Function at 0x9c9b50
Capabilities:
Check if file exists
Create thread
Read .ini file

Disassembly:
mov eax, 0x11ac
call fcn.00a91950
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x11a4], eax
mov eax, dword [esp + 0x11b4]
push ebx
push ebp
mov ebp, dword [esp + 0x11b8]
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x1c], ebx
cmp ebp, ebx
jne 0x9c9bbe
mov eax, dword [str.ForAVScan]
mov ecx, dword [0xaf8de4]
mov dx, word [0xaf8de8]
mov dword [esp + 0xb90], eax
mov dword [esp + 0xb94], ecx
mov word [esp + 0xb98], dx
jmp 0x9c9be3
lea edx, [esp + 0xb90]
mov eax, ebp
sub edx, ebp
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x9c9bd0
cmp byte [ebp], bl
jne 0x9c9e14
push 0xbdcfc0
lea eax, [esp + 0x56c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp byte [esp + 0x568], bl
je 0x9c9c34
lea eax, [esp + 0x568]
lea esp, [esp]
inc eax
cmp byte [eax], bl
jne 0x9c9c10
lea ecx, [esp + 0x568]
sub eax, ecx
je 0x9c9c34
cmp byte [esp + eax + 0x567], 0x5c
je 0x9c9c34
push 0xaa1564
mov edx, ecx
push edx
call esi
push str.CTEMP.DAT
lea eax, [esp + 0x56c]
push eax
call esi
push 1
push ebx
xor edx, edx
lea ecx, [esp + 0x570]
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x9c9c67
lea eax, [esp + 0x568]
call fcn.0094dd20
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], ebx
push ecx
mov ebx, str.PendingFileRenameOperations
mov ecx, str.SystemCurrentControlSetControlSession_Manager
call fcn.00980c50
mov ebp, dword [esp + 0x14]
add esp, 4
test eax, eax
jbe 0x9c9d8c
xor edi, edi
cmp byte [ebp], 0
je 0x9c9d8c
lea ebx, [ebx]
lea esi, [edi + ebp]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x9c9ca8
sub eax, edx
lea ecx, [eax + esi + 1]
lea ebx, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x9c9cb8
sub ecx, ebx
lea ecx, [ecx + eax]
lea edi, [edi + ecx + 2]
jne 0x9c9cdf
push 0
push str.ctemp.dat
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x9c9cea
cmp byte [edi + ebp], 0
jne 0x9c9ca0
jmp 0x9c9d8c
push str.PendingFileRenameOperations
mov ecx, str.SystemCurrentControlSetControlSession_Manager
mov edx, 0x80000002
xor ebp, ebp
call fcn.0094c180
cmp al, 1
je 0x9c9d25
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x9c9d25
push str.PendingFileRenameOperations
call fcn.00989f40
cmp eax, 1
jne 0x9c9d25
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [esp + 0x10]
cmp byte [edx], 0
je 0x9c9d8c
mov edi, edi
mov eax, dword [esp + 0x10]
lea esi, [eax + ebp]
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x9c9d40
sub eax, edx
lea edx, [eax + esi + 1]
mov ecx, edx
lea edi, [ecx + 1]
mov bl, byte [ecx]
inc ecx
test bl, bl
jne 0x9c9d52
sub ecx, edi
lea ecx, [ecx + eax]
lea ebp, [ecx + ebp + 2]
jne 0x9c9d7b
push 0
push str.ctemp.dat
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x9c9d82
xor edx, edx
mov ecx, esi
call fcn.00980d20
mov ecx, dword [esp + 0x10]
cmp byte [ecx + ebp], 0
jne 0x9c9d30
mov eax, dword [esp + 0x10]
test eax, eax
je 0x9c9d9d
push eax
call fcn.00a78fec
add esp, 4
lea edx, [esp + 0x1c]
push edx
push str.LastNow
mov ecx, str.SOFTWAREMicroWorld
mov edx, 0x80000002
call fcn.0094c0d0
call fcn.0094e910
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jbe 0x9c9f24
cmp eax, ecx
jae 0x9c9f38
mov esi, str.LastNow
mov ebx, str.SOFTWAREMicroWorld
mov ecx, 0x80000002
call fcn.0094be90
lea eax, [esp + 0xda0]
push str._JOB__Fresh_BOOT_Detected._Checking_for_Startup_Jobs...
push eax
call fcn.00a78f30
push 0
push 1
lea ecx, [esp + 0xdb0]
push ecx
push 0xb54ce8
call fcn.008808e0
mov ebp, dword [esp + 0x2c]
add esp, 0x18
xor ebx, ebx
xor edi, edi
push ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
call fcn.009ca2f0
mov esi, dword [esp + 0x14]
add esp, 4
cmp esi, ebx
je 0x9c9ec3
cmp byte [esi], bl
je 0x9c9eb6
push 0x103
lea edx, [esp + 0x675]
push ebx
push edx
mov byte [esp + 0x67c], bl
call fcn.00a7ffb0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], ebx
push esi
mov bl, 0x2c
lea edi, [esp + 0x678]
call fcn.0095ae80
add esp, 8
cmp dword [esp + 0x10], 0xffffffff
je 0x9c9eb4
lea ebx, [ebx]
lea ecx, [esp + 0x14]
push ecx
mov edx, ebp
lea ecx, [esp + 0x674]
call 0x9cc440
add esp, 4
lea edx, [esp + 0x10]
push edx
push esi
mov bl, 0x2c
lea edi, [esp + 0x678]
call fcn.0095ae80
add esp, 8
cmp dword [esp + 0x10], 0xffffffff
jne 0x9c9e80
xor ebx, ebx
push esi
call fcn.00a78fec
mov edi, dword [esp + 0x18]
add esp, 4
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x9c9ecd
mov dword [eax], edi
cmp edi, ebx
jne 0x9ca294
push 0x103
lea eax, [esp + 0x56d]
push ebx
push eax
mov byte [esp + 0x20], bl
mov byte [esp + 0x21], bl
mov byte [esp + 0x574], bl
call fcn.00a7ffb0
mov eax, dword [esp + 0x24]
add esp, 0xc
mov dword [esp + 0x10], 0x104
cmp eax, ebx
je 0x9c9f7e
cmp byte [eax], bl
je 0x9c9f7e
push 0xb52cc8
push 2
lea ecx, [esp + 0x1c]
push ecx
push 0xaae0f8
mov edx, eax
push edx
jmp 0x9c9f94
mov esi, str.LastNow
mov ebx, str.SOFTWAREMicroWorld
mov ecx, 0x80000002
call fcn.0094be90
lea edx, [esp + 0xda0]
push str._JOB__Fresh_Boot_NOT_Detected._Not_running_Startup_Jobs...
push edx
call fcn.00a78f30
push 0
push 1
lea eax, [esp + 0xdb0]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x18
xor eax, eax
mov ecx, dword [esp + 0x11b4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00a78f21
add esp, 0x11ac
ret
push 0xb52cc8
push 2
lea eax, [esp + 0x1c]
push eax
push 0xaae0f8
push str.ScheduledJobCompleted
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push str.Config
call esi
cmp byte [esp + 0x14], 0x30
jne 0x9c9fe9
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x9c9fca
cmp byte [eax], bl
je 0x9c9fca
push 0xb52cc8
push 0x104
lea ecx, [esp + 0x570]
push ecx
push ebx
push eax
jmp 0x9c9fe2
push 0xb52cc8
push 0x104
lea edx, [esp + 0x570]
push edx
push ebx
push str.ScheduledJobName
push str.Config
call esi
cmp byte [esp + 0x568], bl
je 0x9ca294
push 0x207
lea eax, [esp + 0x77d]
push ebx
push eax
mov byte [esp + 0x784], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea ecx, [esp + 0xa8d]
push ebx
push ecx
mov byte [esp + 0xa94], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea edx, [esp + 0xc9d]
push ebx
push edx
mov byte [esp + 0xca4], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea eax, [esp + 0x675]
push ebx
push eax
mov byte [esp + 0x67c], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea ecx, [esp + 0x985]
