Function at 0x4015e0
Capabilities:
Check os version
Enumerate processes
Get common file path
Parse pe header
Read file on windows
Read file via mapping

Disassembly:
sub esp, 0x794
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x4a4]
push 1
push eax
mov dword [esp + 0x20], 0
call fcn.00401f40
call fcn.004020a0
lea ecx, [esp + 0x4ac]
lea edx, [esp + 0x40]
push ecx
push str._nStart_of_AntiHook......._at_:__s
push edx
call fcn.004021ce
lea eax, [esp + 0x4c]
push eax
call fcn.00402060
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x40169f
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0x16c]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x16c]
mov dword [esp + 0x16c], 0x9c
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40169f
cmp dword [esp + 0x17c], 2
jne 0x40169f
cmp dword [esp + 0x170], 5
je 0x40169f
lea edx, [esp + 0x38]
push str.OS_Version_is_not_XP.So_skip_Hook_Checking.
push edx
call fcn.004021ce
lea eax, [esp + 0x40]
push eax
call fcn.00402060
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x794
ret
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ZwOpenKey
push eax
mov dword [esp + 0x3c], eax
call esi
push str.ZwOpenKey
push str.ntdll.dll
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call esi
lea ecx, [esp + 0x6a4]
push 0x100
push ecx
mov dword [esp + 0x38], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x6a4]
lea eax, [esp + 0x5a4]
push edx
push str._s_ntdll.dll
push eax
call fcn.004021ce
add esp, 0xc
lea ecx, [esp + 0x5a4]
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401c42
mov ecx, 0x19
xor eax, eax
mov edi, 0x408e9c
push eax
rep stosd dword es:[edi], eax
mov ecx, 0x19
mov edi, 0x408e38
rep stosd dword es:[edi], eax
push eax
push eax
mov ecx, 0x19
mov edi, 0x408d70
push 0x8000002
push eax
rep stosd dword es:[edi], eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
mov dword [esp + 0x1c], edi
jne 0x40179e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x38]
push str.file_Mapping_Error
push edx
call fcn.004021ce
lea eax, [esp + 0x40]
push eax
call fcn.00402060
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x794
ret
push 0
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esp + 0x10], eax
jne 0x4017ef
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
lea ecx, [esp + 0x38]
push str.MapViewofFile_Error
push ecx
call fcn.004021ce
lea edx, [esp + 0x40]
push edx
call fcn.00402060
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x794
ret
cmp word [eax], 0x5a4d
je 0x401830
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
lea eax, [esp + 0x38]
push str.MZ_not_matching
push eax
call fcn.004021ce
lea ecx, [esp + 0x40]
push ecx
call fcn.00402060
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x794
ret
mov ebx, dword [eax + 0x3c]
mov ecx, dword [esp + 0x10]
add ebx, ecx
push 0xf8
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x401887
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
lea eax, [esp + 0x38]
push str.Bad_Pointer_Error
push eax
call fcn.004021ce
lea ecx, [esp + 0x40]
push ecx
call fcn.00402060
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x794
ret
cmp dword [ebx], 0x4550
je 0x4018cd
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
lea eax, [esp + 0x38]
push str.not_PE
push eax
call fcn.004021ce
lea ecx, [esp + 0x40]
push ecx
call fcn.00402060
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x794
ret
mov dx, word [ebx + 6]
xor eax, eax
test dx, dx
jbe 0x401916
lea ecx, [ebx + 0x10c]
cmp dx, 0x19
jae 0x401916
mov edx, dword [ecx - 8]
add ecx, 0x28
mov dword [eax*4 + 0x408d70], edx
mov edx, dword [ecx - 0x28]
mov dword [eax*4 + 0x408e38], edx
mov edx, dword [ecx - 0x2c]
mov dword [eax*4 + 0x408e9c], edx
mov dx, word [ebx + 6]
mov edi, edx
inc eax
and edi, 0xffff
cmp eax, edi
jl 0x4018de
sub ebp, dword [esp + 0x34]
mov edi, ebp
push edi
call fcn.00402020
push edi
lea ebp, [eax + eax*4]
call fcn.00402020
