Function at 0x403ce0
Capabilities:
Check os version
Log keystrokes via polling

Disassembly:
sub esp, 0x2c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push ebp
mov ebp, dword [esp + 0x3c]
push esi
push edi
push 0x441398
push ebp
call ebx
test eax, eax
mov esi, dword [esp + 0x4c]
mov edi, dword [esp + 0x40]
jne 0x403d0d
mov eax, dword [edi + 0x144]
mov dword [esi], eax
push 0x4413a8
push ebp
call ebx
test eax, eax
jne 0x403d21
mov ecx, dword [edi + 0x148]
mov dword [esi], ecx
push 0x4413b8
push ebp
call ebx
test eax, eax
jne 0x403d35
mov edx, dword [edi + 0x14c]
mov dword [esi], edx
push str.String1_Global_
push ebp
call ebx
test eax, eax
mov edi, dword [esp + 0x48]
jne 0x403d56
mov eax, dword [esp + 0x40]
add eax, 0x150
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.String2_Global_
push ebp
call ebx
test eax, eax
jne 0x403d74
mov ecx, dword [esp + 0x40]
add ecx, 0x178
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.String3_Global_
push ebp
call ebx
test eax, eax
jne 0x403d92
mov edx, dword [esp + 0x40]
add edx, 0x1a0
push edx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.Random
push ebp
call ebx
test eax, eax
jne 0x403dbc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0042ce60
add esp, 4
call fcn.0042ce70
cdq
mov ecx, 0x64
idiv ecx
mov dword [esi], edx
push str.ScrollLock
push ebp
call ebx
test eax, eax
jne 0x403ddb
push 0x91
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and eax, 1
mov dword [esi], eax
push str.NumLock
push ebp
call ebx
test eax, eax
jne 0x403dfa
push 0x90
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and eax, 1
mov dword [esi], eax
push str.CapsLock
push ebp
call ebx
test eax, eax
jne 0x403e16
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and eax, 1
mov dword [esi], eax
push str.AltKey
push ebp
call ebx
test eax, eax
jne 0x403e32
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and eax, 1
mov dword [esi], eax
push str.CtrlKey
push ebp
call ebx
test eax, eax
jne 0x403e4e
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and eax, 1
mov dword [esi], eax
push str.ShiftKey
push ebp
call ebx
test eax, eax
jne 0x403e6a
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and eax, 1
mov dword [esi], eax
lea edx, [esp + 0x10]
push edx
call fcn.0042cd30
add esp, 4
lea eax, [esp + 0x10]
push eax
call fcn.0042cb40
add esp, 4
mov dword [esp + 0x4c], eax
push str.SystemTime
push ebp
call ebx
test eax, eax
jne 0x403eab
mov eax, dword [esp + 0x4c]
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 4]
mov dl, byte [eax]
mov ch, byte [eax + 8]
shl ecx, 8
or ecx, edx
mov dword [esi], ecx
push 0x441448
push ebp
call ebx
test eax, eax
jne 0x403ec0
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax + 8]
mov dword [esi], ecx
push 0x441450
push ebp
call ebx
test eax, eax
jne 0x403ed5
mov edx, dword [esp + 0x4c]
mov eax, dword [edx + 4]
mov dword [esi], eax
push str.ElapsedTime
push ebp
call ebx
test eax, eax
jne 0x403ef3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x40]
sub eax, dword [ecx + 0x128]
mov dword [esi], eax
push str.Resolution
push ebp
call ebx
test eax, eax
jne 0x403f2a
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push str._04dx_04d
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov dword [esi], eax
push str.Color_Depth
push ebp
call ebx
test eax, eax
jne 0x403fa9
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov ebp, eax
push 0xe
push ebp
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0xc
push ebp
mov dword [esp + 0x50], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push ebp
push 0
mov edx, dword [esp + 0x50]
imul edx, eax
mov dword [esp + 0x50], edx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [esp + 0x48]
dec eax
je 0x403f8f
sub eax, 3
je 0x403f88
sub eax, 4
je 0x403f81
push str.True
jmp 0x403f94
push 0x441490
jmp 0x403f94
push 0x44148c
jmp 0x403f94
push 0x441488
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov ebp, dword [esp + 0x44]
mov dword [esi], eax
push str.CurrentScene
push ebp
call ebx
test eax, eax
jne 0x403fd4
mov eax, dword [esp + 0x40]
push 2
push eax
call fcn.00403b50
push edi
push 0xa
push eax
call fcn.00405300
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov dword [esi], eax
push str.X_Extent
push ebp
call ebx
test eax, eax
jne 0x403fe9
push eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [esi], eax
push str.Y_Extent
push ebp
call ebx
test eax, eax
jne 0x403fff
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [esi], eax
push str.OSVersion
push ebp
call ebx
test eax, eax
jne 0x404018
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xff
mov dword [esi], eax
push str.OSVersionMinor
push ebp
call ebx
test eax, eax
jne 0x404036
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor ecx, ecx
mov cl, ah
and ecx, 0xff
mov dword [esi], ecx
push 0x4414e0
push ebp
call ebx
test eax, eax
jne 0x40404b
mov edx, dword [esp + 0x4c]
mov eax, dword [edx + 0xc]
mov dword [esi], eax
push 0x4414e4
push ebp
call ebx
test eax, eax
jne 0x404061
mov ecx, dword [esp + 0x4c]
mov edx, dword [ecx + 0x10]
inc edx
mov dword [esi], edx
push 0x4414ec
push ebp
call ebx
test eax, eax
jne 0x40407c
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax + 0x14]
add ecx, 0x76c
mov dword [esi], ecx
push str.SystemDate
push ebp
call ebx
test eax, eax
jne 0x4040b8
mov eax, dword [esp + 0x4c]
mov edx, dword [eax + 0x14]
mov ecx, dword [eax + 0xc]
add edx, 0x76c
push edx
mov edx, dword [eax + 0x10]
inc edx
push ecx
push edx
push str._02u._02u._u
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov dword [esi], eax
push str.DetectOS
push ebp
call ebx
test eax, eax
jne 0x404153
push 0x44151c
call fcn.0042cab0
add esp, 4
push str.Windows_NT
push eax
call ebx
test eax, eax
jne 0x404116
push str.PROCESSOR_ARCHITECTURE
call fcn.0042cab0
add esp, 4
push str.ALPHA
push eax
call ebx
test eax, eax
jne 0x404108
push str.Alpha
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x404149
push 0x441554
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x404149
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor ecx, ecx
mov ebp, eax
mov cl, ah
and ebp, 0xff
cmp cl, 0xa
ja 0x404139
cmp ebp, 3
jne 0x404139
push str.Win3.1
jmp 0x40413e
push str.Win95
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebp, dword [esp + 0x44]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov dword [esi], eax
push str.MonthName
push ebp
call ebx
test eax, eax
jne 0x40418e
mov edx, dword [esp + 0x4c]
lea eax, [esp + 0x14]
push edx
push 0x441574
push 0x28
push eax
call fcn.0042bf70
add esp, 0x10
lea ecx, [esp + 0x14]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov dword [esi], eax
push str.DayName
push ebp
call ebx
test eax, eax
jne 0x4041c9
mov edx, dword [esp + 0x4c]
lea eax, [esp + 0x14]
push edx
push 0x441580
push 0x28
push eax
call fcn.0042bf70
add esp, 0x10
lea ecx, [esp + 0x14]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov dword [esi], eax
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2c
ret 0x10