Function at 0x45111c
Capabilities:
Get session user name
Get system information on windows
Query or enumerate registry value
Set registry value

Disassembly:
push 0xd2c
mov eax, 0x4a26bc
call fcn.0045cd4f
mov edi, edx
mov dword [ebp - 0xcf0], edi
mov dword [ebp - 0xd0c], ecx
push dword [edi + 0xc]
xor eax, eax
push eax
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
xor ecx, ecx
mov esi, 0x200
mov dword [ebp - 0xcfc], ebx
lea eax, [ebp - 0xce0]
mov dword [ebp - 0xcec], ecx
mov dword [ebp - 0xce8], esi
mov dword [ebp - 0xce4], eax
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0xac8]
mov edi, dword [edi]
call fcn.0041325f
mov byte [ebp - 4], 1
test edi, edi
je 0x45124f
xor eax, eax
cmp word [edi], ax
je 0x45124f
push esi
push eax
lea eax, [ebp - 0x290]
push eax
call fcn.0045e560
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x290]
add esp, 0xc
xor ecx, ecx
push ecx
push ecx
push 0x1ff
push eax
push 0xffffffffffffffff
push edi
push ecx
push 0xfde9
call esi
test eax, eax
jle 0x4511f5
cmp eax, 0x200
jae 0x4519fa
mov byte [ebp + eax - 0x290], 0
lea ecx, [ebp - 0xac8]
lea eax, [ebp - 0x290]
push eax
call fcn.00413f2e
jmp 0x45124f
xor eax, eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push edi
push eax
push 0xfde9
call esi
lea esi, [eax + 1]
lea ecx, [esi + 1]
push ecx
call fcn.0045c5fc
pop ecx
mov dword [ebp - 0xcf4], eax
xor eax, eax
push eax
push eax
push esi
mov esi, dword [ebp - 0xcf4]
push esi
push 0xffffffffffffffff
push edi
push eax
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov byte [eax + esi], 0
test eax, eax
jle 0x451248
push esi
lea ecx, [ebp - 0xac8]
call fcn.00413f2e
push esi
call fcn.0045c850
pop ecx
lea eax, [ebp - 0xac8]
push eax
lea ecx, [ebp - 0xae0]
call fcn.00415fd9
lea ecx, [ebp - 0xac8]
mov byte [ebp - 4], 0
call fcn.004134bc
mov edi, dword [ebp - 0xcf0]
lea ecx, [ebp - 0xcec]
mov eax, str.Try_catch__just_an_except_
mov esi, str.Real_Crash
mov edx, str.Exception_From:
cmp byte [edi + 8], 0
cmove esi, eax
call fcn.00415f57
lea edx, [ebp - 0xae0]
mov ecx, eax
call fcn.0041c6a9
mov edx, 0x4bc964
mov ecx, eax
call fcn.00415f57
mov edx, str.Real_crash_or_try_catch:
mov ecx, eax
call fcn.00415f57
mov edx, esi
mov ecx, eax
call fcn.00415f57
mov esi, 0x4bc964
mov ecx, eax
mov edx, esi
call fcn.00415f57
mov edx, esi
mov ecx, eax
call fcn.00415f57
lea ecx, [ebp - 0xae0]
call fcn.004134bc
test ebx, ebx
je 0x451505
mov eax, dword [edi + 0x18]
test eax, eax
je 0x451505
mov eax, dword [eax + 4]
lea ecx, [ebp - 0xae0]
mov edx, ebx
push dword [eax + 0xb8]
call fcn.0045283d
mov ecx, dword [edi + 0x18]
mov ebx, eax
mov esi, dword [edi + 0xc]
mov dword [ebp - 0xab4], 8
mov dword [ebp - 0xcf4], 4
mov edx, dword [ecx + 4]
mov ecx, dword [edx + 0xb8]
mov dword [ebp - 0xab8], ecx
mov ecx, dword [edx + 0xbc]
