Function at 0x14006f198
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4e0
mov r12, rdx
mov r14, rcx
mov rdx, rcx
mov rbx, r9
mov r13, r8
or rdi, 0xffffffffffffffff
lea rcx, [rsp + 0x60]
mov r8, rdi
mov qword [rsp + 0x70], rbx
call fcn.14006d61c
mov r15, qword [rsp + 0x530]
lea rcx, [rsp + 0x80]
mov rbp, qword [rax]
mov rdx, r15
mov r8, rdi
call fcn.14006d61c
lea rcx, [rsp + 0x58]
mov r8, rdi
mov rdx, rbx
mov rsi, rax
call fcn.14006d61c
lea rcx, [rsp + 0x78]
or r8, 0xffffffffffffffff
mov rdx, r13
mov rdi, rax
call fcn.14006d61c
lea rcx, [rsp + 0x68]
or r8, 0xffffffffffffffff
mov rdx, r12
mov rbx, rax
call fcn.14006d61c
mov rcx, qword [rsi]
lea rdx, str._r_nRegSetIP__s__s__s__s__s__r_n
mov r9, qword [rax]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rdi]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbx]
mov r8, rbp
mov qword [rsp + 0x20], rcx
lea rcx, [0x1401350d0]
call fcn.140018a7c
lea rcx, [rsp + 0x60]
call fcn.1400591f8
lea rcx, [rsp + 0x68]
call fcn.1400591f8
lea rcx, [rsp + 0x78]
call fcn.1400591f8
lea rcx, [rsp + 0x58]
call fcn.1400591f8
lea rcx, [rsp + 0x80]
call fcn.1400591f8
xor esi, esi
cmp byte [r12], 0x2a
mov bl, sil
je 0x14006f2ae
cmp byte [r12], 0x3f
jne 0x14006f2b2
mov bl, byte [r12]
lea rdx, str.SYSTEMCurrentControlSetServicesTcpipParametersInterfaces_
lea rcx, [rsp + 0x60]
call fcn.14006d598
lea rcx, [rsp + 0x60]
mov rdx, r14
call fcn.1400614d4
mov rdx, qword [rsp + 0x60]
mov r11b, bl
neg r11b
lea rax, [rsp + 0x48]
mov rcx, 0xffffffff80000002
sbb r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
not r9d
and r9d, 0x20006
or r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
jne 0x14006f524
mov bpl, 0x2d
cmp byte [r12], bpl
jne 0x14006f32e
lea rcx, [rsp + 0x48]
mov r8, r15
mov rdx, r14
call fcn.14006f010
mov esi, eax
jmp 0x14006f524
cmp bl, sil
je 0x14006f535
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x518]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
lea rdx, str.EnableDHCP
mov r14d, 0x320
xor r8d, r8d
mov dword [rsp + 0x58], esi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x518], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x58]
cmp eax, esi
cmovne ecx, esi
mov dword [rsp + 0x58], ecx
cmp bl, 0x3f
jne 0x14006f397
mov r9d, esi
cmp ecx, esi
jne 0x14006f39d
mov r9d, 4
mov rcx, qword [rsp + 0x48]
movsxd rdi, r9d
lea rbx, [r12 + 1]
lea rax, [rsp + 0x518]
lea r12, [0x140000000]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, [rdi + r12 + 0x11f800]
xor r8d, r8d
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x518], r14d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [rsp + 0x518]
mov rcx, rbx
call fcn.14005aca8
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x518]
mov qword [rsp + 0x28], rax
lea rdx, [rdi + r12 + 0x11f7f0]
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x518], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [rsp + 0x518]
mov rcx, r13
call fcn.14005aca8
mov rbp, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x518]
lea rdx, [rdi + r12 + 0x11f7d8]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x518], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [rsp + 0x518]
mov rcx, rbp
call fcn.14005aca8
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x518]
mov qword [rsp + 0x28], rax
lea rdx, [rdi + r12 + 0x11f7c8]
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x518], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x518]
lea r9, [rsp + 0x40]
lea rdx, str.DhcpServer
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x538]
xor r8d, r8d
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x518], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r11, qword [rsp + 0x540]
cmp r11, rsi
je 0x14006f51f
cmp dword [rsp + 0x58], esi
setne al
add al, 0x30
movsx eax, al
mov word [r11], ax
mov esi, 1
lea rcx, [rsp + 0x60]
call fcn.1400591f8
mov eax, esi
jmp 0x14006f9bc
mov ebx, 0xdb
lea rcx, [rsp + 0x241]
xor edx, edx
mov r8, rbx
mov byte [rsp + 0x240], sil
call fcn.1400fae60
lea rcx, [rsp + 0x161]
mov r8, rbx
xor edx, edx
mov byte [rsp + 0x160], sil
call fcn.1400fae60
lea rcx, [rsp + 0x401]
mov r8, rbx
xor edx, edx
mov byte [rsp + 0x400], sil
call fcn.1400fae60
lea rcx, [rsp + 0x321]
mov r8, rbx
xor edx, edx
mov byte [rsp + 0x320], sil
call fcn.1400fae60
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x518]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x400]
lea r9, [rsp + 0x40]
lea rdx, str.IPAddress
mov ebx, 0xc8
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x518], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [rsp + 0x518]
lea rcx, [rsp + 0x400]
call fcn.14005aca8
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov edi, eax
mov eax, dword [rsp + 0x518]
lea rdx, str.SubnetMask
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x518]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x320]
shl edi, 0x10
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x518], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [rsp + 0x518]
lea rcx, [rsp + 0x320]
call fcn.14005aca8
lea r8d, [rbx - 1]
lea rcx, [rsp + 0x91]
shl eax, 0x10
xor edx, edx
mov byte [rsp + 0x90], sil
add edi, eax
mov eax, dword [rsp + 0x518]
mov dword [rsp + 0x58], eax
call fcn.1400fae60
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x518]
lea r9, [rsp + 0x40]
lea rdx, str.EnableDHCP
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x518], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [rsp + 0x50], esi
jle 0x14006f6d4
add edi, 0x10000
cmp byte [r12], bpl
lea rbx, [0x1401162a8]
mov r14d, 0xc6
mov rdx, rbx
lea rcx, [rsp + 0x240]
mov r8d, r14d
cmovne rdx, r12
call qword [sym.imp.KERNEL32.dll_lstrcpynA]
cmp byte [r13], bpl
mov rdx, rbx
lea rcx, [rsp + 0x160]
mov r8d, r14d
cmovne rdx, r13
call qword [sym.imp.KERNEL32.dll_lstrcpynA]
mov rax, qword [rsp + 0x70]
mov rdx, rbx
cmp byte [rax], bpl
cmovne rdx, rax
cmp byte [rdx], 0x30
je 0x14006f73e
lea rcx, [rsp + 0x90]
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_lstrcpynA]
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, [rsp + 0x160]
movsxd r14, eax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, [rsp + 0x90]
movsxd rbp, eax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, r12
movsxd rbx, eax
call qword [0x140135540]
mov byte [rsp + rbx + 0x91], sil
mov byte [rsp + rbp + 0x161], sil
mov byte [rsp + r14 + 0x241], sil
cmp r14d, esi
je 0x14006f79b
add r14d, 2
cmp ebp, esi
je 0x14006f7a2
add ebp, 2
cmp ebx, esi
je 0x14006f7a8
inc ebx
lea rcx, [rsp + 0x160]
inc ebx
call fcn.14005ac7c
lea rcx, [rsp + 0x240]
mov r8d, eax
call fcn.14005ac7c
lea rcx, [rsp + 0x90]
add eax, edi
add eax, r8d
mov dword [rsp + 0x68], eax
call fcn.14005ac7c
cmp r15, rsi
mov r8d, esi
sete r8b
mov rdi, r15
mov dword [rsp + 0x50], r8d
cmp r15, rsi
je 0x14006f812
cmp byte [r15], 0x2d
lea rax, [0x1401162a8]
lea rdi, [0x1401162a8]
cmovne rax, r15
cmp byte [r15], 0x30
cmovne rdi, rax
cmp byte [r12], sil
je 0x14006f845
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x240]
lea rdx, str.IPAddress
mov r9d, 7
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp byte [r13], sil
je 0x14006f877
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x160]
lea rdx, str.SubnetMask
mov r9d, 7
xor r8d, r8d
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rbp, qword [rsp + 0x70]
cmp byte [rbp], sil
je 0x14006f8ae
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x90]
lea rdx, str.DefaultGateway
mov r9d, 7
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp byte [r15], sil
je 0x14006f8e3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rdx, str.NameServer
mov r9d, 1
movsxd rcx, eax
xor r8d, r8d
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rdx, str.EnableDHCP
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [r13], sil
jne 0x14006f962
cmp byte [rsp + 0x320], sil
je 0x14006f962
movsxd rbx, dword [rsp + 0x58]
lea rdx, [rsp + 0x320]
mov rcx, r13
mov r8, rbx
call fcn.14001d614
lea r11d, [rbx - 2]
mov rax, rsi
movsxd rcx, r11d
cmp rcx, rsi
jle 0x14006f962
cmp byte [rax + r13], sil
jne 0x14006f95a
mov byte [rax + r13], 0x3b
inc rax
cmp rax, rcx
jl 0x14006f94f
cmp byte [r12], sil
jne 0x14006f9ac
cmp byte [rsp + 0x400], sil
je 0x14006f9ac
movsxd rbx, dword [rsp + 0x78]
lea rdx, [rsp + 0x400]
mov rcx, r12
mov r8, rbx
call fcn.14001d614
lea r11d, [rbx - 2]
mov rax, rsi
movsxd rcx, r11d
cmp rcx, rsi
jle 0x14006f9ac
cmp byte [rax + r12], sil
jne 0x14006f9a4
mov byte [rax + r12], 0x3b
inc rax
cmp rax, rcx
jl 0x14006f999
lea rcx, [rsp + 0x60]
call fcn.1400591f8
mov eax, dword [rsp + 0x68]
inc eax
lea r11, [rsp + 0x4e0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret