Function at 0x64ab28
Capabilities:
Create process on windows
Persist via run registry key
Self delete
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x56
push 0
push 0
dec ecx
jne 0x64ab30
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 0x270]
mov edx, dword [0x41b148]
call fcn.0040a96c
xor eax, eax
push ebp
push 0x64b059
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 1
mov edx, dword [0x685904]
mov eax, 0x64b074
call fcn.0040a710
test eax, eax
je 0x64b014
mov dl, 1
mov eax, dword [0x685904]
call fcn.00424288
test al, al
je 0x64b014
call fcn.0064aab4
mov byte [ebp - 0x271], 0
lea eax, [ebp - 0x278]
mov ecx, 0x64b08c
mov edx, dword [0x685904]
call fcn.0040a390
mov eax, dword [ebp - 0x278]
lea ecx, [ebp - 0x270]
mov edx, 0x1ff
call fcn.004247f4
test eax, eax
jne 0x64ad6c
mov eax, dword [ebp - 0x25c]
mov edx, 0x64b0a4
call fcn.0040a4c8
je 0x64ad59
mov eax, dword [ebp - 0x25c]
mov edx, 0x64b0b4
call fcn.0040a4c8
je 0x64ad59
mov eax, dword [ebp - 0x260]
and eax, 0x10
cmp eax, 0x10
je 0x64ad59
xor eax, eax
push ebp
push 0x64ac4d
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [0x685904]
push 0x64b0c8
push dword [ebp - 0x25c]
lea eax, [ebp - 0x27c]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x27c]
call fcn.00424884
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64ac57
mov eax, dword [ebp - 0x25c]
mov edx, 0x64b0d8
call fcn.0040a4c8
jne 0x64acef
push dword [0x685904]
push 0x64b100
push dword [ebp - 0x25c]
lea eax, [ebp - 0x280]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x280]
mov dl, 1
call fcn.004241f0
test al, al
je 0x64acef
push 1
push 0
push 0x64b104
push 0x64b14c
push 0x64b15c
push 0
call sub.shell32.dll_ShellExecuteW
push 0x7d0
call sub.kernel32.dll_Sleep_2
push dword [0x685904]
push 0x64b174
push dword [ebp - 0x25c]
lea eax, [ebp - 0x284]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x284]
call fcn.00424884
push dword [0x685904]
push 0x64b184
push dword [ebp - 0x25c]
lea eax, [ebp - 0x288]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x288]
mov dl, 1
call fcn.004241f0
test al, al
je 0x64ad59
mov byte [ebp - 0x271], 1
push 0x64b194
push dword [0x685904]
push 0x64b1b8
push dword [ebp - 0x25c]
lea eax, [ebp - 0x28c]
mov edx, 4
call fcn.0040a418
mov eax, dword [ebp - 0x28c]
call fcn.00649ba0
lea eax, [ebp - 0x270]
call fcn.00424844
test eax, eax
je 0x64abcb
lea eax, [ebp - 0x270]
call fcn.00424868
cmp dword [0x685944], 0
je 0x64ade2
mov dl, 1
mov eax, dword [0x685944]
call fcn.004241f0
test al, al
je 0x64ade2
xor ebx, ebx
jmp 0x64adcd
mov eax, dword [0x67f50c]
mov eax, dword [eax]
call fcn.00612374
push 0x1f4
call sub.kernel32.dll_Sleep_2
inc ebx
mov eax, dword [0x685944]
call fcn.0040a13c
mov edx, eax
lea eax, [ebp - 0x290]
call fcn.0040a1a4
mov eax, dword [ebp - 0x290]
call fcn.00424884
mov dl, 1
mov eax, dword [0x685944]
call fcn.004241f0
test al, al
je 0x64ade2
cmp ebx, 4
jl 0x64ad94
mov dl, 1
mov eax, dword [0x685904]
call fcn.00424288
test al, al
je 0x64ae23
xor eax, eax
push ebp
push 0x64ae19
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x685904]
call fcn.00406ca8
call fcn.00406960
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64ae23
cmp byte [0x6858e9], 0
jne 0x64aea4
lea edx, [ebp - 0x294]
mov al, 5
call fcn.00646c70
lea eax, [ebp - 0x294]
mov edx, 0x64b1c8
call fcn.0040a338
mov eax, dword [ebp - 0x294]
mov dl, 1
call fcn.004241f0
test al, al
je 0x64aea4
xor eax, eax
push ebp
push 0x64ae9a
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x298]
mov al, 5
call fcn.00646c70
lea eax, [ebp - 0x298]
mov edx, 0x64b1f4
call fcn.0040a338
mov eax, dword [ebp - 0x298]
call fcn.00424884
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64aea4
cmp byte [0x6858e9], 0
je 0x64af8c
xor eax, eax
push ebp
push 0x64af82
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 0x271], 0
je 0x64aed2
mov eax, 0x64b220
call fcn.00649ba0
lea ecx, [ebp - 0x2a0]
xor edx, edx
movzx eax, byte [0x6858ec]
call fcn.00423ad4
mov ecx, dword [ebp - 0x2a0]
lea eax, [ebp - 0x29c]
mov edx, 0x64b2c4
call fcn.0040a390
mov eax, dword [ebp - 0x29c]
call fcn.00649ba0
lea ecx, [ebp - 0x2a8]
xor edx, edx
movzx eax, byte [0x68594c]
call fcn.00423ad4
mov ecx, dword [ebp - 0x2a8]
lea eax, [ebp - 0x2a4]
mov edx, 0x64b2f8
call fcn.0040a390
mov eax, dword [ebp - 0x2a4]
call fcn.00649ba0
lea edx, [ebp - 0x2ac]
mov al, 5
call fcn.00646c70
lea eax, [ebp - 0x2ac]
mov edx, 0x64b330
call fcn.0040a338
mov edx, dword [ebp - 0x2ac]
mov eax, dword [0x68589c]
mov eax, dword [eax + 0x3e4]
mov eax, dword [eax + 0x2a0]
mov ecx, dword [eax]
call dword [ecx + 0x80]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64af8c
cmp byte [ebp - 0x271], 1
jne 0x64b014
mov dl, 1
mov eax, dword [0x50d720]
call fcn.0050e86c
mov ebx, eax
mov edx, 0x80000001
mov eax, ebx
call fcn.0050e954
xor ecx, ecx
mov edx, 0x64b35c
mov eax, ebx
call fcn.0050eaac
test al, al
je 0x64b00d
lea edx, [ebp - 0x2b0]
mov eax, dword [0x68589c]
call fcn.005418c8
mov eax, dword [ebp - 0x2b0]
push eax
push 0x64b3cc
push dword [0x685904]
push 0x64b40c
lea eax, [ebp - 0x2b4]
mov edx, 3
call fcn.0040a418
mov ecx, dword [ebp - 0x2b4]
mov eax, ebx
pop edx
call fcn.0050f420
mov eax, ebx
call fcn.0050e924
mov eax, ebx
call fcn.004078f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64b060
lea eax, [ebp - 0x2b4]
call fcn.0040956c
lea eax, [ebp - 0x2b0]
call fcn.0040956c
lea eax, [ebp - 0x2ac]
mov edx, 0xe
call fcn.004095cc
lea eax, [ebp - 0x270]
mov edx, dword [0x41b148]
call fcn.0040aa44
ret