Function at 0x4ea863
Capabilities:
Create thread
Hide graphical window
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fc
mov eax, dword [0x7286bc]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x1e8], 0
lea eax, [ebp - 0x1fc]
and dword [ebp - 0x1e4], 0
xorps xmm0, xmm0
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x1fc], 0x6858e0
mov ecx, dword [0x73df68]
push eax
mov dword [ebp - 0x1b4], ebx
movups xmmword [ebp - 0x1f8], xmm0
call fcn.005d4f6b
cmp byte [ebx + 0x198], 0
je 0x4eaba6
cmp dword [0x736914], 0
jne 0x4ea8f5
push 1
call fcn.00609934
mov esi, eax
mov eax, dword [0x736914]
pop ecx
cmp esi, eax
je 0x4ea8e8
push 1
push eax
call fcn.00609106
pop ecx
pop ecx
mov ecx, esi
mov dword [0x736914], esi
call fcn.004accc4
mov eax, dword [0x735fe4]
add eax, 0xfffffff0
push eax
call fcn.00418dea
mov edi, eax
xor ebx, ebx
and dword [ebp - 0x1a4], ebx
and dword [ebp - 0x1a0], ebx
pop ecx
mov dword [ebp - 0x1b8], edi
mov dword [ebp - 0x1a8], ebx
cmp dword [edi + 4], ebx
je 0x4ea9c3
push ecx
mov ecx, esp
push 0x68c4fc
call fcn.004177e7
push ecx
mov esi, esp
push edi
call fcn.00418dea
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x1c4]
pop ecx
push eax
call fcn.0051413f
add esp, 0xc
xor esi, esi
cmp dword [ebp - 0x1c0], ebx
jle 0x4ea9b3
push esi
lea ecx, [ebp - 0x1c4]
call fcn.0044c702
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00418dea
add eax, 0x10
pop ecx
mov dword [ebp - 0x198], eax
cmp dword [eax - 0xc], ebx
je 0x4ea99c
lea eax, [ebp - 0x198]
push eax
lea ecx, [ebp - 0x1a8]
call fcn.005131bf
mov eax, dword [ebp - 0x198]
lea ecx, [eax - 0x10]
call fcn.00419521
inc esi
cmp esi, dword [ebp - 0x1c0]
jl 0x4ea95e
mov ebx, dword [ebp - 0x1a8]
lea ecx, [ebp - 0x1c4]
call fcn.004e8a9c
jmp 0x4eaab9
push str.202.112.10.36
lea ecx, [ebp - 0x198]
call fcn.004177e7
lea eax, [ebp - 0x198]
push eax
lea ecx, [ebp - 0x1a8]
call fcn.00513170
mov ecx, dword [ebp - 0x198]
lea ecx, [ecx - 0x10]
call fcn.00419521
push str.202.112.29.82
lea ecx, [ebp - 0x198]
call fcn.004177e7
lea eax, [ebp - 0x198]
push eax
lea ecx, [ebp - 0x1a8]
call fcn.00513170
mov ecx, dword [ebp - 0x198]
lea ecx, [ecx - 0x10]
call fcn.00419521
push str.202.112.0.7
lea ecx, [ebp - 0x198]
call fcn.004177e7
lea eax, [ebp - 0x198]
push eax
lea ecx, [ebp - 0x1a8]
call fcn.00513170
mov ecx, dword [ebp - 0x198]
lea ecx, [ecx - 0x10]
call fcn.00419521
push str.202.108.6.95
lea ecx, [ebp - 0x198]
call fcn.004177e7
lea eax, [ebp - 0x198]
push eax
lea ecx, [ebp - 0x1a8]
call fcn.00513170
mov ecx, dword [ebp - 0x198]
lea ecx, [ecx - 0x10]
call fcn.00419521
push str.103.18.128.60
lea ecx, [ebp - 0x198]
call fcn.004177e7
lea eax, [ebp - 0x198]
push eax
lea ecx, [ebp - 0x1a8]
call fcn.00513170
mov ecx, dword [ebp - 0x198]
add ecx, 0xfffffff0
call fcn.00419521
mov ebx, dword [ebp - 0x1a8]
push 0x190
lea eax, [ebp - 0x194]
push 0
push eax
call fcn.0060b7a0
add esp, 0xc
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0
push str._Pcmaster_LunarCalendar
mov byte [ebp - 0x199], 0
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, dword [ebp - 0x1a4]
mov esi, eax
sub edi, ebx
mov dword [ebp - 0x1ac], esi
xor eax, eax
sar edi, 2
mov dword [ebp - 0x198], eax
test edi, edi
je 0x4eab71
mov eax, dword [ebx + eax*4]
push ecx
sub eax, 0x10
mov esi, esp
push eax
call fcn.00418dea
pop ecx
mov ecx, dword [ebp - 0x1b4]
add eax, 0x10
mov dword [esi], eax
call fcn.004e79cd
mov byte [ebp - 0x199], al
test al, al
jne 0x4eab57
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp eax, edi
jb 0x4eab14
mov esi, dword [ebp - 0x1ac]
jmp 0x4eab71
mov esi, dword [ebp - 0x1ac]
test esi, esi
je 0x4eab71
push 1
push 0
push 0x53d
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
call dword [sym.imp.WS2_32.dll_WSACleanup]
cmp byte [ebp - 0x199], 0
jne 0x4eab90
push 0
push 0
push 0x53d
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [ebp - 0x1a8]
call fcn.0050ee4e
mov ecx, dword [ebp - 0x1b8]
jmp 0x4eac90
push 1
call fcn.00609934
pop ecx
mov ecx, dword [0x736914]
mov esi, eax
cmp esi, ecx
je 0x4eabc4
push 1
push ecx
call fcn.00609106
pop ecx
pop ecx
mov ecx, ebx
mov dword [0x736914], esi
call fcn.004a0c15
push 0x4f8
call fcn.00609934
pop ecx
test eax, eax
je 0x4eabeb
mov ecx, eax
call fcn.00440372
mov esi, eax
jmp 0x4eabed
xor esi, esi
test esi, esi
je 0x4eac95
push 0
push SysReAllocString
mov ebx, 0x20e
mov edi, 0x3de
push ebx
push edi
push 0
push 0x88
push 0x84000000
push 0x69b3a4
push 0
mov ecx, esi
call fcn.005c122f
push 0x15
push ebx
push edi
mov eax, 0xffffd8f0
xor ebx, ebx
push eax
push eax
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push ebx
push 0x47a695
call fcn.006423a8
lea eax, [ebp - 0x1b0]
push 1
push eax
call fcn.00483010
mov eax, dword [ebp - 0x1b0]
push ebx
mov dword [str.node.dll], eax
call fcn.00514d8a
add esp, 0x18
lea ecx, [ebp - 0x1fc]
call fcn.005d5721
mov ecx, dword [0x73df68]
call fcn.005d56be
mov ecx, dword [ebp - 0x1b0]
lea ecx, [ecx - 0x10]
call fcn.00419521
lea ecx, [ebp - 0x1ec]
call fcn.0050e3e4
lea ecx, [ebp - 0x1f8]
call fcn.0050e3bb
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00609802
mov esp, ebp
pop ebp
ret 4