Function at 0x648110
Capabilities:
Create process on windows
Persist via run registry key
Self delete
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x55
push 0
push 0
dec ecx
jne 0x648118
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 0x270]
mov edx, dword [0x41b150]
call fcn.0040a96c
xor eax, eax
push ebp
push 0x64860c
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 1
mov edx, dword [0x686918]
mov eax, 0x648628
call fcn.0040a710
test eax, eax
je 0x6485c7
mov dl, 1
mov eax, dword [0x686918]
call fcn.00424290
test al, al
je 0x6485c7
call fcn.00648094
mov byte [ebp - 0x271], 0
lea eax, [ebp - 0x278]
mov ecx, 0x648640
mov edx, dword [0x686918]
call fcn.0040a390
mov eax, dword [ebp - 0x278]
lea ecx, [ebp - 0x270]
mov edx, 0x1ff
call fcn.004247fc
test eax, eax
jne 0x648354
mov eax, dword [ebp - 0x25c]
mov edx, 0x648658
call fcn.0040a4c8
je 0x648341
mov eax, dword [ebp - 0x25c]
mov edx, 0x648668
call fcn.0040a4c8
je 0x648341
mov eax, dword [ebp - 0x260]
and eax, 0x10
cmp eax, 0x10
je 0x648341
xor eax, eax
push ebp
push 0x648235
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [0x686918]
push 0x64867c
push dword [ebp - 0x25c]
lea eax, [ebp - 0x27c]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x27c]
call fcn.0042488c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64823f
mov eax, dword [ebp - 0x25c]
mov edx, 0x64868c
call fcn.0040a4c8
jne 0x6482d7
push dword [0x686918]
push 0x6486b4
push dword [ebp - 0x25c]
lea eax, [ebp - 0x280]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x280]
mov dl, 1
call fcn.004241f8
test al, al
je 0x6482d7
push 1
push 0
push 0x6486b8
push 0x648700
push 0x648710
push 0
call sub.shell32.dll_ShellExecuteW
push 0x7d0
call sub.KERNEL32.DLL_Sleep_2
push dword [0x686918]
push 0x648728
push dword [ebp - 0x25c]
lea eax, [ebp - 0x284]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x284]
call fcn.0042488c
push dword [0x686918]
push 0x648738
push dword [ebp - 0x25c]
lea eax, [ebp - 0x288]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x288]
mov dl, 1
call fcn.004241f8
test al, al
je 0x648341
mov byte [ebp - 0x271], 1
push 0x648748
push dword [0x686918]
push 0x64876c
push dword [ebp - 0x25c]
lea eax, [ebp - 0x28c]
mov edx, 4
call fcn.0040a418
mov eax, dword [ebp - 0x28c]
call fcn.006478b0
lea eax, [ebp - 0x270]
call fcn.0042484c
test eax, eax
je 0x6481b3
lea eax, [ebp - 0x270]
call fcn.00424870
cmp dword [0x68691c], 0
je 0x6483ca
mov dl, 1
mov eax, dword [0x68691c]
call fcn.004241f8
test al, al
je 0x6483ca
xor ebx, ebx
jmp 0x6483b5
mov eax, dword [0x68056c]
mov eax, dword [eax]
call fcn.00615f44
push 0x1f4
call sub.KERNEL32.DLL_Sleep_2
inc ebx
mov eax, dword [0x68691c]
call fcn.0040a13c
mov edx, eax
lea eax, [ebp - 0x290]
call fcn.0040a1a4
mov eax, dword [ebp - 0x290]
call fcn.0042488c
mov dl, 1
mov eax, dword [0x68691c]
call fcn.004241f8
test al, al
je 0x6483ca
cmp ebx, 4
jl 0x64837c
mov dl, 1
mov eax, dword [0x686918]
call fcn.00424290
test al, al
je 0x64840b
xor eax, eax
push ebp
push 0x648401
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x686918]
call fcn.00406ca8
call fcn.00406960
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64840b
cmp byte [0x6868fd], 0
jne 0x64848c
lea edx, [ebp - 0x294]
mov al, 5
call fcn.00644998
lea eax, [ebp - 0x294]
mov edx, 0x64877c
call fcn.0040a338
mov eax, dword [ebp - 0x294]
mov dl, 1
call fcn.004241f8
test al, al
je 0x64848c
xor eax, eax
push ebp
push 0x648482
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x298]
mov al, 5
call fcn.00644998
lea eax, [ebp - 0x298]
mov edx, 0x6487a8
call fcn.0040a338
mov eax, dword [ebp - 0x298]
call fcn.0042488c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64848c
cmp byte [0x6868fd], 0
je 0x64853f
xor eax, eax
push ebp
push 0x648535
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 0x271], 0
je 0x6484ba
mov eax, 0x6487d4
call fcn.006478b0
lea ecx, [ebp - 0x2a0]
xor edx, edx
movzx eax, byte [0x686900]
call fcn.00423adc
mov ecx, dword [ebp - 0x2a0]
lea eax, [ebp - 0x29c]
mov edx, 0x648878
call fcn.0040a390
mov eax, dword [ebp - 0x29c]
call fcn.006478b0
lea edx, [ebp - 0x2a4]
mov al, 5
call fcn.00644998
lea eax, [ebp - 0x2a4]
mov edx, 0x6488ac
call fcn.0040a338
mov edx, dword [ebp - 0x2a4]
mov eax, dword [0x6868b0]
mov eax, dword [eax + 0x4ac]
mov eax, dword [eax + 0x2a0]
mov ecx, dword [eax]
call dword [ecx + 0x80]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64853f
cmp byte [ebp - 0x271], 1
jne 0x6485c7
mov dl, 1
mov eax, dword [0x50d788]
call fcn.0050e8d4
mov ebx, eax
mov edx, 0x80000001
mov eax, ebx
call fcn.0050e9bc
xor ecx, ecx
mov edx, 0x6488d8
mov eax, ebx
call fcn.0050eb14
test al, al
je 0x6485c0
lea edx, [ebp - 0x2a8]
mov eax, dword [0x6868b0]
call fcn.00541938
mov eax, dword [ebp - 0x2a8]
push eax
push 0x648948
push dword [0x686918]
push 0x648988
lea eax, [ebp - 0x2ac]
mov edx, 3
call fcn.0040a418
mov ecx, dword [ebp - 0x2ac]
mov eax, ebx
pop edx
call fcn.0050f488
mov eax, ebx
call fcn.0050e98c
mov eax, ebx
call fcn.004078f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x648613
lea eax, [ebp - 0x2ac]
call fcn.0040956c
lea eax, [ebp - 0x2a8]
call fcn.0040956c
lea eax, [ebp - 0x2a4]
mov edx, 0xc
call fcn.004095cc
lea eax, [ebp - 0x270]
mov edx, dword [0x41b150]
call fcn.0040aa44
ret