Function at 0x1800622dc
Capabilities:
Delete registry key
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x440]
sub rsp, 0x540
mov rax, qword [0x1800b7160]
xor rax, rsp
mov qword [rbp + 0x430], rax
mov r13, rdx
mov qword [rbp - 0x80], 7
xor ebx, ebx
mov dword [rbp + 0x38], 0x20
lea rax, [0x1800a2ff8]
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x78], rax
mov r15d, r8d
mov rax, qword [rdx + 8]
mov r14, rcx
mov qword [rbp - 0x70], rax
lea edx, [rbx + 4]
lea r9d, [rbx + 1]
mov qword [rsp + 0x58], rbx
lea r8d, [rbx + 2]
mov dword [rsp + 0x70], r9d
lea rax, str.DNSSECValidationRequired
mov dword [rbp - 0x68], r8d
mov qword [rbp - 0x60], rax
lea ecx, [rbx + 8]
lea rax, [r13 + 0x10]
mov dword [rbp - 0x50], r8d
mov qword [rbp - 0x48], rax
mov r12d, ebx
lea rax, str.DNSSECQueryIPSECRequired
mov dword [rbp - 0x28], r8d
mov qword [rbp - 0x38], rax
mov esi, ebx
lea rax, [r13 + 0x14]
mov dword [rbp], r8d
mov qword [rbp - 0x20], rax
lea r8d, [rbx + 0x10]
lea rax, str.DNSSECQueryIPSECEncryption
mov dword [rbp - 0x78], r9d
mov qword [rbp - 0x10], rax
lea rax, [r13 + 0x18]
mov qword [rbp + 8], rax
lea rax, str.IPSECCARestriction
mov qword [rbp + 0x18], rax
mov rax, qword [r13 + 0x20]
mov qword [rbp + 0x30], rax
lea rax, str.DirectAccessDNSServers
mov qword [rbp + 0x40], rax
mov rax, qword [r13 + 0x28]
mov qword [rbp + 0x58], rax
lea rax, str.DirectAccessQueryIPSECRequired
mov qword [rbp + 0x68], rax
lea rax, [r13 + 0x30]
mov qword [rbp + 0x80], rax
lea rax, str.DirectAccessQueryIPSECEncryption
mov qword [rbp + 0x90], rax
lea rax, [r13 + 0x34]
mov qword [rbp + 0xa8], rax
lea rax, str.DirectAccessProxyType
mov qword [rbp + 0xb8], rax
lea rax, [r13 + 0x38]
mov qword [rbp + 0xd0], rax
lea rax, str.DirectAccessProxyName
mov qword [rbp + 0xe0], rax
mov qword [rbp - 0x58], rdx
mov dword [rbp - 0x40], edx
mov qword [rbp - 0x30], rdx
mov dword [rbp - 0x18], ecx
mov qword [rbp - 8], rdx
mov dword [rbp + 0x10], r8d
mov dword [rbp + 0x20], r9d
mov dword [rbp + 0x24], r9d
mov dword [rbp + 0x28], r9d
mov qword [rbp + 0x48], r9
mov dword [rbp + 0x50], edx
mov dword [rbp + 0x60], 0x40
mov qword [rbp + 0x70], rdx
mov dword [rbp + 0x78], edx
mov dword [rbp + 0x88], 0x80
mov qword [rbp + 0x98], rdx
mov dword [rbp + 0xa0], edx
mov dword [rbp + 0xb0], pe_nt_image_headers64
mov qword [rbp + 0xc0], rdx
mov dword [rbp + 0xc8], edx
mov dword [rbp + 0xd8], 0x200
mov qword [rbp + 0xe8], r9
mov rax, qword [r13 + 0x40]
mov qword [rbp + 0xf8], rax
lea rax, str.ConfigOptions
mov qword [rbp + 0x108], rax
lea rax, [r13 + 0x48]
mov qword [rbp + 0x120], rax
lea rax, str.Version
mov qword [rbp + 0x130], rax
lea rax, [r13 + 0x4c]
mov qword [rbp + 0x148], rax
lea rax, str.GenericDNSServers
mov qword [rbp + 0x158], rax
mov rax, qword [r13 + 0x50]
mov qword [rbp + 0x170], rax
lea rax, str.VPNRequired
mov qword [rbp + 0x180], rax
lea rax, [r13 + 0x58]
mov qword [rbp + 0x198], rax
lea rax, [0x1800a3268]
mov qword [rbp + 0x1a8], rax
lea rax, [r13 + 0x5c]
mov qword [rbp + 0x1c0], rax
lea rax, [0x1800a3280]
mov qword [rbp + 0x1d0], rax
mov rax, qword [r13 + 0x60]
mov qword [rbp + 0x1e8], rax
lea rax, str.IDNConfig
mov qword [rbp + 0x1f8], rax
lea rax, [r13 + 0x68]
mov qword [rbp + 0x210], rax
mov dword [rbp + 0xf0], edx
mov dword [rbp + 0x100], 0x400
mov qword [rbp + 0x110], rdx
mov dword [rbp + 0x118], r9d
mov dword [rbp + 0x128], 0x800
mov qword [rbp + 0x138], rdx
mov dword [rbp + 0x140], r9d
mov dword [rbp + 0x150], 0x1000
mov qword [rbp + 0x160], r9
mov dword [rbp + 0x168], ecx
mov dword [rbp + 0x178], 0x2000
mov dword [rbp + 0x188], edx
mov dword [rbp + 0x18c], r9d
mov dword [rbp + 0x190], ecx
mov dword [rbp + 0x1a0], 0x4000
mov dword [rbp + 0x1b0], edx
mov dword [rbp + 0x1b4], r9d
mov dword [rbp + 0x1b8], ecx
mov dword [rbp + 0x1c8], 0x8000
mov dword [rbp + 0x1d8], r9d
mov dword [rbp + 0x1dc], r9d
mov dword [rbp + 0x1e0], ecx
mov dword [rbp + 0x1f0], 0x10000
mov qword [rbp + 0x200], rdx
mov dword [rbp + 0x208], r8d
test byte [0x1800b78f1], dl
je 0x180062633
lea ecx, [rbx + 0x14]
mov r9d, r15d
mov r8, r14
lea rdx, [0x1800a3388]
call fcn.180087538
mov edi, 0x20a
lea rcx, [rbp + 0x220]
mov r8d, edi
xor edx, edx
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x50], ebx
test byte [0x1800b78f3], 0x10
lea rcx, str.ParametersDnsPolicyConfig
je 0x18006268a
lea rax, [rbp + 0x220]
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rax
lea r9, str.SYSTEMCurrentControlSetServicesDnscache
lea r8, str.Dnscache
mov qword [rsp + 0x20], rcx
call fcn.180094330
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea r8, str.SYSTEMCurrentControlSetServicesDnscache
lea rax, [rbp + 0x220]
mov dword [rsp + 0x28], edi
xor edx, edx
mov qword [rsp + 0x20], rax
lea rcx, str.Dnscache
call qword [sym.imp.ntdll.dll_RtlGetPersistedStateLocation]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x180062735
test byte [0x1800b78f3], 0x10
je 0x1800626f5
lea r10, str.ParametersDnsPolicyConfig
mov dword [rsp + 0x28], eax
lea r9, str.SYSTEMCurrentControlSetServicesDnscache
mov qword [rsp + 0x20], r10
lea r8, str.Dnscache
call fcn.180094248
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
xor edi, edi
mov ecx, 0x13d
test eax, eax
cmove eax, ecx
cmp eax, ecx
jne 0x18006271c
bts ebx, 0x1c
jmp 0x180062811
test eax, eax
jg 0x180062727
mov ebx, eax
jmp 0x180062811
movzx ebx, ax
or ebx, 0x80070000
jmp 0x180062811
sub edi, dword [rsp + 0x50]
lea rdx, [rbp + 0x220]
mov eax, dword [rsp + 0x50]
lea r10, str.ParametersDnsPolicyConfig
shr rax, 1
mov ecx, edi
shr rcx, 1
lea rdx, [rdx + rax*2]
mov eax, 0x5c
mov word [rdx - 2], ax
mov rax, rcx
neg rax
sbb ebx, ebx
xor edi, edi
not ebx
and ebx, 0x80070057
test rcx, rcx
je 0x1800627c1
mov r8d, 0x7ffffffe
mov r9, r10
sub r8, rcx
sub r9, rdx
lea rax, [rcx + r8]
test rax, rax
je 0x1800627a6
movzx eax, word [rdx + r9]
test ax, ax
je 0x1800627a6
mov word [rdx], ax
add rdx, 2
sub rcx, 1
jne 0x180062786
test rcx, rcx
lea rax, [rdx - 2]
cmovne rax, rdx
neg rcx
sbb ebx, ebx
not ebx
and ebx, 0x8007007a
mov word [rax], di
test ebx, ebx
jns 0x1800627e4
test byte [0x1800b78f3], 0x10
je 0x18006282e
mov ecx, 0xc
lea rdx, [0x18009f460]
mov r8d, ebx
call fcn.1800876bc
jmp 0x180062811
test byte [0x1800b78f3], 0x10
je 0x18006282e
lea rax, [rbp + 0x220]
mov qword [rsp + 0x28], rax
lea r9, str.SYSTEMCurrentControlSetServicesDnscache
lea r8, str.Dnscache
mov qword [rsp + 0x20], r10
call fcn.180094124
test byte [0x1800b78f3], 0x10
je 0x18006282e
mov ecx, 0xe
lea rdx, [0x18009f460]
mov r8d, ebx
call fcn.1800876bc
test ebx, ebx
jns 0x18006283b
mov ecx, ebx
call fcn.180011928
jmp 0x180062868
lea rax, [rsp + 0x60]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x220]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x18006289a
test byte [0x1800b78f1], 4
je 0x180062892
mov ecx, 0xa
lea r8, [rbp + 0x220]
mov r9d, eax
lea rdx, [0x18009f440]
call fcn.180087538
test ebx, ebx
jne 0x180062a00
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, 0xfffffffd
je 0x1800628e6
test byte [0x1800b78f1], 4
je 0x180062a00
mov ecx, 0x15
mov r9d, eax
mov r8, r14
lea rdx, [0x1800a3388]
call fcn.180087538
jmp 0x180062a00
mov qword [rsp + 0x40], rdi
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x38], rcx
mov eax, edi
mov rcx, qword [rsp + 0x60]
test r15d, r15d
mov qword [rsp + 0x30], rdi
mov rdx, r14
setne al
mov dword [rsp + 0x28], 0x20006
xor r9d, r9d
mov dword [rsp + 0x20], eax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x180062942
test byte [0x1800b78f1], 4
je 0x180062a00
mov ecx, 0x16
jmp 0x1800628cf
mov r15d, edi
lea rdi, [rbp - 0x70]
mov eax, dword [rdi - 0x20]
test dword [r13 + 4], eax
je 0x1800629d1
mov eax, dword [rdi - 0x10]
sub eax, 1
je 0x180062977
sub eax, 3
je 0x180062970
cmp eax, 3
jne 0x18006299f
mov rcx, qword [rdi]
call fcn.180072898
mov esi, eax
jmp 0x18006299a
mov esi, 4
jmp 0x18006299a
mov rcx, qword [rdi]
lea r8, [rsp + 0x58]
mov edx, 0x104
call fcn.180001bc8
test eax, eax
js 0x180062ac2
mov rsi, qword [rsp + 0x58]
add rsi, 2
mov qword [rsp + 0x58], rsi
mov rax, qword [rdi]
xor r8d, r8d
mov r9d, dword [rdi - 0x10]
mov rdx, qword [rdi - 0x18]
mov rcx, qword [rsp + 0x68]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x180062a9c
inc r15d
add rdi, 0x28
cmp r15d, 0x11
jb 0x180062949
test byte [0x1800b78f1], 4
mov r12d, 1
je 0x180062a00
lea rdx, str.NRPT_rule_set_successfully
mov rcx, r13
call fcn.180062224
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x180062a16
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
test r12d, r12d
jne 0x180062a35
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteKeyExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x180062a4b
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
test ebx, ebx
je 0x180062a6f
test byte [0x1800b78f1], 4
je 0x180062a6f
mov ecx, 0x18
lea rdx, [0x1800a3388]
mov r9d, ebx
mov r8, r14
call fcn.180087538
mov eax, ebx
mov rcx, qword [rbp + 0x430]
xor rcx, rsp
call fcn.18002d5c0
mov rbx, qword [rsp + 0x598]
add rsp, 0x540
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test byte [0x1800b78f1], 4
je 0x180062a00
mov eax, r15d
mov ecx, 0x17
mov r9d, ebx
lea r8, [rax + rax*4]
mov r8, qword [rsp + r8*8 + 0x78]
jmp 0x1800628d5
mov ebx, 0x57
jmp 0x180062a00