Function at 0x46756c
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push 0x4a4
mov eax, 0x673b9a
call fcn.00626519
mov esi, ecx
lea eax, [esi + 0xa8]
mov dword [ebp - 0x488], 1
push eax
mov dword [ebp - 0x48c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [esi + 0x44], ebx
je 0x467604
cmp dword [esi + 0x34], ebx
jne 0x467604
push 0x30
call fcn.00625367
pop ecx
mov dword [ebp - 0x478], eax
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00466e5f
mov byte [ebp - 4], bl
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x34], eax
mov dword [eax + 0x20], ecx
mov ecx, dword [esi + 0x34]
mov eax, dword [esi + 8]
mov dword [ecx + 0x18], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0x1c], eax
mov ecx, dword [esi + 0x34]
mov eax, dword [esi + 0x10]
mov dword [ecx + 0x28], eax
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x2c], eax
lea eax, [esi + 0x1c]
cmp dword [eax + 0x10], ebx
je 0x467604
mov ecx, dword [esi + 0x34]
cmp ecx, eax
je 0x467604
push 0xffffffffffffffff
push ebx
push eax
call fcn.00429716
cmp dword [esi + 0x44], 0
je 0x46788a
cmp dword [esi + 0x38], ebx
jne 0x46788a
push 0x70
call fcn.00625367
pop ecx
mov dword [ebp - 0x478], eax
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00466ec2
mov byte [ebp - 4], bl
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x38], eax
mov dword [eax + 0x20], ecx
mov ecx, dword [esi + 0x38]
mov eax, dword [esi + 8]
mov dword [ecx + 0x18], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0x1c], eax
mov ecx, dword [esi + 0x38]
mov eax, dword [esi + 0x10]
mov dword [ecx + 0x28], eax
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x2c], eax
lea eax, [esi + 0x1c]
cmp dword [eax + 0x10], ebx
je 0x467672
mov ecx, dword [esi + 0x38]
cmp ecx, eax
je 0x467672
push 0xffffffffffffffff
push ebx
push eax
call fcn.00429716
mov ecx, esi
call fcn.004678a7
test eax, eax
jne 0x46769b
mov eax, dword [esi + 0x38]
xor ecx, ecx
mov word [eax + 0x30], cx
mov eax, dword [esi + 0x38]
mov word [eax + 0x32], cx
mov eax, dword [esi + 0x38]
mov word [eax + 0x36], cx
mov eax, dword [esi + 0x38]
mov word [eax + 0x34], cx
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x4b0]
push 0x6d9638
rep stosd dword es:[edi], eax
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4676ce
lea ecx, [ebp - 0x4b0]
push ecx
call eax
jmp 0x4676db
lea eax, [ebp - 0x4b0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esi + 0x38]
mov ax, word [ebp - 0x4b0]
mov word [ecx + 0x38], ax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov ecx, dword [esi + 0x38]
xorps xmm0, xmm0
movlpd qword [ebp - 0x480], xmm0
mov word [ecx + 0x3a], ax
lea eax, [ebp - 0x474]
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftInternet_Explorer
push closesocket
mov dword [ebp - 0x474], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4677fb
push 0x412
lea eax, [ebp - 0x428]
push ebx
push eax
call fcn.0063e100
add esp, 0xc
mov dword [ebp - 0x484], 0x208
lea eax, [ebp - 0x484]
mov dword [ebp - 0x478], ebx
push eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x478]
push eax
push ebx
push str.Version
push dword [ebp - 0x474]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4677e1
mov dword [ebp - 0x42c], 7
mov dword [ebp - 0x430], ebx
mov word [ebp - 0x440], ax
cmp word [ebp - 0x428], ax
jne 0x4677a0
mov eax, ebx
jmp 0x4677ad
lea eax, [ebp - 0x428]
push eax
call fcn.00642eb3
pop ecx
push eax
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x440]
call fcn.004284f9
lea eax, [ebp - 0x440]
push eax
call fcn.004679a9
push 0
push 1
lea ecx, [ebp - 0x440]
mov edi, eax
mov ebx, edx
call fcn.00428ecb
jmp 0x4677ed
mov ebx, dword [ebp - 0x47c]
mov edi, dword [ebp - 0x480]
push dword [ebp - 0x474]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x467807
mov ebx, dword [ebp - 0x47c]
mov edi, dword [ebp - 0x480]
mov eax, dword [esi + 0x38]
lea ecx, [ebp - 0x470]
push str.1.1.1.e
mov dword [eax + 0x40], edi
mov dword [eax + 0x44], ebx
call fcn.004292cc
push eax
lea eax, [ebp - 0x458]
mov byte [ebp - 4], 3
push str._beacon_id__
push eax
call fcn.00421a3f
add esp, 0xc
push 0x6d969c
push eax
lea eax, [ebp - 0x440]
mov byte [ebp - 4], 4
push eax
call fcn.004238ec
mov ecx, dword [esi + 0x38]
add esp, 0xc
add ecx, 0x58
push eax
call fcn.00428b23
xor ebx, ebx
lea ecx, [ebp - 0x440]
push ebx
push 1
call fcn.00429656
push ebx
push 1
lea ecx, [ebp - 0x458]
call fcn.00429656
push ebx
push 1
lea ecx, [ebp - 0x470]
call fcn.00429656
xor ebx, ebx
lea eax, [esi + 0xa8]
cmp dword [esi + 0x34], ebx
push eax
setne bl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
call fcn.006264c3
ret