Function at 0x412cd5
Capabilities:
Create thread
Resolve dns
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x86c
mov dword [0x41e8c4], ecx
push ebx
push esi
push edi
jmp 0x412ea8
push 0xc
pop ecx
call fcn.00406fa7
mov esi, eax
test esi, esi
je 0x412d03
mov edi, esi
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
jmp 0x412d05
xor esi, esi
mov ebx, dword [ebp - 0x18]
imul eax, ebx, 0xc
lea edi, [eax + 0x41e8d0]
mov dword [ebp - 0x1c], edi
cmp dword [edi], ebx
jne 0x412e8c
cmp byte [edi + 4], 1
jne 0x412e72
push 0x802
lea eax, [ebp - 0x868]
push 0
push eax
call fcn.00401293
mov ebx, dword [ebp - 0x10]
lea edi, [ebp - 0x4c]
add esp, 0xc
xor eax, eax
and dword [ebp - 0xc], eax
and dword [ebp - 8], eax
push 8
pop ecx
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov al, byte [ebx + 3]
cmp al, 1
jne 0x412d85
push 0x802
lea eax, [ebp - 0x868]
push eax
lea esi, [ebx + 4]
push esi
push 2
call dword [sym.imp.WS2_32.dll_InetNtopW]
movzx edx, word [ebx + 8]
mov ecx, esi
call fcn.004130de
jmp 0x412e21
cmp al, 3
jne 0x412dfa
xorps xmm0, xmm0
mov dword [ebp - 0x48], 2
push 0x200
movlpd qword [ebp - 0x3c], xmm0
movlpd qword [ebp - 0x34], xmm0
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x40], 6
call fcn.00401000
movsx ecx, byte [ebx + 4]
mov esi, eax
push ecx
lea ecx, [ebx + 5]
push ecx
push esi
call fcn.0040126d
movsx ecx, byte [ebx + 4]
lea eax, [ebp - 0xc]
add esp, 0x10
mov byte [ecx + esi], 0
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push esi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x412e24
movsx eax, byte [ebx + 4]
movzx edx, word [eax + ebx + 5]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x18]
lea ecx, [ecx + 4]
jmp 0x412d7b
cmp al, 4
jne 0x412e24
push 0x802
lea eax, [ebp - 0x868]
push eax
lea esi, [ebx + 4]
push esi
push 0x17
call dword [sym.imp.WS2_32.dll_InetNtopW]
movzx edx, word [ebx + 8]
mov ecx, esi
call fcn.00413068
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
lea edx, [ebp - 0x2c]
mov word [ebp - 0x2c], 5
push 0xa
mov byte [ebp - 0x29], 1
call fcn.00412f38
mov eax, dword [ebp - 0x1c]
xor edx, edx
pop ecx
pop ecx
mov ecx, dword [ebp - 8]
mov esi, eax
imul edi, dword [eax], 0xc
mov dword [eax + 8], ecx
lea ecx, [ebp - 0x20]
push ecx
mov byte [eax + 4], 2
push edx
add edi, 0x41e8d0
mov dword [ebp - 0x20], edx
push eax
push 0x412ecc
push edx
movsd dword es:[edi], dword [esi]
push edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x412e84
mov ebx, dword [ebp - 0x10]
push 0
push dword [ebp - 0x14]
push ebx
push dword [edi + 8]
call dword [sym.imp.WS2_32.dll_send]
push ebx
call fcn.00401014
jmp 0x412ea7
push ebx
push 2
lea edx, [ebp - 4]
mov word [ebp - 4], 5
call fcn.00412f38
mov byte [esi + 4], 1
mov dword [esi], ebx
movsd dword es:[edi], dword [esi]
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop ecx
lea eax, [ebp - 0x60]
push eax
call fcn.00412f8a
cmp byte [0x41e695], 0
lea edi, [ebp - 0x18]
mov esi, eax
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jne 0x412cec
pop edi
pop esi
pop ebx
leave
ret