Function at 0x42de2e
Capabilities:
Get session user name
Get system information on windows
Query or enumerate registry value
Set registry value

Disassembly:
push 0xb00
mov eax, 0x476a5b
call fcn.0044cfd2
mov eax, dword [ebp + 8]
mov edi, ecx
push dword [edi + 0xc]
xor esi, esi
push esi
push 0x1f0fff
mov dword [ebp - 0xae0], eax
mov dword [ebp - 0xad0], edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0xac4], eax
lea eax, [ebp - 0xab4]
mov dword [ebp - 0xac0], esi
mov dword [ebp - 0xabc], 0x200
mov dword [ebp - 0xab8], eax
mov dword [ebp - 4], esi
cmp byte [edi + 8], 0
mov dword [ebp - 0xac8], str.Real_Crash
jne 0x42de9e
mov dword [ebp - 0xac8], str.Try_catch__just_an_except_
mov eax, 0xfde9
push eax
push 0xffffffffffffffff
push dword [edi]
lea esi, [ebp - 0x890]
call fcn.0040945c
add esp, 0xc
mov ebx, 0x495dac
push ebx
push ebx
push dword [ebp - 0xac8]
push str.Real_crash_or_try_catch:
push ebx
push eax
lea eax, [ebp - 0xac0]
push str.Exception_From:
push eax
call fcn.0040fed7
pop ecx
pop ecx
push eax
call fcn.0040f273
pop ecx
pop ecx
push eax
call fcn.0040fed7
pop ecx
pop ecx
push eax
call fcn.0040fed7
pop ecx
pop ecx
push eax
call fcn.0040fed7
pop ecx
pop ecx
push eax
call fcn.0040fed7
pop ecx
pop ecx
push eax
call fcn.0040fed7
pop ecx
pop ecx
push 0
push 1
mov ecx, esi
call fcn.004063f1
cmp dword [ebp - 0xac4], 0
je 0x42e110
mov edi, dword [edi + 0x18]
test edi, edi
je 0x42e110
mov eax, dword [edi + 4]
push dword [eax + 0xb8]
mov edi, dword [ebp - 0xac4]
lea ecx, [ebp - 0x8ac]
call fcn.0042f0ca
mov edx, dword [ebp - 0xad0]
pop ecx
mov ecx, dword [edx + 0x18]
mov ecx, dword [ecx + 4]
mov esi, dword [ecx + 0xb8]
mov ecx, dword [ecx + 0xbc]
push ebx
push 0x3a
push 0x4960a8
push eax
push str.Exception_Module:
push ebx
push dword [edx + 0x10]
lea eax, [ebp - 0xac0]
push str.Exception_TID:
push ebx
push dword [edx + 0xc]
mov dword [ebp - 0x87c], esi
push str.Exception_PID:
push eax
mov dword [ebp - 0x878], 8
mov dword [ebp - 0xacc], ecx
mov dword [ebp - 0xac8], 4
call fcn.0040fed7
pop ecx
pop ecx
push eax
call fcn.0042f242
pop ecx
pop ecx
push eax
call fcn.0040fed7
pop ecx
pop ecx
push eax
call fcn.0040fed7
pop ecx
pop ecx
push eax
call fcn.0042f242
pop ecx
pop ecx
push eax
call fcn.0040fed7
pop ecx
pop ecx
push eax
call fcn.0040fed7
pop ecx
pop ecx
push eax
call fcn.0040f273
pop ecx
pop ecx
push eax
call fcn.0040fed7
pop ecx
pop ecx
lea esi, [ebp - 0xacc]
mov edi, eax
call fcn.0042efe1
mov esi, eax
call fcn.00409533
pop ecx
lea esi, [ebp - 0x87c]
mov edi, eax
call fcn.0042efe1
push eax
call fcn.0040fed7
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x8ac]
call fcn.004063f1
mov eax, dword [ebp - 0xad0]
mov eax, dword [eax + 0x18]
mov eax, dword [eax]
mov eax, dword [eax]
push 0x4960e0
push str.__0x
push eax
mov dword [ebp - 0x87c], eax
mov dword [ebp - 0x878], 8
call fcn.0042f0a3
pop ecx
push eax
lea eax, [ebp - 0xac0]
push str.Exception_Type:
push eax
call fcn.0040fed7
pop ecx
pop ecx
push eax
call fcn.0040fed7
pop ecx
pop ecx
push eax
call fcn.0040fed7
pop ecx
pop ecx
lea esi, [ebp - 0x87c]
mov edi, eax
call fcn.0042efe1
push eax
call fcn.0040fed7
mov eax, dword [ebp - 0xad0]
mov eax, dword [eax + 0x18]
mov eax, dword [eax]
