Function at 0x409ee0
Capabilities:
Check mutex on windows
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x433feb
mov eax, dword fs:[0]
push eax
sub esp, 0x62c
mov eax, dword [0x449214]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 1
mov edi, dword [ebp + 0xc]
jle 0x40a175
lea ecx, [ebp - 0x4b1]
call fcn.00403980
lea ecx, [ebp - 0x4b1]
mov esi, eax
call fcn.00407430
push 0
push 0
push esi
call fcn.00405b10
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004199b0
add esp, 0x18
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.Loghost.log
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call fcn.00414200
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
lea eax, [ebp - 0x4c0]
mov dword [ebp - 0x4c0], 8
push eax
mov dword [ebp - 0x4bc], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0
mov ecx, 0x44acb8
call fcn.004059b0
push 0
lea eax, [ebp - 0x514]
mov dword [ebp - 0x514], 1
push eax
lea eax, [ebp - 0x4c4]
mov dword [ebp - 0x510], 0
push eax
mov dword [ebp - 0x50c], 0
mov dword [ebp - 0x508], 0
call sub.gdiplus.dll_GdiplusStartup
test eax, eax
jne 0x40a175
mov edx, dword [edi + 4]
mov ecx, edx
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x264], 0xf
mov byte [ebp - 0x278], al
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a043
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x278]
call fcn.00408ce0
lea ecx, [ebp - 0x320]
mov dword [ebp - 4], 0
call fcn.00402720
cmp dword [ebp - 0x264], 0x10
lea eax, [ebp - 0x278]
push 0
push dword [ebp - 0x268]
cmovae eax, dword [ebp - 0x278]
lea ecx, [ebp - 0x320]
push eax
mov byte [ebp - 4], 1
call fcn.00405450
push str.host_type
lea ecx, [ebp - 0x320]
call fcn.004058a0
test eax, eax
jne 0x40a0af
xor edx, edx
jmp 0x40a0b2
lea edx, [eax + 0x3a]
mov ecx, edx
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 0xf
mov byte [ebp - 0x260], 0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a0d2
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x260]
call fcn.00408ce0
push str.header
lea ecx, [ebp - 0x320]
mov byte [ebp - 4], 2
call fcn.004058a0
test eax, eax
je 0x40a154
add eax, 0x3a
je 0x40a154
cmp dword [eax], 0x10080
jne 0x40a154
cmp dword [ebp - 0x24c], 0x10
lea eax, [ebp - 0x260]
push 7
cmovae eax, dword [ebp - 0x260]
push str.pendant
push dword [ebp - 0x250]
push eax
call fcn.00401d90
add esp, 0x10
test al, al
je 0x40a196
sub esp, 0x68
lea eax, [ebp - 0x320]
mov ecx, esp
push eax
call fcn.004025d0
call fcn.00406ff0
add esp, 0x68
lea ecx, [ebp - 0x260]
call fcn.00403020
lea ecx, [ebp - 0x320]
call fcn.00403380
lea ecx, [ebp - 0x278]
call fcn.00403020
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00417c0e
mov esp, ebp
pop ebp
ret
call fcn.00413f00
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x40a275
push 0x50
push str.d:jenkins.jenkinsworkspace_bluewhale_hosthalosrvhost_srvhost_birdsrvhost.cpp
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], 0xf
mov byte [ebp - 0x248], al
call fcn.00408ce0
push 3
push 0x436f3c
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 3
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0xf
mov byte [ebp - 0x230], 0
call fcn.00408ce0
mov byte [ebp - 4], 4
call fcn.00413f00
mov edi, eax
lea ecx, [ebp - 0x5ac]
push 0x86
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.00402350
mov esi, eax
push str.Process_started.
push esi
mov byte [ebp - 4], 5
call fcn.004036d0
mov edx, dword [edi]
add esp, 8
mov ecx, edi
push esi
call dword [edx + 0x1c]
lea ecx, [ebp - 0x5ac]
call fcn.00403a60
lea ecx, [ebp - 0x230]
call fcn.00403020
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 2
call fcn.00403020
push 0x436f54
lea eax, [ebp - 0x2a8]
push eax
lea ecx, [ebp - 0x320]
call fcn.00405660
cmp dword [ebp - 0x294], 8
lea eax, [ebp - 0x2a8]
mov esi, dword [sym.imp.KERNEL32.dll_OpenMutexW]
cmovae eax, dword [ebp - 0x2a8]
push eax
push 0
push 0x100001
call esi
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [ebp - 0x4b1], 0
lea eax, [ebp - 0x4c0]
mov byte [ebp - 4], 7
push eax
call fcn.0041115d
lea eax, [ebp - 0x4c0]
mov dword [ebp - 0x504], eax
lea eax, [ebp - 0x4b1]
mov dword [ebp - 0x500], eax
lea eax, [ebp - 0x504]
push eax
push 0x401840
push 0x44ad50
call fcn.00411e45
add esp, 0x10
test eax, eax
je 0x40a7e1
lea eax, [ebp - 0x4c0]
mov byte [ebp - 4], 9
push eax
call fcn.00411197
mov ecx, dword [0x44ad4c]
add esp, 4
mov byte [ebp - 4], 6
call fcn.0040b500
lea eax, [ebp - 0x4b0]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x436f58
lea eax, [ebp - 0x290]
push eax
lea ecx, [ebp - 0x320]
call fcn.00405660
cmp dword [ebp - 0x27c], 8
lea eax, [ebp - 0x290]
mov byte [ebp - 4], 0xc
cmovae eax, dword [ebp - 0x290]
push eax
push 0
push 0x100001
call esi
mov dword [ebp - 0x4b8], eax
call fcn.00413f00
push 1
mov ecx, eax
mov edx, dword [eax]
mov edx, dword [edx + 8]
call edx
movzx ecx, al
sub ecx, 1
jne 0x40a457
push 0x50
mov dword [ebp - 0x220], ecx
mov byte [ebp - 0x230], cl
lea ecx, [ebp - 0x230]
push str.d:jenkins.jenkinsworkspace_bluewhale_hosthalosrvhost_srvhost_birdsrvhost.cpp
mov dword [ebp - 0x21c], 0xf
call fcn.00408ce0
push 3
push 0x436f3c
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0xf
mov byte [ebp - 0x248], 0
call fcn.00408ce0
mov byte [ebp - 4], 0xe
call fcn.00413f00
mov edi, eax
lea ecx, [ebp - 0x5ac]
push 0x95
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.00402350
mov esi, eax
push str.Process_connection_ready.
push esi
mov byte [ebp - 4], 0xf
call fcn.004013f0
mov edx, dword [edi]
add esp, 8
mov ecx, edi
push esi
call dword [edx + 0x1c]
lea ecx, [ebp - 0x5ac]
call fcn.00403a60
lea ecx, [ebp - 0x248]
call fcn.00403020
lea ecx, [ebp - 0x230]
call fcn.00403020
xorps xmm0, xmm0
mov dword [ebp - 0x4fc], 0x436ae0
movups xmmword [ebp - 0x4f8], xmm0
mov dword [ebp - 0x4e8], 0
mov dword [ebp - 0x4e4], 0
mov ebx, dword [0x44acf8]
add ebx, 0x10
mov byte [ebp - 4], 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [0x44acec]
mov edi, eax
push 4
mov ecx, dword [esi + 8]
inc ecx
push ecx
push dword [esi]
call fcn.0041c5e5
add esp, 0xc
test eax, eax
je 0x40a4f5
mov dword [esi], eax
mov eax, dword [esi + 8]
push 4
inc eax
push eax
push dword [esi + 4]
call fcn.0041c5e5
add esp, 0xc
test eax, eax
je 0x40a4f5
mov ecx, dword [esi + 8]
mov dword [esi + 4], eax
lea edx, [ecx*4]
mov ecx, dword [esi]
add ecx, edx
je 0x40a4e6
mov dword [ecx], edi
mov eax, dword [esi + 4]
add eax, edx
je 0x40a4f2
lea ecx, [ebp - 0x4fc]
mov dword [eax], ecx
inc dword [esi + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp - 0x4b8]
lea ecx, [ebp - 0x638]
call fcn.0040bed0
push dword [ebp - 0x4c4]
movaps xmm0, xmmword [0x436ff0]
lea eax, [ebp - 0x618]
push eax
push 0x449068
push 0x449028
push 0x44adb0
mov byte [ebp - 4], 0x11
movups xmmword [ebp - 0x2b8], xmm0
call fcn.004016a0
add esp, 0x14
movzx eax, ax
lea ecx, [ebp - 0x638]
push 0
push eax
push 0
push 0x40000
push 0xcf0000
push 0x435674
lea eax, [ebp - 0x2b8]
push eax
push 0
call fcn.00404f30
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
mov ebx, 1
xor esi, esi
nop dword [eax + eax]
test ebx, ebx
je 0x40a5b0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x4e0]
push eax
call edi
test eax, eax
jne 0x40a5b0
mov eax, dword [ebp - 0x4fc]
lea ecx, [ebp - 0x4fc]
push esi
call dword [eax + 4]
inc esi
test eax, eax
jne 0x40a584
xor ebx, ebx
push 0
push 0
push 0
lea eax, [ebp - 0x4e0]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
cmp eax, 0xffffffff
je 0x40a580
test eax, eax
je 0x40a646
lea eax, [ebp - 0x4e0]
push eax
mov eax, dword [ebp - 0x4fc]
lea ecx, [ebp - 0x4fc]
call dword [eax]
test eax, eax
jne 0x40a5ff
lea eax, [ebp - 0x4e0]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x4e0]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov eax, dword [ebp - 0x4dc]
cmp eax, 0x118
ja 0x40a61a
je 0x40a636
cmp eax, 0xf
je 0x40a636
cmp eax, 0xa0
jmp 0x40a61f
cmp eax, 0x200
je 0x40a636
mov ecx, 1
xor eax, eax
test ecx, ecx
mov ebx, ecx
cmove eax, esi
mov esi, eax
jmp 0x40a580
xor ecx, ecx
xor eax, eax
test ecx, ecx
cmove eax, esi
mov esi, eax
jmp 0x40a580
mov ecx, 0x44acb8
call fcn.00407300
push dword [ebp - 0x4c4]
call sub.gdiplus.dll_GdiplusShutdown
call fcn.00413f00
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x40a736
push 0x50
push str.d:jenkins.jenkinsworkspace_bluewhale_hosthalosrvhost_srvhost_birdsrvhost.cpp
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], 0xf
mov byte [ebp - 0x230], al
call fcn.00408ce0
push 3
push 0x436f3c
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0xf
mov byte [ebp - 0x248], 0
call fcn.00408ce0
mov byte [ebp - 4], 0x13
call fcn.00413f00
mov edi, eax
lea ecx, [ebp - 0x5ac]
push 0xa3
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.00402350
mov esi, eax
push str.Process_gone.
push esi
mov byte [ebp - 4], 0x14
call fcn.004013f0
mov edx, dword [edi]
add esp, 8
mov ecx, edi
push esi
call dword [edx + 0x1c]
lea ecx, [ebp - 0x5ac]
call fcn.00403a60
lea ecx, [ebp - 0x248]
call fcn.00403020
lea ecx, [ebp - 0x230]
call fcn.00403020
lea ecx, [ebp - 0x638]
call fcn.0040bfc0
mov eax, dword [ebp - 0x4ec]
test eax, eax
je 0x40a75e
push eax
call fcn.0041c5d5
add esp, 4
mov dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x4e8], 0
mov dword [ebp - 0x4e4], 0
test eax, eax
je 0x40a78f
push eax
call fcn.0041c5d5
add esp, 4
mov dword [ebp - 0x4f8], 0
lea ecx, [ebp - 0x290]
mov dword [ebp - 0x4f4], 0
mov dword [ebp - 0x4f0], 0
call fcn.00403070
lea ecx, [ebp - 0x2a8]
call fcn.00403070
lea ecx, [ebp - 0x260]
call fcn.00403020
lea ecx, [ebp - 0x320]
call fcn.00403380
lea ecx, [ebp - 0x278]
call fcn.00403020
xor eax, eax
jmp 0x40a17a
lea eax, [ebp - 0x4c0]
mov byte [ebp - 4], 0xa
push eax
call fcn.004111b8
add esp, 4
mov byte [ebp - 4], 8
test al, al
jne 0x40a801
call fcn.00411e83
sub esp, 8
lea eax, [ebp - 0x4c0]
mov ecx, esp
push eax
call fcn.00402b60
call fcn.004097e0
int3