Function at 0x409ac0
Capabilities:
Create thread
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb4
mov eax, dword [0x413034]
xor eax, esp
mov dword [esp + 0xb0], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
push str._Starting_Ping_Watchdog
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], esi
call fcn.00409370
xor edi, edi
add esp, 4
cmp esi, edi
jne 0x409b27
push str.CPinglWatchdog::StartWatchdog_Error:_Could_not_start_Ping_Watchdog.__NULL_IP_Address_passed_to_method
call fcn.00409370
add esp, 4
mov eax, 0x80004005
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb0]
xor ecx, esp
call fcn.0040be38
mov esp, ebp
pop ebp
ret 8
push str.SOFTWARETeradyneIG_XLDSPPingWatchdog
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [esp + 0x2c]
push eax
mov eax, 0x20019
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
call fcn.00407b80
mov esi, dword [esp + 0x24]
test eax, eax
jne 0x409c84
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
push edi
push str.TimeBetweenPingsMS
mov dword [esp + 0x24], edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, 4
push esi
mov dword [esp + 0x30], ebx
call edi
test eax, eax
jne 0x409ba5
cmp dword [esp + 0x14], ebx
jne 0x409ba5
push str.Ping_interval_overridden_by_TimeBetweenPingsMS_under_HKLMSOFTWARETeradyneIG_XLDSPPingWatchdog
call fcn.00409370
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
add esp, 4
mov dword [edx + 0x40], ecx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
push 0
push str.TimeBetweenPingFailuresMS
push esi
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], ebx
call edi
test eax, eax
jne 0x409bec
cmp dword [esp + 0x18], ebx
jne 0x409bec
push str.Ping_interval_overridden_by_TimeBetweenPingFailuresMS_under_HKLMSOFTWARETeradyneIG_XLDSPPingWatchdog
call fcn.00409370
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
add esp, 4
mov dword [ecx + 0x44], eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0
push str.PingResponseDurationMS
push esi
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], ebx
call edi
test eax, eax
jne 0x409c33
cmp dword [esp + 0x18], ebx
jne 0x409c33
push str.Ping_interval_overridden_by_PingResponseDurationMS_under_HKLMSOFTWARETeradyneIG_XLDSPPingWatchdog
call fcn.00409370
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
add esp, 4
mov dword [eax + 0x48], edx
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x20]
push eax
push 0
push str.MaxConsecutiveDroppedPings
push esi
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], ebx
call edi
test eax, eax
jne 0x409c7e
cmp dword [esp + 0x18], ebx
jne 0x409c7e
push str.Ping_interval_overridden_by_MaxConsecutiveDroppedPings_under_HKLMSOFTWARETeradyneIG_XLDSPPingWatchdog
call fcn.00409370
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
add esp, 4
mov dword [edx + 0x4c], ecx
mov ebx, edx
jmp 0x409c82
mov ebx, dword [esp + 0x1c]
xor edi, edi
mov eax, dword [ebx + 0x40]
push eax
push str.Ping_interval:__d_ms
call fcn.00409370
mov edx, dword [esp + 0x28]
add esp, 8
push 3
lea ecx, [esp + 0x38]
push edx
lea eax, [esp + 0x38]
mov dword [esp + 0x38], ecx
call fcn.0040a200
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebx + 0x3c], eax
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x34]
cmp eax, ecx
je 0x409cd1
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebx + 0x28], eax
cmp eax, edi
jne 0x409d17
push str.CPinglWatchdog::StartWatchdog_Error:_Could_not_start_Ping_Watchdog.__CreateEvent_failed
call fcn.00409370
add esp, 4
cmp esi, edi
je 0x409cfb
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80004005
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb0]
xor ecx, esp
call fcn.0040be38
mov esp, ebp
pop ebp
ret 8
push edi
push edi
push ebx
push 0x409dd0
push edi
push edi
call dword [sym.imp.MSVCR100.dll__beginthreadex]
add esp, 0x18
mov dword [ebx + 0x24], eax
cmp eax, edi
jne 0x409d38
push str.CPinglWatchdog::StartWatchdog_Error:_Could_not_start_Ping_Watchdog.___beginthreadex_failed
jmp 0x409ce8
cmp esi, edi
je 0x409d43
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0xbc]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0040be38
mov esp, ebp
pop ebp
ret 8