Function at 0x441551
Capabilities:
Access the windows event log
Delete registry value
Persist via windows service
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
call fcn.0043ce41
mov eax, dword [ebx]
xor esi, esi
push esi
push 1
push 0x64
push ebx
call dword [eax + 0x20]
mov edi, eax
cmp edi, esi
jge 0x4415a6
push edi
push 0x441de8
push 1
call fcn.004015a0
add esp, 0xc
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401580
leave
ret 8
mov edi, 0x20006
push edi
push 0x41488c
push 0x80000000
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x220], esi
call fcn.0040314f
cmp eax, esi
je 0x441604
jle 0x4415e3
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x441d58
push 1
call fcn.004015a0
add esp, 0xc
lea ecx, [ebp - 0x228]
call fcn.004030f0
mov eax, esi
jmp 0x441595
push edi
push 0x4148f8
push dword [ebp - 0x228]
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x21c], esi
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x214], esi
call fcn.0040314f
cmp eax, esi
je 0x44165c
jle 0x44163d
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x441cc8
push 1
call fcn.004015a0
add esp, 0xc
lea ecx, [ebp - 0x21c]
call fcn.004030f0
jmp 0x4415f5
mov edi, 0x414948
push edi
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp + 0xc], esi
je 0x4416f7
push 1
push 0x4148e8
push edi
lea ecx, [ebp - 0x21c]
call fcn.0043c5af
cmp eax, esi
je 0x4416a4
jle 0x44169a
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x441c48
jmp 0x441645
push 1
push 0x441c34
push 0x441c10
lea ecx, [ebp - 0x21c]
call fcn.0043c5af
cmp eax, esi
jne 0x44168e
mov ecx, ebx
call fcn.0043dc06
mov edi, eax
cmp edi, esi
jge 0x4416f7
push edi
push 0x441b98
push 1
call fcn.004015a0
add esp, 0xc
lea ecx, [ebp - 0x21c]
call fcn.004030f0
lea ecx, [ebp - 0x228]
call fcn.004030f0
jmp 0x441593
push esi
push dword [ebp + 8]
mov ecx, ebx
call fcn.00441479
mov ebx, eax
cmp ebx, esi
jge 0x44171f
push ebx
push 0x441b10
push 1
call fcn.004015a0
add esp, 0xc
mov esi, ebx
jmp 0x44164f
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push 0x43b1e8
push 0x80000002
mov dword [ebp - 0x230], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x441783
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x210]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push 0x441a90
jmp 0x4417b4
and edi, 0xffff
or edi, 0x80070000
mov esi, edi
jmp 0x44164f
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, esi
jne 0x4417c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x210]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push 0x441a00
push 1
call fcn.004015a0
add esp, 0xc
cmp edi, esi
jle 0x44177c
jmp 0x441770
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add eax, eax
push eax
lea eax, [ebp - 0x20c]
push eax
push 2
push esi
push 0x4419d8
push dword [ebp - 0x210]
call edi
test eax, eax
je 0x441804
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x210]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push 0x441c48
jmp 0x4417b4
push 4
lea eax, [ebp - 0x22c]
push eax
push 4
push esi
push 0x4419b8
push dword [ebp - 0x210]
mov dword [ebp - 0x22c], 7
call edi
test eax, eax
jne 0x4417e8
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x4148e8
push esi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov edi, eax
cmp edi, esi
jne 0x44185c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push 0x441928
jmp 0x4417b4
push esi
push esi
push esi
push esi
push esi
push 1
push esi
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
jne 0x441897
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
push 0x4418a8
push 1
call fcn.004015a0
add esp, 0xc
cmp ebx, 0x5de
je 0x441895
cmp ebx, 2
jne 0x441897
xor ebx, ebx
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x441718