Function at 0x40108e
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40108e
push eax
call sub.KERNEL32.dll_ExitProcess
inc edi
je 0x40105d
ja 0x401065
outsd dx, dword [esi]
arpl word [ebx], bp
inc ebp
jb 0x40108b
outsd dx, dword [esi]
jb 0x40101c
imul esi, dword [edx + 0x6e], 0x6c
outsb dx, byte [esi]
outsb dx, byte cs:[esi]
add byte gs:[esi + 0x6f], cl
je 0x40104a
outsw dx, word [esi]
jne 0x40109c
and byte fs:[eax + ebp*2 + 0x65], dh
and byte [ebx + 0x65], ch
jb 0x4010a6
insb byte es:[edi], dx
and byte [ecx + ebp*2 + 0x62], ch
jb 0x4010a1
jb 0x4010bb
and byte [edi + 0x72], ch
and byte [eax + ebp*2 + 0x65], dh
and byte [ebx + 0x65], ch
jb 0x4010bc
imul esp, dword [ebp + 0x72], 0x6e
insb byte es:[edi], dx
and byte [ecx + ebp*2 + 0x62], ch
jb 0x4010b7
jb 0x4010d1
and byte [ecx + 0x73], ch
and byte [ecx + 0x6e], ch
outsb dx, byte [esi]
jbe 0x4010c1
insb byte es:[edi], dx
imul esp, dword [ecx], 0x6c6e726b
imul esi, dword [edx + 0x6e], 0x6c
outsb dx, byte [esi]
outsb dx, byte cs:[esi]
jb 0x40106f
push eax
popal
je 0x4010db
add byte [ebx + 0x6f], dl
je 0x4010f0
popal
jb 0x4010e1
pop esp
inc esi
insb byte es:[edi], dx
jns 0x4010d4
imul edi, dword [ecx + 0x5c], 0x45
pop esp
dec ecx
outsb dx, byte [esi]
jae 0x4010fe
popal
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [ebp - 0x75], dl
in al, dx
add esp, 0xfffffef0
lea eax, [ebp - 0x104]
push eax
call fcn.004011e4
call dword [eax - 0x18]
inc ecx
add dword [eax], eax
add byte [eax + 0x65], ch
adc byte [eax], al
add byte [eax], al
push 0x401065
inc eax
add byte [ebp - 0x1037b], cl
call dword [eax - 0x18]
and al, 1
add byte [eax], al
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
add dword [eax], eax
add byte [ebp - 0x617af040], al
ror byte [edi], 0x85
sahf
jne 0x401160
add byte [eax], al
add byte [ebp - 0x10b7b], cl
call dword [eax + 0x68]
sbb dword [eax], eax
add al, byte [eax]
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401074
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
je 0x4010e3
inc eax
add byte [eax + 1], ch
add byte [eax], al
sub al, 0x33
add dword [eax], eax
add byte [ebx - 0x7af0ff08], al
mov eax, 0xc7000000
xor eax, dword [ecx]
add byte [eax], al
cmp eax, 0
jne 0x4011a0
add byte [edi], cl
test dword [eax - 0x39000000], edi
mov dword [ebp - 0x110], 0x103
test eax, esi
invalid
add byte [eax], al
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
call dword [eax + 0x6a]
add byte [edx], ch
push 0x40106f
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a0
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x401145
mov word [ebx], 0x5c
push 0x40101c
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a0
mov dword [ebp - 0x108], eax
push 0x40100b
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x401195
push 0x3e8
call eax
test eax, eax
je 0x401195
call 0x401185
add dword [esp], 0x1e7b
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401016
push 0x401026
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret