Function at 0x4abd40
Capabilities:
Log keystrokes via polling
Resume thread
Suspend thread

Disassembly:
sub esp, 8
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x308]
mov edx, dword [eax + 0x244]
push ebp
xor ecx, ecx
xor ebp, ebp
cmp edx, ebp
sete cl
push esi
push edi
mov dword [eax + 0x244], ecx
mov eax, dword [ebx + 0x630]
xor ecx, ecx
cmp eax, ebp
mov dword [esp + 0x14], ecx
jle 0x4abe60
cmp ecx, ebp
jl 0x4ac11e
cmp ecx, dword [ebx + 0x630]
jge 0x4ac11e
mov edx, dword [ebx + 0x62c]
mov eax, dword [edx + ecx*4]
cmp dword [eax + 0x14], ebp
mov dword [esp + 0x10], eax
jle 0x4abe4b
jmp 0x4abda8
mov eax, dword [esp + 0x10]
test ebp, ebp
jl 0x4ac11e
cmp ebp, dword [eax + 0x14]
jge 0x4ac11e
mov eax, dword [eax + 0x10]
mov esi, dword [eax + ebp*4]
mov eax, dword [esi + 0x68]
test eax, eax
je 0x4abe0e
mov eax, dword [esi + 0x19c]
xor edi, edi
test eax, eax
jle 0x4abe22
test edi, edi
jl 0x4ac11e
cmp edi, dword [esi + 0x19c]
jge 0x4ac11e
mov ecx, dword [esi + 0x198]
mov ecx, dword [ecx + edi*4]
mov edx, dword [ecx + 0x178]
mov eax, dword [edx + 0xc]
test eax, eax
je 0x4abe01
call fcn.0041c790
mov eax, dword [esi + 0x19c]
inc edi
cmp edi, eax
jl 0x4abdd2
jmp 0x4abe22
mov eax, dword [esi + 0x178]
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x4abe22
mov ecx, esi
call fcn.0041c790
mov ecx, esi
call fcn.0041efb0
mov ecx, esi
call fcn.0041f300
mov ecx, esi
call fcn.0041f3c0
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 0x14]
inc ebp
cmp ebp, eax
jl 0x4abda4
mov ecx, dword [esp + 0x14]
mov eax, dword [ebx + 0x630]
inc ecx
xor ebp, ebp
cmp ecx, eax
mov dword [esp + 0x14], ecx
jl 0x4abd78
mov edx, dword [ebx + 0x308]
mov dword [ebx + 0x264], ebp
mov dword [ebx + 0x2e4], ebp
mov dword [ebx + 0x2e8], ebp
mov dword [edx + 0x298], ebp
mov eax, dword [ebx + 0x308]
cmp dword [eax + 0x244], ebp
jne 0x4abf9f
cmp dword [esp + 0x1c], ebp
mov ecx, dword [ebx + 0x214]
mov dword [ebx + 0x210], ecx
je 0x4abf02
mov edx, dword [ebx + 0x30c]
mov eax, dword [edx + 0xf8]
cmp eax, ebp
je 0x4abebc
mov eax, dword [eax + 0x28]
push eax
call dword [sym.imp.kernel32.dll_SuspendThread]
mov eax, dword [ebx + 0x304]
push 0x54fb00
push eax
call fcn.004ea679
add esp, 8
test eax, eax
je 0x4abee6
mov ecx, dword [ebx + 0x304]
push ecx
mov ecx, dword [ebx + 0x30c]
call fcn.005093d7
cmp dword [ebx + 0x288], ebp
je 0x4abef6
cmp dword [ebx + 0x250], ebp
jne 0x4abf02
mov edx, dword [ebx + 0x308]
mov dword [edx + 0x60c], ebp
cmp dword [ebx + 0x630], ebp
jle 0x4abf77
lea ebx, [ebx]
test ebp, ebp
jl 0x4ac11e
cmp ebp, dword [ebx + 0x630]
jge 0x4ac11e
mov eax, dword [ebx + 0x62c]
mov edi, dword [eax + ebp*4]
mov eax, dword [edi + 0x3c]
xor esi, esi
test eax, eax
jle 0x4abf6c
test esi, esi
jl 0x4ac11e
cmp esi, dword [edi + 0x3c]
jge 0x4ac11e
mov ecx, dword [edi + 0x38]
fld dword [0x54fb38]
mov ecx, dword [ecx + esi*4]
fld dword [ecx + 0x20]
fucompp
fnstsw ax
test ah, 0x44
jnp 0x4abf64
call fcn.0040e640
mov eax, dword [edi + 0x3c]
inc esi
cmp esi, eax
jl 0x4abf36
mov eax, dword [ebx + 0x630]
inc ebp
cmp ebp, eax
jl 0x4abf10
push 0x11
call dword [sym.imp.user32.dll_GetKeyState]
test ax, ax
jge 0x4ac0f7
mov eax, dword [ebx + 0x308]
mov edx, dword [eax + 0x5cc]
mov dword [eax + 0x5b4], edx
jmp 0x4ac0f7
mov ecx, dword [ebx + 0x30c]
lea eax, [ebx + 0x304]
push eax
mov dword [ebx + 0x2f0], 1
call fcn.00507a49
lea ecx, [ebx + 0x54]
call fcn.00496d20
mov ecx, dword [ebx + 0x308]
cmp dword [ecx + 0x27c], ebp
je 0x4ac001
mov edx, dword [ebx + 0x30c]
mov ecx, dword [edx + 0x474]
add ecx, 0xdc
call fcn.00496d20
mov ecx, dword [ebx + 0x308]
push ebp
push ebp
call fcn.0049bea0
mov eax, dword [ebx + 0x308]
mov dword [eax + 0x27c], ebp
cmp dword [ebx + 0x630], ebp
jle 0x4ac099
lea ecx, [ecx]
test ebp, ebp
jl 0x4ac11e
cmp ebp, dword [ebx + 0x630]
jge 0x4ac11e
mov ecx, dword [ebx + 0x62c]
mov esi, dword [ecx + ebp*4]
mov eax, dword [esi + 0x14c]
test eax, eax
je 0x4ac04b
mov eax, dword [esi + 0x110]
test eax, eax
jle 0x4ac04b
mov dword [esi + 0xc4], 1
mov eax, dword [esi + 0x3c]
xor edi, edi
test eax, eax
jle 0x4ac08a
test edi, edi
jl 0x4ac11e
cmp edi, dword [esi + 0x3c]
jge 0x4ac11e
mov edx, dword [esi + 0x38]
fld dword [0x54fb38]
mov ecx, dword [edx + edi*4]
fld dword [ecx + 0x20]
fucompp
fnstsw ax
test ah, 0x44
jnp 0x4ac082
call fcn.0040e640
mov eax, dword [esi + 0x3c]
inc edi
cmp edi, eax
jl 0x4ac054
mov eax, dword [ebx + 0x630]
inc ebp
cmp ebp, eax
jl 0x4ac010
mov eax, dword [ebx + 0x308]
mov ecx, dword [eax + 0x5b4]
mov edx, dword [ebx + 0x210]
mov esi, dword [sym.imp.kernel32.dll_ResumeThread]
xor eax, eax
mov dword [ebx + 0x1ac], ecx
mov dword [ebx + 0x214], edx
mov dword [ebx + 0x210], eax
mov dword [ebx + 0x204], 1
mov dword [ebx + 0x17c], eax
jmp 0x4ac0e0
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0xf8]
mov ecx, dword [eax + 0x28]
push ecx
call esi
cmp eax, 1
jg 0x4ac0e0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4ac114
mov ebx, dword [ebx + 0x308]
mov edx, dword [ebx + 0x5b4]
mov ecx, dword [ebx + 0x1c]
push edx
call fcn.0048c480
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
call fcn.004fd76e
int3