Function at 0x49a59e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push esi
cmp eax, 0xf
push edi
mov dword [ebp - 4], ebx
jne 0x49a615
mov esi, dword [ebp + 8]
cmp dword [esi + 0x54], ebx
je 0x49a5c5
cmp dword [esi + 0x44], ebx
jne 0x49a98f
lea eax, [ebp - 0x44]
push eax
push dword [esi + 0x64]
call dword [sym.imp.USER32.dll_BeginPaint]
mov edi, eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 8]
push eax
mov ecx, esi
call fcn.0049a537
cmp dword [ebp + 8], ebx
jle 0x49a5fb
cmp dword [ebp + 0x10], ebx
jle 0x49a5fb
push ebx
push dword [ebp + 0x10]
push dword [ebp + 8]
push edi
call dword [sym.imp.GDI32.dll_OffsetWindowOrgEx]
push edi
mov ecx, esi
call fcn.0049af89
lea eax, [ebp - 0x44]
push eax
push dword [esi + 0x64]
call dword [sym.imp.USER32.dll_EndPaint]
jmp 0x49a8eb
mov esi, 0x100
cmp eax, esi
jne 0x49a664
cmp dword [ebp + 0x10], 0x70
mov edi, dword [ebp + 8]
jne 0x49a649
mov ecx, edi
call fcn.0049ad60
push ebx
push 0xe146
push 0x111
push dword [edi + 0x64]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp + 0x10]
push esi
call fcn.0049a1a8
test eax, eax
je 0x49a98f
jmp 0x49a8eb
cmp eax, 0x113
jne 0x49a861
mov esi, dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_KillTimer]
mov eax, 0x2be2
cmp dword [ebp + 0x10], eax
jne 0x49a699
push eax
push dword [esi + 0x64]
call edi
push 0x4bc51c
push 0x4cb244
call fcn.0049cb1e
pop ecx
pop ecx
mov eax, 0x2be3
cmp dword [ebp + 0x10], eax
jne 0x49a6b0
push eax
push dword [esi + 0x64]
call edi
mov ecx, esi
call fcn.0049aef5
cmp dword [ebp + 0x10], 0x457
jne 0x49a75a
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x1b
mov dword [ebp + 0x10], ebx
mov dword [ebp + 8], ebx
call edi
mov ebx, 0x8000
test ebx, eax
je 0x49a6dd
mov dword [ebp + 0x10], 1
push 0x5b
call edi
push 1
test ebx, eax
pop edi
je 0x49a6eb
mov dword [ebp + 8], edi
cmp dword [0x4b8bfc], 0xffffffff
jne 0x49a723
xor eax, eax
cmp dword [ebp + 0x10], eax
je 0x49a72a
cmp dword [ebp + 8], eax
je 0x49a725
mov dword [0x4b8bfc], edi
cmp dword [esi + 0x9c], eax
mov ecx, esi
je 0x49a717
call fcn.0049ad60
jmp 0x49a71c
call fcn.0049aef5
mov eax, edi
jmp 0x49a991
xor eax, eax
cmp dword [ebp + 0x10], eax
jne 0x49a731
or dword [0x4b8bfc], 0xffffffff
cmp dword [ebp + 8], eax
je 0x49a98f
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ebx, eax
je 0x49a98f
push 0xaffe
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x49a98f
mov ebx, 0x3e8
cmp dword [ebp + 0x10], ebx
jne 0x49a98f
push ebx
push dword [esi + 0x64]
call edi
xor edi, edi
mov ecx, esi
push edi
call fcn.0049b3b5
push edi
push 0xa
push ebx
push dword [esi + 0x64]
call dword [sym.imp.USER32.dll_SetTimer]
cmp dword [0x4b312c], edi
je 0x49a7eb
cmp dword [esi + 0x50], edi
mov edi, dword [sym.imp.USER32.dll_SetWindowTextW]
jne 0x49a7a2
push str.Click_here_to
push dword [esi + 0x64]
call edi
cmp dword [esi + 0x50], 0xc8
jne 0x49a7b5
push str.set_keyboard_focus
push dword [esi + 0x64]
call edi
cmp dword [esi + 0x50], 0x190
jne 0x49a7c8
push str.to_resize_Magnifi
push dword [esi + 0x64]
call edi
cmp dword [esi + 0x50], 0x258
jne 0x49a7db
push str.over_the_Keyboard
push dword [esi + 0x64]
call edi
cmp dword [esi + 0x50], 0x320
jne 0x49a84c
push str._CTRLESC_To_Tray_n
jmp 0x49a847
cmp dword [esi + 0x50], edi
mov edi, dword [sym.imp.USER32.dll_SetWindowTextW]
jne 0x49a800
push str.Klicken_Sie_bitte_hier
push dword [esi + 0x64]
call edi
cmp dword [esi + 0x50], 0xc8
jne 0x49a813
push str.um_den_Tastaturfocus
push dword [esi + 0x64]
call edi
cmp dword [esi + 0x50], 0x190
jne 0x49a826
push str.zu_erhalten
push dword [esi + 0x64]
call edi
cmp dword [esi + 0x50], 0x258
jne 0x49a839
push str.um_die_Lupe_einzustellen
push dword [esi + 0x64]
call edi
cmp dword [esi + 0x50], 0x320
jne 0x49a84c
push str._UMSCHALTESC_To_Tray_n
push dword [esi + 0x64]
call edi
inc dword [esi + 0x50]
cmp dword [esi + 0x50], ebx
jle 0x49a8eb
and dword [esi + 0x50], 0
jmp 0x49a8eb
cmp eax, 0x200
jne 0x49a873
mov ecx, dword [ebp + 8]
push ebx
call fcn.0049b3b5
jmp 0x49a8eb
cmp eax, 0x201
je 0x49a98f
cmp eax, 0x204
je 0x49a98f
cmp eax, 0x8d2
je 0x49a98f
mov esi, dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_RedrawWindow]
cmp eax, 0x20a
mov ebx, 0x105
jne 0x49a8bf
mov eax, dword [ebp + 0x10]
shr eax, 0x10
test ax, ax
jg 0x49a95f
jl 0x49a923
jmp 0x49a98f
cmp eax, 0x115
je 0x49a913
cmp eax, 0x114
je 0x49a913
cmp eax, 0x20
jne 0x49a8f3
cmp dword [0x4cb220], 0
je 0x49a98f
mov eax, dword [ebp + 8]
push dword [eax + 0x4c]
call dword [sym.imp.USER32.dll_SetCursor]
push 1
pop eax
jmp 0x49a991
cmp eax, 0xd34
jne 0x49a98f
push dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
call fcn.0049abe5
mov ecx, dword [ebp + 8]
call fcn.0049aef5
jmp 0x49a98f
movzx eax, word [ebp + 0x10]
test eax, eax
mov dword [ebp - 4], eax
je 0x49a923
cmp eax, 2
jne 0x49a953
fld dword [esi + 0x94]
fcomp dword [0x4a9e44]
lea ecx, [esi + 0x94]
fnstsw ax
sahf
jbe 0x49a953
fld dword [ecx]
fsub dword [0x4a9e44]
push ebx
push 0
push 0
push dword [esi + 0x64]
fstp dword [ecx]
call edi
call fcn.0043ae4f
cmp dword [ebp - 4], 1
je 0x49a95f
cmp dword [ebp - 4], 3
jne 0x49a98f
fld dword [esi + 0x94]
fcomp dword [0x4ab174]
lea ecx, [esi + 0x94]
fnstsw ax
sahf
jae 0x49a98f
fld dword [ecx]
fadd dword [0x4a9e44]
push ebx
push 0
push 0
push dword [esi + 0x64]
fstp dword [ecx]
call edi
call fcn.0043ae4f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10