Function at 0x401b60
Capabilities:
Check for time delay via gettickcount
Create process on windows
Enumerate gui resources
Find taskbar
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ebx, ebx
cmp dword [ebp + 8], ebx
push edi
je 0x401e9d
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
push ebx
push str.32768
call edi
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x401ba2
mov dword [0x405b78], 4
jmp 0x40209b
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp dword [0x405ad8], ebx
mov dword [ebp + 0x14], eax
jl 0x401bf7
push 4
call esi
test ax, ax
je 0x401bf7
push 4
call esi
test ax, ax
jge 0x401bcf
push 9
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401bbc
mov eax, dword [0x405b00]
cmp eax, ebx
je 0x401bef
push 1
push ebx
push dword [0x405b04]
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x40209b
push 0x20
pop edi
jmp 0x401cad
mov eax, dword [ebp + 0x14]
cmp dword [0x405240], eax
jne 0x401dc1
dec dword [0x405b78]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0x11
call esi
movsx eax, ax
cmp eax, ebx
mov dword [ebp + 0x10], eax
jge 0x401c2e
mov dword [0x405b74], 1
mov eax, dword [ebp - 8]
cmp eax, dword [0x405af8]
jl 0x401ccf
mov ecx, dword [ebp - 4]
mov eax, dword [0x405af4]
cmp ecx, eax
jle 0x401ccf
mov edx, dword [0x405afc]
sub edx, eax
cmp ecx, edx
jge 0x401ccf
mov eax, dword [0x405b74]
cmp eax, ebx
jne 0x401c6a
mov dword [0x405b74], ecx
jmp 0x401c76
sub eax, ecx
cmp eax, 2
jg 0x401ce6
cmp eax, 0xfffffffe
jl 0x401ce6
cmp ecx, dword [0x405af0]
jg 0x401c8a
cmp dword [0x405ac0], ebx
jl 0x401ccf
xor edi, edi
jmp 0x401c95
cmp dword [0x405ac4], ebx
jl 0x401ccf
push 1
pop edi
inc dword [edi*4 + 0x405ac0]
cmp dword [edi*4 + 0x405ac0], 3
lea eax, [edi*4 + 0x405ac0]
jl 0x401ce6
push 0x10
call esi
movzx eax, ax
shr eax, 0xf
xor eax, edi
shl eax, 2
or eax, 0x62
push eax
push ebx
push 0x8104
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, 0x80000000
and dword [0x405ac0], eax
and dword [0x405ac4], eax
mov dword [0x405b74], ebx
mov eax, dword [0x405b08]
cmp eax, ebx
mov esi, dword [sym.imp.USER32.dll_IsWindow]
je 0x401d2f
cmp dword [ebp + 0x14], eax
jne 0x401d22
push dword [0x405b0c]
call esi
test eax, eax
jne 0x401d2f
push dword [0x405b08]
call fcn.004022c4
test eax, eax
pop ecx
je 0x401d29
push 8
push ebx
call fcn.00403652
pop ecx
pop ecx
jmp 0x401d2f
push eax
call esi
test eax, eax
jne 0x401d2f
mov dword [0x405b08], ebx
mov eax, dword [0x405b44]
cmp eax, ebx
je 0x40209b
push eax
call esi
test eax, eax
jne 0x401d4e
mov dword [0x405b44], ebx
jmp 0x40209b
push 0xffffffffffffffec
push dword [0x405b44]
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov esi, eax
mov eax, dword [0x405b44]
sar esi, 3
and esi, 1
cmp eax, dword [ebp + 0x14]
je 0x401d9b
cmp dword [ebp + 0x10], ebx
jl 0x40209b
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 4]
lea eax, [ebp - 0x18]
push dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
xor eax, esi
je 0x401da5
jmp 0x40209b
cmp esi, ebx
jne 0x40209b
jmp 0x401daa
mov eax, dword [0x405b44]
push 0x13
push ebx
push ebx
push ebx
push ebx
lea ecx, [esi + esi - 1]
push ecx
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x40209b
push dword [0x405350]
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
call ebx
test eax, eax
jne 0x401de0
push eax
push str.Progman
call edi
mov dword [0x405350], eax
push dword [0x405354]
call ebx
test eax, eax
jne 0x401df9
push eax
push str.Shell_TrayWnd
call edi
mov dword [0x405354], eax
mov edi, dword [ebp + 0x14]
xor ebx, ebx
cmp edi, dword [0x405354]
je 0x40201c
cmp edi, dword [0x405350]
je 0x40201c
push 1
call esi
test ax, ax
jl 0x402004
push 2
call esi
test ax, ax
jl 0x402004
cmp dword [ebp + 8], ebx
je 0x401e3b
mov dword [0x405240], edi
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov ecx, eax
and ecx, 0x68c00000
cmp ecx, 0xc00000
je 0x401e5f
test eax, 0x80000000
je 0x40209b
test eax, 0x10000000
jne 0x401ee1
cmp dword [ebp + 0x10], 0x60
jne 0x401eb9
test eax, 0x80000
je 0x40209b
lea eax, [ebp - 0x18]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x40209b
cmp dword [ebp - 0x10], ebx
jle 0x40209b
cmp dword [ebp - 0xc], ebx
jg 0x401ed9
jmp 0x40209b
mov edi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp + 0x10], ebx
mov dword [0x405b3c], eax
jl 0x402024
jmp 0x401dfe
cmp dword [ebp + 0x10], ebx
jle 0x40209b
cmp dword [ebp + 0x10], 0x59
jge 0x401ed9
push 5
push edi
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x40209b
dec dword [ebp + 0x10]
jmp 0x402083
push ebx
push edi
mov dword [0x405240], edi
call fcn.004021d4
cmp eax, ebx
jge 0x401f3d
cmp dword [0x405ad4], ebx
jl 0x40209b
cmp dword [ebp + 0x10], 0x60
jne 0x401f2d
mov eax, dword [0x405b88]
cmp eax, ebx
jbe 0x402031
lea ecx, [eax*4 + 0x405240]
cmp dword [ecx], edi
je 0x40209b
dec eax
sub ecx, 4
cmp eax, ebx
ja 0x401f18
jmp 0x402031
mov eax, 0xc0
sub eax, dword [ebp + 0x10]
mov dword [ebp + 0x10], eax
jmp 0x402031
cmp eax, 6
jne 0x401fec
cmp dword [0x405860], 0x37323323
jne 0x401fec
mov esi, dword [sym.imp.USER32.dll_FindWindowExA]
push ebx
push str.ToolbarWindow32
push ebx
push edi
call esi
test eax, eax
je 0x401f73
mov dword [ebp + 0x14], 8
jmp 0x401f91
push ebx
push str.DirectUIHWND
push ebx
push 5
push edi
call dword [sym.imp.USER32.dll_GetWindow]
push eax
call esi
test eax, eax
je 0x401fec
mov dword [ebp + 0x14], 0xc
push edi
call fcn.004022c4
test eax, eax
pop ecx
je 0x401fec
cmp dword [0x405acc], ebx
jl 0x401fab
mov eax, 0xa004
jmp 0x401fad
xor eax, eax
push ebx
push 0x179
push 2
push ebx
push eax
push 0x111
push edi
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
test eax, eax
je 0x40209b
cmp dword [0x405ad0], ebx
jl 0x401fec
push ebx
push str.SysTabControl32
push ebx
push edi
call esi
test eax, eax
jne 0x401fec
push dword [ebp + 0x14]
push edi
call fcn.00403652
pop ecx
pop ecx
cmp dword [0x405ac8], ebx
jl 0x40209b
push edi
call fcn.00403208
pop ecx
jmp 0x40209b
cmp dword [ebp + 8], ebx
je 0x402012
mov dword [ebp + 0x10], 4
jmp 0x402083
dec dword [ebp + 0x10]
cmp dword [ebp + 0x10], ebx
jg 0x402083
jmp 0x40209b
mov dword [0x405240], edi
jmp 0x40209b
push dword [ebp + 0x14]
call fcn.004022c4
test eax, eax
pop ecx
je 0x40209b
push ebx
push edi
call fcn.004020a2
test eax, eax
pop ecx
pop ecx
je 0x402070
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x405b3c]
cmp eax, 0x2f0
jbe 0x402066
push 2
push fcn.004021d4
mov dword [0x405b88], ebx
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x40209b
push 0xfffffffffffffffa
push edi
call fcn.004021d4
jmp 0x40209b
cmp word [ebp + 0x10], bx
jbe 0x40209b
movzx eax, word [ebp + 0x10]
dec eax
or eax, 0x80000000
mov dword [ebp + 0x10], eax
push 0x3d
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push dword [ebp + 0x10]
push 0x8500
push ebx
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebx
leave
ret 0x10