Function at 0x1015b5f0
Capabilities:
Check for time delay via gettickcount
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7d8
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [esi + 0x24], 0x1111ff2f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x68], eax
xor ebx, ebx
mov ecx, 0x3b
xor eax, eax
lea edi, [ebp - 0x103]
mov byte [ebp - 0x104], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x173
xor eax, eax
lea edi, [ebp - 0x6d0]
mov dword [ebp - 0x6d4], ebx
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0xa8]
mov dword [ebp - 0x14], ebx
cmp eax, ebx
mov dword [ebp - 0x10], ebx
je 0x1015b66a
cmp dword [esi + 0xac], ebx
je 0x1015b66a
cmp dword [esi + 0xb0], ebx
je 0x1015b66a
cmp dword [esi + 0xc4], ebx
jne 0x1015b83b
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, ebx
mov dword [esi + 0xa8], eax
jne 0x1015b6a3
cmp dword [esi + 0xc], ebx
jne 0x1015b690
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], 5
mov dword [esi + 0x24], 0x1111ff1f
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 0xac], eax
mov ecx, dword [eax + 0x3c]
add eax, ecx
mov dword [ebp + 0xc], ebx
mov dword [esi + 0xb0], eax
cmp word [eax + 6], bx
jbe 0x1015b759
mov edx, dword [esi + 0xac]
mov ecx, dword [esi + 0xa8]
push str..rdata
mov eax, dword [edx + 0x3c]
add eax, ebx
lea edi, [eax + ecx + 0xf8]
push edi
call fcn.101716a8
add esp, 8
test eax, eax
jne 0x1015b6f1
mov dword [esi + 0xb4], edi
push str..edata
push edi
call fcn.101716a8
add esp, 8
test eax, eax
jne 0x1015b709
mov dword [esi + 0xb8], edi
push str..rsrc
push edi
call fcn.101716a8
add esp, 8
test eax, eax
jne 0x1015b721
mov dword [esi + 0xbc], edi
push str..reloc
push edi
call fcn.101716a8
add esp, 8
test eax, eax
jne 0x1015b739
mov dword [esi + 0xc0], edi
mov edx, dword [esi + 0xb0]
mov eax, dword [ebp + 0xc]
xor ecx, ecx
inc eax
mov cx, word [edx + 6]
add ebx, 0x28
cmp eax, ecx
mov dword [ebp + 0xc], eax
jb 0x1015b6c1
xor ebx, ebx
mov ecx, dword [esi + 0x1c]
mov dword [esi + 0xc4], ebx
test cl, 1
je 0x1015b77d
mov eax, dword [esi + 0xb0]
cmp eax, ebx
je 0x1015b77d
mov edx, dword [eax + 0x1c]
shr edx, 0xc
mov dword [esi + 0xc4], edx
test ch, 1
je 0x1015b7a0
mov eax, dword [esi + 0xb4]
cmp eax, ebx
je 0x1015b7a0
mov eax, dword [eax + 8]
mov edx, dword [esi + 0xc4]
shr eax, 0xc
add edx, eax
mov dword [esi + 0xc4], edx
test ch, 0x10
je 0x1015b7c3
mov eax, dword [esi + 0xb8]
cmp eax, ebx
je 0x1015b7c3
mov edx, dword [eax + 8]
mov eax, dword [esi + 0xc4]
shr edx, 0xc
add eax, edx
mov dword [esi + 0xc4], eax
test ecx, 0x10000
je 0x1015b7e9
mov eax, dword [esi + 0xbc]
cmp eax, ebx
je 0x1015b7e9
mov eax, dword [eax + 8]
mov edx, dword [esi + 0xc4]
shr eax, 0xc
add edx, eax
mov dword [esi + 0xc4], edx
test ecx, 0x100000
je 0x1015b80f
mov eax, dword [esi + 0xc0]
cmp eax, ebx
je 0x1015b80f
mov ecx, dword [eax + 8]
mov eax, dword [esi + 0xc4]
shr ecx, 0xc
add eax, ecx
mov dword [esi + 0xc4], eax
mov eax, dword [esi + 0xc4]
cmp eax, ebx
ja 0x1015b83b
cmp dword [esi + 0xc], ebx
jne 0x1015b828
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], 0x1001
mov dword [esi + 0x24], 0x1111ff1f
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 1
mov eax, 0x10a6e48c
mov dword [ebp + 0xc], ecx
cmp dword [eax], ebx
je 0x1015b84d
inc ecx
add eax, 8
cmp eax, 0x10a6e4b4
jl 0x1015b848
lea edx, [ebp - 0x104]
lea eax, [ebp - 0x6d4]
mov dword [ebp - 0xc], edx
lea edx, [esi + 0xe0]
mov dword [ebp + 0xc], ecx
mov ebx, 0x10a6e48c
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov edx, dword [ebx]
test edx, edx
je 0x1015b8e2
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x7d7]
mov byte [ebp - 0x7d8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x7d8]
push 0x104
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1015bacd
mov eax, dword [ebp + 8]
xor edx, edx
div dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
mov edx, dword [esi + 0x18]
push ecx
push edi
push eax
push edx
push ebx
call fcn.1015b140
push 0x28
push edi
call fcn.1015bca0
mov ecx, dword [ebp - 8]
add esp, 0x1c
mov dword [ecx], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
add edx, 4
add ebx, 8
mov dword [ebp - 8], edx
mov edx, dword [ebp - 0xc]
add eax, 0xf8
add edx, 0x28
cmp ebx, 0x10a6e4b4
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], edx
jl 0x1015b87a
mov edx, dword [esi + 0xa8]
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x1fc]
lea eax, [ebp - 0x3c]
push edx
push eax
mov eax, dword [ebp + 8]
xor edx, edx
div ecx
mov ecx, dword [esi + 0x18]
lea edx, [ebp - 0x14]
push eax
push ecx
push edx
call fcn.1015b140
add esp, 0x14
mov dword [ebp + 8], 0
mov dword [ebp + 8], ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [eax + 0x3c]
mov edi, dword [ebp + 8]
add ecx, eax
mov edi, dword [edi + 4]
mov edx, dword [ecx + 0x2c]
lea ebx, [edx + eax]
cmp edi, ebx
jb 0x1015b979
mov ecx, dword [ecx + 0x1c]
add ecx, edx
add ecx, eax
cmp edi, ecx
ja 0x1015b979
cmp eax, 0x400000
je 0x1015b99d
mov edx, dword [ebp + 8]
mov eax, 1
mov dword [0x10a6e4d4], eax
mov dword [0x10a6e4c0], eax
mov dword [0x10a6e4c4], 0x2011
mov eax, dword [edx + 4]
mov dword [0x10a6e4c8], eax
lea ecx, [ebp - 0x3c]
push 0x28
push ecx
call fcn.1015bca0
add esp, 8
mov dword [esi + 0xf4], eax
xor eax, eax
mov dl, byte [ebp + eax - 0x104]
mov bl, byte [ebp + eax - 0xdc]
mov cl, byte [ebp + eax - 0x3c]
xor dl, bl
mov bl, byte [ebp + eax - 0xb4]
xor dl, cl
mov cl, byte [ebp + eax - 0x64]
xor dl, bl
mov bl, byte [ebp + eax - 0x8c]
xor dl, cl
xor dl, bl
mov byte [esi + eax + 0x3c], dl
inc eax
cmp eax, 0x28
jb 0x1015b9b3
mov eax, dword [ebp - 0x1f4]
mov ecx, dword [ebp - 0x2ec]
mov ebx, dword [ebp - 0x3e4]
mov edi, dword [ebp - 0x4dc]
mov edx, dword [ebp - 0x5d4]
xor eax, ecx
mov ecx, dword [ebp - 0x6cc]
xor eax, ebx
mov ebx, dword [ebp - 0x2cc]
xor eax, edi
mov edi, dword [ebp - 0x3c4]
xor eax, edx
mov edx, dword [ebp - 0x4bc]
xor eax, ecx
mov ecx, dword [ebp - 0x1d4]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 0x5b4]
xor ecx, ebx
mov ebx, dword [ebp - 0x6ac]
xor ecx, edi
mov edi, dword [ebp - 0x2d8]
xor ecx, edx
mov edx, dword [ebp - 0x1e0]
xor ecx, eax
mov eax, dword [ebp - 0x4c8]
xor ecx, ebx
mov ebx, dword [ebp - 0x5c0]
mov dword [esi + 0x2c], ecx
mov ecx, dword [ebp - 0x3d0]
xor edx, edi
mov edi, dword [ebp - 0x6b8]
xor edx, ecx
xor edx, eax
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [ebp - 0x39c]
xor edx, ebx
mov ebx, dword [ebp - 0x494]
xor edx, edi
mov edi, dword [ebp - 0x58c]
mov dword [esi + 0x30], edx
mov edx, dword [ebp - 0x2a4]
xor eax, edx
mov edx, dword [ebp - 0x684]
xor eax, ecx
xor eax, ebx
xor eax, edi
xor eax, edx
mov dword [esi + 0x34], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x68]
mov dword [esi + 0x24], 0x1111ff1f
sub eax, ecx
pop edi
mov dword [esi + 0x64], eax
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x24], 0x1111ff1f
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret