Function at 0x40ebe0
Capabilities:
Persist via active setup registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x634
mov eax, dword [0x5e3fe4]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov edx, 0x410
mov dword [ebp - 0x630], eax
mov al, byte [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov byte [ebp - 0x62c], al
mov edi, ecx
lea eax, [ebp - 0x41c]
mov byte [eax], 0
lea eax, [eax + 1]
sub edx, 1
jne 0x40ec17
cmp esi, reloc.OLEAUT32.dll_SysReAllocString
jne 0x40ed2b
mov eax, 0x22
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
push eax
call fcn.0040eb70
test al, al
je 0x40ed72
lea ecx, [ebp - 0x41c]
add ecx, 0xfffffffe
nop word [eax + eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x40ec60
mov eax, dword [0x5c4e8c]
push dword [ebp - 0x62c]
mov dword [ecx], eax
mov ax, word [0x5c4e90]
mov word [ecx + 4], ax
lea eax, [ebp - 0x41c]
push eax
mov ecx, edi
call fcn.0040e950
lea ecx, [ebp - 0x41c]
add ecx, 0xfffffffe
nop word [eax + eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x40eca0
mov eax, dword [0x5c4e94]
lea edx, [ebp - 0x41c]
mov dword [ecx], eax
mov ax, word [0x5c4e98]
mov word [ecx + 4], ax
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x40ecc6
sub edx, ecx
mov ecx, 0x5ed3b8
sar edx, 1
lea eax, [edx + edx]
sub eax, ecx
lea edx, [ebp - 0x41c]
add edx, eax
nop word [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x40ecf0
lea ecx, [ebp - 0x41c]
add ecx, 0xfffffffe
nop dword [eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x40ed10
mov eax, dword [0x5c4e9c]
mov dword [ecx], eax
mov eax, dword [0x5c4ea0]
mov dword [ecx + 4], eax
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x628]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftActive_SetupInstalled_Components313BA6B7_CF53_4C6F_BDF5_4D55100AF19A
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x40ed86
push str.AddAS__RegCreateKeyEx
push eax
mov ecx, edi
call fcn.0040f7e0
lea ecx, [edi + 0x1010]
test ecx, ecx
je 0x40ed72
call fcn.004041a0
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0054e183
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x208
lea eax, [ebp - 0x624]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x40ed91
cmp esi, reloc.OLEAUT32.dll_SysReAllocString
jne 0x40edfb
lea esi, [ebp - 0x41c]
lea ecx, [esi + 2]
nop dword [eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x40edb0
sub esi, ecx
lea eax, [ebp - 0x41c]
sar esi, 1
add esi, esi
push esi
push eax
lea eax, [ebp - 0x624]
push eax
call fcn.00551030
add esp, 0xc
lea eax, [ebp - 0x624]
push esi
push eax
push 1
push 0
push str.StubPath
push dword [ebp - 0x628]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
jne 0x40ee4b
mov edx, dword [ebp - 0x630]
mov esi, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x40ee06
sub esi, ecx
lea eax, [ebp - 0x624]
sar esi, 1
add esi, esi
push esi
push edx
push eax
call fcn.00551030
add esp, 0xc
lea eax, [ebp - 0x624]
push esi
push eax
push 1
push 0
push str.Version
push dword [ebp - 0x628]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x40ee67
push str.AddAS__RegSetValueEx
push esi
mov ecx, edi
call fcn.0040f7e0
lea ecx, [edi + 0x1010]
test ecx, ecx
je 0x40ee67
call fcn.004041a0
push dword [ebp - 0x628]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
test esi, esi
pop edi
sete al
xor ecx, ebp
pop esi
call fcn.0054e183
mov esp, ebp
pop ebp
ret 0xc