Function at 0x445e00
Capabilities:
Reference quad9 dns server

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d8287
mov eax, dword fs:[0]
push eax
sub esp, 0x2fc
mov eax, dword [0x50f52c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2f8], eax
push 0x104
lea ecx, [ebp - 0x21c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 1
sub esp, 0x1c
mov dword [ebp - 0x2fc], esp
mov ecx, esp
mov ebx, 7
mov dword [ecx + 0x18], ebx
xor esi, esi
mov dword [ecx + 0x14], esi
xor edx, edx
mov word [ecx + 4], dx
lea eax, [ebp - 0x21c]
lea edi, [eax + 2]
mov dx, word [eax]
add eax, 2
cmp dx, si
jne 0x445e76
sub eax, edi
sar eax, 1
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00401860
mov dword [ebp - 4], esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2b8]
call fcn.004326c0
mov dword [ebp - 4], 1
mov dword [ebp - 0x2bc], ebx
mov dword [ebp - 0x2c0], esi
xor ecx, ecx
mov word [ebp - 0x2d0], cx
push ebx
push str.9.9.9.9
lea ecx, [ebp - 0x2d4]
call fcn.00401860
mov byte [ebp - 4], 2
lea edx, [ebp - 0x2d4]
push edx
lea ecx, [ebp - 0x2ec]
call fcn.004306b0
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x2b8]
call fcn.0042f7f0
mov edi, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2ec]
call fcn.00403370
mov byte [ebp - 4], 1
cmp dword [ebp - 0x2bc], 8
jb 0x445f27
mov eax, dword [ebp - 0x2d0]
push eax
call fcn.004b29fa
add esp, 4
mov dword [ebp - 0x2bc], ebx
mov dword [ebp - 0x2c0], esi
xor ecx, ecx
mov word [ebp - 0x2d0], cx
cmp edi, esi
je 0x445fb2
mov dword [ebp - 0x2d8], ebx
mov dword [ebp - 0x2dc], esi
xor edx, edx
mov word [ebp - 0x2ec], dx
push 6
push str.VSInit
lea ecx, [ebp - 0x2f0]
call fcn.00401860
mov byte [ebp - 4], 5
mov dword [ebp - 0x2bc], ebx
mov dword [ebp - 0x2c0], esi
xor eax, eax
mov word [ebp - 0x2d0], ax
push 0x29
push str.Skipping_patching_of_post_Curacao_version
lea ecx, [ebp - 0x2d4]
call fcn.00401860
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2f0]
push ecx
lea edx, [ebp - 0x2d4]
push edx
call fcn.00419d40
mov byte [ebp - 4], 5
jmp 0x4465d9
mov edi, dword [ebp - 0x2f8]
push edi
call dword [sym.imp.dbghelp.dll_ImageNtHeader]
cmp eax, esi
jne 0x446005
push str.VSInit
lea ecx, [ebp - 0x2f0]
call fcn.004019e0
mov byte [ebp - 4], bl
push str.ImageNtHeader_failed.
lea ecx, [ebp - 0x2d4]
call fcn.004019e0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x2f0]
push ecx
lea edx, [ebp - 0x2d4]
push edx
call fcn.00419d40
mov byte [ebp - 4], bl
jmp 0x4465d9
mov ecx, edi
mov dword [ebp - 0x2f8], ecx
mov eax, dword [eax + 0x50]
sub eax, 0xb
mov dword [ebp - 0x2fc], eax
xor edi, edi
mov dword [ebp - 0x2f4], edi
cmp edi, eax
jge 0x446061
mov byte [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x304], eax
cmp eax, 0xb
jge 0x446051
lea edx, [eax + edi]
mov dl, byte [edx + ecx]
and dl, byte [eax + 0x4e6750]
cmp dl, byte [eax + 0x4e675c]
jne 0x446128
inc eax
jmp 0x44602b
mov byte [ebp - 4], 1
cmp edi, dword [ebp - 0x2fc]
jl 0x44617e
mov dword [ebp - 0x2d8], ebx
mov dword [ebp - 0x2dc], esi
xor ecx, ecx
mov word [ebp - 0x2ec], cx
push 6
push str.VSInit
lea ecx, [ebp - 0x2f0]
call fcn.00401860
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x2bc], ebx
mov dword [ebp - 0x2c0], esi
xor edx, edx
mov word [ebp - 0x2d0], dx
push 0x11
push str.No_patch_required
lea ecx, [ebp - 0x2d4]
call fcn.00401860
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x2f0]
push eax
lea ecx, [ebp - 0x2d4]
push ecx
call fcn.00419d40
mov byte [ebp - 4], 0xb
mov edi, 8
cmp dword [ebp - 0x2bc], edi
jb 0x4460ea
mov edx, dword [ebp - 0x2d0]
push edx
call fcn.004b29fa
add esp, 4
mov dword [ebp - 0x2bc], ebx
mov dword [ebp - 0x2c0], esi
xor eax, eax
mov word [ebp - 0x2d0], ax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x2d8], edi
jb 0x44611a
mov ecx, dword [ebp - 0x2ec]
push ecx
call fcn.004b29fa
add esp, 4
xor edx, edx
mov word [ebp - 0x2ec], dx
jmp 0x44662e
mov dword [ebp - 4], 1
inc edi
mov eax, dword [ebp - 0x2fc]
jmp 0x44601b
add edi, ecx
lea eax, [ebp - 0x300]
push eax
push 4
push 2
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x446265
mov dword [ebp - 0x2d8], ebx
mov dword [ebp - 0x2dc], esi
xor ecx, ecx
mov word [ebp - 0x2ec], cx
push 6
push str.VSInit
lea ecx, [ebp - 0x2f0]
call fcn.00401860
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x2bc], ebx
mov dword [ebp - 0x2c0], esi
xor edx, edx
mov word [ebp - 0x2d0], dx
push 0x16
push str.VirtualProtect_failed.
lea ecx, [ebp - 0x2d4]
call fcn.00401860
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x2f0]
push eax
lea ecx, [ebp - 0x2d4]
push ecx
call fcn.00419d40
mov byte [ebp - 4], 0xd
mov edi, 8
cmp dword [ebp - 0x2bc], edi
jb 0x446223
mov edx, dword [ebp - 0x2d0]
push edx
call fcn.004b29fa
add esp, 4
mov dword [ebp - 0x2bc], ebx
mov dword [ebp - 0x2c0], esi
xor eax, eax
mov word [ebp - 0x2d0], ax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x2d8], edi
jb 0x44611a
mov ecx, dword [ebp - 0x2ec]
push ecx
call fcn.004b29fa
add esp, 4
xor edx, edx
mov word [ebp - 0x2ec], dx
jmp 0x44662e
mov ax, word [0x4e6768]
mov word [edi], ax
lea ecx, [ebp - 0x300]
push ecx
mov edx, dword [ebp - 0x300]
push edx
push 2
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x2d8], ebx
mov dword [ebp - 0x2dc], esi
xor eax, eax
mov word [ebp - 0x2ec], ax
push 6
push str.VSInit
lea ecx, [ebp - 0x2f0]
call fcn.00401860
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x2bc], ebx
mov dword [ebp - 0x2c0], esi
xor ecx, ecx
mov word [ebp - 0x2d0], cx
push 0x10
push str.Module_patched_1
lea ecx, [ebp - 0x2d4]
call fcn.00401860
mov byte [ebp - 4], 0x10
lea edx, [ebp - 0x2f0]
push edx
lea eax, [ebp - 0x2d4]
push eax
call fcn.00419d40
mov byte [ebp - 4], 0xf
mov edi, 8
cmp dword [ebp - 0x2bc], edi
jb 0x44630e
mov ecx, dword [ebp - 0x2d0]
push ecx
call fcn.004b29fa
add esp, 4
mov dword [ebp - 0x2bc], ebx
mov dword [ebp - 0x2c0], esi
xor edx, edx
mov word [ebp - 0x2d0], dx
mov byte [ebp - 4], 1
cmp dword [ebp - 0x2d8], edi
jb 0x44633e
mov eax, dword [ebp - 0x2ec]
push eax
call fcn.004b29fa
add esp, 4
mov dword [ebp - 0x2d8], ebx
mov dword [ebp - 0x2dc], esi
xor ecx, ecx
mov word [ebp - 0x2ec], cx
xor edi, edi
mov dword [ebp - 0x2f4], edi
cmp edi, dword [ebp - 0x2fc]
jge 0x4463a5
mov byte [ebp - 4], 0x11
xor eax, eax
mov dword [ebp - 0x308], eax
cmp eax, 8
jge 0x446395
lea edx, [eax + edi]
mov ecx, dword [ebp - 0x2f8]
mov dl, byte [edx + ecx]
and dl, byte [eax + 0x4e676c]
cmp dl, byte [eax + 0x4e6774]
jne 0x446470
inc eax
jmp 0x446369
mov byte [ebp - 4], 1
cmp edi, dword [ebp - 0x2fc]
jl 0x4464b4
mov dword [ebp - 0x2d8], ebx
mov dword [ebp - 0x2dc], esi
xor ecx, ecx
mov word [ebp - 0x2ec], cx
push 6
push str.VSInit
lea ecx, [ebp - 0x2f0]
call fcn.00401860
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x2bc], ebx
mov dword [ebp - 0x2c0], esi
xor edx, edx
mov word [ebp - 0x2d0], dx
push 0x11
push str.No_patch_required
lea ecx, [ebp - 0x2d4]
call fcn.00401860
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x2f0]
push eax
lea ecx, [ebp - 0x2d4]
push ecx
call fcn.00419d40
mov byte [ebp - 4], 0x13
mov edi, 8
cmp dword [ebp - 0x2bc], edi
jb 0x44642e
mov edx, dword [ebp - 0x2d0]
push edx
call fcn.004b29fa
add esp, 4
mov dword [ebp - 0x2bc], ebx
mov dword [ebp - 0x2c0], esi
xor eax, eax
mov word [ebp - 0x2d0], ax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x2d8], edi
jb 0x44611a
mov ecx, dword [ebp - 0x2ec]
push ecx
call fcn.004b29fa
add esp, 4
xor edx, edx
mov word [ebp - 0x2ec], dx
jmp 0x44662e
mov dword [ebp - 4], 1
inc edi
jmp 0x446355
mov eax, dword [ebp - 0x2f8]
add edi, eax
lea ecx, [ebp - 0x300]
push ecx
push 4
push 8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x446544
mov dword [ebp - 0x2d8], ebx
mov dword [ebp - 0x2dc], esi
xor edx, edx
mov word [ebp - 0x2ec], dx
push 6
push str.VSInit
lea ecx, [ebp - 0x2f0]
call fcn.00401860
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x2bc], ebx
mov dword [ebp - 0x2c0], esi
xor eax, eax
mov word [ebp - 0x2d0], ax
push 0x16
push str.VirtualProtect_failed.
lea ecx, [ebp - 0x2d4]
call fcn.00401860
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x2f0]
push ecx
lea edx, [ebp - 0x2d4]
push edx
call fcn.00419d40
mov byte [ebp - 4], 0x15
jmp 0x4465d9
mov ecx, dword [0x4e677c]
mov dword [edi], ecx
mov edx, dword [0x4e6780]
mov dword [edi + 4], edx
lea eax, [ebp - 0x300]
push eax
mov ecx, dword [ebp - 0x300]
push ecx
push 8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x2d8], ebx
mov dword [ebp - 0x2dc], esi
xor edx, edx
mov word [ebp - 0x2ec], dx
push 6
push str.VSInit
lea ecx, [ebp - 0x2f0]
call fcn.00401860
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x2bc], ebx
mov dword [ebp - 0x2c0], esi
xor eax, eax
mov word [ebp - 0x2d0], ax
push 0x10
push str.Module_patched_2
lea ecx, [ebp - 0x2d4]
call fcn.00401860
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x2f0]
push ecx
lea edx, [ebp - 0x2d4]
push edx
call fcn.00419d40
mov byte [ebp - 4], 0x17
mov edi, 8
cmp dword [ebp - 0x2bc], edi
jb 0x4465f5
mov eax, dword [ebp - 0x2d0]
push eax
call fcn.004b29fa
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x2bc], ebx
mov dword [ebp - 0x2c0], esi
mov word [ebp - 0x2d0], cx
mov byte [ebp - 4], 1
cmp dword [ebp - 0x2d8], edi
jb 0x446625
mov edx, dword [ebp - 0x2ec]
push edx
call fcn.004b29fa
add esp, 4
xor eax, eax
mov word [ebp - 0x2ec], ax
mov dword [ebp - 0x2d8], ebx
mov dword [ebp - 0x2dc], esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2b8]
call fcn.00403750
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004b3057
mov esp, ebp
pop ebp
ret 4