Function at 0x6ecc34e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
mov eax, 0x10b8
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
call fcn.6ecc2074
sub esp, eax
mov eax, dword [ecx + 0x10]
mov esi, dword [ecx]
mov dword [ebp - 0x107c], 0x1000
mov ebx, dword [ecx + 4]
mov edi, dword [ecx + 8]
mov dword [ebp - 0x1090], eax
lea eax, [ebp - 0x1018]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x1060], eax
lea eax, [ebp - 0x107c]
mov ecx, dword [ecx + 0x14]
mov dword [ebp - 0x106c], esi
mov word [ebp - 0x1068], bx
mov dword [ebp - 0x1064], edi
mov dword [ebp - 0x105c], eax
test byte [0x6ecc905c], 8
jne 0x6ecc3660
test esi, esi
je 0x6ecc3640
mov eax, dword [ebp - 0x1090]
test eax, eax
je 0x6ecc3640
cmp bx, 1
je 0x6ecc3990
cmp bx, 0x1c
je 0x6ecc38c0
mov dword [esp + 0xc], edx
mov eax, dword [0x6ecc90b0]
mov edx, dword [0x6ecc90b4]
mov dword [esp + 8], 2
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [0x6ecc90ac]
mov dword [ebp - 0x108c], eax
sub esp, 0x10
test eax, eax
jne 0x6ecc364a
lea eax, [ebp - 0x106c]
mov edx, dword [0x6ecc90b4]
mov dword [esp + 8], 3
mov dword [esp + 0xc], eax
mov eax, dword [0x6ecc90b0]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [0x6ecc90ac]
sub esp, 0x10
test eax, eax
jne 0x6ecc3710
mov edx, dword [ebp - 0x107c]
cmp edx, 0xb
jbe 0x6ecc3980
movzx eax, byte [ebp - 0x1015]
rol word [ebp - 0x1018], 8
rol word [ebp - 0x1014], 8
and eax, 0xf
rol word [ebp - 0x1012], 8
rol word [ebp - 0x1010], 8
rol word [ebp - 0x100e], 8
cmp al, 0xa
ja case.0x6ecc3636.4
movzx eax, al
jmp dword [eax*4 + 0x6eccb1e4]
mov dword [ebp - 0x108c], 0x57
mov eax, dword [ebp - 0x108c]
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x18
movzx eax, bx
mov dword [ebp - 0x1098], ecx
mov dword [esp], eax
mov dword [ebp - 0x1094], edx
call sym._debugstr_type
mov dword [ebp - 0x108c], eax
mov eax, esi
call sym._wine_dbgstr_an.constprop.0_2
mov edx, dword [ebp - 0x1090]
mov ecx, dword [ebp - 0x1098]
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], edx
mov edx, dword [ebp - 0x1094]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], edx
mov edx, dword [ebp - 0x108c]
mov dword [esp + 0xc], str.__s___s___lx___p___p___p__n
mov dword [esp + 0x14], edx
mov dword [esp + 8], str.DnsQuery_UTF8
mov dword [esp + 4], 0x6ecc905c
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
mov edx, dword [ebp - 0x1094]
jmp 0x6ecc3556
mov eax, dword [ebp - 0x1090]
movzx edx, dx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
lea eax, [ebp - 0x1018]
mov dword [esp], eax
call sym.dnsapi.dll_DnsExtractRecordsFromMessage_UTF8
sub esp, 0xc
lea esi, [esi]
cmp bx, 1
sete dl
cmp eax, 0x232b
sete cl
and edx, ecx
test dl, dl
je 0x6ecc3a60
and edi, 0x80
mov ebx, edi
jne 0x6ecc3970
test byte [0x6ecc905c], 8
jne 0x6ecc3b00
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov edx, eax
cmp eax, 0xf
ja 0x6ecc3970
lea eax, [ebp - 0x1074]
mov ecx, 0x10
lea edi, [ebp - 0x1058]
mov dword [ebp - 0x1074], 0
mov dword [ebp - 0x1070], eax
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x104e]
mov dword [esp + 8], edx
mov ecx, 0x2020
mov dword [esp + 4], esi
mov dword [esp], eax
mov word [ebp - 0x1042], cx
mov byte [ebp - 0x1058], 0x78
mov dword [ebp - 0x104e], 0x20202020
mov dword [ebp - 0x104a], 0x20202020
mov dword [ebp - 0x1046], 0x20202020
mov byte [ebp - 0x1040], 0x20
call sym._memcpy
lea eax, [ebp - 0x1058]
mov byte [ebp - 0x103f], 0
mov dword [esp], eax
call sym._Netbios_4
sub esp, 4
test al, al
jne 0x6ecc3b50
mov eax, dword [ebp - 0x1054]
cmp word [eax], 0
mov dword [ebp - 0x1098], eax
je 0x6ecc3b5f
mov dword [ebp - 0x1094], esi
lea edi, [eax + 9]
jmp 0x6ecc3856
mov eax, 1
mov dword [esi + 0x10], 0x4b0
inc ebx
add edi, 0x15
mov word [esi + 8], ax
movzx eax, byte [esi + 0xc]
and eax, 0xffffffe4
or eax, 0x11
mov byte [esi + 0xc], al
mov eax, dword [edi - 0x15]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x1070]
mov dword [eax], esi
mov eax, dword [ebp - 0x1098]
mov dword [ebp - 0x1070], esi
movzx eax, word [eax]
cmp ebx, eax
jae 0x6ecc3b30
mov dword [esp + 4], 0x40
mov dword [esp], 1
call dword [sym.imp.ucrtbase.dll_calloc]
mov esi, eax
test eax, eax
je 0x6ecc3887
mov eax, dword [ebp - 0x1094]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__strdup]
mov dword [esi + 4], eax
test eax, eax
jne 0x6ecc3810
mov eax, dword [ebp - 0x1070]
mov dword [eax], 0
mov eax, dword [ebp - 0x1074]
mov dword [esp + 4], 1
mov dword [esp], eax
call sym.dnsapi.dll_DnsRecordListFree
mov dword [ebp - 0x108c], 8
sub esp, 8
jmp 0x6ecc364a
lea eax, [ebp - 0x1058]
mov dword [esp], esi
mov dword [esp + 8], eax
lea eax, [ebp - 0x1078]
mov dword [esp + 4], eax
mov dword [ebp - 0x108c], edx
call sym._RtlIpv6StringToAddressA_12
mov edx, dword [ebp - 0x108c]
sub esp, 0xc
test eax, eax
jne 0x6ecc3580
mov eax, dword [ebp - 0x1078]
cmp byte [eax], 0
jne 0x6ecc3580
mov dword [esp + 4], 0x40
mov dword [esp], 1
call dword [sym.imp.ucrtbase.dll_calloc]
mov edx, dword [ebp - 0x108c]
test eax, eax
mov ecx, eax
je 0x6ecc3580
mov eax, dword [ebp - 0x1058]
mov edi, 0x10
mov word [ecx + 0xa], di
mov dword [ecx + 0x18], eax
mov eax, dword [ebp - 0x1054]
mov dword [ecx + 0x1c], eax
mov eax, dword [ebp - 0x1050]
mov dword [ecx + 0x20], eax
mov eax, dword [ebp - 0x104c]
mov dword [ecx + 0x24], eax
jmp 0x6ecc3a11
cmp bx, 1
je 0x6ecc3729
lea esi, [esi]
mov dword [ebp - 0x108c], 0x232b
jmp 0x6ecc364a
mov dword [ebp - 0x108c], 0x251e
jmp 0x6ecc364a
lea eax, [ebp - 0x1058]
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x1078]
mov dword [esp + 8], eax
mov dword [esp], esi
mov dword [ebp - 0x108c], edx
call sym._RtlIpv4StringToAddressA_16
mov edx, dword [ebp - 0x108c]
sub esp, 0x10
test eax, eax
jne 0x6ecc3580
mov eax, dword [ebp - 0x1078]
cmp byte [eax], 0
jne 0x6ecc3580
mov dword [esp + 4], 0x40
mov dword [esp], 1
call dword [sym.imp.ucrtbase.dll_calloc]
mov edx, dword [ebp - 0x108c]
test eax, eax
mov ecx, eax
je 0x6ecc3580
mov eax, dword [ebp - 0x1058]
mov dword [ecx + 0x18], eax
mov eax, 4
mov word [ecx + 0xa], ax
mov word [ecx + 8], bx
mov dword [ecx + 0x10], 0x93a80
mov dword [ebp - 0x108c], ecx
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll__strdup]
mov ecx, dword [ebp - 0x108c]
mov dword [ebp - 0x108c], 0
mov dword [ecx + 4], eax
mov eax, dword [ecx + 0xc]
and eax, 0xe7
or eax, 0x2010
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 0x1090]
mov dword [eax], ecx
jmp 0x6ecc364a
mov dword [ebp - 0x108c], eax
jmp 0x6ecc364a
mov dword [ebp - 0x108c], 0x2329
jmp 0x6ecc364a
mov dword [ebp - 0x108c], 0x232a
jmp 0x6ecc364a
mov dword [ebp - 0x108c], 0x2332
jmp 0x6ecc364a
mov dword [ebp - 0x108c], 0x2331
jmp 0x6ecc364a
mov dword [ebp - 0x108c], 0x2330
jmp 0x6ecc364a
mov dword [ebp - 0x108c], 0x232f
jmp 0x6ecc364a
mov dword [ebp - 0x108c], 0x232e
jmp 0x6ecc364a
mov dword [ebp - 0x108c], 0x232d
jmp 0x6ecc364a
mov dword [ebp - 0x108c], 0x232c
jmp 0x6ecc364a
mov dword [esp + 0xc], str.dns_lookup_failed__trying_netbios_query_n
mov dword [esp + 8], str.DnsQuery_UTF8
mov dword [esp + 4], 0x6ecc905c
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
jmp 0x6ecc3744
mov edx, esi
mov dword [edx], 0
mov edi, dword [ebp - 0x1090]
mov eax, dword [ebp - 0x1074]
mov dword [edi], eax
jmp 0x6ecc364a
mov dword [ebp - 0x108c], 0x7b
jmp 0x6ecc364a
mov edx, dword [ebp - 0x1070]
jmp 0x6ecc3b32