push ebx
push ecx
mov byte [esp + 0x98c], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x53c
lea edx, [esp + 0x30]
push ebx
push edx
call fcn.00a7ffb0
add esp, 0xc
mov dword [esp + 0x2c], ebx
cmp ebp, ebx
je 0x9ca0e0
cmp byte [ebp], bl
je 0x9ca0e0
lea edx, [esp + 0x154]
mov dword [esp + 0x28], ebx
mov eax, ebp
sub edx, ebp
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x9ca0b6
lea eax, [esp + 0x568]
push eax
push ebp
lea ecx, [esp + 0x780]
push str.SoftwareMicroWorldeScan_For_Windows_sSchedulerJobs_s
push ecx
call fcn.00a78f30
add esp, 0x10
jmp 0x9ca10c
lea edx, [esp + 0x568]
push edx
lea eax, [esp + 0x77c]
push str.SoftwareMicroWorldeScan_For_WindowsODSSchedulerJobs_s
push eax
mov dword [esp + 0x34], 1
mov byte [esp + 0x160], bl
call fcn.00a78f30
add esp, 0xc
cmp dword [esp + 0x28], ebx
je 0x9ca294
push str.AllowUserToCancelScanning
lea eax, [esp + 0x14]
lea edi, [esp + 0x984]
lea ecx, [esp + 0x77c]
mov edx, 0x80000002
mov dword [esp + 0x14], 0x104
call fcn.0094c020
cmp byte [esp + 0x980], 0x30
jne 0x9ca294
mov esi, 0x104
push str.Foreground
lea eax, [esp + 0x14]
lea edi, [esp + 0xa8c]
lea ecx, [esp + 0x77c]
mov edx, 0x80000002
mov dword [esp + 0x14], esi
call fcn.0094c020
xor ecx, ecx
cmp byte [esp + 0xa88], 0x31
push str.ScanPriority
sete cl
lea eax, [esp + 0x14]
lea edi, [esp + 0xc9c]
mov edx, 0x80000002
mov dword [esp + 0x14], esi
mov dword [esp + 0x3c], ecx
lea ecx, [esp + 0x77c]
call fcn.0094c020
mov edx, edi
push edx
call fcn.00a79090
add esp, 4
mov dword [esp + 0x3c], eax
push str.JobName
lea eax, [esp + 0x14]
lea edi, [esp + 0x674]
lea ecx, [esp + 0x77c]
mov edx, 0x80000002
mov dword [esp + 0x14], esi
call fcn.0094c020
cmp byte [esp + 0x670], bl
je 0x9ca294
xor eax, eax
mov cl, byte [esp + eax + 0x670]
mov byte [esp + eax + 0x258], cl
inc eax
cmp cl, bl
jne 0x9ca1f0
xor eax, eax
jmp 0x9ca210
mov cl, byte [esp + eax + 0x568]
mov byte [esp + eax + 0x35c], cl
inc eax
cmp cl, bl
jne 0x9ca210
lea eax, [esp + 0x670]
push eax
lea ecx, [esp + 0x56c]
push ecx
lea edx, [esp + 0xfb0]
push str._JOB__A__Starting_Job:__s__Name:_s_
push edx
call fcn.00a78f30
push ebx
push 1
lea eax, [esp + 0xfc0]
push eax
push 0xb54ce8
call fcn.008808e0
lea ecx, [esp + 0x48]
push ecx
push ebx
push 0x9cb3a0
call fcn.00a791b2
add esp, 0x2c
cmp eax, 0xffffffff
je 0x9ca294
cmp dword [esp + 0x2c], ebx
jne 0x9ca2e4
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, edi
push 1
call esi
cmp dword [esp + 0x2c], ebx
je 0x9ca280
mov eax, 1
jmp 0x9c9f65
mov ecx, dword [esp + 0x18]
cmp ecx, ebx
je 0x9ca2a2
cmp byte [ecx], bl
mov ebx, ecx
jne 0x9ca2a7
mov ebx, str.ScheduledJobCompleted
push str.Config
mov esi, 0xb52cc8
mov eax, 0xaae0f8
call fcn.009584b0
mov ebx, dword [esp + 0x24]
add esp, 4
test ebx, ebx
je 0x9ca2cb
cmp byte [ebx], 0
jne 0x9ca2d0
mov ebx, str.ScheduledJobName
push str.Config
mov esi, 0xb52cc8
xor eax, eax
call fcn.009584b0
add esp, 4
mov eax, 1
jmp 0x9c9f65