Function at 0x51939c
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ecx
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x51988c
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
push 0
call fcn.004c6f54
mov dl, byte [eax]
lea eax, [ebp - 0x18]
call fcn.00403db8
mov eax, dword [ebp - 0x18]
call fcn.00408fd8
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x1c]
fdivr dword [0x5198a0]
fcomp dword [0x5198a4]
fnstsw ax
sahf
jne 0x519869
lea eax, [ebp - 0x14]
mov edx, dword [0x54988c]
mov edx, dword [edx]
call fcn.00403cac
xor eax, eax
mov al, byte [ebp - 9]
imul eax, eax, 0x75
mov esi, dword [eax*2 + 0x54c17f]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [0x54988c]
mov edx, dword [edx]
call fcn.00403fa0
jne 0x5196a3
mov byte [0x54c5fc], 0
mov eax, dword [ebp - 4]
mov edx, dword [0x54c1e8]
call fcn.00403c68
mov eax, dword [esi + 0x20c]
call fcn.0047e0e0
test eax, eax
jne 0x51946a
mov eax, esi
call fcn.00481574
test eax, eax
je 0x519869
mov eax, esi
call fcn.00481574
call fcn.0047dfd4
mov edx, eax
mov eax, dword [esi + 0x20c]
call fcn.0047e118
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.00534a40
cmp al, 3
jne 0x519869
mov eax, esi
call fcn.00481574
call fcn.0047dfd4
mov edx, eax
mov eax, dword [esi + 0x20c]
call fcn.0047e118
mov edx, dword [eax + 0x24]
mov eax, dword [ebp + 0x10]
call fcn.00403c68
lea eax, [ebp - 0x18]
push eax
mov edx, dword [ebp + 0x10]
mov edx, dword [edx]
mov cl, 0x5f
mov eax, dword [ebp - 8]
call fcn.00533a9c
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00403e98
mov eax, dword [ebp - 4]
push ebp
lea eax, [ebp - 0x18]
call fcn.00519108
pop ecx
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
call fcn.00403cac
mov eax, dword [ebp - 0x10]
mov edx, dword [0x54988c]
mov edx, dword [edx]
call fcn.00403fa0
jne 0x51959e
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004095c8
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x18]
call fcn.0040898c
mov eax, dword [ebp - 0x18]
mov edx, 0x5198b0
call fcn.00403fa0
je 0x51957a
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004095c8
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x18]
call fcn.0040898c
mov eax, dword [ebp - 0x18]
mov edx, 0x5198c0
call fcn.00403fa0
je 0x51957a
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004095c8
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x18]
call fcn.0040898c
mov eax, dword [ebp - 0x18]
mov edx, 0x5198d0
call fcn.00403fa0
jne 0x51959e
cmp byte [ebp + 0xc], 0
je 0x51958f
mov eax, 0x5198e0
call fcn.0045b380
jmp 0x519869
mov eax, 0x51990c
call fcn.0045b380
jmp 0x519869
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5195b7
lea eax, [ebp - 0x10]
mov edx, 0x519938
call fcn.00403cac
mov cl, 1
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 8]
call fcn.0050ef20
xor eax, eax
mov al, byte [ebp - 9]
imul eax, eax, 0x75
mov byte [eax*2 + 0x54c1a7], 1
mov byte [0x54c630], 1
xor edx, edx
push ebp
push 0x51960f
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [ebp - 4]
mov edx, dword [edx]
push edx
push 1
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov edx, dword [eax*2 + 0x54c193]
mov eax, dword [ebp - 8]
call fcn.0052e334
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51961b
mov byte [0x54c630], 0
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.00533eb0
xor eax, eax
mov dword [0x54c618], eax
xor eax, eax
mov al, byte [ebp - 9]
imul esi, eax, 0x75
mov byte [esi*2 + 0x54c1a7], 0
xor ecx, ecx
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 8]
call fcn.0050ef20
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0053751c
cmp byte [0x54c5fd], 0
jbe 0x51966c
mov byte [0x54c5fd], 0
xor ebx, ebx
test bl, bl
je 0x519869
mov eax, dword [esi*2 + 0x54c193]
cmp byte [eax + 0x1424], 0
je 0x5196de
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00409590
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.0053c4a0
xor ebx, ebx
jmp 0x519869
lea eax, [ebp - 0x14]
mov edx, 0x519950
call fcn.00403cac
push ebp
lea eax, [ebp - 0x18]
call fcn.00519108
pop ecx
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
call fcn.00403cac
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5196de
lea eax, [ebp - 0x10]
mov edx, 0x519938
call fcn.00403cac
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004649f8
test al, al
je 0x519869
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [0x54988c]
mov edx, dword [edx]
call fcn.00403fa0
je 0x519869
cmp byte [0x54c532], 0
je 0x51973a
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov edx, dword [0x54988c]
mov edx, dword [edx]
call fcn.00403fa0
je 0x51973a
cmp byte [ebp + 0xc], 0
jne 0x51973a
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov eax, dword [0x54c5f8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp - 0x10]
mov edx, dword [0x54988c]
mov edx, dword [edx]
call fcn.00403fa0
jne 0x519798
cmp byte [ebp + 0xc], 0
je 0x519761
lea eax, [ebp - 0x14]
mov edx, 0x519950
call fcn.00403cac
jmp 0x51976e
lea eax, [ebp - 0x14]
mov edx, 0x519960
call fcn.00403cac
push 1
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00404054
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404054
push eax
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
ja 0x519869
mov eax, dword [ebp - 0x10]
mov edx, 0x519938
call fcn.00403fa0
je 0x5197b9
mov eax, dword [ebp - 0x10]
mov edx, dword [0x54988c]
mov edx, dword [edx]
call fcn.00403fa0
jne 0x5197fa
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push eax
push 0
cmp byte [ebp + 0xc], 0
je 0x5197db
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov edx, dword [0x54988c]
mov edx, dword [edx]
call fcn.00403fa0
jne 0x5197df
xor eax, eax
jmp 0x5197e1
mov al, 1
push eax
mov al, byte [ebp + 8]
push eax
mov edx, dword [0x54988c]
mov edx, dword [edx]
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.0051fb00
jmp 0x519869
mov eax, dword [ebp - 0x10]
mov edx, dword [0x54988c]
mov edx, dword [edx]
call fcn.00403fa0
je 0x51984f
push 1
push 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0xb
lea edx, [ebp - 0x28]
xor ecx, ecx
mov eax, 0x519970
call fcn.0040a05c
mov eax, dword [ebp - 0x18]
call fcn.00404054
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404054
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
ja 0x519869
push 0
push 0x519978
push 0x519984
mov eax, dword [ebp - 8]
call fcn.00446fc4
push eax
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x519893
lea eax, [ebp - 0x20]
call fcn.00403c14
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00403c38
ret