Function at 0x401d20
Capabilities:
Create process on windows
Inspect load icon resource
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x57c
mov eax, dword [0x427da0]
xor eax, esp
mov dword [esp + 0x578], eax
mov eax, dword [esp + 0x584]
cmp eax, 0x110
mov ecx, dword [esp + 0x588]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x58c]
push edi
mov edi, dword [esp + 0x59c]
ja 0x401f86
je 0x401e56
add eax, 0xfffffffe
cmp eax, 0x16
ja case.0x401d78.3
movzx eax, byte [eax + 0x402570]
jmp dword [eax*4 + 0x402558]
cmp dword [esp + 0x598], 0
je 0x402538
cmp dword [0x42a148], 0
jne 0x402538
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
mov dword [0x42a148], 1
jmp 0x402538
push 0x4291d0
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
jmp 0x402538
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je case.0x401d78.3
lea ecx, [esp + 0x34]
push ecx
push esi
call dword [sym.imp.USER32.dll_BeginPaint]
push 0
mov edi, eax
push edi
push 0x27
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0xb
call ebx
push 0xc
mov ebp, eax
call ebx
lea edx, [esp + 0x14]
push edx
push esi
mov ebx, eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [0x42a144]
push eax
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x1c]
sub eax, ebx
add eax, 1
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x1c]
sub eax, ebp
add eax, 1
cdq
sub eax, edx
sar eax, 1
push eax
push edi
call dword [sym.imp.USER32.dll_DrawIcon]
lea ecx, [esp + 0x34]
push ecx
push esi
call dword [sym.imp.USER32.dll_EndPaint]
jmp 0x402538
xor eax, eax
jmp 0x40253d
lea edx, [esp + 0x10]
push edx
call fcn.00401080
add esp, 4
test eax, eax
jne 0x401e6e
mov dword [0x4293bc], eax
jmp 0x401e86
mov eax, dword [esp + 0x10]
push eax
call fcn.00401260
add esp, 4
neg eax
sbb eax, eax
neg eax
mov dword [0x4293bc], eax
mov ecx, dword [0x4293b8]
push 0x6b
push ecx
mov dword [0x4293c0], esi
call dword [sym.imp.USER32.dll_LoadIconA]
push str.Service_Control
push 0x4291e8
mov dword [0x42a144], eax
mov dword [0x4291d0], 0x1e8
mov dword [0x4291d8], 1
mov dword [0x4291e0], 0x432
mov dword [0x4291dc], 7
mov dword [0x4291d4], esi
mov dword [0x4291e4], eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
push 0x4291d0
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
mov edx, dword [0x42a144]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push edx
push 1
push 0x80
push esi
call edi
mov eax, dword [0x42a144]
push eax
push 0
push 0x80
push esi
call edi
mov edx, dword [0x4293b8]
push 0x200
lea ecx, [esp + 0x18c]
push ecx
push 0x1f5
push edx
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esp + 0x188]
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextA]
push esi
call fcn.00401a90
mov dword [0x4291c8], eax
call fcn.00401c20
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00401ad0
add esp, 8
test eax, eax
jne 0x402538
push eax
push 0x64
push 0x272e
push esi
mov dword [0x4291cc], eax
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x402538
cmp eax, 0x401
ja 0x40244b
je 0x4020fd
sub eax, 0x111
je 0x402058
sub eax, 2
jne case.0x401d78.3
cmp ecx, 0x272e
jne 0x402019
mov eax, dword [0x4291cc]
mov edi, dword [sym.imp.USER32.dll_KillTimer]
add eax, 1
cmp eax, 0xa
mov dword [0x4291cc], eax
jle 0x401fcf
push ecx
push esi
call edi
lea edx, [esp + 0x10]
push edx
call fcn.00401080
add esp, 4
test eax, eax
je 0x401ff2
mov eax, dword [esp + 0x10]
push eax
call fcn.00401260
add esp, 4
mov dword [0x4293bc], eax
call fcn.00401c20
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00401ad0
add esp, 4
test eax, eax
je 0x402538
push 0x272e
push esi
call edi
jmp 0x402538
cmp ecx, 0x272f
jne case.0x401d78.5
push edi
push 0x3e9
push 0x111
push esi
call fcn.00401d20
push edi
push 0x3e8
push 0x111
push esi
call fcn.00401d20
jmp 0x402538
cmp ecx, 1
jne 0x402538
push 0
jmp 0x402531
mov ebp, dword [esp + 0x598]
movzx eax, bp
cmp eax, 0x3e8
jg 0x40210b
je 0x40222f
sub eax, 2
je case.0x401d78.16
sub eax, 0x67
jne case.0x401d78.3
mov eax, dword [0x4293b8]
push 0x100
lea edx, [esp + 0x8c]
push edx
push 0x1fa
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x104
push 0x421610
lea ecx, [esp + 0x90]
push ecx
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x402538
push 0x200
lea edx, [esp + 0x18c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.__stop
lea eax, [esp + 0x18c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
lea ecx, [esp + 0x18c]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push esi
call dword [sym.imp.USER32.dll_EndDialog]
jmp 0x402538
cmp eax, 0x8003
jg 0x402355
je 0x40222f
sub eax, 0x3e9
je 0x4023c4
sub eax, 1
je 0x402365
sub eax, 1
jne case.0x401d78.3
lea edx, [esp + 0x188]
push edx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x50]
push eax
xor edi, edi
push 1
mov dword [esp + 0x48], 0xc44c
mov dword [esp + 0x54], 0xc8f8
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], edi
call sym.nrSvr.exe__Rockey_36
movzx esi, ax
cmp si, di
jne 0x4021f0
mov ebx, 0xa
mov ecx, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x78]
push str.lp2___d_n
push edx
call fcn.0040fdff
add esp, 0xc
cmp dword [esp + 0x10], ebx
je 0x4021eb
lea eax, [esp + 0x188]
push eax
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x50]
push ecx
push 2
call sym.nrSvr.exe__Rockey_36
movzx esi, ax
cmp si, di
je 0x402192
jmp 0x4021f0
cmp si, di
je 0x402220
cmp si, 4
je 0x402220
cmp si, 0x11
je 0x402211
cmp si, 3
je 0x402211
push 3
call fcn.00401890
add esp, 4
jmp 0x402538
push 2
call fcn.00401890
add esp, 4
jmp 0x402538
push 1
call fcn.00401890
add esp, 4
jmp 0x402538
push 3
call fcn.00401b10
mov edx, dword [0x4293c0]
add esp, 4
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
cmp dword [0x4293d0], 0
jne 0x4022ad
push 0x200
lea eax, [esp + 0x18c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.__start
lea ecx, [esp + 0x18c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
lea edx, [esp + 0x18c]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
nop
push 0x3e8
add edi, 1
call ebx
call fcn.00401000
test eax, eax
mov dword [0x4293d0], eax
jne 0x4022ad
cmp edi, 5
jl 0x402290
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov edi, dword [sym.imp.USER32.dll_SetCursor]
push eax
call edi
cmp dword [0x4293e0], 0
mov ebx, eax
je 0x4022db
push str.start_tcp
call fcn.00401150
add esp, 4
cmp dword [0x4296f8], 0
je 0x4022f1
push str.start_ipx
call fcn.00401150
add esp, 4
cmp dword [0x429a10], 0
je 0x402307
push str.start_netbios
call fcn.00401150
add esp, 4
lea eax, [esp + 0x14]
push eax
call fcn.00401080
add esp, 4
test eax, eax
je 0x40232a
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00401260
add esp, 4
mov dword [0x4293bc], eax
call fcn.00401c20
push ebx
call edi
cmp bp, 0x3e8
jne 0x402538
push 0x3e9
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x402538
sub eax, 0x8004
je 0x4023c4
sub eax, 1
jne case.0x401d78.3
mov eax, dword [0x4293b8]
push 0x100
lea edx, [esp + 0x8c]
push edx
push 0x1f9
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x104
push 0x421610
lea ecx, [esp + 0x90]
push ecx
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x402538
push 0x200
lea edx, [esp + 0x18c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.__remove
jmp 0x4020df
push 3
call fcn.00401b10
mov edx, dword [0x4293c0]
add esp, 4
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov edi, dword [sym.imp.USER32.dll_SetCursor]
push eax
call edi
push str.stop_tcp
mov ebx, eax
call fcn.00401150
lea eax, [esp + 0x18]
push eax
call fcn.00401080
add esp, 8
test eax, eax
je 0x402420
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00401260
add esp, 4
mov dword [0x4293bc], eax
call fcn.00401c20
push ebx
call edi
cmp bp, 0x3e9
jne 0x402538
push 0x3e8
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x402538
cmp eax, 0x432
jne case.0x401d78.3
sub edi, 0x203
je 0x40250b
sub edi, 2
jne 0x402538
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [0x4293b8]
push 0x83
push eax
call dword [sym.imp.USER32.dll_LoadMenuA]
mov ebx, eax
push 0
push ebx
call dword [sym.imp.USER32.dll_GetSubMenu]
mov ebp, dword [sym.imp.USER32.dll_EnableMenuItem]
xor ecx, ecx
cmp dword [0x4293c4], ecx
mov edi, eax
sete cl
push ecx
push 0x8003
push edi
call ebp
xor edx, edx
cmp dword [0x4293c8], edx
sete dl
push edx
push 0x8004
push edi
call ebp
xor eax, eax
cmp dword [0x4293cc], eax
sete al
push eax
push 0x8005
push edi
call ebp
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push 0
push esi
push 0
push ecx
push edx
push 0xa
push edi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push 0
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
push ebx
call dword [sym.imp.USER32.dll_DestroyMenu]
jmp 0x402538
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je case.0x401d78.16
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push esi
call edi
push 9
push esi
call edi
jmp 0x402538
push 2
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
mov ecx, dword [esp + 0x588]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040fac6
add esp, 0x57c
ret 0x10