Function at 0x4343c0
Capabilities:
Register network filter via wfp api

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x5ac
mov eax, dword [0x612790]
xor eax, esp
mov dword [esp + 0x5a8], eax
push esi
push 0x30
lea eax, [esp + 0x104]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x98
lea eax, [esp + 0x78]
mov dword [esp + 0x24], 0
push 0
push eax
mov dword [esp + 0x24], 0
call sub.VCRUNTIME140.dll_memset
push 0x38
lea eax, [esp + 0x17c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [esp + 0x1c0]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [esp + 0x3d4]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x3c
lea eax, [esp + 0x198]
push 0x208
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, eax
test esi, esi
jne 0x434493
push str.GetModuleFileNameA__
push eax
call fcn.00432ba0
push eax
push 0x241
push str.__set_dns_filters
push str.BAGENT
push str.Error__x
push 2
push str.BAGENT
call fcn.00432050
add esp, 0x24
push esi
lea eax, [esp + 0x19c]
push eax
lea eax, [esp + 0x3a8]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs]
add esp, 0xc
mov dword [esp + 0x118], 1
lea eax, [esp + 0x100]
mov dword [0x915748], 0
push 0x915748
push eax
push 0
push 0xa
push 0
call sub.fwpuclnt.dll_FwpmEngineOpen0
test eax, eax
je 0x43450d
push str.FwpmEngineOpen0__
push eax
call fcn.00432ba0
push eax
push 0x24a
push str.__set_dns_filters
push str.BAGENT
push str.Error__x
push 2
push str.BAGENT
call fcn.00432050
add esp, 0x24
push 0x24c
push str.__set_dns_filters
push str.BAGENT
push str.WFP_engine_opened
push dword [0x915734]
call fcn.004322d0
add esp, 0x14
lea eax, [esp + 0x14]
push eax
push str._rf_7j
push dword [0x915748]
call sub.fwpuclnt.dll_FwpmSubLayerGetByKey0
test eax, eax
jne 0x43457a
push 0x251
push str.__set_dns_filters
push str.BAGENT
push str.Using_existing_sublayer
push 1
push str.BAGENT
call fcn.00432050
add esp, 0x18
lea eax, [esp + 0x14]
push eax
call sub.fwpuclnt.dll_FwpmFreeMemory0
jmp 0x434672
movups xmm0, xmmword [str._rf_7j]
push 0x30
lea eax, [esp + 0x134]
push 0
push eax
movaps xmmword [esp + 0x2c], xmm0
call sub.VCRUNTIME140.dll_memset
push 0x2c
lea eax, [esp + 0x4c]
mov dword [esp + 0x20], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x134]
push eax
push 0
push 0xa
push 0
call sub.fwpuclnt.dll_FwpmEngineOpen0
mov esi, eax
test esi, esi
jne 0x434614
mov eax, dword [str.StarLet]
movaps xmm0, xmmword [esp + 0x20]
mov dword [esp + 0x4c], eax
mov eax, dword [str.Allow_to_send_DNS_request__when_OpenVPN_block_it_]
mov dword [esp + 0x50], eax
mov eax, 0x100
mov word [esp + 0x64], ax
lea eax, [esp + 0x3c]
push esi
push eax
push dword [esp + 0x18]
movups xmmword [esp + 0x48], xmm0
mov dword [esp + 0x60], esi
call sub.fwpuclnt.dll_FwpmSubLayerAdd0
mov esi, eax
test esi, esi
je 0x434622
push str.FwpmSubLayerAdd0__
jmp 0x434619
push str.FwpmEngineOpen0__
push esi
call fcn.00432ba0
add esp, 8
mov eax, dword [esp + 0x10]
test eax, eax
je 0x434630
push eax
call sub.fwpuclnt.dll_FwpmEngineClose0
cmp esi, 0x80320009
je 0x43464f
test esi, esi
je 0x43464f
push str.Failed_to_add_persistent_sublayer
push esi
call fcn.00432ba0
add esp, 8
jmp 0x4347f1
push 0x259
push str.__set_dns_filters
push str.BAGENT
push str.Added_a_persistent_sublayer
push 1
push str.BAGENT
call fcn.00432050
add esp, 0x18
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x3a4]
push eax
call sub.fwpuclnt.dll_FwpmGetAppIdFromFileName0
mov esi, eax
test esi, esi
je 0x43469d
push str.Get_byte_blob_for_BAGENT.EXE_failed
push esi
call fcn.00432ba0
add esp, 8
jmp 0x4347f1
mov eax, dword [str.StarLet]
movups xmm0, xmmword [str._rf_7j]
mov dword [esp + 0x78], eax
lea eax, [esp + 0x160]
mov dword [esp + 0xbc], eax
mov eax, 0x35
movups xmmword [esp + 0xa0], xmm0
mov word [esp + 0x178], ax
movups xmm0, xmmword [0x5ecbb4]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x194], eax
lea eax, [esp + 0x18]
movups xmmword [esp + 0x90], xmm0
push eax
movups xmm0, xmmword [0x5ecbd4]
push 0
lea eax, [esp + 0x70]
mov dword [esp + 0xb8], 1
movups xmmword [esp + 0x168], xmm0
push eax
movups xmm0, xmmword [0x5ecbe4]
mov byte [esp + 0xc0], 0xa
push dword [0x915748]
mov dword [esp + 0xc8], 2
mov dword [esp + 0xd0], 0x1002
mov dword [esp + 0x180], 0
mov dword [esp + 0x184], 2
movups xmmword [esp + 0x18c], xmm0
mov dword [esp + 0x19c], 0
mov dword [esp + 0x1a0], 0xc
call sub.fwpuclnt.dll_FwpmFilterAdd0
mov esi, eax
test esi, esi
je 0x43478a
push str.Add_filter_to_permit_IPv4_port_53_traffic_failed
push esi
call fcn.00432ba0
add esp, 8
jmp 0x4347f1
movups xmm0, xmmword [str._9rJ]
lea eax, [esp + 0x18]
push eax
push 0
lea eax, [esp + 0x70]
push eax
push dword [0x915748]
movups xmmword [esp + 0xa0], xmm0
call sub.fwpuclnt.dll_FwpmFilterAdd0
mov esi, eax
test esi, esi
je 0x4347c6
push str.Add_filter_to_permit_IPv6_port_53_traffic_failed
push esi
call fcn.00432ba0
add esp, 8
jmp 0x4347f1
lea eax, [esp + 0x198]
push eax
push 0x28b
push str.__set_dns_filters
push str.BAGENT
push str.Added_permit_filters_for_s
push 1
push str.BAGENT
call fcn.00432050
add esp, 0x1c
cmp dword [esp + 0xc], 0
je 0x434802
lea eax, [esp + 0xc]
push eax
call sub.fwpuclnt.dll_FwpmFreeMemory0
test esi, esi
je 0x43481f
mov eax, dword [0x915748]
test eax, eax
je 0x43481f
push eax
call sub.fwpuclnt.dll_FwpmEngineClose0
mov dword [0x915748], 0
mov ecx, dword [esp + 0x5ac]
xor eax, eax
test esi, esi
pop esi
setne al
xor ecx, esp
inc eax
call fcn.00498b38
mov esp, ebp
pop ebp
ret