Function at 0x54a500
Capabilities:
Create thread
Read .ini file

Disassembly:
mov eax, 0x1190
call fcn.005e00d0
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x118c], eax
mov eax, dword [esp + 0x1198]
mov ecx, dword [esp + 0x119c]
push ebx
mov ebx, dword [esp + 0x11a4]
push ebp
push esi
push edi
mov edi, dword [esp + 0x11a4]
xor esi, esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], esi
cmp edi, esi
jne 0x54a57c
mov edx, dword [str.ForAVScan]
mov eax, dword [0x656254]
mov cx, word [0x656258]
mov dword [esp + 0xc88], edx
mov dword [esp + 0xc8c], eax
mov word [esp + 0xc90], cx
jmp 0x54a599
lea edx, [esp + 0xc88]
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x54a587
cmp byte [edi], cl
jne 0x54a77e
push 0x75e8c8
lea edx, [esp + 0x570]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x56c]
push eax
call fcn.004e24e0
add esp, 4
push str.CTEMP.DAT
lea ecx, [esp + 0x570]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 1
push esi
push esi
push esi
lea edx, [esp + 0x57c]
push esi
push edx
call fcn.004e8950
add esp, 0x18
test eax, eax
jne 0x54a5f9
lea eax, [esp + 0x56c]
push eax
call fcn.004e0670
add esp, 4
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], esi
call fcn.004dc570
mov edi, dword [esp + 0x14]
add esp, 4
test eax, eax
jbe 0x54a6ef
xor ebx, ebx
cmp byte [edi], bl
je 0x54a6ef
lea esi, [ebx + edi]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x54a628
sub eax, edx
lea ecx, [eax + esi + 1]
lea ebp, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x54a638
sub ecx, ebp
lea ecx, [ecx + eax]
lea ebx, [ebx + ecx + 2]
jne 0x54a663
push 0
push str.ctemp.dat
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x54a66e
mov edi, dword [esp + 0x10]
cmp byte [ebx + edi], 0
jne 0x54a620
jmp 0x54a6ef
push 0x626d50
push 0x647970
push reloc.OLEAUT32.dll_SysReAllocString
xor ebx, ebx
call fcn.004e9430
mov edi, dword [esp + 0x10]
cmp byte [edi], bl
je 0x54a6ef
lea esp, [esp]
lea esi, [ebx + edi]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x54a698
sub eax, edx
lea edi, [eax + esi + 1]
mov ecx, edi
lea ebp, [ecx + 1]
lea ebx, [ebx]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x54a6b0
sub ecx, ebp
lea ecx, [ecx + eax]
lea ebx, [ebx + ecx + 2]
jne 0x54a6db
push 0
push str.ctemp.dat
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x54a6e5
push 0
jmp 0x54a6dc
push edi
push esi
call fcn.004dc5c0
add esp, 8
mov edi, dword [esp + 0x10]
cmp byte [ebx + edi], 0
jne 0x54a690
test edi, edi
je 0x54a704
push edi
call fcn.005e0865
add esp, 4
mov dword [esp + 0x10], 0
lea edx, [esp + 0x24]
push edx
push str.LastNow
push 0x6111b8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
call fcn.004f4f50
mov ecx, dword [esp + 0x24]
test ecx, ecx
jbe 0x54a8a6
cmp eax, ecx
jae 0x54a8bb
push eax
push str.LastNow
push 0x6111b8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
lea eax, [esp + 0xd8c]
push str._JOB__Fresh_BOOT_Detected._Checking_for_Startup_Jobs...
push eax
call fcn.005dfb23
push 0
push 1
lea ecx, [esp + 0xd9c]
push ecx
push 0x6aec98
call fcn.004311c0
mov edi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x40]
add esp, 0x18
lea edx, [esp + 0x18]
xor ebp, ebp
push edi
push edx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], ebp
call fcn.005487e0
mov esi, dword [esp + 0x20]
add esp, 8
test esi, esi
je 0x54a842
cmp byte [esi], 0
je 0x54a831
push 0x103
lea eax, [esp + 0x571]
push ebp
push eax
mov byte [esp + 0x578], 0
call fcn.005dfd60
push 1
push ebp
push 0x2c
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x588]
push edx
push esi
mov dword [esp + 0x34], ebp
call fcn.004e1380
add esp, 0x24
cmp dword [esp + 0x10], 0xffffffff
je 0x54a82d
or esi, 0xffffffff
nop
push edi
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x574]
push ecx
call fcn.0054a1f0
mov ecx, dword [esp + 0x24]
push 1
push 0
push 0x2c
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x588]
push eax
push ecx
call fcn.004e1380
add esp, 0x24
cmp dword [esp + 0x10], esi
jne 0x54a7f0
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
push esi
call fcn.005e0865
add esp, 4
mov dword [esp + 0x18], 0
test ebx, ebx
je 0x54a848
mov dword [ebx], ebp
test ebp, ebp
jne 0x54ac2a
push 0x103
lea edx, [esp + 0x675]
push ebp
push edx
mov byte [esp + 0x20], 0
mov byte [esp + 0x21], 0
mov byte [esp + 0x67c], 0
call fcn.005dfd60
mov eax, dword [esp + 0x28]
add esp, 0xc
mov ebp, 0x104
mov dword [esp + 0x10], ebp
test eax, eax
je 0x54a901
cmp byte [eax], 0
je 0x54a901
mov ecx, dword [esp + 0x1c]
push 0x75df40
push 2
lea eax, [esp + 0x1c]
push eax
push 0x615678
push ecx
jmp 0x54a917
push eax
push str.LastNow
push 0x6111b8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
lea edx, [esp + 0xd8c]
push str._JOB__Fresh_Boot_NOT_Detected._Not_running_Startup_Jobs...
push edx
call fcn.005dfb23
push 0
push 1
lea eax, [esp + 0xd9c]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x18
xor eax, eax
mov ecx, dword [esp + 0x119c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005dfbbe
add esp, 0x1190
ret
push 0x75df40
push 2
lea edx, [esp + 0x1c]
push edx
push 0x615678
push str.ScheduledJobCompleted
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x60da74
call esi
mov bl, 0x30
cmp byte [esp + 0x14], bl
jne 0x54a968
mov eax, dword [esp + 0x20]
test eax, eax
je 0x54a94c
cmp byte [eax], 0
je 0x54a94c
push 0x75df40
push ebp
lea ecx, [esp + 0x678]
push ecx
push 0
push eax
jmp 0x54a961
push 0x75df40
push ebp
lea edx, [esp + 0x678]
push edx
push 0
push str.ScheduledJobName
push 0x60da74
call esi
cmp byte [esp + 0x670], 0
je 0x54ac2a
push 0x207
xor esi, esi
lea eax, [esp + 0x87d]
push esi
push eax
mov byte [esp + 0x884], 0
call fcn.005dfd60
push 0x103
lea ecx, [esp + 0xa91]
push esi
push ecx
mov byte [esp + 0xa98], 0
call fcn.005dfd60
push 0x103
lea edx, [esp + 0x791]
push esi
push edx
mov byte [esp + 0x798], 0
call fcn.005dfd60
push 0x103
lea eax, [esp + 0x595]
push esi
push eax
mov byte [esp + 0x59c], 0
call fcn.005dfd60
push 0x103
lea ecx, [esp + 0xbb9]
push esi
push ecx
mov byte [esp + 0xbc0], 0
call fcn.005dfd60
push 0x53c
lea edx, [esp + 0x70]
push esi
push edx
call fcn.005dfd60
add esp, 0x48
mov dword [esp + 0x30], esi
cmp edi, esi
je 0x54aa5a
cmp byte [edi], 0
je 0x54aa5a
lea edx, [esp + 0x158]
mov dword [esp + 0x2c], esi
mov eax, edi
sub edx, edi
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x54aa30
lea eax, [esp + 0x670]
push eax
push edi
lea ecx, [esp + 0x880]
push str.SoftwareMicroWorldeScan_For_Windows_sSchedulerJobs_s
push ecx
call fcn.005dfb23
add esp, 0x10
jmp 0x54aa87
lea edx, [esp + 0x670]
push edx
lea eax, [esp + 0x87c]
push str.SoftwareMicroWorldeScan_For_WindowsODSSchedulerJobs_s
push eax
mov dword [esp + 0x38], 1
mov byte [esp + 0x164], 0
call fcn.005dfb23
add esp, 0xc
cmp dword [esp + 0x2c], esi
je 0x54ac2a
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0xb88]
push edx
push str.AllowUserToCancelScanning
lea eax, [esp + 0x884]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], ebp
call fcn.004d5770
cmp byte [esp + 0xb84], bl
jne 0x54ac2a
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0xa84]
push edx
push str.Foreground
lea eax, [esp + 0x884]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], ebp
call fcn.004d5770
xor ecx, ecx
cmp byte [esp + 0xa80], 0x31
lea edx, [esp + 0x10]
sete cl
push edx
lea eax, [esp + 0x778]
push eax
push str.ScanPriority
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x48], ecx
lea ecx, [esp + 0x884]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5770
lea edx, [esp + 0x774]
push edx
call fcn.005e0909
add esp, 4
mov dword [esp + 0x40], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x570]
push ecx
push str.JobName
lea edx, [esp + 0x884]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], ebp
call fcn.004d5770
cmp byte [esp + 0x56c], 0
je 0x54ac2a
xor eax, eax
jmp 0x54ab80
mov cl, byte [esp + eax + 0x56c]
mov byte [esp + eax + 0x25c], cl
inc eax
test cl, cl
jne 0x54ab80
xor eax, eax
jmp 0x54aba0
mov cl, byte [esp + eax + 0x670]
mov byte [esp + eax + 0x360], cl
inc eax
test cl, cl
jne 0x54aba0
lea eax, [esp + 0x56c]
push eax
lea ecx, [esp + 0x674]
push ecx
lea edx, [esp + 0xf9c]
push str._JOB__A__Starting_Job:__s__Name:_s_
push edx
call fcn.005dfb23
push 0
push 1
lea eax, [esp + 0xfac]
push eax
push 0x6aec98
call fcn.004311c0
lea ecx, [esp + 0x4c]
push ecx
push 0
push 0x5490a0
call fcn.005e07ac
add esp, 0x2c
cmp eax, 0xffffffff
je 0x54ac2a
cmp dword [esp + 0x30], 0
jne 0x54ac90
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call esi
cmp dword [esp + 0x30], 0
je 0x54ac15
mov eax, 1
jmp 0x54a8e8
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x54ac44
cmp byte [eax], 0
je 0x54ac44
push 0x75df40
push 0x615678
push eax
jmp 0x54ac53
push 0x75df40
push 0x615678
push str.ScheduledJobCompleted
push 0x60da74
call fcn.004e0cb0
mov eax, dword [esp + 0x30]
add esp, 0x10
test eax, eax
je 0x54ac77
cmp byte [eax], 0
je 0x54ac77
push 0x75df40
push 0
push eax
jmp 0x54ac83
push 0x75df40
push 0
push str.ScheduledJobName
push 0x60da74
call fcn.004e0cb0
add esp, 0x10
mov eax, 1
jmp 0x54a8e8