Function at 0x401900
Capabilities:
Check if file exists
Create thread
Get hostname
Initialize winsock library
Resolve dns
Terminate thread

Disassembly:
sub esp, 0x5e8
push ebx
push ebp
push esi
lea eax, [esp + 0x14]
push edi
lea ecx, [esp + 0x364]
push eax
push ecx
mov dword [esp + 0x20], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov ebp, dword [esp + 0x600]
lea edx, [esp + 0x364]
push ebp
push edx
call fcn.0040383a
add esp, 8
test eax, eax
jne 0x401a33
push str.Connecting_to_local_system...
push 0x40e858
mov byte [esp + 0x1c], 1
call fcn.004034a4
add esp, 8
lea eax, [esp + 0x468]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
lea ecx, [esp + 0x260]
push 0x104
push ecx
call sub.WS2_32.dll_gethostname
lea edx, [esp + 0x260]
push edx
call sub.WS2_32.dll_gethostbyname
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
mov edx, ecx
lea edi, [esp + 0x4c]
mov esi, dword [eax]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x4c]
push eax
call sub.WS2_32.dll_inet_ntoa
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x58]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x618]
mov ecx, dword [esp + 0x614]
mov edx, dword [esp + 0x610]
mov ebx, dword [esp + 0x60c]
mov edi, dword [esp + 0x608]
mov esi, dword [esp + 0x604]
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
mov edx, dword [esp + 0x608]
push ebx
push edi
push esi
lea ecx, [esp + 0x70]
push eax
push ecx
push ebp
push edx
call fcn.004016c0
add esp, 0x28
test al, al
jne 0x401b4e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5e8
ret
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x58]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
mov eax, ecx
mov esi, edi
mov edi, edx
push str.Connecting_to__s...
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x40e858
and ecx, 3
mov byte [esp + 0x20], 0
rep movsb byte es:[edi], byte [esi]
call fcn.004034a4
mov eax, dword [esp + 0x62c]
add esp, 0xc
cmp eax, 0xffffffff
je 0x4019d5
mov eax, dword [esp + 0x610]
mov cl, byte [esp + 0x5fc]
mov esi, dword [esp + 0x604]
mov edi, dword [esp + 0x608]
mov ebx, dword [esp + 0x60c]
mov dword [esp + 0x38], eax
push 0
lea eax, [esp + 0x20]
lea edx, [esp + 0x5c]
push 0
push eax
mov byte [esp + 0x28], cl
mov ecx, dword [esp + 0x620]
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x624]
push 0x4018c0
push 0
push 0
mov byte [esp + 0x5c], 0
mov dword [esp + 0x38], ebp
mov byte [esp + 0x40], 0
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], edi
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], edx
call fcn.00403a41
mov ecx, dword [esp + 0x638]
add esp, 0x18
mov dword [esp + 0x10], eax
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
shl ecx, 3
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x401b4e
mov edx, dword [esp + 0x10]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebp
push str._rTimeout_accessing__s._n
push 0x40e858
call fcn.004034a4
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5e8
ret
call fcn.00401440
mov al, byte [esp + 0x14]
test al, al
mov eax, str.local_system
jne 0x401b62
mov eax, ebp
push eax
push esi
push str._rStarting__s_service_on__s...
push 0x40e858
call fcn.004034a4
push ebx
lea eax, [esp + 0x170]
push str.__SystemRoot___s
push eax
call fcn.00403452
mov ecx, dword [esp + 0x638]
lea edx, [esp + 0x178]
push ecx
push edx
push edi
push esi
push ebp
call fcn.004012c0
add esp, 0x30
test eax, eax
jne 0x401c14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
call fcn.00401440
cmp dword [esp + 0x10], 2
jne 0x401c21
mov eax, dword [esp + 0x618]
mov ecx, dword [esp + 0x614]
mov edx, dword [esp + 0x610]
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
mov edx, dword [esp + 0x608]
push ebx
push edi
push esi
lea ecx, [esp + 0x70]
push eax
push ecx
push ebp
push edx
call fcn.004016c0
add esp, 0x28
test al, al
je 0x401c4f
mov eax, dword [esp + 0x61c]
lea ecx, [esp + 0x15c]
push eax
push ecx
push edi
push esi
push ebp
call fcn.004012c0
add esp, 0x14
test eax, eax
je 0x401ba5
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x5e8
ret
push ebp
push esi
push str._rCould_not_start__s_service_on__s:_n
push 0x40e858
call fcn.004034a4
mov edx, dword [esp + 0x20]
push edx
call fcn.004013b0
mov eax, dword [esp + 0x610]
push ebx
push edi
push ebp
push eax
call fcn.004015c0
add esp, 0x24
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x5e8
ret