Function at 0x10036630
Capabilities:
Delete file
Move file
Persist via lnk shortcut

Disassembly:
sub esp, 0x800
mov ecx, 0x100
xor eax, eax
mov edx, dword [esp + 0x804]
push ebx
push ebp
push esi
push edi
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov ecx, 0x100
lea edi, [esp + 0x410]
rep stosd dword es:[edi], eax
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x400
jb 0x10036679
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x800
ret
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, dword [sym.imp.MSVCRT.dll_strtok]
mov eax, ecx
mov esi, edi
mov edi, ebx
push 0x10232580
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
call ebp
add esp, 8
test eax, eax
jne 0x100366c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x800
ret
mov edi, 0x102325d4
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x14]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x107ab964]
mov eax, dword [ecx]
call dword [eax]
test eax, eax
jne 0x10036985
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x10036736
push 4
lea ecx, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea edx, [esp + 0x10]
push edx
push 0x10227334
call fcn.10029940
add esp, 8
mov ebx, dword [esp + 0x818]
push 0x10232580
push ebx
call ebp
add esp, 8
test eax, eax
jne 0x10036757
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x800
ret
mov edi, 0x102325d4
or ecx, 0xffffffff
xor eax, eax
push 0x1022722c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebp
mov edi, eax
push ebx
push edi
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 0x10
test eax, eax
je 0x1003681d
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x410]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x410]
and ecx, 3
push 0x1022722c
rep movsb byte es:[edi], byte [esi]
mov edi, 0x1022722c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call ebp
mov edi, eax
add esp, 8
test edi, edi
je 0x10036985
push ebx
push edi
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
jne 0x1003679e
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x410]
push eax
call ebp
test eax, eax
jne 0x1003685b
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 4
lea ecx, [esp + 0x414]
push eax
push ecx
call ebx
lea edx, [esp + 0x410]
push edx
push 0x10227334
call fcn.10029940
add esp, 8
jmp 0x10036861
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea edi, [esp + 0x410]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.MicrosoftWindowsStart_MenuProgramsStartupID_Detector.vbs
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x14]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x107ab964]
mov eax, dword [ecx]
call dword [eax]
test eax, eax
jne 0x100368f3
lea eax, [esp + 0x10]
push eax
call ebp
test eax, eax
jne 0x100368f3
push 4
lea ecx, [esp + 0x14]
push eax
push ecx
call ebx
lea edx, [esp + 0x10]
push edx
push 0x10227334
call fcn.10029940
add esp, 8
lea edi, [esp + 0x410]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.MicrosoftWindowsStart_MenuProgramsStartuppaint.lnk
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x14]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x107ab964]
mov eax, dword [ecx]
call dword [eax]
test eax, eax
jne 0x10036985
lea eax, [esp + 0x10]
push eax
call ebp
test eax, eax
jne 0x10036985
push 4
lea ecx, [esp + 0x14]
push eax
push ecx
call ebx
lea edx, [esp + 0x10]
push edx
push 0x10227334
call fcn.10029940
add esp, 8
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x800
ret