Function at 0x401d60
Capabilities:
Create process on windows
Inspect load icon resource
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x57c
mov eax, dword [0x411ce4]
xor eax, esp
mov dword [esp + 0x578], eax
mov eax, dword [esp + 0x584]
cmp eax, 0x110
mov ecx, dword [esp + 0x588]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x58c]
push edi
mov edi, dword [esp + 0x59c]
ja 0x401fc6
je 0x401e96
add eax, 0xfffffffe
cmp eax, 0x16
ja case.0x401db8.3
movzx eax, byte [eax + 0x4025c4]
jmp dword [eax*4 + 0x4025ac]
cmp dword [esp + 0x598], 0
je 0x40258c
cmp dword [0x412ca8], 0
jne 0x40258c
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
mov dword [0x412ca8], 1
jmp 0x40258c
push 0x411d30
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
jmp 0x40258c
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je case.0x401db8.3
lea ecx, [esp + 0x34]
push ecx
push esi
call dword [sym.imp.USER32.dll_BeginPaint]
push 0
mov edi, eax
push edi
push 0x27
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0xb
call ebx
push 0xc
mov ebp, eax
call ebx
lea edx, [esp + 0x14]
push edx
push esi
mov ebx, eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [0x412ca4]
push eax
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x1c]
sub eax, ebx
add eax, 1
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x1c]
sub eax, ebp
add eax, 1
cdq
sub eax, edx
sar eax, 1
push eax
push edi
call dword [sym.imp.USER32.dll_DrawIcon]
lea ecx, [esp + 0x34]
push ecx
push esi
call dword [sym.imp.USER32.dll_EndPaint]
jmp 0x40258c
xor eax, eax
jmp 0x402591
lea edx, [esp + 0x10]
push edx
call fcn.00401080
add esp, 4
test eax, eax
jne 0x401eae
mov dword [0x411f1c], eax
jmp 0x401ec6
mov eax, dword [esp + 0x10]
push eax
call fcn.00401260
add esp, 4
neg eax
sbb eax, eax
neg eax
mov dword [0x411f1c], eax
mov ecx, dword [0x411f18]
push 0x6b
push ecx
mov dword [0x411f20], esi
call dword [sym.imp.USER32.dll_LoadIconA]
push str.Service_Control
push 0x411d48
mov dword [0x412ca4], eax
mov dword [0x411d30], 0x1e8
mov dword [0x411d38], 1
mov dword [0x411d40], 0x432
mov dword [0x411d3c], 7
mov dword [0x411d34], esi
mov dword [0x411d44], eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
push 0x411d30
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
mov edx, dword [0x412ca4]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push edx
push 1
push 0x80
push esi
call edi
mov eax, dword [0x412ca4]
push eax
push 0
push 0x80
push esi
call edi
mov edx, dword [0x411f18]
push 0x200
lea ecx, [esp + 0x18c]
push ecx
push 0x1f5
push edx
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esp + 0x188]
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextA]
push esi
call fcn.00401a90
mov dword [0x411d28], eax
call fcn.00401c60
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00401ad0
add esp, 8
test eax, eax
jne 0x40258c
push eax
push 0x64
push 0x272e
push esi
mov dword [0x411d2c], eax
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x40258c
cmp eax, 0x401
ja 0x40249f
je 0x40213d
sub eax, 0x111
je 0x402098
sub eax, 2
jne case.0x401db8.3
cmp ecx, 0x272e
jne 0x402059
mov eax, dword [0x411d2c]
mov edi, dword [sym.imp.USER32.dll_KillTimer]
add eax, 1
cmp eax, 0xa
mov dword [0x411d2c], eax
jle 0x40200f
push ecx
push esi
call edi
lea edx, [esp + 0x10]
push edx
call fcn.00401080
add esp, 4
test eax, eax
je 0x402032
mov eax, dword [esp + 0x10]
push eax
call fcn.00401260
add esp, 4
mov dword [0x411f1c], eax
call fcn.00401c60
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00401ad0
add esp, 4
test eax, eax
je 0x40258c
push 0x272e
push esi
call edi
jmp 0x40258c
cmp ecx, 0x272f
jne case.0x401db8.5
push edi
push 0x3e9
push 0x111
push esi
call fcn.00401d60
push edi
push 0x3e8
push 0x111
push esi
call fcn.00401d60
jmp 0x40258c
cmp ecx, 1
jne 0x40258c
push 0
jmp 0x402585
mov ebp, dword [esp + 0x598]
movzx eax, bp
cmp eax, 0x3e8
jg 0x40214b
je 0x40226f
sub eax, 2
je case.0x401db8.16
sub eax, 0x67
jne case.0x401db8.3
mov eax, dword [0x411f18]
push 0x100
lea edx, [esp + 0x8c]
push edx
push 0x1fa
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x104
push str.Confirm
lea ecx, [esp + 0x90]
push ecx
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x40258c
push 0x200
lea edx, [esp + 0x18c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.__stop
lea eax, [esp + 0x18c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
lea ecx, [esp + 0x18c]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push esi
call dword [sym.imp.USER32.dll_EndDialog]
jmp 0x40258c
cmp eax, 0x8003
jg 0x402395
je 0x40226f
sub eax, 0x3e9
je 0x402404
sub eax, 1
je 0x4023a5
sub eax, 1
jne case.0x401db8.3
lea edx, [esp + 0x188]
push edx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x50]
push eax
xor edi, edi
push 1
mov dword [esp + 0x48], 0xc44c
mov dword [esp + 0x54], 0xc8f8
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], edi
call fcn.00408fc0
movzx esi, ax
cmp si, di
jne 0x402230
mov ebx, 0xa
mov ecx, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x78]
push str.lp2___d_n
push edx
call fcn.00401b30
add esp, 0xc
cmp dword [esp + 0x10], ebx
je 0x40222b
lea eax, [esp + 0x188]
push eax
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x50]
push ecx
push 2
call fcn.00408fc0
movzx esi, ax
cmp si, di
je 0x4021d2
jmp 0x402230
cmp si, di
je 0x402260
cmp si, 4
je 0x402260
cmp si, 0x11
je 0x402251
cmp si, 3
je 0x402251
push 3
call fcn.00401890
add esp, 4
jmp 0x40258c
push 2
call fcn.00401890
add esp, 4
jmp 0x40258c
push 1
call fcn.00401890
add esp, 4
jmp 0x40258c
push 3
call fcn.00401b50
mov edx, dword [0x411f20]
add esp, 4
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
cmp dword [0x411f30], 0
jne 0x4022ed
push 0x200
lea eax, [esp + 0x18c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.__start
lea ecx, [esp + 0x18c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
lea edx, [esp + 0x18c]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
nop
push 0x3e8
add edi, 1
call ebx
call fcn.00401000
test eax, eax
mov dword [0x411f30], eax
jne 0x4022ed
cmp edi, 5
jl 0x4022d0
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov edi, dword [sym.imp.USER32.dll_SetCursor]
push eax
call edi
cmp dword [0x411f40], 0
mov ebx, eax
je 0x40231b
push str.start_tcp
call fcn.00401150
add esp, 4
cmp dword [0x412258], 0
je 0x402331
push str.start_ipx
call fcn.00401150
add esp, 4
cmp dword [0x412570], 0
je 0x402347
push str.start_netbios
call fcn.00401150
add esp, 4
lea eax, [esp + 0x14]
push eax
call fcn.00401080
add esp, 4
test eax, eax
je 0x40236a
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00401260
add esp, 4
mov dword [0x411f1c], eax
call fcn.00401c60
push ebx
call edi
cmp bp, 0x3e8
jne 0x40258c
push 0x3e9
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x40258c
sub eax, 0x8004
je 0x402404
sub eax, 1
jne case.0x401db8.3
mov eax, dword [0x411f18]
push 0x100
lea edx, [esp + 0x8c]
push edx
push 0x1f9
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x104
push str.Confirm
lea ecx, [esp + 0x90]
push ecx
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x40258c
push 0x200
lea edx, [esp + 0x18c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.__remove
jmp 0x40211f
push 3
call fcn.00401b50
mov edx, dword [0x411f20]
add esp, 4
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov edi, dword [sym.imp.USER32.dll_SetCursor]
push eax
call edi
push str.stop_tcp
mov ebx, eax
call fcn.00401150
push str.stop_ipx
call fcn.00401150
push str.stop_netbios
call fcn.00401150
lea eax, [esp + 0x20]
push eax
call fcn.00401080
add esp, 0x10
test eax, eax
je 0x402474
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00401260
add esp, 4
mov dword [0x411f1c], eax
call fcn.00401c60
push ebx
call edi
cmp bp, 0x3e9
jne 0x40258c
push 0x3e8
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x40258c
cmp eax, 0x432
jne case.0x401db8.3
sub edi, 0x203
je 0x40255f
sub edi, 2
jne 0x40258c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [0x411f18]
push 0x83
push eax
call dword [sym.imp.USER32.dll_LoadMenuA]
mov ebx, eax
push 0
push ebx
call dword [sym.imp.USER32.dll_GetSubMenu]
mov ebp, dword [sym.imp.USER32.dll_EnableMenuItem]
xor ecx, ecx
cmp dword [0x411f24], ecx
mov edi, eax
sete cl
push ecx
push 0x8003
push edi
call ebp
xor edx, edx
cmp dword [0x411f28], edx
sete dl
push edx
push 0x8004
push edi
call ebp
xor eax, eax
cmp dword [0x411f2c], eax
sete al
push eax
push 0x8005
push edi
call ebp
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push 0
push esi
push 0
push ecx
push edx
push 0xa
push edi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push 0
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
push ebx
call dword [sym.imp.USER32.dll_DestroyMenu]
jmp 0x40258c
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je case.0x401db8.16
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push esi
call edi
push 9
push esi
call edi
jmp 0x40258c
push 2
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
mov ecx, dword [esp + 0x588]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040c056
add esp, 0x57c
ret 0x10