lea ecx, [eax + eax*4]
mov eax, dword [ebx + ebp*8 + 0x10c]
add esp, 8
mov edx, dword [ebx + ecx*8 + 0x104]
sub eax, edx
push 0
add eax, edi
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edx, [esp + 0x14]
push 0
push edx
lea eax, [esp + 0x28]
push 5
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [esp + 0x1c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call ebx
push esi
call ebx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x23]
mov edx, dword [esp + 0x22]
and eax, 0xff
and ecx, 0xff
push eax
mov eax, dword [esp + 0x25]
push ecx
mov ecx, dword [esp + 0x28]
and edx, 0xff
and eax, 0xff
push edx
and ecx, 0xff
push eax
push ecx
lea edx, [esp + 0x14c]
push str.0x_02X_0x_02X_0x_02X_0x_02X_0x_02X
push edx
call fcn.004021ce
lea eax, [esp + 0x154]
lea ecx, [esp + 0x54]
push eax
push str._s__Bytes_on_DISK_n
push ecx
call fcn.004021ce
lea edx, [esp + 0x60]
push edx
call fcn.00402060
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0x238]
mov dword [esp + 0x234], 0
add esp, 0x2c
mov esi, str._SYSTEM_PROCESS__SYSTEM_SMSS.EXE_CSRSS.EXE_WINLOGON.EXE_SERVICES.EXE_LSASS.EXE_SVCHOST.EXE_EXPLORER.EXE_SPOOLSV.EXE
rep stosd dword es:[edi], eax
mov ecx, 0x1d
lea edi, [esp + 0x430]
push eax
push 0xf
rep movsd dword es:[edi], dword [esi]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x1c], esi
je 0x401c42
lea eax, [esp + 0x208]
mov dword [esp + 0x208], 0x128
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x401bfe
mov ecx, dword [esp + 0x210]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea edx, [esp + 0x22c]
mov ebp, eax
push edx
lea eax, [esp + 0x334]
push 0x408148
push eax
call fcn.004021ce
lea ecx, [esp + 0x33c]
push ecx
call fcn.00406a0c
lea edx, [esp + 0x340]
lea eax, [esp + 0x440]
push edx
push eax
call fcn.00402220
add esp, 0x18
test eax, eax
jne 0x401bdd
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x2c]
push 5
push edx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x2b]
mov eax, dword [esp + 0x2a]
and ecx, 0xff
and edx, 0xff
push ecx
mov ecx, dword [esp + 0x2d]
push edx
mov edx, dword [esp + 0x30]
and eax, 0xff
and ecx, 0xff
push eax
and edx, 0xff
push ecx
push edx
lea eax, [esp + 0x14c]
push str.0x_02X_0x_02X_0x_02X_0x_02X_0x_02X
push eax
call fcn.004021ce
lea ecx, [esp + 0x34c]
lea edx, [esp + 0x154]
push ecx
push edx
lea eax, [esp + 0x5c]
push str._s__Bytes_in_Memory___s_
push eax
call fcn.004021ce
lea ecx, [esp + 0x64]
push ecx
call fcn.00402060
mov eax, dword [esp + 0x44]
add esp, 0x30
cmp eax, 5
jne 0x401bdd
mov ecx, 5
lea edi, [esp + 0x20]
lea esi, [esp + 0x28]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x401bd6
cmp byte [esp + 0x28], 0xe9
jne 0x401bd6
lea eax, [esp + 0x330]
lea ecx, [esp + 0x38]
push eax
push str.ZWOpenKey___is_Hooked_in__s.
push ecx
call fcn.004021ce
lea edx, [esp + 0x44]
push edx
call fcn.00402060
mov edx, dword [esp + 0x40]
add esp, 0x10
lea eax, [esp + 0x14]
lea ecx, [esp + 0x20]
push eax
push 5
push ecx
push edx
push ebp
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x401bd6
lea eax, [esp + 0x330]
lea ecx, [esp + 0x38]
push eax
push str.Restored_ZWOpenKey___Hook_of__s.
push ecx
call fcn.004021ce
lea edx, [esp + 0x44]
push edx
call fcn.00402060
mov eax, dword [esp + 0x28]
add esp, 0x10
inc eax
mov dword [esp + 0x18], eax
push ebp
call ebx
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x208]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x401a50
push esi
call ebx
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x401c25
lea ecx, [esp + 0x38]
push str.Hooks_not_found_for_ZwOpenKey__.
push ecx
call fcn.004021ce
lea edx, [esp + 0x40]
push edx
call fcn.00402060
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x794
ret
push eax
lea eax, [esp + 0x3c]
push str.Restored_Hooked_ZwOpenKey___function_in__d_processes
push eax
call fcn.004021ce
lea ecx, [esp + 0x44]
push ecx
call fcn.00402060
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x794
ret