Function at 0x6ecc4120
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
mov eax, 0x11a8
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
call fcn.6ecc88f0
sub esp, eax
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x1164], 0x1000
mov ebx, dword [ecx]
mov edi, dword [ecx + 8]
mov dword [ebp - 0x1178], eax
mov esi, dword [ecx + 0x10]
mov dword [ebp - 0x1174], edx
mov edx, dword [ecx + 0x14]
mov word [ebp - 0x1154], ax
lea eax, [ebp - 0x1018]
mov dword [ebp - 0x114c], eax
lea eax, [ebp - 0x1164]
mov dword [ebp - 0x1170], esi
mov dword [ebp - 0x117c], edx
mov dword [ebp - 0x1158], ebx
mov dword [ebp - 0x1150], edi
mov dword [ebp - 0x1148], eax
test byte [0x6ecc9038], 8
jne 0x6ecc4434
test ebx, ebx
je 0x6ecc4510
mov edx, dword [ebp - 0x1170]
test edx, edx
je 0x6ecc4510
mov eax, dword [ebp - 0x1174]
mov edx, dword [0x6eccd0a4]
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov eax, dword [0x6eccd0a0]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [0x6ecc90a4]
sub esp, 0x10
mov dword [ebp - 0x116c], eax
test eax, eax
jne 0x6ecc43cd
lea eax, [ebp - 0x1158]
mov edx, dword [0x6eccd0a4]
mov dword [esp + 8], 3
mov dword [esp + 0xc], eax
mov eax, dword [0x6eccd0a0]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [0x6ecc90a4]
sub esp, 0x10
test eax, eax
je 0x6ecc43e1
cmp word [ebp - 0x1178], 1
sete dl
cmp eax, 0x232b
sete cl
and edx, ecx
test dl, dl
je 0x6ecc4690
and edi, 0x80
mov esi, edi
jne 0x6ecc4590
test byte [0x6ecc9038], 8
jne 0x6ecc4790
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_strlen]
mov edx, eax
cmp eax, 0xf
ja 0x6ecc4590
lea eax, [ebp - 0x1160]
mov ecx, 0x10
lea edi, [ebp - 0x1144]
mov dword [ebp - 0x1160], 0
mov dword [ebp - 0x115c], eax
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x113a]
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
mov byte [ebp - 0x1144], 0x78
mov dword [ebp - 0x113a], 0x20202020
mov dword [ebp - 0x1136], 0x20202020
mov dword [ebp - 0x1132], 0x20202020
mov dword [ebp - 0x112e], 0x20202020
call sub.ucrtbase.dll_memcpy
lea eax, [ebp - 0x1144]
mov byte [ebp - 0x112b], 0
mov dword [esp], eax
call fcn.6ecc7dd0
sub esp, 4
test al, al
jne 0x6ecc47f0
mov eax, dword [ebp - 0x1140]
cmp word [eax], 0
mov dword [ebp - 0x1178], eax
je 0x6ecc47ff
lea edi, [eax + 9]
mov dword [ebp - 0x1174], ebx
jmp 0x6ecc4383
mov eax, dword [ebp - 0x1174]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__strdup]
mov dword [ebx + 4], eax
test eax, eax
je 0x6ecc439e
mov eax, 1
mov dword [ebx + 0x10], 0x4b0
add esi, 1
add edi, 0x15
mov word [ebx + 8], ax
movzx eax, byte [ebx + 0xc]
and eax, 0xffffffe4
or eax, 0x11
mov byte [ebx + 0xc], al
mov eax, dword [edi - 0x15]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 0x115c]
mov dword [eax], ebx
mov eax, dword [ebp - 0x1178]
mov dword [ebp - 0x115c], ebx
movzx eax, word [eax]
cmp esi, eax
jae 0x6ecc47d0
mov dword [esp + 4], 0x40
mov dword [esp], 1
call dword [sym.imp.ucrtbase.dll_calloc]
mov ebx, eax
test eax, eax
jne 0x6ecc4325
mov eax, dword [ebp - 0x115c]
mov dword [eax], 0
mov eax, dword [ebp - 0x1160]
mov dword [esp + 4], 1
mov dword [esp], eax
call sym.dnsapi.dll_DnsRecordListFree
mov dword [ebp - 0x116c], 8
sub esp, 8
mov eax, dword [ebp - 0x116c]
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x18
mov edx, dword [ebp - 0x1164]
cmp edx, 0xb
jbe 0x6ecc46b0
movzx eax, byte [ebp - 0x1015]
rol word [ebp - 0x1018], 8
rol word [ebp - 0x1014], 8
and eax, 0xf
rol word [ebp - 0x1012], 8
rol word [ebp - 0x1010], 8
rol word [ebp - 0x100e], 8
cmp al, 0xa
ja case.0x6ecc442d.4
movzx eax, al
jmp dword [eax*4 + 0x6eccb4d0]
movzx eax, word [ebp - 0x1178]
mov dword [esp], eax
call fcn.6ecc5c10
mov dword [ebp - 0x1180], eax
test ebx, ebx
je 0x6ecc46a0
mov eax, ebx
shr eax, 0x10
je 0x6ecc4520
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrA]
mov esi, eax
sub esp, 8
mov eax, str._invalid_
test esi, esi
jne 0x6ecc4533
cmp byte [ebx], 0
je 0x6ecc448d
add esi, 1
cmp byte [ebx + esi], 0
jne 0x6ecc4484
mov byte [ebp - 0x1144], 0x22
lea edx, [ebp - 0x1143]
mov dword [ebp - 0x116c], ebx
mov dword [ebp - 0x1184], ebx
lea esi, [esi]
lea esi, [esi]
lea eax, [ebp - 0x1021]
lea ebx, [esi - 1]
cmp edx, eax
ja 0x6ecc4643
test esi, esi
jle 0x6ecc4643
add dword [ebp - 0x116c], 1
mov eax, dword [ebp - 0x116c]
movzx eax, byte [eax - 1]
cmp al, 0xd
je 0x6ecc45c0
jg 0x6ecc45a0
cmp al, 9
je 0x6ecc4630
cmp al, 0xa
jne 0x6ecc45f0
mov eax, 0x6e5c
add edx, 2
mov esi, ebx
mov word [edx - 2], ax
jmp 0x6ecc44b0
mov dword [ebp - 0x116c], 0x57
jmp 0x6ecc43cd
movzx eax, bx
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.6ecc3970
mov ecx, dword [ebp - 0x117c]
mov esi, dword [ebp - 0x1170]
mov dword [esp + 0x18], edi
mov edx, dword [ebp - 0x1174]
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], ecx
mov ecx, dword [ebp - 0x1180]
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], str.__s___s___lx___p___p___p__n
mov dword [esp + 8], str.DnsQuery_UTF8
mov dword [esp + 4], 0x6ecc9038
mov dword [esp], 3
call fcn.6ecc3fc0
jmp 0x6ecc41a8
mov dword [ebp - 0x116c], 0x232b
jmp 0x6ecc43cd
cmp al, 0x22
je 0x6ecc45d3
cmp al, 0x5c
jne 0x6ecc45f0
mov eax, 0x5c5c
add edx, 2
mov esi, ebx
mov word [edx - 2], ax
jmp 0x6ecc44b0
mov eax, 0x725c
add edx, 2
mov esi, ebx
mov word [edx - 2], ax
jmp 0x6ecc44b0
mov eax, 0x225c
add edx, 2
mov esi, ebx
mov word [edx - 2], ax
jmp 0x6ecc44b0
lea esi, [eax - 0x20]
mov ecx, esi
cmp cl, 0x5e
jbe 0x6ecc4680
mov ecx, eax
mov esi, 0x785c
and eax, 0xf
add edx, 4
shr cl, 4
mov word [edx - 4], si
movzx eax, byte [eax + str.0123456789abcdefDnsQuery_A]
movzx esi, cl
movzx ecx, byte [esi + str.0123456789abcdefDnsQuery_A]
mov byte [edx - 1], al
mov esi, ebx
mov byte [edx - 2], cl
jmp 0x6ecc44b0
mov eax, 0x745c
add edx, 2
mov esi, ebx
mov word [edx - 2], ax
jmp 0x6ecc44b0
mov eax, ebx
mov byte [edx], 0x22
mov ebx, dword [ebp - 0x1184]
test eax, eax
jle 0x6ecc47c0
mov ecx, 0x2e2e
mov byte [edx + 3], 0x2e
lea eax, [edx + 4]
mov word [edx + 1], cx
mov byte [eax], 0
lea eax, [ebp - 0x1144]
mov dword [esp], eax
call fcn.6ecc8460
jmp 0x6ecc4533
mov byte [edx], al
mov esi, ebx
add edx, 1
jmp 0x6ecc44b0
mov dword [ebp - 0x116c], eax
jmp 0x6ecc43cd
mov eax, str._null_
jmp 0x6ecc4533
mov dword [ebp - 0x116c], 0x251e
jmp 0x6ecc43cd
mov dword [ebp - 0x116c], 0x232c
jmp 0x6ecc43cd
mov dword [ebp - 0x116c], 0x2329
jmp 0x6ecc43cd
mov dword [ebp - 0x116c], 0x232a
jmp 0x6ecc43cd
cmp word [ebp - 0x1178], 1
mov eax, 0x232b
sete dl
jmp 0x6ecc4243
mov dword [ebp - 0x116c], 0x2332
jmp 0x6ecc43cd
mov eax, dword [ebp - 0x1170]
movzx edx, dx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
lea eax, [ebp - 0x1018]
mov dword [esp], eax
call sym.dnsapi.dll_DnsExtractRecordsFromMessage_UTF8
sub esp, 0xc
jmp 0x6ecc422e
mov dword [ebp - 0x116c], 0x2331
jmp 0x6ecc43cd
mov dword [ebp - 0x116c], 0x2330
jmp 0x6ecc43cd
mov dword [ebp - 0x116c], 0x232f
jmp 0x6ecc43cd
mov dword [ebp - 0x116c], 0x232e
jmp 0x6ecc43cd
mov dword [ebp - 0x116c], 0x232d
jmp 0x6ecc43cd
mov dword [esp + 0xc], str.dns_lookup_failed__trying_netbios_query_n
mov dword [esp + 8], str.DnsQuery_UTF8
mov dword [esp + 4], 0x6ecc9038
mov dword [esp], 3
call fcn.6ecc3fc0
jmp 0x6ecc4266
lea eax, [edx + 1]
jmp 0x6ecc4666
mov edx, ebx
mov dword [edx], 0
mov edi, dword [ebp - 0x1170]
mov eax, dword [ebp - 0x1160]
mov dword [edi], eax
jmp 0x6ecc43cd
mov dword [ebp - 0x116c], 0x7b
jmp 0x6ecc43cd
mov edx, dword [ebp - 0x115c]
jmp 0x6ecc47d2