Function at 0x18001d460
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
sub rsp, 0x60
lea rcx, [0x18006ba90]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [0x18006bb34], 0
jne 0x18001d93a
lea rax, [rsp + 0x90]
mov ebx, 2
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesTcpipParameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor esi, esi
test eax, eax
jne 0x18001d505
mov rcx, qword [rsp + 0x90]
lea rax, [rsp + 0x88]
mov dword [rsp + 0x28], 4
lea rdx, str.DisableTaskOffload
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x88], esi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.180021440
cmp rax, 0xffffffffffffffff
jne 0x18001d518
mov rbp, rax
jmp 0x18001d93e
mov r8d, 0x104
mov qword [rsp + 0x98], rdi
lea rdx, [0x18006b480]
mov qword [0x180068dc8], rax
lea rcx, [0x18006bbe0]
call fcn.18004c7d0
lea rcx, [0x18006ba90]
mov dword [rsp + 0x88], esi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [0x180068dc8]
cmp rcx, 0xffffffffffffffff
je 0x18001d5d4
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x90]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rsp + 0x88]
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x22019c
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x18001d5d4
cmp dword [rsp + 0x90], esi
jbe 0x18001d5d4
mov eax, dword [rsp + 0x88]
lea rcx, [0x18006ba90]
dec eax
cmp eax, 1
setbe dil
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test dil, dil
je 0x18001d5e1
mov dword [0x180068ddc], 0x20000
jmp 0x18001d5e1
lea rcx, [0x18006ba90]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x18006ba90]
mov dword [rsp + 0x88], esi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [0x180068dc8]
cmp rcx, 0xffffffffffffffff
jne 0x18001d613
lea rcx, [0x18006ba90]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, esi
jmp 0x18001d682
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x90]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rsp + 0x88]
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x22019c
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x18001d670
cmp dword [rsp + 0x90], esi
jbe 0x18001d670
lea rcx, [0x18006ba90]
cmp dword [rsp + 0x88], ebx
jne 0x18001d677
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x18001d682
lea rcx, [0x18006ba90]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 1
xor eax, eax
mov dword [0x18006bb54], ebx
lea rbp, [0x18006bce8]
mov dword [rsp + 0x80], esi
mov rdi, rbp
mov ecx, 0x20
rep stosb byte [rdi], al
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea rdi, [rsp + 0x40]
mov ecx, 0x20
mov rbx, rax
xor r9d, r9d
xor eax, eax
xor r8d, r8d
rep stosb byte [rdi], al
mov rcx, qword [0x180068dc8]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov edx, 0x12cc60
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x58], rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rbp, 0xffffffffffffffff
test eax, eax
jne 0x18001d714
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x18001d742
mov rcx, qword [0x180068dc8]
lea r8, [rsp + 0x80]
mov r9d, 1
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x18001d742
cmp dword [rsp + 0x80], 0x20
je 0x18001d764
mov rcx, qword [0x180068dc8]
cmp rcx, rbp
je 0x18001d8f8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x180068dc8], rbp
jmp 0x18001d8f8
lea rax, [0x18006bb38]
mov ecx, 0x18010
mov qword [0x18006bb40], rax
mov qword [0x18006bb38], rax
lea rax, [0x18006bb58]
mov qword [0x18006bb60], rax
mov qword [0x18006bb58], rax
call fcn.180030000
mov rdx, rax
test rax, rax
jne 0x18001d7a5
mov rdx, rsi
jmp 0x18001d7b7
mov rdi, rdx
xor eax, eax
mov ecx, 0x18010
rep stosb byte [rdi], al
mov dword [rdx], 0x3001
mov ecx, 0x18010
mov qword [0x18006bb48], rdx
call fcn.180030000
mov rdx, rax
test rax, rax
jne 0x18001d7d5
mov rdx, rsi
jmp 0x18001d7e7
mov rdi, rdx
xor eax, eax
mov ecx, 0x18010
rep stosb byte [rdi], al
mov dword [rdx], 0x3001
xor eax, eax
mov qword [0x18006bb68], rdx
lea rdx, [0x18006bb70]
mov byte [0x18006bb34], 1
mov rdi, rdx
mov ecx, 0x60
rep stosb byte [rdi], al
lea rax, [0x18006bb88]
mov qword [0x18006bb78], rdx
mov qword [0x18006bb90], rax
lea rcx, [0x18006ba90]
mov qword [0x18006bb88], rax
lea rax, [0x18006bba0]
mov qword [0x18006bba8], rax
mov qword [0x18006bba0], rax
lea rax, [0x18006bbb8]
mov qword [0x18006bbc0], rax
mov qword [0x18006bbb8], rax
mov qword [0x18006bb70], rdx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [0x180068dc8], rbp
je 0x18001d8e6
cmp qword [0x180068dd0], rbp
jne 0x18001d8e6
mov rcx, qword [0x180068db0]
lea rax, [0x180068d98]
mov qword [0x18006bbd0], rax
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [0x180068da8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [0x180068da0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rax, [rsp + 0x88]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, [0x18001c790]
xor edx, edx
mov dword [rsp + 0x20], esi
xor ecx, ecx
call fcn.1800302f4
test rax, rax
jne 0x18001d912
mov rcx, qword [0x180068da8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov qword [0x180068dd0], rbp
lea rcx, [0x18006ba90]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.18001d960
mov esi, ebp
mov rdi, qword [rsp + 0x98]
cmp rbx, rbp
je 0x18001d940
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18001d940
mov rcx, qword [0x180068da0]
mov edx, 0xffffffff
mov qword [0x180068dd0], rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, [0x18006ba90]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x18001d8fa
xor esi, esi
mov ebp, esi
mov esi, ebp
lea rcx, [0x18006ba90]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
add rsp, 0x60
pop rsi
pop rbp
pop rbx
ret