Function at 0x4a116f
Capabilities:
Get session user name
Get system information on windows
Query or enumerate registry value
Set registry value

Disassembly:
push 0xb00
mov eax, 0x4c4848
call fcn.004ac3e5
mov eax, dword [ebp + 8]
mov esi, ecx
push dword [esi + 0xc]
xor edi, edi
push edi
push 0x1f0fff
mov dword [ebp - 0xae0], eax
mov dword [ebp - 0xad0], esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0xac4], eax
lea eax, [ebp - 0xab4]
mov dword [ebp - 0xac0], edi
mov dword [ebp - 0xabc], 0x200
mov dword [ebp - 0xab8], eax
mov dword [ebp - 4], edi
cmp byte [esi + 8], 0
mov dword [ebp - 0xac8], str.Real_Crash
jne 0x4a11df
mov dword [ebp - 0xac8], str.Try_catch__just_an_except_
mov eax, 0xfde9
push eax
push 0xffffffffffffffff
push dword [esi]
lea ecx, [ebp - 0x890]
call fcn.00412e4d
mov ebx, eax
lea eax, [ebp - 0xac0]
add esp, 0xc
push eax
mov eax, str.Exception_From:
call fcn.00412af6
pop ecx
push eax
mov eax, ebx
call fcn.00412a1f
pop ecx
push eax
mov ebx, 0x4de2b8
mov eax, ebx
call fcn.00412af6
pop ecx
push eax
mov eax, str.Real_crash_or_try_catch:
call fcn.00412af6
pop ecx
push eax
mov eax, dword [ebp - 0xac8]
call fcn.00412af6
pop ecx
push eax
mov eax, ebx
call fcn.00412af6
pop ecx
push eax
mov eax, ebx
call fcn.00412af6
pop ecx
push edi
push 1
lea ecx, [ebp - 0x890]
call fcn.0040a0a5
cmp dword [ebp - 0xac4], edi
je 0x4a145d
mov esi, dword [esi + 0x18]
cmp esi, edi
je 0x4a145d
mov eax, dword [esi + 4]
push dword [eax + 0xb8]
mov edi, dword [ebp - 0xac4]
lea esi, [ebp - 0x8ac]
call fcn.004a238e
pop ecx
mov ecx, dword [ebp - 0xad0]
mov edi, eax
mov eax, dword [ecx + 0x18]
mov eax, dword [eax + 4]
mov edx, dword [eax + 0xb8]
mov eax, dword [eax + 0xbc]
push 0x3a
push dword [ecx + 0x10]
mov dword [ebp - 0xacc], eax
push dword [ecx + 0xc]
lea eax, [ebp - 0xac0]
push eax
mov eax, str.Exception_PID:
mov dword [ebp - 0x87c], edx
mov dword [ebp - 0x878], 8
mov dword [ebp - 0xac8], 4
call fcn.00412af6
pop ecx
mov esi, eax
call fcn.004a2463
pop ecx
push eax
mov eax, ebx
call fcn.00412af6
pop ecx
push eax
mov eax, str.Exception_TID:
call fcn.00412af6
pop ecx
mov esi, eax
call fcn.004a2463
pop ecx
push eax
mov eax, ebx
call fcn.00412af6
pop ecx
push eax
mov eax, str.Exception_Module:
call fcn.00412af6
pop ecx
push eax
mov eax, edi
call fcn.00412a1f
pop ecx
push eax
mov eax, 0x4e2fb4
call fcn.00412af6
pop ecx
lea esi, [ebp - 0xacc]
mov edi, eax
call fcn.004a22ce
call fcn.00412ee6
pop ecx
lea esi, [ebp - 0x87c]
mov edi, eax
call fcn.004a22ce
push eax
mov eax, ebx
call fcn.00412af6
pop ecx
push 0
push 1
lea ecx, [ebp - 0x8ac]
call fcn.0040a0a5
mov eax, dword [ebp - 0xad0]
mov eax, dword [eax + 0x18]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x87c], eax
mov dword [ebp - 0x878], 8
xor ecx, ecx
cmp eax, dword [ecx*8 + 0x4f3698]
je 0x4a14a5
inc ecx
cmp ecx, 0x1b
jb 0x4a1387
mov esi, str.an_Unknown_exception_type
lea eax, [ebp - 0xac0]
push eax
mov eax, str.Exception_Type:
call fcn.00412af6
pop ecx
push eax
mov eax, esi
call fcn.00412af6
pop ecx
push eax
mov eax, str.__0x
call fcn.00412af6
pop ecx
lea esi, [ebp - 0x87c]
mov edi, eax
call fcn.004a22ce
push eax
mov eax, 0x4e2fec
call fcn.00412af6
