Function at 0x1800035f0
Capabilities:
Resolve dns

Disassembly:
mov r11, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [r11 - 0x6e8]
sub rsp, 0x7c0
mov rax, qword [0x180093030]
xor rax, rsp
mov qword [rbp + 0x6a0], rax
mov qword [r11 + 0x18], rbx
xor r15d, r15d
mov qword [r11 - 0x30], rsi
mov r14, rdx
mov r12, rcx
mov qword [r11 - 0x38], rdi
mov r13d, r15d
lea rcx, [rsp + 0x52]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x50], r15w
call fcn.180030f50
movsxd r11, r13d
imul r11, r11, 0x208
lea rdx, [rsp + 0x50]
lea rcx, [r11 + r14 + 0x26]
sub rdx, rcx
nop word [rax + rax]
movzx eax, word [rcx]
add rcx, 2
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x180003670
lea rcx, [rsp + 0x50]
mov edx, Ordinal_60
call fcn.18002d448
test rax, rax
je 0x1800039de
lea rcx, [rax + 2]
mov word [rax], r15w
call fcn.18002d580
test ax, ax
je 0x1800039de
xor edx, edx
movzx esi, ax
cmp word [r14 + 0x436], r15w
jne 0x1800037b5
lea rcx, [rbp + 0x161]
mov r8d, 0x103
mov byte [rbp + 0x160], r15b
call fcn.180030f50
lea r9, [rsp + 0x50]
lea r8, [0x180085874]
lea rcx, [rbp + 0x160]
mov edx, 0x103
call fcn.18002d350
lea rcx, [rbp + 0x160]
call qword [sym.imp.WS2_32.dll_inet_addr]
mov ebx, eax
cmp eax, 0xffffffff
je 0x180003714
test eax, eax
jne 0x18000379d
mov edx, 1
lea rax, [rsp + 0x38]
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 7]
xor r9d, r9d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.DNSAPI.dll_DnsQuery_W]
test eax, eax
je 0x180003784
mov edx, 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x48], 1
lea r9, [rsp + 0x48]
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 7]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x4c], 0x8080808
mov qword [rsp + 0x20], rax
call qword [sym.imp.DNSAPI.dll_DnsQuery_W]
test eax, eax
jne 0x1800039cb
mov rcx, qword [rsp + 0x38]
mov edx, 1
mov ebx, dword [rcx + 0x20]
xor ebx, 0x8e494418
call qword [sym.imp.DNSAPI.dll_DnsFree]
cmp bl, 0x7f
je 0x1800039cb
movzx edx, si
mov ecx, ebx
call fcn.180002760
jmp 0x1800039aa
lea rcx, [rbp + 0x492]
mov r8d, 0x206
mov word [rbp + 0x490], r15w
call fcn.180030f50
lea r9, [rsp + 0x50]
lea r8, str._s:_d
lea rcx, [rbp + 0x490]
mov edx, 0x103
mov dword [rsp + 0x20], esi
call fcn.18002d1a0
lea rcx, [rbp + 0x271]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x270], r15b
call fcn.180030f50
lea r9, [rsp + 0x50]
lea r8, [0x180085874]
lea rcx, [rbp + 0x270]
mov edx, 0x103
call fcn.18002d350
lea rcx, [rbp + 0x270]
call qword [sym.imp.WS2_32.dll_inet_addr]
mov ebx, eax
cmp eax, 0xffffffff
je 0x180003844
test eax, eax
jne 0x18000390e
mov edx, 1
lea rax, [rsp + 0x30]
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 7]
xor r9d, r9d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.DNSAPI.dll_DnsQuery_W]
test eax, eax
je 0x1800038b5
mov edx, 1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x40], 1
lea r9, [rsp + 0x40]
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 7]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x44], 0x8080808
mov qword [rsp + 0x20], rax
call qword [sym.imp.DNSAPI.dll_DnsQuery_W]
test eax, eax
je 0x1800038b5
mov ebx, r15d
jmp 0x18000390e
mov rcx, qword [rsp + 0x30]
mov edx, 1
mov ebx, dword [rcx + 0x20]
call qword [sym.imp.DNSAPI.dll_DnsFree]
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_inet_ntoa]
lea r8, [0x180085878]
lea rcx, [0x180096170]
mov r9, rax
mov edx, 0x103
call fcn.18002d1a0
lea r9, [0x180096170]
lea r8, str._s:_d
lea rcx, [rbp + 0x490]
mov edx, 0x103
mov dword [rsp + 0x20], esi
call fcn.18002d1a0
cmp bl, 0x7f
je 0x1800039cb
lea rdx, [r14 + 0x436]
lea rcx, [r12 + 0x10]
call fcn.180003b50
test eax, eax
jne 0x1800039cb
lea rcx, [rbp + 0x381]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x380], r15b
call fcn.180030f50
cmp qword [r12 + 0x18], r15
je 0x1800039cb
lea r9, [rbp + 0x490]
lea r8, [0x180085874]
lea rcx, [rbp + 0x380]
mov edx, 0x103
call fcn.18002d350
mov rcx, qword [r12 + 0x18]
lea r8, [rbp + 0x380]
mov edx, 0x2712
call fcn.18003c2b0
test eax, eax
jne 0x1800039cb
mov rcx, qword [r12 + 0x18]
lea edx, [rax + 0xd]
lea r8d, [rax + 0x1e]
call fcn.18003c2b0
test eax, eax
jne 0x1800039cb
lea rcx, [r12 + 0x10]
call fcn.180003cb0
cmp rax, 0xffffffffffffffff
je 0x1800039cb
mov rdx, rax
mov rcx, r12
call fcn.180002960
test eax, eax
jne 0x1800039cb
mov rcx, r12
call fcn.180002f40
test eax, eax
je 0x180003a26
mov rcx, r12
call fcn.180002e70
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
inc r13d
cmp r13d, 2
jl 0x180003633
or eax, 0xffffffff
mov rdi, qword [rsp + 0x7b0]
mov rsi, qword [rsp + 0x7b8]
mov rbx, qword [rsp + 0x800]
mov rcx, qword [rbp + 0x6a0]
xor rcx, rsp
call fcn.18002cf50
add rsp, 0x7c0
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor eax, eax
jmp 0x1800039ee