Function at 0x100033a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov eax, 0x1094
mov ebp, esp
push edi
push esi
push ebx
call fcn.10002064
sub esp, eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
lea esi, [ebp - 0x100c]
mov dword [ebp - 0x1070], 0x1000
mov dword [ebp - 0x1060], eax
mov eax, dword [ebp + 0x10]
mov word [ebp - 0x105c], bx
mov dword [ebp - 0x1058], eax
lea eax, [ebp - 0x1070]
mov dword [ebp - 0x1054], esi
mov dword [ebp - 0x1050], eax
test byte [0x1000905c], 8
jne 0x10003510
mov eax, dword [ebp + 8]
test eax, eax
je 0x100034f0
mov edi, dword [ebp + 0x18]
test edi, edi
je 0x100034f0
cmp bx, 1
je 0x100037f0
cmp bx, 0x1c
je 0x10003700
mov eax, dword [ebp + 0x14]
mov edx, dword [0x100090b4]
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov eax, dword [0x100090b0]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [0x100090ac]
mov dword [ebp - 0x1074], eax
sub esp, 0x10
test eax, eax
jne 0x100034fa
lea eax, [ebp - 0x1060]
mov edx, dword [0x100090b4]
mov dword [esp + 8], 3
mov dword [esp + 0xc], eax
mov eax, dword [0x100090b0]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [0x100090ac]
sub esp, 0x10
test eax, eax
jne 0x10003578
mov edx, dword [ebp - 0x1070]
cmp edx, 0xb
jbe 0x100037e0
movzx eax, byte [ebp - 0x1009]
rol word [ebp - 0x100c], 8
rol word [ebp - 0x1008], 8
and eax, 0xf
rol word [ebp - 0x1006], 8
rol word [ebp - 0x1004], 8
rol word [ebp - 0x1002], 8
cmp al, 0xa
ja case.0x100034e0.4
movzx eax, al
jmp dword [eax*4 + 0x1000b1e4]
mov dword [ebp - 0x1074], 0x57
mov eax, dword [ebp - 0x1074]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x18
movzx eax, bx
mov dword [esp], eax
call sym._debugstr_type
mov edi, eax
mov eax, dword [ebp + 8]
call sym._wine_dbgstr_an.constprop.0_2
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x1c]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], ecx
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x24], edx
mov dword [esp + 0x1c], ecx
mov ecx, dword [ebp + 0x10]
mov dword [esp + 0xc], str.__s___s___lx___p___p___p__n
mov dword [esp + 0x18], ecx
mov dword [esp + 8], str.DnsQuery_UTF8
mov dword [esp + 4], 0x1000905c
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
jmp 0x100033fd
cmp bx, 1
sete dl
cmp eax, 0x232b
sete cl
and edx, ecx
test dl, dl
je 0x10003890
mov ebx, dword [ebp + 0x10]
and ebx, 0x80
jne 0x100037bc
test byte [0x1000905c], 8
jne 0x10003958
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov edx, eax
cmp eax, 0xf
ja 0x100037bc
lea eax, [ebp - 0x1068]
lea esi, [ebp - 0x104c]
mov ecx, 0x10
mov dword [ebp - 0x1068], 0
mov dword [ebp - 0x1064], eax
mov edi, esi
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [esp + 8], edx
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x1042]
mov dword [esp], eax
mov ecx, 0x2020
mov dword [esp + 4], edx
mov word [ebp - 0x1036], cx
mov byte [ebp - 0x104c], 0x78
mov dword [ebp - 0x1042], 0x20202020
mov dword [ebp - 0x103e], 0x20202020
mov dword [ebp - 0x103a], 0x20202020
mov byte [ebp - 0x1034], 0x20
call sym._memcpy
mov dword [esp], esi
mov byte [ebp - 0x1033], 0
call sym._Netbios_4
sub esp, 4
test al, al
jne 0x10003988
mov eax, dword [ebp - 0x1048]
cmp word [eax], 0
mov dword [ebp - 0x1078], eax
je 0x10003997
lea esi, [eax + 9]
nop
mov dword [esp + 4], 0x40
mov dword [esp], 1
call dword [sym.imp.ucrtbase.dll_calloc]
mov edi, eax
test eax, eax
je 0x100039df
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__strdup]
mov dword [edi + 4], eax
test eax, eax
je 0x100039a2
mov eax, 1
mov dword [edi + 0x10], 0x4b0
inc ebx
add esi, 0x15
mov word [edi + 8], ax
movzx eax, byte [edi + 0xc]
and eax, 0xffffffe4
or eax, 0x11
mov byte [edi + 0xc], al
mov eax, dword [esi - 0x15]
mov dword [edi + 0x18], eax
mov eax, dword [ebp - 0x1064]
mov dword [eax], edi
mov eax, dword [ebp - 0x1078]
mov dword [ebp - 0x1064], edi
movzx eax, word [eax]
cmp ebx, eax
jb 0x10003670
mov dword [edi], 0
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp - 0x1068]
mov dword [ecx], eax
jmp 0x100034fa
lea eax, [ebp - 0x104c]
mov dword [esp + 8], eax
lea eax, [ebp - 0x106c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlIpv6StringToAddressA]
mov dword [ebp - 0x1074], eax
sub esp, 0xc
test eax, eax
jne 0x10003427
mov eax, dword [ebp - 0x106c]
cmp byte [eax], 0
jne 0x10003427
mov dword [esp + 4], 0x40
mov dword [esp], 1
call dword [sym.imp.ucrtbase.dll_calloc]
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__strdup]
mov dword [ebx + 8], 0x10001c
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0xc]
mov dword [ebx + 0x10], 0x93a80
and eax, 0xe7
or eax, 0x2010
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 0x104c]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 0x1048]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp - 0x1044]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 0x1040]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
jmp 0x100034fa
cmp bx, 1
je 0x10003591
mov dword [ebp - 0x1074], 0x232b
mov eax, dword [ebp - 0x1074]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x18
mov dword [ebp - 0x1074], 0x251e
jmp 0x100034fa
lea eax, [ebp - 0x104c]
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x106c]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlIpv4StringToAddressA]
mov dword [ebp - 0x1074], eax
sub esp, 0x10
test eax, eax
jne 0x10003427
mov eax, dword [ebp - 0x106c]
cmp byte [eax], 0
jne 0x10003427
mov dword [esp + 4], 0x40
mov dword [esp], 1
call dword [sym.imp.ucrtbase.dll_calloc]
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__strdup]
mov dword [ebx + 8], 0x40001
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0xc]
mov dword [ebx + 0x10], 0x93a80
and eax, 0xe7
or eax, 0x2010
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 0x104c]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
jmp 0x100034fa
mov dword [ebp - 0x1074], eax
jmp 0x100034fa
mov dword [ebp - 0x1074], 0x2329
jmp 0x100034fa
mov dword [ebp - 0x1074], 0x232a
jmp 0x100034fa
mov dword [ebp - 0x1074], 0x232d
jmp 0x100034fa
mov eax, dword [ebp + 0x18]
movzx edx, dx
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], eax
call sym.dnsapi.dll_DnsExtractRecordsFromMessage_UTF8
sub esp, 0xc
cmp eax, 0x232b
sete dl
cmp bx, 1
sete cl
and edx, ecx
jmp 0x10003589
mov dword [ebp - 0x1074], 0x2332
jmp 0x100034fa
mov dword [ebp - 0x1074], 0x2331
jmp 0x100034fa
mov dword [ebp - 0x1074], 0x2330
jmp 0x100034fa
mov dword [ebp - 0x1074], 0x232f
jmp 0x100034fa
mov dword [ebp - 0x1074], 0x232e
jmp 0x100034fa
mov dword [ebp - 0x1074], 0x232c
jmp 0x100034fa
mov dword [esp + 0xc], str.dns_lookup_failed__trying_netbios_query_n
mov dword [esp + 8], str.DnsQuery_UTF8
mov dword [esp + 4], 0x1000905c
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
jmp 0x100035ad
mov dword [ebp - 0x1074], 0x7b
jmp 0x100034fa
mov edi, dword [ebp - 0x1064]
jmp 0x100036e8
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [ebp - 0x1064]
mov dword [eax], 0
mov eax, dword [ebp - 0x1068]
mov dword [esp + 4], 1
mov dword [esp], eax
call sym.dnsapi.dll_DnsRecordListFree
mov dword [ebp - 0x1074], 8
sub esp, 8
jmp 0x100034fa
mov eax, dword [ebp - 0x1064]
mov dword [eax], 0
jmp 0x100039b7