Function at 0x14007ba60
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x310]
sub rsp, 0x410
mov rax, qword [0x1400cb008]
xor rax, rsp
mov qword [rbp + 0x300], rax
mov r12, qword [r8 + 0x18]
movzx esi, dx
xor edx, edx
xor r13b, r13b
mov qword [rsp + 0x68], rdx
mov rdi, r8
mov qword [rsp + 0x70], rdx
movzx r15d, cl
cmp si, 0x17
jne 0x14007babc
mov eax, dword [r8 + 0x138]
jmp 0x14007bac0
mov eax, dword [r8 + 0x5c]
test r15b, r15b
lea r14, str.IPv4
mov ebx, edx
cmovne ebx, eax
cmp si, 0x17
lea rax, str.IPv6
cmove r14, rax
test ebx, ebx
jne 0x14007baee
test r15b, r15b
je 0x14007baee
mov al, 1
jmp 0x14007bf96
xorps xmm0, xmm0
mov dword [rbp - 0x60], edx
xorps xmm1, xmm1
mov dword [rbp - 0x54], edx
movzx eax, r15b
mov qword [rbp + 0x2a0], rdx
neg al
mov dword [rbp + 0x2a8], edx
mov eax, dword [r8 + 0x2b0]
mov r8d, 0x100
mov rdx, qword [rdi + 0x140]
sbb ecx, ecx
add ecx, 6
mov dword [rbp - 0x58], eax
mov dword [rbp - 0x70], ecx
xor eax, eax
lea rcx, [rbp - 0x54]
mov qword [rbp - 0x68], 0x368
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmmword [rbp - 0x20], xmm1
movdqa xmmword [rbp - 0x10], xmm0
movdqa xmmword [rbp], xmm1
movdqa xmmword [rbp + 0x10], xmm0
movdqa xmmword [rbp + 0x20], xmm1
movdqa xmmword [rbp + 0x30], xmm0
movdqa xmmword [rbp + 0x40], xmm1
movdqa xmmword [rbp + 0x50], xmm0
movdqa xmmword [rbp + 0x60], xmm1
movdqa xmmword [rbp + 0x70], xmm0
movdqa xmmword [rbp + 0x80], xmm1
movdqa xmmword [rbp + 0x90], xmm0
movdqa xmmword [rbp + 0xa0], xmm1
movdqa xmmword [rbp + 0xb0], xmm0
movdqa xmmword [rbp + 0xc0], xmm1
movdqa xmmword [rbp + 0xd0], xmm0
movdqa xmmword [rbp + 0xe0], xmm1
movdqa xmmword [rbp + 0xf0], xmm0
movdqa xmmword [rbp + 0x100], xmm1
movdqa xmmword [rbp + 0x110], xmm0
movdqa xmmword [rbp + 0x120], xmm1
movdqa xmmword [rbp + 0x130], xmm0
movdqa xmmword [rbp + 0x140], xmm1
movdqa xmmword [rbp + 0x150], xmm0
movdqa xmmword [rbp + 0x160], xmm1
movdqa xmmword [rbp + 0x170], xmm0
movdqa xmmword [rbp + 0x180], xmm1
movdqa xmmword [rbp + 0x190], xmm0
movdqa xmmword [rbp + 0x1a0], xmm1
movdqa xmmword [rbp + 0x1b0], xmm0
movdqa xmmword [rbp + 0x1c0], xmm1
movdqa xmmword [rbp + 0x1d0], xmm0
movdqa xmmword [rbp + 0x1e0], xmm1
movdqa xmmword [rbp + 0x1f0], xmm0
movdqa xmmword [rbp + 0x200], xmm1
movdqa xmmword [rbp + 0x210], xmm0
movdqa xmmword [rbp + 0x220], xmm1
movdqa xmmword [rbp + 0x230], xmm0
movdqa xmmword [rbp + 0x240], xmm1
movdqa xmmword [rbp + 0x250], xmm0
movdqa xmmword [rbp + 0x260], xmm1
movdqa xmmword [rbp + 0x270], xmm0
movdqa xmmword [rbp + 0x280], xmm1
movdqa xmmword [rbp + 0x290], xmm0
mov word [rbp + 0x2ac], si
mov dword [rbp + 0x2b0], ebx
movups xmmword [rbp + 0x2b4], xmm0
mov dword [rbp + 0x2f4], eax
movups xmmword [rbp + 0x2c4], xmm0
movups xmmword [rbp + 0x2d4], xmm0
movups xmmword [rbp + 0x2e4], xmm0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0xab], r13b
cmp ebx, 4
jbe 0x14007bcfa
mov ebx, 4
mov dword [rbp + 0x2b0], ebx
lea ecx, [rbx + 0x3c]
call fcn.14000ec70
test al, al
je 0x14007bcfe
mov r9d, ebx
lea rdx, str.Number_of__s_DNS_addresses_sent_to_service_truncated_to__d
mov r8, r14
lea ecx, [rbx + 0x3c]
call fcn.14000e820
jmp 0x14007bcfe
test ebx, ebx
jle 0x14007bd5a
cmp si, 0x17
jne 0x14007bd30
movabs rax, 0xfffffffffffffff
mov r8d, ebx
and r8, rax
lea rdx, [rdi + 0xf8]
add r8, r8
lea rcx, [rbp + 0x2b4]
shl r8, 3
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14007bd5a
movsxd rsi, ebx
test ebx, ebx
jle 0x14007bd5a
lea rbx, [rbp + 0x2b4]
add rdi, 0x4c
mov ecx, dword [rdi]
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rbx], eax
lea rbx, [rbx + 0x10]
lea rdi, [rdi + 4]
sub rsi, 1
jne 0x14007bd42
cmp dword [0x1400d3ed4], 4
jb 0x14007bdaa
mov ecx, 0x34000004
call fcn.14000ec70
test al, al
je 0x14007bdaa
lea rax, str.Setting
test r15b, r15b
lea r8, str.Deleting
mov r9, r14
cmovne r8, rax
lea rdx, str._s__s_dns_servers_on__s__if_index___d__using_service
mov eax, dword [rbp - 0x58]
mov ecx, 0x34000004
mov dword [rsp + 0x28], eax
lea rax, [rbp - 0x54]
mov qword [rsp + 0x20], rax
call fcn.14000e820
xor ebx, ebx
lea r9, [rsp + 0x60]
mov r8d, 0x368
mov qword [rsp + 0x78], rbx
lea rdx, [rbp - 0x70]
mov qword [rbp - 0x80], rbx
mov rcx, r12
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14007beff
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rbx
lea r8d, [rbx + 0x20]
mov rcx, r12
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14007beff
cmp dword [rsp + 0x58], ebx
je 0x14007beb7
lea ecx, [rbx + 0x40]
call fcn.14000ec70
test al, al
je 0x14007bf92
mov ecx, dword [rsp + 0x58]
lea rdx, [rsp + 0x68]
call fcn.14000f4a0
test r15b, r15b
lea rdx, str.adding
lea r8, str.deleting
mov r9, r14
cmovne r8, rdx
lea ecx, [rbx + 0x40]
lea rdx, [rbp - 0x54]
mov qword [rsp + 0x30], rdx
mov edx, dword [rsp + 0x58]
mov dword [rsp + 0x28], edx
lea rdx, str.TUN:__s__s_dns_failed_using_service:__s__status_u_if_name_s_
mov qword [rsp + 0x20], rax
call fcn.14000e820
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14007be81
nop dword [rax]
mov rbx, qword [rcx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbx
test rbx, rbx
jne 0x14007be70
mov rdi, qword [rsp + 0x70]
test rdi, rdi
je 0x14007bf92
nop
mov rcx, qword [rdi + 0x10]
mov rax, qword [rdi + 8]
mov rbx, qword [rdi]
call qword [0x14008d1f0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdi, rbx
test rbx, rbx
jne 0x14007be90
jmp 0x14007bf92
cmp dword [0x1400d3ed4], 1
jb 0x14007bef7
mov ecx, 1
call fcn.14000ec70
test al, al
je 0x14007bef7
test r15b, r15b
lea rax, [0x1400b97b4]
lea r9, str.deleted
mov r8, r14
cmovne r9, rax
lea rdx, str._s_dns_servers__s_using_service
mov ecx, 1
call fcn.14000e820
mov r13b, 1
jmp 0x14007bf92
mov ecx, 0x40
call fcn.14000ec70
test al, al
je 0x14007bf92
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, [rsp + 0x78]
call fcn.14000f4a0
mov r9, rax
mov dword [rsp + 0x20], ebx
lea r8, [0x1400b96b0]
mov ecx, 0x40
lea rdx, str._s:_could_not_talk_to_service:__s___lu_
call fcn.14000e820
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14007bf65
mov rbx, qword [rcx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbx
test rbx, rbx
jne 0x14007bf54
mov rbx, qword [rbp - 0x80]
test rbx, rbx
je 0x14007bf92
nop
mov rcx, qword [rbx + 0x10]
mov rax, qword [rbx + 8]
mov rdi, qword [rbx]
call qword [0x14008d1f0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, rdi
test rdi, rdi
jne 0x14007bf70
movzx eax, r13b
mov rcx, qword [rbp + 0x300]
xor rcx, rsp
call fcn.14008aca0
mov rbx, qword [rsp + 0x468]
add rsp, 0x410
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret