Function at 0x1801b2860
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
movzx r13d, word [rcx + 2]
mov r15, rcx
mov r12d, edx
xor ebx, ebx
mov dword [0x18029ccf4], ebx
xor esi, esi
movzx eax, byte [rcx + 0x11]
and r13d, 1
mov rdx, qword [r15 + 0x18]
xor r14d, r14d
imul ecx, eax, 0x3e8
xor ebp, ebp
movzx eax, byte [r15 + 0x10]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x98], r13d
add ecx, eax
mov dword [rsp + 0x90], ecx
mov rcx, r15
call fcn.1801b5010
mov rdi, rax
test rax, rax
je 0x1801b2912
mov r8d, r13d
mov edx, 0x81
mov rcx, rax
call fcn.1801b4da0
mov ebp, eax
test eax, eax
je 0x1801b2d2b
mov ecx, eax
call fcn.1801aebd0
mov qword [rsp + 0x30], rax
mov rsi, rax
test rax, rax
je 0x1801b2d2b
mov r9d, r13d
mov r8, rdi
mov edx, ebp
mov rcx, rax
call fcn.1801b4d50
mov r13, rsi
jmp 0x1801b2919
lea r13, [0x180056640]
movzx ebx, word [r15 + 0x12]
mov dword [rsp + 0x80], ebx
cmp ebx, 0xfffe
jne 0x1801b2975
cmp byte [r13], r14b
jne 0x1801b2945
mov dword [0x18029ccf4], 4
mov rcx, rsi
jmp 0x1801b2da3
mov rdx, r13
mov ecx, 8
call fcn.1801af310
test eax, eax
jne 0x1801b2968
mov dword [0x18029ccf4], 0x29
mov rcx, rsi
jmp 0x1801b2da3
dec ax
movzx eax, ax
mov dword [rsp + 0x80], eax
call fcn.1801b2dd0
cmp dword [0x1802b1e60], r14d
jne 0x1801b2995
mov dword [0x18029ccf4], 0x60
mov rcx, rsi
jmp 0x1801b2da3
mov r9d, ebp
mov r8, r13
mov edx, r12d
mov rcx, r15
call fcn.1801b20c0
mov rbx, rax
test rax, rax
je 0x1801b2d2b
call fcn.1801b3580
mov rdx, qword [r15 + 0x20]
mov rcx, r15
movzx edi, al
call fcn.1801b5010
mov rsi, rax
test rax, rax
je 0x1801b2aa4
cmp byte [rax], r14b
je 0x1801b2aa4
mov r15d, dword [rsp + 0x98]
mov edx, 0x200
mov r8d, r15d
mov rcx, rax
call fcn.1801b4da0
mov ebp, eax
test eax, eax
je 0x1801b2d2b
mov ecx, eax
call fcn.1801aebd0
mov rdi, rax
test rax, rax
je 0x1801b2d2b
mov r9d, dword [0x18029cd24]
mov r8, rsi
mov edx, ebp
mov rcx, rax
call fcn.1801b4d50
mov rcx, rdi
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
je 0x1801b2a39
mov dword [rbx + 0x8c], eax
jmp 0x1801b2a82
mov rcx, rdi
call sub.WS2_32.dll_gethostbyname
mov rcx, rdi
mov rsi, rax
call fcn.18010fae0
test rsi, rsi
jne 0x1801b2a6a
mov rcx, qword [rsp + 0x30]
mov dword [0x18029ccf4], 0x69
call fcn.18010fae0
jmp 0x1801b2d3f
mov rdx, qword [rsi + 0x18]
lea rcx, [rbx + 0x8c]
movsx r8, word [rsi + 0x12]
mov rdx, qword [rdx]
call fcn.18020b760
mov eax, dword [rsp + 0x90]
xor r9d, r9d
mov r8d, dword [rsp + 0x80]
xor edx, edx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r15d
jmp 0x1801b2d20
test dil, dil
je 0x1801b2be3
mov rdi, qword [0x1802b4568]
test rdi, rdi
je 0x1801b2d2b
mov esi, dword [rsp + 0x80]
cmp dword [rdi + 0xc], 0
je 0x1801b2bd2
mov eax, dword [rdi + 8]
cmp eax, 0xffffffff
je 0x1801b2ade
mov dword [rbx + 0x8c], eax
jmp 0x1801b2b08
lea rcx, [rdi + 0x10]
call sub.WS2_32.dll_gethostbyname
test rax, rax
je 0x1801b2bd2
mov rdx, qword [rax + 0x18]
lea rcx, [rbx + 0x8c]
movsx r8, word [rax + 0x12]
mov rdx, qword [rdx]
call fcn.18020b760
mov eax, dword [rsp + 0x90]
xor r9d, r9d
mov dword [rsp + 0x28], eax
mov r8d, esi
mov eax, dword [rsp + 0x98]
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x20], eax
mov dword [0x18029ccf4], 0
call fcn.1801b2270
mov r14d, eax
test eax, eax
jne 0x1801b2d2b
test rbx, rbx
je 0x1801b2bb5
mov rcx, qword [rbx + 8]
call sub.WS2_32.dll_closesocket
mov qword [rbx + 8], 0xffffffffffffffff
lea rdx, [0x1802b1e78]
mov rcx, qword [0x1802b1e78]
test rcx, rcx
je 0x1801b2b88
nop dword [rax]
mov rax, qword [rcx]
cmp rcx, rbx
je 0x1801b2b85
mov rdx, rcx
mov rcx, rax
test rax, rax
jne 0x1801b2b70
jmp 0x1801b2b88
mov qword [rdx], rax
mov rcx, qword [rbx + 0x70]
call fcn.18010fae0
mov rcx, qword [rbx + 0x98]
test rcx, rcx
je 0x1801b2bad
call fcn.18010fae0
mov qword [rbx + 0x98], 0
mov rcx, rbx
call fcn.18010fae0
mov r9d, ebp
mov r8, r13
mov edx, r12d
mov rcx, r15
call fcn.1801b20c0
mov rbx, rax
test rax, rax
je 0x1801b2d2b
mov rdi, qword [rdi]
test rdi, rdi
jne 0x1801b2ac4
jmp 0x1801b2d2b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r12d, dword [rsp + 0x80]
xor ebp, ebp
mov esi, eax
nop word [rax + rax]
mov r8d, r12d
mov rdx, r13
mov rcx, r15
add esi, 0xbb8
call fcn.1801b3900
test eax, eax
je 0x1801b2d2b
lea rdx, [rsp + 0x80]
mov ecx, esi
call fcn.1801b3e10
mov rdi, rax
test rax, rax
je 0x1801b2c66
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rdi + 4]
mov dword [0x18029ccf4], ecx
test cx, cx
je 0x1801b2c9f
lea rdx, [rsp + 0x80]
mov ecx, esi
call fcn.1801b3e10
mov rdi, rax
test rax, rax
jne 0x1801b2c40
test ebp, ebp
jne 0x1801b2c77
call fcn.1801b3bf0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
inc ebp
cmp ebp, 3
jl 0x1801b2c00
test rdi, rdi
jne 0x1801b2c9f
cmp dword [0x18029ccf4], r14d
jne 0x1801b2d2b
mov dword [0x18029ccf4], 0x69
jmp 0x1801b2d2b
movzx eax, byte [rdi + 0xe]
movzx ecx, byte [rdi + 0x15]
movzx esi, byte [rdi + 0xf]
shl esi, 8
or esi, eax
shl cx, 8
movzx eax, byte [rdi + 0xd]
shl esi, 8
or esi, eax
movzx eax, byte [rdi + 0xc]
shl esi, 8
or esi, eax
movzx eax, byte [rdi + 0x14]
or cx, ax
mov word [rbx + 0x7c], cx
movzx eax, byte [rdi + 0x10]
movzx ecx, byte [rdi + 0x11]
shl cx, 8
or cx, ax
mov eax, dword [rsp + 0x80]
mov word [rbx + 0x7a], cx
mov dword [rbx + 0x8c], eax
xor edx, edx
xor ecx, ecx
call fcn.1801b3e10
test rax, rax
jne 0x1801b2cf1
mov eax, dword [rsp + 0x90]
mov r9d, esi
mov dword [rsp + 0x28], eax
mov r8d, r12d
mov eax, dword [rsp + 0x98]
mov edx, 1
mov dword [rsp + 0x20], eax
mov rcx, rbx
call fcn.1801b2270
mov r14d, eax
mov rcx, qword [rsp + 0x30]
call fcn.18010fae0
test r14d, r14d
jne 0x1801b2da8
test rbx, rbx
je 0x1801b2da8
mov rcx, qword [rbx + 8]
call sub.WS2_32.dll_closesocket
mov qword [rbx + 8], 0xffffffffffffffff
mov rcx, qword [0x1802b1e78]
test rcx, rcx
je 0x1801b2d7b
lea rdx, [0x1802b1e78]
mov rax, qword [rcx]
cmp rcx, rbx
je 0x1801b2d78
mov rdx, rcx
mov rcx, rax
test rax, rax
jne 0x1801b2d63
jmp 0x1801b2d7b
mov qword [rdx], rax
mov rcx, qword [rbx + 0x70]
call fcn.18010fae0
mov rcx, qword [rbx + 0x98]
test rcx, rcx
je 0x1801b2da0
call fcn.18010fae0
mov qword [rbx + 0x98], 0
mov rcx, rbx
call fcn.18010fae0
mov rbx, qword [rsp + 0x88]
mov eax, r14d
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret