Function at 0x543810
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x6420b4]
sub esp, 0x768
push ebx
xor ebx, ebx
cmp eax, ebx
jne 0x543836
push 0x5ef82c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [0x6420b4], eax
je 0x54384f
cmp dword [0x6420b0], ebx
jne 0x543857
push str.GetOpenFileNameA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x6420b0], eax
cmp dword [0x6420b0], ebx
je 0x54385f
cmp dword [0x642ed4], ebx
je 0x543872
push ebx
call fcn.00421c80
add esp, 4
xor eax, eax
pop ebx
add esp, 0x768
ret
push ebp
push esi
mov esi, dword [esp + 0x778]
cmp esi, ebx
push edi
mov edi, 1
mov dword [0x642ed4], edi
je 0x5438ac
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x5438ac
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x5438ac
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x5438b8
mov eax, dword [0x645324]
mov dword [esp + 0x77c], eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
call esi
test ah, ah
js 0x5438cd
push 2
call esi
test ah, ah
jns 0x5438f7
lea ecx, [esp + 0x3f8]
push ecx
call dword [sym.imp.USER32.dll_GetKeyboardState]
lea edx, [esp + 0x3f8]
push edx
mov byte [esp + 0x3fd], bl
mov byte [esp + 0x3fe], bl
call dword [sym.imp.USER32.dll_SetKeyboardState]
push 0x1e
push 0x642920
call fcn.00423a00
push 0x180
push 0x6420b8
call fcn.00423a00
push 0x3e7
push 0x642238
call fcn.00423a00
lea eax, [esp + 0x8c]
push 0x180
push eax
call fcn.00423a00
push 0x180
push 0x642940
call fcn.00423a00
push 0x3e7
push 0x642ac0
call fcn.00423a00
mov eax, dword [esp + 0x7b8]
mov ecx, dword [esp + 0x7bc]
add esp, 0x30
cmp eax, ebx
mov dword [0x642ea8], ecx
mov dword [esp + 0x10], edi
mov dword [0x642eac], ebx
mov dword [0x642eb0], ebx
mov dword [esp + 0x18], ebx
mov dword [0x642eb4], ebx
mov dword [0x642eb8], ebx
mov dword [0x642ebc], ebx
je 0x5439a2
push eax
push 0x1e
push 0x642920
call fcn.00423900
add esp, 0xc
mov eax, dword [esp + 0x780]
cmp eax, 0x64
jl 0x5439bc
sub eax, 0x64
mov dword [esp + 0x780], eax
mov dword [esp + 0x18], edi
cmp eax, 0xa
jl 0x5439cf
sub eax, 0xa
mov dword [esp + 0x780], eax
mov dword [esp + 0x10], ebx
lea edx, [esp + 0x74]
push 0x180
push edx
call fcn.00423a00
mov ecx, dword [0x645320]
add esp, 8
push 0x180
lea eax, [esp + 0x78]
push eax
push 0x13f0
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esp + 0x74]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x543a04
sub eax, edx
mov cl, byte [esp + eax + 0x73]
mov dl, byte [esp + 0x74]
xor eax, eax
cmp dl, bl
je 0x543a51
jmp 0x543a20
cmp byte [esp + eax + 0x74], cl
jne 0x543a2a
mov byte [esp + eax + 0x74], bl
cmp eax, 0x180
jae 0x543a3c
mov dl, byte [esp + eax + 0x75]
inc eax
cmp dl, bl
jne 0x543a20
jmp 0x543a51
mov byte [esp + 0x1f4], bl
mov byte [esp + 0x1f3], bl
mov byte [esp + 0x1f2], bl
xor eax, eax
mov cl, byte [eax + 0x642620]
mov byte [eax + 0x6420b8], cl
inc eax
cmp cl, bl
jne 0x543a53
lea edx, [esp + 0x1f8]
push edx
lea eax, [esp + 0x2fc]
push eax
lea ecx, [esp + 0x680]
push ecx
lea edx, [esp + 0x20]
push edx
push 0x6420b8
call fcn.005cc984
mov al, byte [0x6420b8]
add esp, 0x14
cmp al, bl
je 0x543b77
xor eax, eax
lea ecx, [ecx]
mov cl, byte [esp + eax + 0x14]
mov byte [eax + 0x6420b8], cl
inc eax
cmp cl, bl
jne 0x543aa0
lea eax, [esp + 0x678]
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x543ab8
mov edi, 0x6420b8
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x543ac7
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov cl, byte [esp + eax + 0x2f8]
mov byte [eax + 0x642238], cl
inc eax
cmp cl, bl
jne 0x543ae1
lea eax, [esp + 0x1f8]
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x543b00
mov edi, 0x642238
sub eax, edx
dec edi
nop
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x543b10
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x5ef814
push 0x642238
rep movsb byte es:[edi], byte [esi]
call fcn.005e31f5
add esp, 8
test eax, eax
je 0x543b54
push 0x5ef810
push 0x642238
call fcn.005e31f5
add esp, 8
test eax, eax
jne 0x543b5a
mov byte [0x642238], bl
push 0x5e7eec
push 0x642238
call fcn.005e31f5
add esp, 8
mov ebp, eax
neg ebp
sbb ebp, ebp
add ebp, 2
jmp 0x543b9c
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x637bf8]
mov byte [eax + 0x6420b8], cl
inc eax
cmp cl, bl
jne 0x543b80
mov byte [0x642238], bl
mov ebp, 2
lea eax, [esp + 0x1f8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x543ba6
sub eax, edx
cmp eax, 3
jb 0x543c26
mov edi, 2
lea eax, [esp + 0x74]
lea ecx, [ecx]
cmp byte [eax], bl
je 0x543c26
mov esi, eax
mov cl, byte [esi + 1]
inc esi
cmp cl, bl
jne 0x543bc6
mov ecx, edi
and ecx, reloc.WSOCK32.dll_accept
jns 0x543bdd
dec ecx
or ecx, 0xfffffffe
inc ecx
je 0x543bf4
lea edx, [esp + 0x1f8]
push edx
push eax
call fcn.00422cf0
add esp, 8
test eax, eax
jne 0x543bfe
lea eax, [esi + 1]
inc edi
cmp eax, ebx
jne 0x543bc0
jmp 0x543c26
lea eax, [esp + 0x2f8]
push 0x5e781c
push eax
call fcn.005e31f5
add esp, 8
test eax, eax
jne 0x543c1d
mov byte [0x642238], bl
mov eax, edi
cdq
sub eax, edx
mov ebp, eax
sar ebp, 1
push 2
push 0x6420b8
call fcn.00425b60
add esp, 8
test eax, eax
jne 0x543c51
lea esp, [esp]
mov cl, byte [eax + 0x637bf8]
mov byte [eax + 0x6420b8], cl
inc eax
cmp cl, bl
jne 0x543c40
mov eax, 0x6420b8
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x543c60
sub eax, edx
cmp eax, 3
jbe 0x543c7d
cmp byte [eax + 0x6420b7], 0x5c
jne 0x543c7d
mov byte [eax + 0x6420b7], bl
mov esi, dword [esp + 0x784]
xor eax, eax
mov ecx, 0x16
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x780]
cmp eax, ebx
jne 0x543cf9
mov ecx, dword [esp + 0x77c]
push esi
push ecx
call fcn.00544200
add esp, 8
test eax, eax
je 0x543ce2
xor eax, eax
mov cl, byte [eax + 0x6420b8]
mov byte [eax + 0x642620], cl
inc eax
cmp cl, bl
jne 0x543cb3
mov cl, byte [0x642620]
pop edi
pop esi
xor eax, eax
cmp cl, bl
pop ebp
mov dword [0x642ed4], ebx
setne al
pop ebx
add esp, 0x768
ret
mov dword [0x642238], 0x2a2e2a
mov dword [esp + 0x50], 0x28a0924
jmp 0x543db2
cmp eax, 1
je 0x543d8e
cmp eax, 4
je 0x543d8e
cmp eax, 5
je 0x543d8e
cmp eax, 2
jne 0x543d3d
cmp dword [esp + 0x10], ebx
mov dword [esp + 0x64], 0x14a
mov dword [esp + 0x50], 0x28a0a64
je 0x543d33
mov dword [esp + 0x50], 0x28a1a64
mov dword [esp + 0x60], 0x542c50
jmp 0x543dba
cmp eax, 3
jne 0x543d56
mov dword [0x642eac], 1
mov dword [esp + 0x50], 0x28a0824
jmp 0x543db2
cmp eax, 6
jne 0x543d83
cmp dword [esp + 0x10], ebx
mov dword [esp + 0x64], 0x154
mov dword [esp + 0x50], 0x20a0864
je 0x543d79
mov dword [esp + 0x50], 0x20a1864
mov dword [esp + 0x60], 0x543640
jmp 0x543dba
push ebx
call fcn.00421c80
jmp 0x544092
cmp dword [esp + 0x10], ebx
mov dword [esp + 0x50], 0x28a0824
je 0x543da4
mov dword [esp + 0x50], 0x28a1824
cmp dword [esp + 0x18], ebx
je 0x543db2
or dword [esp + 0x50], 0x200
mov dword [esp + 0x60], 0x543160
cmp byte [esi], bl
je 0x543dc2
mov dword [esp + 0x4c], esi
mov edx, dword [0x60f57c]
mov eax, dword [0x63b6bc]
neg edx
sbb edx, edx
and edx, 0xc
add edx, 0x4c
cmp eax, ebx
mov dword [esp + 0x1c], edx
jne 0x543de4
mov eax, dword [0x645320]
mov ecx, dword [esp + 0x77c]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x4f8]
lea edx, [esp + 0x74]
push 0x180
push eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], 0x642238
mov dword [esp + 0x44], 0x3e7
mov dword [esp + 0x50], 0x6420b8
call fcn.00423a00
lea ecx, [esp + 0x500]
push 0x104
push ecx
call fcn.005e2486
add esp, 0x10
test eax, eax
jne 0x543e5c
push 0x637bf8
lea edx, [esp + 0x4fc]
push 0x180
push edx
call fcn.00423900
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
call dword [0x6420b0]
test eax, eax
je 0x54402f
mov esi, dword [esp + 0x780]
cmp esi, 2
jne 0x543f2c
xor eax, eax
mov cl, byte [eax + 0x642ac0]
mov byte [eax + 0x641738], cl
inc eax
cmp cl, bl
jne 0x543e81
push 0x3e7
push 0x642ac0
call fcn.00423a00
mov ecx, dword [0x613d6c]
push ebx
push 1
push 0x641550
push ecx
call fcn.004e3ad0
add esp, 0x18
cmp eax, ebx
je 0x543ec1
mov dword [0x613d6c], eax
mov edx, dword [0x613d6c]
push 0x637d00
push 0x14
push 0x5e6eac
push str.dccnicks
push edx
call fcn.004c9d30
push 0x180
push 0x6415b8
call fcn.00423a00
push 0x180
push 0x6415b8
call fcn.005e2486
push 0x6415b8
call fcn.00426aa0
lea eax, [esp + 0x520]
push eax
call fcn.005e41de
add esp, 0x2c
pop edi
pop esi
pop ebp
mov dword [0x642ed4], ebx
mov eax, 1
pop ebx
add esp, 0x768
ret
push 0x180
push 0x642620
call fcn.00423a00
push 0x104
push 0x642620
call fcn.005e2486
push 0x642620
call fcn.00426aa0
lea ecx, [esp + 0x50c]
push ecx
call fcn.005e41de
add esp, 0x18
cmp esi, ebx
je 0x544007
push 9
push 0x642ac0
call fcn.005cbf10
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x543f83
mov byte [esi], bl
lea edx, [esp + 0x1f8]
push edx
lea eax, [esp + 0x2fc]
push eax
lea ecx, [esp + 0x680]
push ecx
lea edx, [esp + 0x20]
push edx
push 0x642ac0
call fcn.005cc984
lea eax, [esp + 0x20c]
push eax
lea ecx, [esp + 0x310]
push ecx
push 0x5e6a64
push 0x6427a0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x24
cmp esi, ebx
je 0x543fd4
mov byte [esi], 9
xor eax, eax
jmp 0x543fe0
mov cl, byte [eax + 0x642620]
mov byte [eax + 0x642940], cl
inc eax
cmp cl, bl
jne 0x543fe0
pop edi
pop esi
pop ebp
mov dword [0x642ed4], ebx
mov eax, 1
pop ebx
add esp, 0x768
ret
push 0x180
push 0x6427a0
call fcn.00423a00
add esp, 8
pop edi
pop esi
pop ebp
mov dword [0x642ed4], ebx
mov eax, 1
pop ebx
add esp, 0x768
ret
push 0x180
push 0x642620
call fcn.00423a00
push 0x180
push 0x6427a0
call fcn.00423a00
push 0x180
push 0x642940
call fcn.00423a00
push 0x3e7
push 0x642ac0
call fcn.00423a00
add esp, 0x20
call dword [sym.imp.comdlg32.dll_CommDlgExtendedError]
cmp eax, 0x3003
jne 0x544085
mov dword [0x642eb4], 1
lea edx, [esp + 0x4f8]
push edx
call fcn.005e41de
add esp, 4
pop edi
pop esi
pop ebp
mov dword [0x642ed4], ebx
xor eax, eax
pop ebx
add esp, 0x768
ret