Function at 0x40463d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push esi
cmp eax, 0xf
push edi
mov dword [ebp - 4], ebx
jne 0x4046b4
mov esi, dword [ebp + 8]
cmp dword [esi + 0x54], ebx
je 0x404664
cmp dword [esi + 0x44], ebx
jne 0x404ae1
lea eax, [ebp - 0x44]
push eax
push dword [esi + 0x64]
call dword [sym.imp.USER32.dll_BeginPaint]
mov edi, eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 8]
push eax
mov ecx, esi
call fcn.00404555
cmp dword [ebp + 8], ebx
jle 0x40469a
cmp dword [ebp + 0x10], ebx
jle 0x40469a
push ebx
push dword [ebp + 0x10]
push dword [ebp + 8]
push edi
call dword [sym.imp.GDI32.dll_OffsetWindowOrgEx]
push edi
mov ecx, esi
call fcn.0040515d
lea eax, [ebp - 0x44]
push eax
push dword [esi + 0x64]
call dword [sym.imp.USER32.dll_EndPaint]
jmp 0x404a22
mov esi, 0x100
cmp eax, esi
jne 0x404703
cmp dword [ebp + 0x10], 0x70
mov edi, dword [ebp + 8]
jne 0x4046e8
mov ecx, edi
call fcn.00404f2e
push ebx
push 0x8008
push 0x111
push dword [edi + 0x64]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp + 0x10]
push esi
call fcn.0040416d
test eax, eax
je 0x404ae1
jmp 0x404a22
cmp eax, 0x113
jne 0x404998
mov esi, dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_KillTimer]
mov eax, 0x2be2
cmp dword [ebp + 0x10], eax
jne 0x404738
push eax
push dword [esi + 0x64]
call edi
push 0x4178a0
push 0x417910
call sub.MSVCRT.dll_sprintf
pop ecx
pop ecx
mov eax, 0x2be3
cmp dword [ebp + 0x10], eax
jne 0x40474f
push eax
push dword [esi + 0x64]
call edi
mov ecx, esi
call fcn.004050c3
cmp dword [ebp + 0x10], 0x457
jne 0x40488e
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor eax, eax
push 0x1b
mov dword [ebp + 0x10], eax
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], eax
call edi
mov ebx, 0x8000
test ebx, eax
je 0x404781
mov dword [ebp + 0x10], 1
push 0x5b
call edi
test ebx, eax
je 0x404790
mov dword [ebp + 8], 1
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ebx, eax
je 0x4047a3
mov dword [ebp + 0xc], 1
xor edi, edi
cmp dword [ebp + 0x10], edi
je 0x4047f8
cmp dword [ebp + 8], edi
jne 0x4047e0
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ebx, eax
je 0x4047e0
cmp dword [ebp + 0xc], edi
jne 0x4047e0
mov dword [0x40cbb0], 1
cmp dword [esi + 0x9c], edi
mov ecx, esi
je 0x4047db
call fcn.00404f2e
jmp 0x4047e0
call fcn.004050c3
cmp dword [0x4178e8], 1
jne 0x4047f8
cmp dword [esi + 0x9c], edi
je 0x404819
mov ecx, esi
call fcn.00404f2e
cmp dword [0x4178e8], 2
jne 0x404819
call fcn.004045bc
test eax, eax
je 0x404819
cmp dword [esi + 0x9c], edi
je 0x404819
mov ecx, esi
call fcn.00404f2e
cmp dword [0x40cbb0], 0xffffffff
jne 0x404859
cmp dword [ebp + 0x10], edi
je 0x40485e
cmp dword [ebp + 8], edi
je 0x404859
cmp dword [ebp + 0xc], edi
jne 0x404859
mov dword [0x40cbb0], 1
cmp dword [esi + 0x9c], edi
mov ecx, esi
je 0x40484f
call fcn.00404f2e
jmp 0x404a22
call fcn.004050c3
jmp 0x404a22
cmp dword [ebp + 0x10], edi
jne 0x404865
or dword [0x40cbb0], 0xffffffff
cmp dword [ebp + 8], edi
je 0x404ae1
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ebx, eax
je 0x404ae1
push 0xaffe
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x404ae1
