Function at 0x433230
Capabilities:
Create thread
Initialize winsock library
Resolve dns
Terminate process

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x44c821
push eax
mov eax, dword [0x45f594]
mov dword fs:[0], esp
sub esp, 0x2b8
push ebx
xor ebx, ebx
push ebp
push esi
cmp eax, ebx
push edi
je 0x433264
mov eax, 1
jmp 0x433603
push 0x45f300
mov dword [0x45f594], 1
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x45f2ec], eax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x35]
mov byte [esp + 0x34], bl
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x38]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov cl, byte [esp + 0x13]
push ebx
mov byte [esp + 0x18], cl
lea ecx, [esp + 0x18]
call fcn.00401ff0
lea edi, [esp + 0x34]
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
lea ecx, [esp + 0x18]
push ebp
call fcn.00402180
test al, al
je 0x433301
mov edi, dword [esp + 0x18]
mov ecx, ebp
mov edx, ecx
lea esi, [esp + 0x34]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
call fcn.00402160
mov edx, dword [0x44e274]
mov edi, 0x455138
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x2d0], ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push 0x455138
lea ecx, [esp + 0x20]
call fcn.00401f70
push 1
lea ecx, [esp + 0x18]
lea ebp, [eax + 1]
mov dword [esp + 0x2d4], 0xffffffff
call fcn.00401ff0
cmp ebp, ebx
jne 0x433352
or eax, 0xffffffff
jmp 0x433603
mov al, byte [esp + 0x13]
push ebx
lea ecx, [esp + 0x18]
mov byte [esp + 0x18], al
call fcn.00401ff0
push 1
push ebp
lea ecx, [esp + 0x1c]
call fcn.00402180
test al, al
je 0x433396
mov edi, dword [esp + 0x18]
mov ecx, ebp
mov edx, ecx
lea esi, [esp + 0x34]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
call fcn.00402160
mov eax, dword [0x44e274]
lea ecx, [esp + 0x14]
push eax
push ebx
push ecx
mov ecx, 0x45f3e8
mov dword [esp + 0x2dc], 1
call fcn.004025b0
or esi, 0xffffffff
push 1
lea ecx, [esp + 0x18]
mov dword [esp + 0x2d4], esi
call fcn.00401ff0
push str.Data_
lea edx, [esp + 0x18]
push 0x45f3e8
push edx
call fcn.00402480
add esp, 0xc
mov ecx, dword [0x44e274]
mov dword [esp + 0x2d0], 2
push ecx
push ebx
push eax
mov ecx, 0x45f3d8
call fcn.004025b0
push 1
lea ecx, [esp + 0x18]
mov dword [esp + 0x2d4], esi
call fcn.00401ff0
mov edi, str.C:Media_
mov ecx, esi
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
mov ecx, 0x45f408
push ebp
call fcn.00402180
test al, al
je 0x43345d
mov edi, dword [0x45f40c]
mov ecx, ebp
mov edx, ecx
mov esi, str.C:Media_
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x45f40c]
mov dword [0x45f410], ebp
mov byte [eax + ebp], bl
mov eax, dword [0x45f3dc]
cmp eax, ebx
jne 0x43346b
mov eax, 0x44e270
push eax
call fcn.004399d0
mov eax, dword [0x45f40c]
add esp, 4
cmp eax, ebx
jne 0x433482
mov eax, 0x44e270
push eax
call fcn.004399d0
push 0x456de4
lea ecx, [esp + 0x2c]
push 0x45f3d8
push ecx
call fcn.00402480
mov eax, dword [eax + 4]
add esp, 0x10
cmp eax, ebx
jne 0x4334ab
mov eax, 0x44e270
push eax
call fcn.004399d0
mov eax, dword [esp + 0x2c]
add esp, 4
cmp eax, ebx
je 0x4334d9
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4334d0
cmp al, 0xff
je 0x4334d0
dec al
mov byte [ecx], al
jmp 0x4334d9
push ecx
call fcn.00439308
add esp, 4
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.00432f00
cmp dword [0x45f430], 5
jne 0x43351c
mov eax, dword [0x45f3f8]
cmp eax, 1
jne 0x433508
cmp dword [0x45f31c], 1
jbe 0x43351c
jmp 0x43350a
jb 0x43351c
lea edx, [esp + 0x34]
push str.QVOD
push edx
call fcn.00402b10
add esp, 8
call fcn.00432250
lea eax, [esp + 0x138]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
call fcn.00433110
test eax, eax
jne 0x433545
or eax, 0xffffffff
jmp 0x433603
push str.track.qvod.com
call dword [sym.imp.WS2_32.dll_gethostbyname]
cmp eax, ebx
je 0x433572
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
mov eax, ecx
mov edi, 0x45f554
mov esi, dword [edx]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x43358a
cmp dword [0x45f554], ebx
jne 0x43358a
push str.220.164.140.231
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [0x45f554], eax
push 0x50
call dword [sym.imp.WS2_32.dll_htons]
push 0x1388
mov word [0x45f318], ax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x45f438
call fcn.0041d2b0
test eax, eax
je 0x4335b8
push 1
call fcn.0043b95b
mov ecx, 0x45f328
call fcn.00426bf0
push 0x1f5f
mov ecx, 0x45ada0
call fcn.00402d50
mov ecx, 0x45ada0
call fcn.00404c10
test eax, eax
je 0x4335e6
mov eax, 2
jmp 0x433603
push ebx
push ebx
push 0x432d20
call fcn.0043a873
push ebx
push ebx
push 0x432050
call fcn.0043a873
add esp, 0x18
xor eax, eax
mov ecx, dword [esp + 0x2c8]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c4
ret