Function at 0x416cf0
Capabilities:
Create process on windows
Hide graphical window
Log keystrokes
Print debug messages
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a9abf
mov eax, dword fs:[0]
push eax
mov eax, 0x10284
call fcn.00483550
mov eax, dword [0x4dc38c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10284], edi
mov eax, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x10288], eax
mov eax, dword [ebp + 8]
cmp eax, 0x479
ja 0x4171f6
je 0x416f07
cmp eax, 0x113
ja 0x416edf
je 0x416d9c
cmp eax, 0x10
je 0x416d80
cmp eax, 0xa1
jne 0x4174bc
mov ecx, dword [edi + 0x554]
test ecx, ecx
je 0x416d9c
mov eax, dword [ecx]
push 0
call dword [eax + 0xf8]
jmp 0x4174bc
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0x10288]
mov dword [eax], 1
jmp 0x4174c8
cmp esi, 0x73
jne 0x4174bc
lea ecx, [edi + 0x588]
call fcn.00435e57
test al, al
jne 0x4174bc
lea ecx, [edi + 0x588]
call fcn.00435c9d
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push eax
call esi
push 0x4c931c
call esi
cmp dword [edi + 0x610], 0
jne 0x416e64
cmp dword [edi + 0x6b0], 0
je 0x416e64
lea ecx, [edi + 0x588]
call fcn.00435c9d
push eax
lea ecx, [ebp - 0x10040]
call fcn.0040e2a0
lea edx, [ebp - 0x10040]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10028]
call fcn.0042a5a0
lea ecx, [ebp - 0x10040]
mov byte [ebp - 4], 2
call fcn.0040e260
cmp dword [ebp - 0x10018], 0
jbe 0x416e42
mov ecx, dword [edi + 0x6b0]
lea eax, [ebp - 0x10028]
push eax
call fcn.00410980
lea ecx, [ebp - 0x10028]
mov dword [ebp - 4], 0xffffffff
call fcn.00402270
lea ecx, [edi + 0x588]
call fcn.00435a9c
jmp 0x4174bc
mov ecx, edi
call fcn.004197a0
mov esi, eax
test esi, esi
je 0x416ecf
lea ecx, [edi + 0x588]
call fcn.00435c9d
push eax
lea ecx, [ebp - 0x10040]
call fcn.0040e2a0
lea edx, [ebp - 0x10040]
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x10028]
call fcn.0042a5a0
push ecx
push 0
push eax
mov byte [ebp - 4], 4
mov ecx, esi
push dword [edi + 4]
call fcn.0041eec0
lea ecx, [ebp - 0x10028]
call fcn.00402270
lea ecx, [ebp - 0x10040]
mov dword [ebp - 4], 0xffffffff
call fcn.0040e260
lea ecx, [edi + 0x588]
call fcn.00435a9c
jmp 0x4174bc
sub eax, 0x473
je 0x416efb
sub eax, 1
jne 0x4174bc
push eax
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x4174bc
mov ecx, esi
call fcn.0041f1f0
jmp 0x4174bc
test esi, esi
je 0x4171e5
push 0xffffffffffffffff
push esi
lea ecx, [ebp - 0x10178]
call fcn.004355dd
push 0xffffffffffffffff
lea eax, [esi + 0x200]
mov dword [ebp - 4], 5
push eax
lea ecx, [ebp - 0x10280]
call fcn.004355dd
push 0xffffffffffffffff
lea eax, [esi + 0xa00]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x101fc]
call fcn.004355dd
push esi
lea ecx, [edi + 0x38]
mov byte [ebp - 4], 7
call fcn.004379ee
push str.menu115
lea ecx, [ebp - 0x10178]
call fcn.00435a6f
test eax, eax
je 0x416f89
push str.menu115plus
lea ecx, [ebp - 0x10178]
call fcn.00435a6f
test eax, eax
jne 0x4171c4
lea eax, [ebp - 0x10284]
push eax
push str.Software115Chrome
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, dword [ebp - 0x10284]
test esi, esi
je 0x4171c4
push 0x10000
lea eax, [ebp - 0x10010]
push 0
push eax
call fcn.00486070
add esp, 0xc
mov dword [ebp - 0x1028c], 0x104
lea eax, [ebp - 0x1028c]
mov dword [ebp - 0x10290], 1
push eax
lea eax, [ebp - 0x10010]
push eax
lea eax, [ebp - 0x10290]
push eax
push 0
push str.Path
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4171c4
lea edi, [ebp - 0x10010]
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x417010
mov ecx, 8
mov esi, str.___upload_task_
rep movsd dword es:[edi], dword [esi]
push str.menu115
lea ecx, [ebp - 0x10178]
movsw word es:[edi], word [esi]
call fcn.00435a6f
lea edi, [ebp - 0x10010]
add edi, 0xfffffffe
test eax, eax
jne 0x417070
nop word [eax + eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x417050
mov eax, dword [0x4c939c]
push 0x4c93a0
jmp 0x417086
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x417070
mov eax, dword [0x4c93ac]
push 0x4c93b0
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [ebp - 0x10280]
call fcn.00435c9d
mov edx, eax
mov esi, eax
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4170a0
lea edi, [ebp - 0x10010]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4170b6
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x10010]
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x4170e0
mov eax, dword [0x4c93c0]
push 0x44
mov dword [edi], eax
lea eax, [ebp - 0x100b4]
push 0
push eax
call fcn.00486070
add esp, 0xc
mov dword [ebp - 0x100b4], 0x44
lea ecx, [ebp - 0x10040]
push 0x4c93c4
call fcn.0040e2a0
lea ecx, [ebp - 0x10010]
mov byte [ebp - 4], 8
push ecx
mov edx, eax
lea ecx, [ebp - 0x10058]
call fcn.0041d4d0
push 0x4c931c
mov edx, eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x10070]
call fcn.0041d4d0
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x417159
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x10070]
call fcn.0040e260
lea ecx, [ebp - 0x10058]
call fcn.0040e260
lea ecx, [ebp - 0x10040]
call fcn.0040e260
lea eax, [ebp - 0x10020]
push eax
lea eax, [ebp - 0x100b4]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10010]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4171c4
push dword [ebp - 0x1001c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10020]
call esi
lea ecx, [ebp - 0x101fc]
call fcn.004356df
lea ecx, [ebp - 0x10280]
call fcn.004356df
lea ecx, [ebp - 0x10178]
call fcn.004356df
mov eax, dword [ebp - 0x10288]
mov dword [eax], 1
jmp 0x4174c8
cmp eax, 0x7e8
ja 0x4173fd
je 0x4173c5
sub eax, 0x4fa
je 0x417393
sub eax, 2
jne 0x4174bc
cmp dword [edi + 0x610], eax
jne 0x4174bc
cmp dword [edi + 0x6b0], eax
je 0x4174bc
lea ebx, [edi + 0x698]
cmp ebx, esi
je 0x417248
push 0xffffffffffffffff
push eax
push esi
mov ecx, ebx
call fcn.0040e560
test esi, esi
je 0x417254
push ecx
mov ecx, esi
call fcn.00417540
push 0x4c8e1c
mov ecx, ebx
call fcn.00412eb0
test eax, eax
jne 0x41732a
lea eax, [ebp - 0x101fc]
mov byte [edi + 0x6c0], 1
push eax
mov ecx, edi
call fcn.0041a930
mov ecx, eax
mov dword [ebp - 4], 0xa
call fcn.00435ca7
test eax, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x101fc]
setg bl
call fcn.004356df
test bl, bl
je 0x4174bc
lea eax, [ebp - 0x100f4]
mov ecx, edi
push eax
call fcn.0041a930
mov ecx, eax
mov dword [ebp - 4], 0xb
call fcn.00435c9d
push eax
lea ecx, [ebp - 0x10058]
call fcn.0040e2a0
lea edx, [ebp - 0x10058]
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x10070]
call fcn.0042a5a0
lea ecx, [ebp - 0x10058]
call fcn.0040e260
lea ecx, [ebp - 0x100f4]
mov byte [ebp - 4], 0xf
call fcn.004356df
mov ecx, dword [edi + 0x6b0]
lea eax, [ebp - 0x10070]
push eax
call fcn.00410980
mov ecx, edi
call fcn.00419bd0
lea ecx, [ebp - 0x10070]
call fcn.00402270
jmp 0x4174bc
mov ecx, dword [edi + 0x550]
add ecx, 0x550
mov eax, dword [ecx]
call dword [eax + 0xc]
test eax, eax
jne 0x4174bc
mov ecx, dword [edi + 0x550]
cmp byte [edi + 0x6b7], al
jne 0x417358
push str.fileimg_search.png_dest210_89_289_168
jmp 0x41735d
push str.fileimg_search.png_dest210_79_289_158
call fcn.004461c7
mov ecx, dword [edi + 0x574]
test ecx, ecx
je 0x4174bc
cmp dword [ebx + 0x14], 8
jb 0x417378
mov ebx, dword [ebx]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x2c]
mov ecx, dword [edi + 0x574]
push 1
mov eax, dword [ecx]
call dword [eax + 0xf8]
jmp 0x4174bc
call fcn.00419e50
push esi
lea ecx, [edi + 0x6c4]
call fcn.0041d180
test esi, esi
je 0x4173b0
push ecx
mov ecx, esi
call fcn.00410320
mov ecx, edi
call fcn.00419380
push 0
mov ecx, edi
call fcn.00418c80
jmp 0x4174bc
call fcn.00419710
cmp dword [edi + 0x610], 0
je 0x4173ea
mov ecx, edi
call fcn.0041aac0
mov ecx, dword [edi + 0x530]
push 0x4c8ec8
mov eax, dword [ecx]
call dword [eax + 0x2c]
call fcn.00419a90
push 0
mov ecx, edi
call fcn.0041ad30
jmp 0x4174ae
sub eax, 0x7e9
je 0x41746b
sub eax, 1
jne 0x4174bc
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push esi
mov ebx, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov edi, eax
push 1
push ebx
push edi
call esi
mov eax, dword [ebp - 0x10284]
push 1
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0x10284]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [ebp - 0x10284]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push 0
push ebx
push edi
call esi
jmp 0x4174bc
test esi, esi
je 0x4174ae
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
push dword [esi]
push str.115everything_gid:_lld_uid:_lld_n
call fcn.0042b8f0
add esp, 0x14
lea eax, [esi + 0x10]
mov ecx, edi
push eax
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
push dword [esi]
call fcn.00419950
push 1
mov ecx, edi
call fcn.0041ad30
push ecx
mov ecx, esi
call fcn.004174f0
mov ecx, dword [edi + 0x530]
mov eax, dword [ecx]
call dword [eax + 0x11c]
mov eax, dword [ebp - 0x10288]
mov dword [eax], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048254c
mov esp, ebp
pop ebp
ret 0x10