Function at 0x40104a
Capabilities:
Execute shellcode via indirect call
Query or enumerate registry value

Disassembly:
call 0x40109f
push eax
call sub.KERNEL32.dll_ExitProcess
imul esi, dword [edx + 0x6e], 0x6c
outsb dx, byte [esi]
outsb dx, byte cs:[esi]
add byte gs:[ebx + 0x6f], dl
je 0x401091
popal
jb 0x401082
pop esp
inc esi
insb byte es:[edi], dx
jns 0x401075
imul edi, dword [ecx + 0x5c], 0x45
pop esp
dec ecx
outsb dx, byte [esi]
jae 0x40109f
popal
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [esi + 0x61], al
imul ebp, dword [ebp + 0x64], 0x206f7420
popal
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ecx + 0x74], sp
and byte gs:[ebp + 0x65], ch
insd dword es:[edi], dx
outsd dx, dword [esi]
jb 0x4010c1
and dword [eax], eax
push eax
popal
je 0x4010b6
add byte [ebp + 0x72], al
jb 0x4010c2
jb 0x401055
inc edi
je 0x4010a7
ja 0x4010af
outsd dx, dword [esi]
arpl word [ebx], bp
dec esi
outsd dx, dword [esi]
je 0x401084
outsw dx, word [esi]
jne 0x4010d6
and byte fs:[eax + ebp*2 + 0x65], dh
and byte [ebx + 0x65], ch
jb 0x4010e0
insb byte es:[edi], dx
and byte [ecx + ebp*2 + 0x62], ch
jb 0x4010db
insb byte es:[edi], dx
imul esp, dword [edx + 0x72], 0x20797261
outsd dx, dword [esi]
jb 0x4010a0
jb 0x4010f5
and byte [edi + 0x72], ch
and byte [eax + ebp*2 + 0x65], dh
and byte [ebx + 0x65], ch
je 0x4010ea
and byte gs:[ebx + 0x65], ch
imul esp, dword [ebp + 0x72], 0x6e
jb 0x4010f6
insb byte es:[edi], dx
and byte [ecx + ebp*2 + 0x62], ch
jb 0x4010f1
jb 0x40110b
jns 0x4010b3
and byte [ecx + 0x73], ch
and byte [ecx + 0x6e], ch
jbe 0x4010fb
imul esi, dword [ebx + 0x20], 0x61766e69
insb byte es:[edi], dx
imul esp, dword [ecx], 0x81ec8b55
invalid
push ebp
mov ebp, esp
add esp, 0xfffffef0
lea eax, [ebp - 0x10c]
push eax
dec dword [ebp - 0x10b7b]
call dword [eax + 0x68]
sbb dword [eax], eax
add al, byte [eax]
push 0x20019
add byte [edx], ch
push 0
push 0x401015
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011b3
inc ecx
add dword [eax], eax
add byte [ebx - 0x7af0ff08], al
in eax, 0
add byte [eax], al
mov dword [ebp - 0x110], 0x103
add byte [eax], al
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
invalid
test esp, edi
invalid
push 0x40104a
push dword [ebp - 0x10c]
hlt
call sub.ADVAPI32.dll_RegQueryValueExA
adc al, byte [ecx]
add byte [eax], al
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011b3
test dword [ebx - 0x73000000], esp
test esp, edi
invalid
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40112f
mov word [ebx], 0x5c
push 0x40100b
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011b3
mov dword [ebp - 0x108], eax
push 0x401055
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x4011a8
push 0x3e8
call eax
test eax, eax
je 0x4011a8
push eax
push 0x40
push 0x3000
push 0x10000
push 0
call sub.KERNEL32.dll_VirtualAlloc
test eax, eax
je 0x401195
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
lea eax, [0x40104f]
jmp 0x4011b9
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
lea eax, [0x40102f]
jmp 0x4011b9
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
lea eax, [0x401060]
push 0x10
push 0x40104f
push eax
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret