Function at 0x431420
Capabilities:
Connect socket
Contain obfuscated stackstrings
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcd0
push edi
mov byte [ebp - 0x420], 0
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x41f]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x14], 0
mov word [ebp - 0x430], 2
mov ax, word [ebp + 0x18]
mov word [ebp - 0x42e], ax
mov ecx, dword [ebp + 0x14]
push ecx
call sub.WS2_32.dll_inet_addr
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0xffffffff
jne 0x4314a7
mov edx, dword [ebp + 0x14]
push edx
call sub.WS2_32.dll_gethostbyname
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 0
je 0x4314a0
mov eax, dword [ebp - 0x43c]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [ebp - 0x42c], eax
jmp 0x4314a7
xor eax, eax
jmp 0x431c9a
push 0x10
lea ecx, [ebp - 0x430]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.WS2_32.dll_connect
test eax, eax
je 0x4314c4
xor eax, eax
jmp 0x431c9a
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 0xf], 0x54
mov byte [ebp - 0xe], 0x54
mov byte [ebp - 0xd], 0x50
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x438], 0x48
mov byte [ebp - 0x437], 0x54
mov byte [ebp - 0x436], 0x54
mov byte [ebp - 0x435], 0x50
mov byte [ebp - 0x434], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x43152a
lea edx, [ebp - 0x438]
push edx
mov eax, dword [ebp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x4319c4
cmp dword [ebp + 0x20], 0
je 0x43178e
mov byte [ebp - 0xcb0], 0
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0xcaf]
rep stosd dword es:[edi], eax
mov byte [ebp - 0x8a8], 0
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x8a7]
rep stosd dword es:[edi], eax
mov byte [ebp - 0x464], 0x25
mov byte [ebp - 0x463], 0x73
mov byte [ebp - 0x462], 0x3a
mov byte [ebp - 0x461], 0x25
mov byte [ebp - 0x460], 0x73
mov byte [ebp - 0x45f], 0
mov ecx, dword [ebp + 0x28]
push ecx
mov edx, dword [ebp + 0x24]
push edx
lea eax, [ebp - 0x464]
push eax
lea ecx, [ebp - 0x8a8]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [ebp - 0x8a8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x8a8]
push eax
lea ecx, [ebp - 0xcb0]
push ecx
call fcn.00431d00
add esp, 0xc
mov byte [ebp - 0x4a0], 0x43
mov byte [ebp - 0x49f], 0x4f
mov byte [ebp - 0x49e], 0x4e
mov byte [ebp - 0x49d], 0x4e
mov byte [ebp - 0x49c], 0x45
mov byte [ebp - 0x49b], 0x43
mov byte [ebp - 0x49a], 0x54
mov byte [ebp - 0x499], 0x20
mov byte [ebp - 0x498], 0x25
mov byte [ebp - 0x497], 0x73
mov byte [ebp - 0x496], 0x3a
mov byte [ebp - 0x495], 0x25
mov byte [ebp - 0x494], 0x64
mov byte [ebp - 0x493], 0x20
mov byte [ebp - 0x492], 0x48
mov byte [ebp - 0x491], 0x54
mov byte [ebp - 0x490], 0x54
mov byte [ebp - 0x48f], 0x50
mov byte [ebp - 0x48e], 0x2f
mov byte [ebp - 0x48d], 0x31
mov byte [ebp - 0x48c], 0x2e
mov byte [ebp - 0x48b], 0x30
mov byte [ebp - 0x48a], 0xd
mov byte [ebp - 0x489], 0xa
mov byte [ebp - 0x488], 0x50
mov byte [ebp - 0x487], 0x72
mov byte [ebp - 0x486], 0x6f
mov byte [ebp - 0x485], 0x78
mov byte [ebp - 0x484], 0x79
mov byte [ebp - 0x483], 0x2d
mov byte [ebp - 0x482], 0x41
mov byte [ebp - 0x481], 0x75
mov byte [ebp - 0x480], 0x74
mov byte [ebp - 0x47f], 0x68
mov byte [ebp - 0x47e], 0x6f
mov byte [ebp - 0x47d], 0x72
mov byte [ebp - 0x47c], 0x69
mov byte [ebp - 0x47b], 0x7a
mov byte [ebp - 0x47a], 0x61
mov byte [ebp - 0x479], 0x74
mov byte [ebp - 0x478], 0x69
mov byte [ebp - 0x477], 0x6f
mov byte [ebp - 0x476], 0x6e
mov byte [ebp - 0x475], 0x3a
mov byte [ebp - 0x474], 0x20
mov byte [ebp - 0x473], 0x42
mov byte [ebp - 0x472], 0x61
mov byte [ebp - 0x471], 0x73
mov byte [ebp - 0x470], 0x69
mov byte [ebp - 0x46f], 0x63
mov byte [ebp - 0x46e], 0x20
mov byte [ebp - 0x46d], 0x25
mov byte [ebp - 0x46c], 0x73
mov byte [ebp - 0x46b], 0xd
mov byte [ebp - 0x46a], 0xa
mov byte [ebp - 0x469], 0xd
mov byte [ebp - 0x468], 0xa
mov byte [ebp - 0x467], 0
lea edx, [ebp - 0xcb0]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x4a0]
push edx
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
jmp 0x43186a
mov byte [ebp - 0xccc], 0x43
mov byte [ebp - 0xccb], 0x4f
mov byte [ebp - 0xcca], 0x4e
mov byte [ebp - 0xcc9], 0x4e
mov byte [ebp - 0xcc8], 0x45
mov byte [ebp - 0xcc7], 0x43
mov byte [ebp - 0xcc6], 0x54
mov byte [ebp - 0xcc5], 0x20
mov byte [ebp - 0xcc4], 0x25
mov byte [ebp - 0xcc3], 0x73
mov byte [ebp - 0xcc2], 0x3a
mov byte [ebp - 0xcc1], 0x25
mov byte [ebp - 0xcc0], 0x64
mov byte [ebp - 0xcbf], 0x20
mov byte [ebp - 0xcbe], 0x48
mov byte [ebp - 0xcbd], 0x54
mov byte [ebp - 0xcbc], 0x54
mov byte [ebp - 0xcbb], 0x50
mov byte [ebp - 0xcba], 0x2f
mov byte [ebp - 0xcb9], 0x31
mov byte [ebp - 0xcb8], 0x2e
mov byte [ebp - 0xcb7], 0x30
mov byte [ebp - 0xcb6], 0xd
mov byte [ebp - 0xcb5], 0xa
mov byte [ebp - 0xcb4], 0xd
mov byte [ebp - 0xcb3], 0xa
mov byte [ebp - 0xcb2], 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0xccc]
push eax
lea ecx, [ebp - 0x420]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [ebp - 0x420]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x14], eax
push 0
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x420]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.WS2_32.dll_send
mov dword [ebp - 0x14], 0x400
push 0
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x420]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.WS2_32.dll_recv
mov byte [ebp - 0x45c], 0x48
mov byte [ebp - 0x45b], 0x54
mov byte [ebp - 0x45a], 0x54
mov byte [ebp - 0x459], 0x50
mov byte [ebp - 0x458], 0x2f
mov byte [ebp - 0x457], 0x31
mov byte [ebp - 0x456], 0x2e
mov byte [ebp - 0x455], 0x30
mov byte [ebp - 0x454], 0x20
mov byte [ebp - 0x453], 0x32
mov byte [ebp - 0x452], 0x30
mov byte [ebp - 0x451], 0x30
mov byte [ebp - 0x450], 0
mov byte [ebp - 0x44c], 0x48
mov byte [ebp - 0x44b], 0x54
mov byte [ebp - 0x44a], 0x54
mov byte [ebp - 0x449], 0x50
mov byte [ebp - 0x448], 0x2f
mov byte [ebp - 0x447], 0x31
mov byte [ebp - 0x446], 0x2e
mov byte [ebp - 0x445], 0x31
mov byte [ebp - 0x444], 0x20
mov byte [ebp - 0x443], 0x32
mov byte [ebp - 0x442], 0x30
mov byte [ebp - 0x441], 0x30
mov byte [ebp - 0x440], 0
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea ecx, [ebp - 0x45c]
push ecx
lea edx, [ebp - 0x420]
push edx
call fcn.00431cc0
add esp, 0xc
test eax, eax
je 0x4319b3
lea eax, [ebp - 0x44c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea ecx, [ebp - 0x44c]
push ecx
lea edx, [ebp - 0x420]
push edx
call fcn.00431cc0
add esp, 0xc
test eax, eax
jne 0x4319bd
mov eax, 1
jmp 0x431c9a
xor eax, eax
jmp 0x431c9a
mov byte [ebp - 8], 0x53
mov byte [ebp - 7], 0x4f
mov byte [ebp - 6], 0x43
mov byte [ebp - 5], 0x4b
mov byte [ebp - 4], 0x53
mov byte [ebp - 3], 0x35
mov byte [ebp - 2], 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x431c98
mov dword [ebp - 0x14], 0
cmp dword [ebp + 0x20], 0
je 0x431b55
mov byte [ebp - 0x420], 5
mov byte [ebp - 0x41f], 2
mov byte [ebp - 0x41e], 0
mov byte [ebp - 0x41d], 2
mov dword [ebp - 0x14], 4
push 0
mov edx, dword [ebp - 0x14]
push edx
lea eax, [ebp - 0x420]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.WS2_32.dll_send
mov dword [ebp - 0x14], 2
push 0
mov edx, dword [ebp - 0x14]
push edx
lea eax, [ebp - 0x420]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.WS2_32.dll_recv
movsx edx, byte [ebp - 0x420]
cmp edx, 5
jne 0x431b4c
movsx eax, byte [ebp - 0x41f]
cmp eax, 2
jne 0x431b38
mov byte [ebp - 0x420], 1
mov ecx, dword [ebp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x14], eax
mov dl, byte [ebp - 0x14]
mov byte [ebp - 0x41f], dl
mov eax, dword [ebp + 0x24]
push eax
lea ecx, [ebp - 0x41e]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp - 0x14]
add edx, 2
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x14]
mov byte [ebp + ecx - 0x420], al
mov edx, dword [ebp + 0x28]
push edx
mov eax, dword [ebp - 0x14]
lea ecx, [ebp + eax - 0x41f]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x14]
lea edx, [ecx + eax + 1]
mov dword [ebp - 0x14], edx
push 0
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x420]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.WS2_32.dll_send
mov dword [ebp - 0x14], 2
push 0
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x420]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.WS2_32.dll_recv
movsx eax, byte [ebp - 0x41f]
test eax, eax
je 0x431b36
xor eax, eax
jmp 0x431c9a
jmp 0x431b4a
movsx ecx, byte [ebp - 0x41f]
test ecx, ecx
je 0x431b4a
xor eax, eax
jmp 0x431c9a
jmp 0x431b53
xor eax, eax
jmp 0x431c9a
jmp 0x431bc2
mov byte [ebp - 0x420], 5
mov byte [ebp - 0x41f], 1
mov byte [ebp - 0x41e], 0
mov dword [ebp - 0x14], 3
push 0
mov edx, dword [ebp - 0x14]
push edx
lea eax, [ebp - 0x420]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.WS2_32.dll_send
mov dword [ebp - 0x14], 2
push 0
mov edx, dword [ebp - 0x14]
push edx
lea eax, [ebp - 0x420]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.WS2_32.dll_recv
movsx edx, byte [ebp - 0x420]
cmp edx, 5
jne 0x431bbb
movsx eax, byte [ebp - 0x41f]
test eax, eax
je 0x431bc2
xor eax, eax
jmp 0x431c9a
mov byte [ebp - 0x420], 5
mov byte [ebp - 0x41f], 1
mov byte [ebp - 0x41e], 0
mov byte [ebp - 0x41d], 3
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov byte [ebp - 0x41c], al
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x41b]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov cx, word [ebp + 0x10]
push ecx
call sub.WS2_32.dll_htons
mov word [ebp - 0xcd0], ax
push 2
lea edx, [ebp - 0xcd0]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp + eax - 0x41b]
push ecx
call fcn.00431ca0
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 7
mov dword [ebp - 0x14], eax
push 0
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x420]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.WS2_32.dll_send
mov dword [ebp - 0x14], 0xa
push 0
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x420]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.WS2_32.dll_recv
movsx eax, byte [ebp - 0x420]
cmp eax, 5
jne 0x431c8d
movsx ecx, byte [ebp - 0x41f]
test ecx, ecx
je 0x431c91
xor eax, eax
jmp 0x431c9a
mov eax, 1
jmp 0x431c9a
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret