Function at 0x433f0b
Capabilities:
Get session user name
Get system information on windows
Query or enumerate registry value
Set registry value

Disassembly:
push 0xb30
mov eax, 0x46da2a
call fcn.0043b363
mov ebx, edx
mov dword [ebp - 0xaf0], ebx
mov dword [ebp - 0xb08], ecx
push dword [ebx + 0xc]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
and dword [ebp - 0xaec], 0
mov dword [ebp - 0xaf4], eax
lea eax, [ebp - 0xae0]
mov dword [ebp - 0xae8], 0x200
mov dword [ebp - 0xae4], eax
and dword [ebp - 4], 0
lea ecx, [ebp - 0x8c8]
mov edx, dword [ebx]
mov esi, 0xfde9
push esi
push 0xffffffffffffffff
call fcn.0040c9e3
pop ecx
pop ecx
mov ecx, dword [ebp - 0xaf0]
mov edi, eax
mov eax, str.Try_catch__just_an_except_
mov ebx, str.Real_Crash
mov edx, str.Exception_From:
cmp byte [ecx + 8], 0
lea ecx, [ebp - 0xaec]
cmove ebx, eax
call fcn.0040ce94
mov edx, edi
mov ecx, eax
call fcn.0040ccfe
mov edi, 0x48aaa4
mov ecx, eax
mov edx, edi
call fcn.0040ce94
mov edx, str.Real_crash_or_try_catch:
mov ecx, eax
call fcn.0040ce94
mov edx, ebx
mov ecx, eax
call fcn.0040ce94
mov edx, edi
mov ecx, eax
call fcn.0040ce94
mov edx, edi
mov ecx, eax
call fcn.0040ce94
push 0
push 1
lea ecx, [ebp - 0x8c8]
call fcn.00402d1f
mov ebx, dword [ebp - 0xaf4]
test ebx, ebx
je 0x434227
mov edi, dword [ebp - 0xaf0]
mov eax, dword [edi + 0x18]
test eax, eax
je 0x434227
mov eax, dword [eax + 4]
lea ecx, [ebp - 0x8e0]
mov edx, ebx
push dword [eax + 0xb8]
call fcn.0043536b
mov ecx, dword [edi + 0x18]
mov edi, dword [edi + 0xc]
mov dword [ebp - 0xaf8], eax
mov dword [ebp - 0x8b4], 8
mov edx, dword [ecx + 4]
mov dword [ebp - 0xb14], 4
mov ecx, dword [edx + 0xb8]
mov dword [ebp - 0x8b8], ecx
mov ecx, dword [edx + 0xbc]
mov edx, str.Exception_PID:
mov dword [ebp - 0xb18], ecx
lea ecx, [ebp - 0xaec]
call fcn.0040ce94
push 0xa
mov ebx, eax
lea eax, [ebp - 0x30]
push 0x20
push eax
push edi
call fcn.00442def
lea edx, [ebp - 0x30]
mov ecx, ebx
call fcn.0040ce94
mov ecx, dword [ebp - 0xaf0]
mov edx, 0x48aaa4
mov ebx, dword [ecx + 0x10]
mov ecx, eax
call fcn.0040ce94
mov edx, str.Exception_TID:
mov ecx, eax
call fcn.0040ce94
push 0xa
mov edi, eax
lea eax, [ebp - 0x50]
push 0x20
push eax
push ebx
call fcn.00442def
add esp, 0x24
lea edx, [ebp - 0x50]
mov ecx, edi
call fcn.0040ce94
mov ebx, 0x48aaa4
mov ecx, eax
mov edx, ebx
call fcn.0040ce94
mov edx, str.Exception_Module:
mov ecx, eax
call fcn.0040ce94
mov edx, dword [ebp - 0xaf8]
mov ecx, eax
call fcn.0040ccfe
mov edx, 0x48ab90
mov ecx, eax
call fcn.0040ce94
lea edx, [ebp - 0xb18]
mov ecx, eax
call fcn.0043529e
mov dl, 0x3a
mov ecx, eax
call fcn.0040cae2
lea edx, [ebp - 0x8b8]
mov ecx, eax
call fcn.0043529e
mov edx, ebx
mov ecx, eax
call fcn.0040ce94
push 0
push 1
lea ecx, [ebp - 0x8e0]
call fcn.00402d1f
mov ebx, dword [ebp - 0xaf0]
mov eax, dword [ebx + 0x18]
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x8b8], ecx
mov dword [ebp - 0x8b4], 8
xor eax, eax
cmp ecx, dword [eax*8 + 0x498b60]
je 0x434167
inc eax
cmp eax, 0x1b
jb 0x434151
mov edi, str.an_Unknown_exception_type
jmp 0x43416e
mov edi, dword [eax*8 + 0x498b64]
mov edx, str.Exception_Type:
lea ecx, [ebp - 0xaec]
call fcn.0040ce94
mov edx, edi
mov ecx, eax
call fcn.0040ce94
mov edx, str.__0x
mov ecx, eax
call fcn.0040ce94
lea edx, [ebp - 0x8b8]
mov ecx, eax
call fcn.0043529e
mov edx, 0x48abc8
mov ecx, eax
call fcn.0040ce94
mov eax, dword [ebx + 0x18]
mov ecx, dword [eax]
cmp dword [ecx], 0xc0000005
jne 0x434221
cmp dword [ecx + 0x10], 2
jb 0x434221
mov eax, dword [ecx + 0x18]
mov edi, str.Write_to
cmp dword [ecx + 0x14], 0
mov edx, 0x48ac30
mov dword [ebp - 0x8b8], eax
lea ecx, [ebp - 0xaec]
mov eax, str.Read_from
mov dword [ebp - 0x8b4], 8
cmove edi, eax
call fcn.0040ce94
mov edx, edi
mov ecx, eax
call fcn.0040ce94
mov edx, str._location_0x
mov ecx, eax
call fcn.0040ce94
lea edx, [ebp - 0x8b8]
mov ecx, eax
call fcn.0043529e
mov edx, str._caused_an_access_violation._r_n
mov ecx, eax
call fcn.0040ce94
mov ebx, dword [ebp - 0xaf4]
lea eax, [ebp - 0xb10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov edx, str.Exception_Time:
lea ecx, [ebp - 0xaec]
call fcn.0040ce94
mov edi, eax
lea eax, [ebp - 0x8b8]
push eax
lea eax, [ebp - 0xb10]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
test eax, eax
je 0x43426d
lea edx, [ebp - 0x8b8]
mov ecx, edi
call fcn.004347f4
mov edi, eax
mov edx, 0x48aaa4
mov ecx, edi
call fcn.0040ce94
mov edi, 0x48aaa4
mov ecx, eax
mov edx, edi
call fcn.0040ce94
test ebx, ebx
je 0x434379
lea eax, [ebp - 0x898]
push eax
lea eax, [ebp - 0x8a0]
push eax
lea eax, [ebp - 0x8a8]
push eax
lea eax, [ebp - 0x8b0]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x43430e
mov ecx, dword [ebp - 0xb10]
sub ecx, dword [ebp - 0x8b0]
mov eax, dword [ebp - 0xb0c]
sbb eax, dword [ebp - 0x8ac]
push 0
push 0x2710
push eax
push ecx
call fcn.0043b480
mov dword [ebp - 0x8b4], edx
lea ecx, [ebp - 0xaec]
mov edx, str.Process_Uptime:
mov dword [ebp - 0x8b8], eax
call fcn.0040ce94
lea edx, [ebp - 0x8b8]
mov ecx, eax
call fcn.004352f3
mov edx, edi
mov ecx, eax
call fcn.0040ce94
mov edx, ebx
lea ecx, [ebp - 0x8c8]
call fcn.00434698
push esi
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x8e0]
call fcn.0040ca59
pop ecx
mov edx, str.Command_Line:
lea ecx, [ebp - 0xaec]
mov edi, eax
call fcn.0040ce94
mov edx, edi
mov ecx, eax
call fcn.0040ccfe
mov edi, 0x48aaa4
mov ecx, eax
mov edx, edi
call fcn.0040ce94
push 0
push 1
lea ecx, [ebp - 0x8e0]
call fcn.00402d1f
push 0
push 1
lea ecx, [ebp - 0x8c8]
mov byte [ebp - 4], 0
call fcn.00402f3e
mov edx, edi
lea ecx, [ebp - 0xaec]
call fcn.0040ce94
push 0x800
lea eax, [ebp - 0x890]
push 0
push eax
call fcn.0043bad0
add esp, 0xc
mov dword [ebp - 0xafc], 0x400
lea eax, [ebp - 0xafc]
push eax
lea eax, [ebp - 0x890]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x4343d1
lea eax, [ebp - 0x890]
push 0x48ac7c
push eax
call fcn.00424c51
pop ecx
pop ecx
push esi
push 0xffffffffffffffff
lea edx, [ebp - 0x890]
lea ecx, [ebp - 0x8e0]
call fcn.0040c9e3
pop ecx
pop ecx
mov edx, str.Username:
lea ecx, [ebp - 0xaec]
mov esi, eax
call fcn.0040ce94
mov edx, esi
mov ecx, eax
call fcn.0040ccfe
mov edx, edi
mov ecx, eax
call fcn.0040ce94
push 0
push 1
lea ecx, [ebp - 0x8e0]
call fcn.00402d1f
push 0x40
pop esi
push esi
lea eax, [ebp - 0x90]
push 0
push eax
call fcn.0043bad0
and dword [ebp - 0xb04], 0
lea eax, [ebp - 0xb00]
add esp, 0xc
mov dword [ebp - 0xb00], esi
mov esi, 0x47ccec
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0xb04]
push eax
push esi
push str.SoftwareSogouExplorer
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x4344ea
and dword [ebp - 0x8c0], 0
lea edi, [ebp - 0x8bc]
xor eax, eax
lea ecx, [ebp - 0x8c0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0040d25a
test al, al
je 0x4344b8
push dword [ebp - 0x8b4]
lea eax, [ebp - 0x90]
push dword [ebp - 0x8b8]
push dword [ebp - 0x8bc]
push dword [ebp - 0x8c0]
push 0x47cd04
push eax
call fcn.00406721
add esp, 0x18
lea ecx, [ebp - 0x90]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4344c1
sub ecx, edx
lea eax, [ebp - 0x90]
push ecx
push eax
push 1
push esi
push str.SoftwareSogouExplorer
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov edi, 0x48aaa4
mov edx, str.HID:
lea ecx, [ebp - 0xaec]
call fcn.0040ce94
lea edx, [ebp - 0x90]
mov ecx, eax
call fcn.0040ce94
mov edx, edi
mov ecx, eax
call fcn.0040ce94
mov edx, str.OS_Version:
mov ecx, eax
call fcn.0040ce94
mov ecx, eax
call fcn.00434890
mov edx, edi
mov ecx, eax
call fcn.0040ce94
lea eax, [ebp - 0xb3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [ebp - 0xb28]
lea ecx, [ebp - 0xaec]
mov edx, str.Processor:
call fcn.0040ce94
push 0xa
mov edi, eax
lea eax, [ebp - 0x50]
push 0x20
push eax
push esi
call fcn.00442def
lea edx, [ebp - 0x50]
mov ecx, edi
call fcn.0040ce94
mov esi, dword [ebp - 0xb24]
mov edx, str._processor_s___Type:
mov ecx, eax
call fcn.0040ce94
push 0xa
mov edi, eax
lea eax, [ebp - 0x30]
push 0x20
push eax
push esi
call fcn.00442def
add esp, 0x20
lea edx, [ebp - 0x30]
mov ecx, edi
call fcn.0040ce94
mov edi, 0x48aaa4
mov ecx, eax
mov edx, edi
call fcn.0040ce94
mov edx, str.Memory:
lea ecx, [ebp - 0xaec]
call fcn.0040ce94
mov ecx, eax
call fcn.00434a19
mov edx, edi
mov ecx, eax
call fcn.0040ce94
mov esi, str._r_n_r_n____________________________________________________r_n
test ebx, ebx
je 0x434604
mov edx, esi
mov dword [ebp - 0xaf8], ebx
lea ecx, [ebp - 0xaec]
call fcn.0040ce94
mov edx, str.Modules:__r_n_r_n
mov ecx, eax
call fcn.0040ce94
lea edx, [ebp - 0xaf8]
mov ecx, eax
call fcn.00434c33
mov edx, edi
mov ecx, eax
call fcn.0040ce94
mov edx, esi
lea ecx, [ebp - 0xaec]
call fcn.0040ce94
mov edx, str.Processes:__r_n_r_n
mov ecx, eax
call fcn.0040ce94
push 0
push 2
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
cmp eax, 0xffffffff
je 0x434639
mov edx, eax
mov ecx, esi
call fcn.00435111
mov esi, eax
mov edx, edi
mov ecx, esi
call fcn.0040ce94
test ebx, ebx
je 0x43464d
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xaec]
mov eax, dword [ebp - 0xae4]
push ecx
mov ecx, dword [ebp - 0xb08]
push edx
mov byte [eax + edx], 0
mov edx, str.errorlog.txt
push dword [ebp - 0xae4]
call fcn.00435ef5
lea eax, [ebp - 0xae0]
add esp, 0xc
cmp dword [ebp - 0xae4], eax
je 0x434692
push dword [ebp - 0xae4]
call fcn.00440047
pop ecx
call fcn.0043b30d
ret