joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ca90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4ed018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x210]
push esi
mov esi, dword [ebp + 0x10]
push 0x20a
push 0
push eax
call fcn.00411960
add esp, 0xc
test ebx, ebx
je 0x41cb36
test esi, esi
je 0x41cb36
cmp dword [ebp + 0x14], 0
je 0x41cb36
push 0x105
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x104
ja 0x41cb2f
cmp dword [ebp + 0xc], 0
lea eax, [ebp - 0x210]
push ebx
push eax
mov ecx, 0x4a190c
mov eax, str._sdrivers_s
cmove eax, ecx
push eax
push dword [ebp + 0x14]
push esi
call fcn.00419510
add esp, 0x14
test eax, eax
jns 0x41cb1a
push str.VNLGetSystemPathForFilename:_failed_to_create_complete_path
jmp 0x41cb3b
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
push str.VNLGetSystemPathForFilename:_failed_to_get_system_directory_path
jmp 0x41cb3b
push str.VNLGetSystemPathForFilename:_invalid_parameters
push 1
call fcn.00446b80
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
xor eax, eax
pop esi
pop ebx
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
Function at 0x4284f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x4ed018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xorps xmm0, xmm0
mov dword [ebp - 8], 0
push str.VNLBackupJumboFrameSettings:_backup_jumbo_frame_settings
push 0x20
movups xmmword [ebp - 0x18], xmm0
movups xmmword [ebp - 0x40], xmm0
movups xmmword [ebp - 0x30], xmm0
movq qword [ebp - 0x20], xmm0
call fcn.00446b80
add esp, 8
xor esi, esi
call fcn.0041ec70
test eax, eax
je 0x428602
push ebx
push edi
nop dword [eax]
push esi
push str.VMnet_d
lea eax, [ebp - 0x18]
push 0x14
push eax
call fcn.00457af0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x44], 0x28
push 1
push eax
call fcn.00427b70
mov edi, eax
add esp, 0x18
test edi, edi
jne 0x428581
lea eax, [ebp - 0x18]
push eax
push str.GetAdapterJumboFrameSize:_Cant_open_vmnet_key_to_read_for__s
push 1
call fcn.00446b80
add esp, 0xc
jmp 0x4285f2
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x40]
push eax
push 0
push 0
push 0x4adb70
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x4285c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push 0x4adb70
push str.GetAdapterJumboFrameSize:_couldnt_read_property___S_:_0x_08x_0x_08x
push 1
call fcn.00446b80
jmp 0x4285ef
lea eax, [ebp - 0x40]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4285c7
sub eax, edx
sar eax, 1
inc eax
push eax
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x40]
push eax
push 0x4adc14
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.00417640
add esp, 0x14
inc esi
call fcn.0041ec70
cmp esi, eax
jb 0x428540
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
Function at 0x42af90
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x4ed018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x220], eax
test edi, edi
je 0x42b171
test eax, eax
je 0x42b171
test esi, esi
je 0x42b171
cmp dword [ebp + 0x10], 0
jne 0x42b002
cmp esi, 4
je 0x42b002
push esi
push str.SetDHCPServiceParameter:_DWORD_selected__but_length_isnt_currect:_0x_08x
push 1
call fcn.00446b80
add esp, 0xc
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
push ebx
push 0x20a
lea eax, [ebp - 0x210]
mov dword [ebp - 0x218], 0
push 0
push eax
call fcn.00411960
mov eax, dword [ebp - 0x214]
add esp, 0xc
mov ebx, str.SYSTEMCurrentControlSetServicesVMnetDHCPParameters
test eax, eax
je 0x42b053
push eax
push ebx
push 0x4a190c
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.00419510
add esp, 0x14
lea ebx, [ebp - 0x210]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
push 7
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00417370
add esp, 0x14
mov dword [ebp - 0x21c], eax
test eax, eax
je 0x42b0ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push eax
push dword [ebp - 0x21c]
push str.SetDHCPServiceParameter:_Could_not_create_open_DHCP_REG_PATH_key:_0x_08x_0x_08x__S
push 1
call fcn.00446b80
add esp, 0x14
xor eax, eax
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x218], 1
jne 0x42b0c0
mov eax, 2
mov ecx, str.SetDHCPServiceParameter:_created_new_key:__S
jmp 0x42b0ca
mov eax, 0x20
mov ecx, str.SetDHCPServiceParameter:_opened_existing_key:__S
push ebx
push ecx
push eax
call fcn.00446b80
mov ecx, dword [ebp + 0x10]
lea eax, [esi + esi]
add esp, 0xc
test ecx, ecx
cmove eax, esi
push eax
push dword [ebp - 0x220]
xor eax, eax
test ecx, ecx
sete al
lea eax, [eax*2 + 2]
push eax
push 0
push edi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x42b13f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.SetDHCPServiceParameter:_Could_not_set_key_for_DHCP_parameter__S:_0x_08x
push 1
call fcn.00446b80
add esp, 0x10
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
push edi
push str.SetDHCPServiceParameter:_set_key_for_DHCP__S
push 0x10
call fcn.00446b80
add esp, 0xc
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
push esi
push eax
push edi
push str.SetDHCPServiceParameter:_invalid_parameters:_0x_08x_0x_08x_0x_08x
push 1
call fcn.00446b80
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
xor eax, eax
pop edi
pop esi
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
Function at 0x42bf90
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4ed018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x210]
push edi
mov edi, dword [ebp + 8]
push 0x20a
push 0
push eax
call fcn.00411960
push 0
push 0
push 0
push str.VNL_GetDHCPConfigFilePath:
mov dword [ebp - 0x214], 0x105
call fcn.00447210
push esi
push edi
push str.VNL_GetDHCPConfigFilePath:_p_0x_08x_pL_0x_08x
push 0x80
call fcn.00446b80
add esp, 0x2c
test edi, edi
je 0x42c0d0
test esi, esi
je 0x42c0d0
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
push 1
push str.ConfFile
push 0
call fcn.0042a7b0
add esp, 0x14
test eax, eax
jne 0x42c047
push str.VNL_GetDHCPConfigFilePath:_could_not_read_filename_from_registry
push 1
call fcn.00446b80
add esp, 8
call fcn.00446aa0
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret 8
push ebx
push str.VNL_GetDHCPConfigFilePath:_read_filename_from_registry
push 0x10
call fcn.00446b80
add esp, 8
lea eax, [ebp - 0x210]
push dword [esi]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
test ebx, ebx
jne 0x42c09d
lea eax, [ebp - 0x210]
push eax
push str.VNL_GetDHCPConfigFilePath:_error_expanding_filename_string:__S
push 1
call fcn.00446b80
add esp, 0xc
call fcn.00446aa0
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret 8
push edi
push ebx
push str.VNL_GetDHCPConfigFilePath:_resulting_string_is_length__d:__S
push 0x10
lfence
call fcn.00446b80
add esp, 0x10
mov dword [esi], ebx
call fcn.00446aa0
pop ebx
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret 8
push esi
push edi
push str.VNL_GetDHCPConfigFilePath:_invalid_parameters:_0x_08x_0x_08x
push 1
call fcn.00446b80
add esp, 0x10
call fcn.00446aa0
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00401bd5
mov esp, ebp
pop ebp
ret 8
Function at 0x42c100
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4ed018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x210]
push edi
mov edi, dword [ebp + 8]
push 0x20a
push 0
push eax
call fcn.00411960
push 0
push 0
push 0
push str.VNL_GetDHCPLeaseFilePath:
mov dword [ebp - 0x214], 0x105
call fcn.00447210
push esi
push edi
push str.VNL_GetDHCPLeaseFilePath:_p_0x_08x_pL_0x_08x
push 0x80
call fcn.00446b80
add esp, 0x2c
test edi, edi
je 0x42c240
test esi, esi
je 0x42c240
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
push 1
push str.LeaseFile
push 0
call fcn.0042a7b0
add esp, 0x14
test eax, eax
jne 0x42c1b7
push str.VNL_GetDHCPLeaseFilePath:_could_not_read_filename_from_registry
push 1
call fcn.00446b80
add esp, 8
call fcn.00446aa0
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret 8
push ebx
push str.VNL_GetDHCPLeaseFilePath:_read_filename_from_registry
push 0x10
call fcn.00446b80
add esp, 8
lea eax, [ebp - 0x210]
push dword [esi]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
test ebx, ebx
jne 0x42c20d
lea eax, [ebp - 0x210]
push eax
push str.VNL_GetDHCPLeaseFilePath:_error_expanding_filename_string:__S
push 1
call fcn.00446b80
add esp, 0xc
call fcn.00446aa0
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret 8
push edi
push ebx
push str.VNL_GetDHCPLeaseFilePath:_resulting_string_is_length__d:__S
push 0x10
lfence
call fcn.00446b80
add esp, 0x10
mov dword [esi], ebx
call fcn.00446aa0
pop ebx
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret 8
push esi
push edi
push str.VNL_GetDHCPLeaseFilePath:_invalid_parameters:_0x_08x_0x_08x
push 1
call fcn.00446b80
add esp, 0x10
call fcn.00446aa0
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00401bd5
mov esp, ebp
pop ebp
ret 8
Function at 0x432700
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x432722
push str.SetServiceAutoStart:_invalid_parameter
push 1
call fcn.00446b80
add esp, 8
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push esi
push 0x18
push 0x4b9210
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x432756
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetServiceAutoStart:_couldnt_open_service_manager:_0x_08x
push 1
call fcn.00446b80
add esp, 0xc
xor eax, eax
pop esi
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push 2
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
jne 0x43278e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.SetServiceAutoStart:_couldnt_open_service__S:_0x_08x
push 1
call fcn.00446b80
add esp, 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push esi
call fcn.004325b0
add esp, 4
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [ebp + 0xc], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
sete al
push 0xffffffffffffffff
lea eax, [eax*2 + 2]
push eax
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x4327e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetServiceAutoStart:_change_service_failed:_0x_08x
push 1
call fcn.00446b80
add esp, 0xc
xor edi, edi
jmp 0x432808
cmp dword [ebp + 0xc], 0
mov ecx, str._disabled_
mov eax, str._auto_
cmove eax, ecx
push eax
push edi
push str.SetServiceAutoStart:_changed_service__S_to_start_type__s
push 0x10
call fcn.00446b80
add esp, 0x10
mov edi, 1
mov eax, dword [ebp - 4]
test eax, eax
je 0x432830
push eax
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
test eax, eax
jne 0x432830
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ReleaseServiceDatabaseLock:_unlock_failed:_0x_08x
push 1
call fcn.00446b80
add esp, 0xc
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x434da0
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x434dc2
push str.VNLUpdateServiceFailureActions:_invalid_parameter
push 1
call fcn.00446b80
add esp, 8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push edi
push 0x18
push 0x4b9210
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x434df6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.VNLUpdateServiceFailureActions:_couldnt_open_service_manager:_0x_08x
push 1
call fcn.00446b80
add esp, 0xc
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push 0x12
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
jne 0x434e2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.VNLUpdateServiceFailureActions:_couldnt_open_service__S:_0x_08x
push 1
call fcn.00446b80
add esp, 0x10
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push edi
call fcn.004325b0
add esp, 4
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push 2
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x434e66
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.VNLUpdateServiceFailureActions:_update_service_failure_actions_failed_for__S:_0x_08x
push 1
call fcn.00446b80
add esp, 0x10
xor esi, esi
jmp 0x434e7b
push esi
push str.VNLUpdateServiceFailureActions:_update_service_failure_actions_for__S_successful
push 0x10
call fcn.00446b80
add esp, 0xc
mov esi, 1
mov eax, dword [ebp - 4]
test eax, eax
je 0x434ea3
push eax
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
test eax, eax
jne 0x434ea3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ReleaseServiceDatabaseLock:_unlock_failed:_0x_08x
push 1
call fcn.00446b80
add esp, 0xc
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x436230
Capabilities:
Create thread
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
push 0x90
mov dword [ebp - 0xc], 0
call fcn.0047ee60
mov edi, eax
add esp, 4
test edi, edi
je 0x436292
push 0x90
push 0
push edi
call fcn.00411960
add esp, 0xc
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [edi + 4], eax
test eax, eax
jne 0x436299
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.VNLStartPromptSuppression:_couldnt_allocate_event:_0x_08x
push 1
call fcn.00446b80
push edi
call fcn.0047ee40
add esp, 0x10
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftDriver_Signing
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4362cd
push eax
push str.VNLStartPromptSuppression:_couldnt_open_signature_key:_0x_08x
push 1
call fcn.00446b80
add esp, 0xc
jmp 0x436370
push ebx
lea ebx, [edi + 0xc]
lea eax, [edi + 0x10]
mov dword [ebx], 0x80
push ebx
push eax
lea ecx, [edi + 8]
push ecx
push 0
push str.Policy
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4362fc
push eax
push str.VNLStartPromptSuppression:_couldnt_query_signature_key:_0x_08x
jmp 0x43635f
push dword [ebx]
call fcn.0047ee60
add esp, 4
mov dword [ebp - 8], eax
test eax, eax
jne 0x43631e
push str.VNLStartPromptSuppression:_couldnt_alloc_replacement
push 1
call fcn.00446b80
add esp, 8
jmp 0x436369
push esi
mov esi, dword [ebx]
push esi
push 0
push eax
call fcn.00411960
add esp, 0xc
push esi
mov esi, dword [ebp - 8]
push esi
push dword [edi + 8]
push 0
push str.Policy
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
mov dword [ebp - 8], eax
call fcn.0047ee40
mov eax, dword [ebp - 8]
add esp, 4
pop esi
test eax, eax
je 0x43636f
push eax
push str.VNLStartPromptSuppression:_couldnt_set_value:_0x_08x
push 1
call fcn.00446b80
add esp, 0xc
mov dword [ebx], 0
pop ebx
lea eax, [ebp - 0xc]
push eax
push 0
push edi
push 0x435bf0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi], eax
test eax, eax
jne 0x4363bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.VNLStartPromptSuppression:_couldnt_spawn_thread:_0x_08x
push 1
call fcn.00446b80
add esp, 0xc
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.0047ee40
add esp, 4
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push str.VNLStartPromptSuppression:_spawned_thread
push 0x10
call fcn.00446b80
add esp, 8
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4363e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 1
test esi, esi
jne 0x436408
push str.VNLStopPromptSuppression:_invalid_parameter
push edi
call fcn.00446b80
add esp, 8
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [esi + 0xc], 0
jbe 0x436483
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftDriver_Signing
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43644a
push eax
push str.VNLStopPromptSuppression:_couldnt_open_signature_key:_0x_08x
push 1
call fcn.00446b80
add esp, 0xc
xor edi, edi
jmp 0x436483
push dword [esi + 0xc]
lea eax, [esi + 0x10]
push eax
push dword [esi + 8]
push 0
push str.Policy
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x43647a
push eax
push str.VNLStopPromptSuppression:_couldnt_restore_signature_key:_0x_08x
push 1
call fcn.00446b80
add esp, 0xc
xor edi, edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.VNLStopPromptSuppression:_waiting_for_thread_to_stop
push 0x20
call fcn.00446b80
add esp, 8
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.VNLStopPromptSuppression:_done_waiting
push 0x20
call fcn.00446b80
push esi
call fcn.0047ee40
add esp, 0xc
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x436cd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4965cf
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4ed018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0
call fcn.0047e1c2
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov byte [ebp - 4], 3
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov byte [ebp - 4], 4
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov byte [ebp - 4], 5
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
mov eax, dword [ebp + 8]
test eax, eax
je 0x436d81
push eax
push esi
call fcn.0047e571
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.0047e339
int3
Function at 0x4400f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
mov eax, dword [0x4ed018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0xcc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0xc8
push 0
push eax
mov dword [ebp - 0xd0], 0
call fcn.00411960
add esp, 0xc
mov dword [ebp - 0xd4], 0xc8
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0xd0]
push eax
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x44017f
push edi
push str.SubStringPresentInRegValue:_couldnt_query__S_in_registry
push 4
call fcn.00446b80
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0xd0], 1
je 0x4401aa
push str.SubStringPresentInRegValue:_registry_value_isnt_a_string
push 1
call fcn.00446b80
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xcc]
push ebx
push eax
call fcn.0049595e
mov ecx, dword [ebp - 4]
add esp, 8
neg eax
sbb eax, eax
xor ecx, ebp
pop edi
pop esi
neg eax
pop ebx
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
Function at 0x440350
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4ed018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x210]
push edi
mov edi, dword [ebp + 8]
push 0x20a
push 0
push eax
call fcn.00411960
add esp, 0xc
mov dword [ebp - 0x218], 0
test edi, edi
jne 0x4403b5
push str.guid
push str.WriteAdapterBridgeFlag:__s_failed_n
push 1
call fcn.00446b80
add esp, 0xc
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x4403c0
push str.keyName
jmp 0x440394
cmp dword [ebp + 0x14], 0
jne 0x440420
push 0x4a18f4
push str.SYSTEMCurrentControlSetServices
push str._s_sParameters
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.00419510
add esp, 0x14
lea eax, [ebp - 0x214]
push eax
push 7
push 0
lea eax, [ebp - 0x210]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x440414
push eax
push str.WriteAdapterBridgeFlag:_Bridge_key_doesnt_exist__but_not_allowed_to_create:__x
push 0x20
jmp 0x44039b
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push 0x4a18f4
push str.SYSTEMCurrentControlSetServices
push str._s_sParametersAdapters_s
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.00419510
add esp, 0x18
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 7
push 0
push 0
push 0
lea eax, [ebp - 0x210]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
test edi, edi
je 0x4404a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x210]
push ecx
push eax
push edi
push str.WriteAdapterBridgeFlag:_Could_not_create_bridge_adapter_path:_0x_08x_0x_08x__S
push 1
call fcn.00446b80
add esp, 0x14
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x218], 1
jne 0x4404c3
lea eax, [ebp - 0x210]
push eax
push str.WriteAdapterBridgeFlag:_Created_new_key:__S
push 2
call fcn.00446b80
add esp, 0xc
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push esi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
je 0x440515
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.WriteAdapterBridgeFlag:_could_not_set_bridge_adapter_key:_0x_08x_0x_08x
push 1
call fcn.00446b80
add esp, 0x10
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push dword [ebp + 0x10]
push str.WriteAdapterBridgeFlag:_wrote_0x_08x_to__S
push 0x10
call fcn.00446b80
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
mov eax, 1
pop edi
pop esi
call fcn.00401bd5
mov esp, ebp
pop ebp
ret