Function at 0x52b920
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x46c
mov eax, dword [0x5f5764]
push ebx
push ebp
push esi
xor ebx, ebx
cmp eax, ebx
mov ebp, edx
mov esi, ecx
mov dword [esp + 0xc], ebp
mov dword [esp + 0x14], esi
jne 0x52b954
push 0x5ac7f0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [0x5f5764], eax
je 0x52b96d
cmp dword [0x5f5760], ebx
jne 0x52b975
push str.GetOpenFileNameA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5f5760], eax
cmp dword [0x5f5760], ebx
je 0x52b97d
cmp dword [0x5f6584], ebx
je 0x52b992
xor ecx, ecx
call fcn.0041f0a0
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x46c
ret 0xc
cmp esi, ebx
push edi
mov edi, 1
mov dword [0x5f6584], edi
je 0x52b9c3
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x52b9c3
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x52b9c3
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x52b9cc
mov eax, dword [0x5f92ec]
mov dword [esp + 0x18], eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
call esi
test ah, ah
js 0x52b9e1
push 2
call esi
test ah, ah
jns 0x52ba0b
lea ecx, [esp + 0x1fc]
push ecx
call dword [sym.imp.USER32.dll_GetKeyboardState]
lea edx, [esp + 0x1fc]
push edx
mov byte [esp + 0x201], bl
mov byte [esp + 0x202], bl
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov edx, 0x1e
mov ecx, 0x5f5fd0
call fcn.00420e60
mov edx, 0x180
mov ecx, 0x5f5768
call fcn.00420e60
mov edx, 0x3e7
mov ecx, 0x5f58e8
call fcn.00420e60
mov edx, 0x180
lea ecx, [esp + 0x78]
call fcn.00420e60
mov edx, 0x180
mov ecx, 0x5f5ff0
call fcn.00420e60
mov edx, 0x3e7
mov ecx, 0x5f6170
call fcn.00420e60
mov eax, dword [esp + 0x488]
mov dword [0x5f6558], eax
mov eax, dword [esp + 0x484]
cmp eax, ebx
mov dword [esp + 0x14], edi
mov dword [0x5f655c], ebx
mov dword [0x5f6560], ebx
mov dword [esp + 0x1c], ebx
mov dword [0x5f6564], ebx
mov dword [0x5f6568], ebx
mov dword [0x5f656c], ebx
je 0x52bab1
push eax
mov edx, 0x1e
mov ecx, 0x5f5fd0
call fcn.00420d70
cmp ebp, 0x64
jl 0x52bac1
sub ebp, 0x64
mov dword [esp + 0x10], ebp
mov dword [esp + 0x1c], edi
cmp ebp, 0xa
jl 0x52bad1
sub ebp, 0xa
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebx
mov edx, 0x180
lea ecx, [esp + 0x78]
call fcn.00420e60
mov edx, dword [0x5f92e8]
push 0x180
lea ecx, [esp + 0x7c]
push ecx
push 0x13f0
push edx
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esp + 0x78]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x52bb02
sub eax, edx
mov cl, byte [esp + eax + 0x77]
mov dl, byte [esp + 0x78]
xor eax, eax
cmp dl, bl
je 0x52bb51
lea esp, [esp]
cmp byte [esp + eax + 0x78], cl
jne 0x52bb2a
mov byte [esp + eax + 0x78], bl
cmp eax, 0x180
jae 0x52bb3c
mov dl, byte [esp + eax + 0x79]
inc eax
cmp dl, bl
jne 0x52bb20
jmp 0x52bb51
mov byte [esp + 0x1f8], bl
mov byte [esp + 0x1f7], bl
mov byte [esp + 0x1f6], bl
xor eax, eax
mov cl, byte [eax + 0x5f5cd0]
mov byte [eax + 0x5f5768], cl
inc eax
cmp cl, bl
jne 0x52bb53
push 0x5c5d18
push 0x5c5c18
push 0x5c5b18
push 0x5c5b14
push 0x5f5768
call fcn.00591920
mov al, byte [0x5f5768]
add esp, 0x14
cmp al, bl
je 0x52bc77
xor eax, eax
jmp 0x52bba0
mov cl, byte [eax + 0x5c5b14]
mov byte [eax + 0x5f5768], cl
inc eax
cmp cl, bl
jne 0x52bba0
mov eax, 0x5c5b18
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x52bbb8
mov edi, 0x5f5768
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x52bbc7
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov cl, byte [eax + 0x5c5c18]
mov byte [eax + 0x5f58e8], cl
inc eax
cmp cl, bl
jne 0x52bbe1
mov eax, 0x5c5d18
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x52bc00
mov edi, 0x5f58e8
sub eax, edx
dec edi
nop
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x52bc10
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x5ac7d8
push 0x5f58e8
rep movsb byte es:[edi], byte [esi]
call fcn.005a299c
add esp, 8
test eax, eax
je 0x52bc54
push 0x5ac7d4
push 0x5f58e8
call fcn.005a299c
add esp, 8
test eax, eax
jne 0x52bc5a
mov byte [0x5f58e8], bl
push 0x5a81f0
push 0x5f58e8
call fcn.005a299c
add esp, 8
mov ebp, eax
neg ebp
sbb ebp, ebp
add ebp, 2
jmp 0x52bc9c
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x5ee048]
mov byte [eax + 0x5f5768], cl
inc eax
cmp cl, bl
jne 0x52bc80
mov byte [0x5f58e8], bl
mov ebp, 2
mov eax, 0x5c5d18
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x52bca4
sub eax, edx
cmp eax, 3
jb 0x52bd1b
mov edi, 2
lea ecx, [esp + 0x78]
jmp 0x52bcc0
cmp byte [ecx], bl
je 0x52bd1b
mov esi, ecx
mov al, byte [esi + 1]
inc esi
cmp al, bl
jne 0x52bcc6
mov eax, edi
and eax, reloc.WSOCK32.dll_accept
jns 0x52bcdc
dec eax
or eax, 0xfffffffe
inc eax
je 0x52bcec
mov edx, 0x5c5d18
call fcn.004201d0
test eax, eax
jne 0x52bcf6
lea ecx, [esi + 1]
inc edi
cmp ecx, ebx
jne 0x52bcc0
jmp 0x52bd1b
push 0x5a574c
push 0x5c5c18
call fcn.005a299c
add esp, 8
test eax, eax
jne 0x52bd12
mov byte [0x5f58e8], bl
mov eax, edi
cdq
sub eax, edx
mov ebp, eax
sar ebp, 1
mov edx, 2
mov ecx, 0x5f5768
call fcn.00421f20
test eax, eax
jne 0x52bd41
mov edi, edi
mov cl, byte [eax + 0x5ee048]
mov byte [eax + 0x5f5768], cl
inc eax
cmp cl, bl
jne 0x52bd30
mov eax, 0x5f5768
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x52bd50
sub eax, edx
cmp eax, 3
jbe 0x52bd6d
cmp byte [eax + 0x5f5767], 0x5c
jne 0x52bd6d
mov byte [eax + 0x5f5767], bl
mov esi, dword [esp + 0x480]
xor eax, eax
mov ecx, 0x16
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x10]
cmp eax, ebx
pop edi
jne 0x52bde7
mov ecx, dword [esp + 0x14]
mov edx, esi
call fcn.0052c2e0
test eax, eax
je 0x52bdd0
xor eax, eax
jmp 0x52bda0
mov cl, byte [eax + 0x5f5768]
mov byte [eax + 0x5f5cd0], cl
inc eax
cmp cl, bl
jne 0x52bda0
mov cl, byte [0x5f5cd0]
pop esi
xor eax, eax
cmp cl, bl
pop ebp
mov dword [0x5f6584], ebx
setne al
pop ebx
add esp, 0x46c
ret 0xc
mov dword [0x5f58e8], 0x2a2e2a
mov dword [esp + 0x50], 0x28a0924
jmp 0x52beb7
cmp eax, 1
je 0x52be93
cmp eax, 4
je 0x52be93
cmp eax, 5
je 0x52be93
cmp eax, 2
jne 0x52be32
cmp dword [esp + 0x10], ebx
mov dword [esp + 0x64], 0x14a
mov dword [esp + 0x50], 0x28a0a64
je 0x52be25
mov dword [esp + 0x50], 0x28a1a64
mov dword [esp + 0x60], 0x52add0
jmp 0x52bebf
cmp eax, 3
jne 0x52be4b
mov dword [0x5f655c], 1
mov dword [esp + 0x50], 0x28a0824
jmp 0x52beb7
cmp eax, 6
jne 0x52be78
cmp dword [esp + 0x10], ebx
mov dword [esp + 0x64], 0x154
mov dword [esp + 0x50], 0x20a0864
je 0x52be6e
mov dword [esp + 0x50], 0x20a1864
mov dword [esp + 0x60], 0x52b770
jmp 0x52bebf
xor ecx, ecx
call fcn.0041f0a0
pop esi
pop ebp
mov dword [0x5f6584], ebx
xor eax, eax
pop ebx
add esp, 0x46c
ret 0xc
cmp dword [esp + 0x10], ebx
mov dword [esp + 0x50], 0x28a0824
je 0x52bea9
mov dword [esp + 0x50], 0x28a1824
cmp dword [esp + 0x18], ebx
je 0x52beb7
or dword [esp + 0x50], 0x200
mov dword [esp + 0x60], 0x52b2c0
cmp byte [esi], bl
je 0x52bec7
mov dword [esp + 0x4c], esi
mov ecx, dword [0x5c5e38]
mov eax, dword [0x5eeee0]
neg ecx
sbb ecx, ecx
and ecx, 0xc
add ecx, 0x4c
cmp eax, ebx
mov dword [esp + 0x1c], ecx
je 0x52beea
mov dword [esp + 0x24], eax
jmp 0x52bef4
mov edx, dword [0x5f92e8]
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x74]
mov dword [esp + 0x28], ecx
mov edx, 0x180
lea ecx, [esp + 0x2f8]
mov dword [esp + 0x20], eax
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], 0x5f58e8
mov dword [esp + 0x3c], 0x3e7
mov dword [esp + 0x48], 0x5f5768
call fcn.00420e60
lea edx, [esp + 0x2f8]
push 0x104
push edx
call fcn.005a1943
add esp, 8
test eax, eax
jne 0x52bf60
push 0x5ee048
mov edx, 0x180
lea ecx, [esp + 0x2fc]
call fcn.00420d70
lea eax, [esp + 0x1c]
push eax
call dword [0x5f5760]
test eax, eax
je 0x52c11e
mov esi, dword [esp + 0xc]
cmp esi, 2
jne 0x52c02c
xor eax, eax
mov cl, byte [eax + 0x5f6170]
mov byte [eax + 0x5f5168], cl
inc eax
cmp cl, bl
jne 0x52bf82
mov edx, 0x3e7
mov ecx, 0x5f6170
call fcn.00420e60
mov ecx, dword [0x5ca42c]
push ebx
push 1
mov edx, 0x5f4f80
call fcn.004d4440
cmp eax, ebx
je 0x52bfbe
mov dword [0x5ca42c], eax
mov ecx, dword [0x5ca42c]
push 0x5ee150
push 0x14
push 0x5a4dfc
mov edx, str.dccnicks
call fcn.004bd180
mov edx, 0x180
mov ecx, 0x5f4fe8
call fcn.00420e60
push 0x180
push 0x5f4fe8
call fcn.005a1943
add esp, 8
mov ecx, 0x5f4fe8
call fcn.00422770
lea ecx, [esp + 0x2f8]
push ecx
call fcn.005a34b4
add esp, 4
pop esi
pop ebp
mov dword [0x5f6584], ebx
mov eax, 1
pop ebx
add esp, 0x46c
ret 0xc
mov edx, 0x180
mov ecx, 0x5f5cd0
call fcn.00420e60
push 0x104
push 0x5f5cd0
call fcn.005a1943
add esp, 8
mov ecx, 0x5f5cd0
call fcn.00422770
lea edx, [esp + 0x2f8]
push edx
call fcn.005a34b4
add esp, 4
cmp esi, ebx
je 0x52c0f8
push 9
push 0x5f6170
call fcn.005912e0
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x52c086
mov byte [esi], bl
push 0x5c5d18
push 0x5c5c18
push 0x5c5b18
push 0x5c5b14
push 0x5f6170
call fcn.00591920
push 0x5c5d18
push 0x5c5c18
push 0x5a49b4
push 0x5f5e50
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x24
cmp esi, ebx
je 0x52c0c8
mov byte [esi], 9
xor eax, eax
lea ebx, [ebx]
mov cl, byte [eax + 0x5f5cd0]
mov byte [eax + 0x5f5ff0], cl
inc eax
cmp cl, bl
jne 0x52c0d0
pop esi
pop ebp
mov dword [0x5f6584], ebx
mov eax, 1
pop ebx
add esp, 0x46c
ret 0xc
mov edx, 0x180
mov ecx, 0x5f5e50
call fcn.00420e60
pop esi
pop ebp
mov dword [0x5f6584], ebx
mov eax, 1
pop ebx
add esp, 0x46c
ret 0xc
mov edx, 0x180
mov ecx, 0x5f5cd0
call fcn.00420e60
mov edx, 0x180
mov ecx, 0x5f5e50
call fcn.00420e60
mov edx, 0x180
mov ecx, 0x5f5ff0
call fcn.00420e60
mov edx, 0x3e7
mov ecx, 0x5f6170
call fcn.00420e60
call dword [sym.imp.comdlg32.dll_CommDlgExtendedError]
cmp eax, 0x3003
jne 0x52c171
mov dword [0x5f6564], 1
lea eax, [esp + 0x2f8]
push eax
call fcn.005a34b4
add esp, 4
pop esi
pop ebp
mov dword [0x5f6584], ebx
xor eax, eax
pop ebx
add esp, 0x46c
ret 0xc