Function at 0x1502c1b0
Capabilities:
Check for time delay via gettickcount
Enumerate pe sections

Disassembly:
push 0xffffffffffffffff
push 0x1503fd51
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x15049cf8]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x15049cf8]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
lea eax, [esp + 0x18]
push eax
mov eax, dword [0x15057598]
xor edi, edi
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x24]
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x20], edi
mov ecx, dword [eax + 0x2c]
push edx
call ecx
test eax, eax
je 0x1502c6f7
jmp 0x1502c215
xor edi, edi
cmp dword [esp + 0x1c], edi
je 0x1502c6f7
mov ebx, dword [esp + 0x20]
cmp ebx, edi
je 0x1502c6f7
mov edx, dword [esp + 0x18]
mov eax, dword [0x15049958]
add dword [0x150498d0], edx
cmp eax, edi
mov dword [esp + 0x14], ebx
jle 0x1502c249
mov esi, eax
jmp 0x1502c2ff
push 8
push 0xfffffffffffffffe
push str.._AUCONNREC__
push 0x214
call sym.Storm.dll_Ordinal_401
mov dword [esp + 0x24], eax
mov dword [esp + 0x34], eax
cmp eax, edi
mov dword [esp + 0x44], edi
je 0x1502c277
mov ecx, eax
call fcn.15028fb0
mov esi, eax
jmp 0x1502c279
xor esi, esi
cmp esi, edi
mov dword [esp + 0x44], 0xffffffff
mov eax, esi
jne 0x1502c28c
mov eax, 0x15049954
mov ebp, dword [eax]
cmp ebp, edi
je 0x1502c2b7
mov edx, dword [eax + 4]
cmp edx, edi
jg 0x1502c29d
not edx
jmp 0x1502c2a8
mov ebx, dword [esp + 0x14]
mov ecx, eax
sub ecx, dword [ebp + 4]
add edx, ecx
mov dword [edx], ebp
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov dword [eax], edi
mov dword [eax + 4], edi
mov ecx, dword [0x15049954]
mov dword [eax], ecx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov dword [ecx + 4], esi
mov dword [0x15049954], eax
mov dword [esi + 0x108], edi
mov dword [esi + 0x10c], edi
mov dword [esi + 0x110], edi
mov dword [esi + 0x114], edi
mov byte [esi + 0x212], 0xff
mov byte [esi + 0x213], 0xff
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x11c], eax
test byte [ebx + 0xb], 4
je 0x1502c316
movzx edx, byte [ebx + 0xa]
call fcn.150286b0
mov ebp, eax
mov dword [esp + 0x24], ebp
jmp 0x1502c326
mov eax, dword [esp + 0x1c]
push eax
call fcn.15029b40
mov ebp, eax
mov dword [esp + 0x24], eax
cmp ebp, edi
je 0x1502c6ae
cmp esi, edi
je 0x1502c6ae
cmp dword [esp + 0x18], 0xc
jb 0x1502c9f4
movzx ecx, word [ebx + 2]
movzx eax, cx
cmp dword [esp + 0x18], eax
jb 0x1502c9f4
cmp cx, 0xc
jb 0x1502c9f4
mov ecx, dword [esp + 0x14]
mov bl, byte [ecx + 8]
cmp bl, 4
jae 0x1502c9f4
mov edx, dword [esp + 0x20]
call fcn.15026e70
test ax, ax
jne 0x1502c9f4
cmp dword [0x150573fc], 0
mov edi, dword [esp + 0x14]
jne 0x1502c3a8
mov al, byte [edi + 0xa]
cmp al, 0xff
je 0x1502c3a8
test byte [edi + 0xb], 4
jne 0x1502c3a8
movzx edx, al
call fcn.150286b0
cmp eax, ebp
jne 0x1502c8ab
test bl, bl
jne 0x1502c462
cmp byte [edi + 9], 1
jne 0x1502c462
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.15029b40
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test edi, edi
mov esi, eax
je 0x1502c3eb
mov edx, esi
sub edx, dword [edi + 0x208]
cmp edx, dword [0x15049928]
jae 0x1502c3eb
mov edi, 1
mov ebp, edi
jmp 0x1502c3f5
xor ebp, ebp
call fcn.1502b1f0
lea edi, [ebp + 1]
mov eax, dword [esp + 0x14]
cmp word [eax + 2], 0x10
jne 0x1502c8ab
cmp dword [eax + 0xc], edi
jne 0x1502c8ab
test ebp, ebp
jne 0x1502c8ab
mov eax, dword [esp + 0x1c]
push eax
call fcn.15029b40
test eax, eax
je 0x1502c8ab
push 4
lea ecx, [esp + 0x28]
push ecx
push 2
mov dword [eax + 0x208], esi
push ebp
mov esi, eax
mov dword [eax + 0x204], edi
mov word [eax + 0x1d4], di
mov word [eax + 0x1de], di
mov word [eax + 0x1cc], di
mov dword [esp + 0x34], edi
call fcn.15029ee0
jmp 0x1502c8ab
test byte [edi + 0xb], 4
jne 0x1502c48a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp + 0x11c], eax
test byte [edi + 0xb], 4
jne 0x1502c48a
movzx ecx, word [edi + 6]
movzx edx, byte [edi + 8]
push ecx
push edx
push ebp
call fcn.15029d60
mov al, byte [edi + 0xb]
test al, 1
jne 0x1502c6ae
test al, 2
je 0x1502c65f
cmp word [edi + 2], 0xc
je 0x1502c5c0
mov edx, dword [esp + 0x14]
mov bl, byte [edx + 0xc]
cmp bl, byte [0x15049934]
je 0x1502c5c0
mov eax, edx
cmp byte [eax + 8], 2
jne 0x1502c8ab
movzx edx, bl
call fcn.150286b0
mov edi, eax
test edi, edi
jne 0x1502c4e4
call fcn.15028660
mov edi, eax
test edi, edi
je 0x1502c8ab
cmp byte [edi + 0x212], 0xff
jne 0x1502c527
mov al, byte [edi + 0x213]
cmp al, bl
jne 0x1502c527
movzx edx, word [edi + 0x210]
mov esi, dword [esp + 0x24]
movzx ecx, al
mov eax, dword [edi + 0x20c]
push 0xc
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0x2c]
push ecx
push 0xc
push 0
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
call fcn.15029ee0
mov ebp, dword [edi + 0x180]
test ebp, ebp
jle 0x1502c552
mov edx, dword [esp + 0x14]
movzx eax, word [edx + 4]
lea esp, [esp]
mov ecx, dword [ebp + 0xc]
cmp word [ecx + 4], ax
je 0x1502c58d
mov ebp, dword [ebp + 4]
test ebp, ebp
jle 0x1502c552
jne 0x1502c540
mov edi, dword [edi + 0x1c8]
test edi, edi
jle 0x1502c8ab
mov ebp, edi
test ebp, ebp
je 0x1502c8ab
mov edx, dword [esp + 0x14]
movzx eax, word [edx + 4]
mov ecx, dword [ebp + 0xc]
cmp word [ecx + 4], ax
je 0x1502c58d
mov ebp, dword [ebp + 4]
test ebp, ebp
jle 0x1502c8ab
jne 0x1502c572
jmp 0x1502c8ab
mov edx, dword [ebp + 0xc]
mov word [edx], 0
mov eax, dword [ebp + 0xc]
or byte [eax + 0xb], 4
mov edx, dword [ebp + 0xc]
call fcn.15026ec0
mov ecx, dword [ebp + 0xc]
mov word [ecx], ax
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 0x24]
push eax
mov eax, dword [ebp + 0x10]
push ecx
call fcn.15027730
jmp 0x1502c8ab
mov edx, dword [esp + 0x14]
mov cl, byte [edx + 8]
cmp cl, 2
jne 0x1502c612
mov ebp, dword [esi + 0x180]
test ebp, ebp
jle 0x1502c5f2
movzx eax, word [edx + 4]
lea ebx, [ebx]
mov edi, dword [ebp + 0xc]
cmp word [edi + 4], ax
je 0x1502c5aa
mov ebp, dword [ebp + 4]
test ebp, ebp
jle 0x1502c5f2
jne 0x1502c5e0
mov ebp, dword [esi + 0x1c8]
test ebp, ebp
jle 0x1502c612
movzx eax, word [edx + 4]
mov esi, dword [ebp + 0xc]
cmp word [esi + 4], ax
je 0x1502c5aa
mov ebp, dword [ebp + 4]
test ebp, ebp
jle 0x1502c612
jne 0x1502c600
movzx eax, cl
mov ecx, dword [esp + 0x24]
lea eax, [eax + eax*2]
mov ebp, dword [ecx + eax*4 + 0x138]
test ebp, ebp
lea eax, [ecx + eax*4 + 0x134]
jle 0x1502c8ab
movzx eax, word [edx + 4]
jmp 0x1502c640
mov edx, dword [ebp + 0xc]
cmp word [edx + 4], ax
je 0x1502c5aa
mov ebp, dword [ebp + 4]
test ebp, ebp
jle 0x1502c8ab
jne 0x1502c640
jmp 0x1502c8ab
mov cl, byte [edi + 8]
movzx edx, cl
mov ax, word [ebp + edx*2 + 0x1d4]
sub ax, word [edi + 4]
je 0x1502c716
cmp ax, 0x7fff
jae 0x1502c716
cmp cl, 2
je 0x1502c6ae
movzx eax, cl
mov cx, word [ebp + eax*2 + 0x1de]
sub cx, 1
mov word [ebp + eax*2 + 0x1e6], cx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
movzx edx, byte [edi + 8]
mov dword [ebp + edx*4 + 0x1f0], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push eax
mov eax, dword [0x15057598]
push ecx
mov ecx, dword [eax + 0xc]
push edx
call ecx
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], eax
lea edx, [esp + 0x18]
push edx
mov edx, dword [0x15057598]
lea eax, [esp + 0x24]
push eax
mov eax, dword [edx + 0x2c]
lea ecx, [esp + 0x24]
push ecx
call eax
test eax, eax
jne 0x1502c213
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1503831e
add esp, 0x34
ret
push 8
push 0xfffffffffffffffe
push str.._AUMESSAGE__
push 0x20
call sym.Storm.dll_Ordinal_401
test eax, eax
je 0x1502c73b
mov dword [eax], 0
mov dword [eax + 4], 0
mov ebp, eax
jmp 0x1502c73d
xor ebp, ebp
mov edx, dword [esp + 0x1c]
mov dword [ebp + 8], edx
mov eax, dword [esp + 0x20]
mov dword [ebp + 0xc], eax
mov ecx, dword [esp + 0x18]
mov dword [ebp + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x24]
mov dword [ebp + 0x18], eax
sub eax, dword [0x15049930]
add eax, dword [0x1504992c]
mov dword [ebp + 0x1c], eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff4
add dword [0x150498b0], eax
movzx eax, byte [esi + 8]
lea edx, [eax + eax*2]
mov eax, dword [ebx + edx*4 + 0x168]
test eax, eax
lea edx, [ebx + edx*4]
jg 0x1502c798
xor eax, eax
jmp 0x1502c7cc
movzx edi, word [esi + 4]
lea esp, [esp]
mov esi, dword [eax + 0xc]
mov cx, di
sub cx, word [esi + 4]
je 0x1502c893
cmp cx, 0x7fff
jae 0x1502c893
mov eax, dword [eax + 4]
test eax, eax
jle 0x1502c88c
jne 0x1502c7a0
mov esi, dword [esp + 0x14]
push eax
push 2
push ebp
lea ecx, [edx + 0x160]
call fcn.15028c70
cmp byte [esi + 8], 2
je 0x1502c8ca
movzx eax, byte [esi + 8]
mov cx, word [ebx + eax*2 + 0x1d4]
movzx edx, word [ebx + eax*2 + 0x1de]
mov word [ebx + eax*2 + 0x1de], cx
movzx eax, byte [esi + 8]
lea eax, [eax + eax*2]
mov ecx, dword [ebx + eax*4 + 0x168]
test ecx, ecx
lea eax, [ebx + eax*4 + 0x164]
jle 0x1502c852
lea ebx, [ebx]
movzx eax, byte [esi + 8]
mov edi, dword [ecx + 0xc]
mov di, word [edi + 4]
cmp di, word [ebx + eax*2 + 0x1de]
jne 0x1502c852
movzx eax, byte [esi + 8]
add word [ebx + eax*2 + 0x1de], 1
mov ecx, dword [ecx + 4]
test ecx, ecx
lea eax, [ebx + eax*2 + 0x1de]
jle 0x1502c852
jne 0x1502c820
movzx eax, byte [esi + 8]
cmp word [ebx + eax*2 + 0x1de], dx
je 0x1502c9da
cmp dword [ebx + eax*4 + 0x1f0], 0
jne 0x1502c9da
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x14]
movzx edx, byte [ecx + 8]
mov dword [ebx + edx*4 + 0x1f0], eax
jmp 0x1502c9da
xor eax, eax
jmp 0x1502c7c8
mov ecx, esi
cmp di, word [ecx + 4]
jne 0x1502c7c8
push ebp
lea ecx, [edx + 0x160]
call fcn.15029610
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push edx
mov edx, dword [0x15057598]
push eax
mov eax, dword [edx + 0xc]
push ecx
call eax
jmp 0x1502c6c7
mov eax, dword [esp + 0x14]
movzx eax, byte [eax + 8]
movzx ecx, word [ebx + eax*2 + 0x1de]
mov dx, word [ebx + eax*2 + 0x1d4]
sub dx, cx
cmp dx, 0x7fff
movzx esi, cx
jae 0x1502c8f6
movzx esi, word [ebx + 0x1d8]
mov ebp, dword [0x1504994c]
lea esp, [esp]
xor edx, edx
test ebp, ebp
mov dword [esp + 0x24], 1
jle 0x1502c9da
mov ecx, ebp
cmp byte [ecx + 0x212], 0xff
je 0x1502c95a
test byte [ecx + 0x118], 4
je 0x1502c934
movzx eax, word [ecx + 0x1d8]
movzx edi, si
sub edi, eax
js 0x1502c95a
mov eax, dword [ecx + 0x180]
test eax, eax
jle 0x1502c952
mov edi, edi
mov edi, dword [eax + 0xc]
cmp word [edi + 4], si
je 0x1502c977
mov eax, dword [eax + 4]
test eax, eax
jle 0x1502c952
jne 0x1502c940
mov dword [esp + 0x24], 0
mov eax, dword [ecx + 4]
test eax, eax
jle 0x1502c967
mov ecx, eax
test ecx, ecx
jne 0x1502c914
test edx, edx
je 0x1502c97e
cmp dword [esp + 0x24], 0
je 0x1502c97e
add esi, 1
jmp 0x1502c900
mov edx, 1
jmp 0x1502c95a
test ebp, ebp
jle 0x1502c9da
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x1502c990
cmp si, word [ebp + 0x1e2]
je 0x1502c9d1
cmp byte [ebp + 0x212], 0xff
je 0x1502c9d1
test byte [ebp + 0x118], 4
je 0x1502c9b9
movzx ecx, word [ebp + 0x1d8]
movzx edx, si
sub edx, ecx
js 0x1502c9d1
cmp dword [ebp + 0x1f8], 0
mov word [ebp + 0x1e2], si
jne 0x1502c9d1
call edi
mov dword [ebp + 0x1f8], eax
mov ebp, dword [ebp + 4]
test ebp, ebp
jle 0x1502c9da
jne 0x1502c990
mov eax, dword [esp + 0x14]
cmp byte [eax + 8], 0
jne 0x1502c6c7
mov edi, ebx
call fcn.1502a4c0
jmp 0x1502c6c7
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [0x15057598]
push edx
mov edx, dword [ecx + 0xc]
push eax
call edx
jmp 0x1502c6c7