Conficker wasn’t as frustrating as some, but it still had me cringing. The goal was to take the dll, and make it spit out some dns traffic so we could test our SO rule conficker dns detection engine. All you can do is apply your knowledge of asm and systems and hope you have the time to make sense of it. After loading up this binary into IDA, rebasing it to 0x10001000, and beginning a decode, it became quickly apparent where the function table for the new code lay.”]
Source: https://blog.talosintelligence.com/2009/02/making-conficker-cough-up-goods.html