Function at 0x64aeb4
Capabilities:
Create process on windows
Persist via run registry key
Self delete
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x56
push 0
push 0
dec ecx
jne 0x64aebc
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 0x270]
mov edx, dword [0x41b148]
call fcn.0040a96c
xor eax, eax
push ebp
push 0x64b3e5
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 1
mov edx, dword [0x68b900]
mov eax, 0x64b400
call fcn.0040a710
test eax, eax
je 0x64b3a0
mov dl, 1
mov eax, dword [0x68b900]
call fcn.00424288
test al, al
je 0x64b3a0
call fcn.0064a040
mov byte [ebp - 0x271], 0
lea eax, [ebp - 0x278]
mov ecx, 0x64b418
mov edx, dword [0x68b900]
call fcn.0040a390
mov eax, dword [ebp - 0x278]
lea ecx, [ebp - 0x270]
mov edx, 0x1ff
call fcn.004247f4
test eax, eax
jne 0x64b0f8
mov eax, dword [ebp - 0x25c]
mov edx, 0x64b430
call fcn.0040a4c8
je 0x64b0e5
mov eax, dword [ebp - 0x25c]
mov edx, 0x64b440
call fcn.0040a4c8
je 0x64b0e5
mov eax, dword [ebp - 0x260]
and eax, 0x10
cmp eax, 0x10
je 0x64b0e5
xor eax, eax
push ebp
push 0x64afd9
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [0x68b900]
push 0x64b454
push dword [ebp - 0x25c]
lea eax, [ebp - 0x27c]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x27c]
call fcn.00424884
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64afe3
mov eax, dword [ebp - 0x25c]
mov edx, 0x64b464
call fcn.0040a4c8
jne 0x64b07b
push dword [0x68b900]
push 0x64b488
push dword [ebp - 0x25c]
lea eax, [ebp - 0x280]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x280]
mov dl, 1
call fcn.004241f0
test al, al
je 0x64b07b
push 1
push 0
push 0x64b48c
push 0x64b4d0
push 0x64b4e0
push 0
call sub.shell32.dll_ShellExecuteW
push 0x7d0
call sub.kernel32.dll_Sleep_2
push dword [0x68b900]
push 0x64b4f8
push dword [ebp - 0x25c]
lea eax, [ebp - 0x284]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x284]
call fcn.00424884
push dword [0x68b900]
push 0x64b508
push dword [ebp - 0x25c]
lea eax, [ebp - 0x288]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x288]
mov dl, 1
call fcn.004241f0
test al, al
je 0x64b0e5
mov byte [ebp - 0x271], 1
push 0x64b518
push dword [0x68b900]
push 0x64b53c
push dword [ebp - 0x25c]
lea eax, [ebp - 0x28c]
mov edx, 4
call fcn.0040a418
mov eax, dword [ebp - 0x28c]
call fcn.00649f50
lea eax, [ebp - 0x270]
call fcn.00424844
test eax, eax
je 0x64af57
lea eax, [ebp - 0x270]
call fcn.00424868
cmp dword [0x68b944], 0
je 0x64b16e
mov dl, 1
mov eax, dword [0x68b944]
call fcn.004241f0
test al, al
je 0x64b16e
xor ebx, ebx
jmp 0x64b159
mov eax, dword [0x685578]
mov eax, dword [eax]
call fcn.00612610
push 0x1f4
call sub.kernel32.dll_Sleep_2
inc ebx
mov eax, dword [0x68b944]
call fcn.0040a13c
mov edx, eax
lea eax, [ebp - 0x290]
call fcn.0040a1a4
mov eax, dword [ebp - 0x290]
call fcn.00424884
mov dl, 1
mov eax, dword [0x68b944]
call fcn.004241f0
test al, al
je 0x64b16e
cmp ebx, 4
jl 0x64b120
mov dl, 1
mov eax, dword [0x68b900]
call fcn.00424288
test al, al
je 0x64b1af
xor eax, eax
push ebp
push 0x64b1a5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x68b900]
call fcn.00406ca8
call fcn.00406960
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64b1af
cmp byte [0x68b8e1], 0
jne 0x64b230
lea edx, [ebp - 0x294]
mov al, 5
call fcn.00646d44
lea eax, [ebp - 0x294]
mov edx, 0x64b54c
call fcn.0040a338
mov eax, dword [ebp - 0x294]
mov dl, 1
call fcn.004241f0
test al, al
je 0x64b230
xor eax, eax
push ebp
push 0x64b226
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x298]
mov al, 5
call fcn.00646d44
lea eax, [ebp - 0x298]
mov edx, 0x64b578
call fcn.0040a338
mov eax, dword [ebp - 0x298]
call fcn.00424884
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64b230
cmp byte [0x68b8e1], 0
je 0x64b318
xor eax, eax
push ebp
push 0x64b30e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 0x271], 0
je 0x64b25e
mov eax, 0x64b5a4
call fcn.00649f50
lea ecx, [ebp - 0x2a0]
xor edx, edx
movzx eax, byte [0x68b8e4]
call fcn.00423ad4
mov ecx, dword [ebp - 0x2a0]
lea eax, [ebp - 0x29c]
mov edx, 0x64b648
call fcn.0040a390
mov eax, dword [ebp - 0x29c]
call fcn.00649f50
lea ecx, [ebp - 0x2a8]
xor edx, edx
movzx eax, byte [0x68b94b]
call fcn.00423ad4
mov ecx, dword [ebp - 0x2a8]
lea eax, [ebp - 0x2a4]
mov edx, 0x64b67c
call fcn.0040a390
mov eax, dword [ebp - 0x2a4]
call fcn.00649f50
lea edx, [ebp - 0x2ac]
mov al, 5
call fcn.00646d44
lea eax, [ebp - 0x2ac]
mov edx, 0x64b6b4
call fcn.0040a338
mov edx, dword [ebp - 0x2ac]
mov eax, dword [0x68b898]
mov eax, dword [eax + 0x3e4]
mov eax, dword [eax + 0x2a0]
mov ecx, dword [eax]
call dword [ecx + 0x80]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64b318
cmp byte [ebp - 0x271], 1
jne 0x64b3a0
mov dl, 1
mov eax, dword [0x50d720]
call fcn.0050e86c
mov ebx, eax
mov edx, 0x80000001
mov eax, ebx
call fcn.0050e954
xor ecx, ecx
mov edx, 0x64b6e0
mov eax, ebx
call fcn.0050eaac
test al, al
je 0x64b399
lea edx, [ebp - 0x2b0]
mov eax, dword [0x68b898]
call fcn.005418d0
mov eax, dword [ebp - 0x2b0]
push eax
push 0x64b750
push dword [0x68b900]
push 0x64b790
lea eax, [ebp - 0x2b4]
mov edx, 3
call fcn.0040a418
mov ecx, dword [ebp - 0x2b4]
mov eax, ebx
pop edx
call fcn.0050f420
mov eax, ebx
call fcn.0050e924
mov eax, ebx
call fcn.004078f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64b3ec
lea eax, [ebp - 0x2b4]
call fcn.0040956c
lea eax, [ebp - 0x2b0]
call fcn.0040956c
lea eax, [ebp - 0x2ac]
mov edx, 0xe
call fcn.004095cc
lea eax, [ebp - 0x270]
mov edx, dword [0x41b148]
call fcn.0040aa44
ret