Function at 0x40eda3
Capabilities:
Accept command line arguments
Create process on windows
Persist via run registry key

Disassembly:
push 0xd8
mov eax, 0x470400
call fcn.0045d4e7
mov eax, dword [ebp + 8]
mov edi, ecx
xor ebx, ebx
push str.RUNONCE
lea ecx, [eax + 0x40]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x40], edi
mov byte [edi], bl
call fcn.0043d201
test al, al
jne 0x40eddf
xor eax, eax
call fcn.0045d543
ret 4
push 0x497a28
lea ecx, [ebp - 0x3c]
mov byte [edi], 1
call fcn.004037fc
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.0042df63
pop ecx
pop ecx
test al, al
jne 0x40ee1a
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.00403af7
mov eax, 0x8007000e
jmp 0x40edd7
lea ecx, [ebp - 0x80]
call fcn.0042a635
push str._RODONE
push str._RUNONCE
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 2
call fcn.00409c47
mov dword [ebp - 4], 1
jmp 0x40ef34
lea ecx, [ebp - 0x80]
call fcn.0042a5f3
test al, al
je 0x40ef4d
lea ecx, [ebp - 0x80]
call fcn.0042a615
jmp 0x40ee08
lea ecx, [ebp - 0xa0]
call fcn.0043dbda
lea ecx, [ebp - 0xa0]
call fcn.0043e5c4
mov esi, str.PRODID
push esi
lea ecx, [ebp - 0xa0]
call fcn.0043d201
test al, al
je 0x40f155
lea ecx, [ebp - 0x50]
mov byte [ebp - 0x35], 1
call fcn.0043963e
push ebx
call fcn.0042c3d1
test al, al
pop ecx
mov eax, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
jne 0x40ef9d
mov eax, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push ebx
push 0xf003f
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x50]
call fcn.00439dbf
test eax, eax
jne 0x40efcd
lea ecx, [ebp - 0x50]
call fcn.004396ac
push eax
push str.CInstallManager::RunOnceRelaunch_986__:_failed_to_open_RunOnce:__lu
call fcn.00416f04
pop ecx
pop ecx
mov byte [ebp - 0x35], bl
lea ecx, [ebp - 0x5c]
call fcn.0043963e
push esi
lea ecx, [ebp - 0xa0]
call fcn.0043e5fb
test eax, eax
je 0x40f033
push ebx
push 0x20019
push esi
lea ecx, [ebp - 0xa0]
call fcn.0043e5fb
push eax
lea ecx, [ebp - 0x50]
call fcn.0042a4a7
push eax
lea ecx, [ebp - 0x5c]
call fcn.00439dbf
test eax, eax
jne 0x40f033
lea ecx, [ebp - 0x50]
call fcn.004396ac
push eax
push esi
lea ecx, [ebp - 0xa0]
call fcn.0043e5fb
push eax
push str.CInstallManager::RunOnceRelaunch_995__:_failed_to_open_RunOnce_subkey___s_:__lu
call fcn.00416f04
add esp, 0xc
mov byte [ebp - 0x35], bl
cmp byte [ebp - 0x35], bl
je 0x40f145
push 0x497a28
lea ecx, [ebp - 0x44]
call fcn.004037fc
lea eax, [ebp - 0x44]
push eax
mov esi, str.PATH
push esi
lea ecx, [ebp - 0x5c]
call fcn.00439dd9
test eax, eax
je 0x40f0a3
push dword [ebp - 0x44]
lea eax, [ebp - 0x3c]
push esi
push str.___s___s_
push eax
call fcn.0042dca7
add esp, 0x10
test al, al
jne 0x40f0a3
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.00403af7
lea ecx, [ebp - 0x5c]
call fcn.00439949
lea ecx, [ebp - 0x50]
call fcn.00439949
lea ecx, [ebp - 0xa0]
call fcn.0043dbef
jmp 0x40ef40
push 0x497a28
lea ecx, [ebp - 0x40]
call fcn.004037fc
lea eax, [ebp - 0x40]
push eax
mov esi, str.MEDIA
push esi
lea ecx, [ebp - 0x5c]
call fcn.00439dd9
test eax, eax
je 0x40f12f
push dword [ebp - 0x40]
lea eax, [ebp - 0x3c]
push esi
push str.___s___s_
push eax
call fcn.0042dca7
add esp, 0x10
test al, al
jne 0x40f12f
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.00403af7
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.00403af7
lea ecx, [ebp - 0x5c]
call fcn.00439949
lea ecx, [ebp - 0x50]
call fcn.00439949
mov esi, 0x8007000e
lea ecx, [ebp - 0xa0]
call fcn.0043dbef
lea ecx, [ebp - 0x80]
call fcn.0042a615
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.00403af7
mov eax, esi
jmp 0x40edd7
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.00403af7
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.00403af7
lea ecx, [ebp - 0x5c]
call fcn.00439949
lea ecx, [ebp - 0x50]
call fcn.00439949
mov ecx, dword [ebp - 0x84]
add ecx, 0x5c
mov dword [ebp - 0xe4], 0x3c
mov dword [ebp - 0xe0], 0x8500
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0xd8], str.open
call fcn.0043112d
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xd0], eax
lea eax, [ebp - 0xe4]
push eax
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0xc8], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40f1be
xor esi, esi
jmp 0x40f10a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CInstallManager::RunOnceRelaunch_1040__:_ShellExecuteEx_failed___lu___continue_installing
call fcn.00416ef0
pop ecx
pop ecx
mov byte [edi], bl
jmp 0x40f1b7