Function at 0x4821f0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bc2ed
mov eax, dword fs:[0]
push eax
sub esp, 0xda4
mov eax, dword [0x50dc94]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [0x541a90]
mov esi, dword [0x541a8c]
cmp esi, edi
je 0x482244
nop
mov ecx, esi
call fcn.00413170
add esi, 0x24
cmp esi, edi
jne 0x482230
mov esi, dword [0x541a8c]
mov dword [0x541a90], esi
call fcn.0042b7a0
test al, al
je 0x482ce4
push 2
call fcn.004a8298
push eax
call fcn.004a8292
add esp, 8
test eax, eax
je 0x482ce4
xor edi, edi
mov dword [ebp - 0xd58], 0
push 0x20a
lea eax, [ebp - 0x634]
mov dword [ebp - 0xd7c], 1
push edi
push eax
mov dword [ebp - 0xd4c], edi
call fcn.004b493e
push str.softwareFortinetFortiClientFA_ESNAC
push reloc.SHELL32.dll_SHChangeNotifyRegister
mov dword [ebp - 0xd68], edi
call fcn.004a7eca
mov esi, eax
add esp, 0x14
test esi, esi
je 0x482308
lea eax, [ebp - 0xd68]
push eax
push str.vpn_tab_hidden
push esi
call fcn.004a7ed6
lea eax, [ebp - 0xd98]
mov dword [ebp - 0xd98], edi
push eax
push str.quarantined
push esi
call fcn.004a7ed6
mov eax, dword [ebp - 0xd68]
mov ecx, 1
cmp dword [ebp - 0xd98], edi
push esi
cmovne eax, ecx
mov dword [ebp - 0xd68], eax
call fcn.004a7ed0
add esp, 0x1c
cmp dword [ebp - 0xd68], edi
jne 0x482ce4
push str.softwareFortinetFortiClientFA_VPN
push reloc.SHELL32.dll_SHChangeNotifyRegister
call fcn.004a7eca
mov esi, eax
add esp, 8
test esi, esi
je 0x4823d8
push 0
lea eax, [ebp - 0xd94]
mov dword [ebp - 0xd94], edi
push eax
push str.connection
push esi
call fcn.004a7edc
mov eax, dword [ebp - 0xd94]
add esp, 0x10
test eax, eax
je 0x48236d
push 0x104
push eax
lea eax, [ebp - 0x634]
push eax
call dword [0x4c5ac4]
add esp, 0xc
lea eax, [ebp - 0xd5c]
mov dword [ebp - 0xd5c], edi
push eax
push str.allow_personal_vpns
push esi
call fcn.004a7ed6
add esp, 0xc
test al, al
je 0x48239d
xor ebx, ebx
cmp dword [ebp - 0xd5c], ebx
setne bl
mov dword [ebp - 0xd7c], ebx
lea eax, [ebp - 0xd5c]
mov dword [ebp - 0xd5c], edi
push eax
push str.disable_connect_disconnect
push esi
call fcn.004a7ed6
add esp, 0xc
test al, al
je 0x4823cf
xor ebx, ebx
cmp dword [ebp - 0xd5c], ebx
setne bl
mov dword [ebp - 0xd4c], ebx
mov edi, ebx
push esi
call fcn.004a7ed0
add esp, 4
cmp dword [ebp + 8], 0
je 0x4827a9
push 2
call fcn.004a7fe4
add esp, 4
test eax, eax
je 0x4827a9
push 2
call fcn.004a7fea
add esp, 4
test eax, eax
je 0x4827a9
push 2
call fcn.004a807c
add esp, 4
test eax, eax
jne 0x4827a9
push str.softwareFortinetFortiClientIPSecTunnels
push reloc.SHELL32.dll_SHChangeNotifyRegister
call fcn.004a7eca
mov ebx, eax
add esp, 8
mov dword [ebp - 0xd60], ebx
test ebx, ebx
je 0x4827a9
push 0x20a
lea eax, [ebp - 0x428]
push 0
push eax
call fcn.004b493e
add esp, 0xc
mov dword [ebp - 0xd88], 0x104
xor esi, esi
mov dword [ebp - 0xd64], esi
lea eax, [ebp - 0xd88]
push eax
lea eax, [ebp - 0x428]
push eax
push esi
push ebx
call dword [sym.imp.SHLWAPI.dll_SHEnumKeyExW]
test eax, eax
jne 0x4827a0
mov dword [ebp - 0xd50], eax
xor edi, edi
lea eax, [ebp - 0x428]
push eax
push ebx
call fcn.004a7eca
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x482632
lea eax, [ebp - 0xd50]
push eax
push str.tray_menu
push ebx
call fcn.004a7ed6
add esp, 0xc
test al, al
jne 0x4824c7
mov dword [ebp - 0xd50], 1
jmp 0x4824d3
cmp dword [ebp - 0xd50], edi
je 0x482608
push 0x4db2c0
push ebx
call fcn.004a7eca
add esp, 8
mov dword [ebp - 0xd70], eax
test eax, eax
je 0x482608
cmp dword [ebp - 0xd7c], edi
jne 0x48252c
lea ecx, [ebp - 0xd90]
xor esi, esi
push ecx
push 0x4de980
push eax
mov dword [ebp - 0xd90], esi
call fcn.004a7ed6
add esp, 0xc
test al, al
cmovne esi, dword [ebp - 0xd90]
xor eax, eax
test esi, esi
setne al
mov dword [ebp - 0xd50], eax
jmp 0x482532
mov eax, dword [ebp - 0xd50]
test eax, eax
je 0x4825f4
cmp dword [ebp - 0xd4c], edi
je 0x4825f4
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x64c]
push eax
call fcn.0047f340
mov ecx, dword [ebp - 0x63c]
add esp, 8
mov esi, dword [ebp - 0x638]
mov edx, dword [ebp - 0x64c]
test ecx, ecx
je 0x4825a7
cmp esi, 8
mov dword [ebp - 0xd50], edi
lea eax, [ebp - 0x64c]
cmovae eax, edx
add ecx, ecx
je 0x4825a7
nop dword [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x482590
mov esi, dword [ebp - 0x638]
mov edx, dword [ebp - 0x64c]
cmp esi, 8
jb 0x4825db
lea esi, [esi*2 + 2]
mov eax, edx
cmp esi, 0x1000
jb 0x4825d1
mov edx, dword [edx - 4]
add esi, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x482953
push esi
push edx
call fcn.004aebf7
add esp, 8
xor eax, eax
mov dword [ebp - 0x63c], edi
mov dword [ebp - 0x638], 7
mov word [ebp - 0x64c], ax
push dword [ebp - 0xd70]
call fcn.004a7ed0
mov esi, dword [ebp - 0xd64]
add esp, 4
lea eax, [ebp - 0xd8c]
mov dword [ebp - 0xd8c], edi
push eax
push str.single_user_mode
push ebx
call fcn.004a7ed6
test al, al
push ebx
cmovne edi, dword [ebp - 0xd8c]
call fcn.004a7ed0
add esp, 0x10
xor eax, eax
mov dword [ebp - 0x684], 0
mov dword [ebp - 0x680], 7
mov word [ebp - 0x694], ax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x694]
lea eax, [ebp - 0x428]
push eax
call fcn.00410580
push 0x228
lea eax, [ebp - 0xb20]
mov dword [ebp - 0x67c], 0
push 0
push eax
call fcn.004b493e
push 0xff
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0xb20]
push eax
call dword [0x4c5ac4]
lea eax, [ebp - 0xb20]
push eax
call fcn.004a814e
mov eax, dword [ebp - 0x920]
add esp, 0x1c
cmp eax, 2
je 0x4826cf
cmp eax, 3
je 0x4826cf
mov ebx, dword [ebp - 0xd58]
xor eax, eax
mov dword [ebp - 0x678], eax
mov dword [ebp - 0x674], edi
jmp 0x4826fa
mov ebx, 1
mov dword [ebp - 0x678], 1
mov ecx, 0x541a8c
mov dword [ebp - 0x674], edi
mov dword [ebp - 0xd58], ebx
call fcn.004836a0
mov eax, dword [ebp - 0x678]
cmp dword [ebp - 0xd50], 0
mov edi, dword [ebp - 0xd4c]
je 0x48276f
test eax, eax
je 0x48271d
test edi, edi
je 0x48271d
mov dword [ebp - 0xd50], 0
jmp 0x48276f
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x634]
push eax
call dword [0x4c5ae4]
add esp, 8
test eax, eax
jne 0x48275e
mov eax, dword [0x541a8c]
lea ecx, [ebp - 0x694]
push ecx
push eax
mov dword [ebp - 0xda4], eax
