Function at 0x100011f0
Capabilities:
Access the windows event log
Allocate or change rwx memory
Check for software breakpoints
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
mov eax, dword [0x1001d004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x1001aa24
push str.KernelBase.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
xor esi, esi
mov dword [ebp - 0x43c], edi
test edi, edi
je 0x10001395
push 0x30
call fcn.10007b83
add esp, 4
mov dword [0x1001e3a0], eax
test eax, eax
je 0x10001395
lea ecx, [ebp - 0x438]
push ecx
push 0x40
push 0x30
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ebx, dword [0x1001e3a0]
mov ecx, edi
mov dword [ebp - 0x428], ecx
jmp 0x10001276
mov ecx, dword [ebp - 0x428]
push ecx
lea edx, [ebp - 0x418]
call fcn.10001fb0
add esp, 4
mov ecx, eax
test byte [ebp - 0x418], 1
mov dword [ebp - 0x434], ecx
jne 0x10001329
mov edx, dword [ebp - 0x428]
cmp ecx, 1
jne 0x100012bf
movzx ecx, byte [ebp - 0x414]
mov al, byte [ecx + edx]
cmp al, 0xcc
je 0x10001329
cmp al, 0xc3
je 0x10001329
mov ecx, dword [ebp - 0x434]
jmp 0x100012d1
cmp ecx, 3
jne 0x100012d1
movzx eax, byte [ebp - 0x414]
cmp byte [eax + edx], 0xc2
je 0x10001329
lea eax, [ecx + esi]
mov dword [ebp - 0x438], eax
add eax, 5
cmp eax, 0x30
ja 0x10001329
test byte [ebp - 0x418], 0x80
mov edi, ebx
mov esi, edx
rep movsb byte es:[edi], byte [esi]
je 0x10001306
mov eax, edx
sub eax, ebx
cmp byte [ebp - 0x413], 2
jne 0x10001303
add dword [ebx + 2], eax
jmp 0x10001306
add dword [ebx + 1], eax
add edx, dword [ebp - 0x434]
add ebx, dword [ebp - 0x434]
mov esi, dword [ebp - 0x438]
mov dword [ebp - 0x428], edx
cmp esi, 5
jb 0x10001270
jmp 0x1000134e
cmp esi, 5
jae 0x10001348
push dword [0x1001e3a0]
call fcn.10007c01
add esp, 4
mov dword [0x1001e3a0], 0
jmp 0x10001395
mov edx, dword [ebp - 0x428]
mov edi, dword [ebp - 0x43c]
lea eax, [ebp - 0x42c]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub edx, ebx
push eax
push 0x40
push 5
sub edx, 5
mov byte [ebx], 0xe9
push edi
mov dword [ebx + 1], edx
call esi
mov eax, 0x10001030
mov byte [edi], 0xe9
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
lea eax, [ebp - 0x43c]
push eax
push dword [ebp - 0x42c]
push 5
push edi
call esi
push 0x104
lea eax, [ebp - 0x108]
mov dword [ebp - 0x418], str.Stop
push 0
push eax
mov dword [ebp - 0x414], str.SessionChange
mov dword [ebp - 0x410], str.Shutdown
call fcn.100039a0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
xor ebx, ebx
mov dword [ebp - 0x42c], esi
nop dword [eax]
push 0x104
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.100039a0
push 0xa
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.1000796c
mov edi, dword [ebp + ebx - 0x418]
lea eax, [ebp - 0x20c]
add esp, 0x1c
mov ecx, 0x104
nop dword [eax]
cmp word [eax], 0
je 0x1000142e
add eax, 2
sub ecx, 1
jne 0x10001420
mov eax, 0x104
mov esi, ecx
sub eax, ecx
neg esi
sbb esi, esi
and esi, eax
test ecx, ecx
je 0x10001486
mov edx, 0x104
lea ecx, [ebp - 0x20c]
lea ecx, [ecx + esi*2]
sub edx, esi
je 0x10001479
mov eax, SysReAllocString
sub edi, ecx
nop word [eax + eax]
test eax, eax
je 0x10001479
movzx esi, word [edi + ecx]
test si, si
je 0x10001479
mov word [ecx], si
dec eax
add ecx, 2
sub edx, 1
jne 0x10001460
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, dword [ebp - 0x42c]
mov dword [ebp + ebx - 0x424], eax
add ebx, 4
cmp ebx, 0xc
jl 0x100013e0
lea eax, [ebp - 0x424]
push eax
push 0x10001600
push str.ModdedService
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerExW]
mov dword [0x1001e390], eax
test eax, eax
je 0x100015cb
xor edx, edx
mov dword [0x1001e370], 0x20
push 0xbb8
mov dword [0x1001e380], 0
lea ecx, [edx + 4]
call fcn.10001650
add esp, 4
test eax, eax
je 0x10001505
call fcn.10001a70
mov ecx, dword [0x1001e390]
test ecx, ecx
je 0x100015cb
mov eax, dword [0x1001e38c]
push 0x1001e370
push ecx
mov dword [0x1001e374], 1
mov dword [0x1001e37c], eax
mov dword [0x1001e388], 0
mov dword [0x1001e378], 0x84
mov dword [0x1001e384], 0
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
test eax, eax
jne 0x100015cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.ModdedService
push 0
mov dword [0x1001e38c], eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
push dword [0x1001e38c]
mov esi, eax
lea eax, [ebp - 0x40c]
push str.ModdedService
push str._s_error:__d
push eax
call fcn.10001750
add esp, 0x10
mov dword [ebp - 0x42c], 0x1001aac4
lea eax, [ebp - 0x40c]
mov dword [ebp - 0x430], eax
test esi, esi
je 0x100015cb
push 0
lea eax, [ebp - 0x430]
push eax
push 0
push 2
push 0
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
push dword [ebp + esi*4 - 0x424]
call edi
inc esi
cmp esi, 3
jl 0x100015d3
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10002224
mov esp, ebp
pop ebp
ret 8