Function at 0x1400e3bc0
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1e0
mov rsi, rcx
mov r14, qword [rdx]
mov rbx, qword [rdx + 8]
movzx edi, word [rdx + 0x10]
mov rax, qword [0x1401a4130]
cmp rax, 3
jne 0x1400e3b8b
cmp rbx, 0x17f
ja 0x1400e3b9d
lea r15, [rsp + 0x60]
mov rcx, r15
mov rdx, r14
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov byte [rsp + rbx + 0x60], 0
lea rax, [rbx + 1]
cmp rbx, 0xe
ja 0x1400e3a48
xor edx, edx
nop
cmp byte [rsp + rdx + 0x60], 0
je 0x1400e3af4
inc rdx
cmp rax, rdx
jne 0x1400e3a30
jmp 0x1400e3b52
lea rcx, [rsp + 0x67]
and rcx, 0xfffffffffffffff8
sub rcx, r15
je 0x1400e3a7e
je 0x1400e3a7e
xor edx, edx
nop word [rax + rax]
cmp byte [rsp + rdx + 0x60], 0
je 0x1400e3af4
inc rdx
cmp rcx, rdx
jne 0x1400e3a60
lea rdx, [rbx - 0xf]
cmp rcx, rdx
jbe 0x1400e3a84
jmp 0x1400e3ace
lea rdx, [rbx - 0xf]
xor ecx, ecx
movdqa xmm0, xmmword [0x1401281a0]
movabs r8, 0x8080808080808080
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rsp + rcx + 0x60]
movdqa xmm2, xmm1
paddq xmm2, xmm0
pandn xmm1, xmm2
pshufd xmm2, xmm1, 0xee
por xmm2, xmm1
movq r9, xmm2
test r9, r8
jne 0x1400e3ace
add rcx, 0x10
cmp rcx, rdx
jbe 0x1400e3aa0
sub rax, rcx
je 0x1400e3b52
lea r8, [rsp + rcx]
add r8, 0x60
xor edx, edx
nop dword [rax]
cmp byte [r8 + rdx], 0
je 0x1400e3af1
inc rdx
cmp rax, rdx
jne 0x1400e3ae0
jmp 0x1400e3b52
add rdx, rcx
cmp rdx, rbx
jne 0x1400e3b52
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x60]
lea r8, [rsp + 0x30]
lea r9, [rsp + 0x28]
xor edx, edx
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x1400e3b66
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x1400e3b79
lea rax, [0x1401727b8]
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x1400e3b7c
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], di
xor eax, eax
mov qword [rsi], rax
add rsp, 0x1e0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1400dff60
cmp rbx, 0x17f
jbe 0x1400e3a0a
mov rcx, rsi
mov rdx, r14
mov r8, rbx
mov r9d, edi
add rsp, 0x1e0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp 0x1400e3bc0
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov ebx, r9d
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.14000df40
mov r8, qword [rsp + 0x30]
test r8, r8
je 0x1400e3c1e
lea rax, [0x1401727b8]
mov qword [rsi + 8], rax
mov qword [rsi], 1
cmp qword [rsp + 0x38], 0
je 0x1400e3c95
mov rcx, qword [0x1401a4160]
xor edx, edx
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
jmp sub.KERNEL32.dll_HeapFree
mov rdi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x28]
mov rcx, rdi
xor edx, edx
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x1400e3ca3
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov byte [rdi], 0
test r14, r14
je 0x1400e3c95
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], bx
xor eax, eax
mov qword [rsi], rax
mov byte [rdi], 0
test r14, r14
jne 0x1400e3c84
jmp 0x1400e3c95