Function at 0x456a4d
Capabilities:
Get session user name
Get system information on windows
Query or enumerate registry value
Set registry value

Disassembly:
push 0xb2c
mov eax, 0x4ae554
call fcn.0045edc9
mov esi, edx
mov dword [ebp - 0xaf4], esi
mov dword [ebp - 0xb04], ecx
push dword [esi + 0xc]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
lea ecx, [ebp - 0xaec]
mov dword [ebp - 0xaf0], ebx
call fcn.00408fc1
and dword [ebp - 4], 0
lea ecx, [ebp - 0x8c8]
mov edx, dword [esi]
push 0xfde9
push 0xffffffffffffffff
call fcn.00417443
pop ecx
pop ecx
mov edi, 0x4c9a18
mov byte [ebp - 4], 1
cmp byte [esi + 8], 0
mov edx, str.Try_catch__just_an_except_
push edi
push edi
mov ecx, str.Real_Crash
cmove ecx, edx
push ecx
push str.Real_crash_or_try_catch:
push edi
push eax
lea eax, [ebp - 0xaec]
push str.Exception_From:
push eax
call fcn.0040a771
pop ecx
pop ecx
push eax
call fcn.0040a60a
pop ecx
pop ecx
push eax
call fcn.0040a771
pop ecx
pop ecx
push eax
call fcn.0040a771
pop ecx
pop ecx
push eax
call fcn.0040a771
pop ecx
pop ecx
push eax
call fcn.0040a771
pop ecx
pop ecx
push eax
call fcn.0040a771
pop ecx
pop ecx
lea ecx, [ebp - 0x8c8]
mov byte [ebp - 4], 0
call fcn.00409fcb
test ebx, ebx
je 0x456d56
mov eax, dword [esi + 0x18]
test eax, eax
je 0x456d56
mov eax, dword [eax + 4]
lea ecx, [ebp - 0x8e0]
mov edx, ebx
push dword [eax + 0xb8]
call 0x457f05
mov ebx, eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0xaec]
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0xc]
mov dword [esp], str.Exception_PID:
push eax
mov edx, dword [ecx + 4]
mov dword [ebp - 0x8b4], 8
mov dword [ebp - 0xb10], 4
mov ecx, dword [edx + 0xb8]
mov dword [ebp - 0x8b8], ecx
mov ecx, dword [edx + 0xbc]
mov dword [ebp - 0xb14], ecx
call fcn.0040a771
push 0xa
mov esi, eax
lea eax, [ebp - 0x30]
push 0x20
push eax
push edi
call fcn.0046474e
lea eax, [ebp - 0x30]
push eax
push esi
call fcn.0040a771
mov edi, dword [ebp - 0xaf4]
add esp, 0x20
mov edi, dword [edi + 0x10]
push str.Exception_TID:
push 0x4c9a18
push eax
call fcn.0040a771
pop ecx
pop ecx
push eax
call fcn.0040a771
push 0xa
mov esi, eax
lea eax, [ebp - 0x50]
push 0x20
push eax
push edi
call fcn.0046474e
lea eax, [ebp - 0x50]
push eax
push esi
call fcn.0040a771
add esp, 0x20
mov edi, 0x4c9a18
push edi
push 0x3a
push 0x4cb1cc
push ebx
push str.Exception_Module:
push edi
push eax
call fcn.0040a771
pop ecx
pop ecx
push eax
call fcn.0040a771
pop ecx
pop ecx
push eax
call fcn.0040a60a
pop ecx
pop ecx
push eax
call fcn.0040a771
pop ecx
pop ecx
lea edx, [ebp - 0xb14]
mov ecx, eax
call fcn.00457e34
push eax
call fcn.00414d1e
pop ecx
pop ecx
lea edx, [ebp - 0x8b8]
mov ecx, eax
call fcn.00457e34
push eax
call fcn.0040a771
pop ecx
pop ecx
lea ecx, [ebp - 0x8e0]
mov byte [ebp - 4], 0
call fcn.00409fcb
mov esi, dword [ebp - 0xaf4]
push 8
pop ebx
mov dword [ebp - 0x8b4], ebx
mov eax, dword [esi + 0x18]
mov eax, dword [eax]
mov ecx, dword [eax]
xor eax, eax
mov dword [ebp - 0x8b8], ecx
cmp ecx, dword [eax*8 + 0x4e3bd0]
je 0x456c90
inc eax
cmp eax, 0x1b
jb 0x456c7a
mov eax, str.an_Unknown_exception_type
jmp 0x456c97
mov eax, dword [eax*8 + 0x4e3bd4]
push 0x4cb208
push str.__0x
push eax
lea eax, [ebp - 0xaec]
push str.Exception_Type:
push eax
call fcn.0040a771
pop ecx
pop ecx
push eax
call fcn.0040a771
pop ecx
pop ecx
push eax
call fcn.0040a771
pop ecx
pop ecx
lea edx, [ebp - 0x8b8]
mov ecx, eax
call fcn.00457e34
push eax
call fcn.0040a771
mov eax, dword [esi + 0x18]
pop ecx
pop ecx
mov ecx, dword [eax]
cmp dword [ecx], 0xc0000005
jne 0x456d50
cmp dword [ecx + 0x10], 2
jb 0x456d50
mov eax, dword [ecx + 0x18]
mov edx, str.Read_from
cmp dword [ecx + 0x14], 0
mov dword [ebp - 0x8b8], eax
mov eax, str.Write_to
push str._caused_an_access_violation._r_n
push str._location_0x
cmove eax, edx
mov dword [ebp - 0x8b4], ebx
push eax
lea eax, [ebp - 0xaec]
push 0x4cb294
push eax
call fcn.0040a771
pop ecx
pop ecx
push eax
call fcn.0040a771
pop ecx
pop ecx
push eax
call fcn.0040a771
pop ecx
pop ecx
lea edx, [ebp - 0x8b8]
mov ecx, eax
call fcn.00457e34
push eax
call fcn.0040a771
pop ecx
pop ecx
mov ebx, dword [ebp - 0xaf0]
lea eax, [ebp - 0xb0c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 0xaec]
push str.Exception_Time:
push eax
call fcn.0040a771
pop ecx
mov esi, eax
lea eax, [ebp - 0x8b8]
pop ecx
push eax
lea eax, [ebp - 0xb0c]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
test eax, eax
je 0x456d9f
lea edx, [ebp - 0x8b8]
mov ecx, esi
call 0x457260
mov esi, eax
push edi
push edi
push esi
call fcn.0040a771
pop ecx
pop ecx
push eax
call fcn.0040a771
pop ecx
pop ecx
test ebx, ebx
je 0x456ea4
lea eax, [ebp - 0x898]
push eax
lea eax, [ebp - 0x8a0]
push eax
lea eax, [ebp - 0x8a8]
push eax
lea eax, [ebp - 0x8b0]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x456e3b
mov ecx, dword [ebp - 0xb0c]
sub ecx, dword [ebp - 0x8b0]
mov eax, dword [ebp - 0xb08]
sbb eax, dword [ebp - 0x8ac]
push 0
push 0x2710
push eax
push ecx
call fcn.0045ef90
push edi
mov dword [ebp - 0x8b8], eax
lea eax, [ebp - 0xaec]
push str.Process_Uptime:
push eax
mov dword [ebp - 0x8b4], edx
call fcn.0040a771
pop ecx
pop ecx
lea edx, [ebp - 0x8b8]
mov ecx, eax
call 0x457e8b
push eax
call fcn.0040a771
pop ecx
pop ecx
mov edx, ebx
lea ecx, [ebp - 0x8c8]
call fcn.0041a67b
push 0xfde9
push eax
lea eax, [ebp - 0x8e0]
mov byte [ebp - 4], 3
push eax
call fcn.0040a5a3
add esp, 0xc
push edi
push eax
lea eax, [ebp - 0xaec]
mov byte [ebp - 4], 4
push str.Command_Line:
push eax
call fcn.0040a771
pop ecx
pop ecx
push eax
call fcn.0040a60a
pop ecx
pop ecx
push eax
call fcn.0040a771
pop ecx
pop ecx
lea ecx, [ebp - 0x8e0]
call fcn.00409fcb
lea ecx, [ebp - 0x8c8]
mov byte [ebp - 4], 0
call fcn.0040a301
lea eax, [ebp - 0xaec]
push edi
push eax
call fcn.0040a771
push 0x800
lea eax, [ebp - 0x890]
push 0
push eax
call fcn.004628a0
add esp, 0x14
lea eax, [ebp - 0xaf8]
mov esi, 0x400
mov dword [ebp - 0xaf8], esi
push eax
lea eax, [ebp - 0x890]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x456eff
push str.Unknown
lea eax, [ebp - 0x890]
push esi
push eax
call fcn.0046e63b
add esp, 0xc
push 0xfde9
push 0xffffffffffffffff
lea edx, [ebp - 0x890]
lea ecx, [ebp - 0x8e0]
call fcn.00417443
pop ecx
pop ecx
push edi
push eax
lea eax, [ebp - 0xaec]
mov byte [ebp - 4], 5
push str.Username:
push eax
call fcn.0040a771
pop ecx
pop ecx
push eax
call fcn.0040a60a
pop ecx
pop ecx
push eax
call fcn.0040a771
pop ecx
pop ecx
lea ecx, [ebp - 0x8e0]
mov byte [ebp - 4], 0
call fcn.00409fcb
push 0x40
pop esi
push esi
lea eax, [ebp - 0x90]
push 0
push eax
call fcn.004628a0
and dword [ebp - 0xb00], 0
lea eax, [ebp - 0xafc]
add esp, 0xc
mov dword [ebp - 0xafc], esi
mov esi, 0x4ca5f8
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0xb00]
push eax
push esi
push str.SoftwareSogouExplorer
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x45702a
and dword [ebp - 0x8c0], 0
lea edi, [ebp - 0x8bc]
xor eax, eax
lea ecx, [ebp - 0x8c0]
stosd dword es:[edi], eax
xor edx, edx
push 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0042144a
pop ecx
test al, al
je 0x456ff8
push dword [ebp - 0x8b4]
lea eax, [ebp - 0x90]
push dword [ebp - 0x8b8]
push dword [ebp - 0x8bc]
push dword [ebp - 0x8c0]
push str._08X_08X_08X_08X
push eax
call fcn.00413c60
add esp, 0x18
lea ecx, [ebp - 0x90]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x457001
sub ecx, edx
lea eax, [ebp - 0x90]
push ecx
push eax
push 1
push esi
push str.SoftwareSogouExplorer
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov edi, 0x4c9a18
push edi
push str.OS_Version:
push edi
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0xaec]
push str.HID:
push eax
call fcn.0040a771
pop ecx
pop ecx
push eax
call fcn.0040a771
pop ecx
pop ecx
push eax
call fcn.0040a771
pop ecx
pop ecx
push eax
call fcn.0040a771
pop ecx
pop ecx
mov ecx, eax
call fcn.004572fe
push eax
call fcn.0040a771
pop ecx
pop ecx
lea eax, [ebp - 0xb38]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov edi, dword [ebp - 0xb24]
lea eax, [ebp - 0xaec]
push str.Processor:
push eax
call fcn.0040a771
push 0xa
mov esi, eax
lea eax, [ebp - 0x50]
push 0x20
push eax
push edi
call fcn.0046474e
lea eax, [ebp - 0x50]
push eax
push esi
call fcn.0040a771
mov esi, dword [ebp - 0xb20]
push str._processor_s___Type:
push eax
call fcn.0040a771
push 0xa
mov edi, eax
lea eax, [ebp - 0x30]
push 0x20
push eax
push esi
call fcn.0046474e
add esp, 0x38
lea eax, [ebp - 0x30]
push 0x4c9a18
push eax
push edi
call fcn.0040a771
pop ecx
pop ecx
push eax
call fcn.0040a771
pop ecx
pop ecx
mov edi, 0x4c9a18
lea eax, [ebp - 0xaec]
push edi
push str.Global_Memory:
push eax
call fcn.0040a771
pop ecx
pop ecx
mov ecx, eax
call 0x4573f4
push eax
call fcn.0040a771
mov esi, str._r_n_r_n____________________________________________________r_n
pop ecx
pop ecx
test ebx, ebx
je 0x4571d5
push edi
push str.Process_HeapMemory:__r_n
lea eax, [ebp - 0xaec]
mov dword [ebp - 0xaf0], ebx
push esi
push eax
call fcn.0040a771
pop ecx
pop ecx
push eax
call fcn.0040a771
pop ecx
pop ecx
lea edx, [ebp - 0xaf0]
mov ecx, eax
call 0x4575f6
push eax
call fcn.0040a771
mov edi, dword [ebp - 0xaf4]
lea eax, [ebp - 0xaec]
pop ecx
pop ecx
push str.GDI_Handles:__r_n_r_n
mov edi, dword [edi + 0xc]
push esi
push eax
call fcn.0040a771
pop ecx
pop ecx
push eax
call fcn.0040a771
mov esi, eax
mov edx, ebx
push edi
mov ecx, esi
call 0x45696f
mov edi, 0x4c9a18
push edi
push esi
call fcn.0040a771
add esp, 0x14
mov dword [ebp - 0xaf4], ebx
mov esi, str._r_n_r_n____________________________________________________r_n
lea eax, [ebp - 0xaec]
push edi
push str.Modules:__r_n_r_n
push esi
push eax
call fcn.0040a771
pop ecx
pop ecx
push eax
call fcn.0040a771
pop ecx
pop ecx
lea edx, [ebp - 0xaf4]
mov ecx, eax
call 0x457899
push eax
call fcn.0040a771
pop ecx
pop ecx
push str.Processes:__r_n_r_n
lea eax, [ebp - 0xaec]
push esi
push eax
call fcn.0040a771
pop ecx
pop ecx
push eax
call fcn.0040a771
pop ecx
pop ecx
push 0
push 2
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
cmp eax, 0xffffffff
je 0x45720d
mov edx, eax
mov ecx, esi
call fcn.00457c9a
mov esi, eax
push edi
push esi
call fcn.0040a771
pop ecx
pop ecx
test ebx, ebx
je 0x457221
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xaec]
call fcn.00404485
lea ecx, [ebp - 0xaec]
mov esi, eax
call fcn.0040a8de
push ecx
mov ecx, dword [ebp - 0xb04]
mov edx, str.errorlog.txt
push esi
push eax
call fcn.00459d6c
add esp, 0xc
lea ecx, [ebp - 0xaec]
call fcn.00408f9c
call fcn.0045ed73
ret