mov ebx, 0x3e8
cmp dword [ebp + 0x10], ebx
jne 0x404ae1
push ebx
push dword [esi + 0x64]
call edi
push 0
mov ecx, esi
call fcn.004055a2
push 0
push 0xa
push ebx
push dword [esi + 0x64]
call dword [sym.imp.USER32.dll_SetTimer]
cmp dword [0x415c98], 1
jne 0x404921
cmp dword [esi + 0x50], 0
mov edi, dword [sym.imp.USER32.dll_SetWindowTextA]
jne 0x4048d8
push str.Click_here_to
push dword [esi + 0x64]
call edi
cmp dword [esi + 0x50], 0xc8
jne 0x4048eb
push str.set_keyboard_focus
push dword [esi + 0x64]
call edi
cmp dword [esi + 0x50], 0x190
jne 0x4048fe
push str.to_resize_Magnifi
push dword [esi + 0x64]
call edi
cmp dword [esi + 0x50], 0x258
jne 0x404911
push str.over_the_Keyboard
push dword [esi + 0x64]
call edi
cmp dword [esi + 0x50], 0x320
jne 0x404983
push str._CTRLESC_To_Tray_n
jmp 0x40497e
cmp dword [esi + 0x50], 0
mov edi, dword [sym.imp.USER32.dll_SetWindowTextA]
jne 0x404937
push str.Klicken_Sie_bitte_hier
push dword [esi + 0x64]
call edi
cmp dword [esi + 0x50], 0xc8
jne 0x40494a
push str.um_den_Tastaturfocus
push dword [esi + 0x64]
call edi
cmp dword [esi + 0x50], 0x190
jne 0x40495d
push str.zu_erhalten
push dword [esi + 0x64]
call edi
cmp dword [esi + 0x50], 0x258
jne 0x404970
push str.um_die_Lupe_einzustellen
push dword [esi + 0x64]
call edi
cmp dword [esi + 0x50], 0x320
jne 0x404983
push str._UMSCHALTESC_To_Tray_n
push dword [esi + 0x64]
call edi
inc dword [esi + 0x50]
cmp dword [esi + 0x50], ebx
jle 0x404a22
and dword [esi + 0x50], 0
jmp 0x404a22
cmp eax, 0x200
jne 0x4049aa
mov ecx, dword [ebp + 8]
push ebx
call fcn.004055a2
jmp 0x404a22
cmp eax, 0x201
je 0x404acb
cmp eax, 0x204
je 0x404acb
cmp eax, 0x8d2
je 0x404ae1
mov esi, dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_RedrawWindow]
cmp eax, 0x20a
mov ebx, 0x105
jne 0x4049f6
mov eax, dword [ebp + 0x10]
shr eax, 0x10
test ax, ax
jg 0x404a99
jl 0x404a5d
jmp 0x404ae1
cmp eax, 0x115
je 0x404a4d
cmp eax, 0x114
je 0x404a4d
cmp eax, 0x20
jne 0x404a2a
cmp dword [0x4178ec], 0
je 0x404ae1
mov eax, dword [ebp + 8]
push dword [eax + 0x4c]
call dword [sym.imp.USER32.dll_SetCursor]
push 1
pop eax
jmp 0x404ae3
cmp eax, 0x2f75
jne 0x404ae1
push dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
call fcn.00404db3
mov ecx, dword [ebp + 8]
call fcn.004050c3
jmp 0x404ae1
movzx eax, word [ebp + 0x10]
test eax, eax
mov dword [ebp - 4], eax
je 0x404a5d
cmp eax, 2
jne 0x404a8d
fld dword [esi + 0x94]
fcomp dword [0x4072f8]
lea ecx, [esi + 0x94]
fnstsw ax
sahf
jbe 0x404a8d
fld dword [ecx]
fsub dword [0x4072f8]
push ebx
push 0
push 0
push dword [esi + 0x64]
fstp dword [ecx]
call edi
call fcn.0040215d
cmp dword [ebp - 4], 1
je 0x404a99
cmp dword [ebp - 4], 3
jne 0x404ae1
fld dword [esi + 0x94]
fcomp dword [0x4072fc]
lea ecx, [esi + 0x94]
fnstsw ax
sahf
jae 0x404ae1
fld dword [ecx]
fadd dword [0x4072f8]
push ebx
push 0
push 0
push dword [esi + 0x64]
fstp dword [ecx]
call edi
call fcn.0040215d
jmp 0x404ae1
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x44], 2
jge 0x404ae1
cmp dword [0x40cba0], ebx
je 0x404ae1
call fcn.00404f2e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10