Function at 0x42de80
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
mov eax, dword [0x4ed018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x20a
lea eax, [ebp - 0x41c]
push 0
push eax
call fcn.00411960
push 0
push 0
push 0
push str.VNL_InstallNAT:
call fcn.00447210
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push esi
push edi
push str.VNL_InstallNAT:_cF__d_oF__d
push 0x80
call fcn.00446b80
add esp, 0x2c
call fcn.004351e0
test eax, eax
je 0x42def2
push str.VNL_InstallNAT:_This_call_is_not_supported_when_called_from_64_bit_process
push 2
call fcn.00446b80
add esp, 8
call fcn.00446aa0
jmp 0x42df38
push str.VNL_InstallNAT:_installing_NAT_Service
push 2
call fcn.00446b80
add esp, 8
call fcn.00435210
push 0x105
test eax, eax
lea eax, [ebp - 0x41c]
push eax
push 0
push str.vmnat.exe
je 0x42df4d
call fcn.004352a0
add esp, 0x10
test eax, eax
jne 0x42df60
push str.VNL_InstallNAT:_failed_to_get_syswow64_directory_path
push 1
call fcn.00446b80
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret 8
call fcn.0041ca90
add esp, 0x10
test eax, eax
jne 0x42df60
push str.VNL_InstallNAT:_failed_to_get_system32_directory_path
jmp 0x42df2e
push 0x40000001
call fcn.0041c9f0
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x42df89
push 0x40000001
push str.VNL_InstallNAT:_Failed_to_get_description_0x_08x_for_NAT_service
push 1
call fcn.00446b80
add esp, 0xc
jmp 0x42df38
test edi, edi
je 0x42dfe5
test esi, esi
je 0x42dfd0
push str.VNL_InstallNAT:_Copying_files__so_stopping_any_pre_existing_NAT
push 2
call fcn.00446b80
push 0
push 0
push 0
push str.VNL_StopNAT:
call fcn.00447210
push str.VNL_StopNAT:__no_args_
push 0x80
call fcn.00446b80
push 0
push str.VMware_NAT_Service
call fcn.00434160
add esp, 0x28
call fcn.00446aa0
push esi
push 0
push 0x5000
push str.vmnat.exe
call fcn.0041be60
add esp, 0x10
push 0
push 0x4b136c
push 0
lea eax, [ebp - 0x41c]
push eax
push 2
push 0x10
push ebx
push str.VMware_NAT_Service
push str.VMware_NAT_Service
call fcn.00432ea0
push 0x20a
mov dword [ebp - 0x440], eax
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00411960
add esp, 0x30
mov dword [ebp - 0x43c], 0xf6
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.00418120
test eax, eax
je 0x42e089
lea edi, [ebp - 0x210]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x42e050
mov ecx, 7
lea eax, [ebp - 0x210]
mov esi, str.vmeventmsg.dll
rep movsd dword es:[edi], dword [esi]
push 7
push eax
push str.Application
push str.VMware_NAT_Service
movsw word es:[edi], word [esi]
call fcn.00432850
add esp, 0x10
mov edi, eax
jmp 0x42e09a
push str.VNL_InstallNAT:_could_not_get_path_to_set_NAT_event_log_source
push 1
call fcn.00446b80
add esp, 8
xor edi, edi
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00411960
push 0
push 0
push 0
push str.VNL_SetNATConfigFilePath:
mov dword [ebp - 0x438], 0
call fcn.00447210
push str.VNL_SetNATConfigFilePath:__no_args_
push 0x80
call fcn.00446b80
push 1
push 0x49ccf0
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.0041c740
add esp, 0x34
test eax, eax
jne 0x42e10b
push str.VNL_SetNATConfigFilePath:_couldnt_obtain_config_file_path
push 1
call fcn.00446b80
add esp, 8
xor esi, esi
jmp 0x42e202
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x43c]
push eax
push 3
push str.SYSTEMCurrentControlSetServicesVMware_NAT_ServiceParameters
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00417370
mov esi, eax
add esp, 0x14
test esi, esi
je 0x42e156
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.SYSTEMCurrentControlSetServicesVMware_NAT_ServiceParameters
push eax
push esi
push str.VNL_SetNATConfigFilePath:_Could_not_create_NAT_registry_path:_0x_08x_0x_08x__S
push 1
call fcn.00446b80
add esp, 0x14
xor esi, esi
jmp 0x42e202
cmp dword [ebp - 0x438], 1
jne 0x42e16b
mov eax, 2
mov ecx, str.VNL_SetNATConfigFilePath:_created_new_key:__S
jmp 0x42e175
mov eax, 0x20
mov ecx, str.VNL_SetNATConfigFilePath:_opened_existing_key:__S
push str.SYSTEMCurrentControlSetServicesVMware_NAT_ServiceParameters
push ecx
push eax
call fcn.00446b80
lea ecx, [ebp - 0x210]
add esp, 0xc
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42e190
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x210]
push eax
push 2
push 0
push str.ConfigPath
push dword [ebp - 0x43c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x43c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x42e1e9
push esi
push str.VNL_SetNATConfigFilePath:_Could_not_set_config_path_key_for_NAT:_0x_08x
push 1
call fcn.00446b80
add esp, 0xc
xor esi, esi
jmp 0x42e202
push str.VNL_SetNATConfigFilePath:_set_key_for_NAT_config_file
push 0x10
call fcn.00446b80
add esp, 8
call fcn.00446aa0
mov esi, 1
test esi, esi
mov ecx, str.VNL_InstallNAT:_could_not_create_paths_to_NAT_config_file
mov eax, str.VNL_InstallNAT:_paths_to_NAT_config_file_created_successfully
cmove eax, ecx
mov ecx, 0x10
push eax
mov eax, 1
cmovne eax, ecx
push eax
call fcn.00446b80
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00411960
push 1
push str.vmnetnat.conf
lea eax, [ebp - 0x438]
mov dword [ebp - 0x438], 0x105
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.0042cf50
add esp, 0x24
test eax, eax
jne 0x42e274
push str.VNL_InstallNAT:_could_not_obtain_path_to_NAT_config_file
push 1
call fcn.00446b80
add esp, 8
jmp 0x42e294
push str.VNL_InstallNAT:_adding_uninstall_entry_for_NAT_config_file
push 0x10
call fcn.00446b80
lea eax, [ebp - 0x210]
push 0x5000
push eax
call fcn.0041bc90
add esp, 0x10
push 1
push str.vmnetnat_mac.txt
lea eax, [ebp - 0x438]
mov dword [ebp - 0x438], 0x105
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.0042cf50
add esp, 0x10
test eax, eax
jne 0x42e2d0
push str.VNL_InstallNAT:_could_not_obtain_path_to_NAT_mac_file
push 1
call fcn.00446b80
add esp, 8
jmp 0x42e2f0
push str.VNL_InstallNAT:_adding_uninstall_entry_for_NAT_mac_file
push 0x10
call fcn.00446b80
lea eax, [ebp - 0x210]
push 0x5000
push eax
call fcn.0041bc90
add esp, 0x10
sub esp, 0x14
mov dword [ebp - 0x454], 0x258
mov eax, esp
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x44c], 0
lea ecx, [ebp - 0x434]
mov dword [ebp - 0x448], 3
movups xmm0, xmmword [ebp - 0x454]
push str.VMware_NAT_Service
mov dword [ebp - 0x434], 1
movups xmmword [eax], xmm0
mov dword [ebp - 0x430], 0x3e8
mov dword [ebp - 0x42c], 1
mov dword [ebp - 0x428], 0x3e8
mov dword [ebp - 0x424], 0
mov dword [eax + 0x10], ecx
call fcn.00434da0
push ebx
call fcn.0041c720
mov ebx, dword [ebp - 0x440]
push esi
push edi
push ebx
push str.VNL_InstallNAT:_Finished_install_of_NAT_Service:__d__d__d
push 2
call fcn.00446b80
add esp, 0x30
call fcn.00446aa0
test ebx, ebx
je 0x42df38
test edi, edi
je 0x42df38
test esi, esi
je 0x42df38
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401bd5
mov esp, ebp
pop ebp
ret 8