Function at 0x403ec0
Capabilities:
Copy file
Query or enumerate registry value
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x416768
push 0x407eec
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffa58
mov eax, dword [0x41b2c0]
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x168], 0
mov dword [ebp - 0x164], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x164]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
push SQLCancel
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x403f40
push 0
push 0
push 0
push 0xe0000101
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov byte [ebp - 0x278], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x277]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x388], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x387]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x494], 0
mov edx, 1
test edx, edx
je 0x40407a
mov dword [ebp - 0x5a4], 0x104
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x5a4]
push eax
lea ecx, [ebp - 0x388]
push ecx
mov edx, dword [ebp - 0x494]
push edx
mov eax, dword [ebp - 0x164]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x403fd2
push 0
push 0
push 0
push 0xe0000101
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov dword [ebp - 0x5a4], 0x104
lea ecx, [ebp - 0x5a4]
push ecx
lea edx, [ebp - 0x278]
push edx
push 0
push 0
lea eax, [ebp - 0x388]
push eax
mov ecx, dword [ebp - 0x164]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x404019
push 0
push 0
push 0
push 0xe0000101
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov byte [ebp - 0x175], 0
push 2
lea edx, [ebp - 0x278]
push edx
push 0x416304
call fcn.00407c50
add esp, 0xc
test eax, eax
jne 0x404066
push 0x5c
lea eax, [ebp - 0x278]
push eax
call fcn.00408210
add esp, 8
mov dword [ebp - 0x5a8], eax
cmp dword [ebp - 0x5a8], 0
je 0x404064
mov ecx, dword [ebp - 0x5a8]
mov byte [ecx + 1], 0
jmp 0x40407a
mov edx, dword [ebp - 0x494]
add edx, 1
mov dword [ebp - 0x494], edx
jmp 0x403f7c
mov dword [ebp - 0x27c], 0
mov byte [ebp - 0x5a0], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x59f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x490], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x48f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x276]
push eax
push 0x104
lea ecx, [ebp - 0x5a0]
push ecx
call fcn.00405620
test eax, eax
jl 0x40430c
push str.blackbox.trc
push 0x104
lea edx, [ebp - 0x5a0]
push edx
call fcn.00405660
test eax, eax
jl 0x40430c
lea eax, [ebp - 0x160]
push eax
lea ecx, [ebp - 0x5a0]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0xffffffff
jne 0x404128
push 0
push 0
push 0
push 0xe0000101
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov edx, dword [ebp - 0x16c]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp + 0x10]
push eax
call fcn.00407800
add esp, 4
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 4
jle 0x4041bf
push 0x416318
mov ecx, dword [ebp - 0x27c]
mov edx, dword [ebp + 0x10]
lea eax, [edx + ecx - 4]
push eax
call fcn.00407890
add esp, 8
test eax, eax
jne 0x4041bf
mov ecx, dword [ebp - 0x27c]
sub ecx, 4
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0x104
lea eax, [ebp - 0x490]
push eax
call fcn.004055d0
test eax, eax
jl 0x4041ac
push 0x416320
push 0x104
lea ecx, [ebp - 0x490]
push ecx
call fcn.00405660
test eax, eax
jge 0x4041bd
push 0
push 0
push 0
push 0xe0000101
call dword [sym.imp.KERNEL32.dll_RaiseException]
jmp 0x404203
mov edx, dword [ebp + 0x10]
push edx
push 0x104
lea eax, [ebp - 0x490]
push eax
call fcn.00405620
test eax, eax
jl 0x4041f2
push 0x416328
push 0x104
lea ecx, [ebp - 0x490]
push ecx
call fcn.00405660
test eax, eax
jge 0x404203
push 0
push 0
push 0
push 0xe0000101
call dword [sym.imp.KERNEL32.dll_RaiseException]
lea edx, [ebp - 0x490]
push edx
lea eax, [ebp - 0x5a0]
push eax
call fcn.00407890
add esp, 8
test eax, eax
jne 0x40422e
push 0
push 0
push 0
push 0xe0000101
call dword [sym.imp.KERNEL32.dll_RaiseException]
lea ecx, [ebp - 0x490]
push ecx
lea edx, [ebp - 0x5a0]
push edx
push 0x416330
call fcn.00407cf5
add esp, 0xc
push 0
lea eax, [ebp - 0x490]
push eax
lea ecx, [ebp - 0x5a0]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x40428c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x5ac], eax
cmp dword [ebp - 0x5ac], 0
je 0x404287
mov edx, dword [ebp - 0x5ac]
push edx
call fcn.00405c70
add esp, 4
jmp 0x40430c
push 0
lea eax, [ebp - 0x5b0]
push eax
push 2
push 0x416344
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x490]
push eax
lea ecx, [ebp - 0x5a0]
push ecx
push 0x416348
push 0x41bc40
call fcn.00407ff2
add esp, 0x10
push 0
lea edx, [ebp - 0x5b0]
push edx
push 0x41bc40
call fcn.00407800
add esp, 4
push eax
push 0x41bc40
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [ebp - 0x5b0]
push edx
push 2
push 0x416358
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea edx, [ebp - 0x276]
push edx
push 0x104
lea eax, [ebp - 0x5a0]
push eax
call fcn.00405620
test eax, eax
jl 0x404537
push str.blackbox_1.trc
push 0x104
lea ecx, [ebp - 0x5a0]
push ecx
call fcn.00405660
test eax, eax
jl 0x404537
lea edx, [ebp - 0x160]
push edx
lea eax, [ebp - 0x5a0]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0xffffffff
jne 0x40437e
push 0
push 0
push 0
push 0xe0000101
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov ecx, dword [ebp - 0x16c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [ebp + 0x10]
push edx
call fcn.00407800
add esp, 4
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 4
jle 0x404415
push 0x41636c
mov eax, dword [ebp - 0x27c]
mov ecx, dword [ebp + 0x10]
lea edx, [ecx + eax - 4]
push edx
call fcn.00407890
add esp, 8
test eax, eax
jne 0x404415
mov eax, dword [ebp - 0x27c]
sub eax, 4
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0x104
lea edx, [ebp - 0x490]
push edx
call fcn.004055d0
test eax, eax
jl 0x404402
push 0x416374
push 0x104
lea eax, [ebp - 0x490]
push eax
call fcn.00405660
test eax, eax
jge 0x404413
push 0
push 0
push 0
push 0xe0000101
call dword [sym.imp.KERNEL32.dll_RaiseException]
jmp 0x404459
mov ecx, dword [ebp + 0x10]
push ecx
push 0x104
lea edx, [ebp - 0x490]
push edx
call fcn.00405620
test eax, eax
jl 0x404448
push str..trc
push 0x104
lea eax, [ebp - 0x490]
push eax
call fcn.00405660
test eax, eax
jge 0x404459
push 0
push 0
push 0
push 0xe0000101
call dword [sym.imp.KERNEL32.dll_RaiseException]
lea ecx, [ebp - 0x490]
push ecx
lea edx, [ebp - 0x5a0]
push edx
push str.Copying__s_____s__n
call fcn.00407cf5
add esp, 0xc
push 0
lea eax, [ebp - 0x490]
push eax
lea ecx, [ebp - 0x5a0]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x4044b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x5b4], eax
cmp dword [ebp - 0x5b4], 0
je 0x4044b2
mov edx, dword [ebp - 0x5b4]
push edx
call fcn.00405c70
add esp, 4
jmp 0x404537
push 0
lea eax, [ebp - 0x5b8]
push eax
push 2
push 0x416398
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x490]
push eax
lea ecx, [ebp - 0x5a0]
push ecx
push str.Copied__s_____s
push 0x41bc40
call fcn.00407ff2
add esp, 0x10
push 0
lea edx, [ebp - 0x5b8]
push edx
push 0x41bc40
call fcn.00407800
add esp, 4
push eax
push 0x41bc40
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [ebp - 0x5b8]
push edx
push 2
push 0x4163ac
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 4], 0xffffffff
jmp 0x40455a
cmp dword [ebp - 0x164], 0
je 0x404570
mov edx, dword [ebp - 0x164]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x168]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.00407d96
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret