Function at 0x434b24
Capabilities:
Create process on windows
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, 0x43490c
call fcn.0040636c
xor eax, eax
push ebp
push 0x434ed9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x438c40
call fcn.004041b0
mov eax, 0x438c44
call fcn.004041b0
mov eax, 0x438c48
call fcn.004041b0
mov byte [0x438c4c], 0
mov dl, 1
mov eax, dword [0x4195b4]
call fcn.00419684
mov dword [0x438c3c], eax
mov edx, 0x80000001
mov eax, dword [0x438c3c]
call fcn.00419724
xor ecx, ecx
mov edx, 0x434ef0
mov eax, dword [0x438c3c]
call fcn.00419788
test al, al
je 0x434bd3
mov edx, 0x434f28
mov eax, dword [0x438c3c]
call fcn.00419c30
test al, al
je 0x434bc9
mov edx, 0x434f28
mov eax, dword [0x438c3c]
call fcn.00419a64
mov eax, dword [0x438c3c]
call fcn.004196f4
xor ecx, ecx
mov edx, 0x434f44
mov eax, dword [0x438c3c]
call fcn.00419788
test al, al
je 0x434cbd
mov edx, 0x434f6c
mov eax, dword [0x438c3c]
call fcn.00419c30
test al, al
je 0x434c1e
lea ecx, [ebp - 0x14]
mov edx, 0x434f6c
mov eax, dword [0x438c3c]
call fcn.00419afc
mov edx, dword [ebp - 0x14]
mov eax, 0x438c40
call fcn.00404204
mov edx, 0x434f80
mov eax, dword [0x438c3c]
call fcn.00419c30
test al, al
je 0x434c50
lea ecx, [ebp - 0x18]
mov edx, 0x434f80
mov eax, dword [0x438c3c]
call fcn.00419afc
mov edx, dword [ebp - 0x18]
mov eax, 0x438c44
call fcn.00404204
mov edx, 0x434f98
mov eax, dword [0x438c3c]
call fcn.00419c30
test al, al
je 0x434c82
lea ecx, [ebp - 0x1c]
mov edx, 0x434f98
mov eax, dword [0x438c3c]
call fcn.00419afc
mov edx, dword [ebp - 0x1c]
mov eax, 0x438c48
call fcn.00404204
mov edx, 0x434fb0
mov eax, dword [0x438c3c]
call fcn.00419c30
test al, al
jne 0x434cac
mov edx, 0x434fc4
mov eax, dword [0x438c3c]
call fcn.00419c30
test al, al
jne 0x434cac
xor eax, eax
jmp 0x434cae
mov al, 1
mov byte [0x438c4c], al
mov eax, dword [0x438c3c]
call fcn.004196f4
mov dl, 1
mov eax, dword [0x438c3c]
mov ecx, dword [eax]
call dword [ecx - 4]
call fcn.00434560
push 0x434fd0
call sub.user32.dll_RegisterWindowMessageA
mov dword [0x438c54], eax
push 0x434fdc
push 0
call sub.user32.dll_FindWindowA
mov dword [0x438c50], eax
cmp dword [0x438c50], 0
jbe 0x434d19
push 0
push 0x47b
mov eax, dword [0x438c54]
push eax
mov eax, dword [0x438c50]
push eax
call sub.user32.dll_PostMessageA
push 0x1f4
call sub.kernel32.dll_Sleep_1
push 0x434fec
call sub.user32.dll_RegisterWindowMessageA
mov dword [0x438c5c], eax
push 0x434fec
push 0
call sub.user32.dll_FindWindowA
mov dword [0x438c50], eax
cmp dword [0x438c50], 0
jbe 0x434d64
push 0
push 0x404
mov eax, dword [0x438c5c]
push eax
mov eax, dword [0x438c50]
push eax
call sub.user32.dll_PostMessageA
push 0x1f4
call sub.kernel32.dll_Sleep_1
push 0x434ffc
call sub.user32.dll_RegisterWindowMessageA
mov dword [0x438c60], eax
push 0x434ffc
push 0
call sub.user32.dll_FindWindowA
mov dword [0x438c50], eax
cmp dword [0x438c50], 0
jbe 0x434daf
push 0
push 0x405
mov eax, dword [0x438c60]
push eax
mov eax, dword [0x438c50]
push eax
call sub.user32.dll_PostMessageA
push 0x1f4
call sub.kernel32.dll_Sleep_1
push 0x43500c
call sub.user32.dll_RegisterWindowMessageA
mov dword [0x438c58], eax
push 0x43501c
push 0
call sub.user32.dll_FindWindowA
mov dword [0x438c50], eax
cmp dword [0x438c50], 0
jbe 0x434dfa
push 0
push 0x403
mov eax, dword [0x438c58]
push eax
mov eax, dword [0x438c50]
push eax
call sub.user32.dll_PostMessageA
push 0x1f4
call sub.kernel32.dll_Sleep_1
cmp byte [0x438c4c], 0
jne 0x434e38
mov eax, dword [0x438c48]
call fcn.00404470
test eax, eax
jle 0x434e38
push 1
push 0
push 0
mov eax, dword [0x438c48]
call fcn.00404670
push eax
push 0x435030
push 0
call sub.shell32.dll_ShellExecuteA
push 0x1f4
call sub.kernel32.dll_Sleep_1
cmp byte [0x438c4c], 0
jne 0x434e6d
mov eax, 0x434f28
mov edx, dword [0x438c44]
call fcn.004047b4
test eax, eax
jle 0x434e6d
mov eax, dword [0x438c44]
call fcn.004080f8
test al, al
je 0x434e6d
mov eax, dword [0x438c44]
call fcn.00434718
mov eax, 0x434f28
mov edx, dword [0x438c40]
call fcn.004047b4
test eax, eax
je 0x434ebe
mov eax, dword [0x438c40]
call fcn.004080f8
test al, al
je 0x434ebe
cmp byte [0x438c4c], 0
je 0x434eb4
push 0x24
push 0x435038
push 0x435048
call sub.user32.dll_GetActiveWindow
push eax
call sub.user32.dll_MessageBoxA_1
cmp eax, 7
je 0x434ebe
mov eax, dword [0x438c40]
call fcn.00434718
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x434ee0
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004041d4
ret