Function at 0x4754a0
Capabilities:
Get session user name
Get system information on windows
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c7353
mov eax, dword fs:[0]
push eax
sub esp, 0xbe8
mov eax, dword [0x4fe37c]
xor eax, ebp
mov dword [ebp - 0x40], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
push ecx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x294]
call fcn.0040adf0
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx + 8]
test eax, eax
je 0x47550b
mov dword [ebp - 0xbc0], str.Real_Crash
jmp 0x475515
mov dword [ebp - 0xbc0], str.Try_catch__just_an_except_
push 0
push 0xfde9
lea ecx, [ebp - 0xaf0]
call fcn.0040a290
mov dword [ebp - 0xbc4], eax
mov ecx, dword [ebp - 0xbc4]
mov dword [ebp - 0xbc8], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0xbc8]
mov eax, dword [edx]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
lea eax, [ebp - 0xb0c]
push eax
call fcn.004bf860
add esp, 0x10
mov dword [ebp - 0xbcc], eax
push 0x4d3008
push 0x4d300c
mov ecx, dword [ebp - 0xbc0]
push ecx
push str.Real_crash_or_try_catch:
push 0x4d3054
mov edx, dword [ebp - 0xbcc]
push edx
push str.Exception_From:
lea eax, [ebp - 0x294]
push eax
call fcn.004156c0
add esp, 8
push eax
call fcn.00417320
add esp, 8
push eax
call fcn.004156c0
add esp, 8
push eax
call fcn.004156c0
add esp, 8
push eax
call fcn.004156c0
add esp, 8
push eax
call fcn.004156c0
add esp, 8
push eax
call fcn.004156c0
add esp, 8
lea ecx, [ebp - 0xb0c]
call fcn.00406d00
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xaf0]
call fcn.00439bd0
cmp dword [ebp - 0x3c], 0
je 0x475841
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x18], 0
je 0x475841
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x18]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 0xb8]
push edx
mov eax, dword [ebp - 0x3c]
push eax
lea ecx, [ebp - 0xb38]
push ecx
call fcn.00474a30
add esp, 0xc
mov dword [ebp - 0xbd0], eax
push 0x4d306c
push 8
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x18]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 0xb8]
push edx
lea ecx, [ebp - 0xb14]
call fcn.004114f0
push eax
push 0x3a
push 4
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 4]
mov eax, dword [edx + 0xbc]
push eax
lea ecx, [ebp - 0xb1c]
call fcn.004114f0
push eax
push 0x4d3070
mov ecx, dword [ebp - 0xbd0]
push ecx
push str.Exception_Module:
push 0x4d3088
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x10]
push eax
push str.Exception_TID:
push 0x4d309c
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
push edx
push str.Exception_PID:
lea eax, [ebp - 0x294]
push eax
call fcn.004156c0
add esp, 8
push eax
call fcn.0043c180
add esp, 8
push eax
call fcn.004156c0
add esp, 8
push eax
call fcn.004156c0
add esp, 8
push eax
call fcn.0043c180
add esp, 8
push eax
call fcn.004156c0
add esp, 8
push eax
call fcn.004156c0
add esp, 8
push eax
call fcn.00417320
add esp, 8
push eax
call fcn.004156c0
add esp, 8
push eax
call fcn.004743f0
add esp, 8
push eax
call fcn.00415470
add esp, 8
push eax
call fcn.004743f0
add esp, 8
push eax
call fcn.004156c0
add esp, 8
lea ecx, [ebp - 0xb38]
call fcn.00406d00
push 0x4d30b0
push 8
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x18]
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0xb40]
call fcn.004114f0
push eax
push str.__0x
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
call fcn.004742e0
add esp, 4
push eax
push str.Exception_Type:
lea eax, [ebp - 0x294]
push eax
call fcn.004156c0
add esp, 8
push eax
call fcn.004156c0
add esp, 8
push eax
call fcn.004156c0
add esp, 8
push eax
call fcn.004743f0
add esp, 8
push eax
call fcn.004156c0
add esp, 8
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x18]
mov eax, dword [edx]
cmp dword [eax], 0xc0000005
jne 0x475841
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x18]
mov eax, dword [edx]
cmp dword [eax + 0x10], 2
jb 0x475841
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x18]
mov eax, dword [edx]
cmp dword [eax + 0x14], 0
je 0x4757d4
mov dword [ebp - 0xbd4], str.Write_to
jmp 0x4757de
mov dword [ebp - 0xbd4], str.Read_from
push str._caused_an_access_violation._r_n
push 8
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x18]
mov eax, dword [edx]
mov ecx, dword [eax + 0x18]
push ecx
lea ecx, [ebp - 0xb48]
call fcn.004114f0
push eax
push str._location_0x
mov edx, dword [ebp - 0xbd4]
push edx
push 0x4d3118
lea eax, [ebp - 0x294]
push eax
call fcn.004156c0
add esp, 8
push eax
call fcn.004156c0
add esp, 8
push eax
call fcn.004156c0
add esp, 8
push eax
call fcn.004743f0
add esp, 8
push eax
call fcn.004156c0
add esp, 8
lea ecx, [ebp - 0x2bc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x4d312c
push 0x4d3130
lea edx, [ebp - 0x2bc]
push edx
push str.Exception_Time:
lea eax, [ebp - 0x294]
push eax
call fcn.004156c0
add esp, 8
push eax
call fcn.00474450
add esp, 8
push eax
call fcn.004156c0
add esp, 8
push eax
call fcn.004156c0
add esp, 8
cmp dword [ebp - 0x3c], 0
je 0x47596d
lea ecx, [ebp - 0x29c]
push ecx
lea edx, [ebp - 0x2a4]
push edx
lea eax, [ebp - 0x2ac]
push eax
lea ecx, [ebp - 0x2b4]
push ecx
mov edx, dword [ebp - 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x47596d
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0xadc], eax
mov ecx, dword [ebp - 0x2b8]
mov dword [ebp - 0xad8], ecx
mov edx, dword [ebp - 0x2b4]
mov dword [ebp - 0xad4], edx
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0xad0], eax
mov ecx, dword [ebp - 0xadc]
sub ecx, dword [ebp - 0xad4]
mov edx, dword [ebp - 0xad8]
sbb edx, dword [ebp - 0xad0]
push 0
push 0x2710
push edx
push ecx
call fcn.004566d0
mov dword [ebp - 0xacc], eax
mov dword [ebp - 0xac8], edx
push 0x4d3148
mov eax, dword [ebp - 0xac8]
push eax
mov ecx, dword [ebp - 0xacc]
push ecx
lea ecx, [ebp - 0xb54]
call fcn.00418b30
push eax
push str.Process_Uptime:
lea edx, [ebp - 0x294]
push edx
call fcn.004156c0
add esp, 8
push eax
call fcn.00474330
add esp, 8
push eax
call fcn.004156c0
add esp, 8
cmp dword [ebp - 0x3c], 0
je 0x475a48
push 0
push 0xfde9
lea ecx, [ebp - 0xb58]
call fcn.0040a290
mov dword [ebp - 0xbd8], eax
mov eax, dword [ebp - 0xbd8]
mov dword [ebp - 0xbdc], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x3c]
push ecx
lea edx, [ebp - 0xb74]
push edx
call fcn.004748b0
add esp, 8
mov dword [ebp - 0xbe0], eax
mov eax, dword [ebp - 0xbe0]
mov dword [ebp - 0xbe4], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0xbdc]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp - 0xbe4]
push eax
lea ecx, [ebp - 0xb90]
push ecx
call fcn.004bfa10
add esp, 0xc
mov dword [ebp - 0xbe8], eax
push 0x4d3160
mov edx, dword [ebp - 0xbe8]
push edx
push str.Command_Line:
lea eax, [ebp - 0x294]
push eax
call fcn.004156c0
add esp, 8
push eax
call fcn.00417320
add esp, 8
push eax
call fcn.004156c0
add esp, 8
lea ecx, [ebp - 0xb90]
call fcn.00406d00
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xb74]
call fcn.00406fd0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb58]
call fcn.00439bd0
push 0x4d3174
lea ecx, [ebp - 0x294]
push ecx
call fcn.004156c0
add esp, 8
xor edx, edx
mov word [ebp - 0xac4], dx
push 0x7fe
push 0
lea eax, [ebp - 0xac2]
push eax
call fcn.00445020
add esp, 0xc
mov dword [ebp - 0x2c0], 0x400
lea ecx, [ebp - 0x2c0]
push ecx
lea edx, [ebp - 0xac4]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x475ab1
push 0x4d3178
lea eax, [ebp - 0xac4]
push eax
call fcn.004366b0
add esp, 8
push 0
push 0xfde9
lea ecx, [ebp - 0xb94]
call fcn.0040a290
mov dword [ebp - 0xbec], eax
mov ecx, dword [ebp - 0xbec]
mov dword [ebp - 0xbf0], ecx
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0xbf0]
mov eax, dword [edx]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0xac4]
push ecx
lea edx, [ebp - 0xbb0]
push edx
call fcn.004bf860
add esp, 0x10
mov dword [ebp - 0xbf4], eax
push 0x4d3188
mov eax, dword [ebp - 0xbf4]
push eax
push str.Username:
lea ecx, [ebp - 0x294]
push ecx
call fcn.004156c0
add esp, 8
push eax
call fcn.00417320
add esp, 8
push eax
call fcn.004156c0
add esp, 8
lea ecx, [ebp - 0xbb0]
call fcn.00406d00
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb94]
call fcn.00439bd0
mov byte [ebp - 0x84], 0
push 0x3f
push 0
lea edx, [ebp - 0x83]
push edx
call fcn.00445020
add esp, 0xc
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0x40
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x84]
push ecx
lea edx, [ebp - 0x34]
push edx
push 0x4d3198
push 0x4d319c
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x475c32
mov dword [ebp - 0xaec], 0
xor eax, eax
mov dword [ebp - 0xae8], eax
mov dword [ebp - 0xae4], eax
mov dword [ebp - 0xae0], eax
lea ecx, [ebp - 0xaec]
push ecx
call fcn.004be4d0
add esp, 4
movzx edx, al
test edx, edx
je 0x475c04
mov eax, dword [ebp - 0xae0]
push eax
mov ecx, dword [ebp - 0xae4]
push ecx
mov edx, dword [ebp - 0xae8]
push edx
mov eax, dword [ebp - 0xaec]
push eax
push 0x4d31b4
lea ecx, [ebp - 0x84]
push ecx
call fcn.00409430
add esp, 0x18
lea edx, [ebp - 0x84]
push edx
call fcn.004446f0
add esp, 4
push eax
lea eax, [ebp - 0x84]
push eax
push 1
push 0x4d31c8
push str.SoftwareSogouExplorer
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
xor ecx, ecx
mov byte [ebp - 0xbb1], cl
push 0x4d31e4
lea edx, [ebp - 0xbb1]
push edx
push str.OS_Version:
push 0x4d31f8
lea eax, [ebp - 0x84]
push eax
push str.HID:
lea ecx, [ebp - 0x294]
push ecx
call fcn.004156c0
add esp, 8
push eax
call fcn.004156c0
add esp, 8
push eax
call fcn.004156c0
add esp, 8
push eax
call fcn.004156c0
add esp, 8
push eax
call fcn.004746b0
add esp, 8
push eax
call fcn.004156c0
add esp, 8
lea edx, [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x4d3204
mov eax, dword [ebp - 0x18]
push eax
push str._processor_s___Type:
mov ecx, dword [ebp - 0x1c]
push ecx
push str.Processor:
lea edx, [ebp - 0x294]
push edx
call fcn.004156c0
add esp, 8
push eax
call fcn.0043c180
add esp, 8
push eax
call fcn.004156c0
add esp, 8
push eax
call fcn.0043c180
add esp, 8
push eax
call fcn.004156c0
add esp, 8
xor eax, eax
mov byte [ebp - 0xbb2], al
push 0x4d322c
lea ecx, [ebp - 0xbb2]
push ecx
push str.Memory:
lea edx, [ebp - 0x294]
push edx
call fcn.004156c0
add esp, 8
push eax
call fcn.00474520
add esp, 8
push eax
call fcn.004156c0
add esp, 8
cmp dword [ebp - 0x3c], 0
je 0x475d75
push 0x4d323c
mov eax, dword [ebp - 0x3c]
push eax
lea ecx, [ebp - 0xbb8]
call fcn.0043c660
push eax
push str.Modules:__r_n_r_n
push 0x4d3250
lea ecx, [ebp - 0x294]
push ecx
call fcn.004156c0
add esp, 8
push eax
call fcn.004156c0
add esp, 8
push eax
call fcn.00475150
add esp, 8
push eax
call fcn.004156c0
add esp, 8
xor edx, edx
mov byte [ebp - 0xbb9], dl
push 0x4d328c
lea eax, [ebp - 0xbb9]
push eax
push str.Processes:__r_n_r_n
push str._r_n_r_n____________________________________________________r_n
lea ecx, [ebp - 0x294]
push ecx
call fcn.004156c0
add esp, 8
push eax
call fcn.004156c0
add esp, 8
push eax
call fcn.00475200
add esp, 8
push eax
call fcn.004156c0
add esp, 8
cmp dword [ebp - 0x3c], 0
je 0x475dcd
mov edx, dword [ebp - 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x294]
call fcn.0041bf70
push eax
lea ecx, [ebp - 0x294]
call fcn.004154c0
push eax
push str.errorlog.txt
mov eax, dword [ebp + 8]
push eax
call fcn.00467cf0
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x294]
call fcn.0040ae20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x40]
xor ecx, ebp
call fcn.004443e3
mov esp, ebp
pop ebp
ret