Function at 0x180065fc0
Capabilities:
Get disk information
Resolve dns

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x16d8
call fcn.1800e9570
sub rsp, rax
mov rax, qword [0x180173200]
xor rax, rsp
mov qword [rsp + 0x16c0], rax
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0x90], 0
cmp qword [rsp + 0x16e8], 0
jne 0x180066027
mov eax, 0xffffffff
jmp 0x180066c48
mov edx, reloc.WS2_32.dll_WSASetLastError
mov rcx, qword [rsp + 0x16e0]
call fcn.18000bb40
mov rcx, qword [rsp + 0x16e8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x16e8]
cmp qword [rax], 0
jne 0x18006605c
mov eax, 0xffffffff
jmp 0x180066c48
mov rax, qword [rsp + 0x16e8]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x16f0]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x58]
dec eax
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0x13
ja case.0x1800660a2.7
movsxd rax, dword [rsp + 0x58]
lea rcx, [0x180000000]
mov eax, dword [rcx + rax*4 + 0x66c60]
add rax, rcx
jmp rax
mov rax, qword [rsp + 0x16e0]
mov eax, dword [rax + 0xb70]
and eax, 1
test eax, eax
je 0x1800660ca
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x10], 9
jmp 0x180066c27
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x10], 1
call fcn.180022370
movsx eax, al
mov r8d, eax
lea rdx, str._c:_
lea rcx, [rsp + 0x15d0]
call fcn.180005290
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x98]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x15d0]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x180066159
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x10], 9
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x28], 0
mov eax, 0xffffffff
jmp 0x180066c48
mov rax, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x98]
mov dword [rax + 0x28], ecx
jmp 0x180066c27
mov rax, qword [rsp + 0x16e0]
mov eax, dword [rax + 0xb70]
and eax, 4
test eax, eax
je 0x180066193
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x10], 9
jmp 0x180066c27
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x10], 3
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x16e0]
call fcn.180066e00
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x16e0]
call fcn.1800672b0
jmp 0x180066c27
mov rax, qword [rsp + 0x16e0]
mov eax, dword [rax + 0xb70]
and eax, 8
test eax, eax
je 0x1800661ee
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x10], 9
jmp 0x180066c27
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x10], 4
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x16e0]
movsx eax, byte [rcx + rax + 0x40]
test eax, eax
je 0x180066239
mov rax, qword [rsp + 0x16e0]
add rax, 0x40
mov rcx, qword [rsp + 0x40]
add rcx, 0x28
mov r8d, 0x40
mov rdx, rax
call fcn.18000c140
jmp 0x18006624f
mov rax, qword [rsp + 0x40]
add rax, 0x28
mov edx, 0x41
mov rcx, rax
call fcn.180021a80
jmp 0x180066c27
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x10], reloc.WS2_32.dll_select
mov rax, qword [rsp + 0x16e0]
add rax, 0xa2
mov rcx, qword [rsp + 0x40]
add rcx, 0x28
mov r8d, 0x40
mov rdx, rax
call fcn.18000c140
jmp 0x180066c27
mov rax, qword [rsp + 0x16e0]
mov eax, dword [rax + 0xb70]
and eax, 0x10
test eax, eax
je 0x1800662b0
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x10], 9
jmp 0x180066c27
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x10], 5
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x16e0]
movsx eax, byte [rcx + rax + 0x61]
test eax, eax
je 0x1800662fb
mov rax, qword [rsp + 0x16e0]
add rax, 0x61
mov rcx, qword [rsp + 0x40]
add rcx, 0x28
mov r8d, 0x40
mov rdx, rax
call fcn.18000c140
jmp 0x180066311
mov rax, qword [rsp + 0x40]
add rax, 0x28
mov edx, 0x40
mov rcx, rax
call fcn.180021c30
jmp 0x180066c27
mov rax, qword [rsp + 0x16e0]
mov eax, dword [rax + 0xb70]
and eax, 0x2000
test eax, eax
je 0x18006633e
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x10], 9
jmp 0x180066c27
mov eax, 1
imul rax, rax, 0
mov qword [rsp + 0xa8], rax
cmp qword [rsp + 0xa8], 0x41
jae 0x18006635c
jmp 0x180066361
call fcn.1800e9a54
mov rax, qword [rsp + 0xa8]
mov byte [rsp + rax + 0x15e0], 0
mov edx, 0x40
lea rcx, [rsp + 0x15e0]
call fcn.180021c30
mov eax, 1
imul rax, rax, 0
movsx eax, byte [rsp + rax + 0x15e0]
test eax, eax
je 0x1800664b2
mov dword [rsp + 0x68], 1
mov r8d, gethostbyname
xor edx, edx
lea rcx, [rsp + 0xd0]
call fcn.18012a620
mov dword [rsp + 0xd4], reloc.WS2_32.dll_socket
lea r9, [rsp + 0xb0]
lea r8, [rsp + 0xd0]
xor edx, edx
lea rcx, [rsp + 0x15e0]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [rsp + 0x9c], eax
cmp dword [rsp + 0x9c], 0
je 0x180066412
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x10], 9
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x28], 0
jmp 0x180066c27
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x68], 1
cmp qword [rsp + 0x88], 0
je 0x1800664a4
mov rax, qword [rsp + 0x88]
cmp dword [rax + 4], 0x17
je 0x180066445
jmp 0x18006642a
cmp dword [rsp + 0x68], 0
jne 0x180066456
mov dword [rsp + 0x78], 1
jmp 0x18006645e
mov dword [rsp + 0x78], 0
mov r9d, dword [rsp + 0x78]
mov rax, qword [rsp + 0x88]
mov r8, qword [rax + 0x20]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x16e0]
call fcn.180067520
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x68], 0
jmp 0x18006642a
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
jmp 0x180066c27
mov rax, qword [rsp + 0x16e0]
mov eax, dword [rax + 0xb70]
and eax, 0x20
test eax, eax
je 0x1800664dd
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x10], 9
jmp 0x180066c27
mov eax, 1
imul rax, rax, 0
mov qword [rsp + 0xb8], rax
cmp qword [rsp + 0xb8], 0x41
jae 0x1800664fb
jmp 0x180066500
call fcn.1800e9a54
mov rax, qword [rsp + 0xb8]
mov byte [rsp + rax + 0x15e0], 0
mov edx, 0x40
lea rcx, [rsp + 0x15e0]
call fcn.180021c30
mov eax, 1
imul rax, rax, 0
movsx eax, byte [rsp + rax + 0x15e0]
test eax, eax
je 0x18006656a
mov dword [rsp + 0x6c], 0
lea rcx, [rsp + 0x15e0]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rsp + 0x90], rax
call fcn.180102964
mov rcx, qword [rsp + 0x16e0]
mov eax, dword [rax]
mov dword [rcx + 0x244], eax
cmp qword [rsp + 0x90], 0
je 0x18006669f
mov rax, qword [rsp + 0x90]
movsx eax, word [rax + 0x12]
mov dword [rsp + 0x80], eax
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x60], rax
cmp dword [rsp + 0x6c], 0
jne 0x1800665ae
mov dword [rsp + 0x7c], 1
jmp 0x1800665b6
mov dword [rsp + 0x7c], 0
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8, qword [rsp + 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x16e0]
call fcn.180067390
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x6c], 1
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x180066613
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x18006668e
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx + rax]
movsx eax, byte [rax]
cmp eax, 0x7f
je 0x18006667e
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8, qword [rsp + 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x16e0]
call fcn.180067390
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x18006667e
jmp 0x18006668e
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x60], rax
jmp 0x180066613
mov qword [rsp + 0x90], 0
jmp 0x18006656a
cmp dword [rsp + 0x6c], 0
jne 0x1800666be
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x10], 9
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x28], 0
jmp 0x180066c27
mov rax, qword [rsp + 0x16e0]
mov eax, dword [rax + 0xb70]
and eax, 0x200
test eax, eax
je 0x1800666eb
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x10], 9
jmp 0x180066c27
mov rax, qword [rsp + 0x16e0]
cmp qword [rax + 0xb80], 0
je 0x18006671a
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x16e0]
mov rax, qword [rsp + 0x16e0]
call qword [rax + 0xb80]
jmp 0x180066726
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x10], 9
jmp 0x180066c27
mov rax, qword [rsp + 0x16e0]
mov eax, dword [rax + 0xb70]
and eax, 0x400
test eax, eax
je 0x180066753
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x10], 9
jmp 0x180066c27
mov rax, qword [rsp + 0x16e0]
cmp qword [rax + 0xb88], 0
je 0x180066782
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x16e0]
mov rax, qword [rsp + 0x16e0]
call qword [rax + 0xb88]
jmp 0x18006678e
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x10], 9
jmp 0x180066c27
mov rax, qword [rsp + 0x16e0]
mov eax, dword [rax + 0xb70]
and eax, 0x100
test eax, eax
je 0x1800667bb
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x10], 9
jmp 0x180066c27
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x10], 0xa
mov rax, qword [rsp + 0x40]
add rax, 0x28
lea rdx, [0x180175b20]
mov rcx, rax
call fcn.1800faf60
jmp 0x180066c27
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x10], 9
jmp 0x180066c27
mov rax, qword [rsp + 0x16e0]
mov eax, dword [rax + 0xb70]
and eax, 2
test eax, eax
je 0x18006681b
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x10], 9
jmp 0x180066c27
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x10], 2
mov rax, qword [rsp + 0x40]
add rax, 0x28
lea rdx, [0x180175b21]
mov rcx, rax
call fcn.1800faf60
jmp 0x180066c27
mov rax, qword [rsp + 0x16e0]
mov eax, dword [rax + 0xb70]
and eax, 0x800
test eax, eax
je 0x18006686c
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x10], 9
jmp 0x180066c27
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x16e0]
call fcn.180067610
mov dword [rsp + 0xa0], eax
cmp dword [rsp + 0xa0], 0
je 0x18006689b
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x10], 9
jmp 0x180066c27
mov rax, qword [rsp + 0x16e0]
mov eax, dword [rax + 0xb70]
and eax, 0x4000
test eax, eax
je 0x1800668c8
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x10], 9
jmp 0x180066c27
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + rax + 0x28]
mov rcx, rax
call fcn.1800c65a0
mov dword [rsp + 0xa4], eax
cmp dword [rsp + 0xa4], 0
jne 0x180066919
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
movsx eax, byte [rcx + rax + 0x28]
test eax, eax
je 0x180066919
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x10], reloc.WS2_32.dll_sendto
jmp 0x180066925
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x10], 9
jmp 0x180066c27
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x10], 9
mov rax, qword [rsp + 0x16e0]
mov rax, qword [rax + 0xbb8]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180066c27
mov rax, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x16f0]
cmp dword [rax + 0x14], ecx
jne 0x180066c15
mov dword [rsp + 0x84], 0
mov r8d, 0x14d0
xor edx, edx
lea rcx, [rsp + 0x100]
call fcn.18012a620
mov r8d, 0x81
xor edx, edx
lea rcx, [rsp + 0x1630]
call fcn.18012a620
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x1630]
mov rax, qword [rsp + 0x50]
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
test eax, eax
jne 0x180066a9f
lea rcx, [rsp + 0x1630]
call fcn.1800fb030
cmp rax, 0x40
jbe 0x1800669d8
jmp 0x180066c27
lea rax, [rsp + 0x1630]
mov qword [rsp + 0x48], rax
jmp 0x1800669f4
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
movsx eax, byte [rax]
test eax, eax
je 0x180066a36
mov rax, qword [rsp + 0x48]
movsx eax, byte [rax]
and eax, 0xff
mov ecx, eax
call fcn.1800fc810
test eax, eax
je 0x180066a1a
jmp 0x180066a36
mov rax, qword [rsp + 0x48]
movsx eax, byte [rax]
and eax, 0xff
mov ecx, eax
call fcn.1800fc760
test eax, eax
jne 0x180066a34
jmp 0x180066a36
jmp 0x1800669e7
mov rax, qword [rsp + 0x48]
movsx eax, byte [rax]
test eax, eax
je 0x180066a47
jmp 0x180066c27
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx + 0x14]
mov dword [rax + 0x10], ecx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx + 0x18]
mov dword [rax + 0x14], ecx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 0x20], rcx
mov rax, qword [rsp + 0x40]
add rax, 0x28
mov r8d, 0x40
lea rdx, [rsp + 0x1630]
mov rcx, rax
call fcn.18000c140
mov dword [rsp + 0x84], 1
cmp dword [rsp + 0x84], 0
je 0x180066c13
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x28], 0
je 0x180066c13
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x1630]
mov rax, qword [rsp + 0x50]
call qword [rax + Ordinal_41]
test eax, eax
jne 0x180066c13
mov edx, reloc.WS2_32.dll_WSASetLastError
mov rcx, qword [rsp + 0x16e0]
call fcn.18000bb40
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
jne 0x180066b25
mov rax, qword [rsp + 0x16e0]
mov dword [rax + 0x228], 0xffffff92
mov rax, qword [rsp + 0x16e0]
mov dword [rax + 0x244], reloc.WS2_32.dll_shutdown
jmp 0x180066c13
lea rcx, [rsp + 0x1630]
call fcn.1800fb030
cmp rax, 0x40
jbe 0x180066b3a
jmp 0x180066abd
lea rax, [rsp + 0x1630]
mov qword [rsp + 0x48], rax
jmp 0x180066b56
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
movsx eax, byte [rax]
test eax, eax
je 0x180066b98
mov rax, qword [rsp + 0x48]
movsx eax, byte [rax]
and eax, 0xff
mov ecx, eax
call fcn.1800fc810
test eax, eax
je 0x180066b7c
jmp 0x180066b98
mov rax, qword [rsp + 0x48]
movsx eax, byte [rax]
and eax, 0xff
mov ecx, eax
call fcn.1800fc760
test eax, eax
jne 0x180066b96
jmp 0x180066b98
jmp 0x180066b49
mov rax, qword [rsp + 0x48]
movsx eax, byte [rax]
test eax, eax
je 0x180066ba9
jmp 0x180066abd
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx + 0x14]
mov dword [rax + 0x10], ecx
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx + 0x18]
mov dword [rax + 0x14], ecx
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 0x20], rcx
mov rax, qword [rsp + 0x70]
add rax, 0x28
mov r8d, 0x40
lea rdx, [rsp + 0x1630]
mov rcx, rax
call fcn.18000c140
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x40], rax
jmp 0x180066abd
jmp 0x180066c27
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
jmp 0x18006694a
cmp dword [rsp + 0x16f0], 3
jne 0x180066c46
mov rcx, qword [rsp + 0x40]
call fcn.1800672f0
mov rcx, qword [rsp + 0x16e8]
mov qword [rcx], rax
xor eax, eax
mov rcx, qword [rsp + 0x16c0]
xor rcx, rsp
call fcn.1800e95d0
add rsp, 0x16d8
ret