mov edx, str.Exception_PID:
mov dword [ebp - 0xcf8], ecx
lea ecx, [ebp - 0xcec]
call fcn.00415f57
push 0xa
mov edi, eax
lea eax, [ebp - 0x30]
push 0x20
push eax
push esi
call fcn.0046228f
lea edx, [ebp - 0x30]
mov ecx, edi
call fcn.00415f57
mov edi, dword [ebp - 0xcf0]
mov edx, 0x4bc964
mov ecx, eax
mov edi, dword [edi + 0x10]
call fcn.00415f57
mov edx, str.Exception_TID:
mov ecx, eax
call fcn.00415f57
push 0xa
mov esi, eax
lea eax, [ebp - 0x50]
push 0x20
push eax
push edi
call fcn.0046228f
add esp, 0x24
lea edx, [ebp - 0x50]
mov ecx, esi
call fcn.00415f57
mov esi, 0x4bc964
mov ecx, eax
mov edx, esi
call fcn.00415f57
mov edx, str.Exception_Module:
mov ecx, eax
call fcn.00415f57
mov edx, ebx
mov ecx, eax
call fcn.0041c6a9
mov edx, 0x4bd648
mov ecx, eax
call fcn.00415f57
lea edx, [ebp - 0xcf8]
mov ecx, eax
call fcn.00452770
mov dl, 0x3a
mov ecx, eax
call fcn.0041cf6b
lea edx, [ebp - 0xab8]
mov ecx, eax
call fcn.00452770
mov edx, esi
mov ecx, eax
call fcn.00415f57
lea ecx, [ebp - 0xae0]
call fcn.004134bc
mov edi, dword [ebp - 0xcf0]
push 8
pop ebx
mov eax, dword [edi + 0x18]
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0xab8], ecx
mov dword [ebp - 0xab4], ebx
xor eax, eax
cmp ecx, dword [eax*8 + 0x4d8cd0]
je 0x451449
inc eax
cmp eax, 0x1b
jb 0x451433
mov esi, str.an_Unknown_exception_type
jmp 0x451450
mov esi, dword [eax*8 + 0x4d8cd4]
mov edx, str.Exception_Type:
lea ecx, [ebp - 0xcec]
call fcn.00415f57
mov edx, esi
mov ecx, eax
call fcn.00415f57
mov edx, str.__0x
mov ecx, eax
call fcn.00415f57
lea edx, [ebp - 0xab8]
mov ecx, eax
call fcn.00452770
mov edx, 0x4bd684
mov ecx, eax
call fcn.00415f57
mov eax, dword [edi + 0x18]
mov ecx, dword [eax]
cmp dword [ecx], 0xc0000005
jne 0x4514ff
cmp dword [ecx + 0x10], 2
jb 0x4514ff
mov eax, dword [ecx + 0x18]
mov esi, str.Write_to
cmp dword [ecx + 0x14], 0
mov edx, 0x4bd710
mov dword [ebp - 0xab8], eax
lea ecx, [ebp - 0xcec]
mov eax, str.Read_from
mov dword [ebp - 0xab4], ebx
cmove esi, eax
call fcn.00415f57
mov edx, esi
mov ecx, eax
call fcn.00415f57
mov edx, str._location_0x
mov ecx, eax
call fcn.00415f57
lea edx, [ebp - 0xab8]
mov ecx, eax
call fcn.00452770
mov edx, str._caused_an_access_violation._r_n
mov ecx, eax
call fcn.00415f57
mov ebx, dword [ebp - 0xcfc]
lea eax, [ebp - 0xd14]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov edx, str.Exception_Time:
lea ecx, [ebp - 0xcec]
call fcn.00415f57
lea edx, [ebp - 0xd14]
mov ecx, eax
call fcn.00451a00
mov edi, 0x4bc964
mov ecx, eax
mov edx, edi
call fcn.00415f57
mov edx, edi
mov ecx, eax
call fcn.00415f57
test ebx, ebx
je 0x451631
lea eax, [ebp - 0xa98]
push eax
lea eax, [ebp - 0xaa0]
push eax
lea eax, [ebp - 0xaa8]
push eax
lea eax, [ebp - 0xab0]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x4515cd
mov ecx, dword [ebp - 0xd14]
sub ecx, dword [ebp - 0xab0]
mov eax, dword [ebp - 0xd10]
sbb eax, dword [ebp - 0xaac]
push 0
push 0x2710
push eax
push ecx
call fcn.0045cf10
mov dword [ebp - 0xab4], edx
lea ecx, [ebp - 0xcec]
mov edx, str.Process_Uptime:
mov dword [ebp - 0xab8], eax
call fcn.00415f57
lea edx, [ebp - 0xab8]
mov ecx, eax
call 0x4527c5
mov edx, edi
mov ecx, eax
call fcn.00415f57
mov edx, ebx
lea ecx, [ebp - 0xac8]
call fcn.004159e9
push 0xfde9
push eax
lea eax, [ebp - 0xae0]
mov byte [ebp - 4], 2
push eax
call fcn.004138aa
add esp, 0xc
lea ecx, [ebp - 0xcec]
mov edx, str.Command_Line:
mov esi, eax
call fcn.00415f57
mov edx, esi
mov ecx, eax
call fcn.0041c6a9
mov edx, edi
mov ecx, eax
call fcn.00415f57
lea ecx, [ebp - 0xae0]
call fcn.004134bc
lea ecx, [ebp - 0xac8]
mov byte [ebp - 4], 0
call fcn.00408cf0
mov edx, edi
lea ecx, [ebp - 0xcec]
call fcn.00415f57
push 0x800
lea eax, [ebp - 0xa90]
push 0
push eax
call fcn.0045e560
add esp, 0xc
lea eax, [ebp - 0xd00]
mov esi, 0x400
mov dword [ebp - 0xd00], esi
push eax
lea eax, [ebp - 0xa90]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x45168c
push str.Unknown
lea eax, [ebp - 0xa90]
push esi
push eax
call fcn.00465b5e
add esp, 0xc
push 0xfde9
push 0xffffffffffffffff
lea edx, [ebp - 0xa90]
lea ecx, [ebp - 0xae0]
call fcn.0041a8aa
pop ecx
pop ecx
mov edx, str.Username:
lea ecx, [ebp - 0xcec]
call fcn.00415f57
lea edx, [ebp - 0xae0]
mov ecx, eax
call fcn.0041c6a9
mov edx, edi
mov ecx, eax
call fcn.00415f57
lea ecx, [ebp - 0xae0]
call fcn.004134bc
push 0x40
pop esi
push esi
lea eax, [ebp - 0x90]
push 0
push eax
call fcn.0045e560
and dword [ebp - 0xd08], 0
lea eax, [ebp - 0xd04]
add esp, 0xc
mov dword [ebp - 0xd04], esi
mov esi, 0x4bcee0
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0xd08]
push eax
push esi
push str.SoftwareSogouExplorer
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x4517a3
xor eax, eax
lea edi, [ebp - 0xac0]
stosd dword es:[edi], eax
push ecx
lea ecx, [ebp - 0xac0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00454b9d
pop ecx
test al, al
je 0x451771
push dword [ebp - 0xab4]
lea eax, [ebp - 0x90]
push dword [ebp - 0xab8]
push dword [ebp - 0xabc]
push dword [ebp - 0xac0]
push str._08X_08X_08X_08X
push eax
call fcn.0044a317
add esp, 0x18
lea ecx, [ebp - 0x90]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45177a
sub ecx, edx
lea eax, [ebp - 0x90]
push ecx
push eax
push 1
push esi
push str.SoftwareSogouExplorer
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov edi, 0x4bc964
mov edx, str.HID:
lea ecx, [ebp - 0xcec]
call fcn.00415f57
lea edx, [ebp - 0x90]
mov ecx, eax
call fcn.00415f57
mov edx, edi
mov ecx, eax
call fcn.00415f57
mov edx, str.OS_Version:
mov ecx, eax
call fcn.00415f57
mov ecx, eax
call fcn.00451ab4
mov edx, edi
mov ecx, eax
call fcn.00415f57
lea eax, [ebp - 0xd38]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov esi, dword [ebp - 0xd24]
lea ecx, [ebp - 0xcec]
mov edx, str.Processor:
call fcn.00415f57
push 0xa
mov edi, eax
lea eax, [ebp - 0x50]
push 0x20
push eax
push esi
call fcn.0046228f
lea edx, [ebp - 0x50]
mov ecx, edi
call fcn.00415f57
mov esi, dword [ebp - 0xd20]
mov edx, str._processor_s___Type:
mov ecx, eax
call fcn.00415f57
push 0xa
mov edi, eax
lea eax, [ebp - 0x30]
push 0x20
push eax
push esi
call fcn.0046228f
add esp, 0x20
lea edx, [ebp - 0x30]
mov ecx, edi
call fcn.00415f57
mov edi, 0x4bc964
mov ecx, eax
mov edx, edi
call fcn.00415f57
mov edx, str.Global_Memory:
lea ecx, [ebp - 0xcec]
call fcn.00415f57
mov ecx, eax
call 0x451bdc
mov edx, edi
mov ecx, eax
call fcn.00415f57
mov esi, str._r_n_r_n____________________________________________________r_n
test ebx, ebx
je 0x451938
mov edx, esi
mov dword [ebp - 0xcf4], ebx
lea ecx, [ebp - 0xcec]
call fcn.00415f57
mov edx, str.Process_HeapMemory:__r_n
mov ecx, eax
call fcn.00415f57
lea edx, [ebp - 0xcf4]
mov ecx, eax
call 0x451dd2
mov edx, edi
mov ecx, eax
call fcn.00415f57
mov edi, dword [ebp - 0xcf0]
lea ecx, [ebp - 0xcec]
mov edx, esi
mov edi, dword [edi + 0xc]
call fcn.00415f57
mov edx, str.GDI_Handles:__r_n_r_n
mov ecx, eax
call fcn.00415f57
mov esi, eax
mov edx, ebx
push edi
mov ecx, esi
call 0x4536c7
pop ecx
mov edi, 0x4bc964
mov ecx, esi
mov edx, edi
call fcn.00415f57
mov esi, str._r_n_r_n____________________________________________________r_n
mov dword [ebp - 0xcf4], ebx
mov edx, esi
lea ecx, [ebp - 0xcec]
call fcn.00415f57
mov edx, str.Modules:__r_n_r_n
mov ecx, eax
call fcn.00415f57
lea edx, [ebp - 0xcf4]
mov ecx, eax
call 0x45205f
mov edx, edi
mov ecx, eax
call fcn.00415f57
mov edx, esi
lea ecx, [ebp - 0xcec]
call fcn.00415f57
mov edx, str.Processes:__r_n_r_n
mov ecx, eax
call fcn.00415f57
push 0
push 2
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
cmp eax, 0xffffffff
je 0x45196d
mov edx, eax
mov ecx, esi
call fcn.004525fc
mov esi, eax
mov edx, edi
mov ecx, esi
call fcn.00415f57
mov edx, str._r_n_r_n____________________________________________________r_n
lea ecx, [ebp - 0xcec]
call fcn.00415f57
mov edx, str.Driver_Modules:__r_n_r_n
mov ecx, eax
call fcn.00415f57
mov esi, eax
mov ecx, esi
call fcn.004545a0
mov edx, edi
mov ecx, esi
call fcn.00415f57
test ebx, ebx
je 0x4519af
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xcec]
mov eax, dword [ebp - 0xce4]
push ecx
mov ecx, dword [ebp - 0xd0c]
push edx
mov byte [eax + edx], 0
mov edx, str.errorlog.txt
push dword [ebp - 0xce4]
call fcn.0045782c
lea eax, [ebp - 0xce0]
add esp, 0xc
cmp dword [ebp - 0xce4], eax
je 0x4519f4
push dword [ebp - 0xce4]
call fcn.00461d54
pop ecx
call fcn.0045ccf9
ret
call fcn.0045c976
int3