Function at 0x18005fe30
Capabilities:
Delete registry key
Persist via windows service
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x488]
sub rsp, 0x560
mov rax, qword [0x1800b7160]
xor rax, rsp
mov qword [rbp + 0x450], rax
xor r14d, r14d
mov rdi, rdx
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x58], r14
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x68], r14
cmp ecx, 1
jne 0x1800603c1
test rdx, rdx
je 0x18006069e
xor edx, edx
mov dword [rsp + 0x70], r14d
mov rcx, rdi
call sym.DNSAPI.dll_DnsValidateName_W
mov ebx, eax
test eax, eax
je 0x18005feb3
cmp eax, 0x2554
jne 0x180060698
mov esi, 0x2e
lea rcx, [rbp + 0x252]
mov r8, rdi
mov word [rbp + 0x250], si
mov edx, 0x1fc
call fcn.180001b28
test eax, eax
jns 0x18005fee1
mov ebx, 0x7b
jmp 0x1800606a3
mov ebx, 0x200
lea r8, [rsp + 0x78]
mov edx, ebx
lea rcx, [rbp + 0x250]
call fcn.180001bc8
test eax, eax
js 0x18005fed7
mov r13, qword [rsp + 0x78]
mov rax, r13
shr rax, 1
cmp rax, 1
jbe 0x18005ff1c
cmp word [rbp + rax*2 + 0x24e], si
jne 0x18005ff1c
sub r13, 2
mov rax, r13
shr rax, 1
add rax, rax
cmp rax, rbx
jae 0x1800603bb
mov word [rbp + rax + 0x250], r14w
add rax, 2
cmp rax, rbx
jae 0x1800603bb
mov esi, 4
mov word [rbp + rax + 0x250], r14w
lea r9, [rbp - 0x70]
xor edx, edx
lea r8, [rsp + 0x68]
add r13, rsi
lea rcx, [rbp + 0x250]
call sym.DNSAPI.dll_DnsGetPolicyTableInfo
mov ebx, eax
cmp eax, 0x2564
je 0x180060698
lea edi, [rsi + 0xc]
test eax, eax
jne 0x18005ffa9
mov rbx, qword [rsp + 0x68]
jmp 0x18005ffa4
mov rdx, qword [rbx]
lea rcx, [rbp + 0x250]
call fcn.180072930
test eax, eax
jne 0x18005ffa0
test byte [rbx + 0x6c], dil
jne 0x18005ffc7
mov rbx, qword [rbx + 0x70]
test rbx, rbx
jne 0x18005ff87
lea rcx, [rbp - 0x80]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
nop dword [rax + rax]
test eax, eax
je 0x18005ffd9
mov ebx, 8
jmp 0x1800606a3
mov eax, dword [rbx + 0x68]
neg eax
sbb ebx, ebx
and ebx, 0x1392
jmp 0x1800606a3
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x80]
call fcn.180027164
test eax, eax
je 0x18005ffbd
mov ebx, 0x20a
lea rcx, [rbp + 0x40]
mov r8d, ebx
xor edx, edx
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
mov dword [rsp + 0x54], r14d
test byte [0x1800b78f3], dil
lea r12, str.ParametersDnsPolicyConfig
lea r14, str.SYSTEMCurrentControlSetServicesDnscache
lea r15, str.Dnscache
je 0x18006003d
lea rax, [rbp + 0x40]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
mov r9, r14
mov r8, r15
mov qword [rsp + 0x20], r12
call fcn.180094330
lea rax, [rsp + 0x54]
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov r8, r14
lea rax, [rbp + 0x40]
mov dword [rsp + 0x28], ebx
xor edx, edx
mov qword [rsp + 0x20], rax
mov rcx, r15
call qword [sym.imp.ntdll.dll_RtlGetPersistedStateLocation]
nop dword [rax + rax]
xor r10d, r10d
mov dword [rsp + 0x78], eax
test eax, eax
jns 0x1800600a5
test byte [0x1800b78f3], dil
je 0x180060097
mov dword [rsp + 0x28], eax
mov r9, r14
mov r8, r15
mov qword [rsp + 0x20], r12
call fcn.180094248
mov eax, dword [rsp + 0x78]
mov ecx, eax
call fcn.1800828c8
mov ebx, eax
jmp 0x18006016b
sub ebx, dword [rsp + 0x54]
lea rdx, [rbp + 0x40]
mov eax, dword [rsp + 0x54]
shr rax, 1
mov ecx, ebx
shr rcx, 1
lea rdx, [rdx + rax*2]
mov eax, 0x5c
mov word [rdx - 2], ax
mov rax, rcx
neg rax
sbb ebx, ebx
not ebx
and ebx, 0x80070057
test rcx, rcx
je 0x180060126
mov r8d, 0x7ffffffe
mov r9, r12
sub r8, rcx
sub r9, rdx
lea rax, [r8 + rcx]
test rax, rax
je 0x18006010a
movzx eax, word [r9 + rdx]
test ax, ax
je 0x18006010a
mov word [rdx], ax
add rdx, 2
sub rcx, 1
jne 0x1800600ea
test rcx, rcx
lea rax, [rdx - 2]
cmovne rax, rdx
neg rcx
sbb ebx, ebx
not ebx
and ebx, 0x8007007a
mov word [rax], r10w
test ebx, ebx
jns 0x180060149
test byte [0x1800b78f3], dil
je 0x180060188
mov ecx, 0xc
lea rdx, [0x18009f460]
mov r8d, ebx
call fcn.1800876bc
jmp 0x18006016b
test byte [0x1800b78f3], dil
je 0x180060188
lea rax, [rbp + 0x40]
mov r9, r14
mov qword [rsp + 0x28], rax
mov r8, r15
mov qword [rsp + 0x20], r12
call fcn.180094124
test byte [0x1800b78f3], dil
je 0x180060188
mov ecx, 0xe
lea rdx, [0x18009f460]
mov r8d, ebx
call fcn.1800876bc
xor r14d, r14d
test ebx, ebx
jns 0x180060198
mov ecx, ebx
call fcn.180011928
jmp 0x1800601d6
mov qword [rsp + 0x40], r14
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x40]
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], r14d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x180060205
test byte [0x1800b78f1], sil
je 0x1800601fd
mov ecx, 0xa
lea r8, [rbp + 0x40]
mov r9d, eax
lea rdx, [0x18009f440]
call fcn.180087538
test ebx, ebx
jne 0x180060698
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], r14
lea rdx, [rbp - 0x60]
mov qword [rsp + 0x38], rax
mov r15d, 1
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x180060698
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x28], esi
lea rdx, str.Volatile
mov r9d, esi
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x70], r15d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x180060290
mov edi, r15d
jmp 0x1800606a6
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x250]
mov dword [rsp + 0x28], r13d
lea rdx, [0x1800a2ff8]
mov r9d, 7
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x180060288
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x28], 2
lea rdx, str.IPSECCARestriction
mov r9d, r15d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x70], r14d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x180060288
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x28], esi
lea rdx, str.Version
mov r9d, esi
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x70], 2
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x180060288
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x28], esi
lea rdx, str.ConfigOptions
mov r9d, esi
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x70], edi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x180060288
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x28], esi
lea rdx, str.IDNConfig
mov r9d, esi
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x70], r14d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x18006068f
jmp 0x180060288
call fcn.18002d798
int3
cmp ecx, 2
jne 0x18006069e
mov ebx, 0x20a
lea rcx, [rbp + 0x40]
mov r8d, ebx
xor edx, edx
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
mov dword [rsp + 0x54], r14d
mov edi, 0x10
lea r12, str.ParametersDnsPolicyConfig
test byte [0x1800b78f3], dil
lea r14, str.SYSTEMCurrentControlSetServicesDnscache
lea r15, str.Dnscache
je 0x180060422
lea rax, [rbp + 0x40]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
mov r9, r14
mov r8, r15
mov qword [rsp + 0x20], r12
call fcn.180094330
lea rax, [rsp + 0x54]
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov r8, r14
