 When run if the filename does not include the "IptabLes" string then the data is decrypted, written to disk, and then executed, installing itself as a startup service on the machine and place itself in one of the following locations:  The second encrypted block is configuration data, which includes some IP addresses and DNS data which is used when it writes the first decrypted block to a file.