Function at 0x45ede6
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push 0x4a4
mov eax, 0x66e105
call fcn.00621869
mov esi, ecx
lea eax, [esi + 0xa8]
mov dword [ebp - 0x488], 1
push eax
mov dword [ebp - 0x48c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [esi + 0x44], ebx
je 0x45ee7e
cmp dword [esi + 0x34], ebx
jne 0x45ee7e
push 0x30
call fcn.006206b8
pop ecx
mov dword [ebp - 0x478], eax
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0045e6d9
mov byte [ebp - 4], bl
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x34], eax
mov dword [eax + 0x20], ecx
mov ecx, dword [esi + 0x34]
mov eax, dword [esi + 8]
mov dword [ecx + 0x18], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0x1c], eax
mov ecx, dword [esi + 0x34]
mov eax, dword [esi + 0x10]
mov dword [ecx + 0x28], eax
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x2c], eax
lea eax, [esi + 0x1c]
cmp dword [eax + 0x10], ebx
je 0x45ee7e
mov ecx, dword [esi + 0x34]
cmp ecx, eax
je 0x45ee7e
push 0xffffffffffffffff
push ebx
push eax
call fcn.004296dd
cmp dword [esi + 0x44], 0
je 0x45f104
cmp dword [esi + 0x38], ebx
jne 0x45f104
push 0x70
call fcn.006206b8
pop ecx
mov dword [ebp - 0x478], eax
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0045e73c
mov byte [ebp - 4], bl
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x38], eax
mov dword [eax + 0x20], ecx
mov ecx, dword [esi + 0x38]
mov eax, dword [esi + 8]
mov dword [ecx + 0x18], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0x1c], eax
mov ecx, dword [esi + 0x38]
mov eax, dword [esi + 0x10]
mov dword [ecx + 0x28], eax
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x2c], eax
lea eax, [esi + 0x1c]
cmp dword [eax + 0x10], ebx
je 0x45eeec
mov ecx, dword [esi + 0x38]
cmp ecx, eax
je 0x45eeec
push 0xffffffffffffffff
push ebx
push eax
call fcn.004296dd
mov ecx, esi
call fcn.0045f121
test eax, eax
jne 0x45ef15
mov eax, dword [esi + 0x38]
xor ecx, ecx
mov word [eax + 0x30], cx
mov eax, dword [esi + 0x38]
mov word [eax + 0x32], cx
mov eax, dword [esi + 0x38]
mov word [eax + 0x36], cx
mov eax, dword [esi + 0x38]
mov word [eax + 0x34], cx
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x4b0]
push 0x6d3bc8
rep stosd dword es:[edi], eax
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x45ef48
lea ecx, [ebp - 0x4b0]
push ecx
call eax
jmp 0x45ef55
lea eax, [ebp - 0x4b0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esi + 0x38]
mov ax, word [ebp - 0x4b0]
mov word [ecx + 0x38], ax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov ecx, dword [esi + 0x38]
xorps xmm0, xmm0
movlpd qword [ebp - 0x480], xmm0
mov word [ecx + 0x3a], ax
lea eax, [ebp - 0x474]
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftInternet_Explorer
push closesocket
mov dword [ebp - 0x474], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45f075
push 0x412
lea eax, [ebp - 0x428]
push ebx
push eax
call fcn.00639410
add esp, 0xc
mov dword [ebp - 0x484], 0x208
lea eax, [ebp - 0x484]
mov dword [ebp - 0x478], ebx
push eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x478]
push eax
push ebx
push str.Version
push dword [ebp - 0x474]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x45f05b
mov dword [ebp - 0x42c], 7
mov dword [ebp - 0x430], ebx
mov word [ebp - 0x440], ax
cmp word [ebp - 0x428], ax
jne 0x45f01a
mov eax, ebx
jmp 0x45f027
lea eax, [ebp - 0x428]
push eax
call fcn.0063e1a8
pop ecx
push eax
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x440]
call fcn.004284c0
lea eax, [ebp - 0x440]
push eax
call fcn.0045f223
push 0
push 1
lea ecx, [ebp - 0x440]
mov edi, eax
mov ebx, edx
call fcn.00428e92
jmp 0x45f067
mov ebx, dword [ebp - 0x47c]
mov edi, dword [ebp - 0x480]
push dword [ebp - 0x474]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x45f081
mov ebx, dword [ebp - 0x47c]
mov edi, dword [ebp - 0x480]
mov eax, dword [esi + 0x38]
lea ecx, [ebp - 0x470]
push str.1.1.1.e
mov dword [eax + 0x40], edi
mov dword [eax + 0x44], ebx
call fcn.00429293
push eax
lea eax, [ebp - 0x458]
mov byte [ebp - 4], 3
push str._beacon_id__
push eax
call fcn.004219ff
add esp, 0xc
push 0x6d3c2c
push eax
lea eax, [ebp - 0x440]
mov byte [ebp - 4], 4
push eax
call fcn.004238ab
mov ecx, dword [esi + 0x38]
add esp, 0xc
add ecx, 0x58
push eax
call fcn.00428aea
xor ebx, ebx
lea ecx, [ebp - 0x440]
push ebx
push 1
call fcn.0042961d
push ebx
push 1
lea ecx, [ebp - 0x458]
call fcn.0042961d
push ebx
push 1
lea ecx, [ebp - 0x470]
call fcn.0042961d
xor ebx, ebx
lea eax, [esi + 0xa8]
cmp dword [esi + 0x34], ebx
push eax
setne bl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
call fcn.00621813
ret