Function at 0x40e630
Capabilities:
Enumerate processes
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44208a
mov eax, dword fs:[0]
push eax
sub esp, 0x5fc
mov eax, dword [0x4511b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x4d4], 0
push 0x446b64
push str.HintClient.exe
lea ecx, [ebp - 0x4d0]
call fcn.0040ff20
mov dword [ebp - 0x604], eax
mov eax, dword [ebp - 0x604]
mov dword [ebp - 0x608], eax
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x608]
push ecx
lea edx, [ebp - 0x504]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x12c
call fcn.0040fee0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4d0]
call fcn.0040e5b0
push 0x446b50
push str.RichtechGameMenu.exe
lea ecx, [ebp - 0x600]
call fcn.0040ff20
mov dword [ebp - 0x604], eax
mov eax, dword [ebp - 0x604]
mov dword [ebp - 0x608], eax
mov dword [ebp - 4], 2
mov ecx, dword [ebp - 0x608]
push ecx
lea edx, [ebp - 0x4fc]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x12c
call fcn.0040fee0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x600]
call fcn.0040e5b0
push 0x446b34
push str.ebclnt.exe
lea ecx, [ebp - 0x5c8]
call fcn.0040ff20
mov dword [ebp - 0x604], eax
mov eax, dword [ebp - 0x604]
mov dword [ebp - 0x608], eax
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x608]
push ecx
lea edx, [ebp - 0x4f4]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x12c
call fcn.0040fee0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x5c8]
call fcn.0040e5b0
push 0x446b24
push str.Wclient.exe
lea ecx, [ebp - 0x590]
call fcn.0040ff20
mov dword [ebp - 0x604], eax
mov eax, dword [ebp - 0x604]
mov dword [ebp - 0x608], eax
mov dword [ebp - 4], 4
mov ecx, dword [ebp - 0x608]
push ecx
lea edx, [ebp - 0x4ec]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x12c
call fcn.0040fee0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x590]
call fcn.0040e5b0
push str.sway
push str.sway.exe
lea ecx, [ebp - 0x558]
call fcn.0040ff20
mov dword [ebp - 0x604], eax
mov eax, dword [ebp - 0x604]
mov dword [ebp - 0x608], eax
mov dword [ebp - 4], 5
mov ecx, dword [ebp - 0x608]
push ecx
lea edx, [ebp - 0x4e4]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x12c
call fcn.0040fee0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x558]
call fcn.0040e5b0
push str.else
lea ecx, [ebp - 0x30]
call fcn.00405ff0
mov dword [ebp - 4], 6
mov byte [ebp - 0xb0], 0
push 0x7f
push 0
lea eax, [ebp - 0xaf]
push eax
call fcn.0042a550
add esp, 0xc
mov dword [ebp - 0xb4], 0
push 0x80
lea eax, [ebp - 0xb0]
push eax
lea ecx, [ebp - 0xb4]
push ecx
push 0x44692c
push str.softwareCentury_Networkyileyoo
push 0x80000002
call fcn.00410e30
add esp, 0x18
movzx edx, al
test edx, edx
je 0x40e8a3
push 0x446b00
lea ecx, [ebp - 0x30]
call fcn.004061c0
jmp 0x40ea75
push 0x80
lea eax, [ebp - 0xb0]
push eax
lea ecx, [ebp - 0xb4]
push ecx
push 0x446af8
push str.softwareIcafe8
push 0x80000002
call fcn.00410e30
add esp, 0x18
movzx edx, al
test edx, edx
je 0x40e8e6
push 0x446ae4
lea ecx, [ebp - 0x30]
call fcn.004061c0
jmp 0x40ea75
lea eax, [ebp - 0xb8]
push eax
push 0x20019
push 0
push str.software
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jne 0x40ea75
mov dword [ebp - 0xc0], 0
mov byte [ebp - 0x1c4], 0
push 0x103
push 0
lea eax, [ebp - 0x1c3]
push eax
call fcn.0042a550
add esp, 0xc
mov dword [ebp - 0x1c8], 0x104
