Function at 0x140009960
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push r15
mov rcx, 0xffffffff80000002
mov r9d, 0x20119
xor r8d, r8d
push r14
lea rdx, str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x488
mov rbp, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
call rbp
mov esi, eax
mov ecx, eax
test eax, eax
jne 0x140009a4d
mov dword [rsp + 0x5c], 0x100
mov r15, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov r12, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x140009a01
lea rax, [rsp + 0x70]
xor r8d, r8d
mov rcx, qword [rsp + 0x68]
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
call rbp
test eax, eax
je 0x140009a52
or r13, 0xffffffffffffffff
mov rcx, qword [rsp + 0x70]
call rdi
mov dword [rsp + 0x5c], 0x100
cmp r13, 0xffffffffffffffff
jne 0x140009d13
inc esi
xor eax, eax
mov rcx, qword [rsp + 0x68]
lea r9, [rsp + 0x5c]
mov edx, esi
lea rbx, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov r8, rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call r15
mov rdi, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, 0x103
mov ecx, eax
je 0x140009d0f
test ecx, ecx
je 0x1400099c1
call fcn.14000a780
lea rax, [rsp + 0x60]
lea r14, [rsp + 0x64]
xor r8d, r8d
mov rcx, qword [rsp + 0x70]
lea rbx, [rsp + 0x180]
mov dword [rsp + 0x64], 0x100
mov r9, rax
lea rdx, str.ComponentId
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rbx
call r12
test eax, eax
jne 0x1400099e2
cmp dword [rsp + 0x60], 1
jne 0x1400099e2
lea rdx, str.tap0801
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x140009ae0
lea rdx, str.tap0901
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x140009ae0
lea rdx, str.TEAMVIEWERVPN
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x1400099e2
mov rcx, rbx
call fcn.14000ead0
xor r8d, r8d
mov qword [rsp + 0x28], r14
mov r9, qword [rsp + 0x48]
mov qword [0x14000f0c0], rax
mov rcx, qword [rsp + 0x70]
lea rdx, str.NetCfgInstanceId
mov dword [rsp + 0x64], 0x100
mov qword [rsp + 0x20], rbx
call r12
test eax, eax
je 0x140009b2d
mov rcx, qword [0x14000f0c0]
call sub.msvcrt.dll_free
jmp 0x1400099e2
cmp dword [rsp + 0x60], 1
jne 0x140009b1c
lea rax, [rsp + 0x280]
mov r8d, 0x100
lea rdx, str.SYSTEMCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318_
mov r13d, 0xff
mov rcx, rax
mov qword [rsp + 0x40], rax
call sub.msvcrt.dll_strncpy
mov rcx, qword [rsp + 0x40]
call sub.msvcrt.dll_strlen
mov rcx, qword [rsp + 0x40]
mov r8, r13
mov rdx, rbx
sub r8, rax
call sub.msvcrt.dll_strncat
mov rcx, qword [rsp + 0x40]
call sub.msvcrt.dll_strlen
mov rcx, qword [rsp + 0x40]
mov r8, r13
lea rdx, str.Connection
sub r8, rax
or r13, 0xffffffffffffffff
call sub.msvcrt.dll_strncat
lea rax, [rsp + 0x78]
mov rdx, qword [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
mov rcx, 0xffffffff80000002
call rbp
test eax, eax
jne 0x140009cf9
mov qword [rsp + 0x28], r14
lea r14, [rsp + 0x380]
xor r8d, r8d
mov r9, qword [rsp + 0x48]
mov dword [rsp + 0x64], 0x100
mov rcx, qword [rsp + 0x78]
lea rdx, str.Name
mov qword [rsp + 0x20], r14
call r12
test eax, eax
je 0x140009c05
or r13, 0xffffffffffffffff
jmp 0x140009cf9
cmp dword [rsp + 0x60], 1
jne 0x140009bfc
mov r13, qword [0x14000ff40]
lea rdx, [0x1400121ff]
mov rcx, r13
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140009cda
mov rcx, r14
mov r13d, 0xff
call fcn.14000ead0
mov r8d, 0x100
lea rdx, str..Global_
mov rcx, r14
mov qword [0x14000f0b0], rax
call sub.msvcrt.dll_strncpy
mov rcx, r14
call sub.msvcrt.dll_strlen
mov r8, r13
mov rdx, rbx
mov rcx, r14
sub r8, rax
call sub.msvcrt.dll_strncat
mov rcx, r14
call sub.msvcrt.dll_strlen
mov rcx, qword [0x14000f0c0]
lea rdx, str.TEAMVIEWERVPN
sub r13, rax
call sub.msvcrt.dll_strcmp
lea rdx, str..tap
mov r8, r13
mov rcx, r14
test eax, eax
lea rax, str..dgt
cmove rdx, rax
call sub.msvcrt.dll_strncat
xor edx, edx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rdx
mov rcx, r14
mov edx, 0xc0000000
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r13, rax
jmp 0x140009cf9
mov r8d, 0x100
mov rdx, r14
mov rcx, r13
call qword [sym.imp.msvcrt.dll__strnicmp]
test eax, eax
je 0x140009c2a
jmp 0x140009bfc
mov rcx, qword [rsp + 0x78]
call rdi
cmp r13, 0xffffffffffffffff
jne 0x1400099e6
jmp 0x140009b1c
or r13, 0xffffffffffffffff
mov rcx, qword [rsp + 0x68]
call rdi
cmp r13, 0xffffffffffffffff
jne 0x140009d79
lea rcx, str.Fatal:_No_compatible_VPN_adapter
call fcn.14000ce50
mov rbx, qword [0x14000ff40]
lea rdx, [0x1400121ff]
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140009d54
lea rcx, [0x14001222e]
call fcn.14000ce50
jmp 0x140009d63
mov rdx, rbx
lea rcx, str._with_name___s_
call fcn.14000ce50
lea rcx, str._available_for_use_n
call fcn.14000ce50
mov ecx, 0x10df
call sub.msvcrt.dll_exit
add rsp, 0x488
mov rax, r13
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret