Function at 0x5fd8f570
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
test byte [ebp + 0x14], 1
je 0x5fdc240d
mov edx, dword [esp + 0x1c]
mov dword [ebx + 0x18], eax
lea eax, [edi + 4]
cmp eax, edx
ja 0x5fdc2535
movzx ecx, byte [edi]
mov eax, 0x100
imul cx, ax
movzx eax, byte [edi + 1]
push 2
add cx, ax
pop eax
add edi, eax
mov word [ebx + 0x14], cx
mov eax, 0x100
push 2
movzx ecx, byte [edi]
imul cx, ax
movzx eax, byte [edi + 1]
add cx, ax
pop eax
add edi, eax
mov word [ebx + 0x16], cx
test dword [ebp + 0x14], 0x1000000
jne 0x5fd8f96a
mov eax, dword [esp + 0x24]
mov cl, byte [esp + 0x13]
jmp 0x5fd8f667
mov dword [ebx + 0x1c], eax
mov eax, dword [esp + 0x44]
lea esi, [esp + 0x24]
add eax, 2
mov dword [esp + 0x28], esi
mov dword [esp + 0x44], eax
inc cl
movzx eax, word [eax]
mov dword [esp + 0x3c], eax
xor eax, eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x40], eax
jmp 0x5fd8f65f
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1bc
mov eax, dword [0x5fde94a8]
xor eax, esp
mov dword [esp + 0x1b8], eax
mov eax, dword [ebp + 0x10]
xor edx, edx
push ebx
mov ebx, dword [ebp + 8]
mov ecx, edx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
movzx eax, ax
mov dword [esp + 0x34], esi
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], edi
mov dword [esp + 0x4c], edx
mov dword [esp + 0x48], edx
mov dword [esp + 0x40], ecx
mov word [esp + 0x20], cx
mov ecx, dword [0x5fde9010]
cmp ecx, 0x5fde9010
je 0x5fd8f5d7
test byte [ecx + 0x1c], 0x20
jne 0x5fdc2312
push 0x30
push edx
push ebx
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
add esp, 0xc
push 2
pop eax
cmp edi, 1
jne 0x5fdc2331
mov cl, byte [esi + 3]
movzx edi, cl
and edi, 0xf
mov dword [esp + 0x14], edi
jne 0x5fd9cfb8
lea edi, [ebx + 8]
xor edx, edx
movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x24]
mov dword [esp + 0x28], ecx
mov eax, edx
lea ecx, [esp + 0x50]
mov dword [esp + 0x50], edx
mov dword [esp + 0x54], ecx
lea ecx, [esp + 0x58]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x5c], ecx
mov ecx, dword [esp + 0x3c]
movzx ecx, cx
movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x34]
mov dword [esp + 0x58], edx
mov dword [esp + 0x60], ecx
lea edx, [ecx + esi]
xor cl, cl
and dword [esp + 0x2c], eax
lea edi, [esi + 0xc]
mov dword [esp + 0x1c], edx
lea edx, [esi + 4]
mov esi, edx
mov dword [esp + 0x44], edx
mov edx, dword [esp + 0x1c]
movzx esi, word [esi]
mov dword [esp + 0x3c], esi
mov byte [esp + 0x13], cl
mov dword [esp + 0x24], eax
inc dword [esp + 0x2c]
mov esi, dword [esp + 0x3c]
cmp word [esp + 0x2c], si
mov esi, dword [esp + 0x34]
ja 0x5fd8f948
cmp edi, edx
jae 0x5fdc25fc
mov ecx, dword [0x5fde9010]
test byte [ecx + 0x1c], 0x20
jne 0x5fdc237d
push edx
push esi
push edi
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x30]
push eax
lea edx, [esp + 0x2c]
lea ecx, [esp + 0xd4]
call sym.DNSAPI.dll_Dns_ReadPacketName
mov edi, eax
test edi, edi
je 0x5fdc25e1
mov ecx, dword [0x5fde9010]
test byte [ecx + 0x1c], 0x20
jne 0x5fdc23cc
cmp byte [esp + 0x13], 0
je 0x5fd8efba
lea eax, [esp + 0x64]
push eax
push dword [esp + 0x20]
push edi
call sym.DNSAPI.dll_Dns_ReadRecordStructureFromPacket
mov edi, eax
test edi, edi
je 0x5fdc25c6
mov esi, dword [esp + 0x74]
cmp si, word [esp + 0x40]
je 0x5fd90b11
xor eax, eax
movzx ecx, si
mov dword [esp + 0x30], eax
mov dword [esp + 0x40], ecx
test eax, eax
jne 0x5fd90b22
push dword [esp + 0x38]
lea ecx, [esp + 0xc4]
push 2
pop eax
push eax
mov ax, word [esp + 0x20]
movzx edx, al
call fcn.5fd8abe3
mov esi, eax
mov dword [esp + 0x48], esi
test esi, esi
je 0x5fdad408
mov dword [esp + 0x4c], esi
mov esi, dword [0x5fde9010]
cmp esi, 0x5fde9010
je 0x5fd8f75e
test dword [esi + 0x1c], 0x400
jne 0x5fdc242e
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x74]
mov ecx, eax
mov word [esp + 0x88], ax
call fcn.5fd8ae00
movzx ecx, ax
test cx, cx
je 0x5fdc244e
cmp dword [ecx*4 + 0x5fd8f868], 0
je 0x5fdc244e
push edi
push dword [esp + 0x70]
movzx esi, cx
lea eax, [esp + 0x88]
push dword [esp + 0x3c]
push dword [esp + 0x44]
mov esi, dword [esi*4 + 0x5fd8f868]
mov ecx, esi
push eax
call dword [0x5fdec34c]
call esi
mov edx, eax
test edx, edx
je 0x5fdc2581
mov cx, word [esp + 0x76]
mov eax, dword [esp + 0x4c]
mov word [edx + 0x14], cx
mov ecx, dword [esp + 0x78]
mov dword [edx + 4], eax
movzx eax, byte [esp + 0x13]
mov esi, dword [esp + 0x74]
and eax, 3
mov dword [edx + 0x10], ecx
mov ecx, dword [esp + 0x38]
and ecx, 3
mov word [edx + 8], si
shl ecx, 3
or ecx, eax
mov eax, dword [edx + 0xc]
and eax, 0xffffffe4
or ecx, eax
xor eax, eax
cmp dword [esp + 0x30], eax
push 0x18
sete al
and ecx, 0xffffcfff
and eax, 1
shl eax, 0xd
or eax, ecx
mov dword [edx + 0xc], eax
pop eax
cmp si, ax
je 0x5fdc2482
push 5
pop eax
cmp si, ax
je 0x5fd90bfa
push 0x27
pop eax
cmp si, ax
je 0x5fd90bfa
mov eax, dword [esp + 0x28]
mov dword [eax], edx
mov dword [esp + 0x28], edx
and dword [esp + 0x48], 0
mov eax, dword [esp + 0x24]
mov cl, byte [esp + 0x13]
mov edx, dword [esp + 0x1c]
jmp 0x5fd8f667
test cl, cl
je 0x5fd8f533
cmp cl, 1
je 0x5fd8f530
cmp cl, 2
je 0x5fd8f9b2
cmp cl, 3
jne 0x5fd8f533
mov dword [ebx + 0x28], eax
mov eax, dword [esp + 0x50]
mov edi, dword [esp + 0x14]
mov dword [ebx + 0x20], eax
mov eax, dword [esp + 0x58]
mov dword [ebx + 0x2c], eax
xor eax, eax
cmp word [esi + 6], ax
je 0x5fd9cbd9
mov dword [ebx], edi
mov eax, dword [0x5fde9010]
test byte [eax + 0x1c], 0x80
jne 0x5fdc2529
mov eax, edi
mov ecx, dword [esp + 0x1c4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.5fd83560
mov esp, ebp
pop ebp
ret 0x14
mov dword [ebx + 0x24], eax
jmp 0x5fd8f533
mov eax, dword [esp + 0x30]
jmp 0x5fd8f70d
mov esi, dword [0x5fde9010]
jmp 0x5fd8f75e
movzx eax, word [ebx + 0x14]
mov ecx, 0xff
cmp ax, cx
je 0x5fd8f842
push 5
pop ecx
cmp ax, cx
je 0x5fd8f842
push 0x27
pop ecx
cmp ax, cx
je 0x5fd8f842
cmp byte [esp + 0x13], 1
jne 0x5fd8f842
mov eax, dword [esp + 0x54]
mov dword [eax], edx
mov dword [esp + 0x54], edx
jmp 0x5fd8f84c
test edi, edi
jne 0x5fd8f988
mov al, byte [esi + 2]
test al, 0x78
jne 0x5fd8f988
test al, al
jns 0x5fd8f988
mov ecx, dword [ebx + 0x24]
test ecx, ecx
je 0x5fd9cc33
movzx ecx, word [ecx + 8]
cmp ecx, 6
jne 0x5fdc249b
mov dword [esp + 0x14], 0x251d
mov eax, dword [0x5fde9010]
cmp eax, 0x5fde9010
je 0x5fdad3fe
test byte [eax + 0x1c], 0x20
jne 0x5fdad3f0
mov edi, dword [esp + 0x14]
jmp 0x5fd8f988
test al, 4
jne 0x5fd9cc08
jmp 0x5fdc24f3
and cl, 0xf
call fcn.5fd9cfa7
mov dword [esp + 0x14], eax
cmp eax, 0x232b
je 0x5fd8f602
jmp 0x5fdc2341
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2b
jmp 0x5fdc24e3
mov edi, 0x251d
jmp 0x5fd8f988
push 0xe
pop esi
jmp 0x5fdc2661
movzx eax, ax
mov edx, 0x5fdbd9f8
push eax
push esi
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x20
pop ecx
call fcn.5fdc81e7
xor edx, edx
jmp 0x5fd8f5d7
cmp edi, eax
je 0x5fd8f5ef
push 0x57
pop eax
jmp 0x5fd8f99b
test dword [ebp + 0x14], 0x2000000
jne 0x5fd8f602
mov eax, dword [0x5fde9010]
cmp eax, 0x5fde9010
je 0x5fdc2374
test byte [eax + 0x1c], 0x20
je 0x5fdc2374
push edi
push dword [eax + 0x14]
mov edx, 0x5fdbd9f8
push dword [eax + 0x10]
push 0x21
pop ecx
call fcn.5fdc7d09
mov eax, dword [esp + 0x14]
jmp 0x5fd8f99b
cmp ecx, 0x5fde9010
je 0x5fdc23ad
test dword [ecx + 0x1c], 0x400
je 0x5fdc23ad
mov eax, edi
mov edx, 0x5fdbd9f8
sub eax, esi
movzx eax, ax
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x23
pop ecx
call fcn.5fdc7d09
mov edx, dword [esp + 0x1c]
push 0x5fdbd9f4
push edx
push esi
push edi
push 0x5fdc262c
xor edx, edx
xor ecx, ecx
call fcn.5fdd6b72
mov edx, dword [esp + 0x1c]
jmp 0x5fd8f696
cmp ecx, 0x5fde9010
je 0x5fd8f6cd
test dword [ecx + 0x1c], 0x400
je 0x5fd8f6cd
push dword [esp + 0x30]
movzx eax, word [esp + 0x24]
push eax
movzx eax, word [esp + 0x20]
push eax
lea eax, [esp + 0xcc]
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.5fdccfda
jmp 0x5fd8f6cd
push dword [esp + 0x38]
lea ecx, [esp + 0xc4]
push 2
pop eax
push eax
mov ax, word [esp + 0x20]
movzx edx, al
call fcn.5fd8abe3
jmp 0x5fd8efc6
lea eax, [esp + 0xc0]
mov edx, 0x5fdbd9f8
push eax
push dword [esi + 0x14]
push dword [esi + 0x10]
push 0x28
pop ecx
call fcn.5fdc7fde
jmp 0x5fd90b22
cmp esi, 0x5fde9010
je 0x5fdc247a
test dword [esi + 0x1c], 0x400
je 0x5fdc247a
mov eax, dword [esp + 0x74]
mov edx, 0x5fdbd9f8
movzx eax, ax
push eax
push dword [esi + 0x14]
push dword [esi + 0x10]
push 0x29
pop ecx
call fcn.5fdc7d09
push 0xa
pop ecx
jmp 0x5fd8f796
cmp word [ebx + 0x14], ax
je 0x5fd8f842
mov eax, dword [esp + 0x5c]
mov dword [eax], edx
mov dword [esp + 0x5c], edx
jmp 0x5fd8f84c
push 2
pop edx
cmp cx, dx
jne 0x5fdc24f3
test al, 4
jne 0x5fdc24f3
test byte [esi + 3], 0x80
je 0x5fdc24b1
test al, 1
jne 0x5fdc24f3
mov dword [esp + 0x14], 0x2522
mov eax, dword [0x5fde9010]
cmp eax, 0x5fde9010
je 0x5fdc2515
test byte [eax + 0x1c], 0x20
je 0x5fd9cc2a
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2c
jmp 0x5fdc24e3
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2d
mov edx, 0x5fdbd9f8
pop ecx
call fcn.5fdc7d09
jmp 0x5fd9cc2a
mov dword [esp + 0x14], 0x251e
mov eax, dword [0x5fde9010]
cmp eax, 0x5fde9010
je 0x5fdc251f
test dword [eax + 0x1c], 0x10000000
jne 0x5fdc24da
jmp 0x5fd9cc2a
mov edi, 0x2522
jmp 0x5fd8f988
mov edi, 0x251e
jmp 0x5fd8f988
push ebx
push ecx
call fcn.5fdd83af
jmp 0x5fd8f999
mov eax, dword [0x5fde9010]
cmp eax, 0x5fde9010
je 0x5fdc265c
test dword [eax + 0x1c], 0x400
je 0x5fdc2639
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x26
jmp 0x5fdc2564
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x24
pop ecx
jmp 0x5fdc2572
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x27
pop eax
mov ecx, eax
mov edx, 0x5fdbd9f8
call fcn.5fdc44b5
jmp 0x5fdc2623
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov esi, eax
mov ecx, dword [0x5fde9010]
cmp ecx, 0x5fde9010
je 0x5fdc25b9
test dword [ecx + 0x1c], 0x400
je 0x5fdc25b9
mov eax, dword [esp + 0x74]
push edi
push dword [esp + 0x70]
movzx eax, ax
push esi
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.5fdccf63
test esi, esi
je 0x5fdad408
jmp 0x5fdc2661
mov eax, dword [0x5fde9010]
cmp eax, 0x5fde9010
je 0x5fdc265c
test dword [eax + 0x1c], 0x400
jne 0x5fdc2567
jmp 0x5fdc2639
mov eax, dword [0x5fde9010]
cmp eax, 0x5fde9010
je 0x5fdc265c
test dword [eax + 0x1c], 0x400
jne 0x5fdc255c
jmp 0x5fdc2639
mov eax, dword [0x5fde9010]
cmp eax, 0x5fde9010
je 0x5fdc265c
test dword [eax + 0x1c], 0x400
je 0x5fdc2639
sub edi, esi
push edi
push dword [esp + 0x64]
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.5fdccfa2
mov eax, dword [0x5fde9010]
jmp 0x5fdc2639
cmp eax, 0x5fde9010
je 0x5fdc265c
test dword [eax + 0x1c], 0x400
je 0x5fdc265c
push dword [eax + 0x14]
mov edx, 0x5fdbd9f8
push dword [eax + 0x10]
push 0x2e
pop ecx
call fcn.5fdc44b5
mov esi, 0x251e
mov ecx, dword [esp + 0x48]
call fcn.5fd83e2e
mov ecx, dword [esp + 0x24]
call fcn.5fd85603
mov ecx, dword [esp + 0x50]
call fcn.5fd85603
mov ecx, dword [esp + 0x58]
call fcn.5fd85603
mov dword [ebx], esi
mov eax, esi
jmp 0x5fd8f99b