Function at 0x40ad90
Capabilities:
Create thread
Encode data using xor
Reference cloudflare dns server

Disassembly:
sub esp, 0x644
push ebx
push ebp
push esi
push edi
call fcn.00404bc0
test al, al
jne 0x40adcb
mov ecx, dword [0x41bc48]
mov eax, 1
cmp ecx, eax
jle case.0x40ae48.8
pop edi
pop esi
pop ebp
mov dword [0x41bc48], eax
mov dword [0x41b624], eax
pop ebx
add esp, 0x644
ret
mov eax, dword [0x41bc4c]
test eax, eax
je 0x40adef
mov eax, dword [esp + 0x658]
push eax
call fcn.00407410
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x644
ret
mov ecx, dword [0x41b553]
mov eax, dword [0x41b55b]
mov edx, dword [0x41b557]
mov dword [esp + 0x14], ecx
mov ecx, dword [0x41b55f]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x18], edx
mov byte [esp + 0x24], 0
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x658]
not ecx
and eax, 0xff
dec ecx
cmp eax, 0xe
mov ebx, ecx
ja case.0x40ae48.8
xor edx, edx
mov dl, byte [eax + 0x40b8ec]
jmp dword [edx*4 + 0x40b8c8]
mov eax, dword [0x41b504]
mov ebx, 1
cmp eax, ebx
jne 0x40ae7e
test dword [0x41bc38], 0x800000
jne 0x40ae7e
push 0
push 6
call fcn.004036d0
add esp, 4
push eax
call fcn.004038a0
add esp, 8
mov edx, dword [0x41b594]
cmp edx, 0x1010101
jne 0x40af3f
mov eax, dword [0x417cc8]
test eax, eax
je 0x40aee3
push 0x417cc8
mov byte [0x41b278], 0
call fcn.00403ed0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, dword [0x417cc8]
mov eax, ecx
mov esi, edi
mov edi, 0x41b610
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp edx, 0x1010101
rep movsb byte es:[edi], byte [esi]
mov dword [0x41b594], edx
jne 0x40af3f
mov edi, 0x412030
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40af3f
mov eax, dword [0x41bc38]
test ah, 1
je 0x40af3f
mov edi, 0x412030
or ecx, 0xffffffff
xor eax, eax
push 0x41b610
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [0x41b278], 0
mov edx, ecx
mov esi, edi
mov edi, 0x41b610
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00406600
mov edx, eax
add esp, 4
mov dword [0x41b594], edx
cmp dword [0x41b504], ebx
jne 0x40afbc
push 3
call fcn.00403520
add esp, 4
test eax, eax
jne 0x40afb6
cmp dword [0x41bc1c], ebx
jne 0x40af6d
call fcn.00401540
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x644
ret
cmp dword [0x41bce8], ebx
jne 0x40afa6
push 0
push 9
mov dword [0x41bc48], ebx
mov dword [0x41b624], ebx
call fcn.004036d0
add esp, 4
push eax
call fcn.004038a0
add esp, 8
call fcn.00409270
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x644
ret
call fcn.004091f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x644
ret
mov edx, dword [0x41b594]
mov ecx, 0x32
xor eax, eax
mov edi, 0x41ad98
mov byte [esp + 0x14], 1
rep stosd dword es:[edi], eax
mov al, byte [0x412060]
mov cx, word [0x41bc98]
mov byte [esp + 0x15], al
xor eax, eax
mov dword [esp + 0x18], eax
cmp edx, 0x1010101
mov dword [esp + 0x1c], eax
mov word [esp + 0x16], cx
mov dword [esp + 0x20], eax
mov byte [esp + 0x18], 3
mov dword [esp + 0x24], eax
jne 0x40b054
test dword [0x41bc38], 0x2000000
je 0x40b054
lea ecx, [esp + 0x14]
push 0x14
push ecx
push str.210.42.255.58
call fcn.00406600
add esp, 4
push eax
call fcn.00401d70
add esp, 0xc
lea edx, [esp + 0x14]
push 0x14
push edx
push str.210.42.255.59
call fcn.00406600
add esp, 4
push eax
call fcn.00401d70
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x644
ret
lea eax, [esp + 0x14]
push 0x14
push eax
push edx
call fcn.00401d70
mov eax, dword [0x41b594]
add esp, 0xc
cmp eax, 0x1010101
jne case.0x40ae48.8
lea ecx, [esp + 0x14]
push 0x14
push ecx
push 0x10101ca
call fcn.00401d70
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x644
ret
mov byte [esp + 0x14], 6
jmp 0x40b0c7
mov eax, dword [0x41bc38]
mov byte [esp + 0x14], 3
test eax, 0x800000
jne 0x40b0c7
push 0
push 7
call fcn.004036d0
add esp, 4
push eax
call fcn.004038a0
add esp, 8
jmp 0x40b0c7
mov byte [esp + 0x14], 8
mov edx, dword [0x41b4bc]
mov ecx, ebx
mov eax, ecx
mov esi, 0x41b553
lea edi, [esp + 0x1a]
mov byte [esp + 0x15], 1
shr ecx, 2
mov dword [esp + 0x16], edx
lea edx, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebx + 6]
push ecx
push edx
call fcn.00404b60
mov eax, dword [0x417d90]
mov ecx, dword [0x417d94]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov dword [0x41b29d], eax
mov dword [0x41b2a1], ecx
mov edi, 0x41b538
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov esi, dword [0x417d9c]
mov edx, dword [0x417d98]
not ecx
dec ecx
mov dword [esp + 0x24], esi
mov eax, ecx
mov dword [0x41b2a9], esi
mov esi, 0x41b538
lea edi, [esp + 0x28]
shr ecx, 2
mov dword [esp + 0x20], edx
mov dword [0x41b2a5], edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x41b538
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + 0x16], 0
mov edx, ecx
mov ecx, 0x40
add edx, 0x14
sub ecx, edx
mov byte [esp + 0x17], dl
lea edi, [esp + edx + 0x14]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov al, byte [0x41b2e1]
mov byte [esp + 0x4c], al
call fcn.00406120
mov ecx, dword [eax]
mov dword [esp + 0x4d], ecx
mov dx, word [eax + 4]
mov word [esp + 0x51], dx
mov al, byte [eax + 6]
mov byte [esp + 0x53], al
xor eax, eax
mov cl, byte [esp + eax + 0x18]
mov dl, byte [esp + eax + 0x4e]
xor dl, cl
mov byte [esp + eax + 0x4e], dl
inc eax
cmp eax, 6
jl 0x40b1c0
mov al, byte [esp + 0x658]
cmp al, 1
jne 0x40b52d
mov ecx, ebx
mov esi, 0x41b553
mov edx, ecx
lea edi, [esp + 0x55]
shr ecx, 2
mov byte [esp + 0x54], al
mov eax, dword [0x41b4bc]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebx + 9]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
mov dword [esp + ebx + 0x59], eax
lea ecx, [esp + ebx + 0x5d]
lea eax, [esp + 0x58]
push eax
mov dword [ecx], 0
call fcn.00404b60
mov ecx, dword [0x417d90]
mov edx, dword [0x417d94]
mov eax, dword [0x417d98]
mov dword [esp + 0x5c], ecx
mov ecx, dword [0x417d9c]
push 0
mov dword [esp + 0x64], edx
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], ecx
call fcn.00403520
mov edx, dword [0x4194b4]
mov ecx, dword [0x4194bc]
mov byte [esp + 0x70], al
mov eax, dword [0x4194b8]
mov dword [esp + 0x75], eax
mov dword [esp + 0x71], edx
mov edx, dword [0x4194c0]
lea eax, [esp + 0x20]
push 0x65
push eax
mov dword [esp + 0x81], ecx
mov dword [esp + 0x85], edx
mov byte [esp + 0x89], 0x14
mov byte [esp + 0x8a], 0
mov byte [esp + 0x8b], 7
mov byte [esp + 0x8c], 0xb
call fcn.00404b60
mov eax, dword [0x41bc80]
mov ecx, dword [0x417d90]
mov edx, dword [0x417d94]
add esp, 0x14
test eax, eax
mov dword [esp + 0x75], ecx
mov dword [esp + 0x79], edx
mov byte [esp + 0x7d], 1
jne 0x40b2d6
mov byte [esp + 0x7d], 0
push 7
call fcn.0040a500
add esp, 4
test al, al
je 0x40b2e9
mov byte [esp + 0x7d], 1
mov ecx, 0x32
mov esi, 0x41ad98
lea edi, [esp + 0x82]
mov dword [esp + 0x7e], 0
rep movsd dword es:[edi], dword [esi]
push 7
call fcn.0040a500
add esp, 4
test al, al
je 0x40b328
mov eax, dword [0x41bc38]
shr eax, 0xd
shl al, 7
or al, 3
mov byte [esp + 0x14a], al
jmp 0x40b33e
mov ecx, dword [0x41bc38]
shr ecx, 0xd
shl cl, 7
or cl, 2
mov byte [esp + 0x14a], cl
mov eax, dword [0x41bc80]
test eax, eax
jne 0x40b351
mov byte [esp + 0x14b], 0
jmp 0x40b36c
mov eax, dword [0x41bc2c]
mov edx, eax
and al, 7
sar edx, 3
and dl, 0x1f
shl al, 5
add dl, al
mov byte [esp + 0x14b], dl
cmp word [0x41bc9c], 0
mov eax, 0x138
je 0x40b3c2
cmp ebx, 0x10
jle 0x40b385
mov ebx, 0x10
xor esi, esi
mov byte [esp + 0x14c], 0
test ebx, ebx
mov byte [esp + 0x14d], bl
jle 0x40b3bc
mov al, byte [esi + 0x41b553]
mov cl, byte [esp + esi + 0x18]
xor al, cl
mov cl, al
shr cl, 5
shl al, 3
add cl, al
mov byte [esp + esi + 0x14e], cl
inc esi
cmp esi, ebx
jl 0x40b39a
lea eax, [ebx + 0x13a]
mov cl, byte [0x41bc90]
test cl, 4
je 0x40b3dc
mov eax, dword [0x41bc94]
test eax, eax
jle 0x40b3f3
push 0
push 0xb
jmp 0x40b448
test cl, 8
je 0x40b473
test cl, 1
je 0x40b444
mov eax, dword [0x41bc94]
test eax, eax
jg 0x40b444
call fcn.0040aba0
mov dword [0x41bc94], 1
call fcn.00406920
lea edx, [esp + 0x10]
push edx
push 0
push 1
push 0x408ff0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 3
mov dword [0x41bc84], eax
call fcn.004036d0
add esp, 4
push eax
call fcn.004038a0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x644
ret
push 0
push 0xa
call fcn.004036d0
add esp, 4
push eax
call fcn.004038a0
add esp, 8
mov eax, 1
mov dword [0x41bc44], eax
mov dword [0x41b624], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x644
ret
mov byte [esp + eax + 0x14], 2
mov byte [esp + eax + 0x15], 0xc
add eax, 2
mov esi, 0x4d2
lea edi, [esp + eax + 0x14]
add eax, 0xc
mov dword [edi], 0x11072601
mov cx, word [0x41bc90]
mov word [edi + 4], cx
mov ecx, dword [0x41ad78]
lea edx, [edi + 6]
mov dword [edi + 6], ecx
mov cx, word [0x41ad7c]
mov word [edx + 4], cx
lea edx, [esp + eax + 0x14]
add eax, 3
mov dword [edx], 0
cdq
and edx, 3
add eax, edx
mov ecx, eax
sar ecx, 2
shl ecx, 2
mov eax, ecx
cdq
and edx, 3
add eax, edx
sar eax, 2
test eax, eax
jle 0x40b4ec
lea edx, [esp + 0x14]
mov ebp, dword [edx]
add edx, 4
xor esi, ebp
dec eax
jne 0x40b4e2
lea eax, [esi + esi*4]
push 6
lea esi, [esi + eax*8]
lea edx, [esi + esi*2]
lea esi, [esp + 0x18]
shl edx, 4
mov dword [edi], edx
mov eax, dword [0x41b594]
mov dword [0x41a574], ecx
mov edx, ecx
mov edi, 0x41a578
mov dword [0x41a570], eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0040a500
add esp, 4
jmp 0x40b57d
cmp al, 2
jne 0x40b567
mov ecx, dword [0x41ae84]
mov eax, dword [0x41ae80]
mov edx, dword [0x41ae88]
mov dword [esp + 0x58], ecx
mov dword [esp + 0x54], eax
mov eax, dword [0x41ae8c]
mov dword [esp + 0x5c], edx
mov edx, dword [0x41b594]
lea ecx, [esp + 0x14]
push 0x50
push ecx
mov dword [esp + 0x68], eax
push edx
jmp 0x40b575
mov ecx, dword [0x41b594]
lea eax, [esp + 0x14]
push 0x40
push eax
push ecx
call fcn.00401d70
add esp, 0xc
mov ecx, ebx
mov esi, 0x41b553
mov edx, ecx
lea edi, [esp + 0x28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
add ebx, 0x10
and ecx, 3
lea eax, [esp + 0x18]
push ebx
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00404b60
mov ecx, dword [0x417d90]
mov eax, dword [0x417d98]
mov edx, dword [0x417d94]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov dword [0x41b4ac], ecx
mov ecx, dword [0x417d9c]
mov dword [0x41b4b4], eax
xor eax, eax
mov dword [0x41b4b0], edx
mov dword [0x41b4b8], ecx
mov dword [0x41b628], eax
xor edx, edx
mov dl, byte [eax + 0x417d90]
lea eax, [esp + eax*2 + 0x58c]
push edx
push str._02x
push eax
call esi
mov eax, dword [0x41b628]
add esp, 0xc
inc eax
cmp eax, 0x10
mov dword [0x41b628], eax
jl 0x40b5e2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x644
ret
mov ecx, dword [0x41b4bc]
mov esi, 0x41b553
mov dword [esp + 0x16], ecx
mov ecx, ebx
mov edx, ecx
lea edi, [esp + 0x1a]
shr ecx, 2
mov byte [esp + 0x14], 9
mov byte [esp + 0x15], 1
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebx + 6]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call fcn.00404b60
mov eax, dword [0x417d98]
mov ecx, dword [0x417d9c]
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x34], eax
mov edi, 0x41b538
mov dword [esp + 0x38], eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov edx, dword [0x417d90]
mov ebp, dword [0x417d94]
not ecx
dec ecx
mov dword [esp + 0x3c], eax
mov eax, ecx
mov esi, 0x41b538
lea edi, [esp + 0x30]
mov dword [esp + 0x20], edx
shr ecx, 2
mov dword [esp + 0x24], ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x417d98]
mov dword [esp + 0x40], edx
mov edx, dword [0x417d9c]
mov dword [esp + 0x48], ecx
mov ecx, ebx
mov esi, 0x41b553
mov eax, ecx
lea edi, [esp + 0x50]
shr ecx, 2
mov dword [esp + 0x44], ebp
mov dword [esp + 0x4c], edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
add ebx, 0x10
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x44]
push ecx
call fcn.00404b60
mov edx, dword [0x417d90]
mov eax, dword [0x417d94]
mov ecx, dword [0x417d98]
mov dword [esp + 0x48], edx
mov edx, dword [0x417d9c]
add esp, 0x10
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], edx
xor eax, eax
mov cl, byte [eax + 0x41b2e4]
mov bl, byte [esp + eax + 0x38]
xor bl, cl
mov byte [esp + eax + 0x38], bl
inc eax
cmp eax, 0x10
jl 0x40b71f
xor edx, edx
mov ecx, dword [0x41b54c]
mov dword [esp + 0x48], edx
mov eax, dword [0x41b548]
mov dword [esp + 0x4c], edx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], edx
lea ecx, [esp + 0x14]
mov dword [esp + 0x54], edx
mov dx, word [0x41b550]
mov word [esp + 0x50], dx
mov edx, dword [0x41b594]
mov dword [esp + 0x48], eax
mov al, byte [0x41b552]
push 0x44
push ecx
push edx
mov byte [esp + 0x5e], al
mov byte [esp + 0x22], 0
mov byte [esp + 0x23], 0x44
call fcn.00401d70
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x644
ret
mov byte [esp + 0x14], 0xe
jmp 0x40b7a6
mov byte [esp + 0x14], 0xc
push 0x10
push 0x41b4ac
mov byte [esp + 0x1d], 1
mov byte [esp + 0x1e], 0
call fcn.00404b60
mov ecx, dword [0x417d94]
mov edx, dword [0x417d98]
mov eax, dword [0x417d90]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
mov edx, dword [0x41b594]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], eax
mov eax, dword [0x417d9c]
push 0x14
push ecx
push edx
mov dword [esp + 0x38], eax
mov byte [esp + 0x2b], 0x14
call fcn.00401d70
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x644
ret
mov ax, word [0x41869a]
push 0
mov word [esp + 0x19], ax
mov cl, byte [esp + 0x1a]
mov bl, al
mov byte [esp + 0x18], 0xfe
add bl, cl
mov byte [esp + 0x19], bl
call fcn.00403520
mov dx, word [0x418698]
mov byte [esp + 0x1a], al
lea eax, [esp + 0x18]
push 9
push eax
mov byte [esp + 0x23], 0x14
mov byte [esp + 0x24], 0
mov byte [esp + 0x25], 7
mov byte [esp + 0x26], 0xb
mov word [esp + 0x27], dx
call fcn.00404b60
mov edx, dword [0x417d94]
mov ecx, dword [0x417d90]
mov eax, dword [0x417d98]
mov dword [esp + 0x27], edx
mov edx, dword [0x41b250]
mov dword [esp + 0x23], ecx
mov ecx, dword [0x417d9c]
add edx, 0x20
mov dword [esp + 0x2b], eax
mov dword [esp + 0x2f], ecx
mov eax, dword [edx]
push 0x24
mov dword [esp + 0x38], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0x3c], ecx
mov eax, dword [edx + 8]
mov dword [esp + 0x40], eax
mov eax, dword [0x41b594]
mov ecx, dword [edx + 0xc]
lea edx, [esp + 0x24]
push edx
push eax
mov dword [esp + 0x4c], ecx
call fcn.00401d70
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x644
ret