Function at 0x41b050
Capabilities:
Log keystrokes
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x43f338
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x78]
cmp edi, 0x20
mov esi, ecx
jb 0x41b07c
cmp edi, 0x7e
jbe 0x41b094
cmp edi, 0xa0
jb 0x41b26c
cmp edi, 0xff
ja 0x41b26c
push edi
call dword [sym.imp.USER32.dll_VkKeyScanA]
cmp ax, 0xffff
mov dword [esp + 0x10], eax
jne 0x41b0cf
push edi
push str.ignoring_unrecognised_Latin_1_keysym__d_n
push 8
push 0x44ff14
call fcn.00401e70
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
add esp, 0x64
ret 0xc
mov esi, dword [esp + 0x80]
xor ebx, ebx
mov dword [esp + 0x58], 0x11
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x60], bl
mov byte [esp + 0x61], bl
mov dword [esp + 0x64], esi
mov dword [esp + 0x70], ebx
mov dword [esp + 0x48], 0x12
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x50], bl
mov byte [esp + 0x51], bl
mov dword [esp + 0x54], esi
mov dword [esp + 0x18], 0x10
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x20], bl
mov byte [esp + 0x21], bl
mov dword [esp + 0x24], esi
mov dword [esp + 0x38], 0xa0
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x40], bl
mov byte [esp + 0x41], bl
mov dword [esp + 0x44], esi
mov dword [esp + 0x28], 0xa1
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x30], bl
mov byte [esp + 0x31], bl
mov dword [esp + 0x34], esi
cmp byte [esp + 0x7c], bl
mov byte [esp + 0x70], 4
je 0x41b1b8
shr eax, 8
test al, 2
mov byte [esp + 0x78], al
je 0x41b177
lea ecx, [esp + 0x58]
call fcn.004197f0
mov al, byte [esp + 0x78]
test al, 4
je 0x41b188
lea ecx, [esp + 0x48]
call fcn.004197f0
mov al, byte [esp + 0x78]
test al, 1
je 0x41b197
lea ecx, [esp + 0x18]
call fcn.004197f0
jmp 0x41b1b8
call fcn.004227b0
test eax, eax
je 0x41b1a6
lea ecx, [esp + 0x18]
jmp 0x41b1b3
lea ecx, [esp + 0x38]
call fcn.00419860
lea ecx, [esp + 0x28]
call fcn.00419860
movzx eax, byte [esp + 0x7c]
movzx ebp, byte [esp + 0x10]
push eax
push ebp
push edi
push edi
push str.latin_1_key:_keysym__d_0x_x__vkCode_0x_x_down__d_n
push 9
push 0x44ff14
call fcn.00401e70
add esp, 0x1c
cmp esi, ebx
je 0x41b1ea
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx + 0x204]
mov cl, byte [esp + 0x7c]
xor eax, eax
cmp cl, bl
setne al
push ebx
dec eax
and eax, 2
push eax
push ebx
push ebp
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov ecx, dword [esp + 0x18]
push eax
push ecx
call dword [sym.imp.USER32.dll_keybd_event]
lea ecx, [esp + 0x28]
mov byte [esp + 0x70], 3
call fcn.004198d0
lea ecx, [esp + 0x38]
mov byte [esp + 0x70], 2
call fcn.004198d0
lea ecx, [esp + 0x18]
mov byte [esp + 0x70], 1
call fcn.004198d0
lea ecx, [esp + 0x48]
mov byte [esp + 0x70], bl
call fcn.004198d0
lea ecx, [esp + 0x58]
mov dword [esp + 0x70], 0xffffffff
call fcn.004198d0
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
add esp, 0x64
ret 0xc
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.0041a280
mov ecx, dword [eax]
cmp ecx, dword [esi + 4]
jne 0x41b2ae
push edi
push str.ignoring_unknown_keysym__d_n
push 8
push 0x44ff14
call fcn.00401e70
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
add esp, 0x64
ret 0xc
lea edx, [esp + 0x78]
push edx
mov ecx, esi
call fcn.0041af10
mov al, byte [eax]
lea ecx, [esp + 0x78]
add esi, 0xc
push ecx
mov ecx, esi
mov byte [esp + 0x14], al
xor ebx, ebx
xor ebp, ebp
call fcn.0041af10
cmp byte [eax], bl
je 0x41b2dc
mov ebp, 1
cmp byte [esp + 0x7c], bl
jne 0x41b2e5
or ebp, 2
lea edx, [esp + 0x78]
push edx
mov ecx, esi
call fcn.0041af10
movzx ecx, byte [esp + 0x7c]
movzx edx, byte [eax]
movzx esi, byte [esp + 0x10]
push ecx
push edx
push esi
push edi
push edi
push str.keyboard_key:_keysym__d_0x_x__vkCode_0x_x_ext__d_down__d_n
push 9
push 0x44ff14
call fcn.00401e70
mov al, byte [esp + 0x9c]
add esp, 0x20
cmp al, bl
je 0x41b362
cmp byte [esp + 0x10], 0x2e
jne 0x41b362
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call edi
test ah, ah
jns 0x41b362
push 0x12
call edi
test ah, ah
jns 0x41b362
call fcn.004227c0
test eax, eax
je 0x41b362
call fcn.00422b60
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
add esp, 0x64
ret 0xc
call fcn.004227b0
test eax, eax
je 0x41b390
sub esi, 0xa1
je 0x41b38b
sub esi, 2
je 0x41b384
sub esi, 2
jne 0x41b390
mov byte [esp + 0x10], 0x12
jmp 0x41b390
mov byte [esp + 0x10], 0x11
jmp 0x41b390
mov byte [esp + 0x10], 0x10
mov ecx, dword [esp + 0x80]
cmp ecx, ebx
je 0x41b3a5
mov eax, dword [ecx]
push 1
call dword [eax + 0x204]
movzx ecx, byte [esp + 0x10]
push ebx
push ebp
push ebx
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov edx, dword [esp + 0x18]
push eax
push edx
call dword [sym.imp.USER32.dll_keybd_event]
mov ecx, dword [esp + 0x68]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x64
ret 0xc