Function at 0x4de90c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov edi, 0x560acf
cmp dword [0x535afc], 0
jne 0x4de938
push str.commdlg_FileNameOK
call sub.USER32.dll_RegisterWindowMessageA
mov dword [0x535afc], eax
cmp dword [0x535b00], 0
jne 0x4de950
push str.commdlg_LBSelChangedNotify
call sub.USER32.dll_RegisterWindowMessageA
mov dword [0x535b00], eax
cmp dword [0x535afc], 0
je 0x4de962
cmp dword [0x535b00], 0
jne 0x4de970
push 0
call fcn.00415bea
xor eax, eax
jmp 0x4df0be
cmp dword [0x535b04], 0
je 0x4de987
push 0
call fcn.00415bea
xor eax, eax
jmp 0x4df0be
mov dword [0x535b04], 1
cmp dword [ebp + 8], 0
je 0x4de9bb
push dword [ebp + 8]
call sub.USER32.dll_IsWindow
test eax, eax
je 0x4de9bb
push dword [ebp + 8]
call sub.USER32.dll_IsIconic
test eax, eax
jne 0x4de9bb
push dword [ebp + 8]
call sub.USER32.dll_IsWindowVisible
test eax, eax
jne 0x4de9c4
mov edx, dword [0x537420]
mov dword [ebp + 8], edx
push 1
call sub.USER32.dll_GetKeyState
test ax, ax
jl 0x4de9dc
push 2
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x4de9fe
push 0x54ac34
call sub.USER32.dll_GetKeyboardState
mov byte [0x54ac35], 0
mov byte [0x54ac36], 0
push 0x54ac34
call sub.USER32.dll_SetKeyboardState
mov ecx, dword [ebp + 0x18]
mov dword [0x535aec], ecx
mov dword [ebp - 0xc], 1
xor eax, eax
mov dword [0x535af0], eax
mov dword [ebp - 4], 1
xor edx, edx
mov dword [0x535af4], edx
xor ecx, ecx
mov dword [0x535af8], ecx
mov byte [0x560abb], 0
test ebx, ebx
je 0x4dea4e
push 0xf
push ebx
push 0x560abb
call fcn.005185e8
add esp, 0xc
mov byte [0x560aca], 0
cmp esi, 0xa
jl 0x4dea5b
sub esi, 0xa
xor eax, eax
mov dword [ebp - 0xc], eax
push 0x180
push 0x56063b
push 0x13ee
push dword [0x53741c]
call sub.USER32.dll_LoadStringA
push 0x56063b
call fcn.005183dc
pop ecx
mov dl, byte [eax + 0x56063a]
mov byte [ebp - 5], dl
xor edx, edx
mov eax, 0x56063b
jmp 0x4deab4
cmp cl, byte [ebp - 5]
jne 0x4dea9a
mov byte [eax], 0
cmp edx, 0x104
jb 0x4deab2
mov byte [0x56073e], 0
mov byte [0x56073f], 0
jmp 0x4deaba
inc edx
inc eax
mov cl, byte [eax]
test cl, cl
jne 0x4dea92
push esi
push edi
mov esi, 0x5600d4
mov edi, 0x5607bb
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
cmp byte [0x5600d4], 0
je 0x4debb1
push 0x54bcbb
push 0x54bbbb
push 0x54babb
push 0x54bab8
push 0x5600d4
call fcn.0051d600
add esp, 0x14
push esi
push edi
mov esi, 0x5600d4
mov edi, 0x54bab8
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0x54babb
push 0x5600d4
call fcn.00518300
add esp, 8
push esi
push edi
mov esi, 0x560254
mov edi, 0x54bbbb
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0x54bcbb
push 0x560254
call fcn.00518300
add esp, 8
push 0x535b42
push 0x560254
call fcn.005185a0
add esp, 8
test eax, eax
jne 0x4debaa
mov ebx, 2
jmp 0x4debe8
mov ebx, 1
jmp 0x4debe8
push esi
push edi
mov esi, 0x5600d4
mov edi, 0x52feac
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov byte [0x560254], 0
mov ebx, 2
push 2
push 0x5600d4
call fcn.00416273
test eax, eax
jne 0x4dec23
push esi
push edi
mov esi, 0x5600d4
mov edi, 0x52feac
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0x5600d4
call fcn.005183dc
pop ecx
mov edx, eax
cmp edx, 3
jbe 0x4dec45
cmp byte [edx + 0x5600d3], 0x5c
jne 0x4dec45
mov byte [edx + 0x5600d3], 0
push 0x4c
push 0
push edi
call fcn.0051825c
add esp, 0xc
test esi, esi
jne 0x4ded18
cmp dword [0x532a54], 0
je 0x4dece2
cmp dword [ebp - 4], 0
je 0x4dece2
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.00408858
test eax, eax
je 0x4decc0
mov esi, 0x5607bb
mov edi, 0x5600d4
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov dword [0x535b04], eax
cmp byte [0x5607bb], 0
jne 0x4decb6
xor eax, eax
jmp 0x4df0be
mov eax, 1
jmp 0x4df0be
push esi
push edi
mov esi, 0x535b47
mov edi, 0x560254
mov eax, edi
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword [edi + 0x34], 0xa0924
mov dword [0x535af0], 1
cmp dword [0x535af0], 0
jne 0x4ded0c
push esi
push edi
mov esi, str.jnukjnuk
mov edi, 0x560254
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov dword [edi + 0x48], 0x168
mov dword [edi + 0x34], 0x64
mov dword [edi + 0x44], sym.mirc32.exe_FileHook2
jmp 0x4deeb8
cmp esi, 1
je 0x4ded27
cmp esi, 4
je 0x4ded27
cmp esi, 5
jne 0x4ded84
cmp dword [0x532a54], 0
je 0x4ded54
cmp dword [ebp - 4], 0
je 0x4ded54
mov dword [edi + 0x34], 0xa0824
cmp dword [ebp - 0xc], 0
je 0x4ded4a
or dword [edi + 0x34], 0x1000
mov dword [0x535af0], 1
cmp dword [0x535af0], 0
jne 0x4ded78
mov dword [edi + 0x48], 0x15e
mov dword [edi + 0x34], 0x864
cmp dword [ebp - 0xc], 0
je 0x4ded78
or dword [edi + 0x34], 0x1000
mov dword [edi + 0x44], sym.mirc32.exe_FileHook2
jmp 0x4deeb8
cmp esi, 2
jne 0x4deded
cmp dword [0x532a54], 0
je 0x4dedbd
cmp dword [ebp - 4], 0
je 0x4dedbd
mov dword [edi + 0x48], 0x14a
mov dword [edi + 0x34], 0xa0a64
cmp dword [ebp - 0xc], 0
je 0x4dedb3
or dword [edi + 0x34], 0x1000
mov dword [0x535af0], 1
cmp dword [0x535af0], 0
jne 0x4dede1
mov dword [edi + 0x48], 0x172
mov dword [edi + 0x34], 0xa64
cmp dword [ebp - 0xc], 0
je 0x4dede1
or dword [edi + 0x34], 0x1000
mov dword [edi + 0x44], sym.mirc32.exe_FileHook
jmp 0x4deeb8
cmp esi, 3
jne 0x4dee3c
mov dword [0x535af4], 1
cmp dword [0x532a54], 0
je 0x4dee1c
cmp dword [ebp - 4], 0
je 0x4dee1c
mov dword [edi + 0x34], 0xa0824
mov dword [0x535af0], 1
cmp dword [0x535af0], 0
jne 0x4dee33
mov dword [edi + 0x48], 0x15e
mov dword [edi + 0x34], 0x864
mov dword [edi + 0x44], sym.mirc32.exe_FileHook2
jmp 0x4deeb8
cmp esi, 6
jne 0x4deea2
cmp dword [0x532a54], 0
je 0x4dee75
cmp dword [ebp - 4], 0
je 0x4dee75
mov dword [edi + 0x48], 0x154
mov dword [edi + 0x34], 0xa0864
cmp dword [ebp - 0xc], 0
je 0x4dee6b
or dword [edi + 0x34], 0x1000
mov dword [0x535af0], 1
cmp dword [0x535af0], 0
jne 0x4dee99
mov dword [edi + 0x48], 0x190
mov dword [edi + 0x34], 0x864
cmp dword [ebp - 0xc], 0
je 0x4dee99
or dword [edi + 0x34], 0x1000
mov dword [edi + 0x44], sym.mirc32.exe_FileHook3
jmp 0x4deeb8
push 0
call fcn.00415bea
xor edx, edx
mov dword [0x535b04], edx
xor eax, eax
jmp 0x4df0be
mov edx, dword [ebp + 0x10]
cmp byte [edx], 0
je 0x4deec6
mov ecx, dword [ebp + 0x10]
mov dword [edi + 0x30], ecx
mov dword [edi], 0x4c
mov eax, dword [0x532a84]
test eax, eax
je 0x4deeda
mov dword [edi + 8], eax
jmp 0x4deee3
mov edx, dword [0x53741c]
mov dword [edi + 8], edx
mov ecx, dword [ebp + 8]
mov dword [edi + 4], ecx
mov dword [edi + 0xc], 0x56063b
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], 0x560254
mov dword [edi + 0x20], 0x3e7
mov dword [edi + 0x2c], 0x5600d4
push 0x8001
call sub.KERNEL32.dll_SetErrorMode
call fcn.0051eb6c
mov dword [ebp - 0x10], eax
push edi
call sub.COMDLG32.dll_GetOpenFileNameA
test eax, eax
je 0x4df07b
push 0
call sub.KERNEL32.dll_SetErrorMode
cmp esi, 2
jne 0x4defd2
push 0
push 1
push 0x55d984
push dword [0x52cc6c]
call fcn.0049dbfe
mov ebx, eax
mov dword [0x5600d0], ebx
test ebx, ebx
je 0x4def5e
mov dword [0x52cc6c], ebx
push 0x52ffb0
push 0x14
push 0x535b60
push str.dccnicks
push dword [0x52cc6c]
call fcn.00486f75
push 0x180
push 0x55d9e8
call fcn.0051c368
add esp, 8
push 0x55d9e8
call fcn.005183dc
pop ecx
mov edx, eax
test edx, edx
jbe 0x4defb8
cmp byte [edx + 0x55d9e7], 0x5c
je 0x4defb8
push 0x535b63
push 0x55d9e8
call fcn.00518300
add esp, 8
push dword [ebp - 0x10]
call fcn.0051eb7c
pop ecx
xor eax, eax
mov dword [0x535b04], eax
mov eax, 1
jmp 0x4df0be
push 0x5c
push dword [edi + 0x1c]
call fcn.005186c4
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x4deffa
push 0
call fcn.00415bea
xor eax, eax
mov dword [0x535b04], eax
xor eax, eax
jmp 0x4df0be
inc ebx
test esi, esi
je 0x4df027
push esi
push edi
mov esi, 0x56093b
mov edi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov byte [ebx], 0
mov eax, dword [edi + 0x1c]
push esi
push edi
mov esi, 0x5607bb
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
test esi, esi
jne 0x4df064
push 0x5607bb
call fcn.005207ec
pop ecx
push dword [ebp - 0x10]
call fcn.0051eb7c
pop ecx
xor eax, eax
mov dword [0x535b04], eax
mov eax, 1
jmp 0x4df0be
push dword [ebp - 0x10]
call fcn.0051eb7c
pop ecx
push 0
call sub.KERNEL32.dll_SetErrorMode
cmp dword [ebp - 4], 0
je 0x4df0b5
cmp dword [0x535af0], 0
je 0x4df0b5
call sub.COMDLG32.dll_CommDlgExtendedError
test eax, eax
je 0x4df0b5
xor edx, edx
mov dword [ebp - 4], edx
xor ecx, ecx
mov dword [0x535af0], ecx
jmp 0x4dec45
xor eax, eax
mov dword [0x535b04], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14