Function at 0x54c360
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [0x676eb0]
sub esp, 0xccc
push ebx
xor ebx, ebx
cmp eax, ebx
jne 0x54c385
push ebx
call fcn.00421dc0
add esp, 4
xor eax, eax
pop ebx
add esp, 0xccc
ret
cmp dword [0x68fff0], ebx
push ebp
push esi
push edi
mov edi, 1
jne 0x54c3b8
cmp dword [0x693614], ebx
jne 0x54c3c0
push str.GetOpenFileNameA
push eax
mov dword [0x693614], edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
mov dword [0x68fff0], eax
je 0x54c3c0
cmp dword [0x693610], ebx
je 0x54c3d6
push ebx
call fcn.00421dc0
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xccc
ret
mov esi, dword [esp + 0xce0]
cmp esi, ebx
mov dword [0x693610], edi
je 0x54c408
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x54c408
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x54c408
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x54c414
mov eax, dword [0x6a0f40]
mov dword [esp + 0xce0], eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
call esi
test ah, ah
js 0x54c429
push 2
call esi
test ah, ah
jns 0x54c453
lea ecx, [esp + 0x274]
push ecx
call dword [sym.imp.USER32.dll_GetKeyboardState]
lea edx, [esp + 0x274]
push edx
mov byte [esp + 0x279], bl
mov byte [esp + 0x27a], bl
call dword [sym.imp.USER32.dll_SetKeyboardState]
push 0x432
push 0x691d08
call fcn.004232e0
push 0x432
push 0x68fff8
call fcn.004232e0
push 0x1068
push 0x690430
call fcn.004232e0
lea eax, [esp + 0x38c]
push 0x432
push eax
call fcn.004232e0
push 0x432
push 0x692140
call fcn.004232e0
push 0x1068
push 0x692578
call fcn.004232e0
mov eax, dword [esp + 0xd1c]
mov ecx, dword [esp + 0xd20]
add esp, 0x30
cmp eax, ebx
mov dword [0x6935e0], ecx
mov dword [esp + 0x10], edi
mov dword [0x6935e4], ebx
mov dword [0x6935e8], ebx
mov dword [esp + 0x18], ebx
mov dword [0x6935ec], ebx
mov dword [0x6935f0], ebx
mov dword [0x6935f4], ebx
mov dword [0x6935f8], ebx
je 0x54c50a
push eax
push 0x432
push 0x691d08
call fcn.00425550
add esp, 0xc
mov eax, dword [esp + 0xce4]
cmp eax, 0x64
jl 0x54c524
sub eax, 0x64
mov dword [esp + 0xce4], eax
mov dword [esp + 0x18], edi
cmp eax, 0xa
jl 0x54c537
sub eax, 0xa
mov dword [esp + 0xce4], eax
mov dword [esp + 0x10], ebx
lea edx, [esp + 0x374]
push 0x432
push edx
call fcn.004232e0
lea eax, [esp + 0x37c]
push 0x432
push eax
call fcn.00423310
mov edx, dword [0x6a0f3c]
add esp, 0x10
push eax
lea ecx, [esp + 0x378]
push ecx
push 0x13f0
push edx
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esp + 0x374]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x54c583
sub eax, edx
mov cl, byte [esp + eax + 0x373]
mov dl, byte [esp + 0x374]
xor eax, eax
cmp dl, bl
je 0x54c5da
cmp byte [esp + eax + 0x374], cl
jne 0x54c5b0
mov byte [esp + eax + 0x374], bl
cmp eax, 0xff
jae 0x54c5c5
mov dl, byte [esp + eax + 0x375]
inc eax
cmp dl, bl
jne 0x54c5a0
jmp 0x54c5da
mov byte [esp + 0x473], bl
mov byte [esp + 0x472], bl
mov byte [esp + 0x471], bl
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x691498]
mov byte [eax + 0x68fff8], cl
inc eax
cmp cl, bl
jne 0x54c5e0
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x178]
push ecx
lea edx, [esp + 0x7b0]
push edx
lea eax, [esp + 0x20]
push eax
push 0x68fff8
call fcn.005da53c
mov al, byte [0x68fff8]
add esp, 0x14
cmp al, bl
je 0x54c707
xor eax, eax
jmp 0x54c630
mov cl, byte [esp + eax + 0x14]
mov byte [eax + 0x68fff8], cl
inc eax
cmp cl, bl
jne 0x54c630
lea eax, [esp + 0x7a8]
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x54c648
mov edi, 0x68fff8
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x54c657
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov cl, byte [esp + eax + 0x174]
mov byte [eax + 0x690430], cl
inc eax
cmp cl, bl
jne 0x54c671
lea eax, [esp + 0x74]
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x54c690
mov edi, 0x690430
sub eax, edx
dec edi
nop
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x54c6a0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x5fdacc
push 0x690430
rep movsb byte es:[edi], byte [esi]
call fcn.005f1860
add esp, 8
test eax, eax
je 0x54c6e4
push 0x5fdac8
push 0x690430
call fcn.005f1860
add esp, 8
test eax, eax
jne 0x54c6ea
mov byte [0x690430], bl
push 0x5f59c4
push 0x690430
call fcn.005f1860
add esp, 8
mov ebp, eax
neg ebp
sbb ebp, ebp
add ebp, 2
jmp 0x54c72c
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x66c330]
mov byte [eax + 0x68fff8], cl
inc eax
cmp cl, bl
jne 0x54c710
mov byte [0x690430], bl
mov ebp, 2
lea eax, [esp + 0x74]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x54c733
sub eax, edx
cmp eax, 3
jb 0x54c7b3
mov edi, 2
lea eax, [esp + 0x374]
lea ecx, [ecx]
cmp byte [eax], bl
je 0x54c7b3
mov esi, eax
mov cl, byte [esi + 1]
inc esi
cmp cl, bl
jne 0x54c756
mov ecx, edi
and ecx, reloc.WSOCK32.dll_accept
jns 0x54c76d
dec ecx
or ecx, 0xfffffffe
inc ecx
je 0x54c781
lea edx, [esp + 0x74]
push edx
push eax
call fcn.00422d30
add esp, 8
test eax, eax
jne 0x54c78b
lea eax, [esi + 1]
inc edi
cmp eax, ebx
jne 0x54c750
jmp 0x54c7b3
lea eax, [esp + 0x174]
push 0x5f5984
push eax
call fcn.005f1860
add esp, 8
test eax, eax
jne 0x54c7aa
mov byte [0x690430], bl
mov eax, edi
cdq
sub eax, edx
mov ebp, eax
sar ebp, 1
push 2
push 0x68fff8
call fcn.00424420
add esp, 8
test eax, eax
jne 0x54c7e1
jmp 0x54c7d0
mov cl, byte [eax + 0x66c330]
mov byte [eax + 0x68fff8], cl
inc eax
cmp cl, bl
jne 0x54c7d0
mov eax, 0x68fff8
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x54c7f0
sub eax, edx
cmp eax, 3
jbe 0x54c80d
cmp byte [eax + 0x68fff7], 0x5c
jne 0x54c80d
mov byte [eax + 0x68fff7], bl
mov esi, dword [esp + 0xce8]
xor eax, eax
mov ecx, 0x16
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0xce4]
cmp eax, ebx
jne 0x54c889
mov ecx, dword [esp + 0xce0]
push esi
push ecx
call fcn.0054cda0
add esp, 8
test eax, eax
je 0x54c872
xor eax, eax
mov cl, byte [eax + 0x68fff8]
mov byte [eax + 0x691498], cl
inc eax
cmp cl, bl
jne 0x54c843
mov cl, byte [0x691498]
pop edi
pop esi
xor eax, eax
cmp cl, bl
pop ebp
mov dword [0x693610], ebx
setne al
pop ebx
add esp, 0xccc
ret
mov dword [0x690430], 0x2a2e2a
mov dword [esp + 0x50], 0x28a0924
jmp 0x54c942
cmp eax, 1
je 0x54c91e
cmp eax, 4
je 0x54c91e
cmp eax, 5
je 0x54c91e
cmp eax, 2
jne 0x54c8cd
cmp dword [esp + 0x10], ebx
mov dword [esp + 0x64], 0x14a
mov dword [esp + 0x50], 0x28a0a64
je 0x54c8c3
mov dword [esp + 0x50], 0x28a1a64
mov dword [esp + 0x60], 0x54b750
jmp 0x54c94a
cmp eax, 3
jne 0x54c8e6
mov dword [0x6935e4], 1
mov dword [esp + 0x50], 0x28a0824
jmp 0x54c942
cmp eax, 6
jne 0x54c913
cmp dword [esp + 0x10], ebx
mov dword [esp + 0x64], 0x154
mov dword [esp + 0x50], 0x20a0864
je 0x54c909
mov dword [esp + 0x50], 0x20a1864
mov dword [esp + 0x60], 0x54c140
jmp 0x54c94a
push ebx
call fcn.00421dc0
jmp 0x54cc32
cmp dword [esp + 0x10], ebx
mov dword [esp + 0x50], 0x28a0824
je 0x54c934
mov dword [esp + 0x50], 0x28a1824
cmp dword [esp + 0x18], ebx
je 0x54c942
or dword [esp + 0x50], 0x200
mov dword [esp + 0x60], 0x54bc50
cmp byte [esi], bl
je 0x54c952
mov dword [esp + 0x4c], esi
mov edx, dword [0x62b300]
mov eax, dword [0x676ea8]
neg edx
sbb edx, edx
and edx, 0xc
add edx, 0x4c
cmp eax, ebx
mov dword [esp + 0x1c], edx
jne 0x54c974
mov eax, dword [0x6a0f3c]
mov ecx, dword [esp + 0xce0]
lea edx, [esp + 0x374]
push 0x1068
push 0x690430
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], 0x690430
call fcn.00423310
mov dword [esp + 0x44], eax
lea eax, [esp + 0x8b0]
push 0x432
push eax
mov dword [esp + 0x58], 0x68fff8
call fcn.004232e0
lea ecx, [esp + 0x8b8]
push 0x400
push ecx
call fcn.005f0af1
add esp, 0x18
test eax, eax
jne 0x54c9fa
push 0x66c330
lea edx, [esp + 0x8ac]
push 0x432
push edx
call fcn.00425550
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
call dword [0x68fff0]
test eax, eax
je 0x54cbcf
mov esi, dword [esp + 0xce4]
cmp esi, 2
jne 0x54cad6
xor eax, eax
nop
mov cl, byte [eax + 0x692578]
mov byte [eax + 0x68d990], cl
inc eax
cmp cl, bl
jne 0x54ca20
push 0x1068
push 0x692578
call fcn.004232e0
mov ecx, dword [0x63dd7c]
push ebx
push 1
push 0x68d420
push ecx
call fcn.004e9380
add esp, 0x18
cmp eax, ebx
je 0x54ca60
mov dword [0x63dd7c], eax
mov edx, dword [0x63dd7c]
push 0x66c768
push 0x14
push 0x5f4ea4
push str.dccnicks
push edx
call fcn.004cf490
push 0x432
push 0x68d558
call fcn.004232e0
push 0x432
push 0x68d558
call fcn.00423310
push eax
push 0x68d558
call fcn.005f0af1
push 0x68d558
call fcn.004256e0
lea eax, [esp + 0x8d8]
push eax
call fcn.005f28ce
add esp, 0x34
pop edi
pop esi
pop ebp
mov dword [0x693610], ebx
mov eax, 1
pop ebx
add esp, 0xccc
ret
push 0x432
push 0x691498
call fcn.004232e0
push 0x400
push 0x691498
call fcn.005f0af1
push 0x691498
call fcn.004256e0
lea ecx, [esp + 0x8bc]
push ecx
call fcn.005f28ce
add esp, 0x18
cmp esi, ebx
je 0x54cba7
push 9
push 0x692578
call fcn.005d9b20
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x54cb2d
mov byte [esi], bl
lea edx, [esp + 0x74]
push edx
lea eax, [esp + 0x178]
push eax
lea ecx, [esp + 0x7b0]
push ecx
lea edx, [esp + 0x20]
push edx
push 0x692578
call fcn.005da53c
lea eax, [esp + 0x88]
push eax
lea ecx, [esp + 0x18c]
push ecx
push 0x5f4a5c
push 0x6918d0
call fcn.005d9929
add esp, 0x24
cmp esi, ebx
je 0x54cb7a
mov byte [esi], 9
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x691498]
mov byte [eax + 0x692140], cl
inc eax
cmp cl, bl
jne 0x54cb80
pop edi
pop esi
pop ebp
mov dword [0x693610], ebx
mov eax, 1
pop ebx
add esp, 0xccc
ret
push 0x432
push 0x6918d0
call fcn.004232e0
add esp, 8
pop edi
pop esi
pop ebp
mov dword [0x693610], ebx
mov eax, 1
pop ebx
add esp, 0xccc
ret
push 0x432
push 0x691498
call fcn.004232e0
push 0x432
push 0x6918d0
call fcn.004232e0
push 0x432
push 0x692140
call fcn.004232e0
push 0x1068
push 0x692578
call fcn.004232e0
add esp, 0x20
call dword [sym.imp.comdlg32.dll_CommDlgExtendedError]
cmp eax, 0x3003
jne 0x54cc25
mov dword [0x6935ec], 1
lea edx, [esp + 0x8a8]
push edx
call fcn.005f28ce
add esp, 4
pop edi
pop esi
pop ebp
mov dword [0x693610], ebx
xor eax, eax
pop ebx
add esp, 0xccc
ret