Function at 0x64330c
Capabilities:
Create process on windows
Persist via run registry key
Self delete
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x55
push 0
push 0
dec ecx
jne 0x643314
push ebx
push esi
push edi
lea eax, [ebp - 0x270]
mov edx, dword [0x41b128]
call fcn.0040a96c
xor eax, eax
push ebp
push 0x6437a3
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 1
mov edx, dword [0x67c8f4]
mov eax, 0x6437c0
call fcn.0040a710
test eax, eax
je 0x64375e
mov dl, 1
mov eax, dword [0x67c8f4]
call fcn.00424268
test al, al
je 0x64375e
mov byte [ebp - 0x271], 0
lea eax, [ebp - 0x278]
mov ecx, 0x6437d8
mov edx, dword [0x67c8f4]
call fcn.0040a390
mov eax, dword [ebp - 0x278]
lea ecx, [ebp - 0x270]
mov edx, 0x1ff
call fcn.004247d4
test eax, eax
jne 0x64354a
mov eax, dword [ebp - 0x25c]
mov edx, 0x6437f0
call fcn.0040a4c8
je 0x643537
mov eax, dword [ebp - 0x25c]
mov edx, 0x643800
call fcn.0040a4c8
je 0x643537
mov eax, dword [ebp - 0x260]
and eax, 0x10
cmp eax, 0x10
je 0x643537
xor eax, eax
push ebp
push 0x64342b
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [0x67c8f4]
push 0x643814
push dword [ebp - 0x25c]
lea eax, [ebp - 0x27c]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x27c]
call fcn.00424864
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x643435
mov eax, dword [ebp - 0x25c]
mov edx, 0x643824
call fcn.0040a4c8
jne 0x6434cd
push dword [0x67c8f4]
push 0x64384c
push dword [ebp - 0x25c]
lea eax, [ebp - 0x280]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x280]
mov dl, 1
call fcn.004241d0
test al, al
je 0x6434cd
push 1
push 0
push 0x643850
push 0x643898
push 0x6438a8
push 0
call sub.shell32.dll_ShellExecuteW
push 0x7d0
call sub.kernel32.dll_Sleep_2
push dword [0x67c8f4]
push 0x6438c0
push dword [ebp - 0x25c]
lea eax, [ebp - 0x284]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x284]
call fcn.00424864
push dword [0x67c8f4]
push 0x6438d0
push dword [ebp - 0x25c]
lea eax, [ebp - 0x288]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x288]
mov dl, 1
call fcn.004241d0
test al, al
je 0x643537
mov byte [ebp - 0x271], 1
push 0x6438e0
push dword [0x67c8f4]
push 0x643904
push dword [ebp - 0x25c]
lea eax, [ebp - 0x28c]
mov edx, 4
call fcn.0040a418
mov eax, dword [ebp - 0x28c]
call fcn.0064324c
lea eax, [ebp - 0x270]
call fcn.00424824
test eax, eax
je 0x6433a9
lea eax, [ebp - 0x270]
call fcn.00424848
mov eax, dword [0x67644c]
mov eax, dword [eax]
call fcn.00615e70
mov dl, 1
mov eax, dword [0x67c8f4]
call fcn.00424268
test al, al
je 0x6435a2
xor eax, eax
push ebp
push 0x643598
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x67c8f4]
call fcn.00406ca8
call fcn.00406960
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6435a2
cmp byte [0x67c8e5], 0
jne 0x643623
lea edx, [ebp - 0x290]
mov al, 5
call fcn.006407c4
lea eax, [ebp - 0x290]
mov edx, 0x643914
call fcn.0040a338
mov eax, dword [ebp - 0x290]
mov dl, 1
call fcn.004241d0
test al, al
je 0x643623
xor eax, eax
push ebp
push 0x643619
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x294]
mov al, 5
call fcn.006407c4
lea eax, [ebp - 0x294]
mov edx, 0x643940
call fcn.0040a338
mov eax, dword [ebp - 0x294]
call fcn.00424864
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x643623
cmp byte [0x67c8e5], 0
je 0x6436d6
xor eax, eax
push ebp
push 0x6436cc
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 0x271], 0
je 0x643651
mov eax, 0x64396c
call fcn.0064324c
lea ecx, [ebp - 0x29c]
xor edx, edx
movzx eax, byte [0x67c8e8]
call fcn.00423ab4
mov ecx, dword [ebp - 0x29c]
lea eax, [ebp - 0x298]
mov edx, 0x643a10
call fcn.0040a390
mov eax, dword [ebp - 0x298]
call fcn.0064324c
lea edx, [ebp - 0x2a0]
mov al, 5
call fcn.006407c4
lea eax, [ebp - 0x2a0]
mov edx, 0x643a44
call fcn.0040a338
mov edx, dword [ebp - 0x2a0]
mov eax, dword [0x67c8a4]
mov eax, dword [eax + 0x4b4]
mov eax, dword [eax + 0x2a0]
mov ecx, dword [eax]
call dword [ecx + 0x80]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6436d6
cmp byte [ebp - 0x271], 1
jne 0x64375e
mov dl, 1
mov eax, dword [0x50d748]
call fcn.0050e894
mov ebx, eax
mov edx, 0x80000001
mov eax, ebx
call fcn.0050e97c
xor ecx, ecx
mov edx, 0x643a70
mov eax, ebx
call fcn.0050ead4
test al, al
je 0x643757
lea edx, [ebp - 0x2a4]
mov eax, dword [0x67c8a4]
call fcn.005418f8
mov eax, dword [ebp - 0x2a4]
push eax
push 0x643ae0
push dword [0x67c8f4]
push 0x643b20
lea eax, [ebp - 0x2a8]
mov edx, 3
call fcn.0040a418
mov ecx, dword [ebp - 0x2a8]
mov eax, ebx
pop edx
call fcn.0050f448
mov eax, ebx
call fcn.0050e94c
mov eax, ebx
call fcn.004078f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6437aa
lea eax, [ebp - 0x2a8]
call fcn.0040956c
lea eax, [ebp - 0x2a4]
call fcn.0040956c
lea eax, [ebp - 0x2a0]
mov edx, 0xb
call fcn.004095cc
lea eax, [ebp - 0x270]
mov edx, dword [0x41b128]
call fcn.0040aa44
ret