mov eax, dword [ebp - 0xad0]
mov eax, dword [eax + 0x18]
mov eax, dword [eax]
cmp dword [eax], 0xc0000005
pop ecx
jne 0x4a145b
cmp dword [eax + 0x10], 2
jb 0x4a145b
cmp dword [eax + 0x14], 0
mov esi, str.Write_to
jne 0x4a1408
mov esi, str.Read_from
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x87c], eax
lea eax, [ebp - 0xac0]
push eax
mov eax, 0x4e3054
mov dword [ebp - 0x878], 8
call fcn.00412af6
pop ecx
push eax
mov eax, esi
call fcn.00412af6
pop ecx
push eax
mov eax, str._location_0x
call fcn.00412af6
pop ecx
lea esi, [ebp - 0x87c]
mov edi, eax
call fcn.004a22ce
push eax
mov eax, str._caused_an_access_violation._r_n
call fcn.00412af6
pop ecx
xor edi, edi
lea eax, [ebp - 0xad8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 0xac0]
push eax
mov eax, str.Exception_Time:
call fcn.00412af6
mov esi, eax
pop ecx
lea eax, [ebp - 0x87c]
push eax
lea eax, [ebp - 0xad8]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
test eax, eax
je 0x4a14b1
lea eax, [ebp - 0x87c]
push eax
call fcn.004a1a2a
pop ecx
jmp 0x4a14b3
mov esi, dword [ecx*8 + 0x4f369c]
jmp 0x4a139f
mov eax, esi
push eax
mov eax, ebx
call fcn.00412af6
pop ecx
push eax
mov eax, ebx
call fcn.00412af6
pop ecx
cmp dword [ebp - 0xac4], edi
je 0x4a15c8
lea eax, [ebp - 0x858]
push eax
lea eax, [ebp - 0x860]
push eax
lea eax, [ebp - 0x868]
push eax
lea eax, [ebp - 0x870]
push eax
push dword [ebp - 0xac4]
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x4a1558
mov eax, dword [ebp - 0xad8]
sub eax, dword [ebp - 0x870]
mov ecx, dword [ebp - 0xad4]
sbb ecx, dword [ebp - 0x86c]
push edi
push 0x2710
push ecx
push eax
call fcn.004b14e0
mov dword [ebp - 0x880], eax
lea eax, [ebp - 0x880]
push eax
lea eax, [ebp - 0xac0]
push eax
mov eax, str.Process_Uptime:
mov dword [ebp - 0x87c], edx
call fcn.00412af6
pop ecx
mov esi, eax
call fcn.004a2318
pop ecx
push eax
mov eax, ebx
call fcn.00412af6
pop ecx
mov edx, dword [ebp - 0xac4]
lea ecx, [ebp - 0x890]
call fcn.004a18dd
mov ecx, 0xfde9
push ecx
lea ecx, [ebp - 0x8ac]
push ecx
mov byte [ebp - 4], 1
call fcn.00412ebd
mov esi, eax
lea eax, [ebp - 0xac0]
push eax
mov eax, str.Command_Line:
call fcn.00412af6
add esp, 0xc
push eax
mov eax, esi
call fcn.00412a1f
pop ecx
push eax
mov eax, ebx
call fcn.00412af6
pop ecx
push edi
push 1
lea ecx, [ebp - 0x8ac]
call fcn.0040a0a5
push 1
xor edi, edi
lea esi, [ebp - 0x890]
mov byte [ebp - 4], 0
call fcn.0040a3ed
lea eax, [ebp - 0xac0]
push eax
mov eax, ebx
call fcn.00412af6
xor eax, eax
mov word [ebp - 0x850], ax
mov dword [esp], 0x7fe
lea eax, [ebp - 0x84e]
push edi
push eax
call fcn.004a63e0
add esp, 0xc
lea eax, [ebp - 0xadc]
push eax
lea eax, [ebp - 0x850]
mov esi, 0x400
push eax
mov dword [ebp - 0xadc], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x4a162e
push 0x4defa4
lea eax, [ebp - 0x850]
push esi
push eax
call fcn.004a85c2
add esp, 0xc
mov eax, 0xfde9
push eax
lea eax, [ebp - 0x850]
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x8ac]
call fcn.00412e4d
mov esi, eax
lea eax, [ebp - 0xac0]
add esp, 0xc
push eax
mov eax, str.Username:
call fcn.00412af6
pop ecx
push eax
mov eax, esi
call fcn.00412a1f
pop ecx
push eax
mov eax, ebx
call fcn.00412af6
pop ecx
push edi
push 1
lea ecx, [ebp - 0x8ac]
call fcn.0040a0a5
push 0x3f
lea eax, [ebp - 0x4f]
push edi
push eax
mov byte [ebp - 0x50], 0
call fcn.004a63e0
add esp, 0xc
lea eax, [ebp - 0xae4]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0xae8]
push eax
push 0x4cd1dc
push str.SoftwareSogouExplorer
mov esi, SysReAllocString
push esi
mov dword [ebp - 0xae8], edi
mov dword [ebp - 0xae4], 0x40
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x4a1740
mov dword [ebp - 0x884], edi
xor eax, eax
lea edi, [ebp - 0x880]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x884]
push eax
call fcn.00477d67
pop ecx
test al, al
je 0x4a1719
push dword [ebp - 0x878]
lea eax, [ebp - 0x50]
push dword [ebp - 0x87c]
push dword [ebp - 0x880]
push dword [ebp - 0x884]
push str._08X_08X_08X_08X
push eax
call fcn.0040dac7
add esp, 0x18
lea eax, [ebp - 0x50]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4a171f
sub eax, edx
push eax
lea eax, [ebp - 0x50]
push eax
push 1
push 0x4cd1dc
push str.SoftwareSogouExplorer
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea eax, [ebp - 0xac0]
push eax
mov eax, str.HID:
call fcn.00412af6
pop ecx
push eax
lea eax, [ebp - 0x50]
call fcn.00412af6
pop ecx
push eax
mov eax, ebx
call fcn.00412af6
pop ecx
push eax
mov eax, str.OS_Version:
call fcn.00412af6
pop ecx
mov edi, eax
call fcn.004a1ac3
push eax
mov eax, ebx
call fcn.00412af6
pop ecx
lea eax, [ebp - 0xb0c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0xaf4]
lea eax, [ebp - 0xac0]
push dword [ebp - 0xaf8]
push eax
mov eax, str.Processor:
call fcn.00412af6
pop ecx
mov esi, eax
call fcn.004a2463
pop ecx
push eax
mov eax, str._processor_s___Type:
call fcn.00412af6
pop ecx
mov esi, eax
call fcn.004a2463
pop ecx
push eax
mov eax, ebx
call fcn.00412af6
pop ecx
lea eax, [ebp - 0xac0]
push eax
mov eax, str.Memory:
call fcn.00412af6
pop ecx
mov ebx, eax
call fcn.004a1c02
push eax
mov edi, 0x4de2b8
mov eax, edi
call fcn.00412af6
mov eax, dword [ebp - 0xac4]
pop ecx
mov ebx, str._r_n_r_n____________________________________________________r_n
test eax, eax
je 0x4a183e
mov dword [ebp - 0xac8], eax
lea eax, [ebp - 0xac0]
push eax
mov eax, ebx
call fcn.00412af6
pop ecx
push eax
mov eax, str.Modules:__r_n_r_n
call fcn.00412af6
pop ecx
push eax
lea esi, [ebp - 0xac8]
call fcn.004a1d51
pop ecx
push eax
mov eax, edi
call fcn.00412af6
pop ecx
lea eax, [ebp - 0xac0]
push eax
mov eax, ebx
call fcn.00412af6
pop ecx
push eax
mov eax, str.Processes:__r_n_r_n
call fcn.00412af6
pop ecx
push 0
push 2
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
cmp eax, 0xffffffff
je 0x4a1875
push esi
mov ecx, eax
call fcn.004a2142
pop ecx
jmp 0x4a1877
mov eax, esi
push eax
mov eax, edi
call fcn.00412af6
cmp dword [ebp - 0xac4], 0
pop ecx
je 0x4a1895
push dword [ebp - 0xac4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xac0]
mov ecx, dword [ebp - 0xab8]
mov edi, dword [ebp - 0xae0]
mov byte [ecx + eax], 0
mov ecx, dword [ebp - 0xab8]
push eax
mov ebx, str.errorlog.txt
call fcn.004a30f1
lea eax, [ebp - 0xab4]
pop ecx
cmp dword [ebp - 0xab8], eax
je 0x4a18d7
push dword [ebp - 0xab8]
call fcn.004a5f5b
pop ecx
call fcn.004ac468
ret