Function at 0x180005c80
Capabilities:
Resolve dns

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rdi, rdx
mov rbp, rcx
xor esi, esi
mov dword [rsp + 0x80], esi
lea rcx, str.WSHTCPIP.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x30], rsi
lea edx, [rsi + 5]
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [rsi + 0x68]
mov rcx, rdi
call sub.DNSAPI.dll_DnsQuery_W
test eax, eax
jne 0x180005d29
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x180005d29
mov rdx, qword [rdx + 0x20]
lea rcx, [rsp + 0x80]
call fcn.180008830
lea edx, [rsi + 1]
mov rcx, qword [rsp + 0x30]
call sub.DNSAPI.dll_DnsFree
mov rbx, qword [rsp + 0x80]
or edi, 0xffffffff
cmp dword [rbx - 0x10], 0
jle 0x180005ede
lea edx, [rdi + 0x2f]
mov rcx, rbx
call fcn.180014708
test rax, rax
jne 0x180005d4a
mov eax, edi
jmp 0x180005d4c
sub eax, ebx
mov r8d, eax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x80]
call fcn.180008c10
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x180005dc2
cmp dword [rbx + 0x10], 0
jl 0x180005db0
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x180005db0
call fcn.180009810
mov rsi, rax
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x180005da2
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.WS2_32.dll_htonl + 8]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x80], rax
jmp 0x180005dc2
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x80]
call fcn.180009730
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180005de1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
lea r8, [0x1800298c5]
lea rdx, [0x1800298c8]
lea rcx, [rsp + 0x80]
call fcn.180008910
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x88], rax
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x180005e55
test rdx, 0xffffffffffff0000
jne 0x180005e55
movzx ebx, dx
xor edx, edx
mov ecx, ebx
call fcn.180004180
test rax, rax
je 0x180005e63
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.1800030d0
jmp 0x180005e63
lea rcx, [rsp + 0x88]
call fcn.180002c90
nop
xor r8d, r8d
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x40]
call fcn.180010e50
nop
mov rdx, qword [rax]
lea rcx, [rsp + 0x80]
call fcn.180008830
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180005eaa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180005ed6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rbx, qword [rsp + 0x80]
jmp 0x180005ede
mov rbx, qword [rsp + 0x80]
mov rdx, rbx
mov rcx, rbp
call fcn.180002c00
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
dec edi
test edi, edi
jg 0x180005f07
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, rbp
jmp 0x180005f0a
mov rax, rbp
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret