Function at 0x401320
Capabilities:
Copy file
Create process on windows
Create thread
Get common file path
Initialize winsock library
Terminate process

Disassembly:
sub esp, 0xc00
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0xbfc], eax
mov eax, dword [esp + 0xc04]
push ebx
push ebp
push esi
push edi
xor esi, esi
push esi
push eax
push esi
push esi
push esi
push connect
push esi
push connect
push 0xcf0000
push 0x4246b0
push 0x4245e8
push esi
mov dword [0x424778], eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x40176c
push 0x206
lea eax, [esp + 0xa06]
push esi
push eax
mov word [esp + 0xa0c], si
call fcn.0040f6e0
add esp, 0xc
push 0x206
lea ecx, [esp + 0x1e6]
push esi
push ecx
mov word [esp + 0x1ec], si
call fcn.0040f6e0
add esp, 0xc
push 0x206
lea edx, [esp + 0x5f6]
push esi
push edx
mov word [esp + 0x5fc], si
call fcn.0040f6e0
add esp, 0xc
push 0x104
lea eax, [esp + 0xa04]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, 0x41dc20
mov eax, 0x4251b8
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401416
cmp dx, si
je 0x401412
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401416
add eax, 4
add ecx, 4
cmp dx, si
jne 0x4013f0
xor eax, eax
jmp 0x40141b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
je 0x4015f8
push 0x206
lea ecx, [esp + 0x3ee]
push esi
push ecx
mov word [esp + 0x3f4], si
call fcn.0040f6e0
add esp, 0xc
push 0x206
lea edx, [esp + 0x7fe]
push esi
push edx
mov word [esp + 0x804], si
call fcn.0040f6e0
add esp, 0xc
xor eax, eax
movzx ecx, word [eax + 0x41dc44]
mov word [esp + eax + 0x3e8], cx
add eax, 2
cmp cx, si
jne 0x401461
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [esp + eax + 0x3e8]
mov word [esp + eax + 0x7f8], cx
add eax, 2
cmp cx, si
jne 0x401480
lea eax, [esp + 0x7f8]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
cmp cx, si
jne 0x4014a2
mov ecx, dword [0x41dc54]
mov edx, dword [0x41dc58]
mov edi, dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [eax], ecx
mov ecx, dword [0x41dc5c]
mov dword [eax + 4], edx
lea edx, [esp + 0x3e8]
push edx
push esi
push 0x20000
mov dword [eax + 8], ecx
call edi
cmp eax, esi
je 0x40153f
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
lea eax, [esp + 0x7f8]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
lea ecx, [esp + 0x3e8]
push ecx
push esi
push 0x20000
call edi
cmp eax, esi
je 0x40153f
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 5
jge 0x40153d
push eax
call ebx
push 0xc8
add esi, 1
call ebp
lea edx, [esp + 0x3e8]
push edx
push 0
push 0x20000
call edi
test eax, eax
jne 0x401516
xor esi, esi
push 0x208
lea eax, [esp + 0x1e4]
push esi
push eax
call fcn.0040f6e0
add esp, 0xc
lea ecx, [esp + 0x1e0]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x208
lea edx, [esp + 0x5f4]
push esi
push edx
call fcn.0040f6e0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0040aeab
add esp, 4
lea eax, [esp + 0x5f0]
push eax
push 6
mov eax, 7
call fcn.00403210
lea ecx, [esp + 0x5f8]
push ecx
lea edx, [esp + 0x1ec]
push edx
mov eax, edx
push 0x41dc60
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
push esi
lea ecx, [esp + 0x1e4]
push ecx
lea edx, [esp + 0xa08]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 1
push esi
push 0x41dc20
lea eax, [esp + 0x1ec]
push eax
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [esp + 0x10]
push ecx
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 1
mov edi, 0x424f38
call fcn.0040ac30
add esp, 4
test eax, eax
jne 0x401709
push 0x3a
lea edx, [esp + 0x1aa]
push esi
push edx
mov word [esp + 0x1b0], si
call fcn.0040f6e0
add esp, 0xc
lea edi, [esp + 0x1a4]
call fcn.00401000
xor eax, eax
jmp 0x401650
movzx ecx, word [esp + eax + 0x1a4]
mov word [eax + 0x4250e0], cx
add eax, 2
cmp cx, si
jne 0x401650
push 0x41dc74
push 0x40
push 0x424f3c
call fcn.0040aeda
add esp, 0xc
push 0x41dc90
push 0x10
push 0x424fbe
mov word [0x424fbc], 0x51
call fcn.0040aeda
add esp, 0xc
push 0x41dc9c
push 0x40
push 0x424fde
call fcn.0040aeda
add esp, 0xc
mov word [0x42505e], 0x2b66
xor eax, eax
jmp 0x4016c0
movzx ecx, word [esp + eax + 0x1a4]
mov word [eax + 0x4250c0], cx
add eax, 2
cmp cx, si
jne 0x4016c0
mov eax, 0x4250c0
add eax, 0xfffffffe
nop
mov cx, word [eax + 2]
add eax, 2
cmp cx, si
jne 0x4016e0
mov ecx, dword [0x41dcb8]
mov dx, word [0x41dcbc]
mov dword [eax], ecx
mov word [eax + 4], dx
mov dword [0x425100], 5
call fcn.004019f0
mov eax, 0x425138
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
cmp cx, si
jne 0x401716
mov ecx, dword [0x41dc44]
mov edx, dword [0x41dc48]
mov dword [eax], ecx
mov ecx, dword [0x41dc4c]
mov dword [eax + 4], edx
mov edx, dword [0x41dc50]
mov dword [eax + 8], ecx
push 0x7d0
mov dword [eax + 0xc], edx
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x425138
push esi
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
cmp eax, esi
je 0x401770
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4017b0
push 0x425138
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
je 0x40176c
mov ecx, 0x4255d0
call fcn.004029b0
mov eax, dword [0x425104]
push esi
push esi
push esi
push 0x401930
push esi
push esi
mov dword [0x4255d8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x423648], eax
mov eax, 1
mov ecx, dword [esp + 0xc0c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040adf2
add esp, 0xc00
ret