Function at 0x44143f
Capabilities:
Access the windows event log
Delete registry value
Persist via windows service
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
call fcn.0043cd31
mov eax, dword [ebx]
xor esi, esi
push esi
push 1
push 0x64
push ebx
call dword [eax + 0x20]
mov edi, eax
cmp edi, esi
jge 0x441494
push edi
push 0x441cd8
push 1
call fcn.004015a0
add esp, 0xc
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401580
leave
ret 8
mov edi, 0x20006
push edi
push 0x413e84
push 0x80000000
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x220], esi
call fcn.00403d7c
cmp eax, esi
je 0x4414f2
jle 0x4414d1
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x441c48
push 1
call fcn.004015a0
add esp, 0xc
lea ecx, [ebp - 0x228]
call fcn.00403d1d
mov eax, esi
jmp 0x441483
push edi
push 0x413ef0
push dword [ebp - 0x228]
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x21c], esi
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x214], esi
call fcn.00403d7c
cmp eax, esi
je 0x44154a
jle 0x44152b
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x441bb8
push 1
call fcn.004015a0
add esp, 0xc
lea ecx, [ebp - 0x21c]
call fcn.00403d1d
jmp 0x4414e3
mov edi, 0x413f40
push edi
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp + 0xc], esi
je 0x4415e5
push 1
push 0x413ee0
push edi
lea ecx, [ebp - 0x21c]
call fcn.0043c49f
cmp eax, esi
je 0x441592
jle 0x441588
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x441b38
jmp 0x441533
push 1
push 0x441b24
push 0x441b00
lea ecx, [ebp - 0x21c]
call fcn.0043c49f
cmp eax, esi
jne 0x44157c
mov ecx, ebx
call fcn.0043daf6
mov edi, eax
cmp edi, esi
jge 0x4415e5
push edi
push 0x441a88
push 1
call fcn.004015a0
add esp, 0xc
lea ecx, [ebp - 0x21c]
call fcn.00403d1d
lea ecx, [ebp - 0x228]
call fcn.00403d1d
jmp 0x441481
push esi
push dword [ebp + 8]
mov ecx, ebx
call fcn.00441367
mov ebx, eax
cmp ebx, esi
jge 0x44160d
push ebx
push 0x441a00
push 1
call fcn.004015a0
add esp, 0xc
mov esi, ebx
jmp 0x44153d
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push 0x43b070
push 0x80000002
mov dword [ebp - 0x230], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x441671
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x210]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push 0x441980
jmp 0x4416a2
and edi, 0xffff
or edi, 0x80070000
mov esi, edi
jmp 0x44153d
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, esi
jne 0x4416b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x210]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push 0x4418f0
push 1
call fcn.004015a0
add esp, 0xc
cmp edi, esi
jle 0x44166a
jmp 0x44165e
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add eax, eax
push eax
lea eax, [ebp - 0x20c]
push eax
push 2
push esi
push 0x4418c8
push dword [ebp - 0x210]
call edi
test eax, eax
je 0x4416f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x210]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push 0x441b38
jmp 0x4416a2
push 4
lea eax, [ebp - 0x22c]
push eax
push 4
push esi
push 0x4418a8
push dword [ebp - 0x210]
mov dword [ebp - 0x22c], 7
call edi
test eax, eax
jne 0x4416d6
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x413ee0
push esi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov edi, eax
cmp edi, esi
jne 0x44174a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push 0x441818
jmp 0x4416a2
push esi
push esi
push esi
push esi
push esi
push 1
push esi
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
jne 0x441785
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
push 0x441798
push 1
call fcn.004015a0
add esp, 0xc
cmp ebx, 0x5de
je 0x441783
cmp ebx, 2
jne 0x441785
xor ebx, ebx
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x441606