Function at 0x644150
Capabilities:
Create process on windows
Persist via run registry key
Self delete
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x55
push 0
push 0
dec ecx
jne 0x644158
push ebx
push esi
push edi
lea eax, [ebp - 0x270]
mov edx, dword [0x41b140]
call fcn.0040a96c
xor eax, eax
push ebp
push 0x644633
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 1
mov edx, dword [0x67e8f4]
mov eax, 0x644650
call fcn.0040a710
test eax, eax
je 0x6445ee
mov dl, 1
mov eax, dword [0x67e8f4]
call fcn.00424280
test al, al
je 0x6445ee
call fcn.006440d4
mov byte [ebp - 0x271], 0
lea eax, [ebp - 0x278]
mov ecx, 0x644668
mov edx, dword [0x67e8f4]
call fcn.0040a390
mov eax, dword [ebp - 0x278]
lea ecx, [ebp - 0x270]
mov edx, 0x1ff
call fcn.004247ec
test eax, eax
jne 0x644393
mov eax, dword [ebp - 0x25c]
mov edx, 0x644680
call fcn.0040a4c8
je 0x644380
mov eax, dword [ebp - 0x25c]
mov edx, 0x644690
call fcn.0040a4c8
je 0x644380
mov eax, dword [ebp - 0x260]
and eax, 0x10
cmp eax, 0x10
je 0x644380
xor eax, eax
push ebp
push 0x644274
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [0x67e8f4]
push 0x6446a4
push dword [ebp - 0x25c]
lea eax, [ebp - 0x27c]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x27c]
call fcn.0042487c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64427e
mov eax, dword [ebp - 0x25c]
mov edx, 0x6446b4
call fcn.0040a4c8
jne 0x644316
push dword [0x67e8f4]
push 0x6446dc
push dword [ebp - 0x25c]
lea eax, [ebp - 0x280]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x280]
mov dl, 1
call fcn.004241e8
test al, al
je 0x644316
push 1
push 0
push 0x6446e0
push 0x644728
push 0x644738
push 0
call sub.shell32.dll_ShellExecuteW
push 0x7d0
call sub.kernel32.dll_Sleep_2
push dword [0x67e8f4]
push 0x644750
push dword [ebp - 0x25c]
lea eax, [ebp - 0x284]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x284]
call fcn.0042487c
push dword [0x67e8f4]
push 0x644760
push dword [ebp - 0x25c]
lea eax, [ebp - 0x288]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x288]
mov dl, 1
call fcn.004241e8
test al, al
je 0x644380
mov byte [ebp - 0x271], 1
push 0x644770
push dword [0x67e8f4]
push 0x644794
push dword [ebp - 0x25c]
lea eax, [ebp - 0x28c]
mov edx, 4
call fcn.0040a418
mov eax, dword [ebp - 0x28c]
call fcn.00643940
lea eax, [ebp - 0x270]
call fcn.0042483c
test eax, eax
je 0x6441f2
lea eax, [ebp - 0x270]
call fcn.00424860
cmp dword [0x67e8f8], 0
je 0x6443f1
mov dl, 1
mov eax, dword [0x67e8f8]
call fcn.004241e8
test al, al
je 0x6443f1
xor eax, eax
push ebp
push 0x6443e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x67e8f8]
call fcn.0042487c
test al, al
jne 0x6443dd
mov eax, dword [0x67e8f8]
call fcn.0042487c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6443f1
mov dl, 1
mov eax, dword [0x67e8f4]
call fcn.00424280
test al, al
je 0x644432
xor eax, eax
push ebp
push 0x644428
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x67e8f4]
call fcn.00406ca8
call fcn.00406960
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x644432
cmp byte [0x67e8e5], 0
jne 0x6444b3
lea edx, [ebp - 0x290]
mov al, 5
call fcn.00640d00
lea eax, [ebp - 0x290]
mov edx, 0x6447a4
call fcn.0040a338
mov eax, dword [ebp - 0x290]
mov dl, 1
call fcn.004241e8
test al, al
je 0x6444b3
xor eax, eax
push ebp
push 0x6444a9
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x294]
mov al, 5
call fcn.00640d00
lea eax, [ebp - 0x294]
mov edx, 0x6447d0
call fcn.0040a338
mov eax, dword [ebp - 0x294]
call fcn.0042487c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6444b3
cmp byte [0x67e8e5], 0
je 0x644566
xor eax, eax
push ebp
push 0x64455c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 0x271], 0
je 0x6444e1
mov eax, 0x6447fc
call fcn.00643940
lea ecx, [ebp - 0x29c]
xor edx, edx
movzx eax, byte [0x67e8e8]
call fcn.00423acc
mov ecx, dword [ebp - 0x29c]
lea eax, [ebp - 0x298]
mov edx, 0x6448a0
call fcn.0040a390
mov eax, dword [ebp - 0x298]
call fcn.00643940
lea edx, [ebp - 0x2a0]
mov al, 5
call fcn.00640d00
lea eax, [ebp - 0x2a0]
mov edx, 0x6448d4
call fcn.0040a338
mov edx, dword [ebp - 0x2a0]
mov eax, dword [0x67e8a4]
mov eax, dword [eax + 0x4b4]
mov eax, dword [eax + 0x2a0]
mov ecx, dword [eax]
call dword [ecx + 0x80]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x644566
cmp byte [ebp - 0x271], 1
jne 0x6445ee
mov dl, 1
mov eax, dword [0x50d778]
call fcn.0050e8c4
mov ebx, eax
mov edx, 0x80000001
mov eax, ebx
call fcn.0050e9ac
xor ecx, ecx
mov edx, 0x644900
mov eax, ebx
call fcn.0050eb04
test al, al
je 0x6445e7
lea edx, [ebp - 0x2a4]
mov eax, dword [0x67e8a4]
call fcn.00541928
mov eax, dword [ebp - 0x2a4]
push eax
push 0x644970
push dword [0x67e8f4]
push 0x6449b0
lea eax, [ebp - 0x2a8]
mov edx, 3
call fcn.0040a418
mov ecx, dword [ebp - 0x2a8]
mov eax, ebx
pop edx
call fcn.0050f478
mov eax, ebx
call fcn.0050e97c
mov eax, ebx
call fcn.004078f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64463a
lea eax, [ebp - 0x2a8]
call fcn.0040956c
lea eax, [ebp - 0x2a4]
call fcn.0040956c
lea eax, [ebp - 0x2a0]
mov edx, 0xb
call fcn.004095cc
lea eax, [ebp - 0x270]
mov edx, dword [0x41b140]
call fcn.0040aa44
ret