Function at 0x10001340
Capabilities:
Allocate or change rwx memory
Check if file exists
Execute shellcode via indirect call
Get file attributes
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push str.decimal.ini
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0
push 0x80
cmp eax, 0xffffffff
je 0x1000151d
push 3
push 0
push 0
push 0x80000000
push str.decimal.ini
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10001577
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea esi, [edi + 1]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push esi
push 0
push eax
mov dword [ebp - 8], eax
call sub.msvcrt.dll_memset
mov esi, dword [ebp - 8]
add esp, 0xc
test edi, edi
je 0x100013df
nop dword [eax]
push 0
lea eax, [ebp - 4]
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10001586
add esi, dword [ebp - 4]
sub edi, dword [ebp - 4]
jne 0x100013c0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x100043a8
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x10001516
mov esi, dword [0x5310b5]
lea eax, [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
push 0x5310b5
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0xd35d0468
je 0x10001449
mov esi, 1
mov dword [0x5310b5], 0xd35d0468
push esi
call ebx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 4
push 0x5310b5
call edi
jmp 0x1000147c
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 4
push 0x5310b5
call edi
mov eax, 0x100043ac
cmp eax, str.9A7
je 0x1000148f
cmp eax, str.992
je 0x1000148f
cmp eax, str.9A0
je 0x1000148f
xor esi, esi
cmp eax, 0x10004380
je 0x1000148f
push esi
push 0x100043ac
push str.Patch__Code_:__s___d__r_n
call fcn.10001050
add esp, 0xc
mov esi, dword [0x5310df]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x5310df
call edi
cmp esi, 0xd35d0468
je 0x100014d0
mov esi, 1
mov dword [0x5310df], 0xd35d0468
push esi
call ebx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 4
push 0x5310df
call edi
jmp 0x10001503
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 4
push 0x5310df
call edi
mov eax, 0x100043b0
cmp eax, str.9A7
je 0x10001516
cmp eax, str.992
je 0x10001516
cmp eax, str.9A0
je 0x10001516
xor esi, esi
cmp eax, 0x10004380
je 0x10001516
push esi
push 0x100043b0
push str.Patch__Code_:__s___d__r_n
call fcn.10001050
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 4
push 0
push 0
push 2
push str.decimal.ini
mov esi, 1
mov edi, 0x100043a8
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10001595
push 0
lea eax, [ebp - 8]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10001568
add edi, dword [ebp - 8]
sub esi, dword [ebp - 8]
jne 0x10001541
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100013fc
push str.decimal.ini
push str.Error_writing_to_file__s.
call fcn.10001000
push str.decimal.ini
push str.Error_opening_file__s.
call fcn.10001000
push str.decimal.ini
push str.Error_loading_file__s.
call fcn.10001000
push str.decimal.ini
push str.Error_creating_file__s.
call fcn.10001000
int3