cmp dword [eax], 0xc0000005
pop ecx
pop ecx
jne 0x42e110
cmp dword [eax + 0x10], 2
jb 0x42e110
cmp dword [eax + 0x14], 0
mov ecx, str.Write_to
jne 0x42e0ba
mov ecx, str.Read_from
mov eax, dword [eax + 0x18]
push str._caused_an_access_violation._r_n
push str._location_0x
push ecx
mov dword [ebp - 0x87c], eax
lea eax, [ebp - 0xac0]
push 0x496148
push eax
mov dword [ebp - 0x878], 8
call fcn.0040fed7
pop ecx
pop ecx
push eax
call fcn.0040fed7
pop ecx
pop ecx
push eax
call fcn.0040fed7
pop ecx
pop ecx
lea esi, [ebp - 0x87c]
mov edi, eax
call fcn.0042efe1
push eax
call fcn.0040fed7
pop ecx
pop ecx
lea eax, [ebp - 0xad8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 0xac0]
push str.Exception_Time:
push eax
call fcn.0040fed7
pop ecx
mov esi, eax
pop ecx
lea eax, [ebp - 0x87c]
push eax
lea eax, [ebp - 0xad8]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
test eax, eax
je 0x42e159
lea eax, [ebp - 0x87c]
push eax
call fcn.0042e6d2
pop ecx
jmp 0x42e15b
mov eax, esi
push ebx
push ebx
push eax
call fcn.0040fed7
pop ecx
pop ecx
push eax
call fcn.0040fed7
cmp dword [ebp - 0xac4], 0
pop ecx
pop ecx
je 0x42e27d
lea eax, [ebp - 0x858]
push eax
lea eax, [ebp - 0x860]
push eax
lea eax, [ebp - 0x868]
push eax
lea eax, [ebp - 0x870]
push eax
push dword [ebp - 0xac4]
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x42e203
mov eax, dword [ebp - 0xad8]
sub eax, dword [ebp - 0x870]
mov ecx, dword [ebp - 0xad4]
sbb ecx, dword [ebp - 0x86c]
push 0
push 0x2710
push ecx
push eax
call fcn.0045a750
mov dword [ebp - 0x880], eax
push ebx
lea eax, [ebp - 0x880]
push eax
lea eax, [ebp - 0xac0]
push str.Process_Uptime:
push eax
mov dword [ebp - 0x87c], edx
call fcn.0040fed7
pop ecx
pop ecx
mov esi, eax
call fcn.0042f02c
pop ecx
push eax
call fcn.0040fed7
pop ecx
pop ecx
mov ecx, dword [ebp - 0xac4]
lea ebx, [ebp - 0x890]
call fcn.0042e595
mov ecx, 0xfde9
push ecx
push eax
lea eax, [ebp - 0x8ac]
push eax
mov byte [ebp - 4], 1
call fcn.004094ce
add esp, 0xc
push 0x495dac
push eax
lea eax, [ebp - 0xac0]
push str.Command_Line:
push eax
call fcn.0040fed7
pop ecx
pop ecx
push eax
call fcn.0040f273
pop ecx
pop ecx
push eax
call fcn.0040fed7
pop ecx
pop ecx
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x8ac]
call fcn.004063f1
push ebx
push 1
lea ecx, [ebp - 0x890]
mov byte [ebp - 4], bl
call fcn.00403656
mov ebx, 0x495dac
lea eax, [ebp - 0xac0]
push ebx
push eax
call fcn.0040fed7
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x850], ax
lea eax, [ebp - 0x84e]
push eax
call fcn.0044d460
add esp, 0x14
lea eax, [ebp - 0xadc]
push eax
lea eax, [ebp - 0x850]
mov esi, 0x400
push eax
mov dword [ebp - 0xadc], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x42e2e0
push 0x496194
lea eax, [ebp - 0x850]
push esi
push eax
call fcn.0044ea50
add esp, 0xc
mov eax, 0xfde9
push eax
lea eax, [ebp - 0x850]
push 0xffffffffffffffff
push eax
lea esi, [ebp - 0x8ac]
call fcn.0040945c
add esp, 0xc
push ebx
push eax
lea eax, [ebp - 0xac0]
push str.Username:
push eax
call fcn.0040fed7
pop ecx
pop ecx
push eax
call fcn.0040f273
pop ecx
pop ecx
push eax
call fcn.0040fed7
pop ecx
pop ecx
xor edi, edi
push edi
push 1
mov ecx, esi
call fcn.004063f1
push 0x3f
lea eax, [ebp - 0x4f]
push edi
push eax
mov byte [ebp - 0x50], 0
call fcn.0044d460
add esp, 0xc
lea eax, [ebp - 0xae4]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0xae8]
push eax
push 0x4961b0
push str.SoftwareSogouExplorer
mov esi, SysReAllocString
push esi
mov dword [ebp - 0xae8], edi
mov dword [ebp - 0xae4], 0x40
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x42e3ef
mov dword [ebp - 0x884], edi
xor eax, eax
lea edi, [ebp - 0x880]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x884]
push eax
call fcn.0042fa76
pop ecx
test al, al
je 0x42e3c8
push dword [ebp - 0x878]
lea eax, [ebp - 0x50]
push dword [ebp - 0x87c]
push dword [ebp - 0x880]
push dword [ebp - 0x884]
push str._08X_08X_08X_08X
push eax
call fcn.0042f19f
add esp, 0x18
lea eax, [ebp - 0x50]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42e3ce
sub eax, edx
push eax
lea eax, [ebp - 0x50]
push eax
push 1
push 0x4961b0
push str.SoftwareSogouExplorer
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
push ebx
push str.OS_Version:
push ebx
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0xac0]
push str.HID:
push eax
call fcn.0040fed7
pop ecx
pop ecx
push eax
call fcn.0040fed7
pop ecx
pop ecx
push eax
call fcn.0040fed7
pop ecx
pop ecx
push eax
call fcn.0040fed7
pop ecx
pop ecx
mov edi, eax
call fcn.0042e76c
push eax
call fcn.0040fed7
pop ecx
pop ecx
lea eax, [ebp - 0xb0c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push ebx
push dword [ebp - 0xaf4]
lea eax, [ebp - 0xac0]
push str._processor_s___Type:
push dword [ebp - 0xaf8]
push str.Processor:
push eax
call fcn.0040fed7
pop ecx
pop ecx
push eax
call fcn.0042f242
pop ecx
pop ecx
push eax
call fcn.0040fed7
pop ecx
pop ecx
push eax
call fcn.0042f242
pop ecx
pop ecx
push eax
call fcn.0040fed7
pop ecx
pop ecx
push ebx
push ecx
lea eax, [ebp - 0xac0]
push str.Memory:
push eax
call fcn.0040fed7
pop ecx
pop ecx
mov esi, eax
call fcn.0042e8b2
pop ecx
push eax
call fcn.0040fed7
mov eax, dword [ebp - 0xac4]
pop ecx
pop ecx
mov edi, str._r_n_r_n____________________________________________________r_n
test eax, eax
je 0x42e4f3
push ebx
push ecx
push str.Modules:__r_n_r_n
mov dword [ebp - 0xac8], eax
lea eax, [ebp - 0xac0]
push edi
push eax
call fcn.0040fed7
pop ecx
pop ecx
push eax
call fcn.0040fed7
push eax
lea esi, [ebp - 0xac8]
call fcn.0042ea0b
add esp, 0x10
push eax
call fcn.0040fed7
pop ecx
pop ecx
push str.Processes:__r_n_r_n
lea eax, [ebp - 0xac0]
push edi
push eax
call fcn.0040fed7
pop ecx
pop ecx
push eax
call fcn.0040fed7
pop ecx
pop ecx
push 0
push 2
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
cmp eax, 0xffffffff
je 0x42e52b
push esi
mov ecx, eax
call fcn.0042ee0f
pop ecx
jmp 0x42e52d
mov eax, esi
push ebx
push eax
call fcn.0040fed7
cmp dword [ebp - 0xac4], 0
pop ecx
pop ecx
je 0x42e54b
push dword [ebp - 0xac4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xac0]
mov ecx, dword [ebp - 0xab8]
mov edi, dword [ebp - 0xae0]
mov byte [ecx + eax], 0
mov edx, dword [ebp - 0xab8]
push eax
xor ecx, ecx
mov ebx, str.errorlog.txt
call fcn.004313a8
lea eax, [ebp - 0xab4]
pop ecx
cmp dword [ebp - 0xab8], eax
je 0x42e58f
push dword [ebp - 0xab8]
call fcn.0044d937
pop ecx
call fcn.0044d055
ret