Function at 0x4169e0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x418
push ebx
push ebp
push esi
push edi
mov ecx, 0x103
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
push str.UnBindName_With_VPNAdapter
push str.SOFTWAREArray_NetworksArray_SSL_VPN
push reloc.WS2_32.dll_bind
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], 0x410
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov ebp, dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
test esi, esi
je 0x416af7
mov eax, dword [0x441ff4]
test eax, eax
je 0x416aca
mov eax, dword [0x441fd4]
mov eax, dword [eax]
cmp eax, 3
je 0x416a68
mov ecx, dword [0x441fdc]
cmp dword [ecx], 0
jne 0x416aca
cmp eax, 3
jle 0x416aca
call ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [0x439d90]
test eax, eax
jge 0x416a89
mov edx, dword [0x441fa0]
mov dword [0x439d90], edx
call fcn.0041c4b1
test eax, eax
je 0x416abc
mov eax, dword [0x439d90]
push 3
push eax
push 0x430
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvs_body.cpp
call fcn.0041c4e1
push esi
push str.SetDefaultNameForReverseNDISBind:_no_old_value__dwRet_is__d._n
call fcn.0041c506
add esp, 0x18
call fcn.0041c4cc
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.NWLink
push 0x43ae88
push str.Kaspersky
push str.Check_Point
push str.symantec
push str._s__s__s__s__s
lea ecx, [esp + 0x30]
push 0x40f
push ecx
jmp 0x416d59
lea edx, [esp + 0x18]
test edx, edx
je 0x416d31
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x30c
jae 0x416d31
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIA]
lea eax, [esp + 0x18]
push str.symantec
push eax
call ebx
test eax, eax
jne 0x416b8b
mov edi, 0x43ae50
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x18]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.symantec
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x18]
push str.Check_Point
push eax
call ebx
test eax, eax
jne 0x416bf3
mov edi, 0x43ae50
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x18]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.Check_Point
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x18]
push str.Kaspersky
push eax
call ebx
test eax, eax
jne 0x416c5b
mov edi, 0x43ae50
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x18]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.Kaspersky
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x18]
push 0x43ae88
push eax
call ebx
test eax, eax
jne 0x416cc3
mov edi, 0x43ae50
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x18]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x43ae88
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x18]
push str.NWLink
push eax
call ebx
test eax, eax
jne 0x416d62
mov edi, 0x43ae50
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x18]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.NWLink
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x416d62
push str.NWLink
push 0x43ae88
push str.Kaspersky
push str.Check_Point
push str.symantec
push str._s__s__s__s__s
lea eax, [esp + 0x30]
push 0x40f
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x20
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
lea ecx, [esp + 0x1c]
push ecx
push 1
push str.UnBindName_With_VPNAdapter
push str.SOFTWAREArray_NetworksArray_SSL_VPN
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov esi, eax
test esi, esi
je 0x416e1e
mov eax, dword [0x441ff4]
test eax, eax
je 0x416e1e
mov edx, dword [0x441fd4]
mov eax, dword [edx]
cmp eax, 2
je 0x416dbc
mov ecx, dword [0x441fdc]
cmp dword [ecx], 0
jne 0x416e1e
cmp eax, 2
jle 0x416e1e
call ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [0x439d90]
test eax, eax
jge 0x416ddd
mov edx, dword [0x441fa0]
mov dword [0x439d90], edx
call fcn.0041c4b1
test eax, eax
je 0x416e10
mov eax, dword [0x439d90]
push 2
push eax
push 0x459
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvs_body.cpp
call fcn.0041c4e1
push esi
push str.SetDefaultNameForReverseNDISBind:_failed__ret_is__d_n
call fcn.0041c506
add esp, 0x18
call fcn.0041c4cc
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x418
ret