Function at 0x741640
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x775b69
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
mov dword [ebp - 0x100], ecx
push str.SYSTEMCurrentControlSetServicesEventLog_
lea ecx, [ebp - 0x30]
call fcn.0041c2b0
mov dword [ebp - 4], 0
mov eax, dword [0x7d4aa0]
push eax
push 0
mov ecx, dword [ebp - 0x100]
add ecx, 0x44
push ecx
lea ecx, [ebp - 0x30]
call fcn.0044be11
mov dword [ebp - 0x104], 0x7975c8
mov edx, dword [ebp - 0x104]
add edx, 1
mov dword [ebp - 0x108], edx
mov eax, dword [ebp - 0x104]
mov cl, byte [eax]
mov byte [ebp - 0x109], cl
add dword [ebp - 0x104], 1
cmp byte [ebp - 0x109], 0
jne 0x7416ab
mov edx, dword [ebp - 0x104]
sub edx, dword [ebp - 0x108]
mov dword [ebp - 0x110], edx
mov eax, dword [ebp - 0x110]
push eax
push 0x7975c8
lea ecx, [ebp - 0x30]
call fcn.0044beb8
mov ecx, dword [0x7d4aa0]
push ecx
push 0
mov edx, dword [ebp - 0x100]
add edx, 0xc
push edx
lea ecx, [ebp - 0x30]
call fcn.0044be11
lea eax, [ebp - 0xa5]
mov dword [ebp - 0xa4], eax
push 0
push 0
lea ecx, [ebp - 0x4c]
call fcn.00449c25
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
push ecx
lea edx, [ebp - 0x30]
push edx
call fcn.005db2f0
add esp, 8
cmp dword [ebp - 0x34], 8
jb 0x741747
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x114], eax
jmp 0x741750
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x114], ecx
lea edx, [ebp - 0x50]
push edx
lea eax, [ebp - 0x14]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov ecx, dword [ebp - 0x114]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x7417a8
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x4c]
call fcn.00449c25
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.0041c8f0
jmp 0x741954
cmp dword [ebp - 0x50], 1
jne 0x741927
lea edx, [ebp - 0xb1]
mov dword [ebp - 0xb0], edx
push 0
push 0
lea ecx, [ebp - 0x6c]
call fcn.00449c25
mov byte [ebp - 4], 2
xor eax, eax
cmp dword [ebp - 0x58], 0
sete al
movzx ecx, al
test ecx, ecx
je 0x741833
push str.PocoMsg.dll
lea edx, [ebp - 0x90]
push edx
call fcn.00741970
add esp, 8
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0xb8], eax
mov byte [ebp - 4], 3
mov ecx, dword [0x7d4aa0]
push ecx
push 0
mov edx, dword [ebp - 0xb8]
push edx
lea ecx, [ebp - 0x6c]
call fcn.0044bcf3
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x90]
call fcn.00449c25
xor eax, eax
cmp dword [ebp - 0x58], 0
sete al
movzx ecx, al
test ecx, ecx
jne 0x741917
mov dword [ebp - 0x70], 8
mov dword [ebp - 0x74], 7
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0xbc], edx
cmp dword [ebp - 0x54], 8
jb 0x74186f
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x11c], eax
jmp 0x741878
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x11c], ecx
mov edx, dword [ebp - 0xbc]
lea eax, [edx + edx + 2]
push eax
mov ecx, dword [ebp - 0x11c]
push ecx
push 1
push 0
push str.CategoryMessageFile
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0x54], 8
jb 0x7418b7
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0x120], ecx
jmp 0x7418c0
lea edx, [ebp - 0x68]
mov dword [ebp - 0x120], edx
mov eax, dword [ebp - 0xc0]
lea ecx, [eax + eax + 2]
push ecx
mov edx, dword [ebp - 0x120]
push edx
push 1
push 0
push str.EventMessageFile
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea ecx, [ebp - 0x70]
push ecx
push 4
push 0
push str.CategoryCount
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea eax, [ebp - 0x74]
push eax
push 4
push 0
push str.TypesSupported
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [ebp - 4], 1
push 0
push 1
lea ecx, [ebp - 0x6c]
call fcn.00449c25
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x4c]
call fcn.00449c25
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.0041c8f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret