Function at 0x402eb4
Capabilities:
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
in al, dx
sub esp, 0x54
push ebx
push esi
stosd dword es:[edi], eax
jne 0x402ed1
push edi
mov ebp, dword [ebp + 0x10]
mov dword [ebp - 8], esi
test edi, edi
pop es
mov dword [ebp - 8], RegEnumValueA
and dword [ebp - 4], 0
mov ebx, edi
test edi, edi
jne 0x402ede
cld
add byte [ebx + 0x75ff85df], cl
add eax, 0x40701cbb
add byte [ebx - 0x3f7af7bb], cl
mov ebx, sym.imp.ADVAPI32.dll_RegCloseKey
mov eax, dword [ebp + 8]
test eax, eax
jl 0x402ef3
mov ecx, dword [0x423eb8]
add ecx, eax
push ecx
call 0x104030d6
lea eax, [ebp + 0x14]
push 4
push eax
call fcn.004030a4
test eax, eax
je 0x404092
test byte [ebp + 0x17], 0x80
je 0x403038
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40af90
mov dword [ebp - 0xc], eax
call fcn.00405ef2
and dword [ebp + 0x14], 0x7fffffff
mov eax, dword [ebp + 0x14]
mov dword [ebp + 8], eax
jle 0x40309a
mov esi, 0x4000
cmp dword [ebp + 0x14], esi
jge 0x402f43
mov esi, dword [ebp + 0x14]
mov edi, 0x40b01c
push esi
push edi
call fcn.004030a4
test eax, eax
je 0x403092
sub dword [ebp + 0x14], esi
mov dword [0x40afa8], edi
mov dword [0x40afac], esi
mov eax, dword [ebp - 8]
mov ebp, 0x40af90
mov dword [0x840afb0], ebx
mov dword [0x40afb4], eax
call fcn.00405e94
test eax, eax
mov dword [ebp - 0x14], eax
jl 0x403030
mov esi, dword [0x40afb0]
sub esi, ebx
call dword [0x40308c]
test byte [0x423f14], 0x21
aas
inc edx
add byte [ecx], ah
mov edi, eax
je 0x402fe5
sub eax, dword [ebp - 0xc]
cmp eax, 0x88c8
ja 0x402fb2
cmp dword [ebp + 0x1c], 0
jne 0x402fe5
mov ecx, dword [ecx + 8]
push dword [ebp - 0x78]
sub eax, dword [ebp + 0x14]
push 0x64
push eax
call dword [0x80407130]
push eax
lea eax, [ebp - 0x54]
push str....__d__
inc eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x53]
push eax
push 0
call fcn.00404e23
mov dword [ebp - 0xc], edi
xor eax, eax
cmp esi, eax
je 0x403025
cmp dword [ebp + 0x10], eax
jne 0x40300e
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push dword [ebp + 0xc]
call dword [0x607128]
test eax, eax
je 0x403034
cmp dword [ebp - 0x10], esi
je 0x403034
add dword [ebp - 4], esi
jmp 0x402f9a
add dword [ebp - 4], edi
sub dword [ebp - 8], esi
mov dword [0x40afb0], ebx
cmp dword [ebp - 0x14], 1
je 0x40309a
jmp 0x402f66
cmp dword [ebp + 0x14], eax
jg 0x402f36
jmp 0x40309a
push 0xfffffffffffffffc
jmp 0x403074
push 0xfffffffffffffffe
jmp 0x403094
test edi, edi
jne 0x40307f
cmp dword [ebp + 0x14], 0
jle 0x40309a
mov esi, dword [ebp - 8]
cmp dword [ebp + 0x14], esi
pop ebp
add ecx, dword [ebx + 0x1cbf1475]
mov al, 0x40
add byte [esi + 0x57], dl
call 0xc030a4
test eax, eax
je 0x40308e
lea eax, [ebp + 0x10]
push 0
push eax
push esi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403034
sub byte [ecx + 0x40], dh
add byte [ebp + 0x3bc274c0], al
jne 0x403085
cmp esi, dword [ebp + 0x10]
adc byte [ebp - 0x43], dh
jne 0x403034
add dword [ebp - 4], esi
test eax, 0xbdeb1475
cmp dword [ebp + 0x14], esi
jg 0x403007
mov esi, dword [ebp + 0x14]
jne 0x40309b
push esi
push edi
call fcn.004030a4
test eax, eax
jne 0x403097
push 0xfffffffffffffffd
pop eax
jmp 0x4030bd
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
inc ebp
cld
pop edi
pop esi
jnp 0x40306a
ret 0x111
sub al, 0x75
inc eax
add byte [ebp + 0x390a74c0], al
jne 0x4030d4
jne 0x4030cf
push 1
pop eax
jmp 0x4030d1
xor eax, eax
pop esi
pop ebp
ret 8
or byte [eax], al
cmp ah, bh
inc ecx
add dh, dh
inc ecx
adc al, 0x20
lea edi, [ecx + 0x14]
je 0x4041b1
push eax
push eax
push 0xf1
push 0xc0a
jg 0x404126
or al, 0xff
rcl dword [eax - 1], cl
fimul dword [ebx + 0x1e0830f]
and ecx, 0xfffffffe
push eax
or ecx, eax
mov dword [edi], ecx
call 0x3e15
call fcn.004041c7
cmp dword [ebp + 4], 0x4e
jne 0x4041a2
push 0x83e8
push dword [ebp + 8]
call ebx
stosd dword es:[edi], eax
jge 0x4040f9
cmp dword [edi + 8], 0x70b
jge 0x404160
cmp dword [edi + 0xc], 0x201
jne 0x404160
mov ecx, dword [ebp + 0x1c]
mov edx, dword [edi + 0x18]
mov dword [ebp - 8], ecx
sub ecx, dword [edx + 0x800f983]
add byte [eax], al
leave
sbb al, 0x8b
push edi
sbb byte [ecx - 0x75d407b3], cl
cmp ecx, 0
or byte [eax], al
add cl, cl
push ebp
hlt
inc eax
add byte [eax + 2], ch
jg 0x40412c
or byte [esi], ch
inc edi
mov ebx, dword [sym.imp.USER32.dll_SetCursor]
push eax
mov ebp, 0x6a016ac3
add byte [edx], ch
push dword [ebp - 4]
push 0x4291c0
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push SetBkMode
push 0
call edi
inc eax
invalid
cmp dword [edi + 0x18], 0x700
jne 0x4041b4
cmp dword [edi + 0xc], 0x100
jne 0x4041b4
cmp dword [edi + 0x10], 0xd
jne 0x404189
bound eax, qword [eax]
push 1
push 0x111
div dword [0x423e68]
call esi
cmp dword [edi + 0x10], 0x1b
jno 0x40419d
push 0
push 0
push 0x10
jg 0x4041cb
push 0xff00423e
salc
push 1
pop eax
jmp 0x4041c0
cmp dword [ebp + 0xc], 0x40b
jne 0x4041b1
inc dword [0x420444]
mov edi, dword [ebp + 0x14]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call 0xfe403e5a
pop edi
pop esi
pop ebx
leave
ret 0x10
inc edx
add byte [eax], al
mov eax, dword [0x41f42c]
jne 0x4041da
mov eax, dword [0x42245c]
push 1
push 1
push 0xf4
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
ret