Function at 0x40faf0
Capabilities:
Create thread
Encode data using xor
Reference cloudflare dns server

Disassembly:
sub esp, 0x670
push ebx
push ebp
push esi
push edi
call fcn.0040a490
test al, al
jne 0x40fb2b
mov ecx, dword [0x42943c]
mov eax, 1
cmp ecx, eax
jle case.0x40fbc6.8
pop edi
pop esi
pop ebp
mov dword [0x42943c], eax
mov dword [0x428cc0], eax
pop ebx
add esp, 0x670
ret
test dword [0x42874c], 0x80000
je 0x40fb52
mov eax, dword [esp + 0x684]
push eax
call fcn.0040bd50
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x670
ret
mov ecx, 0x15d
xor eax, eax
lea edi, [esp + 0x41]
mov byte [esp + 0x40], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
push ecx
stosb byte es:[edi], al
call fcn.00414940
mov edx, dword [esp + 0x2e]
mov eax, dword [esp + 0x32]
mov ecx, dword [esp + 0x36]
mov dword [esp + 0x44], edx
mov edx, dword [esp + 0x3a]
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], ecx
lea edi, [esp + 0x44]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
mov dword [esp + 0x4c], edx
mov byte [esp + 0x50], 0
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x684]
not ecx
and eax, 0xff
dec ecx
cmp eax, 0xe
mov ebx, ecx
ja case.0x40fbc6.8
xor ecx, ecx
mov cl, byte [eax + 0x4106f0]
jmp dword [ecx*4 + 0x4106cc]
mov eax, dword [0x42842c]
mov ebx, 1
cmp eax, ebx
jne 0x40fbfd
test dword [0x42868c], 0x20000
jne 0x40fbfd
push ebx
push 0
push 6
call fcn.004047d0
add esp, 4
push eax
call fcn.00409af0
add esp, 0xc
mov edx, dword [0x429490]
cmp edx, 0x1010101
jne 0x40fc77
mov edi, 0x41e198
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40fcd0
mov eax, dword [0x42874c]
test ah, 4
je 0x40fcd0
mov edi, 0x41e198
or ecx, 0xffffffff
xor eax, eax
mov byte [0x428330], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov edx, ecx
mov esi, edi
mov edi, 0x428cac
push 0x428cac
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0040af30
add esp, 4
push eax
call fcn.004051a0
mov edx, dword [0x429490]
add esp, 8
cmp edx, 0xffffffff
je 0x40fc80
test edx, edx
jne 0x40fcd0
mov eax, dword [0x428688]
test eax, eax
je 0x40fcd0
cmp eax, 0xffffffff
je 0x40fcd0
push 0x428688
mov byte [0x428330], 0
call fcn.0040a1d0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, dword [0x428688]
mov eax, ecx
mov esi, edi
mov edi, 0x428cac
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [0x429490], edx
cmp dword [0x42842c], ebx
jne 0x40fd56
push 3
call fcn.004087d0
add esp, 4
test eax, eax
jne 0x40fd50
cmp dword [0x429418], ebx
jne 0x40fd06
push str.on_ip_error
call fcn.004051d0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x670
ret
cmp dword [0x429558], ebx
jne 0x40fd40
push ebx
push 0
push 9
mov dword [0x42943c], ebx
mov dword [0x428cc0], ebx
call fcn.004047d0
add esp, 4
push eax
call fcn.00409af0
add esp, 0xc
call fcn.0040dd40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x670
ret
call fcn.0040dcc0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x670
ret
mov edx, dword [0x429490]
mov ecx, 0x32
