Function at 0x403e00
Capabilities:
Check os version
Log keystrokes via polling

Disassembly:
sub esp, 0x38
push ebx
mov ebx, dword [esp + 0x44]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push esi
push edi
push 0x44451c
push ebx
call ebp
test eax, eax
mov edi, dword [esp + 0x58]
mov esi, dword [esp + 0x4c]
jne 0x403e2d
mov eax, dword [esi + 0x144]
mov dword [edi], eax
push 0x44452c
push ebx
call ebp
test eax, eax
jne 0x403e41
mov ecx, dword [esi + 0x148]
mov dword [edi], ecx
push 0x44453c
push ebx
call ebp
test eax, eax
jne 0x403e55
mov edx, dword [esi + 0x14c]
mov dword [edi], edx
push 0x44454c
push ebx
call ebp
test eax, eax
jne 0x403e69
mov eax, dword [esi + 0x150]
mov dword [edi], eax
push 0x44455c
push ebx
call ebp
test eax, eax
jne 0x403e7d
mov ecx, dword [esi + 0x154]
mov dword [edi], ecx
push 0x44456c
push ebx
call ebp
test eax, eax
jne 0x403e91
mov edx, dword [esi + 0x158]
mov dword [edi], edx
push str.String1_Global_
push ebx
call ebp
test eax, eax
mov esi, dword [esp + 0x54]
jne 0x403eb2
mov eax, dword [esp + 0x4c]
add eax, 0x15c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.String2_Global_
push ebx
call ebp
test eax, eax
jne 0x403ed0
mov ecx, dword [esp + 0x4c]
add ecx, 0x261
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.String3_Global_
push ebx
call ebp
test eax, eax
jne 0x403eee
mov edx, dword [esp + 0x4c]
add edx, 0x366
push edx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.String4_Global_
push ebx
call ebp
test eax, eax
jne 0x403f0b
mov eax, dword [esp + 0x4c]
add eax, 0x46b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.String5_Global_
push ebx
call ebp
test eax, eax
jne 0x403f29
mov ecx, dword [esp + 0x4c]
add ecx, 0x570
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.String6_Global_
push ebx
call ebp
test eax, eax
jne 0x403f47
mov edx, dword [esp + 0x4c]
add edx, 0x675
push edx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.Random
push ebx
call ebp
test eax, eax
jne 0x403f71
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0043a778
add esp, 4
call fcn.0043a782
cdq
mov ecx, 0x64
idiv ecx
mov dword [edi], edx
push str.ScrollLock
push ebx
call ebp
test eax, eax
jne 0x403f90
push 0x91
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and eax, 1
mov dword [edi], eax
push str.NumLock
push ebx
call ebp
test eax, eax
jne 0x403faf
push 0x90
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and eax, 1
mov dword [edi], eax
push str.CapsLock
push ebx
call ebp
test eax, eax
jne 0x403fcb
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and eax, 1
mov dword [edi], eax
push str.AltKey
push ebx
call ebp
test eax, eax
jne 0x403fe7
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and eax, 1
mov dword [edi], eax
push str.CtrlKey
push ebx
call ebp
test eax, eax
jne 0x404003
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and eax, 1
mov dword [edi], eax
push str.ShiftKey
push ebx
call ebp
test eax, eax
jne 0x40401f
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and eax, 1
mov dword [edi], eax
lea edx, [esp + 0x10]
push edx
call fcn.0043a69c
lea eax, [esp + 0x14]
push eax
call fcn.0043a53c
add esp, 8
mov dword [esp + 0x58], eax
push str.SystemTime
push ebx
call ebp
test eax, eax
jne 0x40405d
mov eax, dword [esp + 0x58]
xor ecx, ecx
xor edx, edx
mov ch, byte [eax + 8]
mov dl, byte [eax]
mov cl, byte [eax + 4]
shl ecx, 8
or ecx, edx
mov dword [edi], ecx
push 0x44462c
push ebx
call ebp
test eax, eax
jne 0x404072
mov eax, dword [esp + 0x58]
mov ecx, dword [eax + 8]
mov dword [edi], ecx
push 0x444634
push ebx
call ebp
test eax, eax
jne 0x404087
mov edx, dword [esp + 0x58]
mov eax, dword [edx + 4]
mov dword [edi], eax
push str.ElapsedTime
push ebx
call ebp
test eax, eax
jne 0x4040a5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x4c]
sub eax, dword [ecx + 0x128]
mov dword [edi], eax
push str.Resolution
push ebx
call ebp
test eax, eax
jne 0x4040dc
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push str._04dx_04d
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov dword [edi], eax
push str.Language
push ebx
call ebp
test eax, eax
jne 0x40411f
lea edx, [esp + 0x14]
push edx
call fcn.0042c280
lea eax, [esp + 0x14]
push 0x44466c
push eax
call ebp
test eax, eax
jne 0x404109
push 0x444674
jmp 0x40410e
lea ecx, [esp + 0x15]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov dword [edi], eax
push str.Color_Depth
push ebx
call ebp
test eax, eax
jne 0x404196
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
push 0xe
push ebx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0xc
push ebx
mov ebp, eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
imul ebp, eax
push ebx
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
dec ebp
je 0x404176
sub ebp, 3
je 0x40416f
sub ebp, 4
je 0x404168
push 0x444690
jmp 0x40417b
push 0x44468c
jmp 0x40417b
push 0x444688
jmp 0x40417b
push 0x444684
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
inc eax
mov ebx, dword [esp + 0x50]
mov dword [edi], eax
push str.CurrentScene
push ebx
call ebp
test eax, eax
jne 0x4041c1
mov edx, dword [esp + 0x4c]
push 2
push edx
call fcn.00403bc0
push esi
push 0xa
push eax
call fcn.00405900
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov dword [edi], eax
push str.OSVersion
push ebx
call ebp
test eax, eax
jne 0x4041da
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xff
mov dword [edi], eax
push str.OSVersionMinor
push ebx
call ebp
test eax, eax
jne 0x4041f8
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor ecx, ecx
mov cl, ah
and ecx, 0xff
mov dword [edi], ecx
push str.X_Extent
push ebx
call ebp
test eax, eax
jne 0x40420d
push eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [edi], eax
push str.Y_Extent
push ebx
call ebp
test eax, eax
jne 0x404223
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [edi], eax
push 0x4446dc
push ebx
call ebp
test eax, eax
jne 0x404238
mov edx, dword [esp + 0x58]
mov eax, dword [edx + 0xc]
mov dword [edi], eax
push 0x4446e0
push ebx
call ebp
test eax, eax
jne 0x40424e
mov ecx, dword [esp + 0x58]
mov edx, dword [ecx + 0x10]
inc edx
mov dword [edi], edx
push 0x4446e8
push ebx
call ebp
test eax, eax
jne 0x404269
mov eax, dword [esp + 0x58]
mov ecx, dword [eax + 0x14]
add ecx, 0x76c
mov dword [edi], ecx
push str.SystemDate
push ebx
call ebp
test eax, eax
jne 0x4042a5
mov eax, dword [esp + 0x58]
mov edx, dword [eax + 0x14]
mov ecx, dword [eax + 0xc]
add edx, 0x76c
push edx
mov edx, dword [eax + 0x10]
inc edx
push ecx
push edx
push str._02u._02u._u
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov dword [edi], eax
push str.DetectOS
push ebx
call ebp
test eax, eax
jne 0x404347
push 0x444718
call fcn.0043a4bf
add esp, 4
push str.Windows_NT
push eax
call ebp
test eax, eax
jne 0x4042f5
push str.PROCESSOR_ARCHITECTURE
call fcn.0043a4bf
add esp, 4
push str.ALPHA
push eax
call ebp
test eax, eax
jne 0x4042ee
push str.Alpha
jmp 0x404336
push 0x444750
jmp 0x404336
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov ecx, eax
mov dl, ah
and ecx, 0xff
and edx, 0xff
mov eax, edx
cmp eax, 0xa
jg 0x404325
cmp ecx, 3
jne 0x404320
push str.Win31
jmp 0x404336
cmp eax, 0xa
jl 0x404331
cmp ecx, 4
jne 0x404331
push str.Win98
jmp 0x404336
push str.Win95
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov dword [edi], eax
push str.MonthName
push ebx
call ebp
test eax, eax
jne 0x404382
mov eax, dword [esp + 0x58]
lea ecx, [esp + 0x20]
push eax
push 0x444778
push 0x28
push ecx
call fcn.00439c58
add esp, 0x10
lea edx, [esp + 0x20]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov dword [edi], eax
push str.DayName
push ebx
call ebp
test eax, eax
jne 0x4043bd
mov eax, dword [esp + 0x58]
lea ecx, [esp + 0x20]
push eax
push 0x444784
push 0x28
push ecx
call fcn.00439c58
add esp, 0x10
lea edx, [esp + 0x20]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov dword [edi], eax
push str.IsPDF
push ebx
call ebp
test eax, eax
jne 0x4043f7
push str..pdf
call fcn.00404480
add esp, 4
test eax, eax
je 0x4043e1
push 0x444798
jmp 0x4043e6
push 0x4447a0
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov dword [edi], eax
push str.IsFTP
push ebx
call ebp
test eax, eax
jne 0x404431
push 0x4447b0
call fcn.00404480
add esp, 4
test eax, eax
je 0x40441b
push 0x4447b4
jmp 0x404420
push 0x4447bc
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov dword [edi], eax
push str.IsHTTP
push ebx
call ebp
test eax, eax
jne 0x40446b
push str.http
call fcn.00404480
add esp, 4
test eax, eax
je 0x404455
push str.True
jmp 0x40445a
push str.False
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov dword [edi], eax
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x38
ret 0x10