Function at 0x583420
Capabilities:
Resolve dns

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1e8
mov rsi, rcx
mov r14, qword [rdx]
mov rbx, qword [rdx + 8]
movzx edi, word [rdx + 0x10]
mov rax, qword [0x006be138]
cmp rax, 3
jne 0x5835d8
cmp rbx, 0x17f
ja 0x5835ea
lea rcx, [rsp + 0x68]
mov rdx, r14
mov r8, rbx
call sub.ntdll.dll_memcpy
mov byte [rsp + rbx + 0x68], 0
lea rax, [rbx + 1]
cmp rbx, 0xe
ja 0x583498
xor edx, edx
nop dword [rax]
cmp byte [rsp + rdx + 0x68], 0
je 0x583544
inc rdx
cmp rax, rdx
jne 0x583480
jmp 0x5835a1
xor ecx, ecx
mov dl, 1
test dl, dl
jne 0x5834cc
jne 0x5834cc
xor edx, edx
nop word cs:[rax + rax]
cmp byte [rsp + rdx + 0x68], 0
je 0x583544
inc rdx
jne 0x5834b0
xor edx, edx
test dl, dl
jne 0x58353a
lea rdx, [rbx - 0xf]
jmp 0x5834d2
lea rdx, [rbx - 0xf]
xor ecx, ecx
movabs r8, 0xfefefefefefefeff
movabs r9, 0x8080808080808080
nop word cs:[rax + rax]
mov r10, qword [rsp + rcx + 0x68]
mov r11, r10
not r11
add r10, r8
and r11, r9
test r11, r10
jne 0x58353a
mov r10, qword [rsp + rcx + 0x70]
mov r11, r10
not r11
add r10, r8
and r11, r9
test r11, r10
jne 0x58353a
add rcx, 0x10
cmp rcx, rdx
jbe 0x5834f0
jmp 0x58353a
cmp byte [rsp + rcx + 0x68], 0
je 0x583541
inc rcx
cmp rax, rcx
jne 0x583530
jmp 0x5835a1
mov rdx, rcx
cmp rdx, rbx
jne 0x5835a1
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x68]
lea r8, [rsp + 0x30]
lea r9, [rsp + 0x28]
xor edx, edx
call sub.WS2_32.dll_getaddrinfo
test eax, eax
je 0x5835c0
call sub.WS2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
jmp 0x5835b3
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0x1e8
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], di
xor eax, eax
mov qword [rsi], rax
jmp 0x5835b3
call fcn.00583a50
cmp rbx, 0x17f
jbe 0x583458
mov rcx, rsi
mov rdx, r14
mov r8, rbx
mov r9d, edi
add rsp, 0x1e8
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x583ab0
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov ebx, r9d
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.0043b6f0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x583b0a
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
cmp qword [rsp + 0x38], 0
je 0x583b92
mov edx, 1
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.00417e40
mov rdi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x28]
mov rcx, rdi
xor edx, edx
call sub.WS2_32.dll_getaddrinfo
test eax, eax
je 0x583b67
call sub.WS2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x583b7a
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], bx
xor eax, eax
mov qword [rsi], rax
mov byte [rdi], 0
test r14, r14
je 0x583b92
mov edx, 1
mov rcx, rdi
call fcn.00417e40
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret