This batch file is responsible for deleting the original sample executable. It queries and stores the current cursor position several times to detect activity and identify if it is being executed in a sandbox or automated analysis environment. These measures are all designed to impede the analysis process and make it more expensive to identify what the malware is actually designed to do from a code execution flow perspective. Below the EAX register is stored in a variable to be reused later in order to allocate a heap memory chunk to initiate its own unpacked code. The malware also uses others techniques to make analysis significantly more difficult, like creating hundreds of case comparisons, which makes tracing code much harder. Below an example of several if conditional statements in pseudo code demonstrating this process and how it can result in impeding the ability to efficiently trace the code. In order to decrypt the malware code it's installs an exception handler, which is responsible for decrypting some memory bytes to continue it's execution. During this execution, the malware will then continue to patch itself and continue execution. The strings are encrypted using an XOR value, however each string uses a separate XOR value preventing an easy detection mechanism. Below is some IDA Python code which can be used to decrypt strings