Function at 0x140079f30
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x310]
sub rsp, 0x410
mov rax, qword [0x1400c7008]
xor rax, rsp
mov qword [rbp + 0x300], rax
mov r12, qword [r8 + 0x18]
movzx esi, dx
xor edx, edx
xor r13b, r13b
mov qword [rsp + 0x48], rdx
mov rdi, r8
mov qword [rsp + 0x50], rdx
movzx r15d, cl
cmp si, 0x17
jne 0x140079f8c
mov eax, dword [r8 + 0x138]
jmp 0x140079f90
mov eax, dword [r8 + 0x5c]
test r15b, r15b
lea r14, str.IPv4
mov ebx, edx
cmovne ebx, eax
cmp si, 0x17
lea rax, str.IPv6
cmove r14, rax
test ebx, ebx
jne 0x140079fbe
test r15b, r15b
je 0x140079fbe
mov al, 1
jmp 0x14007a45f
xorps xmm0, xmm0
mov dword [rbp - 0x60], edx
xorps xmm1, xmm1
mov dword [rbp - 0x54], edx
movzx eax, r15b
mov qword [rbp + 0x2a0], rdx
neg al
mov dword [rbp + 0x2a8], edx
mov eax, dword [r8 + 0x2b0]
mov r8d, 0x100
mov rdx, qword [rdi + 0x140]
sbb ecx, ecx
add ecx, 6
mov dword [rbp - 0x58], eax
mov dword [rbp - 0x70], ecx
xor eax, eax
lea rcx, [rbp - 0x54]
mov qword [rbp - 0x68], 0x368
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmmword [rbp - 0x20], xmm1
movdqa xmmword [rbp - 0x10], xmm0
movdqa xmmword [rbp], xmm1
movdqa xmmword [rbp + 0x10], xmm0
movdqa xmmword [rbp + 0x20], xmm1
movdqa xmmword [rbp + 0x30], xmm0
movdqa xmmword [rbp + 0x40], xmm1
movdqa xmmword [rbp + 0x50], xmm0
movdqa xmmword [rbp + 0x60], xmm1
movdqa xmmword [rbp + 0x70], xmm0
movdqa xmmword [rbp + 0x80], xmm1
movdqa xmmword [rbp + 0x90], xmm0
movdqa xmmword [rbp + 0xa0], xmm1
movdqa xmmword [rbp + 0xb0], xmm0
movdqa xmmword [rbp + 0xc0], xmm1
movdqa xmmword [rbp + 0xd0], xmm0
movdqa xmmword [rbp + 0xe0], xmm1
movdqa xmmword [rbp + 0xf0], xmm0
movdqa xmmword [rbp + 0x100], xmm1
movdqa xmmword [rbp + 0x110], xmm0
movdqa xmmword [rbp + 0x120], xmm1
movdqa xmmword [rbp + 0x130], xmm0
movdqa xmmword [rbp + 0x140], xmm1
movdqa xmmword [rbp + 0x150], xmm0
movdqa xmmword [rbp + 0x160], xmm1
movdqa xmmword [rbp + 0x170], xmm0
movdqa xmmword [rbp + 0x180], xmm1
movdqa xmmword [rbp + 0x190], xmm0
movdqa xmmword [rbp + 0x1a0], xmm1
movdqa xmmword [rbp + 0x1b0], xmm0
movdqa xmmword [rbp + 0x1c0], xmm1
movdqa xmmword [rbp + 0x1d0], xmm0
movdqa xmmword [rbp + 0x1e0], xmm1
movdqa xmmword [rbp + 0x1f0], xmm0
movdqa xmmword [rbp + 0x200], xmm1
movdqa xmmword [rbp + 0x210], xmm0
movdqa xmmword [rbp + 0x220], xmm1
movdqa xmmword [rbp + 0x230], xmm0
movdqa xmmword [rbp + 0x240], xmm1
movdqa xmmword [rbp + 0x250], xmm0
movdqa xmmword [rbp + 0x260], xmm1
movdqa xmmword [rbp + 0x270], xmm0
movdqa xmmword [rbp + 0x280], xmm1
movdqa xmmword [rbp + 0x290], xmm0
mov word [rbp + 0x2ac], si
mov dword [rbp + 0x2b0], ebx
movups xmmword [rbp + 0x2b4], xmm0
mov dword [rbp + 0x2f4], eax
movups xmmword [rbp + 0x2c4], xmm0
movups xmmword [rbp + 0x2d4], xmm0
movups xmmword [rbp + 0x2e4], xmm0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0xab], r13b
cmp ebx, 4
jbe 0x14007a1ca
mov ebx, 4
mov dword [rbp + 0x2b0], ebx
lea ecx, [rbx + 0x3c]
call fcn.14000e3d0
test al, al
je 0x14007a1ce
mov r9d, ebx
lea rdx, str.Number_of__s_DNS_addresses_sent_to_service_truncated_to__d
mov r8, r14
lea ecx, [rbx + 0x3c]
call fcn.14000e000
jmp 0x14007a1ce
test ebx, ebx
jle 0x14007a22a
cmp si, 0x17
jne 0x14007a200
movabs rax, 0xfffffffffffffff
mov r8d, ebx
and r8, rax
lea rdx, [rdi + 0xf8]
add r8, r8
lea rcx, [rbp + 0x2b4]
shl r8, 3
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14007a22a
movsxd rsi, ebx
test ebx, ebx
jle 0x14007a22a
lea rbx, [rbp + 0x2b4]
add rdi, 0x4c
mov ecx, dword [rdi]
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rbx], eax
lea rbx, [rbx + 0x10]
lea rdi, [rdi + 4]
sub rsi, 1
jne 0x14007a212
cmp dword [0x1400cfe94], 4
jb 0x14007a27a
mov ecx, 0x34000004
call fcn.14000e3d0
test al, al
je 0x14007a27a
lea rax, str.Setting
test r15b, r15b
lea r8, str.Deleting
mov r9, r14
cmovne r8, rax
lea rdx, str._s__s_dns_servers_on__s__if_index___d__using_service
mov eax, dword [rbp - 0x58]
mov ecx, 0x34000004
mov dword [rsp + 0x28], eax
lea rax, [rbp - 0x54]
mov qword [rsp + 0x20], rax
call fcn.14000e000
xor ebx, ebx
lea r9, [rsp + 0x40]
mov r8d, 0x368
mov qword [rsp + 0x58], rbx
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x60], rbx
mov rcx, r12
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14007a3c8
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbx
lea r8d, [rbx + 0x20]
mov rcx, r12
lea rdx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14007a3c8
cmp dword [rbp - 0x80], ebx
je 0x14007a380
lea ecx, [rbx + 0x40]
call fcn.14000e3d0
test al, al
je 0x14007a45b
mov ecx, dword [rbp - 0x80]
lea rdx, [rsp + 0x48]
call fcn.14000ebf0
test r15b, r15b
lea rdx, str.adding
lea r8, str.deleting
mov r9, r14
cmovne r8, rdx
lea ecx, [rbx + 0x40]
lea rdx, [rbp - 0x54]
mov qword [rsp + 0x30], rdx
mov edx, dword [rbp - 0x80]
mov dword [rsp + 0x28], edx
lea rdx, str.TUN:__s__s_dns_failed_using_service:__s__status_u_if_name_s_
mov qword [rsp + 0x20], rax
call fcn.14000e000
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14007a351
nop dword [rax + rax]
mov rbx, qword [rcx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbx
test rbx, rbx
jne 0x14007a340
mov rdi, qword [rsp + 0x50]
test rdi, rdi
je 0x14007a45b
nop
mov rcx, qword [rdi + 0x10]
mov rbx, qword [rdi]
call qword [rdi + reloc.WS2_32.dll_htonl]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdi, rbx
test rbx, rbx
jne 0x14007a360
jmp 0x14007a45b
cmp dword [0x1400cfe94], 1
jb 0x14007a3c0
mov ecx, 1
call fcn.14000e3d0
test al, al
je 0x14007a3c0
test r15b, r15b
lea rax, [0x1400b6534]
lea r9, str.deleted
mov r8, r14
cmovne r9, rax
lea rdx, str._s_dns_servers__s_using_service
mov ecx, 1
call fcn.14000e000
mov r13b, 1
jmp 0x14007a45b
mov ecx, 0x40
call fcn.14000e3d0
test al, al
je 0x14007a45b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, [rsp + 0x58]
call fcn.14000ebf0
mov r9, rax
mov dword [rsp + 0x20], ebx
lea r8, [0x1400b6430]
mov ecx, 0x40
lea rdx, str._s:_could_not_talk_to_service:__s___lu_
call fcn.14000e000
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14007a431
nop dword [rax]
mov rbx, qword [rcx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbx
test rbx, rbx
jne 0x14007a420
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x14007a45b
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
mov rdi, qword [rbx]
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, rdi
test rdi, rdi
jne 0x14007a440
movzx eax, r13b
mov rcx, qword [rbp + 0x300]
xor rcx, rsp
call fcn.140088150
mov rbx, qword [rsp + 0x468]
add rsp, 0x410
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret