Function at 0x4101d7
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x45be62
call fcn.0043baec
sub esp, 0x54c
push edi
mov edi, ecx
mov dword [ebp - 0x14], edi
call fcn.00429e60
test eax, eax
je 0x410210
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
call fcn.00429d80
push eax
call fcn.00431e56
pop ecx
pop ecx
jmp 0x4106ae
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x20], vtable.CMenu.0
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], ebx
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call esi
movsx eax, ax
test eax, 0x8000000
je 0x41025b
push 0x10
call esi
movsx eax, ax
test eax, 0x8000000
je 0x41025b
mov dword [ebp - 0x18], 1
push 0x85
jmp 0x410263
mov dword [ebp - 0x18], ebx
push 0x83
lea ecx, [ebp - 0x20]
call fcn.00411996
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call fcn.004515a6
mov esi, eax
cmp esi, ebx
je 0x41067d
cmp dword [ebp - 0x18], ebx
jne 0x4103cf
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
push str.DebugMenu
push str.softwareGator.comGatordynSettings
push reloc.WSOCK32.dll_bind
call fcn.0042a020
add esp, 0x10
cmp dword [ebp - 0x18], ebx
jne 0x4102ca
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetMenuItemCount]
dec eax
push 0x400
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_RemoveMenu]
lea ecx, [edi + 0x64]
mov byte [ebp - 0xd], bl
cmp ecx, ebx
je 0x4102f2
cmp dword [ecx + 0x1c], ebx
je 0x4102f2
call fcn.0044fb57
test eax, eax
jne 0x4102f2
push dword [edi + 0x80]
call dword [sym.imp.USER32.dll_IsWindowVisible]
cmp eax, ebx
jne 0x41031a
lea ecx, [edi + 0x59a0]
cmp ecx, ebx
je 0x41031e
cmp dword [ecx + 0x1c], ebx
je 0x41031e
call fcn.0044fb57
test eax, eax
jne 0x41031e
push dword [edi + 0x59bc]
call dword [sym.imp.USER32.dll_IsWindowVisible]
cmp eax, ebx
je 0x41031e
mov byte [ebp - 0xd], 1
mov ecx, dword [0x484844]
mov edi, dword [sym.imp.USER32.dll_EnableMenuItem]
cmp ecx, ebx
mov dword [ebp - 0x24], ecx
je 0x410346
cmp dword [ecx + 0x28], ebx
je 0x410346
push ebx
push ebx
call fcn.0042e6cd
test eax, eax
jne 0x410346
cmp byte [ebp - 0xd], bl
je 0x410387
push 1
push 0x8015
push dword [esi + 4]
call edi
cmp byte [ebp - 0xd], bl
je 0x410387
push 1
push 0x8014
push dword [esi + 4]
call edi
push 1
push 0x801c
push dword [esi + 4]
call edi
push 1
push 0x801a
push dword [esi + 4]
call edi
push 1
push 0x801b
push dword [esi + 4]
call edi
mov eax, dword [0x484818]
cmp eax, ebx
jne 0x410401
push 1
push 0x801b
push dword [esi + 4]
call edi
mov edi, dword [sym.imp.USER32.dll_DeleteMenu]
push ebx
push 0x8014
push dword [esi + 4]
call edi
push ebx
push 0x8015
push dword [esi + 4]
call edi
cmp byte [ebp - 0xd], bl
jne 0x4103cc
push ebx
push 0x801c
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetMenuDefaultItem]
mov edi, dword [ebp - 0x14]
push dword [edi + 0x1c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 1
push ebx
push ebx
lea eax, [ebp - 0x48]
push ebx
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x410434
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x4103d8
cmp eax, 1
jne 0x410418
mov ecx, dword [ebp - 0x24]
cmp ecx, ebx
je 0x410418
push ebx
push ebx
call fcn.0042e6cd
test eax, eax
jne 0x41039c
push ebx
push 0x801c
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DeleteMenu]
cmp byte [ebp - 0xd], bl
jne 0x4103cc
push ebx
push 0x8014
jmp 0x4103c3
cmp edi, ebx
jne 0x41043c
xor eax, eax
jmp 0x41043f
mov eax, dword [edi + 0x1c]
push ebx
push eax
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push 0x120
push dword [esi + 4]
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
add eax, 0xffff7ffa
cmp eax, 0x18
ja case.0x41046a.32775
movzx eax, byte [eax + 0x4106f3]
jmp dword [eax*4 + 0x4106bb]
mov ecx, 0x4847f8
call fcn.004027e3
jmp case.0x41046a.32775
mov esi, dword [0x484844]
cmp esi, ebx
je case.0x41046a.32775
push 4
push str.Clear_all_site_data_
call fcn.00428230
pop ecx
cmp eax, 6
pop ecx
jne case.0x41046a.32775
mov eax, dword [esi]
push 0x4780e4
mov ecx, esi
call dword [eax + 8]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
jmp case.0x41046a.32775
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
call fcn.0042b120
pop ecx
push ebx
push str.HTTP_History
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [ebp - 0x14], ebx
je case.0x41046a.32775
push dword [ebp - 0x14]
call fcn.00450113
pop ecx
jmp case.0x41046a.32775
push ebx
lea ecx, [ebp - 0x430]
call fcn.00401000
lea esi, [edi + 0x62cc]
lea eax, [ebp - 0x430]
lea ecx, [ebp - 0x430]
mov byte [ebp - 4], 1
mov dword [esi], eax
call fcn.0044c718
lea ecx, [ebp - 0x430]
mov dword [esi], ebx
mov byte [ebp - 4], bl
call fcn.0040115f
jmp case.0x41046a.32775
push 1
mov ecx, edi
call fcn.0040ff5c
jmp case.0x41046a.32775
push 1
mov ecx, edi
call fcn.0040fef1
mov eax, dword [0x484848]
push ebx
push edi
push 0x4c
push 3
push eax
push 0x484808
lea ecx, [ebp - 0x558]
call fcn.004157fd
lea esi, [edi + 0x62d0]
lea eax, [ebp - 0x558]
lea ecx, [ebp - 0x558]
mov byte [ebp - 4], 2
mov dword [esi], eax
call fcn.00415937
cmp eax, 1
mov dword [esi], ebx
jne 0x4105b4
mov ecx, edi
call fcn.0041169c
push ebx
mov ecx, edi
call fcn.0040ff5c
push dword [edi + 0x62bc]
lea esi, [edi + 0x62bc]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4105b4
push dword [esi]
mov ecx, edi
call fcn.004116a8
lea ecx, [ebp - 0x558]
mov byte [ebp - 4], bl
call fcn.0040fe0a
jmp case.0x41046a.32775
mov esi, dword [0x484844]
cmp esi, ebx
je case.0x41046a.32775
push ebx
push ebx
mov ecx, esi
call fcn.0042e6cd
test eax, eax
jne case.0x41046a.32775
mov ecx, esi
call fcn.0042e6af
test eax, eax
jl 0x410620
lea ecx, [edi + 0x64]
cmp ecx, ebx
je 0x410603
cmp dword [ecx + 0x1c], ebx
je 0x410603
push ebx
call fcn.0044fb30
lea eax, [edi + 0x59a0]
cmp eax, ebx
je 0x410619
cmp dword [eax + 0x1c], ebx
je 0x410619
mov ecx, edi
call fcn.0040ff1b
mov ecx, edi
call fcn.0041169c
push ebx
mov ecx, edi
call fcn.00410f30
jmp case.0x41046a.32775
push ebx
mov ecx, edi
call fcn.0040ff5c
push ebx
push 0xffffffffffffffff
push 4
lea ecx, [edi + 0x64]
call fcn.00414955
jmp case.0x41046a.32775
mov eax, dword [edi + 0x6294]
push ebx
push ebx
push eax
push dword [edi + 0x1c]
call dword [sym.imp.USER32.dll_PostMessageA]
jmp case.0x41046a.32775
push ebx
push ebx
push 0x10
jmp 0x41064a
push ebx
push ebx
mov ecx, edi
call fcn.0041118e
jmp case.0x41046a.32775
mov ecx, edi
call fcn.004113fb
jmp case.0x41046a.32775
push 1
mov ecx, 0x4812f0
call fcn.0040eb73
jmp case.0x41046a.32775
push str.no_create_menu
push 0x50f
push str.D:Source_CodeClient_Codeclientegclientdlg.cpp
push 1
call fcn.00431d70
add esp, 0x10
mov dword [ebp - 0x20], vtable.CMenu.0
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 3
call fcn.00451630
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
leave
ret