Function at 0x49aaeb
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push esi
cmp eax, 0xf
push edi
mov dword [ebp - 4], ebx
jne 0x49ab62
mov esi, dword [ebp + 8]
cmp dword [esi + 0x54], ebx
je 0x49ab12
cmp dword [esi + 0x44], ebx
jne 0x49aedc
lea eax, [ebp - 0x44]
push eax
push dword [esi + 0x64]
call dword [sym.imp.USER32.dll_BeginPaint]
mov edi, eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 8]
push eax
mov ecx, esi
call fcn.0049aa84
cmp dword [ebp + 8], ebx
jle 0x49ab48
cmp dword [ebp + 0x10], ebx
jle 0x49ab48
push ebx
push dword [ebp + 0x10]
push dword [ebp + 8]
push edi
call dword [sym.imp.GDI32.dll_OffsetWindowOrgEx]
push edi
mov ecx, esi
call fcn.0049b4d6
lea eax, [ebp - 0x44]
push eax
push dword [esi + 0x64]
call dword [sym.imp.USER32.dll_EndPaint]
jmp 0x49ae38
mov esi, 0x100
cmp eax, esi
jne 0x49abb1
cmp dword [ebp + 0x10], 0x70
mov edi, dword [ebp + 8]
jne 0x49ab96
mov ecx, edi
call fcn.0049b2ad
push ebx
push 0xe146
push 0x111
push dword [edi + 0x64]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp + 0x10]
push esi
call fcn.0049a6f5
test eax, eax
je 0x49aedc
jmp 0x49ae38
cmp eax, 0x113
jne 0x49adae
mov esi, dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_KillTimer]
mov eax, 0x2be2
cmp dword [ebp + 0x10], eax
jne 0x49abe6
push eax
push dword [esi + 0x64]
call edi
push 0x4bd5dc
push 0x4cc32c
call fcn.0049d06e
pop ecx
pop ecx
mov eax, 0x2be3
cmp dword [ebp + 0x10], eax
jne 0x49abfd
push eax
push dword [esi + 0x64]
call edi
mov ecx, esi
call fcn.0049b442
cmp dword [ebp + 0x10], 0x457
jne 0x49aca7
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x1b
mov dword [ebp + 0x10], ebx
mov dword [ebp + 8], ebx
call edi
mov ebx, 0x8000
test ebx, eax
je 0x49ac2a
mov dword [ebp + 0x10], 1
push 0x5b
call edi
push 1
test ebx, eax
pop edi
je 0x49ac38
mov dword [ebp + 8], edi
cmp dword [0x4b9cc4], 0xffffffff
jne 0x49ac70
xor eax, eax
cmp dword [ebp + 0x10], eax
je 0x49ac77
cmp dword [ebp + 8], eax
je 0x49ac72
mov dword [0x4b9cc4], edi
cmp dword [esi + 0x9c], eax
mov ecx, esi
je 0x49ac64
call fcn.0049b2ad
jmp 0x49ac69
call fcn.0049b442
mov eax, edi
jmp 0x49aede
xor eax, eax
cmp dword [ebp + 0x10], eax
jne 0x49ac7e
or dword [0x4b9cc4], 0xffffffff
cmp dword [ebp + 8], eax
je 0x49aedc
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ebx, eax
je 0x49aedc
push 0xaffe
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x49aedc
mov ebx, 0x3e8
cmp dword [ebp + 0x10], ebx
jne 0x49aedc
push ebx
push dword [esi + 0x64]
call edi
xor edi, edi
mov ecx, esi
push edi
call fcn.0049b902
push edi
push 0xa
push ebx
push dword [esi + 0x64]
call dword [sym.imp.USER32.dll_SetTimer]
cmp dword [0x4b412c], edi
je 0x49ad38
cmp dword [esi + 0x50], edi
mov edi, dword [sym.imp.USER32.dll_SetWindowTextW]
jne 0x49acef
push str.Click_here_to
push dword [esi + 0x64]
call edi
cmp dword [esi + 0x50], 0xc8
jne 0x49ad02
push str.set_keyboard_focus
push dword [esi + 0x64]
call edi
cmp dword [esi + 0x50], 0x190
jne 0x49ad15
push str.to_resize_Magnifi
push dword [esi + 0x64]
call edi
cmp dword [esi + 0x50], 0x258
jne 0x49ad28
push str.over_the_Keyboard
push dword [esi + 0x64]
call edi
cmp dword [esi + 0x50], 0x320
jne 0x49ad99
push str._CTRLESC_To_Tray_n
jmp 0x49ad94
cmp dword [esi + 0x50], edi
mov edi, dword [sym.imp.USER32.dll_SetWindowTextW]
jne 0x49ad4d
push str.Klicken_Sie_bitte_hier
push dword [esi + 0x64]
call edi
cmp dword [esi + 0x50], 0xc8
jne 0x49ad60
push str.um_den_Tastaturfocus
push dword [esi + 0x64]
call edi
cmp dword [esi + 0x50], 0x190
jne 0x49ad73
push str.zu_erhalten
push dword [esi + 0x64]
call edi
cmp dword [esi + 0x50], 0x258
jne 0x49ad86
push str.um_die_Lupe_einzustellen
push dword [esi + 0x64]
call edi
cmp dword [esi + 0x50], 0x320
jne 0x49ad99
push str._UMSCHALTESC_To_Tray_n
push dword [esi + 0x64]
call edi
inc dword [esi + 0x50]
cmp dword [esi + 0x50], ebx
jle 0x49ae38
and dword [esi + 0x50], 0
jmp 0x49ae38
cmp eax, 0x200
jne 0x49adc0
mov ecx, dword [ebp + 8]
push ebx
call fcn.0049b902
jmp 0x49ae38
cmp eax, 0x201
je 0x49aedc
cmp eax, 0x204
je 0x49aedc
cmp eax, 0x8d2
je 0x49aedc
mov esi, dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_RedrawWindow]
cmp eax, 0x20a
mov ebx, 0x105
jne 0x49ae0c
mov eax, dword [ebp + 0x10]
shr eax, 0x10
test ax, ax
jg 0x49aeac
jl 0x49ae70
jmp 0x49aedc
cmp eax, 0x115
je 0x49ae60
cmp eax, 0x114
je 0x49ae60
cmp eax, 0x20
jne 0x49ae40
cmp dword [0x4cc308], 0
je 0x49aedc
mov eax, dword [ebp + 8]
push dword [eax + 0x4c]
call dword [sym.imp.USER32.dll_SetCursor]
push 1
pop eax
jmp 0x49aede
cmp eax, 0xd34
jne 0x49aedc
push dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
call fcn.0049b132
mov ecx, dword [ebp + 8]
call fcn.0049b442
jmp 0x49aedc
movzx eax, word [ebp + 0x10]
test eax, eax
mov dword [ebp - 4], eax
je 0x49ae70
cmp eax, 2
jne 0x49aea0
fld dword [esi + 0x94]
fcomp dword [0x4aae54]
lea ecx, [esi + 0x94]
fnstsw ax
sahf
jbe 0x49aea0
fld dword [ecx]
fsub dword [0x4aae54]
push ebx
push 0
push 0
push dword [esi + 0x64]
fstp dword [ecx]
call edi
call fcn.0043aed1
cmp dword [ebp - 4], 1
je 0x49aeac
cmp dword [ebp - 4], 3
jne 0x49aedc
fld dword [esi + 0x94]
fcomp dword [0x4ac184]
lea ecx, [esi + 0x94]
fnstsw ax
sahf
jae 0x49aedc
fld dword [ecx]
fadd dword [0x4aae54]
push ebx
push 0
push 0
push dword [esi + 0x64]
fstp dword [ecx]
call edi
call fcn.0043aed1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10