Function at 0x417070
Capabilities:
Copy file
Create process on windows
Create thread
Get common file path
Initialize winsock library
Terminate process

Disassembly:
sub esp, 0x7f0
mov eax, dword [0x425044]
xor eax, esp
mov dword [esp + 0x7ec], eax
mov eax, dword [esp + 0x7f4]
push esi
push edi
xor esi, esi
push esi
push eax
push esi
push esi
push esi
push connect
push esi
push connect
push 0xcf0000
push 0x4276b0
push 0x4275e8
push esi
mov dword [0x427778], eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x417383
push 0x206
lea eax, [esp + 0x5ee]
push esi
push eax
mov word [esp + 0x5f4], si
call fcn.00405a30
add esp, 0xc
push 0x206
lea ecx, [esp + 0x1de]
push esi
push ecx
mov word [esp + 0x1e4], si
call fcn.00405a30
add esp, 0xc
push 0x206
lea edx, [esp + 0x3e6]
push esi
push edx
mov word [esp + 0x3ec], si
call fcn.00405a30
add esp, 0xc
push 0x104
lea eax, [esp + 0x5ec]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, 0x422ffc
mov eax, 0x4281b8
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x417166
cmp dx, si
je 0x417162
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x417166
add eax, 4
add ecx, 4
cmp dx, si
jne 0x417140
xor eax, eax
jmp 0x41716b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
je 0x41722c
push 0x208
lea ecx, [esp + 0x1dc]
push esi
push ecx
call fcn.00405a30
add esp, 0xc
lea edx, [esp + 0x1d8]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x208
lea eax, [esp + 0x3e4]
push esi
push eax
call fcn.00405a30
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004011f5
add esp, 4
lea ecx, [esp + 0x3e0]
push ecx
push 6
mov eax, 7
call fcn.00415380
lea edx, [esp + 0x3e8]
push edx
lea eax, [esp + 0x1e4]
push eax
mov ecx, eax
push str._s_s.exe
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
push esi
lea edx, [esp + 0x1dc]
push edx
lea eax, [esp + 0x5f0]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 1
push esi
push 0x423018
lea ecx, [esp + 0x1e4]
push ecx
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea edx, [esp + 8]
push edx
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 1
mov edi, 0x427f38
call fcn.0040e100
add esp, 4
test eax, eax
jne 0x417339
push 0x3a
lea eax, [esp + 0x1a2]
push esi
push eax
mov word [esp + 0x1a8], si
call fcn.00405a30
add esp, 0xc
lea edi, [esp + 0x19c]
call fcn.00415fb0
xor eax, eax
lea esp, [esp]
movzx ecx, word [esp + eax + 0x19c]
mov word [eax + 0x4280e0], cx
add eax, 2
cmp cx, si
jne 0x417280
push 0x423020
push 0x40
push 0x427f3c
call fcn.00401224
add esp, 0xc
push 0x42303c
push 0x10
push 0x427fbe
mov word [0x427fbc], 0x51
call fcn.00401224
add esp, 0xc
push 0x423048
push 0x40
push 0x427fde
call fcn.00401224
add esp, 0xc
mov word [0x42805e], 0x2b66
xor eax, eax
jmp 0x4172f0
movzx ecx, word [esp + eax + 0x19c]
mov word [eax + 0x4280c0], cx
add eax, 2
cmp cx, si
jne 0x4172f0
mov eax, 0x4280c0
add eax, 0xfffffffe
nop
mov cx, word [eax + 2]
add eax, 2
cmp cx, si
jne 0x417310
mov ecx, dword [0x423064]
mov dx, word [0x423068]
mov dword [eax], ecx
mov word [eax + 4], dx
mov dword [0x428100], 5
call fcn.00416e30
lea edi, [esp + 0x3e0]
call fcn.00415fb0
xor eax, eax
lea esp, [esp]
movzx ecx, word [esp + eax + 0x3e0]
mov word [eax + 0x428138], cx
add eax, 2
cmp cx, si
jne 0x417350
push 0x428138
push esi
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
cmp eax, esi
je 0x41739c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x7ec]
xor ecx, esp
call fcn.0040113c
add esp, 0x7f0
ret
push 0x428138
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
je 0x417383
mov ecx, 0x4285d0
call fcn.00416ee0
mov eax, dword [0x428104]
push esi
push esi
push esi
push 0x415d00
push esi
push esi
mov dword [0x4285d8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0x7f4]
pop edi
pop esi
mov dword [0x426648], eax
xor ecx, esp
mov eax, 1
call fcn.0040113c
add esp, 0x7f0
ret