Function at 0x407600
Capabilities:
Encrypt data using dpapi
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x309c
call fcn.00415110
mov eax, dword [0x426004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor eax, eax
push edi
mov ebx, edx
mov dword [ebp - 0x3064], eax
mov dword [ebp - 0x3044], eax
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::__s_
mov eax, 0x40000
mov dword [ebp - 0x307c], edi
mov dword [ebp - 0x3054], ebx
call fcn.0040b690
add esp, 0xc
mov esi, ebx
call fcn.004074a0
lea eax, [ebx + 0x2c90]
mov dword [ebp - 0x3050], eax
test edi, edi
je 0x40766a
push edi
jmp 0x40766f
push str.DEFAULT
push 0x200
push eax
call fcn.0040f44c
add esp, 0xc
lea eax, [ebp - 0x304c]
push eax
push 0x20019
push 0
push str.SOFTWARESecureW2MethodsDefaultProfiles
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x407838
lea ecx, [ebp - 0x3098]
push ecx
push eax
lea edx, [ebp - 0x3048]
push edx
push eax
mov dword [ebp - 0x3098], eax
mov eax, dword [ebp - 0x304c]
push str.DataBlob
push eax
call esi
test eax, eax
jne 0x407825
push str.SW2_TRACE_LEVEL_DEBUG
push str.__23s::SW2_ReadProfile__::ConfigLockdown
mov eax, 0x80000
call fcn.0040b690
mov ecx, dword [ebp - 0x304c]
push ecx
lea edi, [ebp - 0x3060]
lea eax, [ebp - 0x3088]
mov ebx, str.DataBlob
call fcn.0040c4e0
add esp, 0xc
test eax, eax
jne 0x40781f
mov edx, dword [ebp - 0x3060]
mov eax, dword [ebp - 0x3088]
lea ecx, [ebp - 0x3078]
push ecx
push 5
xor ebx, ebx
push ebx
push ebx
mov dword [ebp - 0x3084], edx
lea edx, [ebp - 0x305c]
mov dword [ebp - 0x3080], eax
push edx
lea eax, [ebp - 0x306c]
push eax
lea ecx, [ebp - 0x3084]
push ecx
mov dword [ebp - 0x3078], ebx
mov dword [ebp - 0x3074], ebx
mov dword [ebp - 0x3058], str.534543555245573252554c455a544845574f524c44574954484f55544245494e474556494c
mov dword [ebp - 0x305c], 0x4b
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x4077d4
mov edx, dword [ebp - 0x3078]
push edx
lea esi, [ebp - 0x3070]
call fcn.0040bae0
mov edi, eax
add esp, 4
cmp edi, ebx
jne 0x4077b4
mov eax, dword [ebp - 0x3078]
mov ecx, dword [ebp - 0x3074]
mov edx, dword [ebp - 0x3070]
push eax
push ecx
push eax
push edx
mov dword [ebp - 0x3068], eax
call fcn.0040f557
add esp, 0x10
mov eax, dword [ebp - 0x306c]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
push eax
call esi
mov ecx, dword [ebp - 0x3074]
push ecx
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x4077d9
mov edi, 0x1771
lea eax, [ebp - 0x3088]
call fcn.0040bb70
cmp edi, ebx
jne 0x40781f
cmp dword [ebp - 0x3068], 0x528c
jne 0x407814
mov edx, dword [ebp - 0x3070]
mov eax, dword [ebp - 0x3054]
push 0x528c
push edx
push 0x528c
push eax
call fcn.0040f557
add esp, 0x10
lea eax, [ebp - 0x3070]
call fcn.0040bb70
mov ebx, dword [ebp - 0x3054]
mov ecx, dword [ebp - 0x304c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x307c]
cmp dword [ebx + 0x2c68], 0
jne 0x408a61
test edi, edi
je 0x40786a
push edi
push str.SOFTWARESecureW2MethodsDefaultProfiles
push str._s_s
lea edx, [ebp - 0x418]
push 0x208
push edx
call fcn.0040f5cc
add esp, 0x14
jmp 0x407888
push str.SOFTWARESecureW2MethodsDefaultProfiles
push str._sDEFAULT
lea eax, [ebp - 0x418]
push 0x208
push eax
call fcn.0040f5cc
add esp, 0x10
push 0x3e8
lea eax, [ebx + 0x2e94]
push 0
push eax
call fcn.00410110
add esp, 0xc
lea ecx, [ebp - 0x304c]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x418]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x408a4c
mov edx, dword [ebp - 0x304c]
mov dword [ebx], eax
lea eax, [ebp - 0x3044]
push eax
push ebx
lea ecx, [ebp - 0x3048]
push ecx
push edi
push str.Version
push edx
mov dword [ebp - 0x3044], 4
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
mov eax, dword [ebx]
push eax
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_Version__d
mov eax, 0x40000
call fcn.0040b690
mov ecx, dword [ebx + 0x2c3c]
add esp, 0xc
push ecx
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_PromptUser__d
mov eax, 0x40000
call fcn.0040b690
mov ecx, dword [ebp - 0x304c]
add esp, 0xc
lea edx, [ebp - 0x3044]
push edx
lea eax, [ebx + 0x608]
push eax
lea eax, [ebp - 0x3048]
push eax
push edi
push str.DisableSaveUserCredentials
push ecx
mov dword [ebp - 0x3044], 4
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
mov edx, dword [ebx + 0x608]
push edx
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_DisableSaveUserCredentials__d
mov eax, 0x40000
call fcn.0040b690
add esp, 0xc
lea ecx, [ebp - 0x3044]
push ecx
lea eax, [ebx + 0x60c]
push eax
mov eax, dword [ebp - 0x304c]
lea edx, [ebp - 0x3048]
push edx
push edi
push str.AlwaysSaveUserCredentials
push eax
mov dword [ebp - 0x3044], 4
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
mov ecx, dword [ebx + 0x60c]
push ecx
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_AlwaysSaveUserCredentials__d
mov eax, 0x40000
call fcn.0040b690
mov ecx, dword [ebp - 0x304c]
add esp, 0xc
lea edx, [ebp - 0x3044]
push edx
lea eax, [ebx + 0x610]
push eax
lea eax, [ebp - 0x3048]
push eax
push edi
push str.HideDomain
push ecx
mov dword [ebp - 0x3044], 4
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
mov edx, dword [ebx + 0x610]
push edx
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_HideDomain__d
mov eax, 0x40000
call fcn.0040b690
add esp, 0xc
lea ecx, [ebp - 0x3044]
push ecx
lea eax, [ebx + 0x614]
push eax
mov eax, dword [ebp - 0x304c]
lea edx, [ebp - 0x3048]
push edx
push edi
push str.HideUnmask
push eax
mov dword [ebp - 0x3044], 4
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
mov ecx, dword [ebx + 0x614]
push ecx
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_HideUnmask__d
mov eax, 0x40000
call fcn.0040b690
mov ecx, dword [ebp - 0x304c]
add esp, 0xc
lea edx, [ebp - 0x3044]
push edx
lea eax, [ebx + 0x618]
push eax
lea eax, [ebp - 0x3048]
push eax
push edi
push str.AltUsernameStr
push ecx
mov dword [ebp - 0x3044], 0x200
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
lea eax, [ebx + 0x618]
push eax
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_AltUsernameStr__s
mov eax, 0x40000
call fcn.0040b690
mov ecx, dword [ebp - 0x304c]
add esp, 0xc
lea edx, [ebp - 0x3044]
push edx
lea eax, [ebx + 0x818]
push eax
lea eax, [ebp - 0x3048]
push eax
push edi
push str.AltPasswordStr
push ecx
mov dword [ebp - 0x3044], 0x200
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
lea eax, [ebx + 0x818]
push eax
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_AltPasswordStr__s
mov eax, 0x40000
call fcn.0040b690
mov ecx, dword [ebp - 0x304c]
add esp, 0xc
lea edx, [ebp - 0x3044]
push edx
lea eax, [ebx + 0xa18]
push eax
lea eax, [ebp - 0x3048]
push eax
push edi
push str.AltPassword2Str
push ecx
mov dword [ebp - 0x3044], 0x200
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
lea eax, [ebx + 0xa18]
push eax
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_AltPassword2Str__s
mov eax, 0x40000
call fcn.0040b690
mov ecx, dword [ebp - 0x304c]
add esp, 0xc
lea edx, [ebp - 0x3044]
push edx
lea eax, [ebx + 0xc18]
push eax
lea eax, [ebp - 0x3048]
push eax
push edi
push str.AltRePasswordStr
push ecx
mov dword [ebp - 0x3044], 0x200
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
lea eax, [ebx + 0xc18]
push eax
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_AltRePasswordStr__s
mov eax, 0x40000
call fcn.0040b690
mov ecx, dword [ebp - 0x304c]
add esp, 0xc
lea edx, [ebp - 0x3044]
push edx
lea eax, [ebx + 0xe18]
push eax
lea eax, [ebp - 0x3048]
push eax
push edi
push str.AltDomainStr
push ecx
mov dword [ebp - 0x3044], 0x200
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
lea eax, [ebx + 0xe18]
push eax
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_AltDomainStr__s
mov eax, 0x40000
call fcn.0040b690
mov ecx, dword [ebp - 0x304c]
add esp, 0xc
lea edx, [ebp - 0x3044]
push edx
lea eax, [ebx + 0x1018]
push eax
lea eax, [ebp - 0x3048]
push eax
push edi
push str.AltCredsTitle
push ecx
mov dword [ebp - 0x3044], 0x200
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
lea eax, [ebx + 0x1018]
push eax
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_pwcAltCredsTitle__s
mov eax, 0x40000
call fcn.0040b690
mov ecx, dword [ebp - 0x304c]
add esp, 0xc
lea edx, [ebp - 0x3044]
push edx
lea eax, [ebx + 0x1218]
push eax
lea eax, [ebp - 0x3048]
push eax
push edi
push str.AltResponseTitle
push ecx
mov dword [ebp - 0x3044], 0x200
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
lea eax, [ebx + 0x1218]
push eax
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_AltResponseTitle__s
mov eax, 0x40000
call fcn.0040b690
mov ecx, dword [ebp - 0x304c]
add esp, 0xc
lea edx, [ebp - 0x3044]
push edx
lea eax, [ebx + 0x261c]
push eax
lea eax, [ebp - 0x3048]
push eax
push edi
push str.UseAlternateOuterIdentity
push ecx
mov dword [ebp - 0x3044], 4
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
mov edx, dword [ebx + 0x261c]
push edx
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_UseAlternateOuterIdentity__d
mov eax, 0x40000
call fcn.0040b690
add esp, 0xc
lea ecx, [ebp - 0x3044]
push ecx
lea eax, [ebx + 0x2620]
push eax
mov eax, dword [ebp - 0x304c]
lea edx, [ebp - 0x3048]
push edx
push edi
push str.UseAnonymousOuterIdentity
push eax
mov dword [ebp - 0x3044], 4
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
mov ecx, dword [ebx + 0x2620]
push ecx
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_UseAnonymousOuterIdentity__d
mov eax, 0x40000
call fcn.0040b690
mov ecx, dword [ebp - 0x304c]
add esp, 0xc
lea edx, [ebp - 0x3044]
push edx
lea eax, [ebx + 0x2628]
push eax
lea eax, [ebp - 0x3048]
push eax
push edi
push str.AlternateOuterIdentity
push ecx
mov dword [ebp - 0x3044], 0x200
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
lea eax, [ebx + 0x2628]
push eax
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_AlternateOuterIdentity__s
mov eax, 0x40000
call fcn.0040b690
mov ecx, dword [ebp - 0x304c]
add esp, 0xc
lea edx, [ebp - 0x3044]
push edx
lea eax, [ebx + 0x2c44]
push eax
lea eax, [ebp - 0x3048]
push eax
push edi
push str.UseSessionResumption
push ecx
mov dword [ebp - 0x3044], 4
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
mov edx, dword [ebx + 0x2c44]
push edx
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_UseSessionResumption__d
mov eax, 0x40000
call fcn.0040b690
add esp, 0xc
lea ecx, [ebp - 0x3044]
push ecx
lea eax, [ebx + 0x2828]
push eax
mov eax, dword [ebp - 0x304c]
lea edx, [ebp - 0x3048]
push edx
push edi
push str.VerifyServerCertificate
push eax
mov dword [ebp - 0x3044], 4
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
mov ecx, dword [ebx + 0x2828]
push ecx
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_VerifyServerCertificate__d
mov eax, 0x40000
call fcn.0040b690
mov ecx, dword [ebp - 0x304c]
add esp, 0xc
lea edx, [ebp - 0x3044]
push edx
lea eax, [ebx + 0x282c]
push eax
lea eax, [ebp - 0x3048]
push eax
push edi
push str.VerifyServerName
push ecx
mov dword [ebp - 0x3044], 4
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
mov edx, dword [ebx + 0x282c]
push edx
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_VerifyServerName__d
mov eax, 0x40000
call fcn.0040b690
add esp, 0xc
lea ecx, [ebp - 0x3044]
push ecx
lea eax, [ebx + 0x2834]
push eax
mov eax, dword [ebp - 0x304c]
lea edx, [ebp - 0x3048]
push edx
push edi
push str.ServerName
push eax
mov dword [ebp - 0x3044], 0x200
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
lea eax, [ebx + 0x2834]
push eax
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_ServerName__s
mov eax, 0x40000
call fcn.0040b690
add esp, 0xc
lea ecx, [ebp - 0x3044]
push ecx
lea eax, [ebx + 0x241c]
push eax
mov eax, dword [ebp - 0x304c]
lea edx, [ebp - 0x3048]
push edx
push edi
push str.InnerAuth
push eax
mov dword [ebp - 0x3044], 0x200
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
lea eax, [ebx + 0x241c]
push eax
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_InnerAuth__s
mov eax, 0x40000
call fcn.0040b690
add esp, 0xc
lea ecx, [ebp - 0x3044]
push ecx
lea eax, [ebx + 0x2c80]
push eax
mov eax, dword [ebp - 0x304c]
lea edx, [ebp - 0x3048]
push edx
push edi
push str.CurrentInnerEapMethod
push eax
mov dword [ebp - 0x3044], 1
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
movzx ecx, byte [ebx + 0x2c80]
push ecx
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_InnerEapType__ld
mov eax, 0x40000
call fcn.0040b690
mov ecx, dword [ebp - 0x304c]
add esp, 0xc
lea edx, [ebp - 0x3044]
push edx
lea eax, [ebx + 0x2c8c]
push eax
lea eax, [ebp - 0x3048]
push eax
push edi
push str.InnerEapAuthorId
push ecx
mov dword [ebp - 0x3044], 4
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
mov edx, dword [ebx + 0x2c8c]
push edx
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_InnerEapAuthorId__ld
mov eax, 0x40000
call fcn.0040b690
mov edx, dword [ebx + 0x2c84]
push ecx
mov ecx, dword [ebx + 0x2c80]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebx + 0x2c88]
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x2c8c]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x307c]
push eax
lea edx, [ebp - 0x3040]
mov ecx, ebx
call fcn.0040a720
add esp, 0x14
test eax, eax
jne 0x4080bd
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::using_pre_configured_ConnectionData_for_Inner_EAP
mov eax, 0x40000
call fcn.0040b690
mov eax, dword [ebp - 0x103c]
push eax
lea ecx, [ebp - 0x303c]
push ecx
lea edx, [ebx + 0x3288]
push 0x2000
push edx
mov dword [ebx + 0x5288], eax
call fcn.0040f557
add esp, 0x18
lea ecx, [ebp - 0x3044]
push ecx
lea eax, [ebx + 0x2c40]
push eax
mov eax, dword [ebp - 0x304c]
lea edx, [ebp - 0x3048]
push edx
push 0
push str.UseUserCredentialsForComputer
push eax
mov dword [ebp - 0x3044], 4
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
mov ecx, dword [ebx + 0x2c40]
push ecx
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_UseUserCredentialsForComputer__d
mov eax, 0x40000
call fcn.0040b690
mov ecx, dword [ebp - 0x304c]
add esp, 0xc
lea edx, [ebp - 0x3044]
push edx
lea eax, [ebx + 0x1e18]
push eax
lea eax, [ebp - 0x3048]
push eax
push edi
push str.UseAlternateComputerCred
push ecx
mov dword [ebp - 0x3044], 4
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
mov edx, dword [ebx + 0x1e18]
push edx
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_UseAlternateComputerCred__d
mov eax, 0x40000
call fcn.0040b690
add esp, 0xc
lea ecx, [ebp - 0x3044]
push ecx
lea eax, [ebx + 0x2830]
push eax
mov eax, dword [ebp - 0x304c]
lea edx, [ebp - 0x3048]
push edx
push edi
push str.ServerCertificateLocal
push eax
mov dword [ebp - 0x3044], 4
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
mov ecx, dword [ebx + 0x2830]
push ecx
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_ServerCertificateLocal__d
mov eax, 0x40000
call fcn.0040b690
mov ecx, dword [ebp - 0x304c]
add esp, 0xc
lea edx, [ebp - 0x3044]
push edx
lea eax, [ebx + 0x2c50]
push eax
lea eax, [ebp - 0x3048]
push eax
push edi
push str.CheckForMicrosoftExtension
push ecx
mov dword [ebp - 0x3044], 4
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
mov edx, dword [ebx + 0x2c50]
push edx
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_VerifyMSExtension__d
mov eax, 0x40000
call fcn.0040b690
add esp, 0xc
lea ecx, [ebp - 0x3044]
push ecx
lea eax, [ebx + 0x2624]
push eax
mov eax, dword [ebp - 0x304c]
lea edx, [ebp - 0x3048]
push edx
push edi
push str.UseEmptyOuterIdentity
push eax
mov dword [ebp - 0x3044], 4
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
mov ecx, dword [ebx + 0x2624]
push ecx
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_UseEmptyOuterIdentity__d
mov eax, 0x40000
call fcn.0040b690
mov ecx, dword [ebp - 0x304c]
add esp, 0xc
lea edx, [ebp - 0x3044]
push edx
lea eax, [ebx + 0x2c54]
push eax
lea eax, [ebp - 0x3048]
push eax
push edi
push str.AllowNewConnections
push ecx
mov dword [ebp - 0x3044], 4
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
mov edx, dword [ebx + 0x2c54]
push edx
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_AllowNewConnections__d
mov eax, 0x40000
call fcn.0040b690
add esp, 0xc
lea ecx, [ebp - 0x3044]
push ecx
lea eax, [ebx + 0x2c58]
push eax
mov eax, dword [ebp - 0x304c]
lea edx, [ebp - 0x3048]
push edx
push edi
push str.UseMicrosoftCachedUserData
push eax
mov dword [ebp - 0x3044], 4
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
mov ecx, dword [ebx + 0x2c58]
push ecx
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_UseMicrosoftCachedUserData__d
mov eax, 0x40000
call fcn.0040b690
mov ecx, dword [ebp - 0x304c]
add esp, 0xc
lea edx, [ebp - 0x3044]
push edx
lea eax, [ebx + 0x2c5c]
push eax
lea eax, [ebp - 0x3048]
push eax
push edi
push str.ForceSecureW2UserInterface
push ecx
mov dword [ebp - 0x3044], 4
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
mov edx, dword [ebx + 0x2c5c]
push edx
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_ForceSecureW2UserInterface__d
mov eax, 0x40000
call fcn.0040b690
add esp, 0xc
lea ecx, [ebp - 0x3044]
push ecx
lea eax, [ebx + 0x2c60]
push eax
mov eax, dword [ebp - 0x304c]
lea edx, [ebp - 0x3048]
push edx
push edi
push str.CheckForSoftwareToken
push eax
mov dword [ebp - 0x3044], 4
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
mov ecx, dword [ebx + 0x2c60]
push ecx
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_CheckForSoftwareToken__d
mov eax, 0x40000
call fcn.0040b690
mov ecx, dword [ebp - 0x304c]
add esp, 0xc
lea edx, [ebp - 0x3044]
push edx
lea eax, [ebx + 0x2c64]
push eax
lea eax, [ebp - 0x3048]
push eax
push edi
push str.BypassBalloonNotification
push ecx
mov dword [ebp - 0x3044], 4
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
mov edx, dword [ebx + 0x2c64]
push edx
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_BypassBalloonNotification__d
mov eax, 0x40000
call fcn.0040b690
add esp, 0xc
lea ecx, [ebp - 0x3044]
push ecx
lea eax, [ebx + 0x2c48]
push eax
mov eax, dword [ebp - 0x304c]
lea edx, [ebp - 0x3048]
push edx
push edi
push str.AllowNotifications
push eax
mov dword [ebp - 0x3044], 4
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
mov ecx, dword [ebx + 0x2c48]
push ecx
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_bAllowNotifications__d
mov eax, 0x40000
call fcn.0040b690
mov ecx, dword [ebp - 0x304c]
add esp, 0xc
lea edx, [ebp - 0x3044]
push edx
lea eax, [ebx + 0x327c]
push eax
lea eax, [ebp - 0x3048]
push eax
push edi
push str.InnerEapOptional
push ecx
mov dword [ebp - 0x3044], 4
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
mov edx, dword [ebx + 0x327c]
push edx
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_bInnerEapOptional__d
mov eax, 0x40000
call fcn.0040b690
add esp, 0xc
lea ecx, [ebp - 0x3044]
push ecx
lea eax, [ebx + 0x3280]
push eax
mov eax, dword [ebp - 0x304c]
lea edx, [ebp - 0x3048]
push edx
push edi
push str.EnableQuarantineChecks
push eax
mov dword [ebp - 0x3044], 4
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
mov ecx, dword [ebx + 0x3280]
push ecx
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_bEnableQuarantineChecks__d
mov eax, 0x40000
call fcn.0040b690
mov ecx, dword [ebp - 0x304c]
add esp, 0xc
lea edx, [ebp - 0x3044]
push edx
lea eax, [ebx + 0x3284]
push eax
lea eax, [ebp - 0x3048]
push eax
push edi
push str.RequireCryptoBinding
push ecx
mov dword [ebp - 0x3044], 4
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
mov edx, dword [ebx + 0x3284]
push edx
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_bRequireCryptoBinding__d
mov eax, 0x40000
call fcn.0040b690
add esp, 0xc
lea ecx, [ebp - 0x3044]
push ecx
lea eax, [ebx + 0x2c4c]
push eax
mov eax, dword [ebp - 0x304c]
lea edx, [ebp - 0x3048]
push edx
push edi
push str.RenewIP
push eax
mov dword [ebp - 0x3044], 4
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
mov ecx, dword [ebx + 0x2c4c]
push ecx
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_RenewIP__d
mov eax, 0x40000
call fcn.0040b690
mov eax, dword [ebp - 0x3050]
add esp, 0xc
lea edx, [ebp - 0x3044]
push edx
mov edx, dword [ebp - 0x304c]
push eax
lea ecx, [ebp - 0x3048]
push ecx
push edi
push str.CurrentProfileId
push edx
mov dword [ebp - 0x3044], 0x200
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
mov eax, dword [ebp - 0x3050]
push eax
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_CurrentProfileId__s
mov eax, 0x40000
call fcn.0040b690
add esp, 0xc
lea ecx, [ebp - 0x3044]
push ecx
lea eax, [ebx + 0x1618]
push eax
mov eax, dword [ebp - 0x304c]
lea edx, [ebp - 0x3048]
push edx
push edi
push str.ProfileDescription
push eax
mov dword [ebp - 0x3044], 0x200
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
lea eax, [ebx + 0x1618]
push eax
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_ProfileDescription__s
mov eax, 0x40000
call fcn.0040b690
add esp, 0xc
lea ecx, [ebp - 0x3044]
push ecx
lea eax, [ebx + 0x1818]
push eax
mov eax, dword [ebp - 0x304c]
lea edx, [ebp - 0x3048]
push edx
push edi
push str.ProfileDescription2
push eax
mov dword [ebp - 0x3044], 0x200
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
lea eax, [ebx + 0x1818]
push eax
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_ProfileDescription2__s
mov eax, 0x40000
call fcn.0040b690
add esp, 0xc
lea ecx, [ebp - 0x3044]
push ecx
lea eax, [ebx + 0x1a18]
push eax
mov eax, dword [ebp - 0x304c]
lea edx, [ebp - 0x3048]
push edx
push edi
push str.HelpURL
push eax
mov dword [ebp - 0x3044], 0x200
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
lea eax, [ebx + 0x1a18]
push eax
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_HelpURL__s
mov eax, 0x40000
call fcn.0040b690
add esp, 0xc
lea ecx, [ebp - 0x3044]
push ecx
lea eax, [ebx + 0x1c18]
push eax
mov eax, dword [ebp - 0x304c]
lea edx, [ebp - 0x3048]
push edx
push edi
push str.HelpCaption
push eax
mov dword [ebp - 0x3044], 0x200
call esi
mov edi, eax
test edi, edi
jne 0x408a4c
lea eax, [ebx + 0x1c18]
push eax
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_HelpCaption__s
mov eax, 0x40000
call fcn.0040b690
mov ecx, dword [ebp - 0x307c]
add esp, 0xc
mov edx, ebx
call fcn.00408fd0
mov edi, eax
test edi, edi
jne 0x408a4c
mov eax, dword [ebp - 0x307c]
test eax, eax
je 0x4087b8
push eax
push str.SOFTWARESecureW2MethodsDefaultProfiles
push str._s_sCredentials
lea ecx, [ebp - 0x418]
push 0x208
push ecx
call fcn.0040f5cc
add esp, 0x14
jmp 0x4087d6
push str.SOFTWARESecureW2MethodsDefaultProfiles
push str._sDEFAULTCredentials
lea edx, [ebp - 0x418]
push 0x208
push edx
call fcn.0040f5cc
add esp, 0x10
lea eax, [ebp - 0x418]
push eax
push str.SW2_TRACE_LEVEL_DEBUG
push str.__23s::SW2_ReadProfile__::opening_computer_registry_key:__s
mov eax, 0x80000
call fcn.0040b690
add esp, 0xc
lea ecx, [ebp - 0x308c]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x418]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
neg eax
sbb eax, eax
inc eax
je 0x408a2a
mov edx, dword [ebp - 0x308c]
lea eax, [ebp - 0x3044]
push eax
lea edi, [ebx + 0x1e1c]
push edi
lea ecx, [ebp - 0x3048]
push ecx
push 0
push str.CompName
push edx
mov dword [ebp - 0x3044], 0x200
call esi
test eax, eax
jne 0x408a1b
push edi
push str.SW2_TRACE_LEVEL_DEBUG
push str.__23s::SW2_ReadProfile__::CompName:__s
mov eax, 0x80000
call fcn.0040b690
mov eax, dword [ebp - 0x308c]
add esp, 0xc
push eax
lea edi, [ebp - 0x306c]
lea eax, [ebp - 0x3088]
mov ebx, str.CompPassword
call fcn.0040c4e0
mov edi, eax
add esp, 4
test edi, edi
jne 0x40896b
mov ecx, dword [ebp - 0x306c]
mov edx, dword [ebp - 0x3088]
lea eax, [ebp - 0x305c]
push eax
push 5
xor ebx, ebx
push ebx
push ebx
mov dword [ebp - 0x3094], ecx
lea ecx, [ebp - 0x3084]
mov dword [ebp - 0x3090], edx
push ecx
lea edx, [ebp - 0x3074]
push edx
lea eax, [ebp - 0x3094]
push eax
mov dword [ebp - 0x305c], ebx
mov dword [ebp - 0x3058], ebx
mov dword [ebp - 0x3080], str.534543555245573252554c455a544845574f524c44574954484f55544245494e474556494c
mov dword [ebp - 0x3084], 0x4b
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x40895b
mov ecx, dword [ebp - 0x305c]
push ecx
lea esi, [ebp - 0x3050]
call fcn.0040bae0
mov edi, eax
add esp, 4
cmp edi, ebx
jne 0x40893b
mov eax, dword [ebp - 0x305c]
mov edx, dword [ebp - 0x3058]
push eax
push edx
push eax
mov dword [ebp - 0x3060], eax
mov eax, dword [ebp - 0x3050]
push eax
call fcn.0040f557
add esp, 0x10
mov ecx, dword [ebp - 0x3074]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
push ecx
call esi
mov edx, dword [ebp - 0x3058]
push edx
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x408960
mov edi, 0x1771
lea eax, [ebp - 0x3088]
call fcn.0040bb70
mov ebx, edi
test edi, edi
jne 0x408a15
cmp dword [ebp - 0x3060], 0x200
jb 0x4089b5
mov edi, dword [ebp - 0x3054]
push 0x200
add edi, 0x201c
push ebx
push edi
call fcn.00410110
mov eax, dword [ebp - 0x3060]
mov ecx, dword [ebp - 0x3050]
add esp, 0xc
push eax
push ecx
push edi
call fcn.00410190
add esp, 0xc
jmp 0x4089ba
mov ebx, 8
lea eax, [ebp - 0x3050]
call fcn.0040bb70
test ebx, ebx
jne 0x408a15
mov edi, dword [ebp - 0x3054]
mov ecx, dword [ebp - 0x308c]
lea edx, [ebp - 0x3044]
push edx
add edi, 0x221c
push edi
lea eax, [ebp - 0x3048]
push eax
push ebx
push str.CompDomain
push ecx
mov dword [ebp - 0x3044], 0x200
call esi
push edi
push str.SW2_TRACE_LEVEL_DEBUG
push str.__23s::SW2_ReadProfile__::CompDomain:__s
mov eax, 0x80000
call fcn.0040b690
add esp, 0xc
mov ebx, dword [ebp - 0x3054]
mov edx, dword [ebp - 0x308c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x408a4a
push 0
lea eax, [ebp - 0x418]
push eax
push str.SW2_TRACE_LEVEL_WARNING
push str.__23s::SW2_ReadProfile__::could_not_open_key__HKEY_LOCAL_MACHINE_s_:__ld
mov eax, 0x20000
call fcn.0040b690
add esp, 0x10
xor edi, edi
mov ecx, dword [ebp - 0x304c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x408f9f
lea edx, [ebp - 0x3050]
push edx
call fcn.0040ca70
add esp, 4
test eax, eax
jne 0x408b1e
cmp dword [ebx + 0x2c68], eax
je 0x408a9f
mov eax, dword [ebp - 0x3050]
push str.SOFTWARESecureW2MethodsDefaultProfiles
push eax
push str._s_s
push 0x208
lea ecx, [ebp - 0x418]
push ecx
jmp 0x408b01
mov eax, dword [ebp - 0x307c]
test eax, eax
je 0x408ae4
mov edx, dword [ebp - 0x3050]
push eax
push str.SOFTWARESecureW2MethodsDefaultProfiles
push edx
push str._s_s_sCredentials
lea eax, [ebp - 0x418]
push 0x208
push eax
call fcn.0040f5cc
add esp, 0x18
lea eax, [ebp - 0x3050]
call fcn.0040bb70
mov eax, 0x80000003
jmp 0x408ba3
mov ecx, dword [ebp - 0x3050]
push str.SOFTWARESecureW2MethodsDefaultProfiles
push ecx
push str._s_sDEFAULTCredentials
push 0x208
lea edx, [ebp - 0x418]
push edx
call fcn.0040f5cc
add esp, 0x14
lea eax, [ebp - 0x3050]
call fcn.0040bb70
mov eax, 0x80000003
jmp 0x408ba3
push 0x410
lea eax, [ebp - 0x418]
push 0
push eax
call fcn.00410110
add esp, 0xc
cmp dword [ebx + 0x2c68], 0
je 0x408b55
push str.SOFTWARESecureW2MethodsDefaultProfiles
push 0x41dc0c
push 0x208
lea ecx, [ebp - 0x418]
push ecx
jmp 0x408b96
mov eax, dword [ebp - 0x307c]
test eax, eax
je 0x408b80
push eax
push str.SOFTWARESecureW2MethodsDefaultProfiles
push str._s_sCredentials
lea edx, [ebp - 0x418]
push 0x208
push edx
call fcn.0040f5cc
add esp, 0x14
jmp 0x408b9e
push str.SOFTWARESecureW2MethodsDefaultProfiles
push str._sDEFAULTCredentials
push 0x208
lea eax, [ebp - 0x418]
push eax
call fcn.0040f5cc
add esp, 0x10
mov eax, 0x80000001
lea ecx, [ebp - 0x3064]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x418]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408f9d
cmp dword [ebx + 0x2c68], eax
je 0x408d9f
mov edx, dword [ebp - 0x3064]
mov dword [ebp - 0x3098], eax
lea eax, [ebp - 0x3098]
push eax
push 0
lea ecx, [ebp - 0x3048]
push ecx
push 0
push str.DataBlob
push edx
call esi
test eax, eax
jne 0x408f90
push str.SW2_TRACE_LEVEL_DEBUG
push str.__23s::SW2_ReadProfile__::SW2_TRACE_LEVEL_DEBUG::SW2_ReadProfile:_ConfigLockdown
mov eax, 0x80000
call fcn.0040b690
mov eax, dword [ebp - 0x3064]
push eax
lea edi, [ebp - 0x3074]
lea eax, [ebp - 0x3060]
mov ebx, str.DataBlob
call fcn.0040c4e0
add esp, 0xc
test eax, eax
jne 0x408f90
mov ecx, dword [ebp - 0x3074]
mov edx, dword [ebp - 0x3060]
lea eax, [ebp - 0x305c]
push eax
push 1
xor ebx, ebx
push ebx
push ebx
mov dword [ebp - 0x3084], ecx
lea ecx, [ebp - 0x3094]
mov dword [ebp - 0x3080], edx
push ecx
lea edx, [ebp - 0x306c]
push edx
lea eax, [ebp - 0x3084]
push eax
mov dword [ebp - 0x305c], ebx
mov dword [ebp - 0x3058], ebx
mov dword [ebp - 0x3090], str.534543555245573252554c455a544845574f524c44574954484f55544245494e474556494c
mov dword [ebp - 0x3094], 0x4b
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x408cfa
mov ecx, dword [ebp - 0x305c]
push ecx
lea esi, [ebp - 0x3070]
call fcn.0040bae0
mov edi, eax
add esp, 4
cmp edi, ebx
jne 0x408ce0
mov eax, dword [ebp - 0x305c]
mov edx, dword [ebp - 0x3058]
push eax
push edx
push eax
mov dword [ebp - 0x3068], eax
mov eax, dword [ebp - 0x3070]
push eax
call fcn.0040f557
add esp, 0x10
mov ecx, dword [ebp - 0x306c]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
push ecx
call esi
mov edx, dword [ebp - 0x3058]
push edx
call esi
jmp 0x408cff
mov edi, 0x1771
lea eax, [ebp - 0x3060]
call fcn.0040bb70
cmp edi, ebx
jne 0x408f90
cmp dword [ebp - 0x3068], 0x604
jne 0x408d8f
mov esi, dword [ebp - 0x3070]
mov edi, dword [ebp - 0x3054]
push 4
push esi
lea eax, [edi + 0x2c3c]
push 4
push eax
call fcn.0040f557
push 0x200
lea ecx, [esi + 4]
push ecx
lea edx, [edi + 6]
push 0x200
push edx
call fcn.0040f557
push 0x200
lea eax, [esi + 0x204]
push eax
lea ecx, [edi + 0x206]
push 0x200
push ecx
call fcn.0040f557
push 0x200
add esi, 0x404
push esi
push 0x200
add edi, 0x406
push edi
call fcn.0040f557
add esp, 0x40
lea eax, [ebp - 0x3070]
call fcn.0040bb70
jmp 0x408f90
mov ecx, dword [ebp - 0x3064]
lea edx, [ebp - 0x3044]
push edx
lea edi, [ebx + 0x2c3c]
push edi
lea eax, [ebp - 0x3048]
push eax
push 0
push str.PromptUser
push ecx
mov dword [ebp - 0x3044], 1
call esi
mov edx, dword [edi]
push edx
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::read_PromptUser__d
mov eax, 0x40000
call fcn.0040b690
mov edx, dword [ebp - 0x3064]
add esp, 0xc
lea eax, [ebp - 0x3044]
push eax
add ebx, 6
push ebx
lea ecx, [ebp - 0x3048]
push ecx
push 0
push str.UserName
push edx
mov dword [ebp - 0x3044], 0x200
call esi
mov eax, dword [ebp - 0x3064]
push eax
lea edi, [ebp - 0x3074]
lea eax, [ebp - 0x3060]
mov ebx, str.UserPassword
call fcn.0040c4e0
add esp, 4
test eax, eax
jne 0x408f5b
mov ecx, dword [ebp - 0x3074]
mov edx, dword [ebp - 0x3060]
lea eax, [ebp - 0x305c]
push eax
push 1
xor ebx, ebx
push ebx
push ebx
mov dword [ebp - 0x3084], ecx
lea ecx, [ebp - 0x3094]
mov dword [ebp - 0x3080], edx
push ecx
lea edx, [ebp - 0x306c]
push edx
lea eax, [ebp - 0x3084]
push eax
mov dword [ebp - 0x305c], ebx
mov dword [ebp - 0x3058], ebx
mov dword [ebp - 0x3090], str.534543555245573252554c455a544845574f524c44574954484f55544245494e474556494c
mov dword [ebp - 0x3094], 0x4b
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x408f01
mov ecx, dword [ebp - 0x305c]
push ecx
lea esi, [ebp - 0x3068]
call fcn.0040bae0
mov edi, eax
add esp, 4
cmp edi, ebx
jne 0x408edb
mov ebx, dword [ebp - 0x305c]
mov edx, dword [ebp - 0x3058]
mov eax, dword [ebp - 0x3068]
push ebx
push edx
push ebx
push eax
call fcn.0040f557
add esp, 0x10
jmp 0x408ee1
mov ebx, dword [ebp - 0x3074]
mov ecx, dword [ebp - 0x306c]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
push ecx
call esi
mov edx, dword [ebp - 0x3058]
push edx
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x408f0c
mov ebx, dword [ebp - 0x3074]
mov edi, 0x1771
lea eax, [ebp - 0x3060]
call fcn.0040bb70
test edi, edi
jne 0x408f5b
cmp ebx, 0x200
jb 0x408f50
mov edi, dword [ebp - 0x3054]
push 0x200
add edi, 0x206
push 0
push edi
call fcn.00410110
mov eax, dword [ebp - 0x3068]
add esp, 0xc
push ebx
push eax
push edi
call fcn.00410190
add esp, 0xc
lea eax, [ebp - 0x3068]
call fcn.0040bb70
mov edx, dword [ebp - 0x3054]
lea ecx, [ebp - 0x3044]
push ecx
mov ecx, dword [ebp - 0x3064]
add edx, 0x406
push edx
lea eax, [ebp - 0x3048]
push eax
push 0
push str.UserDomain
push ecx
mov dword [ebp - 0x3044], 0x200
call esi
mov edx, dword [ebp - 0x3064]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
push edi
push str.SW2_TRACE_LEVEL_INFO
push str.__23s::SW2_ReadProfile__::returning__ld
mov eax, 0x40000
call fcn.0040b690
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040f43d
mov esp, ebp
pop ebp
ret