Function at 0x40e9db
Capabilities:
Get session user name
Get system information on windows
Query or enumerate registry value
Set registry value

Disassembly:
push 0xb34
mov eax, 0x42ef40
call fcn.0042d090
mov ebx, edx
mov dword [ebp - 0xaf4], ebx
mov dword [ebp - 0xb0c], ecx
push dword [ebx + 0xc]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
and dword [ebp - 0xaf0], 0
mov dword [ebp - 0xaf8], eax
lea eax, [ebp - 0xae4]
mov dword [ebp - 0xaec], 0x200
mov dword [ebp - 0xae8], eax
and dword [ebp - 4], 0
lea ecx, [ebp - 0x8c8]
mov edx, dword [ebx]
mov esi, 0xfde9
push esi
push 0xffffffffffffffff
call fcn.00409d37
pop ecx
pop ecx
mov ecx, dword [ebp - 0xaf4]
mov edi, eax
mov eax, str.Try_catch__just_an_except_
mov ebx, str.Real_Crash
mov edx, str.Exception_From:
cmp byte [ecx + 8], 0
lea ecx, [ebp - 0xaf0]
cmove ebx, eax
call fcn.0040a70c
mov edx, edi
mov ecx, eax
call fcn.0040a596
mov edi, 0x43a188
mov ecx, eax
mov edx, edi
call fcn.0040a70c
mov edx, str.Real_crash_or_try_catch:
mov ecx, eax
call fcn.0040a70c
mov edx, ebx
mov ecx, eax
call fcn.0040a70c
mov edx, edi
mov ecx, eax
call fcn.0040a70c
mov edx, edi
mov ecx, eax
call fcn.0040a70c
push 0
push 1
lea ecx, [ebp - 0x8c8]
call fcn.00408008
mov ebx, dword [ebp - 0xaf8]
test ebx, ebx
je 0x40ecfd
mov edi, dword [ebp - 0xaf4]
mov eax, dword [edi + 0x18]
test eax, eax
je 0x40ecf8
mov eax, dword [eax + 4]
lea ecx, [ebp - 0x8e0]
mov edx, ebx
push dword [eax + 0xb8]
call fcn.0040fdfb
pop ecx
mov ecx, dword [edi + 0x18]
mov edi, dword [edi + 0xc]
mov dword [ebp - 0xafc], eax
mov dword [ebp - 0x8b4], 8
mov edx, dword [ecx + 4]
mov dword [ebp - 0xb18], 4
mov ecx, dword [edx + 0xb8]
mov dword [ebp - 0x8b8], ecx
mov ecx, dword [edx + 0xbc]
mov edx, str.Exception_PID:
mov dword [ebp - 0xb1c], ecx
lea ecx, [ebp - 0xaf0]
call fcn.0040a70c
push 0xa
mov ebx, eax
lea eax, [ebp - 0x30]
push 0x20
push eax
push edi
call fcn.00422776
lea edx, [ebp - 0x30]
mov ecx, ebx
call fcn.0040a70c
mov ecx, dword [ebp - 0xaf4]
mov edx, 0x43a188
mov ebx, dword [ecx + 0x10]
mov ecx, eax
call fcn.0040a70c
mov edx, str.Exception_TID:
mov ecx, eax
call fcn.0040a70c
push 0xa
mov edi, eax
lea eax, [ebp - 0x50]
push 0x20
push eax
push ebx
call fcn.00422776
add esp, 0x20
lea edx, [ebp - 0x50]
mov ecx, edi
call fcn.0040a70c
mov ebx, 0x43a188
mov ecx, eax
mov edx, ebx
call fcn.0040a70c
mov edx, str.Exception_Module:
mov ecx, eax
call fcn.0040a70c
mov edx, dword [ebp - 0xafc]
mov ecx, eax
call fcn.0040a596
mov edx, 0x43a278
mov ecx, eax
call fcn.0040a70c
lea edx, [ebp - 0xb1c]
mov ecx, eax
call fcn.0040fd2e
mov dl, 0x3a
mov ecx, eax
call fcn.0040a22b
lea edx, [ebp - 0x8b8]
mov ecx, eax
call fcn.0040fd2e
mov edx, ebx
mov ecx, eax
call fcn.0040a70c
push 0
push 1
lea ecx, [ebp - 0x8e0]
call fcn.00408008
mov ebx, dword [ebp - 0xaf4]
mov eax, dword [ebx + 0x18]
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x8b8], ecx
xor eax, eax
mov dword [ebp - 0x8b4], 8
cmp ecx, dword [eax*8 + 0x440b60]
je 0x40ec38
inc eax
cmp eax, 0x1b
jb 0x40ec22
mov edi, str.an_Unknown_exception_type
jmp 0x40ec3f
mov edi, dword [eax*8 + 0x440b64]
mov edx, str.Exception_Type:
lea ecx, [ebp - 0xaf0]
call fcn.0040a70c
mov edx, edi
mov ecx, eax
call fcn.0040a70c
mov edx, str.__0x
mov ecx, eax
call fcn.0040a70c
lea edx, [ebp - 0x8b8]
mov ecx, eax
call fcn.0040fd2e
mov edx, 0x43a2b0
mov ecx, eax
call fcn.0040a70c
mov eax, dword [ebx + 0x18]
mov ecx, dword [eax]
cmp dword [ecx], 0xc0000005
jne 0x40ecf2
cmp dword [ecx + 0x10], 2
jb 0x40ecf2
mov eax, dword [ecx + 0x18]
mov edi, str.Write_to
cmp dword [ecx + 0x14], 0
mov edx, 0x43a318
mov dword [ebp - 0x8b8], eax
lea ecx, [ebp - 0xaf0]
mov eax, str.Read_from
mov dword [ebp - 0x8b4], 8
cmove edi, eax
call fcn.0040a70c
mov edx, edi
mov ecx, eax
call fcn.0040a70c
mov edx, str._location_0x
mov ecx, eax
call fcn.0040a70c
lea edx, [ebp - 0x8b8]
mov ecx, eax
call fcn.0040fd2e
mov edx, str._caused_an_access_violation._r_n
mov ecx, eax
call fcn.0040a70c
mov ebx, dword [ebp - 0xaf8]
mov edi, 0x43a188
lea eax, [ebp - 0xb14]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov edx, str.Exception_Time:
lea ecx, [ebp - 0xaf0]
call fcn.0040a70c
lea edx, [ebp - 0xb14]
mov ecx, eax
call fcn.0040f266
mov edx, edi
mov ecx, eax
call fcn.0040a70c
mov edx, edi
mov ecx, eax
call fcn.0040a70c
test ebx, ebx
je 0x40ee27
lea eax, [ebp - 0x898]
push eax
lea eax, [ebp - 0x8a0]
push eax
lea eax, [ebp - 0x8a8]
push eax
lea eax, [ebp - 0x8b0]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x40edc0
mov ecx, dword [ebp - 0xb14]
sub ecx, dword [ebp - 0x8b0]
mov eax, dword [ebp - 0xb10]
sbb eax, dword [ebp - 0x8ac]
push 0
push 0x2710
push eax
push ecx
call fcn.0042dd10
mov dword [ebp - 0x8b4], edx
lea ecx, [ebp - 0xaf0]
mov edx, str.Process_Uptime:
mov dword [ebp - 0x8b8], eax
call fcn.0040a70c
lea edx, [ebp - 0x8b8]
mov ecx, eax
call fcn.0040fd83
mov edx, edi
mov ecx, eax
call fcn.0040a70c
mov edx, ebx
lea ecx, [ebp - 0x8c8]
call fcn.0040f137
push esi
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x8e0]
call fcn.00409dad
pop ecx
mov edx, str.Command_Line:
lea ecx, [ebp - 0xaf0]
mov edi, eax
call fcn.0040a70c
mov edx, edi
mov ecx, eax
call fcn.0040a596
mov edi, 0x43a188
mov ecx, eax
mov edx, edi
call fcn.0040a70c
push 0
push 1
lea ecx, [ebp - 0x8e0]
call fcn.00408008
lea ecx, [ebp - 0x8c8]
mov byte [ebp - 4], 0
call fcn.00402610
mov edx, edi
lea ecx, [ebp - 0xaf0]
call fcn.0040a70c
push 0x800
lea eax, [ebp - 0x890]
push 0
push eax
call fcn.00419740
add esp, 0xc
mov dword [ebp - 0xb00], 0x400
lea eax, [ebp - 0xb00]
push eax
lea eax, [ebp - 0x890]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x40ee85
push 0x43a364
lea eax, [ebp - 0x890]
push 0x400
push eax
call fcn.00422b47
add esp, 0xc
push esi
push 0xffffffffffffffff
lea edx, [ebp - 0x890]
lea ecx, [ebp - 0x8e0]
call fcn.00409d37
pop ecx
pop ecx
mov edx, str.Username:
lea ecx, [ebp - 0xaf0]
mov esi, eax
call fcn.0040a70c
mov edx, esi
mov ecx, eax
call fcn.0040a596
mov edx, edi
mov ecx, eax
call fcn.0040a70c
push 0
push 1
lea ecx, [ebp - 0x8e0]
call fcn.00408008
push 0x40
pop esi
push esi
lea eax, [ebp - 0x90]
push 0
push eax
call fcn.00419740
and dword [ebp - 0xb08], 0
lea eax, [ebp - 0xb04]
add esp, 0xc
mov dword [ebp - 0xb04], esi
mov esi, 0x439b98
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0xb08]
push eax
push esi
push str.SoftwareSogouExplorer
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x40ef9e
and dword [ebp - 0x8c0], 0
lea edi, [ebp - 0x8bc]
xor eax, eax
lea ecx, [ebp - 0x8c0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.004140e0
test al, al
je 0x40ef6c
push dword [ebp - 0x8b4]
lea eax, [ebp - 0x90]
push dword [ebp - 0x8b8]
push dword [ebp - 0x8bc]
push dword [ebp - 0x8c0]
push 0x439bb0
push eax
call fcn.0040d5b1
add esp, 0x18
lea ecx, [ebp - 0x90]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40ef75
sub ecx, edx
lea eax, [ebp - 0x90]
push ecx
push eax
push 1
push esi
push str.SoftwareSogouExplorer
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov edi, 0x43a188
mov edx, str.HID:
lea ecx, [ebp - 0xaf0]
call fcn.0040a70c
lea edx, [ebp - 0x90]
mov ecx, eax
call fcn.0040a70c
mov edx, edi
mov ecx, eax
call fcn.0040a70c
mov edx, str.OS_Version:
mov ecx, eax
call fcn.0040a70c
mov ecx, eax
call fcn.0040f31a
mov edx, edi
mov ecx, eax
call fcn.0040a70c
lea eax, [ebp - 0xb40]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [ebp - 0xb2c]
lea ecx, [ebp - 0xaf0]
mov edx, str.Processor:
call fcn.0040a70c
push 0xa
mov edi, eax
lea eax, [ebp - 0x50]
push 0x20
push eax
push esi
call fcn.00422776
lea edx, [ebp - 0x50]
mov ecx, edi
call fcn.0040a70c
mov esi, dword [ebp - 0xb28]
mov edx, str._processor_s___Type:
mov ecx, eax
call fcn.0040a70c
push 0xa
mov edi, eax
lea eax, [ebp - 0x30]
push 0x20
push eax
push esi
call fcn.00422776
add esp, 0x20
lea edx, [ebp - 0x30]
mov ecx, edi
call fcn.0040a70c
mov esi, 0x43a188
mov ecx, eax
mov edx, esi
call fcn.0040a70c
mov edx, str.Memory:
lea ecx, [ebp - 0xaf0]
call fcn.0040a70c
mov ecx, eax
call fcn.0040f4a3
mov edx, esi
mov ecx, eax
call fcn.0040a70c
mov edi, str._r_n_r_n____________________________________________________r_n
test ebx, ebx
je 0x40f0b8
mov edx, edi
mov dword [ebp - 0xafc], ebx
lea ecx, [ebp - 0xaf0]
call fcn.0040a70c
mov edx, str.Modules:__r_n_r_n
mov ecx, eax
call fcn.0040a70c
lea edx, [ebp - 0xafc]
mov ecx, eax
call fcn.0040f6bd
mov edx, esi
mov ecx, eax
call fcn.0040a70c
mov edx, edi
lea ecx, [ebp - 0xaf0]
call fcn.0040a70c
mov edx, str.Processes:__r_n_r_n
mov ecx, eax
call fcn.0040a70c
mov ecx, eax
call fcn.0040fb8e
mov edx, esi
mov ecx, eax
call fcn.0040a70c
test ebx, ebx
je 0x40f0ec
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xaf0]
mov eax, dword [ebp - 0xae8]
push ecx
mov ecx, dword [ebp - 0xb0c]
push edx
mov byte [eax + edx], 0
mov edx, str.errorlog.txt
push dword [ebp - 0xae8]
call fcn.0041178a
lea eax, [ebp - 0xae4]
add esp, 0xc
cmp dword [ebp - 0xae8], eax
je 0x40f131
push dword [ebp - 0xae8]
call fcn.0041aac0
pop ecx
call fcn.0042d04b
ret