Function at 0x70b180
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x73b519
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
mov dword [ebp - 0x100], ecx
push str.SYSTEMCurrentControlSetServicesEventLog_
lea ecx, [ebp - 0x30]
call fcn.0040aae0
mov dword [ebp - 4], 0
mov eax, dword [0x7c2410]
push eax
push 0
mov ecx, dword [ebp - 0x100]
add ecx, 0x44
push ecx
lea ecx, [ebp - 0x30]
call fcn.00447010
mov dword [ebp - 0x104], 0x7529d0
mov edx, dword [ebp - 0x104]
add edx, 1
mov dword [ebp - 0x108], edx
mov eax, dword [ebp - 0x104]
mov cl, byte [eax]
mov byte [ebp - 0x109], cl
add dword [ebp - 0x104], 1
cmp byte [ebp - 0x109], 0
jne 0x70b1eb
mov edx, dword [ebp - 0x104]
sub edx, dword [ebp - 0x108]
mov dword [ebp - 0x110], edx
mov eax, dword [ebp - 0x110]
push eax
push 0x7529d0
lea ecx, [ebp - 0x30]
call fcn.004472f0
mov ecx, dword [0x7c2410]
push ecx
push 0
mov edx, dword [ebp - 0x100]
add edx, 0xc
push edx
lea ecx, [ebp - 0x30]
call fcn.00447010
lea eax, [ebp - 0xa5]
mov dword [ebp - 0xa4], eax
push 0
push 0
lea ecx, [ebp - 0x4c]
call fcn.00446c40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
push ecx
lea edx, [ebp - 0x30]
push edx
call fcn.005a5ad0
add esp, 8
cmp dword [ebp - 0x34], 8
jb 0x70b287
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x114], eax
jmp 0x70b290
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x114], ecx
lea edx, [ebp - 0x50]
push edx
lea eax, [ebp - 0x14]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov ecx, dword [ebp - 0x114]
push ecx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x70b2e8
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x4c]
call fcn.00446c40
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.0040b0a0
jmp 0x70b494
cmp dword [ebp - 0x50], 1
jne 0x70b467
lea edx, [ebp - 0xb1]
mov dword [ebp - 0xb0], edx
push 0
push 0
lea ecx, [ebp - 0x6c]
call fcn.00446c40
mov byte [ebp - 4], 2
xor eax, eax
cmp dword [ebp - 0x58], 0
sete al
movzx ecx, al
test ecx, ecx
je 0x70b373
push str.PocoMsg.dll
lea edx, [ebp - 0x90]
push edx
call fcn.0070b4b0
add esp, 8
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0xb8], eax
mov byte [ebp - 4], 3
mov ecx, dword [0x7c2410]
push ecx
push 0
mov edx, dword [ebp - 0xb8]
push edx
lea ecx, [ebp - 0x6c]
call fcn.004471f0
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x90]
call fcn.00446c40
xor eax, eax
cmp dword [ebp - 0x58], 0
sete al
movzx ecx, al
test ecx, ecx
jne 0x70b457
mov dword [ebp - 0x70], 8
mov dword [ebp - 0x74], 7
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0xbc], edx
cmp dword [ebp - 0x54], 8
jb 0x70b3af
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x11c], eax
jmp 0x70b3b8
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x11c], ecx
mov edx, dword [ebp - 0xbc]
lea eax, [edx + edx + 2]
push eax
mov ecx, dword [ebp - 0x11c]
push ecx
push 1
push 0
push str.CategoryMessageFile
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0x54], 8
jb 0x70b3f7
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0x120], ecx
jmp 0x70b400
lea edx, [ebp - 0x68]
mov dword [ebp - 0x120], edx
mov eax, dword [ebp - 0xc0]
lea ecx, [eax + eax + 2]
push ecx
mov edx, dword [ebp - 0x120]
push edx
push 1
push 0
push str.EventMessageFile
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea ecx, [ebp - 0x70]
push ecx
push 4
push 0
push str.CategoryCount
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea eax, [ebp - 0x74]
push eax
push 4
push 0
push str.TypesSupported
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [ebp - 4], 1
push 0
push 1
lea ecx, [ebp - 0x6c]
call fcn.00446c40
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x4c]
call fcn.00446c40
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.0040b0a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret