Function at 0x4abfe0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x18
push edi
push eax
mov edi, ecx
call dword [sym.imp.user32.dll_SetRectEmpty]
push 0x11
call dword [sym.imp.user32.dll_GetKeyState]
test ax, ax
jl 0x4ac267
mov edx, dword [edi]
push ebx
mov ebx, dword [esp + 0x2c]
push ebp
mov ebp, dword [esp + 0x2c]
push esi
push 1
xor esi, esi
push esi
push ebx
push ebp
mov ecx, edi
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], esi
call dword [edx + 0x14]
cmp eax, esi
mov esi, dword [esp + 0x2c]
je 0x4ac05a
mov ecx, dword [esp + 0x40]
mov edx, dword [eax]
push ecx
mov ecx, dword [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x40]
push ecx
push ebx
push ebp
push esi
mov ecx, eax
call dword [edx + 0x184]
mov edx, dword [esp + 0x38]
push edx
call dword [sym.imp.user32.dll_IsRectEmpty]
test eax, eax
je 0x4ac264
mov ecx, dword [0x5a44dc]
mov eax, dword [edi]
push 0
push 1
push 0
push 1
push ecx
push ebx
push ebp
mov ecx, edi
call dword [eax + 0x10]
push eax
push 0x5a46a0
call fcn.00526a01
add esp, 8
test eax, eax
mov dword [esp + 0x2c], eax
je 0x4ac0fb
mov ecx, eax
call fcn.004cfb50
test eax, eax
je 0x4ac0fb
push 0x5a4508
mov ecx, esi
call fcn.005269f6
test eax, eax
je 0x4ac0ca
push esi
push 0x5a4508
call fcn.00526a01
mov edi, dword [esp + 0x34]
mov edx, dword [edi]
add esp, 8
push eax
mov ecx, edi
call dword [edx + 0x2b8]
test eax, eax
je 0x4ac264
jmp 0x4ac0ce
mov edi, dword [esp + 0x2c]
mov ecx, edi
call fcn.004cfb50
mov ecx, dword [esp + 0x40]
mov edx, dword [eax]
push ecx
mov ecx, dword [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x40]
push ecx
push ebx
push ebp
push esi
mov ecx, eax
call dword [edx + 0x240]
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x18
ret 0x18
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push ebx
push ebp
mov ecx, edi
call fcn.004aaf30
test eax, eax
je 0x4ac25a
mov ecx, dword [esp + 0x40]
mov dword [ecx], 0
push 0x5a4508
mov ecx, esi
call fcn.005269f6
test eax, eax
je 0x4ac15c
push esi
push 0x5a4508
call fcn.00526a01
mov edx, dword [eax]
add esp, 8
mov ecx, eax
call dword [edx + 0x170]
push eax
push 0x5751b0
call fcn.00526a01
add esp, 8
test eax, eax
je 0x4ac18e
jmp 0x4ac17a
push 0x5a46a0
mov ecx, esi
call fcn.005269f6
test eax, eax
je 0x4ac18e
push esi
push 0x5a46a0
call fcn.00526a01
add esp, 8
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x15c]
test dword [esp + 0x10], eax
je 0x4ac264
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.user32.dll_GetWindowRect]
mov eax, dword [esp + 0x14]
test eax, eax
lea eax, [edi + 0xf8]
jne 0x4ac1b1
lea eax, [edi + 0xe8]
mov ecx, dword [eax]
mov esi, dword [esp + 0x38]
mov edx, esi
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x10]
cmp eax, 0x4000
ja 0x4ac222
je 0x4ac20f
cmp eax, 0x1000
je 0x4ac1fc
cmp eax, 0x2000
jne 0x4ac23b
mov ecx, dword [esi + 4]
mov ebx, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
sub ecx, ebx
add ecx, edx
mov dword [esi + 0xc], ecx
jmp 0x4ac23b
mov edx, dword [esi]
mov ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
sub edx, ebx
add edx, ecx
mov dword [esi + 8], edx
jmp 0x4ac23b
mov ecx, dword [esi + 8]
mov ebx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
sub ecx, ebx
add ecx, edx
mov dword [esi], ecx
jmp 0x4ac23b
cmp eax, 0x8000
jne 0x4ac23b
mov edx, dword [esi + 0xc]
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
sub edx, ebx
add edx, ecx
mov dword [esi + 4], edx
mov edx, dword [edi]
push eax
push esi
mov ecx, edi
call dword [edx + 0x54]
mov ecx, dword [edi + 0xd4]
push esi
call fcn.00528443
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x18
ret 0x18
mov eax, dword [esp + 0x40]
mov dword [eax], 0
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x18
ret 0x18