Function at 0x41e370
Capabilities:
Create thread
Get hostname
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x455028
mov eax, dword fs:[0]
push eax
sub esp, 0x2ac
mov eax, dword [0x4668f0]
xor eax, esp
mov dword [esp + 0x2a8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4668f0]
xor eax, esp
push eax
lea eax, [esp + 0x2c0]
mov dword fs:[0], eax
xor ebx, ebx
cmp byte [0x468e4b], bl
jne 0x41e882
mov eax, dword [0x467bb0]
push 0x45c7e4
lea edi, [ebx + 3]
mov ecx, 0x467b9c
mov byte [0x468e4b], 1
mov dword [0x468df4], ebx
call fcn.00430060
test eax, eax
je 0x41e3e6
call fcn.00408e30
push 0x7f
lea eax, [esp + 0x241]
push ebx
push eax
mov byte [esp + 0x248], bl
call fcn.00438230
add esp, 0xc
lea ecx, [esp + 0xac]
push ecx
push 0x202
call sub.WS2_32.dll_WSAStartup
push 0x80
lea edx, [esp + 0x240]
push edx
call sub.WS2_32.dll_gethostname
call sub.WS2_32.dll_WSACleanup
mov edi, 0xf
lea eax, [esp + 0x23c]
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x41e444
sub eax, edx
push eax
lea eax, [esp + 0x240]
push eax
lea ecx, [esp + 0x28]
call fcn.0042d2b0
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x28]
push ecx
mov ecx, 0x467950
mov dword [esp + 0x2d4], ebx
call fcn.0042bf10
mov ebp, 0x10
mov dword [esp + 0x2c8], 0xffffffff
cmp dword [esp + 0x38], ebp
jb 0x41e49b
mov edx, dword [esp + 0x24]
push edx
call fcn.00434321
add esp, 4
push 0x45c640
call fcn.0043755c
mov esi, eax
mov ecx, esi
mov dword [esp + 0x3c], edi
add esp, 4
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
lea edi, [ecx + 1]
jmp 0x41e4c0
mov al, byte [ecx]
inc ecx
cmp al, bl
jne 0x41e4c0
sub ecx, edi
push ecx
push esi
lea ecx, [esp + 0x28]
call fcn.0042d2b0
lea eax, [esp + 0x20]
push eax
mov edi, 0x45bb08
lea esi, [esp + 0x40]
mov dword [esp + 0x2cc], 1
call fcn.0042f240
add esp, 4
push eax
mov edi, str.ds_arj
lea esi, [esp + 0x5c]
mov byte [esp + 0x2cc], 2
call fcn.0042f240
add esp, 4
push eax
mov edi, 0x45bb08
lea esi, [esp + 0x94]
mov byte [esp + 0x2cc], 3
call fcn.0042f240
add esp, 4
push 0xffffffffffffffff
push ebx
push eax
mov ecx, 0x467988
mov byte [esp + 0x2d4], 4
call fcn.0042bf10
cmp dword [esp + 0xa8], ebp
jb 0x41e55b
mov ecx, dword [esp + 0x94]
push ecx
call fcn.00434321
add esp, 4
mov esi, 0xf
mov dword [esp + 0xa8], esi
mov dword [esp + 0xa4], ebx
mov byte [esp + 0x94], bl
cmp dword [esp + 0x70], ebp
jb 0x41e588
mov edx, dword [esp + 0x5c]
push edx
call fcn.00434321
add esp, 4
mov dword [esp + 0x70], esi
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x5c], bl
cmp dword [esp + 0x54], ebp
jb 0x41e5a7
mov eax, dword [esp + 0x40]
push eax
call fcn.00434321
add esp, 4
mov dword [esp + 0x2c8], 0xffffffff
mov dword [esp + 0x54], esi
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
cmp dword [esp + 0x38], ebp
jb 0x41e5d1
mov ecx, dword [esp + 0x24]
push ecx
call fcn.00434321
add esp, 4
mov eax, dword [0x46798c]
cmp dword [0x4679a0], ebp
jae 0x41e5e3
mov eax, 0x46798c
push eax
call fcn.00435dfd
add esp, 4
lea edi, [esp + 0x3c]
call fcn.00409e20
push ebx
push eax
or eax, 0xffffffff
mov esi, 0x467988
mov dword [esp + 0x2d0], 5
call fcn.0042d1c0
mov dword [esp + 0x2c8], 0xffffffff
cmp dword [esp + 0x54], ebp
jb 0x41e62d
mov edx, dword [esp + 0x40]
push edx
call fcn.00434321
add esp, 4
mov eax, dword [0x46798c]
cmp dword [0x4679a0], ebp
jae 0x41e63f
mov eax, 0x46798c
push eax
call fcn.00435dfd
add esp, 4
push 0x467988
mov edi, str.pwrlg4.tmp
lea esi, [esp + 0x40]
call fcn.0042f240
add esp, 4
push 0xffffffffffffffff
push ebx
push eax
mov ecx, 0x4679dc
mov dword [esp + 0x2d4], 6
call fcn.0042bf10
mov dword [esp + 0x2c8], 0xffffffff
cmp dword [esp + 0x54], ebp
jb 0x41e695
mov eax, dword [esp + 0x40]
push eax
call fcn.00434321
add esp, 4
cmp dword [0x4679f4], ebp
jb 0x41e6ab
mov ecx, dword [0x4679e0]
mov dword [0x468dc8], ecx
jmp 0x41e6b5
mov dword [0x468dc8], 0x4679e0
push 0x467988
mov edi, str._flg4.tmp
lea esi, [esp + 0x78]
mov dword [0x468dc0], ebx
call fcn.0042f240
add esp, 4
push 0xffffffffffffffff
push ebx
push eax
mov ecx, 0x4679f8
mov dword [esp + 0x2d4], 7
call fcn.0042bf10
mov dword [esp + 0x2c8], 0xffffffff
cmp dword [esp + 0x8c], ebp
jb 0x41e70b
mov edx, dword [esp + 0x78]
push edx
call fcn.00434321
add esp, 4
mov eax, dword [0x467bcc]
mov esi, 0xa
push 0x45c7e4
lea edi, [esi - 7]
mov ecx, 0x467bb8
mov dword [esp + 0x90], 0xf
mov dword [esp + 0x8c], ebx
mov byte [esp + 0x7c], bl
mov dword [0x468dac], ebx
mov dword [0x468db8], ebx
mov dword [esp + 0x1c], esi
call fcn.00430060
mov ebp, dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x41e770
lea eax, [esp + 0x1c]
push eax
push ebx
lea ecx, [esp + 0x20]
push ecx
push 0x41dcc0
push ebx
push ebx
call ebp
mov dword [0x468ddc], eax
mov eax, dword [0x467be8]
push 0x45c7e4
mov ecx, 0x467bd4
mov dword [esp + 0x1c], esi
call fcn.00430060
test eax, eax
je 0x41e7a0
lea edx, [esp + 0x1c]
push edx
push ebx
lea eax, [esp + 0x20]
push eax
push 0x41cf10
push ebx
push ebx
call ebp
mov eax, dword [0x467c3c]
push 0x45c7e4
mov ecx, 0x467c28
mov dword [esp + 0x1c], esi
call fcn.00430060
test eax, eax
je 0x41e7d0
lea ecx, [esp + 0x1c]
push ecx
push ebx
lea edx, [esp + 0x20]
push edx
push 0x41c670
push ebx
push ebx
call ebp
mov eax, dword [0x467c20]
push 0x45c7e4
mov ecx, 0x467c0c
mov dword [esp + 0x1c], esi
call fcn.00430060
test eax, eax
je 0x41e81d
mov eax, dword [0x467c20]
push 0x45c804
mov edi, 2
mov ecx, 0x467c0c
call fcn.00430060
test eax, eax
jne 0x41e81d
lea eax, [esp + 0x1c]
push eax
push ebx
lea ecx, [esp + 0x20]
push ecx
push 0x419490
push ebx
push ebx
call ebp
mov eax, dword [0x467c04]
push 0x45c7e4
mov edi, 3
mov ecx, 0x467bf0
mov dword [esp + 0x1c], esi
call fcn.00430060
test eax, eax
je 0x41e852
lea edx, [esp + 0x1c]
push edx
push ebx
lea eax, [esp + 0x20]
push eax
push 0x419950
push ebx
push ebx
call ebp
mov eax, dword [0x467bcc]
push 0x45c7e4
mov ecx, 0x467bb8
mov dword [esp + 0x1c], esi
call fcn.00430060
test eax, eax
je 0x41e882
lea ecx, [esp + 0x1c]
push ecx
push ebx
lea edx, [esp + 0x20]
push edx
push 0x41bfa0
push ebx
push ebx
call ebp
mov ecx, dword [esp + 0x2c0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2a8]
xor ecx, esp
call fcn.0043432c
add esp, 0x2b8
ret