Function at 0x1801b2940
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
movzx r13d, word [rcx + 2]
mov r15, rcx
mov r12d, edx
xor ebx, ebx
mov dword [0x18029ccf4], ebx
xor esi, esi
movzx eax, byte [rcx + 0x11]
and r13d, 1
mov rdx, qword [r15 + 0x18]
xor r14d, r14d
imul ecx, eax, 0x3e8
xor ebp, ebp
movzx eax, byte [r15 + 0x10]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x98], r13d
add ecx, eax
mov dword [rsp + 0x90], ecx
mov rcx, r15
call fcn.1801b50f0
mov rdi, rax
test rax, rax
je 0x1801b29f2
mov r8d, r13d
mov edx, 0x81
mov rcx, rax
call fcn.1801b4e80
mov ebp, eax
test eax, eax
je 0x1801b2e0b
mov ecx, eax
call fcn.1801aecb0
mov qword [rsp + 0x30], rax
mov rsi, rax
test rax, rax
je 0x1801b2e0b
mov r9d, r13d
mov r8, rdi
mov edx, ebp
mov rcx, rax
call fcn.1801b4e30
mov r13, rsi
jmp 0x1801b29f9
lea r13, [0x180056640]
movzx ebx, word [r15 + 0x12]
mov dword [rsp + 0x80], ebx
cmp ebx, 0xfffe
jne 0x1801b2a55
cmp byte [r13], r14b
jne 0x1801b2a25
mov dword [0x18029ccf4], 4
mov rcx, rsi
jmp 0x1801b2e83
mov rdx, r13
mov ecx, 8
call fcn.1801af3f0
test eax, eax
jne 0x1801b2a48
mov dword [0x18029ccf4], 0x29
mov rcx, rsi
jmp 0x1801b2e83
dec ax
movzx eax, ax
mov dword [rsp + 0x80], eax
call fcn.1801b2eb0
cmp dword [0x1802b1e60], r14d
jne 0x1801b2a75
mov dword [0x18029ccf4], 0x60
mov rcx, rsi
jmp 0x1801b2e83
mov r9d, ebp
mov r8, r13
mov edx, r12d
mov rcx, r15
call fcn.1801b21a0
mov rbx, rax
test rax, rax
je 0x1801b2e0b
call fcn.1801b3660
mov rdx, qword [r15 + 0x20]
mov rcx, r15
movzx edi, al
call fcn.1801b50f0
mov rsi, rax
test rax, rax
je 0x1801b2b84
cmp byte [rax], r14b
je 0x1801b2b84
mov r15d, dword [rsp + 0x98]
mov edx, 0x200
mov r8d, r15d
mov rcx, rax
call fcn.1801b4e80
mov ebp, eax
test eax, eax
je 0x1801b2e0b
mov ecx, eax
call fcn.1801aecb0
mov rdi, rax
test rax, rax
je 0x1801b2e0b
mov r9d, dword [0x18029cd24]
mov r8, rsi
mov edx, ebp
mov rcx, rax
call fcn.1801b4e30
mov rcx, rdi
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
je 0x1801b2b19
mov dword [rbx + 0x8c], eax
jmp 0x1801b2b62
mov rcx, rdi
call sub.WS2_32.dll_gethostbyname
mov rcx, rdi
mov rsi, rax
call fcn.18010fbc0
test rsi, rsi
jne 0x1801b2b4a
mov rcx, qword [rsp + 0x30]
mov dword [0x18029ccf4], 0x69
call fcn.18010fbc0
jmp 0x1801b2e1f
mov rdx, qword [rsi + 0x18]
lea rcx, [rbx + 0x8c]
movsx r8, word [rsi + 0x12]
mov rdx, qword [rdx]
call fcn.18020b840
mov eax, dword [rsp + 0x90]
xor r9d, r9d
mov r8d, dword [rsp + 0x80]
xor edx, edx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r15d
jmp 0x1801b2e00
test dil, dil
je 0x1801b2cc3
mov rdi, qword [0x1802b4568]
test rdi, rdi
je 0x1801b2e0b
mov esi, dword [rsp + 0x80]
cmp dword [rdi + 0xc], 0
je 0x1801b2cb2
mov eax, dword [rdi + 8]
cmp eax, 0xffffffff
je 0x1801b2bbe
mov dword [rbx + 0x8c], eax
jmp 0x1801b2be8
lea rcx, [rdi + 0x10]
call sub.WS2_32.dll_gethostbyname
test rax, rax
je 0x1801b2cb2
mov rdx, qword [rax + 0x18]
lea rcx, [rbx + 0x8c]
movsx r8, word [rax + 0x12]
mov rdx, qword [rdx]
call fcn.18020b840
mov eax, dword [rsp + 0x90]
xor r9d, r9d
mov dword [rsp + 0x28], eax
mov r8d, esi
mov eax, dword [rsp + 0x98]
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x20], eax
mov dword [0x18029ccf4], 0
call fcn.1801b2350
mov r14d, eax
test eax, eax
jne 0x1801b2e0b
test rbx, rbx
je 0x1801b2c95
mov rcx, qword [rbx + 8]
call sub.WS2_32.dll_closesocket
mov qword [rbx + 8], 0xffffffffffffffff
lea rdx, [0x1802b1e78]
mov rcx, qword [0x1802b1e78]
test rcx, rcx
je 0x1801b2c68
nop dword [rax]
mov rax, qword [rcx]
cmp rcx, rbx
je 0x1801b2c65
mov rdx, rcx
mov rcx, rax
test rax, rax
jne 0x1801b2c50
jmp 0x1801b2c68
mov qword [rdx], rax
mov rcx, qword [rbx + 0x70]
call fcn.18010fbc0
mov rcx, qword [rbx + 0x98]
test rcx, rcx
je 0x1801b2c8d
call fcn.18010fbc0
mov qword [rbx + 0x98], 0
mov rcx, rbx
call fcn.18010fbc0
mov r9d, ebp
mov r8, r13
mov edx, r12d
mov rcx, r15
call fcn.1801b21a0
mov rbx, rax
test rax, rax
je 0x1801b2e0b
mov rdi, qword [rdi]
test rdi, rdi
jne 0x1801b2ba4
jmp 0x1801b2e0b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r12d, dword [rsp + 0x80]
xor ebp, ebp
mov esi, eax
nop word [rax + rax]
mov r8d, r12d
mov rdx, r13
mov rcx, r15
add esi, 0xbb8
call fcn.1801b39e0
test eax, eax
je 0x1801b2e0b
lea rdx, [rsp + 0x80]
mov ecx, esi
call fcn.1801b3ef0
mov rdi, rax
test rax, rax
je 0x1801b2d46
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rdi + 4]
mov dword [0x18029ccf4], ecx
test cx, cx
je 0x1801b2d7f
lea rdx, [rsp + 0x80]
mov ecx, esi
call fcn.1801b3ef0
mov rdi, rax
test rax, rax
jne 0x1801b2d20
test ebp, ebp
jne 0x1801b2d57
call fcn.1801b3cd0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
inc ebp
cmp ebp, 3
jl 0x1801b2ce0
test rdi, rdi
jne 0x1801b2d7f
cmp dword [0x18029ccf4], r14d
jne 0x1801b2e0b
mov dword [0x18029ccf4], 0x69
jmp 0x1801b2e0b
movzx eax, byte [rdi + 0xe]
movzx ecx, byte [rdi + 0x15]
movzx esi, byte [rdi + 0xf]
shl esi, 8
or esi, eax
shl cx, 8
movzx eax, byte [rdi + 0xd]
shl esi, 8
or esi, eax
movzx eax, byte [rdi + 0xc]
shl esi, 8
or esi, eax
movzx eax, byte [rdi + 0x14]
or cx, ax
mov word [rbx + 0x7c], cx
movzx eax, byte [rdi + 0x10]
movzx ecx, byte [rdi + 0x11]
shl cx, 8
or cx, ax
mov eax, dword [rsp + 0x80]
mov word [rbx + 0x7a], cx
mov dword [rbx + 0x8c], eax
xor edx, edx
xor ecx, ecx
call fcn.1801b3ef0
test rax, rax
jne 0x1801b2dd1
mov eax, dword [rsp + 0x90]
mov r9d, esi
mov dword [rsp + 0x28], eax
mov r8d, r12d
mov eax, dword [rsp + 0x98]
mov edx, 1
mov dword [rsp + 0x20], eax
mov rcx, rbx
call fcn.1801b2350
mov r14d, eax
mov rcx, qword [rsp + 0x30]
call fcn.18010fbc0
test r14d, r14d
jne 0x1801b2e88
test rbx, rbx
je 0x1801b2e88
mov rcx, qword [rbx + 8]
call sub.WS2_32.dll_closesocket
mov qword [rbx + 8], 0xffffffffffffffff
mov rcx, qword [0x1802b1e78]
test rcx, rcx
je 0x1801b2e5b
lea rdx, [0x1802b1e78]
mov rax, qword [rcx]
cmp rcx, rbx
je 0x1801b2e58
mov rdx, rcx
mov rcx, rax
test rax, rax
jne 0x1801b2e43
jmp 0x1801b2e5b
mov qword [rdx], rax
mov rcx, qword [rbx + 0x70]
call fcn.18010fbc0
mov rcx, qword [rbx + 0x98]
test rcx, rcx
je 0x1801b2e80
call fcn.18010fbc0
mov qword [rbx + 0x98], 0
mov rcx, rbx
call fcn.18010fbc0
mov rbx, qword [rsp + 0x88]
mov eax, r14d
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret