Function at 0x41d940
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags
Log keystrokes
Log keystrokes via polling
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x5067a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x28]
lea esi, [edi + 0x10]
xor ebx, ebx
push ecx
mov ecx, esi
mov dword [esp + 0x24], ebx
mov dword [edi + 0xc], eax
call fcn.004e1f6e
mov edx, dword [esp + 0x34]
lea ebp, [edi + 0x14]
push edx
mov ecx, ebp
call fcn.004e1f6e
lea ecx, [edi + 0x1020]
mov dword [edi + 0x1018], 0xffffffff
mov dword [edi + 0x101c], ebx
call fcn.004e1daf
push esi
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], ebx
call fcn.004e1b94
mov eax, dword [esi]
mov byte [esp + 0x20], 1
push eax
lea eax, [esp + 0x38]
push eax
call fcn.004a92e0
add esp, 8
push eax
mov ecx, esi
mov byte [esp + 0x24], 2
call fcn.004e1f6e
lea ecx, [esp + 0x34]
mov byte [esp + 0x20], 1
call fcn.004e1e27
mov eax, dword [ebp]
mov ecx, dword [esi]
lea ebx, [edi + 0x18]
push eax
push 0x14
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
test eax, eax
jne 0x41db09
mov eax, dword [esi]
lea ecx, [esp + 0x34]
push eax
push ecx
call fcn.004a9510
add esp, 8
push eax
mov ecx, esi
mov byte [esp + 0x24], 3
call fcn.004e1f6e
lea ecx, [esp + 0x34]
mov byte [esp + 0x20], 1
call fcn.004e1e27
mov eax, dword [ebp]
mov ecx, dword [esi]
push eax
push 0x14
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
test eax, eax
jne 0x41db09
lea edx, [esp + 0x30]
mov ecx, esi
push edx
call fcn.004e1f6e
mov eax, dword [ebp]
mov ecx, dword [esi]
push eax
push 0x14
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
test eax, eax
jne 0x41db09
push eax
lea eax, [esp + 0x38]
push esi
push eax
call fcn.0041bfe0
add esp, 0xc
push eax
mov ecx, esi
mov byte [esp + 0x24], 4
call fcn.004e1f6e
lea ecx, [esp + 0x34]
mov byte [esp + 0x20], 1
call fcn.004e1e27
mov eax, dword [ebp]
mov ecx, dword [esi]
push eax
push 0x14
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
test eax, eax
jne 0x41db09
push 1
lea ecx, [esp + 0x38]
push esi
push ecx
call fcn.0041bfe0
add esp, 0xc
push eax
mov ecx, esi
mov byte [esp + 0x24], 5
call fcn.004e1f6e
lea ecx, [esp + 0x34]
mov byte [esp + 0x20], 1
call fcn.004e1e27
mov eax, dword [ebp]
mov ecx, dword [esi]
push eax
push 0x14
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
test eax, eax
jne 0x41db09
push 0x55ca2c
mov ecx, esi
call fcn.004e1fbe
mov eax, dword [ebp]
mov ecx, dword [esi]
push eax
push 0x14
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
test eax, eax
jle 0x41db09
mov dword [esp + 0x28], 1
push esi
lea ecx, [esp + 0x14]
call fcn.004e1b94
mov eax, dword [esp + 0x28]
mov byte [esp + 0x20], 6
test eax, eax
jne 0x41db2c
lea edx, [esp + 0x30]
mov ecx, esi
push edx
call fcn.004e1f6e
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
test eax, eax
mov dword [ecx], eax
je 0x41db43
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov ecx, edi
call fcn.0041c320
mov ecx, dword [esi]
mov dword [esp + 0x34], eax
mov eax, dword [ebp]
mov dword [edi + 0x1028], 0
push eax
push 0x800
push ebx
push 0x5705d0
push 0x55ccc8
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x41db89
cmp word [ebx], 0x31
jne 0x41db89
mov dword [edi + 0x1028], 1
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
call ebx
test ax, ax
jge 0x41dba4
mov dword [edi + 0x1028], 0
jmp 0x41dbb7
push 0x11
call ebx
test ax, ax
jge 0x41dbb7
mov dword [edi + 0x1028], 1
mov eax, dword [edi + 0x1028]
test eax, eax
je 0x41dbd8
push 0
push 0
push 0
push 0xd
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push 0xd
call dword [sym.imp.USER32.dll_keybd_event]
mov edx, dword [esi]
push 0x55ca2c
push edx
call fcn.004bdb15
add esp, 8
test eax, eax
je 0x41dc40
mov eax, dword [0x56b44c]
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], 7
push ecx
call fcn.004d8218
mov eax, dword [eax]
lea edx, [esp + 0x28]
push eax
push 0x55ccc0
push edx
call fcn.004d736f
mov ebp, dword [ebp]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push ebp
push eax
push 0x55cc9c
push ecx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [esp + 0x28]
mov byte [esp + 0x20], 6
call fcn.004e1e27
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 1
call fcn.004e1e27
lea ecx, [esp + 0x30]
mov byte [esp + 0x20], 0
call fcn.004e1e27
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
test eax, eax
je 0x41dc72
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x34]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret 0x10