Function at 0x40ad50
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create thread
Delete registry value
Enumerate gui resources
Set environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xe8
mov eax, dword [0x4c700c]
xor eax, esp
mov dword [esp + 0xe4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [esp + 0x14], eax
xor esi, esi
mov eax, dword [ebp + 0x10]
push edi
mov edi, dword [sym.imp.USER32.dll_EnumWindows]
mov dword [esp + 0x14], eax
nop dword [eax]
push esi
push 0x40aa00
call edi
inc esi
cmp esi, 2
jl 0x40ad90
cmp byte [0x4c8d93], 0
je 0x40adbf
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xe4]
xor ecx, esp
call fcn.004490d7
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [0x4c8e78]
test eax, eax
jne 0x40adea
mov eax, 1
mov ecx, 0x4c8e78
lock xadd dword [ecx], eax
test eax, eax
jne 0x40adea
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x4c8e7c], eax
jmp 0x40adef
mov eax, dword [0x4c8e7c]
push 0xffffffffffffffff
push eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esp + 0x28], eax
call eax
mov esi, dword [0x4c8e80]
mov ecx, 0x4c8e80
push dword [esi + 4]
push 0x4c8e80
call fcn.00437db0
mov dword [esi + 4], esi
mov dword [esi], esi
mov dword [esi + 8], esi
push dword [0x4c8e7c]
mov dword [0x4c8e84], 0
mov byte [0x4c8e88], 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, 0x4c8e38
call fcn.00436a70
mov ecx, 0x4c8e58
call fcn.00436a70
lea eax, [esp + 0x24]
mov dword [esp + 0x24], str.da39a3ee5e6b4b0d3255bfef95601890afd80709
push eax
lea eax, [esp + 0x70]
mov dword [esp + 0x2c], 2
push eax
mov ecx, 0x4c8e38
call fcn.00438900
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], str.95d07955711560d0048eb2ffe81e7b54784d0f13
push eax
lea eax, [esp + 0x78]
mov dword [esp + 0x34], 2
push eax
mov ecx, 0x4c8e38
call fcn.00438900
lea eax, [esp + 0x34]
mov dword [esp + 0x34], str.04df0b4479b490c802cc61cae3a943cc05448907
push eax
lea eax, [esp + 0x80]
mov dword [esp + 0x3c], 2
push eax
mov ecx, 0x4c8e38
call fcn.00438900
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], str.956bf83315c7ecd53427d4f8529f39c10e711354
push eax
lea eax, [esp + 0x88]
mov dword [esp + 0x44], 2
push eax
mov ecx, 0x4c8e38
call fcn.00438900
lea eax, [esp + 0x44]
mov dword [esp + 0x44], str.dca8ccd2431aafbdd1f4f7c300119b1e24c3db71
push eax
lea eax, [esp + 0x90]
mov dword [esp + 0x4c], 2
push eax
mov ecx, 0x4c8e58
call fcn.00438900
lea eax, [esp + 0x4c]
mov dword [esp + 0x4c], str.c8851beabccaecdf43a3d26588628d53c1119c5c
push eax
lea eax, [esp + 0x98]
mov dword [esp + 0x54], 2
push eax
mov ecx, 0x4c8e38
call fcn.00438900
lea eax, [esp + 0x54]
mov dword [esp + 0x54], str.7c21ddb85bb167a2a267020a9e0bf43ae0102ea3
push eax
lea eax, [esp + 0xa0]
mov dword [esp + 0x5c], 2
push eax
mov ecx, 0x4c8e58
call fcn.00438900
lea eax, [esp + 0x5c]
mov dword [esp + 0x5c], str.b5f3bac4c0788996b6400a1b3cf831364e07dbb4
mov dword [esp + 0x60], 2
push eax
lea eax, [esp + 0xa8]
mov ecx, 0x4c8e38
push eax
call fcn.00438900
lea eax, [esp + 0x64]
mov dword [esp + 0x64], str.b0dba77ca71455562fd14113887d0cd7e1c743a0
push eax
lea eax, [esp + 0xb0]
mov dword [esp + 0x6c], 2
push eax
mov ecx, 0x4c8e58
call fcn.00438900
call fcn.00406e40
call fcn.004073f0
lea ecx, [esp + 0xd4]
call fcn.00410a90
lea ecx, [esp + 0xbc]
call fcn.00401740
cmp dword [esp + 0xd0], 8
lea eax, [esp + 0xbc]
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
cmovae eax, dword [esp + 0xbc]
push eax
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push 0x80000001
call esi
cmp dword [esp + 0xd0], 8
lea eax, [esp + 0xbc]
cmovae eax, dword [esp + 0xbc]
push eax
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push 0x80000002
call esi
mov edi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0
push str.__COMPAT_LAYER
call edi
cmp dword [esp + 0xd0], 8
lea edx, [esp + 0xbc]
mov eax, dword [esp + 0xe4]
lea ecx, [esp + 0xd4]
cmovae edx, dword [esp + 0xbc]
cmp dword [esp + 0xe8], 8
cmovae ecx, dword [esp + 0xd4]
setae byte [esp + 0xb]
cmp eax, dword [esp + 0xcc]
jne 0x40b076
push eax
call fcn.0040d080
add esp, 4
test eax, eax
je 0x40b0c4
cmp byte [esp + 0xb], 0
lea eax, [esp + 0xd4]
cmovne eax, dword [esp + 0xd4]
push eax
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push 0x80000001
call esi
cmp dword [esp + 0xe8], 8
lea eax, [esp + 0xd4]
cmovae eax, dword [esp + 0xd4]
push eax
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push 0x80000002
call esi
push 0
push str.__COMPAT_LAYER
call edi
call fcn.00409e20
mov esi, eax
mov dword [esp + 0xb8], esi
cmp esi, 0xe0000000
jne 0x40b5af
mov ecx, dword fs:[0x30]
mov eax, dword [ecx + 0xa4]
shl eax, 8
or eax, dword [ecx + 0xa8]
cmp eax, 0x603
jae 0x40b15f
push 0
push 0
push 0
push 0x40ac20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x4c7a40], 0xffffffff
jne 0x40b12d
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop
push 1
call esi
cmp dword [0x4c7a40], 0xffffffff
je 0x40b120
mov ecx, 0x25
call fcn.0040c560
mov ecx, 0x2d
mov esi, eax
call fcn.0040c560
mov ecx, dword [0x4c7a40]
push 0x4000
push esi
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x47324c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40b1d4
push str.IsWow64Process
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x40b1aa
lea eax, [esp + 0xb4]
mov dword [esp + 0xb4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x40b1aa
cmp dword [esp + 0xb4], 0
jne 0x40b1d4
mov ecx, 7
call fcn.0040c560
mov ecx, 0x2c
mov esi, eax
call fcn.0040c560
push 0
push esi
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp byte [0x4c909a], 0
jne 0x40b2f5
push str.TwitchStudioSetupUniqueHandle
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
test esi, esi
je 0x40b2f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40b2f5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x4c8d5c]
test ecx, ecx
je 0x40b24f
mov esi, dword [ecx + 0x34]
mov eax, 0x2aaaaaab
mov ecx, dword [ecx + 0x38]
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 7
jb 0x40b24f
cmp dword [esi + 0xa4], 8
lea eax, [esi + 0x90]
jb 0x40b254
mov eax, dword [eax]
jmp 0x40b254
mov eax, 0x4732fc
push 0
push eax
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x40b26f
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor esi, esi
jmp 0x40b5af
mov ecx, dword [0x4c8d5c]
test ecx, ecx
je 0x40b2d8
mov esi, dword [ecx + 0x34]
mov eax, 0x2aaaaaab
mov ecx, dword [ecx + 0x38]
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x18
jb 0x40b2aa
cmp dword [esi + 0x23c], 8
lea ecx, [esi + 0x228]
jb 0x40b2af
mov ecx, dword [ecx]
jmp 0x40b2af
mov ecx, 0x4732fc
cmp eax, 0x1a
jb 0x40b2dd
cmp dword [esi + 0x26c], 8
lea eax, [esi + 0x258]
jb 0x40b2e2
mov eax, dword [eax]
push 0
push ecx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor esi, esi
jmp 0x40b5af
mov ecx, 0x4732fc
mov eax, 0x4732fc
push 0
push ecx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor esi, esi
jmp 0x40b5af
push 0x8c
call fcn.004492e2
add esp, 4
mov edx, eax
mov dword [esp + 0x10], edx
push 0x8c
push 0
push edx
call fcn.0044ac20
mov ecx, dword [0x4c8d5c]
add esp, 0xc
test ecx, ecx
je 0x40b35b
mov esi, dword [ecx + 0x34]
mov eax, 0x2aaaaaab
mov ecx, dword [ecx + 0x38]
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 7
jb 0x40b35b
cmp dword [esi + 0xa4], 8
lea eax, [esi + 0x90]
mov dword [esp + 0xc], eax
jb 0x40b363
mov eax, dword [eax]
mov dword [esp + 0xc], eax
jmp 0x40b363
mov dword [esp + 0xc], 0x4732fc
mov ecx, dword [esp + 0x10]
mov esi, dword [0x4c7a58]
mov edi, dword [0x4c7a5c]
mov dword [esp + 0xb4], 0
mov eax, dword [esp + 0xb4]
mov dword [ecx], str.Twitch_UI
mov dword [ecx + 4], 0x280
mov dword [ecx + 8], 0x1e0
mov dword [ecx + 0x14], eax
push 0x14
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
call fcn.004492e2
mov edx, dword [esp + 0x14]
add esp, 4
lea ecx, [edx + 0x20]
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edx + 0x18], eax
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [edx + 0x2c], 7
mov dword [edx + 0x30], 8
mov dword [edx + 0x14], 0x3f800000
mov eax, dword [edx + 0x18]
push eax
push 0x10
call fcn.00417bd0
mov eax, dword [esp + 0x10]
xorps xmm0, xmm0
mov ecx, dword [esp + 0xc]
push 0x24
mov dword [0x4c909c], eax
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x50], 0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x5c], 0
mov dword [eax + 0x34], 0
mov dword [eax + 0x38], 0x7d0
mov dword [eax + 0x3c], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0x60], 0
mov byte [eax + 0x64], 0
movups xmmword [eax + 0x68], xmm0
movq qword [eax + 0x78], xmm0
mov dword [eax + 0x80], 0
mov dword [eax], ecx
mov dword [eax + 4], esi
mov dword [eax + 8], edi
mov dword [eax + 0x84], 0x4018d0
mov dword [eax + 0x88], 0x401bb0
call fcn.004492e2
mov esi, eax
add esp, 4
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
push 8
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.004492e2
add esp, 4
mov dword [eax + 4], 0
mov dword [esi], eax
mov dword [eax], esi
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov byte [esi + 0x20], 0
push 0x10
mov byte [esi + 0x21], 0
call fcn.004492e2
add esp, 4
push 0
push 0
push eax
push 0x410b30
push 0
push 0
mov dword [eax + 4], str.Spade::EventManager::EventThread
mov dword [eax], vtable.Util::MethodThreadAdapter_class_Spade::EventManager__unsigned_char____cdecl_Spade::EventManager::__int__void__.0
mov dword [eax + 8], esi
mov dword [eax + 0xc], 0x416bf0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
push dword [ebp + 0x14]
mov edx, dword [esp + 0x1c]
push dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
mov dword [0x4c9090], esi
call fcn.00407ec0
mov ecx, dword [0x4c9090]
add esp, 8
mov dword [esp + 0xb8], eax
push 0xbb8
call fcn.00417500
mov eax, dword [0x4c8e8c]
test eax, eax
je 0x40b5a8
push 0xffffffffffffffff
push eax
call dword [esp + 0x28]
lea eax, [esp + 0xb8]
push eax
push dword [0x4c8e8c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [0x4c8e8c]
call edi
mov esi, dword [esp + 0xb8]
mov edx, dword [esp + 0xd0]
cmp edx, 8
jb 0x40b5f1
mov ecx, dword [esp + 0xbc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40b5e7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b667
push edx
push ecx
call fcn.00449563
add esp, 8
mov edx, dword [esp + 0xe8]
xor eax, eax
mov dword [esp + 0xcc], 0
mov dword [esp + 0xd0], 7
mov word [esp + 0xbc], ax
cmp edx, 8
jb 0x40b64f
mov ecx, dword [esp + 0xd4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40b645
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b667
push edx
push ecx
call fcn.00449563
add esp, 8
mov ecx, dword [esp + 0xec]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.004490d7
mov esp, ebp
pop ebp
ret 0x10
call fcn.00458a87
int3