Function at 0x41f9a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x445408
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x4629b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, 0x469a38
push 0
call fcn.0040df90
mov ecx, eax
call fcn.00409580
mov ecx, esi
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x41fa09
test dx, dx
je 0x41fa05
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x41fa09
add ecx, 4
add eax, 4
test dx, dx
jne 0x41f9e3
xor eax, eax
jmp 0x41fa0e
sbb eax, eax
or eax, 1
test eax, eax
je 0x41fcca
push 0x62
mov ecx, 0x469a38
call fcn.0040df90
mov ecx, eax
call fcn.00409580
mov ecx, esi
nop dword [eax + eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x41fa56
test dx, dx
je 0x41fa52
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x41fa56
add ecx, 4
add eax, 4
test dx, dx
jne 0x41fa30
xor eax, eax
jmp 0x41fa5b
sbb eax, eax
or eax, 1
push 0xffffffffffffffff
test eax, eax
jne 0x41fa91
push 0x62
mov ecx, 0x469a38
call fcn.0040df90
mov ecx, eax
call fcn.00409580
push eax
push 0x46c7b8
call fcn.0040d880
add esp, 0xc
mov dword [0x46115c], 0
jmp 0x41fcca
push esi
call fcn.00434cd6
add esp, 8
lea ecx, [ebp - 0x44]
push esi
call fcn.00405090
push 0
push str._HIDE:ICO
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0
call fcn.0040bce0
cmp eax, 0xffffffff
je 0x41faeb
push 0xffffffffffffffff
push 0x62
mov ecx, 0x469a38
call fcn.0040df90
mov ecx, eax
call fcn.00409580
push eax
push 0x46c7b8
call fcn.0040d880
add esp, 0xc
mov dword [0x46115c], 0
push 0
push str._NUMK
lea ecx, [ebp - 0x44]
call fcn.0040bce0
cmp eax, 0xffffffff
je 0x41fb49
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 0
xorps xmm0, xmm0
push eax
movq qword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
cmp byte [ebp - 0x20], 0x7f
jae 0x41fb49
cmp byte [ebp - 0x1e], 0x7f
jae 0x41fb49
push 0x90
call dword [sym.imp.USER32.dll_GetKeyState]
push 0
test ax, ax
jne 0x41fb3a
push 3
jmp 0x41fb3c
push 1
push 0x45
push 0x90
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push str._DPI:
lea ecx, [ebp - 0x44]
call fcn.0040bce0
cmp eax, 0xffffffff
je 0x41fc75
push 3
add eax, 5
lea ecx, [ebp - 0x44]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0040c590
mov byte [ebp - 4], 1
xor esi, esi
nop dword [eax]
push esi
lea ecx, [ebp - 0x2c]
call fcn.0040af80
cmp word [eax], 0x30
jb 0x41fc6d
push esi
lea ecx, [ebp - 0x2c]
call fcn.0040af80
cmp word [eax], 0x39
ja 0x41fc6d
inc esi
cmp esi, 3
jb 0x41fb80
lea ecx, [ebp - 0x2c]
call fcn.00409580
push eax
lea ecx, [ebp - 0x60]
call fcn.00405090
push 0xa
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 2
push 0
push eax
call fcn.0042bde0
add esp, 0xc
lea ecx, [ebp - 0x60]
mov edi, eax
call fcn.004050d0
push 1
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push ebx
push 0x9e
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov esi, dword [ebp - 0x14]
cmp edi, 0x63
jle 0x41fc1f
lea ecx, [edi - 0x64]
mov eax, 0x51eb851f
mul ecx
mov ebx, edx
shr ebx, 3
test esi, esi
js 0x41fc14
add ebx, esi
jmp 0x41fc1c
not esi
inc esi
mov dword [ebp - 0x14], esi
sub ebx, esi
mov dword [ebp - 0x48], ebx
lea eax, [ebx + 4]
add eax, esi
push 0
imul ebx, eax, 0x19
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0x58
push edi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
imul ecx, eax, 0x64
mov eax, 0x2aaaaaab
push edi
push 0
imul ecx
sar edx, 4
mov esi, edx
shr esi, 0x1f
add esi, edx
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp ebx, esi
je 0x41fc6d
push 1
push 0
push dword [ebp - 0x48]
push 0x9f
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
lea ecx, [ebp - 0x2c]
call fcn.004050d0
push 0
push 0x4561a0
lea ecx, [ebp - 0x44]
call fcn.0040bce0
lea ecx, [ebp - 0x44]
push 0
push 0x4561a8
cmp eax, 0xffffffff
je 0x41fcb3
mov dword [0x46c1e4], 1
call fcn.0040bce0
cmp eax, 0xffffffff
jne 0x41fcc2
mov dword [0x46c1e4], 2
jmp 0x41fcc2
call fcn.0040bce0
cmp eax, 0xffffffff
jne 0x41fcc2
call fcn.00420d90
lea ecx, [ebp - 0x44]
call fcn.004050d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042d960
mov esp, ebp
pop ebp
ret