Function at 0x401060
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x110
push ebx
push esi
lea eax, [esp + 8]
push edi
push eax
push str.SYSTEMCurrentControlSetServicesEventLogApplicationSvcName
push 0x80000002
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov esi, eax
test esi, esi
jne 0x401283
mov edx, dword [esp + 0xc]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [esp + 0x10]
push 4
push ecx
push 4
push eax
push str.TypesSupported
push edx
mov dword [esp + 0x28], 7
call ebx
mov esi, eax
test esi, esi
je 0x4010ce
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call edi
push eax
push str.RegSetValue_TypesSupported_failed:__x__result:__x_n
jmp 0x40124e
lea ecx, [esp + 0x18]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x401104
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push eax
push str.CreateEventRegister_GetModuleFileName_failed:__x_n
call fcn.00401860
mov edx, dword [esp + 0x14]
add esp, 8
push edx
jmp 0x401261
push 0x5c
lea eax, [esp + 0x1c]
push 0
push eax
call dword [sym.imp.SHELL32.dll_StrRChrA]
mov edx, eax
test edx, edx
jne 0x401139
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push eax
push str.CreateEventRegister_StrRChr_failed:__x_n
call fcn.00401860
mov ecx, dword [esp + 0x14]
add esp, 8
push ecx
jmp 0x401261
mov edi, str.provider.dll
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x18]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov edx, dword [esp + 0xc]
dec ecx
mov esi, ecx
lea ecx, [esp + 0x18]
push esi
push ecx
push 1
push eax
push str.EventMessageFile
push edx
call ebx
mov edi, eax
test edi, edi
je 0x401197
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call ebx
push eax
push str.RegSetValue_EventMessageFile_failed:__x__result:__x_n
jmp 0x4011c2
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x18]
push esi
push ecx
push 1
push 0
push str.ParameterMessageFile
push edx
call ebx
mov edi, eax
test edi, edi
je 0x4011ed
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call ebx
push eax
push str.RegSetValue_ParameterMessageFile_failed:__x__result:__x_n
call fcn.00401860
push edi
call fcn.00401000
mov eax, dword [esp + 0x1c]
add esp, 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
je 0x40129e
push esi
call ebx
jmp 0x40128a
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x18]
push esi
push ecx
push 1
push 0
push str.CategoryMessageFile
push edx
call ebx
mov esi, eax
test esi, esi
je 0x40121a
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call edi
push eax
push str.RegSetValue_CategoryMessageFile_failed:__x__result:__x_n
jmp 0x40124e
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push 4
push ecx
push 4
push 0
push str.CategoryCount
push edx
mov dword [esp + 0x2c], 1
call ebx
mov esi, eax
test esi, esi
je 0x401272
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call edi
push eax
push str.RegSetValue_CategoryCount_failed:__x__result:__x_n
call fcn.00401860
push esi
call fcn.00401000
mov eax, dword [esp + 0x1c]
add esp, 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
je 0x40129e
push esi
call edi
jmp 0x40128a
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
je 0x40129e
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RegCreateKey_failed:__x__result:__x_n
call fcn.00401860
push esi
call fcn.00401000
add esp, 0x10
pop edi
pop esi
pop ebx
add esp, 0x110
ret