mov ecx, 0x541a8c
lea eax, [ebp - 0xda8]
push eax
call fcn.00483940
jmp 0x48276f
lea eax, [ebp - 0x694]
mov ecx, 0x541a8c
push eax
call fcn.00483a90
lea ecx, [ebp - 0x694]
mov dword [ebp - 4], 0xffffffff
call fcn.00413170
inc esi
mov dword [ebp - 0xd88], 0x104
test ebx, ebx
mov dword [ebp - 0xd64], esi
mov ebx, dword [ebp - 0xd60]
je 0x482462
push ebx
call fcn.004a7ed0
add esp, 4
cmp dword [ebp + 0xc], 0
je 0x482ce4
push 0xb
call fcn.004a7fe4
add esp, 4
test eax, eax
je 0x482ce4
push 0xb
call fcn.004a7fea
add esp, 4
test eax, eax
je 0x482ce4
push 0xb
call fcn.004a807c
add esp, 4
test eax, eax
jne 0x482ce4
push 0x228
push eax
lea eax, [ebp - 0xd48]
push eax
call fcn.004b493e
lea eax, [ebp - 0xd48]
push eax
call fcn.0042d450
lea eax, [ebp - 0xda0]
mov dword [ebp - 0xd6c], 0
push eax
lea eax, [ebp - 0xd74]
push eax
lea eax, [ebp - 0xd6c]
push eax
call fcn.0042dab0
add esp, 0x1c
cmp dword [ebp - 0xd6c], 0
je 0x48287a
push 0xffffffffffffffff
push dword [ebp - 0xd74]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0xd6c]
push dword [ebp - 0xd74]
mov esi, dword [eax + 0x18]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [ebp - 0xda0]
push eax
lea eax, [ebp - 0xd74]
push eax
push dword [ebp - 0xd6c]
call fcn.0042db00
add esp, 0xc
test esi, esi
jne 0x48288d
cmp dword [ebp - 0xb48], 2
mov dword [ebp - 0xd70], 0
jne 0x482897
mov dword [ebp - 0xd70], 1
push str.SoftwareFortinetFortiClientSslvpnTunnels
push reloc.SHELL32.dll_SHChangeNotifyRegister
call fcn.004a7eca
mov ebx, eax
add esp, 8
mov dword [ebp - 0xd64], ebx
test ebx, ebx
je 0x482c20
push 0x20a
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.004b493e
xor esi, esi
add esp, 0xc
cmp dword [ebp - 0xd58], esi
mov dword [ebp - 0xd60], esi
mov dword [ebp - 0xd80], 0x104
jne 0x482c17
lea eax, [ebp - 0xd80]
push eax
lea eax, [ebp - 0x21c]
push eax
push esi
push ebx
call dword [sym.imp.SHLWAPI.dll_SHEnumKeyExW]
test eax, eax
jne 0x482c17
mov dword [ebp - 0xd54], eax
xor edi, edi
lea eax, [ebp - 0x21c]
push eax
push ebx
call fcn.004a7eca
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x482a7b
lea eax, [ebp - 0xd54]
push eax
push str.tray_menu
push ebx
call fcn.004a7ed6
add esp, 0xc
test al, al
jne 0x482959
mov eax, 1
mov dword [ebp - 0xd54], eax
jmp 0x482967
call dword [0x4c59b0]
mov eax, dword [ebp - 0xd54]
test eax, eax
je 0x482a4b
cmp dword [ebp - 0xd7c], edi
jne 0x4829a2
lea eax, [ebp - 0xd84]
xor esi, esi
push eax
push 0x4de980
push ebx
mov dword [ebp - 0xd84], esi
call fcn.004a7ed6
add esp, 0xc
test al, al
cmovne esi, dword [ebp - 0xd84]
xor eax, eax
test esi, esi
setne al
mov dword [ebp - 0xd54], eax
test eax, eax
je 0x482a4b
cmp dword [ebp - 0xd4c], edi
je 0x482a4b
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x6ac]
push eax
call fcn.0047f600
mov ecx, dword [ebp - 0x69c]
add esp, 8
mov esi, dword [ebp - 0x698]
mov edx, dword [ebp - 0x6ac]
test ecx, ecx
je 0x482a17
cmp esi, 8
mov dword [ebp - 0xd54], edi
lea eax, [ebp - 0x6ac]
cmovae eax, edx
add ecx, ecx
je 0x482a17
nop dword [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x482a00
mov esi, dword [ebp - 0x698]
mov edx, dword [ebp - 0x6ac]
cmp esi, 8
jb 0x482a4b
lea esi, [esi*2 + 2]
mov eax, edx
cmp esi, 0x1000
jb 0x482a41
mov edx, dword [edx - 4]
add esi, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x482953
push esi
push edx
call fcn.004aebf7
add esp, 8
lea eax, [ebp - 0xd9c]
mov dword [ebp - 0xd9c], edi
push eax
push str.single_user_mode
push ebx
call fcn.004a7ed6
test al, al
push ebx
cmovne edi, dword [ebp - 0xd9c]
call fcn.004a7ed0
mov esi, dword [ebp - 0xd60]
add esp, 0x10
xor eax, eax
mov dword [ebp - 0x660], 0
mov dword [ebp - 0x65c], 7
mov word [ebp - 0x670], ax
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0x670]
call fcn.00410580
push 0x228
lea eax, [ebp - 0x8f8]
mov dword [ebp - 0x658], 1
push 0
push eax
call fcn.004b493e
lea eax, [ebp - 0x8f8]
push eax
call fcn.0042d450
lea eax, [ebp - 0x8f8]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [0x4c5ae4]
add esp, 0x18
mov dword [ebp - 0x650], edi
test eax, eax
je 0x482b0b
mov ebx, dword [ebp - 0xd58]
xor eax, eax
mov dword [ebp - 0x654], eax
jmp 0x482b49
cmp dword [ebp - 0x6f8], 2
je 0x482b24
mov ebx, dword [ebp - 0xd58]
xor eax, eax
mov dword [ebp - 0x654], eax
jmp 0x482b49
mov ebx, 1
mov dword [ebp - 0x654], 1
mov ecx, 0x541a8c
mov dword [ebp - 0xd58], ebx
call fcn.004836a0
mov eax, dword [ebp - 0x654]
cmp dword [ebp - 0xd54], 0
mov edi, dword [ebp - 0xd4c]
je 0x482bf7
test eax, eax
je 0x482b73
test edi, edi
je 0x482b73
mov dword [ebp - 0xd54], 0
jmp 0x482bf7
test byte [0x50f810], 2
je 0x482ba5
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x634]
push eax
push 0x4e41e8
push str.__debug
push 0x1cc
push 0
push 0
call fcn.00421090
add esp, 0x1c
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x634]
push eax
call dword [0x4c5ae4]
add esp, 8
test eax, eax
jne 0x482be6
mov eax, dword [0x541a8c]
lea ecx, [ebp - 0x670]
push ecx
push eax
mov dword [ebp - 0xdac], eax
mov ecx, 0x541a8c
lea eax, [ebp - 0xdb0]
push eax
call fcn.00483940
jmp 0x482bf7
lea eax, [ebp - 0x670]
mov ecx, 0x541a8c
push eax
call fcn.00483a90
lea ecx, [ebp - 0x670]
mov dword [ebp - 4], 0xffffffff
call fcn.00413170
inc esi
test ebx, ebx
mov ebx, dword [ebp - 0xd64]
jmp 0x4828d7
push ebx
call fcn.004a7ed0
add esp, 4
cmp dword [ebp - 0xd70], 0
je 0x482ce4
cmp dword [ebp - 0xd58], 0
jne 0x482ce4
mov ecx, 0x541a8c
call fcn.004836a0
test edi, edi
jne 0x482ce4
xor eax, eax
mov dword [ebp - 0x6c0], edi
mov dword [ebp - 0x6bc], 7
mov word [ebp - 0x6d0], ax
lea ecx, [ebp - 0xd78]
mov dword [ebp - 4], 2
call dword [0x4c5d94]
push 0xa5
lea ecx, [ebp - 0xd78]
mov byte [ebp - 4], 3
call dword [0x4c5fac]
push dword [ebp - 0xd78]
lea ecx, [ebp - 0x6d0]
call fcn.00410580
lea eax, [ebp - 0x6d0]
mov dword [ebp - 0x6b8], 1
push eax
mov ecx, 0x541a8c
mov dword [ebp - 0x6b4], 1
mov dword [ebp - 0x6b0], 1
call fcn.00483a90
lea ecx, [ebp - 0xd78]
call dword [0x4c5d9c]
lea ecx, [ebp - 0x6d0]
call fcn.00413170
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ae9c0
mov esp, ebp
pop ebp
ret