Function at 0x4049d4
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xd8
mov eax, 0x420b4d
call fcn.0040dd84
mov dword [ebp - 0xcc], ecx
xor ebx, ebx
mov byte [ebp - 0xb5], bl
mov byte [ebp - 0xb6], bl
mov byte [ebp - 0xb7], bl
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0xc4], eax
mov dword [ebp - 4], ebx
mov esi, 0x42ba9c
mov dword [ebp - 0xc8], esi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 1
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0xd0]
push eax
mov edi, 0x42ba8c
mov ecx, edi
call fcn.004040d9
mov eax, dword [eax]
cmp eax, dword [0x42ba90]
jne 0x404a6b
push ebx
lea eax, [ebp - 0xc4]
push eax
mov ecx, edi
call fcn.00403cae
push eax
lea eax, [ebp - 0xe4]
push eax
mov ecx, edi
call fcn.00403fbf
mov byte [ebp - 0xb7], 1
mov byte [ebp - 4], bl
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
or dword [ebp - 4], 0xffffffff
jmp 0x404a8c
cmp byte [ebp - 0xb7], bl
je 0x404ce5
mov dword [ebp - 4], 3
or dword [ebp - 4], 0xffffffff
jmp 0x404ab6
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xd0], ebx
lea eax, [ebp - 0xc0]
push eax
push 0x20019
push ebx
push str.SOFTWAREWildTangentDebugging
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x404c8c
push 4
pop edi
mov dword [ebp - 0xbc], edi
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0xd8]
push eax
push ebx
push str.ShowThrowContinueDialog
push dword [ebp - 0xc0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0xdc], ebx
je 0x404bf4
mov dword [ebp - 0xd4], 7
mov dword [ebp - 4], 5
mov ecx, dword [ebp - 0xcc]
mov eax, dword [ecx]
lea edx, [ebp - 0x30]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 8
jb 0x404b67
mov eax, dword [eax]
push eax
push str._n_s_n_n_n_n__Attempt_to_Continue___Use_Cancel_to_Debug._
lea eax, [ebp - 0x4c]
push eax
call fcn.00406420
add esp, 0xc
mov byte [ebp - 4], 7
cmp dword [eax + 0x14], 8
jb 0x404b85
mov eax, dword [eax]
push 0x33
push str.Exception_Thrown:
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0xd4], eax
mov byte [ebp - 4], 6
push ebx
push 1
lea ecx, [ebp - 0x4c]
call fcn.004014d0
mov byte [ebp - 4], 5
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.004014d0
or dword [ebp - 4], 0xffffffff
jmp 0x404bd2
cmp dword [ebp - 0xd4], 6
jne 0x404be4
mov byte [ebp - 0xb5], 1
jmp 0x404bf4
cmp dword [ebp - 0xd4], 2
jne 0x404bf4
mov byte [ebp - 0xb6], 1
mov dword [ebp - 0xbc], edi
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0xd8]
push eax
push ebx
push str.ForceBreak
push dword [ebp - 0xc0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xbc], edi
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0xd8]
push eax
push ebx
push 0x4224d4
push dword [ebp - 0xc0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0xd0], ebx
je 0x404c5d
mov byte [ebp - 0xb5], 1
cmp dword [ebp - 0xc8], ebx
je 0x404c6c
mov byte [ebp - 0xb6], 1
push dword [ebp - 0xc0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc0], ebx
cmp byte [ebp - 0xb6], bl
je 0x404c8c
call dword [sym.imp.KERNEL32.dll_DebugBreak]
mov dword [ebp - 4], 9
mov dword [ebp - 0xe0], esi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0xc4]
push eax
mov ecx, 0x42ba8c
call fcn.004045af
mov byte [ebp - 4], 9
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
or dword [ebp - 4], 0xffffffff
jmp 0x404cd2
mov ecx, dword [ebp - 0xcc]
call fcn.00404726
cmp byte [ebp - 0xb5], bl
jne 0x404d07
push dword [ebp - 0xcc]
lea ecx, [ebp - 0xb4]
call fcn.004044cb
push 0x427678
lea eax, [ebp - 0xb4]
push eax
call fcn.0040d398
call fcn.0040dde0
ret