Function at 0x455d20
Capabilities:
Get hostname
Log keystrokes via polling
Set socket configuration

Disassembly:
sub esp, 8
push esi
push edi
mov esi, edx
mov edi, ecx
mov ecx, esi
call fcn.004e2760
test eax, eax
je 0x456033
mov ecx, dword [esi]
push ebx
push ebp
call fcn.00542c90
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x14], eax
je 0x456031
mov eax, dword [esi + 0x440]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x14]
cmp eax, ebx
je 0x455da9
test al, 1
je 0x455d6d
mov edx, esi
xor ecx, ecx
call fcn.00454ec0
test byte [esi + 0x14], 2
je 0x455d7a
mov ecx, esi
call fcn.00518870
test byte [esi + 0x14], 4
je 0x455d89
xor edx, edx
mov ecx, esi
call fcn.00517840
test byte [esi + 0x14], 8
je 0x455da6
cmp dword [0x59bcb0], ebx
je 0x455da6
cmp dword [0x59bcc0], ebx
je 0x455da6
mov ecx, esi
call fcn.00517dd0
mov dword [esi + 0x14], ebx
cmp edi, ebx
jne 0x455ddf
cmp dword [esi + 0xc], ebx
jne 0x455db9
mov ecx, esi
call fcn.00517dd0
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
test ah, ah
jns 0x455dce
mov ecx, esi
call fcn.00518870
push 0x10
call edi
test ah, ah
js 0x455ddf
xor edx, edx
mov ecx, esi
call fcn.00517840
mov edx, esi
xor ecx, ecx
call fcn.00455270
cmp byte [esi + 0xd34], bl
je 0x455ff8
cmp byte [esi + 0xd98], bl
je 0x455ff8
cmp byte [esi + 0xdfc], bl
je 0x455ff8
mov al, byte [esi + 0xf30]
cmp al, bl
lea edi, [esi + 0xf30]
je 0x455ff8
mov al, byte [esi + 0x10c0]
cmp al, bl
lea ebp, [esi + 0x10c0]
je 0x455ff8
cmp dword [esp + 0x10], ebx
je 0x455e80
mov ecx, dword [esi + 0x438]
mov eax, 2
cmp ecx, eax
mov dword [esi + 0x43c], 1
jge 0x455e59
mov dword [esi + 0x438], eax
mov ecx, dword [esi + 0x438]
push ebp
dec ecx
push edi
push ecx
xor edx, edx
mov ecx, 0x5e0
call fcn.0041d620
push eax
push 0x5aa640
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
jmp 0x455ede
mov eax, 1
push ebp
push edi
xor edx, edx
mov ecx, 0x5df
mov dword [esi + 0x438], eax
mov dword [esi + 0x43c], eax
call fcn.0041d620
push eax
push 0x5aa640
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esi + 0xd20]
add esp, 0x10
cmp eax, ebx
je 0x455ec7
push 0x2e
push edi
call fcn.00570260
add esp, 8
test eax, eax
jne 0x455ede
cmp dword [0x59bcb0], ebx
je 0x455ede
cmp dword [0x59bcc0], ebx
je 0x455ede
mov ecx, esi
call fcn.00517dd0
push edi
lea ecx, [esi + 0x1124]
mov edx, 0x64
call fcn.0041ee40
mov edx, dword [esp + 0x14]
cmp dword [edx + 0x6cc], ebx
je 0x455f08
mov edx, dword [0x5a5504]
mov ecx, dword [esi]
call fcn.00502b10
mov eax, dword [0x5a5504]
mov edi, 1
mov dword [0x59bcec], ebx
mov dword [0x5ae23c], edi
mov ecx, dword [esi]
push eax
mov edx, 0x5aa640
call fcn.00502c40
mov edx, dword [0x5a5504]
mov ecx, dword [esi]
call fcn.00502b10
cmp byte [ebp], 0x2b
jne 0x455f46
mov dword [esi + 0x241c], edi
jmp 0x455f4c
mov dword [esi + 0x241c], ebx
cmp dword [esi + 0x241c], ebx
je 0x455fa8
cmp dword [0x5b1440], ebx
jne 0x455fa8
mov ecx, dword [0x5a5504]
push ecx
xor edx, edx
mov ecx, 0x1425
mov dword [0x59bcec], ebx
mov dword [0x5ae23c], edi
call fcn.0041d620
mov ecx, dword [esi]
mov edx, eax
call fcn.00503ad0
mov edx, 0x5aa640
mov ecx, 0x5e2
call fcn.0041d620
push esi
mov edx, edi
mov ecx, 0x5aa640
call fcn.00455150
pop ebp
pop ebx
pop edi
pop esi
add esp, 8
ret
mov ecx, esi
call fcn.004c12d0
mov ecx, esi
call fcn.0049ba40
mov ecx, edi
call fcn.004e2c60
cmp dword [0x59bca8], ebx
je 0x455fcc
mov ecx, esi
call fcn.005180b0
cmp dword [esi + 0x908], ebx
jne 0x455fea
cmp dword [0x59bca4], ebx
jne 0x455fea
pop ebp
pop ebx
pop edi
mov ecx, esi
pop esi
add esp, 8
jmp 0x54ada0
pop ebp
pop ebx
pop edi
mov ecx, esi
pop esi
add esp, 8
jmp fcn.0054c010
push esi
mov edx, 1
mov ecx, 0x583b74
call fcn.00455150
xor ecx, ecx
call fcn.0041d520
mov edx, dword [0x5b4314]
push ebx
push 0x9f
push 0x111
push edx
mov dword [0x5ad280], 1
call dword [sym.imp.USER32.dll_PostMessageA]
pop ebp
pop ebx
pop edi
pop esi
add esp, 8
ret
sub esp, 0x104
push ebp
push esi
mov esi, ecx
push edi
lea ebp, [esi + 0x840]
push ebp
mov edx, 0x104
lea ecx, [esp + 0x10]
mov dword [esi + 0x424], 1
call fcn.0041ee40
mov eax, dword [0x59bc9c]
test eax, eax
jne 0x54adf3
cmp byte [ebp], 0
je 0x54adf3
xor edx, edx
mov ecx, 0x1772
call fcn.0041d620
push eax
push ebp
call fcn.005809c6
add esp, 8
test eax, eax
jne 0x54ae1a
push 0x64
push ebp
call dword [sym.imp.WSOCK32.dll_gethostname]
test eax, eax
je 0x54ae1a
xor edx, edx
mov ecx, 0x1772
call fcn.0041d620
mov edx, ebp
mov edi, edi
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x54ae10
mov eax, dword [0x59bca0]
test eax, eax
jne 0x54ae64
mov eax, dword [esi + 0x908]
test eax, eax
je 0x54ae64
lea edi, [esp + 0xc]
mov eax, ebp
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [edi]
jne 0x54ae57
test cl, cl
je 0x54ae53
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x54ae57
add eax, 2
add edi, 2
test cl, cl
jne 0x54ae33
xor eax, eax
jmp 0x54ae5c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x54aee2
xor edx, edx
mov ecx, 0x1772
call fcn.0041d620
push eax
push ebp
call fcn.005809c6
add esp, 8
test eax, eax
jne 0x54aeee
xor edx, edx
mov ecx, 0x1772
call fcn.0041d620
lea edx, [esi + 0x8a4]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x54ae90
mov eax, dword [esi + 0x420]
test eax, eax
mov dword [esi + 0x908], 0
je 0x54aee2
lea edi, [esi + 0x444]
mov edx, edi
mov ecx, 0x1777
mov dword [esi + 0x830], 1
call fcn.0041d620
mov ecx, esi
call fcn.0054a7d0
test eax, eax
mov ecx, edi
je 0x54af6d
mov edx, esi
call fcn.0054a630
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x104
ret
lea edi, [esi + 0x1c]
mov edx, 0x400
mov ecx, edi
call fcn.0041ef30
mov eax, dword [0x5b4314]
push 0x400
push edi
push ebp
push 0x800a
push eax
call dword [sym.imp.WSOCK32.dll_WSAAsyncGetHostByName]
test eax, eax
mov dword [esi + 0x18], eax
jne 0x54aee2
mov dword [esi + 0x424], eax
mov eax, dword [esi + 0x41c]
test eax, eax
jne 0x54aee2
mov eax, dword [esi + 0x420]
test eax, eax
mov dword [esi + 0x908], 0
je 0x54aee2
lea edi, [esi + 0x444]
mov edx, edi
mov ecx, 0x1778
mov dword [esi + 0x830], 2
call fcn.0041d620
mov ecx, esi
call fcn.0054a7d0
test eax, eax
mov ecx, edi
jne 0x54aedb
push esi
mov edx, 7
call fcn.00455150
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x104
ret