Function at 0x4075c8
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb7c
push ebx
push esi
push edi
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp + 8]
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x88c], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x21c], 0
cmp dword [0x461140], 0
jne 0x40763c
mov dword [0x461140], 0xb
mov edi, 0xb60500
xor eax, eax
mov ecx, 0x1e
rep stosd dword es:[edi], eax
mov edi, 0xb60580
xor eax, eax
mov ecx, 0x3c
rep stosd dword es:[edi], eax
cmp dword [ebp + 8], 0
jne 0x407652
mov dword [ebp - 0xc], 1
jmp 0x407699
mov eax, dword [ebp - 0x220]
xor ecx, ecx
mov cl, byte [eax + 1]
push ecx
mov eax, dword [ebp - 0x220]
xor ecx, ecx
mov cl, byte [eax]
push ecx
push str._d._d.
push 0x16
lea eax, [ebp - 0x888]
push eax
call fcn.00452660
add esp, 0x14
lea edi, [ebp - 0x888]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x88c], eax
lea eax, [ebp - 0x228]
push eax
push 0x20019
push 0
push 0x4612e8
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x407bf2
mov dword [ebp - 8], 0
mov dword [ebp - 0x224], 0
cmp dword [ebp - 8], 0
jne 0x407be5
mov byte [ebp - 0x870], 0
mov dword [ebp - 4], 0x320
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x870]
push eax
mov eax, dword [ebp - 0x224]
push eax
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov dword [ebp - 8], eax
inc dword [ebp - 0x224]
cmp dword [ebp - 8], 0
jne 0x407be0
lea eax, [ebp - 0x54c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x870]
push eax
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x407be0
mov dword [ebp - 0x550], 4
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x550]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push str.VPNInterface
mov eax, dword [ebp - 0x54c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40778f
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x218]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
mov dword [ebp - 0x550], 0x1ff
lea eax, [ebp - 0x550]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x461338
mov eax, dword [ebp - 0x54c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x407867
lea eax, [ebp - 0x218]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
mov dword [ebp - 0x550], 0x1ff
lea eax, [ebp - 0x550]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x461348
mov eax, dword [ebp - 0x54c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x407832
jmp 0x407867
push str.0.0.0.0
lea eax, [ebp - 0x218]
push eax
call fcn.00452540
add esp, 8
test eax, eax
jne 0x407867
lea eax, [ebp - 0x218]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
movsx eax, byte [ebp - 0x218]
test eax, eax
je 0x4078b3
lea eax, [ebp - 0x218]
push eax
call fcn.00407e86
add esp, 4
test eax, eax
je 0x4078b3
cmp dword [0x45e03c], 0
je 0x4078ae
lea eax, [ebp - 0x218]
push eax
push str._r_nACTIVE_NETCFG_SKIPPING_DISQUALIFIED_IP_ADDRESS___s_
call fcn.00452380
add esp, 8
jmp 0x407bd3
movsx eax, byte [ebp - 0x218]
test eax, eax
je 0x4079e2
cmp dword [ebp - 0xc], 0
je 0x4079e2
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x548]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00407c71
add esp, 0xc
test eax, eax
je 0x407995
lea edi, [ebp - 0x218]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, 0xb60500
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x548]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, 0xb60580
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
inc dword [ebp - 0x10]
lea eax, [ebp - 0x548]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
call fcn.00452990
add esp, 4
push eax
push str.__X_CONNECTED_WITH_OFFLINE_BIND_ALT_NIC___s___s
push 0xbc
lea eax, [ebp - 0x948]
push eax
call fcn.00452660
add esp, 0x18
lea eax, [ebp - 0x948]
push eax
call fcn.004097a0
add esp, 4
mov dword [ebp - 8], 0x63
jmp 0x4079dd
lea eax, [ebp - 0x548]
push eax
lea eax, [ebp - 0x218]
push eax
mov eax, dword [ebp - 0x21c]
push eax
push 0
call fcn.00452990
add esp, 4
push eax
push str.__X_UNABLE_TO_CONNECT_WITH_OFFLINE_BIND_ALT_NIC_err_d___s___s
push 0xbc
lea eax, [ebp - 0xa04]
push eax
call fcn.00452660
add esp, 0x1c
lea eax, [ebp - 0xa04]
push eax
call fcn.004097a0
add esp, 4
jmp 0x407bd3
movsx eax, byte [ebp - 0x218]
test eax, eax
je 0x407bd3
lea eax, [ebp - 0x548]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
lea eax, [ebp - 0x548]
push eax
lea eax, [ebp - 0x870]
push eax
call fcn.00407034
add esp, 8
cmp dword [0x45e03c], 0
je 0x407a62
lea eax, [ebp - 0x888]
push eax
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x548]
push eax
lea eax, [ebp - 0x218]
push eax
push str._r_nACTIVE_ALT_NETCFG___s____s__VPN__d__MatchIP._s
call fcn.00452380
add esp, 0x14
cmp dword [ebp - 0x14], 0
jne 0x407adc
push str.Fortinet
lea eax, [ebp - 0x548]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
jne 0x407adc
push str.SonicWALL
lea eax, [ebp - 0x548]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
jne 0x407adc
push str.PANGP_Virtual
lea eax, [ebp - 0x548]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
jne 0x407adc
push str.AoVPN
lea eax, [ebp - 0x548]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x407ae1
jmp 0x407bd3
mov dword [0x461140], 3
lea edi, [ebp - 0x218]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
cmp eax, 0x78
jbe 0x407b0f
mov byte [ebp - 0x1a1], 0
inc dword [ebp - 0x10]
lea edi, [ebp - 0x218]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, 0xb60500
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x548]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, 0xb60580
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [0x45e03c], 0
je 0x407b89
push 0xb60500
mov eax, dword [ebp - 0x10]
push eax
push str._r_n__d_ESTABLISHING_BIND_OVERRIDE_ALT_NIC___s_
call fcn.00452380
add esp, 0xc
lea eax, [ebp - 0x888]
push eax
push 0xb60500
mov eax, dword [ebp - 0x10]
push eax
push 0
call fcn.00452990
add esp, 4
push eax
push str.__X_OFFLINE_BIND_ALT_NIC___d___s___s
push 0xbc
lea eax, [ebp - 0xac0]
push eax
call fcn.00452660
add esp, 0x1c
lea eax, [ebp - 0xac0]
push eax
call fcn.004097a0
add esp, 4
mov dword [ebp - 8], 0x63
mov eax, dword [ebp - 0x54c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4076d5
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x10], 0
jne 0x407c6c
mov edi, 0xb60500
xor eax, eax
mov ecx, 0x1e
rep stosd dword es:[edi], eax
mov edi, 0xb60580
xor eax, eax
mov ecx, 0x3c
rep stosd dword es:[edi], eax
push 0
call fcn.00452990
add esp, 4
push eax
push str.__X_OFFLINE_BIND_ALT_NIC_NONE_FOUND
push 0xbc
lea eax, [ebp - 0xb7c]
push eax
call fcn.00452660
add esp, 0x10
lea eax, [ebp - 0xb7c]
push eax
call fcn.004097a0
add esp, 4
cmp dword [0x45e03c], 0
je 0x407c6c
lea eax, [ebp - 0xb7c]
push eax
push str._r_n_s
call fcn.00452380
add esp, 8
pop edi
pop esi
pop ebx
leave
ret