Function at 0x401150
Capabilities:
Enumerate files on windows
Query or enumerate registry key
Query or enumerate registry value
Read file on windows
Terminate process

Disassembly:
push esi
push edi
mov esi, ecx
mov edi, eax
mov eax, dword [esi]
cmp eax, 0xf
ja case.default.0x401161
jmp dword [eax*4 + 0x40146c]
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [esi + 0x8010]
mov edx, dword [esi + 0x800c]
lea eax, [esi + 0x8014]
push eax
push ecx
mov ecx, dword [esi + 8]
push edx
lea eax, [esi + 0xc]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop edi
mov dword [esi + 4], eax
pop esi
ret
lea edx, [esi + 0x28]
push edx
lea eax, [esi + 0x24]
push eax
lea ecx, [esi + 0x20]
push ecx
lea edx, [esi + 0x1c]
push edx
lea eax, [esi + 0x18]
push eax
lea ecx, [esi + 0x14]
push ecx
mov ecx, dword [esi + 8]
lea edx, [esi + 0x10]
push edx
lea eax, [esi + 0xc]
push eax
push 0
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
pop edi
mov dword [esi + 4], eax
pop esi
ret
push ebx
lea ebx, [esi + 0x21018]
push ebx
lea edi, [esi + 0x8018]
push edi
lea eax, [esi + 0x8014]
push eax
mov eax, dword [esi + 8]
push 0
lea ecx, [esi + 0x8010]
push ecx
lea edx, [esi + 0x10]
push edx
mov edx, dword [esi + 0xc]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0xea
mov dword [esi + 4], eax
jne 0x401263
mov ecx, dword [ebx]
push ebp
push ecx
call fcn.00402e72
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x401262
mov edx, dword [esi + 0xc]
push ebx
push ebp
lea eax, [esi + 0x8014]
push eax
push 0
lea eax, [esi + 0x8010]
push eax
lea eax, [esi + 0x10]
push eax
mov eax, dword [esi + 8]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [esi + 4], eax
mov ecx, 0x6400
mov esi, ebp
rep movsd dword es:[edi], dword [esi]
push ebp
mov dword [ebx], 0x19000
call fcn.00402e6d
add esp, 4
pop ebp
pop ebx
pop edi
pop esi
ret
lea ecx, [esi + 0x10018]
push ecx
lea edx, [esi + 0x10014]
push edx
lea eax, [esi + 0x8014]
push eax
mov eax, dword [esi + 0xc]
push 0
lea ecx, [esi + 0x8010]
push ecx
mov ecx, dword [esi + 8]
lea edx, [esi + 0x10]
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
pop edi
mov dword [esi + 4], eax
pop esi
ret
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov dword [esi + 4], eax
pop esi
ret
mov eax, dword [edi + 0xc]
test eax, eax
jne 0x4012de
push str.psapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x40139a
push str.EnumProcesses
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [edi + 0xc], eax
je 0x40139a
lea eax, [esi + 0x1008]
push eax
push 0x1000
lea ecx, [esi + 8]
push ecx
call dword [edi + 0xc]
pop edi
mov dword [esi + 4], eax
pop esi
ret
cmp dword [edi], 0
jne 0x401327
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x40131d
push str.CreateToolhelp32Snapshot
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [edi], eax
jne 0x401327
pop edi
mov dword [esi + 4], 0xffffffff
pop esi
ret
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 8]
push edx
push eax
call dword [edi]
pop edi
mov dword [esi + 4], eax
pop esi
ret
mov eax, dword [edi + 4]
test eax, eax
jne 0x401360
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x40139a
push str.Process32FirstW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [edi + 4], eax
je 0x40139a
mov edx, dword [esi + 8]
lea ecx, [esi + 0xc]
push ecx
push edx
call dword [edi + 4]
pop edi
mov dword [esi + 4], eax
pop esi
ret
mov eax, dword [edi + 8]
test eax, eax
jne 0x4013a4
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x40139a
push str.Process32NextW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [edi + 8], eax
jne 0x4013a4
pop edi
mov dword [esi + 4], 0
pop esi
ret
mov ecx, dword [esi + 8]
lea eax, [esi + 0xc]
push eax
push ecx
call dword [edi + 8]
pop edi
mov dword [esi + 4], eax
pop esi
ret
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov dword [esi + 4], eax
pop esi
ret
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov dword [esi + 4], eax
pop esi
ret
lea ecx, [esi + 0x10008]
push ecx
lea edx, [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
pop edi
mov dword [esi + 4], eax
pop esi
ret
mov ecx, dword [esi + 8]
lea eax, [esi + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
pop edi
mov dword [esi + 4], eax
pop esi
ret
mov edx, dword [esi + 0x10018]
mov eax, dword [esi + 0x10014]
mov ecx, dword [esi + 0x10010]
push edx
mov edx, dword [esi + 0x1000c]
push eax
mov eax, dword [esi + 0x10008]
push ecx
push 0
push edx
push eax
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
pop edi
mov dword [esi + 4], eax
pop esi
ret
mov eax, dword [esi + 0x40c]
push 0
lea edx, [esi + 0x410]
push edx
mov edx, dword [esi + 8]
push eax
lea ecx, [esi + 0xc]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop edi
mov dword [esi + 4], eax
pop esi
ret
push 1
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov dword [esi + 4], 1
pop esi
ret