joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41aa40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4a39f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x218], 0
test edi, edi
je 0x41ac37
test ebx, ebx
je 0x41ac37
test esi, esi
je 0x41ac37
cmp dword [ebp + 0xc], 0
jne 0x41aaa9
cmp dword [esi], 4
je 0x41aaa9
push esi
push str.GetDHCPServiceParameter:_DWORD_selected__but_length_isnt_currect:_0x_08x
push 1
call fcn.004343f0
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
xor ecx, ecx
push 0x208
push ecx
lea edx, [ebp - 0x20e]
push edx
mov word [ebp - 0x210], cx
call fcn.00405300
mov eax, dword [ebp - 0x21c]
add esp, 0xc
test eax, eax
je 0x41aaf8
push eax
push str.SYSTEMCurrentControlSetServicesVMnetDHCPParameters
push 0x46c138
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.00457d45
add esp, 0x14
lea eax, [ebp - 0x210]
jmp 0x41aafd
mov eax, str.SYSTEMCurrentControlSetServicesVMnetDHCPParameters
lea ecx, [ebp - 0x214]
push ecx
push 1
push 0
push eax
push 0x80000002
call dword [0x4650cc]
test eax, eax
je 0x41ab4d
cmp dword [ebp - 0x21c], 0
lea ecx, [ebp - 0x210]
jne 0x41ab2c
mov ecx, str.SYSTEMCurrentControlSetServicesVMnetDHCPParameters
push ecx
push eax
push str.GetDHCPServiceParameter:_Could_not_open_DHCP_REG_PATH_key:_0x_08x__S
push 4
call fcn.004343f0
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0xc], 0
push esi
push ebx
je 0x41ab76
mov edx, dword [esi]
mov ecx, dword [ebp - 0x214]
lea eax, [ebp - 0x218]
push eax
push 0
push edi
add edx, edx
push ecx
mov dword [esi], edx
call dword [0x4650c4]
shr dword [esi], 1
jmp 0x41ab8d
mov eax, dword [ebp - 0x214]
lea edx, [ebp - 0x218]
push edx
push 0
push edi
push eax
call dword [0x4650c4]
test eax, eax
je 0x41abbf
push eax
push edi
push str.GetDHCPServiceParameter:_Could_not_query_key_for_DHCP_parameter__S:_0x_08x
push 1
call fcn.004343f0
mov ecx, dword [ebp - 0x214]
add esp, 0x10
push ecx
call dword [0x4650d0]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0xc], 0
mov eax, dword [ebp - 0x218]
je 0x41ac05
cmp eax, 1
je 0x41abd5
cmp eax, 2
jne 0x41ac30
push edi
push str.GetDHCPServiceParameter:_queried_key_for_DHCP__S
push 0x10
call fcn.004343f0
mov edx, dword [ebp - 0x214]
add esp, 0xc
push edx
call dword [0x4650d0]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
cmp eax, 4
je 0x41abd5
mov ecx, str.dword
push ecx
push eax
push str.GetDHCPServiceParameter:_Registry_key_is_not_expected_type:_0x_08x_versus__s
push 1
call fcn.004343f0
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
mov ecx, str.string
jmp 0x41ac0f
push esi
push ebx
push edi
push str.GetDHCPServiceParameter:_invalid_parameters:_0x_08x_0x_08x_0x_08x
push 1
call fcn.004343f0
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 0x14
xor eax, eax
call fcn.0040506e
mov esp, ebp
pop ebp
ret
Function at 0x41cbe0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4a39f8]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x208
push eax
lea ecx, [ebp - 0x20e]
push ecx
mov word [ebp - 0x210], ax
call fcn.00405300
push str.VNL_SetNATConfigFilePath:
mov dword [ebp - 0x218], 0
call fcn.00434640
push str.VNL_SetNATConfigFilePath:__no_args_
push 0x80
call fcn.004343f0
push 1
push 0x470c3c
lea edx, [ebp - 0x210]
push 0x105
push edx
call fcn.00417260
add esp, 0x28
test eax, eax
jne 0x41cc6f
push str.VNL_SetNATConfigFilePath:_couldnt_obtain_config_file_path
push 1
call fcn.004343f0
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x214]
push ecx
push 3
push str.SYSTEMCurrentControlSetServicesVMware_NAT_ServiceParameters
push 0x80000002
call fcn.00410720
mov esi, eax
add esp, 0x14
test esi, esi
je 0x41ccc5
call dword [0x4651b0]
push str.SYSTEMCurrentControlSetServicesVMware_NAT_ServiceParameters
push eax
push esi
push str.VNL_SetNATConfigFilePath:_Could_not_create_NAT_registry_path:_0x_08x_0x_08x__S
push 1
call fcn.004343f0
add esp, 0x14
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x218], 1
push str.SYSTEMCurrentControlSetServicesVMware_NAT_ServiceParameters
jne 0x41ccdc
push str.VNL_SetNATConfigFilePath:_created_new_key:__S
push 2
jmp 0x41cce3
push str.VNL_SetNATConfigFilePath:_opened_existing_key:__S
push 0x20
call fcn.004343f0
lea eax, [ebp - 0x210]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41ccf4
mov ecx, dword [ebp - 0x214]
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x210]
push eax
push 2
push 0
push str.ConfigPath
push ecx
call dword [0x465094]
mov edx, dword [ebp - 0x214]
push edx
mov esi, eax
call dword [0x4650d0]
test esi, esi
je 0x41cd59
push esi
push str.VNL_SetNATConfigFilePath:_Could_not_set_config_path_key_for_NAT:_0x_08x
push 1
call fcn.004343f0
add esp, 0xc
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
push str.VNL_SetNATConfigFilePath:_set_key_for_NAT_config_file
push 0x10
call fcn.004343f0
add esp, 8
call fcn.00434690
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0040506e
mov esp, ebp
pop ebp
ret
Function at 0x424880
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
mov eax, dword [0x4a39f8]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0xc6
push eax
lea ecx, [ebp - 0xca]
push ecx
mov dword [ebp - 0xd0], 0
mov word [ebp - 0xcc], ax
call fcn.00405300
add esp, 0xc
lea edx, [ebp - 0xd4]
push edx
lea eax, [ebp - 0xcc]
push eax
lea ecx, [ebp - 0xd0]
push ecx
push 0
push esi
push edi
mov dword [ebp - 0xd4], 0xc8
call dword [0x4650c4]
test eax, eax
je 0x424908
push esi
push str.SubStringPresentInRegValue:_couldnt_query__S_in_registry
push 4
call fcn.004343f0
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0xd0], 1
je 0x424930
push str.SubStringPresentInRegValue:_registry_value_isnt_a_string
push 1
call fcn.004343f0
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0xcc]
push ebx
push edx
call fcn.00457c9a
mov ecx, dword [ebp - 4]
add esp, 8
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.0040506e
mov esp, ebp
pop ebp
ret
Function at 0x424960
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x4a39f8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x208
mov esi, ecx
push eax
lea ecx, [ebp - 0x20e]
push ecx
mov word [ebp - 0x210], ax
call fcn.00405300
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x220], 4
mov dword [ebp - 0x218], eax
cmp esi, eax
jne 0x4249d5
push str.guid
push str.ReadAdapterBridgeFlag:__s_failed_n
push 1
call fcn.004343f0
add esp, 0xc
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
cmp ebx, eax
jne 0x4249fe
push str.keyName
push str.ReadAdapterBridgeFlag:__s_failed_n
push 1
call fcn.004343f0
add esp, 0xc
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
cmp edi, eax
jne 0x424a27
push str.regValue
push str.ReadAdapterBridgeFlag:__s_failed_n
push 1
call fcn.004343f0
add esp, 0xc
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
push esi
push str.VMnetBridge
push str.SYSTEMCurrentControlSetServices
push str._s_sParametersAdapters_s
lea eax, [ebp - 0x210]
push 0x105
push eax
mov dword [edi], edx
call fcn.00457d45
add esp, 0x18
lea ecx, [ebp - 0x214]
push ecx
push 1
push 0
lea edx, [ebp - 0x210]
push edx
push 0x80000002
call dword [0x4650cc]
mov esi, eax
test esi, esi
je 0x424ace
call dword [0x4651b0]
cmp esi, 2
je 0x424aa7
push eax
push esi
lea eax, [ebp - 0x210]
push eax
push str.ReadAdapterBridgeFlag:_could_not_open_bridge_param_key__S:_0x_08x_0x_08x
push 1
call fcn.004343f0
add esp, 0x14
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x210]
push ecx
push str.ReadAdapterBridgeFlag:_bridge_param_key_doesnt_exist:__S
push 4
call fcn.004343f0
add esp, 0xc
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x220]
push edx
mov edx, dword [ebp - 0x214]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x218]
push ecx
push 0
push ebx
push edx
call dword [0x4650c4]
mov esi, eax
test esi, esi
jne 0x424b29
cmp dword [ebp - 0x218], 4
jne 0x424b29
mov eax, dword [ebp - 0x214]
push eax
call dword [0x4650d0]
mov ecx, dword [ebp - 0x21c]
lea eax, [esi + 1]
mov dword [edi], ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
call dword [0x4651b0]
cmp esi, 2
je 0x424b4f
mov edx, dword [ebp - 0x218]
push edx
push eax
push esi
push ebx
push str.ReadAdapterBridgeFlag:_could_not_query_bridge_adapter_key__S:_0x_08x_0x_08x_0x_08x
push 1
call fcn.004343f0
add esp, 0x18
jmp 0x424b5f
push ebx
push str.ReadAdapterBridgeFlag:_bridge_adapter_value__S_doesnt_exist
push 4
call fcn.004343f0
add esp, 0xc
mov eax, dword [ebp - 0x214]
push eax
call dword [0x4650d0]
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0040506e
mov esp, ebp
pop ebp
ret
Function at 0x424b80
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4a39f8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x208
mov esi, ecx
push eax
lea ecx, [ebp - 0x20e]
push ecx
mov word [ebp - 0x210], ax
call fcn.00405300
add esp, 0xc
mov dword [ebp - 0x218], 0
test esi, esi
jne 0x424be7
push str.guid
push str.WriteAdapterBridgeFlag:__s_failed_n
push 1
call fcn.004343f0
add esp, 0xc
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
test edi, edi
jne 0x424bf2
push str.keyName
jmp 0x424bc7
cmp dword [ebp + 0xc], 0
push ebx
mov ebx, dword [0x4650d0]
jne 0x424c6e
push str.VMnetBridge
push str.SYSTEMCurrentControlSetServices
push str._s_sParameters
lea edx, [ebp - 0x210]
push 0x105
push edx
call fcn.00457d45
add esp, 0x14
lea eax, [ebp - 0x214]
push eax
push 7
push 0
lea ecx, [ebp - 0x210]
push ecx
push 0x80000002
call dword [0x4650cc]
test eax, eax
je 0x424c65
push eax
push str.WriteAdapterBridgeFlag:_Bridge_key_doesnt_exist__but_not_allowed_to_create:__x
push 0x20
call fcn.004343f0
add esp, 0xc
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x214]
push edx
call ebx
push esi
push str.VMnetBridge
push str.SYSTEMCurrentControlSetServices
push str._s_sParametersAdapters_s
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.00457d45
add esp, 0x18
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x214]
push edx
push 0
push 7
push 0
push 0
push 0
lea eax, [ebp - 0x210]
push eax
push 0x80000002
call dword [0x4650b0]
mov esi, eax
test esi, esi
je 0x424cf2
call dword [0x4651b0]
lea ecx, [ebp - 0x210]
push ecx
push eax
push esi
push str.WriteAdapterBridgeFlag:_Could_not_create_bridge_adapter_path:_0x_08x_0x_08x__S
push 1
call fcn.004343f0
add esp, 0x14
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x218], 1
jne 0x424d11
lea edx, [ebp - 0x210]
push edx
push str.WriteAdapterBridgeFlag:_Created_new_key:__S
push 2
call fcn.004343f0
add esp, 0xc
mov ecx, dword [ebp - 0x214]
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push edi
push ecx
call dword [0x465094]
mov esi, eax
test esi, esi
je 0x424d61
call dword [0x4651b0]
push eax
push esi
push str.WriteAdapterBridgeFlag:_could_not_set_bridge_adapter_key:_0x_08x_0x_08x
push 1
call fcn.004343f0
mov edx, dword [ebp - 0x214]
add esp, 0x10
push edx
call ebx
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x214]
push eax
call ebx
mov ecx, dword [ebp + 8]
push edi
push ecx
push str.WriteAdapterBridgeFlag:_wrote_0x_08x_to__S
push 0x10
call fcn.004343f0
mov ecx, dword [ebp - 4]
add esp, 0x10
pop ebx
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0040506e
mov esp, ebp
pop ebp
ret
Function at 0x4282b0
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 1
test edi, edi
jne 0x4282d9
push str.VNLUpdateServiceFailureActions:_invalid_parameter
push 1
call fcn.004343f0
add esp, 8
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push esi
push 0x18
push str.ServicesActive
push 0
call dword [0x465034]
mov esi, eax
test esi, esi
jne 0x42830d
call dword [0x4651b0]
push eax
push str.VNLUpdateServiceFailureActions:_couldnt_open_service_manager:_0x_08x
push 1
call fcn.004343f0
add esp, 0xc
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push 0x12
push edi
push esi
call dword [0x465038]
mov ebx, eax
test ebx, ebx
jne 0x428345
call dword [0x4651b0]
push eax
push edi
push str.VNLUpdateServiceFailureActions:_couldnt_open_service__S:_0x_08x
push 1
call fcn.004343f0
add esp, 0x10
push esi
call dword [0x46503c]
pop ebx
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
call fcn.00428150
mov dword [ebp + 8], eax
lea eax, [ebp + 0xc]
push eax
push 2
push ebx
call dword [0x46501c]
test eax, eax
jne 0x428379
call dword [0x4651b0]
push eax
push edi
push str.VNLUpdateServiceFailureActions:_update_service_failure_actions_failed_for__S:_0x_08x
push 1
call fcn.004343f0
add esp, 0x10
xor edi, edi
jmp 0x42838c
push edi
push str.VNLUpdateServiceFailureActions:_update_service_failure_actions_for__S_successful
push 0x10
call fcn.004343f0
mov edi, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
test eax, eax
je 0x4283b4
push eax
call dword [0x465020]
test eax, eax
jne 0x4283b4
call dword [0x4651b0]
push eax
push str.ReleaseServiceDatabaseLock:_unlock_failed:_0x_08x
push 1
call fcn.004343f0
add esp, 0xc
push ebx
mov ebx, dword [0x46503c]
call ebx
push esi
call ebx
pop ebx
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4283d0
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, eax
mov dword [ebp - 4], 1
test ebx, ebx
jne 0x4283fa
push str.SetServiceAutoStart:_invalid_parameter
push 1
call fcn.004343f0
add esp, 8
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 0x18
push str.ServicesActive
push 0
call dword [0x465034]
mov esi, eax
test esi, esi
jne 0x42842e
call dword [0x4651b0]
push eax
push str.SetServiceAutoStart:_couldnt_open_service_manager:_0x_08x
push 1
call fcn.004343f0
add esp, 0xc
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push 2
push ebx
push esi
call dword [0x465038]
mov edi, eax
test edi, edi
jne 0x428466
call dword [0x4651b0]
push eax
push ebx
push str.SetServiceAutoStart:_couldnt_open_service__S:_0x_08x
push 1
call fcn.004343f0
add esp, 0x10
push esi
call dword [0x46503c]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00428150
push 0
push 0
push 0
mov dword [ebp - 8], eax
xor eax, eax
cmp dword [ebp + 8], eax
push 0
push 0
push 0
sete al
push 0
push 0xffffffffffffffff
lea eax, [eax + eax + 2]
push eax
push 0xffffffffffffffff
push edi
call dword [0x465018]
test eax, eax
jne 0x4284b2
call dword [0x4651b0]
push eax
push str.SetServiceAutoStart:_change_service_failed:_0x_08x
push 1
call fcn.004343f0
add esp, 0xc
xor ebx, ebx
jmp 0x4284d6
cmp dword [ebp + 8], 0
mov eax, str._auto_
jne 0x4284c2
mov eax, str._disabled_
push eax
push ebx
push str.SetServiceAutoStart:_changed_service__S_to_start_type__s
push 0x10
call fcn.004343f0
mov ebx, dword [ebp - 4]
add esp, 0x10
mov eax, dword [ebp - 8]
test eax, eax
je 0x4284fe
push eax
call dword [0x465020]
test eax, eax
jne 0x4284fe
call dword [0x4651b0]
push eax
push str.ReleaseServiceDatabaseLock:_unlock_failed:_0x_08x
push 1
call fcn.004343f0
add esp, 0xc
push edi
mov edi, dword [0x46503c]
call edi
push esi
call edi
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42a2c0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
push 0x90
mov dword [ebp - 0xc], 0
call fcn.00405d04
mov edi, eax
add esp, 4
test edi, edi
je 0x42a322
push 0x90
push 0
push edi
call fcn.00405300
add esp, 0xc
push 0
push 0
push 1
push 0
call dword [0x465294]
mov dword [edi + 4], eax
test eax, eax
jne 0x42a329
call dword [0x4651b0]
push eax
push str.VNLStartPromptSuppression:_couldnt_allocate_event:_0x_08x
push 1
call fcn.004343f0
push edi
call fcn.00403d53
add esp, 0x10
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftDriver_Signing
push 0x80000002
call dword [0x4650cc]
test eax, eax
je 0x42a35d
push eax
push str.VNLStartPromptSuppression:_couldnt_open_signature_key:_0x_08x
push 1
call fcn.004343f0
add esp, 0xc
jmp 0x42a412
push esi
lea esi, [edi + 0xc]
push esi
lea ecx, [edi + 0x10]
push ecx
lea eax, [edi + 8]
push eax
push 0
mov dword [esi], 0x80
mov edx, dword [ebp - 4]
push str.Policy
push edx
call dword [0x4650c4]
test eax, eax
je 0x42a39d
push eax
push str.VNLStartPromptSuppression:_couldnt_query_signature_key:_0x_08x
push 1
call fcn.004343f0
add esp, 0xc
mov dword [esi], 0
jmp 0x42a411
mov eax, dword [esi]
push ebx
push eax
call fcn.00405d04
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x42a3c0
push str.VNLStartPromptSuppression:_couldnt_alloc_replacement
push 1
call fcn.004343f0
add esp, 8
jmp 0x42a40a
mov ecx, dword [esi]
push ecx
push 0
push ebx
call fcn.00405300
mov edx, dword [esi]
mov eax, dword [edi + 8]
mov ecx, dword [ebp - 4]
add esp, 0xc
push edx
push ebx
push eax
push 0
push str.Policy
push ecx
call dword [0x465094]
push ebx
mov dword [ebp - 8], eax
call fcn.00403d53
mov eax, dword [ebp - 8]
add esp, 4
test eax, eax
je 0x42a410
push eax
push str.VNLStartPromptSuppression:_couldnt_set_value:_0x_08x
push 1
call fcn.004343f0
add esp, 0xc
mov dword [esi], 0
pop ebx
pop esi
lea edx, [ebp - 0xc]
push edx
push 0
push edi
push 0x42a130
push 0
push 0
call dword [0x465290]
mov dword [edi], eax
test eax, eax
jne 0x42a45e
call dword [0x4651b0]
push eax
push str.VNLStartPromptSuppression:_couldnt_spawn_thread:_0x_08x
push 1
call fcn.004343f0
mov eax, dword [edi + 4]
add esp, 0xc
push eax
call dword [0x46525c]
push edi
call fcn.00403d53
add esp, 4
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push str.VNLStartPromptSuppression:_spawned_thread
push 0x10
call fcn.004343f0
add esp, 8
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x42a480
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 1
test esi, esi
jne 0x42a4a5
push str.VNLStopPromptSuppression:_invalid_parameter
push edi
call fcn.004343f0
add esp, 8
pop edi
xor eax, eax
pop esi
pop ebp
ret
mov eax, dword [esi + 4]
push eax
call dword [0x465298]
cmp dword [esi + 0xc], 0
jbe 0x42a525
lea ecx, [ebp + 8]
push ecx
push 0xf003f
push 0
push str.SOFTWAREMicrosoftDriver_Signing
push 0x80000002
call dword [0x4650cc]
test eax, eax
je 0x42a4e8
push eax
push str.VNLStopPromptSuppression:_couldnt_open_signature_key:_0x_08x
push 1
call fcn.004343f0
add esp, 0xc
xor edi, edi
jmp 0x42a525
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 8]
push edx
mov edx, dword [ebp + 8]
lea eax, [esi + 0x10]
push eax
push ecx
push 0
push str.Policy
push edx
call dword [0x465094]
test eax, eax
je 0x42a51b
push eax
push str.VNLStopPromptSuppression:_couldnt_restore_signature_key:_0x_08x
push 1
call fcn.004343f0
add esp, 0xc
xor edi, edi
mov eax, dword [ebp + 8]
push eax
call dword [0x4650d0]
push str.VNLStopPromptSuppression:_waiting_for_thread_to_stop
push 0x20
call fcn.004343f0
mov ecx, dword [esi]
add esp, 8
push 0xffffffffffffffff
push ecx
call dword [0x465284]
push str.VNLStopPromptSuppression:_done_waiting
push 0x20
call fcn.004343f0
push esi
call fcn.00403d53
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x4392d0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
push 1
push eax
call fcn.0043bcf0
mov ecx, dword [ebp + 8]
add esp, 8
mov esi, eax
push esi
push ecx
call dword [0x465088]
push esi
mov edi, eax
call fcn.00403d53
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x439310
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 8
push ebx
push esi
push edi
push 1
push eax
call fcn.0043bcf0
mov esi, dword [ebp + 0x14]
add esp, 8
mov edi, eax
test esi, esi
jbe 0x439354
cmp esi, 2
jbe 0x43933a
cmp esi, 7
jne 0x439354
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp + 0x18]
lea edx, [ebp - 4]
push edx
push eax
push ecx
call fcn.0043a3b0
add esp, 0x10
jmp 0x439360
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
push edx
push esi
push eax
push edi
push ecx
call dword [0x465094]
mov ebx, eax
cmp esi, 1
je 0x439389
cmp esi, 2
je 0x439389
cmp esi, 7
jne 0x439395
mov edx, dword [ebp - 4]
push edx
call fcn.00403d53
add esp, 4
push edi
call fcn.00403d53
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4393b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0x2b7
push str.d:_build_ob_bora_894247_bora_lib_misc_win32uRegistry.c
push 2
push 0x4000
xor ebx, ebx
push 0xffffffffffffffff
mov dword [ebp - 8], 0x4000
mov dword [ebp - 4], ebx
call fcn.00439050
add esp, 0x14
mov edi, eax
mov dword [ebp - 0x10], edi
cmp dword [ebp + 0x20], ebx
je 0x43940b
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
push 0x2bc
add eax, eax
push str.d:_build_ob_bora_894247_bora_lib_misc_win32uRegistry.c
push eax
push 0xffffffffffffffff
mov dword [ebp - 4], eax
call fcn.00438fb0
add esp, 0x10
mov ebx, eax
mov eax, dword [ebp + 0x18]
lea ecx, [ebp - 4]
push ecx
push ebx
lea edx, [ebp - 0xc]
push edx
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 8]
push ecx
push edi
push edx
push eax
call dword [0x465084]
mov esi, eax
cmp esi, 0x103
je 0x439453
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 8]
push ecx
push edi
mov edi, dword [ebp + 0x10]
add edx, edx
call fcn.00439180
add esp, 8
test al, al
jne 0x439453
mov esi, 0xea
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
push edx
mov edx, dword [ebp + 0x20]
mov eax, esi
mov esi, dword [ebp + 0x24]
push ebx
call fcn.00439200
mov esi, eax
mov eax, dword [ebp + 0x1c]
add esp, 8
test eax, eax
je 0x439479
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.00403d53
push ebx
call fcn.00403d53
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret