Function at 0x48cd50
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54d6b3
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
push esi
push edi
push ecx
lea edi, [ebp - 0x288]
mov ecx, 0x9f
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x5a2184]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], 0
push str.SYSTEMCurrentControlSetServicesEventLog_
lea ecx, [ebp - 0x4c]
call fcn.0040a9e0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0x78
push eax
lea ecx, [ebp - 0x4c]
call fcn.004266c0
push 0x5c
push 1
lea ecx, [ebp - 0x4c]
call fcn.0042a820
mov ecx, dword [ebp - 0x14]
add ecx, 0x94
push ecx
lea ecx, [ebp - 0x4c]
call fcn.004266c0
lea edx, [ebp - 0x4c]
mov dword [ebp - 0x54], edx
mov esi, esp
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x28]
push ecx
push 0
push 2
push 0
push 0
push 0
mov ecx, dword [ebp - 0x54]
call fcn.0040b300
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp esi, esp
call fcn.0052354c
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jne 0x48cf6a
cmp dword [ebp - 0x1c], 1
jne 0x48cf6a
mov esi, esp
push str.log4cxx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp esi, esp
call fcn.0052354c
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jne 0x48ce60
mov esi, esp
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp esi, esp
call fcn.0052354c
mov dword [ebp - 0x5c], eax
mov esi, esp
push 0x103
lea edx, [ebp - 0x268]
push edx
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp esi, esp
call fcn.0052354c
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0
jbe 0x48cf6a
mov ecx, dword [ebp - 0x270]
mov word [ebp + ecx*2 - 0x268], 0
lea edx, [ebp - 0x268]
push edx
call fcn.00523b4b
add esp, 4
shl eax, 1
mov esi, esp
push eax
lea eax, [ebp - 0x268]
push eax
push 1
push 0
push str.EventMessageFile
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp esi, esp
call fcn.0052354c
lea edx, [ebp - 0x268]
push edx
call fcn.00523b4b
add esp, 4
shl eax, 1
mov esi, esp
push eax
lea eax, [ebp - 0x268]
push eax
push 1
push 0
push str.CategoryMessageFile
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp esi, esp
call fcn.0052354c
mov dword [ebp - 0x278], 7
mov dword [ebp - 0x284], 6
mov esi, esp
push 4
lea edx, [ebp - 0x278]
push edx
push 4
push 0
push str.TypesSupported
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp esi, esp
call fcn.0052354c
mov esi, esp
push 4
lea ecx, [ebp - 0x284]
push ecx
push 4
push 0
push str.CategoryCount
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp esi, esp
call fcn.0052354c
mov esi, esp
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.0052354c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.0040b2c0
push edx
mov ecx, ebp
push eax
lea edx, [0x48cfc8]
call fcn.0052356f
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00522672
add esp, 0x288
cmp ebp, esp
call fcn.0052354c
mov esp, ebp
pop ebp
ret