Function at 0x46172e
Capabilities:
Get session user name
Get system information on windows
Query or enumerate registry value
Set registry value

Disassembly:
push 0xb2c
mov eax, 0x4b9d73
call fcn.00469c08
mov esi, edx
mov dword [ebp - 0xaf4], esi
mov dword [ebp - 0xb04], ecx
push dword [esi + 0xc]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
lea ecx, [ebp - 0xaec]
mov dword [ebp - 0xaf0], ebx
call fcn.00411071
and dword [ebp - 4], 0
lea ecx, [ebp - 0x8c8]
mov edx, dword [esi]
push 0xfde9
push 0xffffffffffffffff
call fcn.0042218f
pop ecx
pop ecx
mov edi, 0x4d558c
mov byte [ebp - 4], 1
cmp byte [esi + 8], 0
mov edx, str.Try_catch__just_an_except_
push edi
push edi
mov ecx, str.Real_Crash
cmove ecx, edx
push ecx
push str.Real_crash_or_try_catch:
push edi
push eax
lea eax, [ebp - 0xaec]
push str.Exception_From:
push eax
call fcn.00412821
pop ecx
pop ecx
push eax
call fcn.004126ba
pop ecx
pop ecx
push eax
call fcn.00412821
pop ecx
pop ecx
push eax
call fcn.00412821
pop ecx
pop ecx
push eax
call fcn.00412821
pop ecx
pop ecx
push eax
call fcn.00412821
pop ecx
pop ecx
push eax
call fcn.00412821
pop ecx
pop ecx
lea ecx, [ebp - 0x8c8]
mov byte [ebp - 4], 0
call fcn.0041207b
test ebx, ebx
je 0x461a37
mov eax, dword [esi + 0x18]
test eax, eax
je 0x461a37
mov eax, dword [eax + 4]
lea ecx, [ebp - 0x8e0]
mov edx, ebx
push dword [eax + 0xb8]
call 0x462be6
mov ebx, eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0xaec]
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0xc]
mov dword [esp], str.Exception_PID:
push eax
mov edx, dword [ecx + 4]
mov dword [ebp - 0x8b4], 8
mov dword [ebp - 0xb10], 4
mov ecx, dword [edx + 0xb8]
mov dword [ebp - 0x8b8], ecx
mov ecx, dword [edx + 0xbc]
mov dword [ebp - 0xb14], ecx
call fcn.00412821
push 0xa
mov esi, eax
lea eax, [ebp - 0x30]
push 0x20
push eax
push edi
call fcn.0046f4ee
lea eax, [ebp - 0x30]
push eax
push esi
call fcn.00412821
mov edi, dword [ebp - 0xaf4]
add esp, 0x20
mov edi, dword [edi + 0x10]
push str.Exception_TID:
push 0x4d558c
push eax
call fcn.00412821
pop ecx
pop ecx
push eax
call fcn.00412821
push 0xa
mov esi, eax
lea eax, [ebp - 0x50]
push 0x20
push eax
push edi
call fcn.0046f4ee
lea eax, [ebp - 0x50]
push eax
push esi
call fcn.00412821
add esp, 0x20
mov edi, 0x4d558c
push edi
push 0x3a
push 0x4d6d10
push ebx
push str.Exception_Module:
push edi
push eax
call fcn.00412821
pop ecx
pop ecx
push eax
call fcn.00412821
pop ecx
pop ecx
push eax
call fcn.004126ba
pop ecx
pop ecx
push eax
call fcn.00412821
pop ecx
pop ecx
lea edx, [ebp - 0xb14]
mov ecx, eax
call fcn.00462b15
push eax
call fcn.0041f997
pop ecx
pop ecx
lea edx, [ebp - 0x8b8]
mov ecx, eax
call fcn.00462b15
push eax
call fcn.00412821
pop ecx
pop ecx
lea ecx, [ebp - 0x8e0]
mov byte [ebp - 4], 0
call fcn.0041207b
mov esi, dword [ebp - 0xaf4]
push 8
pop ebx
mov dword [ebp - 0x8b4], ebx
mov eax, dword [esi + 0x18]
mov eax, dword [eax]
mov ecx, dword [eax]
xor eax, eax
mov dword [ebp - 0x8b8], ecx
cmp ecx, dword [eax*8 + 0x4f0ba0]
je 0x461971
inc eax
cmp eax, 0x1b
jb 0x46195b
mov eax, str.an_Unknown_exception_type
jmp 0x461978
mov eax, dword [eax*8 + 0x4f0ba4]
push 0x4d6d4c
push str.__0x
push eax
lea eax, [ebp - 0xaec]
push str.Exception_Type:
push eax
call fcn.00412821
pop ecx
pop ecx
push eax
call fcn.00412821
pop ecx
pop ecx
push eax
call fcn.00412821
pop ecx
pop ecx
lea edx, [ebp - 0x8b8]
mov ecx, eax
call fcn.00462b15
push eax
call fcn.00412821
mov eax, dword [esi + 0x18]
pop ecx
pop ecx
mov ecx, dword [eax]
cmp dword [ecx], 0xc0000005
jne 0x461a31
cmp dword [ecx + 0x10], 2
jb 0x461a31
mov eax, dword [ecx + 0x18]
mov edx, str.Read_from
cmp dword [ecx + 0x14], 0
mov dword [ebp - 0x8b8], eax
mov eax, str.Write_to
push str._caused_an_access_violation._r_n
push str._location_0x
cmove eax, edx
mov dword [ebp - 0x8b4], ebx
push eax
lea eax, [ebp - 0xaec]
push 0x4d6dd8
push eax
call fcn.00412821
pop ecx
pop ecx
push eax
call fcn.00412821
pop ecx
pop ecx
push eax
call fcn.00412821
pop ecx
pop ecx
lea edx, [ebp - 0x8b8]
mov ecx, eax
call fcn.00462b15
push eax
call fcn.00412821
pop ecx
pop ecx
mov ebx, dword [ebp - 0xaf0]
lea eax, [ebp - 0xb0c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 0xaec]
push str.Exception_Time:
push eax
call fcn.00412821
pop ecx
mov esi, eax
lea eax, [ebp - 0x8b8]
pop ecx
push eax
lea eax, [ebp - 0xb0c]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
test eax, eax
je 0x461a80
lea edx, [ebp - 0x8b8]
mov ecx, esi
call 0x461f41
mov esi, eax
push edi
push edi
push esi
call fcn.00412821
pop ecx
pop ecx
push eax
call fcn.00412821
pop ecx
pop ecx
test ebx, ebx
je 0x461b85
lea eax, [ebp - 0x898]
push eax
lea eax, [ebp - 0x8a0]
push eax
lea eax, [ebp - 0x8a8]
push eax
lea eax, [ebp - 0x8b0]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x461b1c
mov ecx, dword [ebp - 0xb0c]
sub ecx, dword [ebp - 0x8b0]
mov eax, dword [ebp - 0xb08]
sbb eax, dword [ebp - 0x8ac]
push 0
push 0x2710
push eax
push ecx
call fcn.00469dc0
push edi
mov dword [ebp - 0x8b8], eax
lea eax, [ebp - 0xaec]
push str.Process_Uptime:
push eax
mov dword [ebp - 0x8b4], edx
call fcn.00412821
pop ecx
pop ecx
lea edx, [ebp - 0x8b8]
mov ecx, eax
call 0x462b6c
push eax
call fcn.00412821
pop ecx
pop ecx
mov edx, ebx
lea ecx, [ebp - 0x8c8]
call fcn.004252fb
push 0xfde9
push eax
lea eax, [ebp - 0x8e0]
mov byte [ebp - 4], 3
push eax
call fcn.00412653
add esp, 0xc
push edi
push eax
lea eax, [ebp - 0xaec]
mov byte [ebp - 4], 4
push str.Command_Line:
push eax
call fcn.00412821
pop ecx
pop ecx
push eax
call fcn.004126ba
pop ecx
pop ecx
push eax
call fcn.00412821
pop ecx
pop ecx
lea ecx, [ebp - 0x8e0]
call fcn.0041207b
lea ecx, [ebp - 0x8c8]
mov byte [ebp - 4], 0
call fcn.004123b1
lea eax, [ebp - 0xaec]
push edi
push eax
call fcn.00412821
push 0x800
lea eax, [ebp - 0x890]
push 0
push eax
call fcn.0046d6f0
add esp, 0x14
lea eax, [ebp - 0xaf8]
mov esi, 0x400
mov dword [ebp - 0xaf8], esi
push eax
lea eax, [ebp - 0x890]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x461be0
push str.Unknown
lea eax, [ebp - 0x890]
push esi
push eax
call fcn.0047988b
add esp, 0xc
push 0xfde9
push 0xffffffffffffffff
lea edx, [ebp - 0x890]
lea ecx, [ebp - 0x8e0]
call fcn.0042218f
pop ecx
pop ecx
push edi
push eax
lea eax, [ebp - 0xaec]
mov byte [ebp - 4], 5
push str.Username:
push eax
call fcn.00412821
pop ecx
pop ecx
push eax
call fcn.004126ba
pop ecx
pop ecx
push eax
call fcn.00412821
pop ecx
pop ecx
lea ecx, [ebp - 0x8e0]
mov byte [ebp - 4], 0
call fcn.0041207b
push 0x40
pop esi
push esi
lea eax, [ebp - 0x90]
push 0
push eax
call fcn.0046d6f0
and dword [ebp - 0xb00], 0
lea eax, [ebp - 0xafc]
add esp, 0xc
mov dword [ebp - 0xafc], esi
mov esi, 0x4d61c8
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0xb00]
push eax
push esi
push str.SoftwareSogouExplorer
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x461d0b
and dword [ebp - 0x8c0], 0
lea edi, [ebp - 0x8bc]
xor eax, eax
lea ecx, [ebp - 0x8c0]
stosd dword es:[edi], eax
xor edx, edx
push 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0042b729
pop ecx
test al, al
je 0x461cd9
push dword [ebp - 0x8b4]
lea eax, [ebp - 0x90]
push dword [ebp - 0x8b8]
push dword [ebp - 0x8bc]
push dword [ebp - 0x8c0]
push str._08X_08X_08X_08X
push eax
call fcn.0041e8d9
add esp, 0x18
lea ecx, [ebp - 0x90]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x461ce2
sub ecx, edx
lea eax, [ebp - 0x90]
push ecx
push eax
push 1
push esi
push str.SoftwareSogouExplorer
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov edi, 0x4d558c
push edi
push str.OS_Version:
push edi
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0xaec]
push str.HID:
push eax
call fcn.00412821
pop ecx
pop ecx
push eax
call fcn.00412821
pop ecx
pop ecx
push eax
call fcn.00412821
pop ecx
pop ecx
push eax
call fcn.00412821
pop ecx
pop ecx
mov ecx, eax
call fcn.00461fdf
push eax
call fcn.00412821
pop ecx
pop ecx
lea eax, [ebp - 0xb38]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov edi, dword [ebp - 0xb24]
lea eax, [ebp - 0xaec]
push str.Processor:
push eax
call fcn.00412821
push 0xa
mov esi, eax
lea eax, [ebp - 0x50]
push 0x20
push eax
push edi
call fcn.0046f4ee
lea eax, [ebp - 0x50]
push eax
push esi
call fcn.00412821
mov esi, dword [ebp - 0xb20]
push str._processor_s___Type:
push eax
call fcn.00412821
push 0xa
mov edi, eax
lea eax, [ebp - 0x30]
push 0x20
push eax
push esi
call fcn.0046f4ee
add esp, 0x38
lea eax, [ebp - 0x30]
push 0x4d558c
push eax
push edi
call fcn.00412821
pop ecx
pop ecx
push eax
call fcn.00412821
pop ecx
pop ecx
mov edi, 0x4d558c
lea eax, [ebp - 0xaec]
push edi
push str.Global_Memory:
push eax
call fcn.00412821
pop ecx
pop ecx
mov ecx, eax
call 0x4620d5
push eax
call fcn.00412821
mov esi, str._r_n_r_n____________________________________________________r_n
pop ecx
pop ecx
test ebx, ebx
je 0x461eb6
push edi
push str.Process_HeapMemory:__r_n
lea eax, [ebp - 0xaec]
mov dword [ebp - 0xaf0], ebx
push esi
push eax
call fcn.00412821
pop ecx
pop ecx
push eax
call fcn.00412821
pop ecx
pop ecx
lea edx, [ebp - 0xaf0]
mov ecx, eax
call 0x4622d7
push eax
call fcn.00412821
mov edi, dword [ebp - 0xaf4]
lea eax, [ebp - 0xaec]
pop ecx
pop ecx
push str.GDI_Handles:__r_n_r_n
mov edi, dword [edi + 0xc]
push esi
push eax
call fcn.00412821
pop ecx
pop ecx
push eax
call fcn.00412821
mov esi, eax
mov edx, ebx
push edi
mov ecx, esi
call 0x461650
mov edi, 0x4d558c
push edi
push esi
call fcn.00412821
add esp, 0x14
mov dword [ebp - 0xaf4], ebx
mov esi, str._r_n_r_n____________________________________________________r_n
lea eax, [ebp - 0xaec]
push edi
push str.Modules:__r_n_r_n
push esi
push eax
call fcn.00412821
pop ecx
pop ecx
push eax
call fcn.00412821
pop ecx
pop ecx
lea edx, [ebp - 0xaf4]
mov ecx, eax
call 0x46257a
push eax
call fcn.00412821
pop ecx
pop ecx
push str.Processes:__r_n_r_n
lea eax, [ebp - 0xaec]
push esi
push eax
call fcn.00412821
pop ecx
pop ecx
push eax
call fcn.00412821
pop ecx
pop ecx
push 0
push 2
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
cmp eax, 0xffffffff
je 0x461eee
mov edx, eax
mov ecx, esi
call fcn.0046297b
mov esi, eax
push edi
push esi
call fcn.00412821
pop ecx
pop ecx
test ebx, ebx
je 0x461f02
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xaec]
call fcn.0040c535
lea ecx, [ebp - 0xaec]
mov esi, eax
call fcn.0041298e
push ecx
mov ecx, dword [ebp - 0xb04]
mov edx, str.errorlog.txt
push esi
push eax
call fcn.00464a4e
add esp, 0xc
lea ecx, [ebp - 0xaec]
call fcn.0041104c
call fcn.00469bb2
ret