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c8]
push eax
lea ecx, [ebp - 0x1c4]
push ecx
mov edx, dword [ebp - 0xc0]
push edx
mov eax, dword [ebp - 0xb8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
je 0x40ea75
lea eax, [ebp - 0x1c4]
push eax
lea ecx, [ebp - 0x1e4]
call fcn.00405ff0
mov byte [ebp - 4], 7
push 0
push 0x446ad4
lea ecx, [ebp - 0x1e4]
call fcn.0040fde0
cmp eax, 0xffffffff
je 0x40ea32
push str.software_
lea ecx, [ebp - 0x200]
call fcn.00405ff0
mov byte [ebp - 4], 8
lea eax, [ebp - 0x1e4]
push eax
lea ecx, [ebp - 0x200]
call fcn.004061f0
mov dword [ebp - 0x204], 0
push 0x80
lea eax, [ebp - 0xb0]
push eax
lea ecx, [ebp - 0x204]
push ecx
push str.nbid
lea ecx, [ebp - 0x200]
call fcn.004063b0
push eax
push 0x80000002
call fcn.00410e30
add esp, 0x18
movzx edx, al
test edx, edx
je 0x40ea23
push 0x446abc
lea ecx, [ebp - 0x30]
call fcn.004061c0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x200]
call fcn.00406130
push 0x104
push 0
lea eax, [ebp - 0x1c4]
push eax
call fcn.0042a550
add esp, 0xc
mov dword [ebp - 0x1c8], 0x104
mov eax, dword [ebp - 0xc0]
add eax, 1
mov dword [ebp - 0xc0], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1e4]
call fcn.00406130
jmp 0x40e948
push str.else
lea eax, [ebp - 0x30]
push eax
call fcn.0040d090
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x40ec12
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0xffffffff
je 0x40ec12
mov dword [ebp - 0x434], 0x22c
lea eax, [ebp - 0x434]
push eax
mov ecx, dword [ebp - 0x208]
push ecx
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 0
je 0x40ec12
lea eax, [ebp - 0x43c]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x12c
call fcn.0040b740
jmp 0x40eb08
push 0
lea eax, [ebp - 0x4dc]
push eax
lea ecx, [ebp - 0x43c]
call fcn.0040fe40
lea eax, [ebp - 0x4d8]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x12c
call fcn.004227f0
push eax
lea ecx, [ebp - 0x43c]
call fcn.004232b0
movzx ecx, al
test ecx, ecx
je 0x40ebf4
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x520]
call fcn.004064c0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x520]
push ecx
lea edx, [ebp - 0x458]
push edx
call fcn.0041bc80
add esp, 8
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x520]
call fcn.00406570
lea ecx, [ebp - 0x43c]
call fcn.0040fe20
mov ecx, eax
call fcn.004063b0
push eax
lea ecx, [ebp - 0x458]
call fcn.004063b0
push eax
call fcn.0042cf9f
add esp, 8
test eax, eax
jne 0x40ebe0
lea ecx, [ebp - 0x43c]
call fcn.0040fe20
add eax, 0x1c
push eax
mov ecx, dword [ebp + 8]
call fcn.00405ef0
mov eax, dword [ebp - 0x4d4]
or eax, 1
mov dword [ebp - 0x4d4], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x458]
call fcn.00406130
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00406130
mov eax, dword [ebp + 8]
jmp 0x40ec3c
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x458]
call fcn.00406130
jmp 0x40eaf4
lea eax, [ebp - 0x434]
push eax
mov ecx, dword [ebp - 0x208]
push ecx
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 0x438], eax
jmp 0x40ead0
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp + 8]
call fcn.00406070
mov ecx, dword [ebp - 0x4d4]
or ecx, 1
mov dword [ebp - 0x4d4], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00406130
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042a65e
mov esp, ebp
pop ebp
ret 4