Function at 0x404180
Capabilities:
Create tcp socket
Create thread
Create udp socket
Delete file
Read file on windows
Resolve dns
Terminate thread

Disassembly:
sub esp, 0x120
mov eax, dword [0x43d68c]
xor eax, esp
mov dword [esp + 0x11c], eax
push ebx
mov ebx, dword [esp + 0x134]
push ebp
mov ebp, dword [esp + 0x12c]
push esi
mov esi, dword [esp + 0x138]
push edi
push esi
push str.Setting_up__s...
push 0x44a8c0
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], ebx
call fcn.004124f2
mov eax, dword [0x44f9e0]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
add esp, 0xc
push 0x44a8c0
push 0
push 0x402
push eax
call edi
push esi
lea ecx, [esp + 0x2c]
push str._sADMIN_System32Dbgvsvc.exe
push ecx
call fcn.004124f2
lea edx, [esp + 0x34]
push edx
push str.RCDBGSVC
call fcn.0040a600
add esp, 0x14
test al, al
jne 0x404297
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
mov ebx, eax
mov eax, dword [0x44f9e0]
push 0x406
push eax
call edi
cmp ebx, 5
je 0x404236
cmp ebx, 0x3e7
jne 0x4042e8
mov ecx, dword [0x44ba00]
push esi
push 0x403af0
push ebp
push str.LOGIN
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
test eax, eax
je 0x4042e8
lea edx, [esp + 0x28]
push edx
push str.RCDBGSVC
call fcn.0040a600
add esp, 8
test al, al
je 0x4042e8
mov eax, dword [esp + 0x138]
mov ecx, dword [0x44f9e0]
imul eax, eax, 0x160
push 0
push 0
push 0x405
push ecx
mov byte [eax + 0x450134], 1
call edi
mov ebx, dword [esp + 0x10]
push esi
lea edx, [esp + 0x2c]
push str._sADMIN_System32Dbgv.sys
push edx
call fcn.004124f2
add esp, 0xc
cmp dword [0x44a8a8], 0
mov eax, str.RCDBGSYS64
jne 0x4042bd
mov eax, str.RCDBGSYS
lea ecx, [esp + 0x28]
push ecx
push eax
call fcn.0040a600
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 8
test al, al
jne 0x40432d
push ebx
call fcn.00401960
add esp, 4
mov edi, 3
jmp 0x4044fe
mov edx, dword [0x44f9e0]
push 0
push 0
push 0x405
push edx
call edi
mov eax, dword [esp + 0x10]
push eax
call fcn.00401960
mov eax, dword [esp + 0x13c]
mov ecx, eax
imul ecx, ecx, 0x160
push eax
mov byte [ecx + 0x450134], 1
call fcn.00403a80
add esp, 8
mov eax, 1
jmp 0x404562
push esi
push str.Starting_DebugView_on__s...
push 0x44a8c0
call fcn.004124f2
mov edx, dword [0x44f9e0]
add esp, 0xc
push 0x44a8c0
push 0
push 0x402
push edx
call edi
push esi
push 0
push 0x404010
call fcn.004134f2
add esp, 0xc
mov dword [0x4534f0], eax
mov eax, dword [0x452320]
push 0xafc8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x449074], 0
jne 0x4043c1
cmp eax, 0x102
jne 0x4043a1
mov ecx, dword [0x4534f0]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0x41d
jmp 0x4043a8
mov edx, dword [0x450000]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
call fcn.00401960
add esp, 4
mov edi, 5
jmp 0x4044fe
push esi
push str.Connecting_with__s...
push 0x44a8c0
call fcn.004124f2
mov eax, dword [0x44f9e0]
add esp, 0xc
push 0x44a8c0
push 0
push 0x402
push eax
call edi
push esi
call sub.WS2_32.dll_gethostbyname
mov edi, eax
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
movsx ecx, word [edi + 0xa]
mov edx, dword [edi + 0xc]
mov eax, dword [edx]
push ecx
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.004135b0
mov dx, word [edi + 8]
push esi
lea eax, [esp + 0x38]
push str._sADMIN_System32dbgview.ini
push eax
mov word [esp + 0x30], dx
call fcn.004124f2
lea ecx, [esp + 0x40]
push 0x434a9c
push ecx
call fcn.00413387
mov edi, eax
add esp, 0x20
test edi, edi
jne 0x404450
lea edi, [eax + 4]
jmp 0x4044dd
push edi
push 1
lea edx, [esp + 0x22]
push 2
push edx
call fcn.004132a6
push edi
call fcn.00412f6d
push esi
lea eax, [esp + 0x40]
push str._sADMIN_System32dbgview.ini
push eax
call fcn.004124f2
add esp, 0x20
lea ecx, [esp + 0x28]
push ecx
call ebp
mov ebx, dword [esp + 0x138]
imul ebx, ebx, 0x160
push 0
push 1
push 2
lea ebx, [ebx + 0x450130]
call sub.WS2_32.dll_socket
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x18]
mov dword [ebx], eax
mov eax, dword [esp + 0x138]
push edx
push eax
push ecx
call fcn.00404090
mov edi, eax
add esp, 0xc
test edi, edi
je 0x404560
mov edx, dword [ebx]
push edx
call sub.WS2_32.dll_closesocket
cmp edi, 2
je 0x4044dd
mov eax, dword [esp + 0x10]
push eax
call fcn.00401960
add esp, 4
mov ecx, dword [esp + 0x138]
imul ecx, ecx, 0x160
add ecx, 0x450028
push str.DBGVSVC
push ecx
call fcn.0040cf10
add esp, 8
push esi
lea edx, [esp + 0x2c]
push str._sADMIN_System32Dbgvsvc.exe
push edx
call fcn.004124f2
add esp, 0xc
lea eax, [esp + 0x28]
push eax
call ebp
push esi
lea ecx, [esp + 0x2c]
push str._sADMIN_System32Dbgv.sys
push ecx
call fcn.004124f2
add esp, 0xc
lea edx, [esp + 0x28]
push edx
call ebp
push esi
lea eax, [esp + 0x2c]
push str._sADMIN_System32dbgview.ini
push eax
call fcn.004124f2
add esp, 0xc
lea ecx, [esp + 0x28]
push ecx
call ebp
mov edx, dword [esp + 0x138]
push edx
call fcn.00403a80
add esp, 4
mov eax, edi
jmp 0x404562
xor eax, eax
mov ecx, dword [esp + 0x12c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004126a4
add esp, 0x120
ret