Function at 0x702940
Capabilities:
Check os version
Create process on windows
Create process suspended
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push edi
push 0x702930
call esi
push 0x524ab0
call esi
mov ebx, dword [ebp + 0x10]
push 0x79c38c
push ebx
call fcn.00712e20
add esp, 8
test eax, eax
jmp 0x7029e8
push 0x79c374
push ebx
call fcn.00712e20
add esp, 8
test eax, eax
je 0x702a01
mov byte [0x83ecb9], 2
push 0x79c360
push ebx
call fcn.00712e20
add esp, 8
test eax, eax
setne cl
mov byte [0x83e0c2], cl
call fcn.00768d9c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, 0x79c344
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x114]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x79c338
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x814650
call fcn.00546430
push 0x79c32c
push ebx
call fcn.00712e20
mov edx, eax
add esp, 8
test edx, edx
je 0x702aa7
mov edi, 0x79c32c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
add edx, ecx
lea ecx, [ebp - 0x114]
mov al, byte [edx]
test al, al
je 0x702aa4
cmp al, 9
je 0x702aa4
cmp al, 0x20
je 0x702aa4
mov byte [ecx], al
mov al, byte [edx + 1]
inc ecx
inc edx
test al, al
jne 0x702a91
mov byte [ecx], 0
lea ecx, [ebp - 0x114]
push ecx
call fcn.0052f310
mov eax, dword [0x81424c]
add esp, 4
cmp eax, 3
jne 0x702adf
lea edx, [ebp - 0x114]
push 0x77103c
push edx
call fcn.00712e20
add esp, 8
test eax, eax
je 0x702adf
mov byte [0x838b74], 0
mov esi, dword [0x770b3c]
mov edi, dword [0x770b38]
xor ebx, ebx
push ebx
push esi
call fcn.0071e49f
add esp, 8
test eax, eax
nop
jmp 0x702bde
mov ecx, 0x83a9e0
call fcn.006c0000
mov edi, 0x79c320
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x30]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x79c310
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.007022a0
test eax, eax
jne 0x702ccc
mov ebx, dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea edi, [ebp - 0x30]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x214]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
mov dword [ebp - 0x10], eax
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x10
lea edi, [ebp - 0x78]
rep stosd dword es:[edi], eax
xor ecx, ecx
mov eax, 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x50], eax
mov word [ebp - 0x4c], ax
lea eax, [ebp - 0x7c]
mov dword [ebp - 8], ecx
push edx
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 4], ecx
push ecx
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x7c], 0x44
push ecx
push 0
call ebx
mov edx, dword [ebp - 0x10]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.007022a0
test eax, eax
je 0x702c45
xor ebx, ebx
push 0x30000
push 0x20000
call fcn.007173bc
add esp, 8
lea eax, [ebp - 0x1c]
mov dword [ebp + 0x10], ebx
push 8
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x702d1f
mov ecx, dword [ebp - 0x1c]
cmp ecx, 1
mov eax, ecx
ja 0x702d00
mov eax, 1
mov edx, dword [ebp - 0x18]
cmp eax, edx
jae 0x702d13
cmp ecx, 1
ja 0x702d15
mov ecx, 1
jmp 0x702d15
mov ecx, edx
push ecx
mov dword [ebp + 0x10], ecx
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
call fcn.0041bfe0
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov eax, dword [0x81424c]
cmp eax, ebx
nop
jmp 0x702e34
mov ecx, 0x83a9e0
call fcn.006c1a20
cmp dword [0x81424c], ebx
jne 0x702eca
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, 0x27
xor eax, eax
lea edi, [ebp - 0xd4]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xd4]
mov dword [ebp - 0xd4], 0x9c
push eax
call esi
test eax, eax
jne 0x702e8d
lea ecx, [ebp - 0xd4]
mov dword [ebp - 0xd4], 0x94
push ecx
call esi
test eax, eax
je 0x702ea2
cmp dword [ebp - 0xc4], 1
sete al
test al, al
je 0x702ea2
call fcn.00700f40
jmp 0x702ea7
call fcn.00701330
test al, al
jmp 0x702eca
push 0x79c2b4
call fcn.0054a300
mov ecx, eax
call fcn.0054b280
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
push eax
push ecx
call fcn.00702060
add esp, 8
test eax, eax
jne 0x702efd
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
jmp 0x702f14
cmp dword [0x83e848], ebx
je 0x702f46
call fcn.0041b650
test al, al
jne 0x702f46
push 0x79c21c
call fcn.00531ef0
add esp, 4
mov dword [0x769d34], ebx
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [0x83e820]
mov eax, 6
cmp ecx, ebx
je 0x702f5a
mov eax, 7
mov ecx, dword [0x83e828]
mov edx, dword [0x83e824]
push eax
lea eax, [ebp - 0xb4]
mov dword [ebp - 0xac], ecx
mov ecx, dword [0x83ec88]
push eax
push 0x83e7d8
mov dword [ebp - 0xa8], edx
mov edx, dword [0x83e82c]
push 0x83e7e8
push ecx
mov ecx, 0x79e950
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x9c], ebx
call fcn.00403fb0
test eax, eax
jge 0x702fc3
push 0x79c1f0
call fcn.00531ef0
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, 0x79e950
call fcn.00404fe0
mov dword [0x7a0f18], eax
call fcn.00418b90
test al, al
jne 0x702fe9
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x3c
call fcn.0041bff0
mov edx, dword [0x83ec88]
add esp, 4
push edx
call dword [sym.imp.USER32.dll_SetFocus]
cmp dword [0x79eb24], ebx
je 0x70300f
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
mov ecx, 0x7a1228
call fcn.00419700
mov eax, dword [0x7a0f18]
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x24]
push ecx
push edx
mov ecx, 0x7dabc0
call fcn.00506740
mov ecx, 0x7dabc0
call fcn.00501fe0
mov ecx, 0x7d1450
call fcn.0042e570
push ebx
push 5
push 0x79c294
mov ecx, 0x7d1450
call fcn.0042e580
mov ecx, 0x7da930
call fcn.00435950
call fcn.0040a9c0
mov eax, dword [0x81424c]
cmp eax, 4
je 0x7030cd
cmp eax, 8
je 0x7030cd
cmp eax, 9
je 0x7030cd
cmp eax, 6
jne 0x70308a
mov ecx, dword [0x770b54]
cmp ecx, ebx
je 0x7030cd
jmp 0x7030aa
cmp eax, 0xc
je 0x7030cd
cmp eax, ebx
jne 0x70309b
mov dword [0x78ef08], ebx
jmp 0x7030d7
mov ecx, dword [0x770b54]
cmp ecx, ebx
je 0x7030c1
cmp eax, 2
je 0x7030c1
cmp ecx, 5
je 0x7030c1
cmp eax, 3
je 0x7030c1
cmp eax, 0x13
je 0x7030c1
mov dword [0x78ef08], ebx
jmp 0x7030d7
mov dword [0x78ef08], 2
jmp 0x7030d7
mov dword [0x78ef08], 1
push 1
mov ecx, 0x83ec78
call fcn.00544bd0
push 0x78d3f0
push ebx
mov ecx, 0x814260
call fcn.00533590
call fcn.0041b920
mov ecx, 0x7dabc0
call fcn.00506780
call fcn.00419180
mov ecx, eax
call fcn.00418880
call fcn.00418d10
mov ecx, 0x7dabc0
call fcn.00506ce0
mov ecx, 0x7dabc0
call fcn.00503f80
mov ecx, 0x83a9e0
call fcn.006c1710
call fcn.0054a300
mov ecx, eax
call fcn.0054a710
mov ecx, 0x7a0f08
call fcn.0040c320
mov eax, dword [0x7a0f18]
mov ecx, 0x79e950
push eax
call fcn.00404b50
mov ecx, 0x79e950
call fcn.00403e80
mov ecx, 0x7a1228
call fcn.004197d0
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push 1
push ebx
push ebx
lea ecx, [ebp - 0x38]
push ebx
push ecx
call esi
test eax, eax
je 0x7031d4
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
cmp dword [ebp - 0x34], 0x100
jne 0x7031b5
cmp dword [ebp - 0x30], 0xe5
jne 0x7031b5
mov edx, dword [0x813acc]
mov eax, dword [ebp - 0x38]
push eax
mov ebx, dword [edx]
call sub.IMM32.dll_ImmGetVirtualKey
mov ecx, dword [0x813acc]
push eax
call dword [ebx + 0xc]
xor ebx, ebx
lea ecx, [ebp - 0x38]
push ecx
call edi
lea edx, [ebp - 0x38]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push ebx
push ebx
lea eax, [ebp - 0x38]
push ebx
push eax
call esi
test eax, eax
jne 0x703186
mov esi, dword [sym.imp.ole32.dll_CoUninitialize]
call esi
mov ecx, dword [0x83ec88]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
call fcn.005471e0
call fcn.005a4c10
mov ecx, eax
call fcn.00550ca0
call esi
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x70320a
push eax
call dword [sym.imp.WINMM.dll_timeEndPeriod]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10