Function at 0x413dea
Capabilities:
Create thread
Resolve dns
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x86c
mov dword [0x553c7c], ecx
push ebx
push esi
push edi
jmp 0x413fbd
push 0xc
pop ecx
call fcn.0040698f
mov esi, eax
test esi, esi
je 0x413e18
mov edi, esi
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
jmp 0x413e1a
xor esi, esi
mov ebx, dword [ebp - 0x18]
imul eax, ebx, 0xc
lea edi, [eax + 0x420950]
mov dword [ebp - 0x1c], edi
cmp dword [edi], ebx
jne 0x413fa1
cmp byte [edi + 4], 1
jne 0x413f87
push 0x802
lea eax, [ebp - 0x868]
push 0
push eax
call fcn.004012cf
mov ebx, dword [ebp - 0x10]
lea edi, [ebp - 0x4c]
add esp, 0xc
xor eax, eax
and dword [ebp - 0xc], eax
and dword [ebp - 8], eax
push 8
pop ecx
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov al, byte [ebx + 3]
cmp al, 1
jne 0x413e9a
push 0x802
lea eax, [ebp - 0x868]
push eax
lea esi, [ebx + 4]
push esi
push 2
call dword [sym.imp.WS2_32.dll_InetNtopW]
movzx edx, word [ebx + 8]
mov ecx, esi
call fcn.00413b63
jmp 0x413f36
cmp al, 3
jne 0x413f0f
xorps xmm0, xmm0
mov dword [ebp - 0x48], 2
push 0x200
movlpd qword [ebp - 0x3c], xmm0
movlpd qword [ebp - 0x34], xmm0
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x40], 6
call fcn.00401000
movsx ecx, byte [ebx + 4]
mov esi, eax
push ecx
lea ecx, [ebx + 5]
push ecx
push esi
call fcn.004012a9
movsx ecx, byte [ebx + 4]
lea eax, [ebp - 0xc]
add esp, 0x10
mov byte [ecx + esi], 0
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push esi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x413f39
movsx eax, byte [ebx + 4]
movzx edx, word [eax + ebx + 5]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x18]
lea ecx, [ecx + 4]
jmp 0x413e90
cmp al, 4
jne 0x413f39
push 0x802
lea eax, [ebp - 0x868]
push eax
lea esi, [ebx + 4]
push esi
push 0x17
call dword [sym.imp.WS2_32.dll_InetNtopW]
movzx edx, word [ebx + 8]
mov ecx, esi
call fcn.00413bd8
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
lea edx, [ebp - 0x2c]
mov word [ebp - 0x2c], 5
push 0xa
mov byte [ebp - 0x29], 1
call fcn.00413d2c
mov eax, dword [ebp - 0x1c]
xor edx, edx
pop ecx
pop ecx
mov ecx, dword [ebp - 8]
mov esi, eax
imul edi, dword [eax], 0xc
mov dword [eax + 8], ecx
lea ecx, [ebp - 0x20]
push ecx
mov byte [eax + 4], 2
push edx
add edi, 0x420950
mov dword [ebp - 0x20], edx
push eax
push 0x413d7e
push edx
movsd dword es:[edi], dword [esi]
push edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x413f99
mov ebx, dword [ebp - 0x10]
push 0
push dword [ebp - 0x14]
push ebx
push dword [edi + 8]
call dword [sym.imp.WS2_32.dll_send]
push ebx
call fcn.00401014
jmp 0x413fbc
push ebx
push 2
lea edx, [ebp - 4]
mov word [ebp - 4], 5
call fcn.00413d2c
mov byte [esi + 4], 1
mov dword [esi], ebx
movsd dword es:[edi], dword [esi]
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop ecx
lea eax, [ebp - 0x60]
push eax
call fcn.00413c4e
cmp byte [0x4206a6], 0
lea edi, [ebp - 0x18]
mov esi, eax
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jne 0x413e01
pop edi
pop esi
pop ebx
leave
ret