Function at 0x49e350
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf1c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
xor eax, eax
lea edx, [ebp - 0x34]
push 4
push edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
call fcn.00409810
mov eax, dword [0x50b3a4]
add esp, 8
cmp byte [eax + 0x127d2], 4
jb 0x49e3c2
mov ecx, dword [ebp + 0x10]
push ebx
push ecx
mov ecx, dword [0x50b39c]
push esi
push edi
call fcn.0040e5e0
cmp esi, 1
je 0x49e3dc
cmp esi, 0x81
je 0x49e3dc
push 0xffffffffffffffeb
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov edi, eax
jmp 0x49e44e
mov edi, dword [ebx]
mov edx, dword [ebp + 8]
push edi
push 0xffffffffffffffeb
push edx
call dword [sym.imp.USER32.dll_SetWindowLongW]
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
lea ecx, [eax + eax*4]
add ecx, ecx
mov eax, 0x38e38e39
mul ecx
shr edx, 1
push edx
mov edx, dword [ebp + 8]
push 0xc84
push edx
lea ecx, [edi + 0x58]
call fcn.004aded0
mov eax, dword [0x50b3a0]
mov ecx, dword [eax + 0x113fc]
mov edx, dword [ebp + 8]
push ecx
push 0xc81
push edx
lea ecx, [edi + 0x7c]
call fcn.004aded0
mov eax, dword [0x50b3a0]
mov ecx, dword [eax + 0x11400]
mov edx, dword [ebp + 8]
push ecx
push 0xc82
push edx
lea ecx, [edi + 0x8c]
call fcn.004aded0
push edi
lea ecx, [ebp + 0xc]
call fcn.004a4840
xor edx, edx
mov dword [ebp - 4], edx
cmp esi, 0x106
jne 0x49e470
mov dword [ebp - 0x10], 1
jmp case.0x49e4b7.1
cmp edi, edx
jne 0x49e48c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ebx
push eax
push esi
push ecx
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [ebp - 0x10], eax
jmp case.0x49e4b7.1
cmp esi, 0x101
ja 0x49e575
cmp esi, 0x100
jae case.0x49e5a3.260
lea eax, [esi - 1]
cmp eax, 0x50
ja case.0x49e5a3.262
movzx eax, byte [eax + 0x49e84c]
jmp dword [eax*4 + 0x49e820]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
push ebx
push ecx
push esi
push edx
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [ebp - 0x10], eax
jmp case.0x49e4b7.1
mov ecx, edi
call fcn.004a4aa0
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.004a4770
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
mov dword [ebp - 0x10], edx
jmp case.0x49e4b7.1
lea ecx, [edi + 8]
call fcn.0049de00
mov dword [ebp - 0x10], eax
jmp case.0x49e4b7.1
mov eax, dword [ebp + 0x10]
push ebx
push eax
lea ecx, [edi + 8]
call fcn.0049d090
mov dword [ebp - 0x10], eax
jmp case.0x49e4b7.1
mov ecx, dword [ebp + 0x10]
push ebx
push ecx
lea ecx, [edi + 8]
call fcn.0049d0f0
mov dword [ebp - 0x10], eax
jmp case.0x49e4b7.1
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push ebx
push edx
push esi
push eax
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [ebp - 0x10], eax
jmp case.0x49e4b7.1
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
push ebx
push ecx
mov ecx, dword [0x50b39c]
push esi
push edx
call fcn.0041dbf0
jmp case.0x49e4b7.1
cmp esi, 0x11a
ja 0x49e691
cmp esi, 0x119
jae 0x49e667
lea eax, [esi - 0x104]
cmp eax, 0x11
ja case.0x49e5a3.262
movzx eax, byte [eax + 0x49e8b0]
jmp dword [eax*4 + 0x49e8a0]
mov eax, dword [ebp + 0x10]
sub eax, 0xc81
je 0x49e627
sub eax, 1
je 0x49e5f8
sub eax, 2
jne case.0x49e4b7.1
lea ecx, [edi + 0x58]
call fcn.004aeb40
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
je case.0x49e4b7.1
mov ecx, edi
call fcn.004a4a70
mov ecx, eax
call fcn.00479760
jmp case.0x49e4b7.1
lea esi, [edi + 8]
push edx
mov ecx, esi
call fcn.0049d2e0
test eax, eax
jne 0x49e618
push 1
mov ecx, esi
call fcn.0049d970
lea esi, [edi + 0x8c]
jmp 0x49e64c
mov dword [edi + 0x70], 1
lea esi, [edi + 0x8c]
jmp 0x49e64c
lea esi, [edi + 8]
push edx
mov ecx, esi
call fcn.0049d2e0
test eax, eax
jne 0x49e640
cmp dword [edi + 0x74], eax
jne 0x49e640
mov dword [edi + 0x70], eax
jmp 0x49e649
push 1
mov ecx, esi
call fcn.0049d6d0
lea esi, [edi + 0x7c]
mov ecx, esi
call fcn.004ade90
test al, al
je case.0x49e4b7.1
mov ecx, esi
call fcn.004aeb40
jmp case.0x49e4b7.1
mov ecx, dword [0x50b39c]
mov eax, dword [ecx + 0xe8]
mov eax, dword [eax + 4]
lea edx, [ebp - 0x10]
push edx
mov edx, dword [ebp + 0x10]
push ebx
push edx
mov edx, dword [ebp + 8]
add ecx, 0xe8
push esi
push edx
call eax
jmp case.0x49e4b7.1
cmp esi, 0x282
ja 0x49e755
je case.0x49e4b7.1
cmp esi, 0x200
jb case.0x49e5a3.262
cmp esi, 0x20d
ja case.0x49e5a3.262
cmp esi, 0x115
je 0x49e6d0
cmp esi, 0x202
jne 0x49e700
mov dword [edi + 0x78], edx
jmp 0x49e700
mov ecx, dword [ebp + 0x10]
movzx eax, cx
cmp eax, 4
jl 0x49e6f1
cmp eax, 5
jle 0x49e6ea
cmp eax, 8
jne 0x49e6f1
mov dword [edi + 0x78], edx
jmp 0x49e6f1
mov dword [edi + 0x78], 1
push ecx
mov ecx, edi
call fcn.004a4a70
mov ecx, eax
call fcn.00476f20
mov edi, dword [0x50b384]
lea ecx, [esi - 0x200]
cmp ecx, 0xe
ja 0x49e73b
mov ecx, dword [ebp + 8]
push 1
lea eax, [ebp - 0x18]
push eax
movzx edx, bx
push edi
shr ebx, 0x10
push ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.USER32.dll_MapWindowPoints]
movzx ebx, word [ebp - 0x14]
movzx edx, word [ebp - 0x18]
shl ebx, 0x10
or ebx, edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x50b39c]
push ebx
push eax
push esi
push edi
call fcn.0041dbf0
mov dword [ebp - 0x10], eax
jmp case.0x49e4b7.1
cmp esi, 0x318
je 0x49e7e3
cmp esi, dword [edi + 0x18]
jne 0x49e78c
mov ecx, dword [0x50b3a0]
cmp byte [ecx + 0x11331], 0
je case.0x49e4b7.1
mov edx, dword [0x50b39c]
mov ecx, dword [edx + 0x4234]
call fcn.00495190
jmp case.0x49e4b7.1
cmp esi, dword [edi + 0x1c]
jne 0x49e79b
lea ecx, [edi + 8]
call fcn.0049d150
jmp case.0x49e4b7.1
cmp esi, dword [edi + 0x20]
jne 0x49e7a9
mov ecx, edi
call fcn.004a78c0
jmp case.0x49e4b7.1
cmp esi, dword [edi + 0x24]
jne 0x49e7ca
cmp ebx, 1
sete al
movzx ecx, al
push ecx
push 1
mov ecx, edi
call fcn.004a4a70
mov ecx, eax
call fcn.0047fe90
jmp case.0x49e4b7.1
cmp esi, edx
je case.0x49e4b7.1
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push ebx
push edx
push esi
push eax
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [ebp - 0x10], eax
jmp case.0x49e4b7.1
mov eax, dword [ebp + 0x10]
cmp eax, edx
je case.0x49e4b7.1
test bl, 4
je case.0x49e4b7.1
push edx
push edx
push eax
mov ecx, edi
call fcn.004aba40
mov esi, dword [ebp - 0x10]
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.004a4770
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10