Function at 0x40dee0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create thread
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x480df4
push eax
mov dword fs:[0], esp
sub esp, 0x2ec
push ebx
push ebp
xor ebx, ebx
push esi
push ebx
push 1
mov ebp, ecx
push 2
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [ebp + 0x20], eax
jne 0x40df1b
or eax, eax
jmp 0x40e1f8
mov ecx, dword [esp + 0x30c]
xor eax, eax
mov dword [esp + 0xc], eax
push ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
call sub.WSOCK32.dll_htons
mov word [esp + 0xe], ax
mov eax, dword [esp + 0x308]
mov word [esp + 0xc], 2
mov cl, byte [eax]
cmp cl, 0x30
jl 0x40df65
cmp cl, 0x39
jg 0x40df65
push eax
call sub.WSOCK32.dll_inet_addr
mov dword [esp + 0x10], eax
jmp 0x40df9b
push eax
call sub.WSOCK32.dll_gethostbyname
cmp eax, ebx
jne 0x40df7e
mov ecx, ebp
call fcn.0040e310
or eax, 0xffffffff
jmp 0x40e1f8
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
mov eax, ecx
push edi
lea edi, [esp + 0x14]
mov esi, dword [edx]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov ecx, dword [esp + 0x10]
push ecx
call sub.WSOCK32.dll_inet_ntoa
push eax
lea ecx, [ebp + 0x1c]
call fcn.004623ff
mov eax, dword [ebp + 0x20]
lea edx, [esp + 0xc]
push 0x10
push edx
push eax
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
jne 0x40dfd2
mov ecx, ebp
call fcn.0040e310
or eax, 0xffffffff
jmp 0x40e1f8
lea ecx, [esp + 0x20]
mov dword [ebp + 0x18], ebx
push ecx
push ebx
push ebx
push 0x40dec0
push ebx
push ebx
call dword [sym.imp.Kernel32.dll_CreateThread]
cmp eax, ebx
mov dword [ebp + 0x30], eax
jne 0x40dff8
or eax, 0xffffffff
jmp 0x40e1f8
push 0x10000
call fcn.00462947
mov esi, eax
add esp, 4
cmp esi, ebx
jne 0x40e013
or eax, 0xffffffff
jmp 0x40e1f8
push esi
lea edx, [esp + 0x28]
push 1
push edx
mov ecx, ebp
mov byte [esp + 0x30], 0x18
call fcn.0040e420
test eax, eax
je 0x40e043
push esi
call fcn.00462970
add esp, 4
mov ecx, ebp
call fcn.0040e310
or eax, 0xffffffff
jmp 0x40e1f8
lea ecx, [esp + 0x1c]
lea eax, [esi + 1]
push ecx
mov ecx, dword [0x4a956c]
mov dword [esp + 0x20], eax
call fcn.00410ac0
push esi
call fcn.00462970
mov edx, dword [0x4a956c]
push str.EVALUATION_VERSION
mov eax, dword [edx + 0x50]
push eax
call fcn.0043f04f
add esp, 0xc
test eax, eax
jne 0x40e1d8
push ebx
lea ecx, [esp + 0x50]
call fcn.00420a20
lea ecx, [esp + 0x4c]
mov dword [esp + 0x300], ebx
mov dword [esp + 0xb0], ebx
call fcn.00421340
mov eax, dword [esp + 0xb0]
cmp eax, ebx
jle 0x40e0d0
push eax
lea eax, [esp + 0x234]
push str.Cluster_software_will_expire__nafter__d_days.
push eax
call fcn.0043ef3e
add esp, 0xc
lea ecx, [esp + 0x230]
push ebx
push ebx
push ecx
call fcn.0046c37b
mov dword [0x4a5130], 1
mov ecx, dword [0x4aa20c]
call fcn.004219a0
lea ecx, [esp + 0x22c]
mov dword [esp + 0x300], 0xb
call fcn.00462276
lea ecx, [esp + 0x228]
mov byte [esp + 0x300], 0xa
call fcn.00462276
lea ecx, [esp + 0x220]
mov byte [esp + 0x300], 9
call fcn.00462276
lea ecx, [esp + 0x21c]
mov byte [esp + 0x300], 8
call fcn.00462276
lea ecx, [esp + 0x1e0]
mov byte [esp + 0x300], 7
call fcn.00474cc0
lea ecx, [esp + 0x1a4]
mov byte [esp + 0x300], 6
call fcn.00474cc0
lea ecx, [esp + 0x168]
mov byte [esp + 0x300], 5
call fcn.00474cc0
lea ecx, [esp + 0x12c]
mov byte [esp + 0x300], 4
call fcn.00474cc0
lea ecx, [esp + 0xf0]
mov byte [esp + 0x300], 3
call fcn.00474cc0
lea ecx, [esp + 0xb4]
mov byte [esp + 0x300], 2
call fcn.00474cc0
lea ecx, [esp + 0xac]
mov byte [esp + 0x300], 1
call fcn.00462276
lea ecx, [esp + 0x4c]
mov dword [esp + 0x300], 0xffffffff
call fcn.0045d5a0
mov dword [0x4a5130], ebx
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x28]
push 1
push eax
mov ecx, ebp
mov byte [esp + 0x30], 0xe
call fcn.0040e420
xor eax, eax
mov ecx, dword [esp + 0x2f8]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2f8
ret 8