xor eax, eax
mov edi, 0x427e50
mov byte [esp + 0x40], 1
rep stosd dword es:[edi], eax
mov cl, byte [0x41e1c8]
mov ax, word [0x4294b8]
mov byte [esp + 0x41], cl
xor ecx, ecx
mov dword [esp + 0x44], ecx
cmp edx, 0x1010101
mov dword [esp + 0x48], ecx
mov word [esp + 0x42], ax
mov dword [esp + 0x4c], ecx
mov byte [esp + 0x44], 4
mov dword [esp + 0x50], ecx
jne 0x40fdee
test dword [0x42868c], 0x10000
je 0x40fdee
lea edx, [esp + 0x40]
push 0x14
push edx
push str.210.42.255.58
call fcn.0040af30
add esp, 4
push eax
call fcn.00406d80
add esp, 0xc
lea eax, [esp + 0x40]
push 0x14
push eax
push str.210.42.255.59
call fcn.0040af30
add esp, 4
push eax
call fcn.00406d80
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x670
ret
lea ecx, [esp + 0x40]
push 0x14
push ecx
push edx
call fcn.00406d80
mov eax, dword [0x429490]
add esp, 0xc
cmp eax, 0x1010101
jne case.0x40fbc6.8
lea edx, [esp + 0x40]
push 0x14
push edx
push 0x10101ca
call fcn.00406d80
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x670
ret
mov byte [esp + 0x40], 6
jmp 0x40fe63
mov eax, dword [0x42868c]
mov byte [esp + 0x40], 3
test eax, 0x20000
jne 0x40fe63
push 1
push 0
push 7
call fcn.004047d0
add esp, 4
push eax
call fcn.00409af0
add esp, 0xc
jmp 0x40fe63
mov byte [esp + 0x40], 8
mov eax, dword [0x4283e4]
mov ecx, ebx
mov edx, ecx
lea esi, [esp + 0x2a]
lea edi, [esp + 0x46]
mov byte [esp + 0x41], 1
shr ecx, 2
mov dword [esp + 0x42], eax
lea eax, [ebx + 6]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x44]
push ecx
call fcn.00405f50
mov eax, dword [0x424dcc]
mov ecx, dword [0x424dd0]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], ecx
mov dword [0x428355], eax
mov dword [0x428359], ecx
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [0x424dd4]
mov esi, dword [0x424dd8]
not ecx
dec ecx
mov dword [esp + 0x4c], edx
mov dword [0x42835d], edx
mov edx, ecx
mov dword [esp + 0x50], esi
mov dword [0x428361], esi
lea esi, [esp + 0x10]
lea edi, [esp + 0x54]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + 0x42], al
mov edx, ecx
mov ecx, 0x40
add edx, 0x14
sub ecx, edx
mov byte [esp + 0x43], dl
lea edi, [esp + edx + 0x40]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov al, byte [0x429498]
mov byte [esp + 0x78], al
call fcn.0040aa20
mov ecx, dword [eax]
mov dword [esp + 0x79], ecx
mov dx, word [eax + 4]
mov word [esp + 0x7d], dx
mov al, byte [eax + 6]
mov byte [esp + 0x7f], al
xor eax, eax
mov cl, byte [esp + eax + 0x44]
mov dl, byte [esp + eax + 0x7a]
xor dl, cl
mov byte [esp + eax + 0x7a], dl
inc eax
cmp eax, 6
jl 0x40ff54
mov al, byte [esp + 0x684]
cmp al, 1
jne 0x410333
mov ecx, ebx
lea esi, [esp + 0x2a]
mov edx, ecx
lea edi, [esp + 0x81]
shr ecx, 2
mov byte [esp + 0x80], al
mov eax, dword [0x4283e4]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebx + 9]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
mov dword [esp + ebx + 0x85], eax
lea ecx, [esp + ebx + 0x89]
lea eax, [esp + 0x84]
push eax
mov dword [ecx], 0
call fcn.00405f50
mov ecx, dword [0x424dcc]
mov edx, dword [0x424dd0]
mov eax, dword [0x424dd4]
mov dword [esp + 0x88], ecx
mov ecx, dword [0x424dd8]
push 0
mov dword [esp + 0x90], edx
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
call fcn.004087d0
mov edx, dword [0x424cac]
mov ecx, dword [0x424cb4]
mov byte [esp + 0x9c], al
mov eax, dword [0x424cb0]
mov dword [esp + 0xa1], eax
mov dword [esp + 0x9d], edx
mov edx, dword [0x424cb8]
lea eax, [esp + 0x4c]
push 0x65
push eax
mov dword [esp + 0xad], ecx
mov dword [esp + 0xb1], edx
mov byte [esp + 0xb5], 0x14
mov byte [esp + 0xb6], 0
mov byte [esp + 0xb7], 7
mov byte [esp + 0xb8], 0xb
call fcn.00405f50
mov eax, dword [0x4294a0]
mov ecx, dword [0x424dcc]
mov edx, dword [0x424dd0]
add esp, 0x14
test eax, eax
mov dword [esp + 0xa1], ecx
mov dword [esp + 0xa5], edx
mov byte [esp + 0xa9], 1
jne 0x410099
mov byte [esp + 0xa9], 0
push 7
call fcn.0040f0b0
add esp, 4
test al, al
je 0x4100af
mov byte [esp + 0xa9], 1
mov ecx, 0x32
mov esi, 0x427e50
lea edi, [esp + 0xae]
mov dword [esp + 0xaa], 0
rep movsd dword es:[edi], dword [esi]
push 7
call fcn.0040f0b0
add esp, 4
test al, al
je 0x4100f1
mov eax, dword [0x42868c]
shr eax, 0x1c
shl al, 7
or al, 4
mov byte [esp + 0x176], al
jmp 0x410107
mov ecx, dword [0x42868c]
shr ecx, 0x1c
shl cl, 7
or cl, 2
mov byte [esp + 0x176], cl
mov eax, dword [0x4294a0]
test eax, eax
jne 0x41011a
mov byte [esp + 0x177], 0
jmp 0x410135
mov eax, dword [0x429428]
mov edx, eax
and al, 7
sar edx, 3
and dl, 0x1f
shl al, 5
add dl, al
mov byte [esp + 0x177], dl
test byte [0x428684], 2
je 0x410169
mov eax, dword [0x41f9c8]
mov byte [esp + 0xa9], 1
mov ecx, eax
mov dl, al
sar ecx, 3
and dl, 7
and cl, 0x1f
shl dl, 5
add cl, dl
mov dword [0x429428], eax
mov byte [esp + 0x177], cl
cmp word [0x4294fa], 0
mov eax, 0x138
je 0x4101bd
cmp ebx, 0x10
jle 0x410182
mov ebx, 0x10
xor esi, esi
mov byte [esp + 0x178], 0
test ebx, ebx
mov byte [esp + 0x179], bl
jle 0x4101b7
mov al, byte [esp + esi + 0x44]
mov cl, byte [esp + esi + 0x2a]
xor al, cl
mov cl, al
shr cl, 5
shl al, 3
add cl, al
mov byte [esp + esi + 0x17a], cl
inc esi
cmp esi, ebx
jl 0x410197
lea eax, [ebx + 0x13a]
mov cl, byte [0x4294b0]
test cl, 4
je 0x4101dd
mov eax, dword [0x4294b4]
test eax, eax
jle 0x4101f4
mov esi, 1
push esi
push 0
push 0xb
jmp 0x410251
test cl, 8
je 0x410279
test cl, 1
je 0x410247
mov eax, dword [0x4294b4]
test eax, eax
jg 0x410247
call fcn.0040f8b0
mov dword [0x4294b4], 1
call fcn.0040b220
lea edx, [esp + 0x3c]
push edx
push 0
push 1
push 0x40dad0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push 1
push 0
push 3
mov dword [0x4294a4], eax
call fcn.004047d0
add esp, 4
push eax
call fcn.00409af0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x670
ret
mov esi, 1
push esi
push 0
push 0xa
call fcn.004047d0
add esp, 4
push eax
call fcn.00409af0
add esp, 0xc
mov dword [0x429438], esi
mov dword [0x428cc0], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x670
ret
mov byte [esp + eax + 0x40], 2
mov byte [esp + eax + 0x41], 0xc
add eax, 2
mov esi, 0x4d2
lea edi, [esp + eax + 0x40]
add eax, 0xc
mov dword [edi], 0x11072601
mov cx, word [0x4294b0]
mov word [edi + 4], cx
mov ecx, dword [0x427e30]
lea edx, [edi + 6]
mov dword [edi + 6], ecx
mov cx, word [0x427e34]
mov word [edx + 4], cx
lea edx, [esp + eax + 0x40]
add eax, 3
mov dword [edx], 0
cdq
and edx, 3
add eax, edx
mov ecx, eax
sar ecx, 2
shl ecx, 2
mov eax, ecx
cdq
and edx, 3
add eax, edx
sar eax, 2
test eax, eax
jle 0x4102f2
lea edx, [esp + 0x40]
mov ebp, dword [edx]
add edx, 4
xor esi, ebp
dec eax
jne 0x4102e8
lea eax, [esi + esi*4]
push 6
lea eax, [esi + eax*8]
lea esi, [esp + 0x44]
lea edx, [eax + eax*2]
shl edx, 4
mov dword [edi], edx
mov eax, dword [0x429490]
mov dword [0x42762c], ecx
mov edx, ecx
mov edi, 0x427630
mov dword [0x427628], eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0040f0b0
add esp, 4
jmp 0x41038b
cmp al, 2
jne 0x410376
mov eax, dword [0x428308]
push 0x50
add eax, 0x20
mov ecx, dword [eax]
mov dword [esp + 0x84], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x88], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x8c], ecx
mov ecx, dword [0x429490]
mov edx, dword [eax + 0xc]
lea eax, [esp + 0x44]
push eax
mov dword [esp + 0x94], edx
push ecx
jmp 0x410383
mov eax, dword [0x429490]
lea edx, [esp + 0x40]
push 0x40
push edx
push eax
call fcn.00406d80
add esp, 0xc
mov ecx, ebx
lea esi, [esp + 0x2a]
mov edx, ecx
lea edi, [esp + 0x54]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
add ebx, 0x10
and ecx, 3
lea eax, [esp + 0x44]
push ebx
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00405f50
mov ecx, dword [0x424dcc]
mov eax, dword [0x424dd4]
mov edx, dword [0x424dd0]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov dword [0x4283d4], ecx
mov ecx, dword [0x424dd8]
mov dword [0x4283dc], eax
xor eax, eax
mov dword [0x4283d8], edx
mov dword [0x4283e0], ecx
mov dword [0x428cc4], eax
xor edx, edx
mov dl, byte [eax + 0x424dcc]
lea eax, [esp + eax*2 + 0x5b8]
push edx
push str._02x
push eax
call esi
mov eax, dword [0x428cc4]
add esp, 0xc
inc eax
cmp eax, 0x10
mov dword [0x428cc4], eax
jl 0x4103ef
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x670
ret
mov ecx, dword [0x4283e4]
lea esi, [esp + 0x2a]
mov dword [esp + 0x42], ecx
mov ecx, ebx
mov edx, ecx
lea edi, [esp + 0x46]
shr ecx, 2
mov byte [esp + 0x40], 9
mov byte [esp + 0x41], 1
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebx + 6]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x44]
push ecx
call fcn.00405f50
mov eax, dword [0x424dd4]
mov ecx, dword [0x424dd8]
mov dword [esp + 0x54], eax
xor eax, eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x58], ecx
mov dword [esp + 0x60], eax
lea edi, [esp + 0x18]
mov dword [esp + 0x64], eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov edx, dword [0x424dcc]
mov ebp, dword [0x424dd0]
not ecx
dec ecx
mov dword [esp + 0x68], eax
mov eax, ecx
lea esi, [esp + 0x18]
lea edi, [esp + 0x5c]
mov dword [esp + 0x4c], edx
shr ecx, 2
mov dword [esp + 0x50], ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x424dd4]
mov dword [esp + 0x6c], edx
mov edx, dword [0x424dd8]
mov dword [esp + 0x74], ecx
mov ecx, ebx
lea esi, [esp + 0x32]
mov eax, ecx
lea edi, [esp + 0x7c]
shr ecx, 2
mov dword [esp + 0x70], ebp
mov dword [esp + 0x78], edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
add ebx, 0x10
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x70]
push ecx
call fcn.00405f50
mov edx, dword [0x424dcc]
mov eax, dword [0x424dd0]
mov ecx, dword [0x424dd4]
mov dword [esp + 0x74], edx
mov edx, dword [0x424dd8]
add esp, 0x10
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x70], edx
xor eax, eax
mov cl, byte [eax + 0x42839c]
mov bl, byte [esp + eax + 0x64]
xor bl, cl
mov byte [esp + eax + 0x64], bl
inc eax
cmp eax, 0x10
jl 0x410528
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
xor edx, edx
push 0x44
mov dword [esp + 0x78], edx
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], edx
mov dword [esp + 0x7c], ecx
mov ecx, dword [0x429490]
mov dword [esp + 0x80], edx
lea eax, [esp + 0x44]
mov dword [esp + 0x84], edx
mov dx, word [esp + 0x2c]
push eax
push ecx
mov word [esp + 0x88], dx
mov byte [esp + 0x4e], 0
mov byte [esp + 0x4f], 0x44
call fcn.00406d80
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x670
ret
mov byte [esp + 0x40], 0xe
jmp 0x4105aa
mov byte [esp + 0x40], 0xc
push 0x10
push 0x4283d4
mov byte [esp + 0x49], 1
mov byte [esp + 0x4a], 0
call fcn.00405f50
mov eax, dword [0x424dd0]
mov ecx, dword [0x424dd4]
mov edx, dword [0x424dcc]
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], ecx
mov ecx, dword [0x429490]
lea eax, [esp + 0x48]
mov dword [esp + 0x4c], edx
mov edx, dword [0x424dd8]
push 0x14
push eax
push ecx
mov dword [esp + 0x64], edx
mov byte [esp + 0x57], 0x14
call fcn.00406d80
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x670
ret
mov dx, word [0x423e92]
push 0
mov word [esp + 0x45], dx
mov al, byte [esp + 0x46]
mov bl, dl
mov byte [esp + 0x44], 0xfe
add bl, al
mov byte [esp + 0x45], bl
call fcn.004087d0
mov cx, word [0x423e90]
lea edx, [esp + 0x44]
push 9
push edx
mov byte [esp + 0x4e], al
mov byte [esp + 0x4f], 0x14
mov byte [esp + 0x50], 0
mov byte [esp + 0x51], 7
mov byte [esp + 0x52], 0xb
mov word [esp + 0x53], cx
call fcn.00405f50
mov ecx, dword [0x424dd0]
mov eax, dword [0x424dcc]
mov edx, dword [0x424dd4]
mov dword [esp + 0x53], ecx
mov ecx, dword [0x428308]
mov dword [esp + 0x4f], eax
mov eax, dword [0x424dd8]
add ecx, 0x20
mov dword [esp + 0x57], edx
mov dword [esp + 0x5b], eax
mov edx, dword [ecx]
push 0x24
mov dword [esp + 0x64], edx
mov eax, dword [ecx + 4]
mov dword [esp + 0x68], eax
mov edx, dword [ecx + 8]
mov dword [esp + 0x6c], edx
mov edx, dword [0x429490]
mov eax, dword [ecx + 0xc]
lea ecx, [esp + 0x50]
push ecx
push edx
mov dword [esp + 0x78], eax
call fcn.00406d80
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x670
ret