Function at 0x10007be0
Capabilities:
Enumerate processes
Query or enumerate registry value
Read .ini file
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x13c
mov eax, dword [0x100390c0]
xor eax, esp
mov dword [esp + 0x138], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push esi
push edi
push str..Settings.ini
push 0
push str.ApplyWindowsScaleSettings
push str.WindowMode
call ebx
push str..Settings.ini
push 1
push str.ApplyWindowsScaleSettingsOnWindows7
push str.WindowMode
mov esi, eax
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x10007c40
call fcn.10007990
test al, al
jne 0x10007caa
jmp 0x10007c4e
cmp eax, 1
jne 0x10007c4e
call fcn.10007990
test al, al
jne 0x10007caf
test esi, esi
je 0x10007caa
lea eax, [esp + 0xc]
mov dword [esp + 0x14], 0
push eax
push str.SOFTWAREWebzenMuConfig
push 0x80000001
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10007caa
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push str.WindowMode
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10007ca4
cmp dword [esp + 0x14], eax
jne 0x10007caf
jmp 0x10007caa
push dword [esp + 0xc]
call edi
call fcn.1000ec90
push 0
push 2
mov dword [esp + 0x20], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x10007d3f
mov edi, dword [sym.imp.KERNEL32.dll_Process32Next]
nop dword [eax]
mov eax, str.main.exe
lea ecx, [esp + 0x3c]
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10007d10
test dl, dl
je 0x10007d0c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10007d10
add ecx, 2
add eax, 2
test dl, dl
jne 0x10007cf0
xor eax, eax
jmp 0x10007d15
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10007d2d
mov eax, dword [0x1003b024]
cmp eax, 0x45
jg 0x10007f11
inc eax
mov dword [0x1003b024], eax
lea eax, [esp + 0x18]
push eax
push esi
call edi
test eax, eax
jne 0x10007ce0
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x60c271
mov dword [0x60c269], 0x15ff016a
push str..Settings.ini
mov dword [0x60c26d], 0x661138
mov ecx, 0x90909090
push 0
mov dword [eax], ecx
mov dword [eax + 4], ecx
push str.Borderless
mov word [eax + 8], cx
push str.WindowMode
mov word [0x60c27b], 0xd1eb
call ebx
push str..Settings.ini
push 1
push str.Position
push str.WindowMode
mov dword [0x1003b048], eax
call ebx
push str..Settings.ini
push 1
push str.AboveTaskbar
push str.WindowMode
mov dword [0x1003b03c], eax
call ebx
push str..Settings.ini
push 0
push str.MaximizeBox
push str.WindowMode
mov dword [0x1003b044], eax
call ebx
push str..Settings.ini
push 0
push str.ResizableWindow
push str.WindowMode
mov dword [0x1003b040], eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor ecx, ecx
mov dword [0x1003b04c], eax
mov eax, 0x66fee8
mov dword [eax], ecx
mov word [eax + 4], cx
mov ecx, eax
mov eax, dword [str.22359]
mov dword [ecx], eax
mov ax, word [0x10035544]
mov word [ecx + 4], ax
lea eax, [esp + 0xc]
push eax
push 0x1f0fff
push 0xf
push 0x66f3e2
call esi
push 0
push 0xf
push str.poi.mubz.bg
push 0x66f3e2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push 0xf
push 0x66f3e2
call esi
mov eax, 0xad77
xor ecx, ecx
mov word [0x67ac94], ax
mov eax, 0x66fef0
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov byte [eax + 0x10], cl
mov ecx, eax
movups xmm0, xmmword [str.IlI1IlIlI1llI1I]
movups xmmword [ecx], xmm0
mov al, byte [0x10035564]
mov byte [ecx + 0x10], al
lea eax, [esp + 0x14]
mov dword [0x4a6f3d], 0x1000ebd0
push eax
push str.SOFTWAREWebzenMuConfig
push 0x80000001
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10007f33
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
push 0
push 0
push str.WindowMode
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10007f2d
cmp dword [esp + 0xc], eax
jle 0x10007f33
call fcn.100013cb
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10001721
push 0x1000e7a0
push 0x1003b064
call fcn.100019ed
push 0x1000ebc0
push 0x1003b060
call fcn.100019ed
call fcn.100019e5
jmp 0x10007f33
push 0
push str.Error_de_inicio_
push str.you_can_only_run_2_main_per_pc_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [esp + 0x14]
call edi
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
push 0x40
push 4
mov ebx, 0x10006d00
push 0x4a85e7
sub ebx, 0x4a85eb
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10007f84
lea eax, [esp + 0x10]
mov dword [0x4a85e7], ebx
push eax
push dword [esp + 0x10]
mov dword [esp + 0x18], 0
push 4
push 0x4a85e7
call esi
test eax, eax
jne 0x10007f86
call edi
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
push 0x40
push 1
push 0x4a85e6
call esi
test eax, eax
je 0x10007fc7
lea eax, [esp + 0x10]
mov byte [0x4a85e6], 0xe8
push eax
push dword [esp + 0x10]
mov dword [esp + 0x18], 0
push 1
push 0x4a85e6
call esi
test eax, eax
jne 0x10007fc9
call edi
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
push 0x40
push 1
push 0x4a85eb
call esi
test eax, eax
je 0x1000800a
lea eax, [esp + 0x10]
mov byte [0x4a85eb], 0x90
push eax
push dword [esp + 0x10]
mov dword [esp + 0x18], 0
push 1
push 0x4a85eb
call esi
test eax, eax
jne 0x1000800c
call edi
call fcn.1000e0f0
mov eax, 0x5f03e0
mov dword [eax], 0x90909090
mov dword [eax + 4], 0x90909090
mov dword [eax + 8], 0x90909090
mov dword [eax + 0xc], 0x90909090
mov dword [eax + 0x10], 0x90909090
mov dword [eax + 0x14], 0x90909090
mov dword [eax + 0x18], 0x90909090
mov dword [eax + 0x1c], 0x90909090
mov dword [eax + 0x20], 0x90909090
mov dword [eax + 0x24], 0x90909090
call fcn.1000e710
mov ecx, 0x10007140
mov eax, 0x100071d0
sub eax, 0x5dcc1c
mov dword [0x5dcc18], eax
lea eax, [ecx - 0x5b8534]
mov dword [0x5b8530], eax
lea eax, [ecx - 0x5b85d0]
mov dword [0x5b85cc], eax
lea eax, [ecx - 0x5b88ca]
mov dword [0x5b88c6], eax
lea eax, [ecx - 0x5cc3ff]
mov dword [0x5cc3fb], eax
lea eax, [ecx - 0x5cc41e]
mov dword [0x5cc41a], eax
lea eax, [ecx - 0x5cce65]
sub ecx, 0x6022ac
mov dword [0x5cce61], eax
mov dword [0x6022a8], ecx
mov ecx, 0x10039bb8
call fcn.10003550
mov byte [0x580846], 0xe8
mov eax, 0x10007120
sub eax, 0x58084b
mov ecx, 0x90909090
mov dword [0x580847], eax
mov eax, 0x4bef15
mov byte [0x4beef7], 0x90
mov dword [eax], ecx
mov word [eax + 4], cx
mov byte [eax + 6], cl
mov eax, 0x4c1c28
mov byte [0x4c1c04], 0x90
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
call fcn.1000de50
mov ecx, dword [esp + 0x144]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1000ed1b
mov esp, ebp
pop ebp
ret