Function at 0x406256
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Terminate process

Disassembly:
sub esp, 0x41c
lea eax, [esp + 8]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ebp
push esi
push eax
push 0x20119
xor ebp, ebp
or esi, 0xffffffff
push ebp
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push reloc.WS2_32.dll_bind
call ebx
test eax, eax
jne 0x406676
push edi
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0x100
push eax
lea eax, [esp + 0x340]
mov dword [esp + 0x3c], ebp
push eax
push ebp
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, 0x103
je 0x406610
mov ebp, dword [sym.imp.msvcrt.dll_strncmp]
test eax, eax
jne 0x40667d
lea eax, [esp + 0x1c]
push eax
push 0x20119
push 0
lea eax, [esp + 0x338]
push eax
push dword [esp + 0x28]
call ebx
test eax, eax
jne 0x4065cb
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x100
push eax
lea eax, [esp + 0x130]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push str.ComponentId
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4065cb
cmp dword [esp + 0x14], 1
jne 0x4065cb
push 0x100
lea eax, [esp + 0x130]
push str.tap0801
push eax
call ebp
add esp, 0xc
test eax, eax
je 0x406386
push 0x100
lea eax, [esp + 0x130]
push str.tap0901
push eax
call ebp
add esp, 0xc
test eax, eax
je 0x406386
push 0x100
lea eax, [esp + 0x130]
push str.TEAMVIEWERVPN
push eax
call ebp
add esp, 0xc
test eax, eax
jne 0x4065cb
lea eax, [esp + 0x12c]
push eax
call dword [sym.imp.msvcrt.dll__strdup]
pop ecx
test eax, eax
jne 0x40639e
call fcn.00401dca
mov dword [0x40aaf8], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x130]
mov dword [esp + 0x14], 0x100
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push str.NetCfgInstanceId
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4065b9
cmp dword [esp + 0x14], 1
jne 0x4065b9
push 0x100
lea eax, [esp + 0x230]
push str.SYSTEMCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318_
push eax
call dword [sym.imp.msvcrt.dll_strncpy]
lea ecx, [esp + 0x238]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406406
sub ecx, edx
mov eax, 0xff
sub eax, ecx
push eax
lea eax, [esp + 0x130]
push eax
lea eax, [esp + 0x234]
push eax
call dword [sym.imp.msvcrt.dll_strncat]
lea ecx, [esp + 0x238]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40643a
sub ecx, edx
mov eax, 0xff
sub eax, ecx
push eax
lea eax, [esp + 0x230]
push str.Connection
push eax
call dword [sym.imp.msvcrt.dll_strncat]
add esp, 0xc
lea eax, [esp + 0x24]
push eax
push 0x20119
push 0
lea eax, [esp + 0x238]
push eax
push reloc.WS2_32.dll_bind
call ebx
test eax, eax
jne 0x4065b3
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x100
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push str.Name
push dword [esp + 0x38]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4065b3
cmp dword [esp + 0x14], 1
jne 0x4065b3
mov ecx, dword [0x40aad0]
cmp byte [ecx], 0x2e
jne 0x4064d2
movzx eax, byte [ecx + 1]
test al, al
je 0x4064ee
push 0x100
lea eax, [esp + 0x30]
push eax
push ecx
call dword [sym.imp.msvcrt.dll__strnicmp]
add esp, 0xc
test eax, eax
jne 0x4065b3
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.msvcrt.dll__strdup]
pop ecx
test eax, eax
jne 0x406503
call fcn.00401dca
push 0x100
mov dword [0x40aad4], eax
lea eax, [esp + 0x30]
push str..Global_
push eax
call dword [sym.imp.msvcrt.dll_strncpy]
lea ecx, [esp + 0x38]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406527
sub ecx, edx
mov eax, 0xff
sub eax, ecx
push eax
lea eax, [esp + 0x130]
push eax
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.msvcrt.dll_strncat]
lea esi, [esp + 0x38]
add esp, 0xc
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x406555
push 0xe
push str.TEAMVIEWERVPN
push dword [0x40aaf8]
sub esi, ecx
call sub.msvcrt.dll_memcmp
mov ecx, eax
mov edx, str..dgt
mov eax, 0xff
sub eax, esi
test ecx, ecx
push eax
mov eax, str..tap
cmove eax, edx
push eax
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.msvcrt.dll_strncat]
add esp, 0x18
xor eax, eax
push eax
push 4
push 3
push eax
push eax
push 0xc0000000
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push dword [esp + 0x24]
call edi
cmp esi, 0xffffffff
jne 0x4065cb
push dword [0x40aaf8]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push dword [esp + 0x1c]
call edi
mov dword [esp + 0x20], 0x100
cmp esi, 0xffffffff
jne 0x406610
mov eax, dword [esp + 0x28]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
lea ecx, [esp + 0x30]
inc eax
push ecx
lea ecx, [esp + 0x340]
mov dword [esp + 0x3c], eax
push ecx
push eax
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x4062c9
push dword [esp + 0x18]
call edi
cmp esi, 0xffffffff
jne 0x406669
push str.Fatal:_No_compatible_VPN_adapter
call fcn.00404029
pop ecx
mov ecx, dword [0x40aad0]
cmp byte [ecx], 0x2e
jne 0x406645
movzx eax, byte [ecx + 1]
test al, al
jne 0x406645
push 0x408fe0
call fcn.00404029
jmp 0x406651
push ecx
push str._with_name___s_
call fcn.00404029
pop ecx
pop ecx
push str._available_for_use_n
call fcn.00404029
mov dword [esp], 0x10df
call dword [sym.imp.msvcrt.dll_exit]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
mov ecx, eax
call fcn.00406239
mov ecx, eax
call fcn.00406239
int3