Function at 0x4130e0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4beec0
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push ebx
push esi
push edi
mov eax, dword [0x57e030]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
lea ecx, [esp + 0x14]
call fcn.00404990
lea eax, [esp + 0x14]
xor ebx, ebx
push eax
mov dword [esp + 0x84], ebx
call fcn.0041b0b0
add esp, 4
test al, al
je 0x413331
push str.SYSTEMCurrentControlSet_serviceseventlogApplication_
lea ecx, [esp + 0x34]
push ecx
call fcn.004049f0
push 0x556004
lea edx, [esp + 0x34]
push edx
mov byte [esp + 0x88], 1
call fcn.00404c90
mov esi, dword [esp + 0x40]
cmp esi, dword [esp + 0x44]
jbe 0x413168
call fcn.00480e22
mov eax, dword [esp + 0x34]
cmp eax, ebx
jne 0x413376
call fcn.00480e22
xor eax, eax
cmp esi, dword [eax + 0x10]
jb 0x413185
call fcn.00480e22
push ebx
push 1
push esi
push reloc.WS2_32.dll_bind
lea eax, [esp + 0x5c]
push eax
call fcn.0041bac0
mov eax, dword [esp + 0x50]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [esp + 0x10], ebx
cmp eax, ebx
je 0x4131bc
push 4
lea ecx, [esp + 0x14]
push ecx
push 4
push ebx
push str.CategoryCount
push eax
call edi
mov esi, dword [esp + 0x24]
cmp esi, dword [esp + 0x28]
jbe 0x4131cb
call fcn.00480e22
mov eax, dword [esp + 0x18]
cmp eax, ebx
jne 0x41337d
call fcn.00480e22
xor eax, eax
cmp esi, dword [eax + 0x10]
jb 0x4131e8
call fcn.00480e22
cmp dword [esp + 0x50], ebx
je 0x413217
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4131f3
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
mov eax, dword [esp + 0x50]
push edx
push esi
push 1
push ebx
push str.CategoryMessageFile
push eax
call edi
mov esi, dword [esp + 0x24]
cmp esi, dword [esp + 0x28]
jbe 0x413226
call fcn.00480e22
mov eax, dword [esp + 0x18]
cmp eax, ebx
jne 0x413384
call fcn.00480e22
xor eax, eax
cmp esi, dword [eax + 0x10]
jb 0x413243
call fcn.00480e22
cmp dword [esp + 0x50], ebx
je 0x413274
mov eax, esi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x413250
sub eax, edx
mov edx, dword [esp + 0x50]
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
push esi
push 1
push ebx
push str.EventMessageFile
push edx
call edi
mov esi, dword [esp + 0x24]
cmp esi, dword [esp + 0x28]
jbe 0x413283
call fcn.00480e22
mov eax, dword [esp + 0x18]
cmp eax, ebx
jne 0x41338b
call fcn.00480e22
xor eax, eax
cmp esi, dword [eax + 0x10]
jb 0x4132a0
call fcn.00480e22
cmp dword [esp + 0x50], ebx
je 0x4132d4
mov eax, esi
lea edx, [eax + 2]
jmp 0x4132b0
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4132b0
mov ecx, dword [esp + 0x50]
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push ebx
push str.ParameterMessageFile
push ecx
call edi
mov eax, dword [esp + 0x50]
mov dword [esp + 0x10], 7
cmp eax, ebx
je 0x4132f6
push 4
lea edx, [esp + 0x14]
push edx
push 4
push ebx
push str.TypesSupported
push eax
call edi
lea ecx, [esp + 0x4c]
call fcn.0041bbc0
mov eax, dword [esp + 0x40]
mov dword [esp + 0x30], vtable.StringStorage.0
cmp eax, ebx
je 0x413318
push eax
call fcn.00480e32
add esp, 4
mov eax, dword [esp + 0x34]
push eax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
call fcn.00480e32
add esp, 4
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], vtable.StringStorage.0
cmp eax, ebx
je 0x41334a
push eax
call fcn.00480e32
add esp, 4
mov ecx, dword [esp + 0x18]
push ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.00480e32
add esp, 4
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [eax]
jmp 0x41317b
mov eax, dword [eax]
jmp 0x4131de
mov eax, dword [eax]
jmp 0x413239
mov eax, dword [eax]
jmp 0x413296