Function at 0x10048f7
Capabilities:
Access the windows event log
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x478
mov eax, dword [0x1012070]
push esi
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x42c]
xor esi, esi
push eax
push 0x2001b
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x424], esi
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x470], esi
call fcn.010048d1
cmp eax, esi
mov dword [ebp - 0x420], eax
je 0x1004982
cmp eax, 2
jne 0x1004951
mov dword [ebp - 0x420], esi
jmp 0x1004dfc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push esi
push esi
push esi
push esi
mov edi, 0xc00007d3
push edi
push esi
push 1
push dword [0x1012b30]
mov dword [ebp - 0x420], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov dword [ebp - 0x420], edi
jmp 0x1004dfc
push esi
mov eax, 0x105
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x43c], eax
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x41c]
push eax
push esi
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push dword [ebp - 0x42c]
mov dword [ebp - 0x444], esi
mov word [ebp - 0x210], si
mov word [ebp - 0x41c], si
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
mov dword [ebp - 0x420], eax
je 0x1004dfc
mov edi, dword [sym.imp.ADVAPI32.dll_ReportEventW]
push ebx
xor ebx, ebx
inc ebx
lea eax, [ebp - 0x424]
push eax
push 0x2001b
push esi
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
mov dword [ebp - 0x420], eax
je 0x1004a3f
lea eax, [ebp - 0x210]
mov dword [ebp - 0x438], eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x438]
push eax
push 4
push ebx
push esi
push 0x800007d5
jmp 0x1004d70
inc dword [0x1012ff4]
push 0x1012fe0
push dword [0x1012fcc]
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x428]
push eax
push esi
push 0x1001930
push dword [ebp - 0x424]
call fcn.01009601
cmp dword [ebp - 0x428], esi
mov dword [ebp - 0x420], eax
je 0x1004af4
push dword [ebp - 0x428]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x1004acc
push dword [ebp - 0x428]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, eax
inc ecx
mov eax, 0x104
cmp ecx, eax
jg 0x1004ab8
push dword [ebp - 0x428]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push eax
push dword [ebp - 0x428]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
cmp dword [ebp - 0x428], esi
je 0x1004ae8
push dword [ebp - 0x428]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x470], esi
or dword [ebp - 0x448], 0xffffffff
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x448]
push eax
push 0x1001744
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x424]
call fcn.010027f0
cmp dword [ebp - 0x440], esi
mov dword [ebp - 0x420], eax
je 0x1004b43
cmp dword [ebp - 0x440], ebx
je 0x1004b43
cmp dword [ebp - 0x440], 2
jne 0x1004d7b
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x448]
push eax
push 0x1001544
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x424]
mov dword [ebp - 0x448], esi
call fcn.010027f0
cmp dword [ebp - 0x44c], ebx
mov dword [ebp - 0x420], eax
jne 0x1004d7b
push 4
lea eax, [ebp - 0x44c]
push eax
push 0x1001544
push dword [ebp - 0x424]
mov dword [ebp - 0x44c], esi
call fcn.01002a4f
cmp eax, esi
mov dword [ebp - 0x420], eax
je 0x1004bd1
lea eax, [ebp - 0x210]
mov dword [ebp - 0x438], eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x438]
push eax
push 4
push ebx
push esi
push 0x800007ea
jmp 0x1004d70
lea eax, [ebp - 0x478]
push eax
call fcn.01009395
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x464], eax
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x460], eax
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x46c]
push eax
push 0x1001510
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x424]
mov word [ebp - 0x46a], bx
mov dword [ebp - 0x468], 2
mov word [ebp - 0x46c], bx
call fcn.01002714
cmp dword [ebp - 0x458], esi
mov dword [ebp - 0x420], eax
jne 0x1004caf
cmp dword [ebp - 0x454], 0xffffffff
jne 0x1004c55
cmp dword [ebp - 0x450], 0x7fffffff
je 0x1004caf
or dword [ebp - 0x454], 0xffffffff
lea eax, [ebp - 0x45c]
push eax
push 0x1001510
push dword [ebp - 0x424]
mov dword [ebp - 0x450], 0x7fffffff
call fcn.01002a73
cmp eax, esi
mov dword [ebp - 0x420], eax
je 0x1004caf
lea eax, [ebp - 0x210]
mov dword [ebp - 0x438], eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x438]
push eax
push 4
push ebx
push esi
push 0x800007eb
jmp 0x1004d70
lea eax, [ebp - 0x478]
push eax
call fcn.01009395
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x46c]
push eax
push 0x1001504
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x424]
mov word [ebp - 0x46c], bx
mov word [ebp - 0x46a], 2
mov dword [ebp - 0x468], esi
mov dword [ebp - 0x464], esi
mov dword [ebp - 0x460], esi
call fcn.01002714
cmp dword [ebp - 0x458], esi
mov dword [ebp - 0x420], eax
jne 0x1004d7b
cmp dword [ebp - 0x454], esi
jne 0x1004d20
cmp dword [ebp - 0x450], esi
je 0x1004d7b
lea eax, [ebp - 0x45c]
push eax
push 0x1001504
push dword [ebp - 0x424]
mov dword [ebp - 0x454], esi
mov dword [ebp - 0x450], esi
call fcn.01002a73
cmp eax, esi
mov dword [ebp - 0x420], eax
je 0x1004d7b
lea eax, [ebp - 0x210]
mov dword [ebp - 0x438], eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x438]
push eax
push 4
push ebx
push esi
push 0x800007f0
push esi
push 2
push dword [0x1012b30]
call edi
cmp dword [ebp - 0x424], esi
je 0x1004d8f
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x444]
push esi
mov eax, 0x105
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x43c], eax
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x41c]
push eax
push esi
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x444]
mov dword [ebp - 0x424], esi
push dword [ebp - 0x42c]
mov word [ebp - 0x210], si
mov word [ebp - 0x41c], si
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
mov dword [ebp - 0x420], eax
jne 0x10049ed
pop ebx
cmp dword [ebp - 0x42c], esi
pop edi
pop esi
je 0x1004e12
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x420]
call fcn.01009963
leave
ret