Function at 0x40b585
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xd8
mov eax, 0x428ec9
call fcn.00413ef7
mov dword [ebp - 0xc4], ecx
xor ebx, ebx
mov byte [ebp - 0xb5], bl
mov byte [ebp - 0xb6], bl
mov byte [ebp - 0xb7], bl
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0xd4], eax
mov dword [ebp - 4], ebx
mov esi, 0x444468
mov dword [ebp - 0xd0], esi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 1
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0xcc]
push eax
mov edi, 0x444458
mov ecx, edi
call fcn.0040b0af
mov eax, dword [eax]
cmp eax, dword [0x44445c]
jne 0x40b61c
push ebx
lea eax, [ebp - 0xd4]
push eax
mov ecx, edi
call fcn.0040aca5
push eax
lea eax, [ebp - 0xe4]
push eax
mov ecx, edi
call fcn.0040af95
mov byte [ebp - 0xb7], 1
mov byte [ebp - 4], bl
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
or dword [ebp - 4], 0xffffffff
jmp 0x40b63d
cmp byte [ebp - 0xb7], bl
je 0x40b8a1
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0xc4]
call fcn.0040b508
or dword [ebp - 4], 0xffffffff
jmp 0x40b672
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 0xcc], ebx
lea eax, [ebp - 0xbc]
push eax
push 0x20019
push ebx
push str.SOFTWAREWildTangentDebugging
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x40b848
push 4
pop edi
mov dword [ebp - 0xc0], edi
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0xc8]
push eax
push ebx
push str.ShowThrowContinueDialog
push dword [ebp - 0xbc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0xdc], ebx
je 0x40b7b0
mov dword [ebp - 0xd8], 7
mov dword [ebp - 4], 5
mov ecx, dword [ebp - 0xc4]
mov eax, dword [ecx]
lea edx, [ebp - 0x30]
push edx
call dword [eax + 4]
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 8
jb 0x40b723
mov eax, dword [eax]
push eax
push str._n_s_n_n_n_n__Attempt_to_Continue___Use_Cancel_to_Debug._
lea eax, [ebp - 0x4c]
push eax
call fcn.0040992a
add esp, 0xc
mov byte [ebp - 4], 7
cmp dword [eax + 0x14], 8
jb 0x40b741
mov eax, dword [eax]
push 0x33
push str.Exception_Thrown:
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0xd8], eax
mov byte [ebp - 4], 6
push ebx
push 1
lea ecx, [ebp - 0x4c]
call fcn.004012a0
mov byte [ebp - 4], 5
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.004012a0
or dword [ebp - 4], 0xffffffff
jmp 0x40b78e
cmp dword [ebp - 0xd8], 6
jne 0x40b7a0
mov byte [ebp - 0xb5], 1
jmp 0x40b7b0
cmp dword [ebp - 0xd8], 2
jne 0x40b7b0
mov byte [ebp - 0xb6], 1
mov dword [ebp - 0xc0], edi
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0xc8]
push eax
push ebx
push str.ForceBreak
push dword [ebp - 0xbc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc0], edi
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0xc8]
push eax
push ebx
push 0x438114
push dword [ebp - 0xbc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0xcc], ebx
je 0x40b819
mov byte [ebp - 0xb5], 1
cmp dword [ebp - 0xd0], ebx
je 0x40b828
mov byte [ebp - 0xb6], 1
push dword [ebp - 0xbc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xbc], ebx
cmp byte [ebp - 0xb6], bl
je 0x40b848
call dword [sym.imp.KERNEL32.dll_DebugBreak]
mov dword [ebp - 4], 9
mov dword [ebp - 0xe0], esi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0xd4]
push eax
mov ecx, 0x444458
call fcn.0040b29e
mov byte [ebp - 4], 9
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
or dword [ebp - 4], 0xffffffff
jmp 0x40b88e
mov ecx, dword [ebp - 0xc4]
call fcn.0040b3f2
cmp byte [ebp - 0xb5], bl
jne 0x40b8c3
push dword [ebp - 0xc4]
lea ecx, [ebp - 0xb4]
call fcn.0040b1ba
push 0x43de98
lea eax, [ebp - 0xb4]
push eax
call fcn.00413452
call fcn.00413f53
ret