lea rax, [rbp + 0x40]
mov dword [rsp + 0x28], ebx
xor edx, edx
mov qword [rsp + 0x20], rax
mov rcx, r15
call qword [sym.imp.ntdll.dll_RtlGetPersistedStateLocation]
nop dword [rax + rax]
xor r10d, r10d
mov esi, eax
test eax, eax
jns 0x180060484
test byte [0x1800b78f3], dil
je 0x180060476
mov dword [rsp + 0x28], eax
mov r9, r14
mov r8, r15
mov qword [rsp + 0x20], r12
call fcn.180094248
mov ecx, esi
call fcn.1800828c8
mov ebx, eax
jmp 0x18006054a
sub ebx, dword [rsp + 0x54]
lea rdx, [rbp + 0x40]
mov eax, dword [rsp + 0x54]
shr rax, 1
mov ecx, ebx
shr rcx, 1
lea rdx, [rdx + rax*2]
mov eax, 0x5c
mov word [rdx - 2], ax
mov rax, rcx
neg rax
sbb ebx, ebx
not ebx
and ebx, 0x80070057
test rcx, rcx
je 0x180060505
mov r8d, 0x7ffffffe
mov r9, r12
sub r8, rcx
sub r9, rdx
lea rax, [rcx + r8]
test rax, rax
je 0x1800604e9
movzx eax, word [rdx + r9]
test ax, ax
je 0x1800604e9
mov word [rdx], ax
add rdx, 2
sub rcx, 1
jne 0x1800604c9
test rcx, rcx
lea rax, [rdx - 2]
cmovne rax, rdx
neg rcx
sbb ebx, ebx
not ebx
and ebx, 0x8007007a
mov word [rax], r10w
test ebx, ebx
jns 0x180060528
test byte [0x1800b78f3], dil
je 0x180060567
mov ecx, 0xc
lea rdx, [0x18009f460]
mov r8d, ebx
call fcn.1800876bc
jmp 0x18006054a
test byte [0x1800b78f3], dil
je 0x180060567
lea rax, [rbp + 0x40]
mov r9, r14
mov qword [rsp + 0x28], rax
mov r8, r15
mov qword [rsp + 0x20], r12
call fcn.180094124
test byte [0x1800b78f3], dil
je 0x180060567
mov ecx, 0xe
lea rdx, [0x18009f460]
mov r8d, ebx
call fcn.1800876bc
xor r14d, r14d
test ebx, ebx
jns 0x180060577
mov ecx, ebx
call fcn.180011928
jmp 0x1800605a1
lea rax, [rsp + 0x60]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x1800605d3
mov esi, 4
test byte [0x1800b78f1], sil
je 0x1800605c9
lea ecx, [rsi + 6]
mov r9d, eax
lea r8, [rbp + 0x40]
lea rdx, [0x18009f440]
call fcn.180087538
mov ebx, r14d
mov edi, ebx
jmp 0x1800606a6
mov edi, r14d
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0x78]
mov qword [rsp + 0x38], r14
lea r8, [rbp - 0x60]
mov qword [rsp + 0x30], r14
mov edx, edi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x78], 0x50
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 0x103
je 0x18006068c
cmp eax, 0xea
je 0x18006067c
test eax, eax
jne 0x180060698
mov rcx, qword [rsp + 0x60]
lea r8, str.Volatile
mov qword [rsp + 0x30], r14
lea rdx, [rbp - 0x60]
mov qword [rsp + 0x28], r14
mov r9d, 0xffff
mov qword [rsp + 0x20], r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x18006067c
mov rcx, qword [rsp + 0x60]
lea rdx, [rbp - 0x60]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x18006067c
dec edi
inc edi
cmp edi, 0x3e8
jb 0x1800605d6
jmp 0x18006068f
mov ebx, r14d
xor edx, edx
xor ecx, ecx
call sym.DNSAPI.dll_DnsNotifyResolver
mov edi, dword [rsp + 0x50]
jmp 0x1800606a6
mov ebx, 0x57
mov edi, r14d
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1800606b5
call sym.DNSAPI.dll_DnsFreePolicyConfig
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1800606cb
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
test edi, edi
je 0x1800606ea
mov rcx, qword [rsp + 0x60]
lea rdx, [rbp - 0x60]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteKeyExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x180060700
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x450]
xor rcx, rsp
call fcn.18002d5c0
lea r11, [rsp + 0x560]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret