Function at 0x409820
Capabilities:
Access the windows event log
Delete registry key
Delete service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x44b004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
push edi
test eax, eax
je 0x409a94
movzx eax, word [eax]
mov ecx, 0x692f
cmp ax, cx
jne 0x40985c
mov ecx, esi
call fcn.00401480
jmp 0x40999f
mov ecx, 0x722f
cmp ax, cx
jne 0x409922
mov ecx, esi
call fcn.004013e0
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 0
push eax
mov ecx, esi
call fcn.004011d0
test al, al
je 0x40999f
mov edi, dword [ebp - 0x218]
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x4098a6
xor eax, eax
jmp 0x4098ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0x200
lea ecx, [esi + 0x11]
push ecx
push 0x400
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 0
push eax
push 0xf003f
push 0
push 0x4433a0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40999f
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
push eax
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40999f
mov ecx, 0x732f
cmp ax, cx
jne 0x40998e
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 0
push eax
mov ecx, esi
call fcn.004011d0
test al, al
je 0x40999f
mov edi, dword [ebp - 0x218]
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x409961
xor eax, eax
jmp 0x409967
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0x200
lea ecx, [esi + 0x11]
push ecx
push 0x400
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x40999f
mov ecx, 0x712f
cmp ax, cx
jne 0x40999f
mov ecx, esi
call fcn.004013e0
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov edi, eax
mov dword [ebp - 0x218], 0
test edi, edi
je 0x409a03
cmp byte [edi], 0
je 0x409a03
push 0
lea eax, [ebp - 0x218]
push eax
push 2
push 0x443400
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call ebx
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4099e0
push 0
lea eax, [ebp - 0x218]
sub ecx, edx
push eax
push ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xfffffffffffffff4
call edi
push eax
call ebx
jmp 0x409a09
mov edi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0x200
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.00417ec0
add esp, 0xc
add esi, 0x11
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409a27
sub ecx, edx
lea eax, [ebp - 0x204]
push ecx
push eax
push esi
call dword [sym.imp.USER32.dll_CharToOemBuffA]
push 0
lea eax, [ebp - 0x218]
push eax
push 2
push 0x443400
push 0xfffffffffffffff4
call edi
push eax
call ebx
lea ecx, [ebp - 0x204]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409a60
push 0
lea eax, [ebp - 0x218]
sub ecx, edx
push eax
push ecx
lea eax, [ebp - 0x204]
push eax
push 0xfffffffffffffff4
call edi
push eax
call ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041525a
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi]
call dword [eax]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov dword [esi + 0xc], eax
mov ecx, esi
mov eax, dword [esi]
call dword [eax]
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x214]
push eax
mov dword [ebp - 0x210], 0x4010c0
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x208], 0
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
je 0x409ae3
xor edi, edi
jmp 0x409aeb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push 0
push 0x200
lea ebx, [esi + 0x11]
push ebx
push 0x400
push edi
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
test edi, edi
je 0x409b36
mov eax, dword [esi + 0xc]
test eax, eax
je 0x409b36
push 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x218], ebx
push ecx
push 0
push 1
push 0
push 0
push 0
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041525a
mov esp, ebp
pop ebp
ret 4