Function at 0x4fc0e0
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x300
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [esp + 0x2f8], eax
mov eax, dword [esi + 0x138]
mov dword [ecx], 0
test eax, eax
je 0x4fc84b
cmp dword [eax + 4], 0
jne 0x4fc12a
cmp dword [eax + 0x220], 0
je 0x4fcd24
xor ebx, ebx
cmp dword [eax + 0x43c], 0
jne 0x4fcd80
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
lea ebx, [eax + 4]
xor edi, edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], edi
mov ecx, 0x22c
lea eax, [esp + 0x44]
push ecx
push 0xff
push eax
call fcn.00650600
add esp, 0xc
mov eax, dword [esp + 0x14]
push dword [eax + 4]
push dword [esi + 0x70]
call fcn.0050e8b0
add esp, 8
push ebx
call fcn.00520060
add esp, 4
mov eax, dword [esp + 0x14]
lea ebx, [eax + 0x220]
mov eax, dword [esp + 0x14]
push dword [eax + 0x220]
push dword [esi + 0x70]
call fcn.0050e8b0
add esp, 8
push ebx
mov ebx, dword [esp + 0x18]
call fcn.00520060
add esp, 4
mov eax, 0x22c
push eax
push edi
lea eax, [esp + 0x4c]
push eax
call fcn.00650600
add esp, 0xc
lea eax, [esp + 0x44]
mov dword [eax + 0x224], getpeername
mov esi, 0x100
push esi
push eax
call fcn.004fd040
add esp, 8
lea eax, [esp + 0x54]
push esi
push eax
call fcn.004fd040
add esp, 8
lea eax, [esp + 0x64]
push esi
push eax
call fcn.004fd040
add esp, 8
lea eax, [esp + 0x74]
push esi
push eax
call fcn.004fd040
add esp, 8
mov al, 1
imul ecx, edi, 0x21c
mov edx, dword [ebx + ecx + 8]
test edx, edx
je 0x4fc2c6
mov dword [esp + 0x24], edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x30], ecx
lea esi, [ebx + ecx]
add esi, 0x210
push esi
call fcn.004f47e0
add esp, 4
mov ebx, eax
mov dword [esp + 0x28], esi
push esi
call fcn.004fd280
add esp, 4
mov esi, 4
cmp ebx, 0xc
jb 0x4fc272
mov esi, 0xc
test eax, eax
je 0x4fc272
cmp byte [eax], 0
jne 0x4fc272
cmp byte [eax + 1], 0
jne 0x4fc272
mov esi, 8
test byte [eax + 3], 0xf
je 0x4fc2db
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x30]
lea ebx, [eax + ecx]
add ebx, 8
mov dword [esp + edi*4 + 0x3c], esi
push dword [esp + 0x28]
call fcn.004fd060
add esp, 4
cmp dword [ebx], 1
mov ebx, dword [esp + 0x14]
mov eax, 0x74a11a
mov ecx, 0x74a118
cmove eax, ecx
push dword [ebx + 0x444]
push eax
push dword [esi*4 + 0x74e460]
push str.DoH:__s_type__s_for__s
push dword [ebp + 8]
call fcn.00514fc0
add esp, 0x14
mov eax, dword [esp + 0x1c]
xor edi, edi
inc edi
test al, 1
mov eax, 0
jne 0x4fc20a
jmp 0x4fc855
mov edx, ebx
movzx esi, word [eax + 4]
rol si, 8
test si, si
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov ecx, 0xc
je 0x4fc36f
mov word [esp + 0x20], si
lea edx, [ecx + 1]
mov esi, 2
cmp edx, dword [esp + 0xc]
ja 0x4fc272
mov ebx, edx
movzx eax, byte [eax + ecx]
mov edx, eax
and edx, 0xc0
jne 0x4fc338
add ebx, eax
mov edx, dword [esp + 0xc]
cmp ebx, edx
ja 0x4fc272
mov ecx, ebx
test eax, eax
mov eax, dword [esp + 8]
jne 0x4fc2fc
jmp 0x4fc359
cmp edx, 0xc0
jne 0x4fc81b
add ecx, 2
mov ebx, ecx
mov edx, dword [esp + 0xc]
cmp ecx, edx
mov eax, dword [esp + 8]
ja 0x4fc272
add ebx, 4
cmp ebx, edx
ja 0x4fc272
mov ecx, ebx
movzx esi, word [esp + 0x20]
dec si
jne 0x4fc2f7
movzx ebx, word [eax + 6]
rol bx, 8
test bx, bx
je 0x4fc662
lea eax, [ecx + 1]
cmp eax, edx
ja 0x4fc658
mov esi, ecx
mov ecx, dword [esp + 8]
movzx ecx, byte [ecx + esi]
mov edx, ecx
and edx, 0xc0
jne 0x4fc3b7
add eax, ecx
mov edx, dword [esp + 0xc]
cmp eax, edx
ja 0x4fc658
mov esi, eax
test ecx, ecx
mov ecx, eax
jne 0x4fc380
jmp 0x4fc3d6
cmp edx, 0xc0
jne 0x4fc81b
mov ecx, esi
add ecx, 2
mov eax, ecx
mov edx, dword [esp + 0xc]
cmp ecx, edx
ja 0x4fc658
lea ecx, [eax + 2]
cmp ecx, edx
ja 0x4fc658
mov ecx, dword [esp + 8]
movzx ecx, word [ecx + eax]
rol cx, 8
mov dword [esp + 0x20], ecx
movzx ecx, cx
cmp cx, 5
je 0x4fc409
cmp ecx, 0x27
je 0x4fc409
cmp dword [esp + 0x24], ecx
jne 0x4fc841
lea edx, [eax + 4]
cmp edx, dword [esp + 0xc]
ja 0x4fc658
mov esi, dword [esp + 8]
movzx esi, word [esi + eax + 2]
rol si, 8
cmp si, 1
jne 0x4fc823
lea esi, [eax + 8]
cmp esi, dword [esp + 0xc]
ja 0x4fc658
mov esi, dword [esp + 8]
mov edx, dword [esi + edx]
bswap edx
cmp edx, dword [esp + 0x268]
jae 0x4fc453
mov dword [esp + 0x268], edx
lea esi, [eax + 0xa]
mov edx, dword [esp + 0xc]
cmp esi, edx
ja 0x4fc658
mov dword [esp + 0x2c], ecx
mov word [esp + 0x36], bx
mov ecx, esi
mov esi, dword [esp + 8]
movzx eax, word [esi + eax + 8]
rol ax, 8
mov esi, edx
movzx edx, ax
mov ebx, ecx
mov dword [esp + 0x10], ecx
add edx, ecx
mov dword [esp + 0x18], edx
cmp edx, esi
ja 0x4fc658
mov edx, esi
cmp word [esp + 0x20], 0x1c
je 0x4fc4f3
mov ecx, dword [esp + 0x2c]
cmp ecx, 5
je 0x4fc53a
cmp ecx, 1
mov ecx, dword [esp + 0x18]
jne 0x4fc54a
cmp ax, 4
jne 0x4fc837
mov eax, dword [esp + 0x264]
cmp eax, 0x17
jg 0x4fc54a
lea eax, [eax + eax*4]
mov dword [esp + eax*4 + 0x84], 1
mov ecx, dword [esp + 8]
mov esi, dword [esp + 0x10]
mov ecx, dword [ecx + esi]
mov dword [esp + eax*4 + 0x88], ecx
mov ecx, dword [esp + 0x18]
jmp 0x4fc531
cmp ax, 0x10
jne 0x4fc837
mov eax, dword [esp + 0x264]
cmp eax, 0x17
mov ecx, dword [esp + 0x18]
jg 0x4fc54a
lea eax, [eax + eax*4]
mov dword [esp + eax*4 + 0x84], 0x1c
mov esi, dword [esp + 8]
mov ebx, dword [esp + 0x10]
movdqu xmm0, xmmword [esi + ebx]
movdqu xmmword [esp + eax*4 + 0x88], xmm0
inc dword [esp + 0x264]
jmp 0x4fc54a
mov eax, dword [esp + 0x26c]
cmp eax, 4
mov ecx, dword [esp + 0x18]
jne 0x4fc560
movzx ebx, word [esp + 0x36]
dec bx
mov eax, dword [esp + 8]
jne 0x4fc380
jmp 0x4fc66a
lea ecx, [eax + 1]
mov dword [esp + 0x26c], ecx
mov ecx, dword [esp + 0x18]
shl eax, 4
add eax, esp
add eax, 0x44
mov dword [esp + 0x2c], eax
mov dword [esp + 0x38], 0xffffff80
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0x10]
cmp ebx, edx
jae 0x4fc658
mov esi, ebx
mov dword [esp + 0x10], ebx
movzx esi, byte [eax + ebx]
mov eax, esi
and eax, 0xc0
je 0x4fc5d5
cmp eax, 0xc0
jne 0x4fc81b
mov eax, dword [esp + 0x10]
inc eax
cmp eax, edx
jae 0x4fc658
test esi, esi
je 0x4fc54a
mov ebx, eax
and esi, 0x3f
shl esi, 8
mov eax, dword [esp + 8]
movzx ebx, byte [eax + ebx]
or ebx, esi
jmp 0x4fc644
test esi, esi
je 0x4fc54a
mov ebx, dword [esp + 0x2c]
push ebx
call fcn.004f47e0
add esp, 4
test eax, eax
je 0x4fc604
push 0x74485b
push ebx
call fcn.004fd160
add esp, 8
test eax, eax
jne 0x4fc82d
mov ebx, dword [esp + 0x10]
inc ebx
lea eax, [ebx + esi]
mov dword [esp + 0x10], eax
cmp eax, dword [esp + 0xc]
ja 0x4fc81b
add ebx, dword [esp + 8]
push esi
push ebx
push dword [esp + 0x34]
call fcn.004fd0b0
add esp, 0xc
test eax, eax
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x10]
jne 0x4fc82d
mov esi, 3
inc dword [esp + 0x38]
jne 0x4fc58a
jmp 0x4fc272
mov esi, 2
jmp 0x4fc272
mov dword [esp + 0x20], 0
movzx esi, word [eax + 8]
rol si, 8
test si, si
je 0x4fc718
mov word [esp + 0x24], si
mov ebx, ecx
lea ecx, [ebx + 1]
mov esi, 2
cmp ecx, edx
ja 0x4fc272
movzx eax, byte [eax + ebx]
mov edx, eax
and edx, 0xc0
jne 0x4fc6ba
add ecx, eax
mov edx, dword [esp + 0xc]
cmp ecx, edx
ja 0x4fc272
mov ebx, ecx
test eax, eax
mov eax, dword [esp + 8]
jne 0x4fc682
jmp 0x4fc6d7
cmp edx, 0xc0
jne 0x4fc81b
add ebx, 2
mov ecx, ebx
mov edx, dword [esp + 0xc]
cmp ebx, edx
ja 0x4fc272
lea eax, [ecx + 8]
cmp eax, edx
ja 0x4fc272
lea ebx, [ecx + 0xa]
cmp ebx, edx
ja 0x4fc272
mov eax, dword [esp + 8]
movzx eax, word [eax + ecx + 8]
rol ax, 8
movzx ecx, ax
mov eax, dword [esp + 8]
add ecx, ebx
cmp ecx, edx
ja 0x4fc272
movzx esi, word [esp + 0x24]
dec si
jne 0x4fc67b
movzx esi, word [eax + 0xa]
rol si, 8
test si, si
je 0x4fc7c8
mov word [esp + 0x24], si
mov ebx, ecx
lea ecx, [ebx + 1]
mov esi, 2
cmp ecx, edx
ja 0x4fc272
movzx eax, byte [eax + ebx]
mov edx, eax
and edx, 0xc0
jne 0x4fc768
add ecx, eax
mov edx, dword [esp + 0xc]
cmp ecx, edx
ja 0x4fc272
mov ebx, ecx
test eax, eax
mov eax, dword [esp + 8]
jne 0x4fc730
jmp 0x4fc787
cmp edx, 0xc0
jne 0x4fc81b
mov eax, ebx
add eax, 2
mov ecx, eax
mov edx, dword [esp + 0xc]
cmp eax, edx
ja 0x4fc272
lea eax, [ecx + 8]
cmp eax, edx
ja 0x4fc272
lea ebx, [ecx + 0xa]
cmp ebx, edx
ja 0x4fc272
mov eax, dword [esp + 8]
movzx eax, word [eax + ecx + 8]
rol ax, 8
movzx ecx, ax
mov eax, dword [esp + 8]
add ecx, ebx
cmp ecx, edx
ja 0x4fc272
movzx esi, word [esp + 0x24]
dec si
jne 0x4fc729
mov esi, 7
cmp ecx, edx
jne 0x4fc272
cmp word [esp + 0x20], 2
je 0x4fc7fa
cmp dword [esp + 0x26c], 0
jne 0x4fc7fa
mov esi, 0xb
cmp dword [esp + 0x264], 0
je 0x4fc272
mov dword [esp + edi*4 + 0x3c], 0
push dword [esp + 0x28]
call fcn.004fd060
add esp, 4
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
jmp 0x4fc2c6
xor esi, esi
inc esi
jmp 0x4fc272
mov esi, 0xa
jmp 0x4fc272
mov esi, 5
jmp 0x4fc272
mov esi, 6
jmp 0x4fc272
mov esi, 9
jmp 0x4fc272
mov ebx, 0x1b
jmp 0x4fcd80
cmp dword [esp + 0x3c], 0
mov dword [esp + 0x18], 6
je 0x4fc8bf
cmp dword [esp + 0x40], 0
je 0x4fc8bf
mov ebx, dword [ebp + 8]
cmp dword [esp + 0x26c], 0
jle 0x4fc894
xor esi, esi
lea edi, [esp + 0x44]
push edi
call fcn.004fd060
add esp, 4
inc esi
add edi, 0x10
cmp esi, dword [esp + 0x26c]
jl 0x4fc87e
mov ecx, dword [fcn.005f2b80]
mov esi, dword [ebx + 0x138]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
mov dword [ebx + 0x138], 0
mov ebx, dword [esp + 0x18]
jmp 0x4fcd80
push dword [ebx + 0x444]
push str.DoH_Host_name:__s
mov esi, dword [ebp + 8]
push esi
call fcn.00514fc0
add esp, 0xc
push dword [esp + 0x268]
push str.TTL:__u_seconds
push esi
call fcn.00514fc0
add esp, 0xc
mov esi, dword [esp + 0x264]
test esi, esi
jle 0x4fcb49
lea ebx, [esp + 0x97]
xor edi, edi
mov eax, dword [ebx - 0x13]
cmp eax, 0x1c
je 0x4fc93d
cmp eax, 1
jne 0x4fcb36
movzx eax, byte [ebx - 0xc]
movzx ecx, byte [ebx - 0xd]
movzx edx, byte [ebx - 0xe]
movzx esi, byte [ebx - 0xf]
push eax
push ecx
push edx
push esi
push str.DoH_A:__u._u._u._u
push dword [ebp + 8]
call fcn.00514fc0
add esp, 0x18
jmp 0x4fcb36
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x2e0], xmm0
movdqa xmmword [esp + 0x2d0], xmm0
movdqa xmmword [esp + 0x2c0], xmm0
movdqa xmmword [esp + 0x2b0], xmm0
movdqa xmmword [esp + 0x2a0], xmm0
movdqa xmmword [esp + 0x290], xmm0
movdqa xmmword [esp + 0x280], xmm0
movdqa xmmword [esp + 0x270], xmm0
push str.DoH_AAAA:
push 0x80
lea eax, [esp + 0x278]
push eax
call fcn.0050d0c0
add esp, 0xc
movzx eax, byte [ebx - 0xe]
movzx ecx, byte [ebx - 0xf]
push eax
push ecx
push 0x743187
mov eax, str._s_02x_02x
push eax
mov eax, 0x76
push eax
lea esi, [esp + 0x28e]
push esi
call fcn.0050d0c0
add esp, 0x18
push esi
call fcn.0066b230
add esp, 4
mov dword [esp + 0x1c], edi
mov edi, eax
mov esi, 0x76
sub esi, eax
lea eax, [esp + 0x27a]
add edi, eax
movzx eax, byte [ebx - 0xc]
movzx ecx, byte [ebx - 0xd]
push eax
push ecx
mov eax, 0x74378f
push eax
mov eax, str._s_02x_02x
push eax
push esi
push edi
call fcn.0050d0c0
add esp, 0x18
push edi
call fcn.0066b230
add esp, 4
sub esi, eax
add edi, eax
movzx eax, byte [ebx - 0xa]
movzx ecx, byte [ebx - 0xb]
push eax
push ecx
mov eax, 0x74378f
push eax
mov eax, str._s_02x_02x
push eax
push esi
push edi
call fcn.0050d0c0
add esp, 0x18
push edi
call fcn.0066b230
add esp, 4
sub esi, eax
add edi, eax
movzx eax, byte [ebx - 8]
movzx ecx, byte [ebx - 9]
push eax
push ecx
mov eax, 0x74378f
push eax
mov eax, str._s_02x_02x
push eax
push esi
push edi
call fcn.0050d0c0
add esp, 0x18
push edi
call fcn.0066b230
add esp, 4
sub esi, eax
add edi, eax
movzx eax, byte [ebx - 6]
movzx ecx, byte [ebx - 7]
push eax
push ecx
mov eax, 0x74378f
push eax
mov eax, str._s_02x_02x
push eax
push esi
push edi
call fcn.0050d0c0
add esp, 0x18
push edi
call fcn.0066b230
add esp, 4
sub esi, eax
add edi, eax
movzx eax, byte [ebx - 4]
movzx ecx, byte [ebx - 5]
push eax
push ecx
mov eax, 0x74378f
push eax
mov eax, str._s_02x_02x
push eax
push esi
push edi
call fcn.0050d0c0
add esp, 0x18
push edi
call fcn.0066b230
add esp, 4
sub esi, eax
add edi, eax
movzx eax, byte [ebx - 2]
movzx ecx, byte [ebx - 3]
push eax
push ecx
mov eax, 0x74378f
push eax
mov eax, str._s_02x_02x
push eax
push esi
push edi
call fcn.0050d0c0
add esp, 0x18
push edi
call fcn.0066b230
add esp, 4
sub esi, eax
add edi, eax
movzx eax, byte [ebx]
movzx ecx, byte [ebx - 1]
push eax
push ecx
mov eax, 0x74378f
push eax
mov eax, str._s_02x_02x
push eax
push esi
push edi
mov edi, dword [esp + 0x34]
call fcn.0050d0c0
add esp, 0x18
lea eax, [esp + 0x270]
push eax
push 0x746075
push dword [ebp + 8]
call fcn.00514fc0
add esp, 0xc
inc edi
mov esi, dword [esp + 0x264]
add ebx, 0x14
cmp edi, esi
jl 0x4fc903
cmp dword [esp + 0x26c], 0
mov ebx, dword [ebp + 8]
jle 0x4fcb88
xor esi, esi
lea edi, [esp + 0x44]
push edi
call fcn.004fd280
add esp, 4
push eax
push str.CNAME:__s
push ebx
call fcn.00514fc0
add esp, 0xc
inc esi
add edi, 0x10
cmp esi, dword [esp + 0x26c]
jl 0x4fcb5c
mov esi, dword [esp + 0x264]
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 0x444]
mov dword [esp + 0xc], eax
push eax
call fcn.0066b230
add esp, 4
test esi, esi
jle 0x4fcd55
lea ecx, [eax + 1]
mov dword [esp + 0x20], ecx
movzx ecx, word [edi + 0x440]
mov word [esp + 0x10], cx
add eax, 0x21
lea ecx, [esp + 0x88]
xor edx, edx
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0
mov dword [esp + 8], eax
mov dword [esp + 0x24], edx
mov dword [esp + 0x1c], ecx
mov edi, dword [ecx - 4]
cmp edi, 0x1c
mov ecx, 0x10
cmovne edi, ecx
mov esi, 2
mov ecx, 0x17
cmove esi, ecx
mov ecx, dword [fcn.005f2c20]
lea ebx, [eax + edi]
call dword [section..00cfg]
push ebx
push 1
call ecx
add esp, 8
test eax, eax
je 0x4fcd49
mov ebx, eax
add eax, 0x20
mov dword [ebx + 0x18], eax
lea eax, [ebx + edi + 0x20]
mov dword [ebx + 0x14], eax
push dword [esp + 0x20]
push dword [esp + 0x10]
push eax
call fcn.00650080
add esp, 0xc
mov eax, dword [esp + 0x28]
test eax, eax
cmove eax, ebx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4fcc54
mov dword [eax + 0x1c], ebx
movzx eax, si
mov dword [ebx + 4], eax
mov dword [ebx + 8], 1
mov dword [ebx + 0x10], edi
cmp ax, 0x17
mov ecx, dword [esp + 0x1c]
je 0x4fcc7d
cmp eax, 2
jne 0x4fcca0
mov edi, dword [ebx + 0x18]
mov eax, dword [ecx]
mov dword [edi + 4], eax
jmp 0x4fcc89
mov edi, dword [ebx + 0x18]
movdqu xmm0, xmmword [ecx]
movdqu xmmword [edi + 8], xmm0
mov word [edi], si
movzx eax, word [esp + 0x10]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x1c]
mov word [edi + 2], ax
mov edx, dword [esp + 0x24]
inc edx
add ecx, 0x14
mov dword [esp + 0x30], ebx
cmp edx, dword [esp + 0x264]
mov eax, dword [esp + 8]
jl 0x4fcbda
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x78], 0
je 0x4fccd3
push 2
push 3
push ebx
call fcn.00519930
add esp, 0xc
mov eax, dword [esp + 0x14]
push dword [eax + 0x440]
push dword [eax + 0x444]
mov esi, dword [esp + 0x30]
push esi
push ebx
call fcn.004ffc00
add esp, 0x10
mov edi, eax
cmp dword [ebx + 0x78], 0
je 0x4fcd04
push 3
push ebx
call fcn.00519980
add esp, 8
test edi, edi
je 0x4fcd98
mov dword [ebx + 0x9bc], edi
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
mov dword [esp + 0x18], 0
jmp 0x4fc86e
push dword [esi + 0x9b8]
push str.Could_not_DoH_resolve:__s
push esi
call fcn.00515170
add esp, 0xc
mov eax, dword [esi + 0xc]
xor ebx, ebx
cmp byte [eax + 0x262], 1
adc ebx, 5
jmp 0x4fcd80
push dword [esp + 0x28]
call fcn.004fa8b0
add esp, 4
mov ebx, 0x1b
cmp dword [esp + 0x26c], 0
jle 0x4fcd80
xor esi, esi
lea edi, [esp + 0x44]
push edi
call fcn.004fd060
add esp, 4
inc esi
add edi, 0x10
cmp esi, dword [esp + 0x26c]
jl 0x4fcd6a
mov ecx, dword [esp + 0x2f8]
xor ecx, ebp
call fcn.0064d372
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push esi
call fcn.004fa8b0
add esp, 4
jmp 0x4fc86e