Function at 0x45808f
Capabilities:
Get session user name
Get system information on windows
Query or enumerate registry value
Set registry value

Disassembly:
push 0xd2c
mov eax, 0x4b6130
call fcn.00461a91
mov esi, edx
mov dword [ebp - 0xcf0], esi
mov dword [ebp - 0xd0c], ecx
push dword [esi + 0xc]
xor eax, eax
push eax
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
lea ecx, [ebp - 0xcec]
mov dword [ebp - 0xcfc], ebx
call fcn.0040a6f3
xor edx, edx
lea ecx, [ebp - 0xac8]
mov dword [ebp - 4], edx
mov edi, dword [esi]
call fcn.00414daa
mov byte [ebp - 4], 1
test edi, edi
je 0x4581be
xor eax, eax
cmp word [edi], ax
je 0x4581be
push 0x200
push eax
lea eax, [ebp - 0x290]
push eax
call fcn.00464590
add esp, 0xc
lea eax, [ebp - 0x290]
xor ecx, ecx
push ecx
push ecx
push 0x1ff
push eax
push 0xffffffffffffffff
push edi
push ecx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jle 0x458159
cmp eax, 0x200
jae 0x4589b9
xor edx, edx
lea ecx, [ebp - 0xac8]
mov byte [ebp + eax - 0x290], dl
lea eax, [ebp - 0x290]
push eax
call fcn.0040ae37
jmp 0x4581be
xor eax, eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push edi
push eax
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea esi, [eax + 1]
lea ecx, [esi + 1]
push ecx
call fcn.0046142c
pop ecx
mov dword [ebp - 0xcf4], eax
xor eax, eax
push eax
push eax
push esi
mov esi, dword [ebp - 0xcf4]
push esi
push 0xffffffffffffffff
push edi
push eax
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor edx, edx
mov byte [eax + esi], dl
test eax, eax
jle 0x4581b1
push esi
lea ecx, [ebp - 0xac8]
call fcn.0040ae37
push esi
call fcn.00461435
mov esi, dword [ebp - 0xcf0]
pop ecx
lea eax, [ebp - 0xac8]
push eax
lea ecx, [ebp - 0xae0]
call fcn.0040a793
lea ecx, [ebp - 0xac8]
call fcn.00404f45
mov edi, 0x4d29e0
mov byte [ebp - 4], 2
cmp byte [esi + 8], 0
mov ecx, str.Try_catch__just_an_except_
push edi
push edi
mov eax, str.Real_Crash
cmove eax, ecx
push eax
push str.Real_crash_or_try_catch:
push edi
lea eax, [ebp - 0xae0]
push eax
lea eax, [ebp - 0xcec]
push str.Exception_From:
push eax
call fcn.00414bb4
pop ecx
pop ecx
push eax
call fcn.0041374a
pop ecx
pop ecx
push eax
call fcn.00414bb4
pop ecx
pop ecx
push eax
call fcn.00414bb4
pop ecx
pop ecx
push eax
call fcn.00414bb4
pop ecx
pop ecx
push eax
call fcn.00414bb4
pop ecx
pop ecx
push eax
call fcn.00414bb4
pop ecx
pop ecx
xor eax, eax
lea ecx, [ebp - 0xae0]
mov byte [ebp - 4], al
call fcn.00404f45
test ebx, ebx
je 0x458496
mov eax, dword [esi + 0x18]
test eax, eax
je 0x458496
mov eax, dword [eax + 4]
lea ecx, [ebp - 0xae0]
mov edx, ebx
push dword [eax + 0xb8]
call fcn.004597b7
mov ebx, eax
mov byte [ebp - 4], 3
lea eax, [ebp - 0xcec]
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0xc]
mov dword [esp], str.Exception_PID:
push eax
mov edx, dword [ecx + 4]
mov dword [ebp - 0xab4], 8
mov dword [ebp - 0xcf4], 4
mov ecx, dword [edx + 0xb8]
mov dword [ebp - 0xab8], ecx
mov ecx, dword [edx + 0xbc]
mov dword [ebp - 0xcf8], ecx
call fcn.00414bb4
push 0xa
mov esi, eax
lea eax, [ebp - 0x30]
push 0x20
push eax
push edi
call fcn.004670dc
lea eax, [ebp - 0x30]
push eax
push esi
call fcn.00414bb4
mov edi, dword [ebp - 0xcf0]
add esp, 0x20
mov edi, dword [edi + 0x10]
push str.Exception_TID:
push 0x4d29e0
push eax
call fcn.00414bb4
pop ecx
pop ecx
push eax
call fcn.00414bb4
push 0xa
mov esi, eax
lea eax, [ebp - 0x50]
push 0x20
push eax
push edi
call fcn.004670dc
lea eax, [ebp - 0x50]
push eax
push esi
call fcn.00414bb4
add esp, 0x20
mov edi, 0x4d29e0
push edi
push 0x3a
push 0x4d40ac
push ebx
push str.Exception_Module:
push edi
push eax
call fcn.00414bb4
pop ecx
pop ecx
push eax
call fcn.00414bb4
pop ecx
pop ecx
push eax
call fcn.0041374a
pop ecx
pop ecx
push eax
call fcn.00414bb4
pop ecx
pop ecx
lea edx, [ebp - 0xcf8]
mov ecx, eax
call fcn.004596ea
push eax
call fcn.00414a8b
pop ecx
pop ecx
lea edx, [ebp - 0xab8]
mov ecx, eax
call fcn.004596ea
push eax
call fcn.00414bb4
pop ecx
pop ecx
xor ebx, ebx
lea ecx, [ebp - 0xae0]
mov byte [ebp - 4], bl
call fcn.00404f45
mov esi, dword [ebp - 0xcf0]
mov dword [ebp - 0xab4], 8
mov eax, dword [esi + 0x18]
mov eax, dword [eax]
mov ecx, dword [eax]
mov eax, ebx
mov dword [ebp - 0xab8], ecx
cmp ecx, dword [eax*8 + 0x4f0c30]
je 0x4583cd
inc eax
cmp eax, 0x1b
jb 0x4583b7
mov eax, str.an_Unknown_exception_type
jmp 0x4583d4
mov eax, dword [eax*8 + 0x4f0c34]
push 0x4d40e8
push str.__0x
push eax
lea eax, [ebp - 0xcec]
push str.Exception_Type:
push eax
call fcn.00414bb4
pop ecx
pop ecx
push eax
call fcn.00414bb4
pop ecx
pop ecx
push eax
call fcn.00414bb4
pop ecx
pop ecx
lea edx, [ebp - 0xab8]
mov ecx, eax
call fcn.004596ea
push eax
call fcn.00414bb4
mov eax, dword [esi + 0x18]
pop ecx
pop ecx
mov ecx, dword [eax]
cmp dword [ecx], 0xc0000005
jne 0x458490
cmp dword [ecx + 0x10], 2
jb 0x458490
mov eax, dword [ecx + 0x18]
mov edx, str.Read_from
cmp dword [ecx + 0x14], ebx
mov dword [ebp - 0xab8], eax
mov eax, str.Write_to
push str._caused_an_access_violation._r_n
push str._location_0x
cmove eax, edx
mov dword [ebp - 0xab4], 8
push eax
lea eax, [ebp - 0xcec]
push 0x4d4174
push eax
call fcn.00414bb4
pop ecx
pop ecx
push eax
call fcn.00414bb4
pop ecx
pop ecx
push eax
call fcn.00414bb4
pop ecx
pop ecx
lea edx, [ebp - 0xab8]
mov ecx, eax
call fcn.004596ea
push eax
call fcn.00414bb4
pop ecx
pop ecx
mov ebx, dword [ebp - 0xcfc]
lea eax, [ebp - 0xd14]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push edi
push edi
lea eax, [ebp - 0xcec]
push str.Exception_Time:
push eax
call fcn.00414bb4
pop ecx
pop ecx
lea edx, [ebp - 0xd14]
mov ecx, eax
call fcn.004589bf
push eax
call fcn.00414bb4
pop ecx
pop ecx
push eax
call fcn.00414bb4
pop ecx
pop ecx
test ebx, ebx
je 0x4585ca
lea eax, [ebp - 0xa98]
push eax
lea eax, [ebp - 0xaa0]
push eax
lea eax, [ebp - 0xaa8]
push eax
lea eax, [ebp - 0xab0]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x458560
mov ecx, dword [ebp - 0xd14]
sub ecx, dword [ebp - 0xab0]
mov eax, dword [ebp - 0xd10]
sbb eax, dword [ebp - 0xaac]
