Function at 0x512110
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x45c
mov eax, dword [0x59f65c]
push ebx
push ebp
push esi
xor ebx, ebx
cmp eax, ebx
mov ebp, edx
mov esi, ecx
mov dword [esp + 0xc], ebp
mov dword [esp + 0x14], esi
je 0x512145
xor ecx, ecx
call fcn.0041c8e0
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x45c
ret 0xc
cmp esi, ebx
push edi
mov edi, 1
mov dword [0x59f65c], edi
je 0x512176
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x512176
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x512176
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x51217f
mov eax, dword [0x5a1b00]
mov dword [esp + 0x18], eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
call esi
test ah, ah
js 0x512194
push 2
call esi
test ah, ah
jns 0x5121be
lea ecx, [esp + 0x1ec]
push ecx
call dword [sym.imp.USER32.dll_GetKeyboardState]
lea edx, [esp + 0x1ec]
push edx
mov byte [esp + 0x1f1], bl
mov byte [esp + 0x1f2], bl
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov edx, 0x1e
mov ecx, 0x59f0b0
call fcn.0041e210
mov edx, 0x180
mov ecx, 0x59e848
call fcn.0041e210
mov edx, 0x3e7
mov ecx, 0x59e9c8
call fcn.0041e210
mov edx, 0x180
lea ecx, [esp + 0x6c]
call fcn.0041e210
mov edx, 0x180
mov ecx, 0x59f0d0
call fcn.0041e210
mov edx, 0x3e7
mov ecx, 0x59f250
call fcn.0041e210
mov eax, dword [esp + 0x478]
mov dword [0x59f638], eax
mov eax, dword [esp + 0x474]
cmp eax, ebx
mov dword [esp + 0x14], edi
mov dword [0x59f63c], ebx
mov dword [0x59f640], ebx
mov dword [esp + 0x1c], ebx
mov dword [0x59f644], ebx
je 0x512258
push eax
mov edx, 0x1e
mov ecx, 0x59f0b0
call fcn.0041e120
cmp ebp, 0x64
jl 0x512268
sub ebp, 0x64
mov dword [esp + 0x10], ebp
mov dword [esp + 0x1c], edi
cmp ebp, 0xa
jl 0x512278
sub ebp, 0xa
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebx
mov edx, 0x180
lea ecx, [esp + 0x6c]
call fcn.0041e210
mov edx, dword [0x5a1afc]
push 0x180
lea ecx, [esp + 0x70]
push ecx
push 0x13f0
push edx
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esp + 0x6c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x5122b0
sub eax, edx
mov cl, byte [esp + eax + 0x6b]
mov dl, byte [esp + 0x6c]
xor eax, eax
cmp dl, bl
je 0x5122f8
cmp byte [esp + eax + 0x6c], cl
jne 0x5122d1
mov byte [esp + eax + 0x6c], bl
cmp eax, 0x104
jae 0x5122e3
mov dl, byte [esp + eax + 0x6d]
inc eax
cmp dl, bl
jne 0x5122c7
jmp 0x5122f8
mov byte [esp + 0x170], bl
mov byte [esp + 0x16f], bl
mov byte [esp + 0x16e], bl
xor eax, eax
lea ebx, [ebx]
mov cl, byte [eax + 0x59edb0]
mov byte [eax + 0x59e848], cl
inc eax
cmp cl, bl
jne 0x512300
push 0x5902c8
push 0x5901c8
push 0x5900c8
push 0x5900c0
push 0x59e848
call fcn.00563b42
mov al, byte [0x59e848]
add esp, 0x14
cmp al, bl
je 0x5123ec
xor eax, eax
mov cl, byte [eax + 0x5900c0]
mov byte [eax + 0x59e848], cl
inc eax
cmp cl, bl
jne 0x512341
mov eax, 0x5900c8
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x512360
mov edi, 0x59e848
sub eax, edx
dec edi
nop
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x512370
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
lea ebx, [ebx]
mov cl, byte [eax + 0x5901c8]
mov byte [eax + 0x59e9c8], cl
inc eax
cmp cl, bl
jne 0x512390
mov eax, 0x5902c8
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x5123a8
mov edi, 0x59e9c8
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x5123b7
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x577a10
push 0x59e9c8
rep movsb byte es:[edi], byte [esi]
call fcn.00572b46
add esp, 8
mov ebp, eax
neg ebp
sbb ebp, ebp
add ebp, 2
jmp 0x51240c
xor eax, eax
mov edi, edi
mov cl, byte [eax + 0x598248]
mov byte [eax + 0x59e848], cl
inc eax
cmp cl, bl
jne 0x5123f0
mov byte [0x59e9c8], bl
mov ebp, 2
mov eax, 0x5902c8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x512414
sub eax, edx
cmp eax, 3
jb 0x51248b
mov edi, 2
lea ecx, [esp + 0x6c]
jmp 0x512430
cmp byte [ecx], bl
je 0x51248b
mov esi, ecx
mov al, byte [esi + 1]
inc esi
cmp al, bl
jne 0x512436
mov eax, edi
and eax, reloc.WSOCK32.dll_accept
jns 0x51244c
dec eax
or eax, 0xfffffffe
inc eax
je 0x51245c
mov edx, 0x5902c8
call fcn.0041d580
test eax, eax
jne 0x512466
lea ecx, [esi + 1]
inc edi
cmp ecx, ebx
jne 0x512430
jmp 0x51248b
push 0x57561c
push 0x5901c8
call fcn.00572b46
add esp, 8
test eax, eax
jne 0x512482
mov byte [0x59e9c8], bl
mov eax, edi
cdq
sub eax, edx
mov ebp, eax
sar ebp, 1
mov edx, 2
mov ecx, 0x59e848
call fcn.0041ef30
test eax, eax
jne 0x5124b1
mov edi, edi
mov cl, byte [eax + 0x598248]
mov byte [eax + 0x59e848], cl
inc eax
cmp cl, bl
jne 0x5124a0
mov eax, 0x59e848
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x5124c0
sub eax, edx
cmp eax, 3
jbe 0x5124dd
cmp byte [eax + 0x59e847], 0x5c
jne 0x5124dd
mov byte [eax + 0x59e847], bl
mov esi, dword [esp + 0x470]
xor eax, eax
mov ecx, 0x13
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x10]
cmp eax, ebx
pop edi
jne 0x512557
mov ecx, dword [esp + 0x14]
mov edx, esi
call fcn.00512a30
test eax, eax
je 0x512540
xor eax, eax
jmp 0x512510
mov cl, byte [eax + 0x59e848]
mov byte [eax + 0x59edb0], cl
inc eax
cmp cl, bl
jne 0x512510
mov cl, byte [0x59edb0]
pop esi
xor eax, eax
cmp cl, bl
pop ebp
mov dword [0x59f65c], ebx
setne al
pop ebx
add esp, 0x45c
ret 0xc
mov dword [0x59e9c8], 0x2a2e2a
mov dword [esp + 0x50], 0x20a0924
jmp 0x512627
cmp eax, 1
je 0x512603
cmp eax, 4
je 0x512603
cmp eax, 5
je 0x512603
cmp eax, 2
jne 0x5125a2
cmp dword [esp + 0x10], ebx
mov dword [esp + 0x64], 0x14a
mov dword [esp + 0x50], 0x20a0a64
je 0x512595
mov dword [esp + 0x50], 0x20a1a64
mov dword [esp + 0x60], 0x511650
jmp 0x51262f
cmp eax, 3
jne 0x5125bb
mov dword [0x59f63c], 1
mov dword [esp + 0x50], 0x20a0824
jmp 0x512627
cmp eax, 6
jne 0x5125e8
cmp dword [esp + 0x10], ebx
mov dword [esp + 0x64], 0x154
mov dword [esp + 0x50], 0x20a0864
je 0x5125de
mov dword [esp + 0x50], 0x20a1864
mov dword [esp + 0x60], 0x511f60
jmp 0x51262f
xor ecx, ecx
call fcn.0041c8e0
pop esi
pop ebp
mov dword [0x59f65c], ebx
xor eax, eax
pop ebx
add esp, 0x45c
ret 0xc
cmp dword [esp + 0x10], ebx
mov dword [esp + 0x50], 0x20a0824
je 0x512619
mov dword [esp + 0x50], 0x20a1824
cmp dword [esp + 0x18], ebx
je 0x512627
or dword [esp + 0x50], 0x200
mov dword [esp + 0x60], 0x511b60
cmp byte [esi], bl
je 0x512637
mov dword [esp + 0x4c], esi
mov eax, dword [0x5990c4]
cmp eax, ebx
mov dword [esp + 0x1c], 0x4c
je 0x51264e
mov dword [esp + 0x24], eax
jmp 0x512658
mov ecx, dword [0x5a1afc]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
lea eax, [esp + 0x68]
mov edx, 0x180
lea ecx, [esp + 0x2e8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], 0x59e9c8
mov dword [esp + 0x3c], 0x3e7
mov dword [esp + 0x48], 0x59e848
call fcn.0041e210
lea ecx, [esp + 0x2e8]
push 0x104
push ecx
call fcn.00573637
add esp, 8
test eax, eax
jne 0x5126c4
push 0x598248
mov edx, 0x180
lea ecx, [esp + 0x2ec]
call fcn.0041e120
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.comdlg32.dll_GetOpenFileNameA]
test eax, eax
je 0x512875
mov esi, dword [esp + 0xc]
cmp esi, 2
jne 0x512791
xor eax, eax
jmp 0x5126f0
mov cl, byte [eax + 0x59f250]
mov byte [eax + 0x59e258], cl
inc eax
cmp cl, bl
jne 0x5126f0
mov ecx, dword [0x59476c]
push ebx
push 1
mov edx, 0x59e070
mov byte [0x59f250], bl
call fcn.004c2f40
cmp eax, ebx
je 0x512723
mov dword [0x59476c], eax
mov ecx, dword [0x59476c]
push 0x598350
push 0x14
push 0x574d20
mov edx, str.dccnicks
call fcn.004aca10
mov edx, 0x180
mov ecx, 0x59e0d8
call fcn.0041e210
push 0x180
push 0x59e0d8
call fcn.00573637
add esp, 8
mov ecx, 0x59e0d8
call fcn.0041f4e0
lea eax, [esp + 0x2e8]
push eax
call fcn.0057347a
add esp, 4
pop esi
pop ebp
mov dword [0x59f65c], ebx
mov eax, 1
pop ebx
add esp, 0x45c
ret 0xc
mov edx, 0x180
mov ecx, 0x59edb0
call fcn.0041e210
push 0x104
push 0x59edb0
call fcn.00573637
add esp, 8
mov ecx, 0x59edb0
call fcn.0041f4e0
lea ecx, [esp + 0x2e8]
push ecx
call fcn.0057347a
add esp, 4
cmp esi, ebx
je 0x512858
push 9
push 0x59f250
call fcn.00563730
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x5127eb
mov byte [esi], bl
push 0x5902c8
push 0x5901c8
push 0x5900c8
push 0x5900c0
push 0x59f250
call fcn.00563b42
push 0x5902c8
push 0x5901c8
push 0x574904
push 0x59ef30
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x24
cmp esi, ebx
je 0x51282d
mov byte [esi], 9
xor eax, eax
nop
mov cl, byte [eax + 0x59edb0]
mov byte [eax + 0x59f0d0], cl
inc eax
cmp cl, bl
jne 0x512830
pop esi
pop ebp
mov dword [0x59f65c], ebx
mov eax, 1
pop ebx
add esp, 0x45c
ret 0xc
pop esi
pop ebp
mov byte [0x59ef30], bl
mov dword [0x59f65c], ebx
mov eax, 1
pop ebx
add esp, 0x45c
ret 0xc
mov edx, 0x180
mov ecx, 0x59edb0
call fcn.0041e210
mov edx, 0x180
mov ecx, 0x59ef30
call fcn.0041e210
mov edx, 0x180
mov ecx, 0x59f0d0
call fcn.0041e210
mov edx, 0x3e7
mov ecx, 0x59f250
call fcn.0041e210
call dword [sym.imp.comdlg32.dll_CommDlgExtendedError]
cmp eax, 0x3003
jne 0x5128c8
mov dword [0x59f644], 1
lea edx, [esp + 0x2e8]
push edx
call fcn.0057347a
add esp, 4
pop esi
pop ebp
mov dword [0x59f65c], ebx
xor eax, eax
pop ebx
add esp, 0x45c
ret 0xc