Function at 0x5270d0
Capabilities:
Delete registry key
Persist via windows service
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x7575d8
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x81f390]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push esi
push edi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x7c]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x34], 0x10
lea eax, [edi + 0x20]
jb 0x52710e
mov eax, dword [eax]
lea ecx, [esp + 0x50]
push ecx
push reloc.WS2_32.dll_bind
push eax
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryA]
test eax, eax
je 0x52712f
push 0x464
mov ecx, edi
call fcn.00527610
push 0x2b
push str.SystemCurrentControlSetServicesEventLog_
lea ecx, [esp + 0x68]
mov dword [esp + 0x7c], 0xf
mov dword [esp + 0x78], 0
mov byte [esp + 0x68], 0
call fcn.00409620
mov dword [esp + 0x5c], vtable.wbs::StringBase_char_.0
cmp byte [edi + 0x58], 0
mov dword [esp + 0x84], 0
je 0x5271d1
push 6
push str.System
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
call fcn.00409620
mov dword [esp + 0x10], vtable.wbs::StringBase_char_.0
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x1c]
mov byte [esp + 0x8c], 1
push eax
lea ecx, [esp + 0x6c]
call fcn.004094b0
cmp dword [esp + 0x28], 0x10
mov byte [esp + 0x84], 0
mov dword [esp + 0x10], vtable.wbs::StringBase_char_.0
jb 0x52723b
push dword [esp + 0x14]
jmp 0x527233
push 0xb
push str.Application
lea ecx, [esp + 0x38]
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], 0
mov byte [esp + 0x38], 0
call fcn.00409620
mov dword [esp + 0x2c], vtable.wbs::StringBase_char_.0
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x38]
mov byte [esp + 0x8c], 2
push eax
lea ecx, [esp + 0x6c]
call fcn.004094b0
cmp dword [esp + 0x44], 0x10
mov byte [esp + 0x84], 0
mov dword [esp + 0x2c], vtable.wbs::StringBase_char_.0
jb 0x52723b
push dword [esp + 0x30]
call fcn.006f75a9
add esp, 4
cmp dword [esp + 0x74], 0x10
lea ecx, [esp + 0x54]
push ecx
lea ecx, [esp + 0x50]
push ecx
push 0
push 0x20006
push 0
push str.SubKey
lea eax, [esp + 0x78]
cmovae eax, dword [esp + 0x78]
push 0
push eax
push dword [esp + 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push dword [esp + 0x50]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
call ebx
test esi, esi
je 0x52728c
push 0x464
mov ecx, edi
call fcn.00527610
cmp dword [edi + 0x18], 0x10
lea esi, [edi + 4]
jb 0x527297
mov esi, dword [esi]
lea eax, [esp + 0x48]
push eax
push esi
push dword [esp + 0x54]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x5272b6
push esi
push dword [esp + 0x50]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
push 0x20006
push 0
push str.SubKey
push 0
push esi
push dword [esp + 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x5272eb
push 0x464
mov ecx, edi
call fcn.00527610
push dword [esp + 0x4c]
call ebx
cmp dword [edi + 0x50], 0x10
lea ecx, [edi + 0x3c]
mov eax, dword [edi + 0x4c]
jb 0x5272ff
mov ecx, dword [ecx]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc eax
push eax
push ecx
push 1
push 0
push str.EventMessageFile
push dword [esp + 0x5c]
call esi
test eax, eax
je 0x527327
push 0x464
mov ecx, edi
call fcn.00527610
push 4
lea eax, [esp + 0x5c]
mov dword [esp + 0x5c], 7
push eax
push 4
push 0
push str.TypesSupported
push dword [esp + 0x5c]
call esi
test eax, eax
je 0x527355
push 0x464
mov ecx, edi
call fcn.00527610
push dword [esp + 0x48]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [esp + 0x48]
call ebx
lea ecx, [esp + 0x5c]
call fcn.0061b700
mov ecx, dword [esp + 0x7c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.006f7ca4
add esp, 0x78
ret