xor edx, edx
push edx
push 0x2710
push eax
push ecx
call fcn.00461c50
push edi
mov dword [ebp - 0xab8], eax
lea eax, [ebp - 0xcec]
push str.Process_Uptime:
push eax
mov dword [ebp - 0xab4], edx
call fcn.00414bb4
pop ecx
pop ecx
lea edx, [ebp - 0xab8]
mov ecx, eax
call 0x45973f
push eax
call fcn.00414bb4
pop ecx
pop ecx
mov edx, ebx
lea ecx, [ebp - 0xac8]
call fcn.00415663
push 0xfde9
push eax
lea eax, [ebp - 0xae0]
mov byte [ebp - 4], 4
push eax
call fcn.0040a860
add esp, 0xc
push edi
push eax
lea eax, [ebp - 0xcec]
mov byte [ebp - 4], 5
push str.Command_Line:
push eax
call fcn.00414bb4
pop ecx
pop ecx
push eax
call fcn.0041374a
pop ecx
pop ecx
push eax
call fcn.00414bb4
pop ecx
pop ecx
lea ecx, [ebp - 0xae0]
call fcn.00404f45
xor eax, eax
lea ecx, [ebp - 0xac8]
mov byte [ebp - 4], al
call fcn.00405118
lea eax, [ebp - 0xcec]
push edi
push eax
call fcn.00414bb4
xor eax, eax
push 0x800
push eax
lea eax, [ebp - 0xa90]
push eax
call fcn.00464590
add esp, 0x14
lea eax, [ebp - 0xd00]
mov esi, 0x400
mov dword [ebp - 0xd00], esi
push eax
lea eax, [ebp - 0xa90]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x458626
push str.Unknown
lea eax, [ebp - 0xa90]
push esi
push eax
call fcn.0046b418
add esp, 0xc
push 0xfde9
push 0xffffffffffffffff
lea edx, [ebp - 0xa90]
lea ecx, [ebp - 0xae0]
call fcn.00418c95
pop ecx
pop ecx
push edi
lea eax, [ebp - 0xae0]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0xcec]
push str.Username:
push eax
call fcn.00414bb4
pop ecx
pop ecx
push eax
call fcn.0041374a
pop ecx
pop ecx
push eax
call fcn.00414bb4
pop ecx
pop ecx
xor eax, eax
lea ecx, [ebp - 0xae0]
mov byte [ebp - 4], al
call fcn.00404f45
push 0x40
pop esi
xor eax, eax
push esi
push eax
lea eax, [ebp - 0x90]
push eax
call fcn.00464590
add esp, 0xc
mov dword [ebp - 0xd04], esi
xor eax, eax
mov esi, 0x4d351c
mov dword [ebp - 0xd08], eax
lea eax, [ebp - 0xd04]
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0xd08]
push eax
push esi
push str.SoftwareSogouExplorer
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x458751
xor eax, eax
lea edi, [ebp - 0xac0]
stosd dword es:[edi], eax
lea ecx, [ebp - 0xac0]
xor edx, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
push eax
call fcn.00421ac7
pop ecx
test al, al
je 0x45871f
push dword [ebp - 0xab4]
lea eax, [ebp - 0x90]
push dword [ebp - 0xab8]
push dword [ebp - 0xabc]
push dword [ebp - 0xac0]
push str._08X_08X_08X_08X
push eax
call fcn.00413ba4
add esp, 0x18
lea ecx, [ebp - 0x90]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x458728
sub ecx, edx
lea eax, [ebp - 0x90]
push ecx
push eax
push 1
push esi
push str.SoftwareSogouExplorer
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov edi, 0x4d29e0
push edi
push str.OS_Version:
push edi
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0xcec]
push str.HID:
push eax
call fcn.00414bb4
pop ecx
pop ecx
push eax
call fcn.00414bb4
pop ecx
pop ecx
push eax
call fcn.00414bb4
pop ecx
pop ecx
push eax
call fcn.00414bb4
pop ecx
pop ecx
mov ecx, eax
call fcn.00458a73
push eax
call fcn.00414bb4
pop ecx
pop ecx
lea eax, [ebp - 0xd38]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov edi, dword [ebp - 0xd24]
lea eax, [ebp - 0xcec]
push str.Processor:
push eax
call fcn.00414bb4
push 0xa
mov esi, eax
lea eax, [ebp - 0x50]
push 0x20
push eax
push edi
call fcn.004670dc
lea eax, [ebp - 0x50]
push eax
push esi
call fcn.00414bb4
mov esi, dword [ebp - 0xd20]
push str._processor_s___Type:
push eax
call fcn.00414bb4
push 0xa
mov edi, eax
lea eax, [ebp - 0x30]
push 0x20
push eax
push esi
call fcn.004670dc
add esp, 0x38
lea eax, [ebp - 0x30]
push 0x4d29e0
push eax
push edi
call fcn.00414bb4
pop ecx
pop ecx
push eax
call fcn.00414bb4
pop ecx
pop ecx
mov edi, 0x4d29e0
lea eax, [ebp - 0xcec]
push edi
push str.Global_Memory:
push eax
call fcn.00414bb4
pop ecx
pop ecx
mov ecx, eax
call 0x458ba5
push eax
call fcn.00414bb4
mov esi, str._r_n_r_n____________________________________________________r_n
pop ecx
pop ecx
test ebx, ebx
je 0x4588fc
push edi
push str.Process_HeapMemory:__r_n
lea eax, [ebp - 0xcec]
mov dword [ebp - 0xcf4], ebx
push esi
push eax
call fcn.00414bb4
pop ecx
pop ecx
push eax
call fcn.00414bb4
pop ecx
pop ecx
lea edx, [ebp - 0xcf4]
mov ecx, eax
call 0x458da5
push eax
call fcn.00414bb4
mov edi, dword [ebp - 0xcf0]
lea eax, [ebp - 0xcec]
pop ecx
pop ecx
push str.GDI_Handles:__r_n_r_n
mov edi, dword [edi + 0xc]
push esi
push eax
call fcn.00414bb4
pop ecx
pop ecx
push eax
call fcn.00414bb4
mov esi, eax
mov edx, ebx
push edi
mov ecx, esi
call 0x45a585
mov edi, 0x4d29e0
push edi
push esi
call fcn.00414bb4
add esp, 0x14
mov dword [ebp - 0xcf4], ebx
mov esi, str._r_n_r_n____________________________________________________r_n
lea eax, [ebp - 0xcec]
push edi
push str.Modules:__r_n_r_n
push esi
push eax
call fcn.00414bb4
pop ecx
pop ecx
push eax
call fcn.00414bb4
pop ecx
pop ecx
lea edx, [ebp - 0xcf4]
mov ecx, eax
call 0x459046
push eax
call fcn.00414bb4
pop ecx
pop ecx
push str.Processes:__r_n_r_n
lea eax, [ebp - 0xcec]
push esi
push eax
call fcn.00414bb4
pop ecx
pop ecx
push eax
call fcn.00414bb4
pop ecx
pop ecx
mov esi, eax
xor eax, eax
push eax
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
cmp eax, 0xffffffff
je 0x458935
mov edx, eax
mov ecx, esi
call fcn.00459560
mov esi, eax
push edi
push esi
call fcn.00414bb4
pop ecx
pop ecx
push str.Driver_Modules:__r_n_r_n
lea eax, [ebp - 0xcec]
push str._r_n_r_n____________________________________________________r_n
push eax
call fcn.00414bb4
pop ecx
pop ecx
push eax
call fcn.00414bb4
mov esi, eax
mov ecx, esi
call fcn.0045b4c2
push edi
push esi
call fcn.00414bb4
add esp, 0x10
test ebx, ebx
je 0x45897a
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xcec]
call fcn.00405ae7
lea ecx, [ebp - 0xcec]
mov esi, eax
call fcn.00414c36
push ecx
mov ecx, dword [ebp - 0xd0c]
mov edx, str.errorlog.txt
push esi
push eax
call fcn.0045c811
add esp, 0xc
lea ecx, [ebp - 0xcec]
call fcn.0040a6d0
call fcn.00461a3b
ret
call fcn.0046155b
int3