax
jmp 0x1006303
lea eax, [ebp - 0x228]
mov dword [ebp - 0x668], eax
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x668]
push eax
push 4
push 1
push esi
push 0x800007d5
push esi
push 2
push dword [0x1012b30]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov dword [ebp - 0x644], esi
inc dword [ebp - 0x654]
mov word [ebp - 0x228], si
mov dword [ebp - 0x660], ebx
mov word [ebp - 0x434], si
mov dword [ebp - 0x65c], ebx
jmp 0x100615c
cmp dword [ebp - 0x64c], esi
je 0x1006359
push dword [ebp - 0x64c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x644]
mov ecx, dword [ebp - 0x1c]
call fcn.01009963
call fcn.01009fa3
ret