Function at 0x4060d6
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
call fcn.00404980
mov edi, eax
call fcn.00404960
mov dword [ebp - 4], eax
push esi
call fcn.0040ebf0
add esp, 4
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x688], 0
je 0x4061a3
cmp esi, 7
jne 0x40614b
cmp dword [edi + 0x20f8], 0
je 0x406124
mov edx, dword [ebp - 4]
cmp dword [edx + 0x680], 6
je 0x40614b
push esi
mov edi, dword [ebp + 8]
push edi
call fcn.0045e2ea
add esp, 8
push 0
push 0x708
push 0x111
push edi
call dword [sym.imp.USER32.DLL_SendMessageA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0xb
jne case.0x4062e0.0
cmp dword [edi + reloc.USER32.DLL_CreateWindowExA], 0
je 0x40617c
push 1
push 0xa28
push 0x111
push dword [edi + reloc.USER32.DLL_CreateWindowExA]
call dword [sym.imp.USER32.DLL_SendMessageA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov edi, dword [ebp + 8]
push edi
call fcn.0045e2ea
add esp, 8
push 0
push 0x8fc
push 0x111
push edi
call dword [sym.imp.USER32.DLL_SendMessageA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 7
jne 0x4061b5
cmp dword [edi + 0x2508], 0
je case.0x4062e0.0
mov edx, 6
cmp esi, edx
jne 0x4061ce
cmp dword [ecx + 0x684], 0x838
je case.0x4062e0.0
cmp dword [ecx + 0x690], 0x89d
jne 0x4061e2
cmp esi, edx
je case.0x4062e0.0
cmp esi, 0xc
ja case.0x4061e7.0
jmp dword [esi*4 + 0x46acc4]
mov ebx, 0x578
mov eax, 1
jmp 0x406240
mov ebx, 0x5dc
mov eax, 1
jmp 0x406240
mov ebx, 0x640
mov eax, 1
jmp 0x406240
mov ebx, 0x6a4
mov eax, 1
jmp 0x406240
mov ebx, 0x708
xor eax, eax
jmp 0x406240
mov ebx, 0x8fc
xor eax, eax
jmp 0x406240
mov ebx, 0x960
mov eax, 1
jmp 0x406240
xor ebx, ebx
xor eax, eax
test ebx, ebx
jle 0x4062a3
push esi
mov dword [ebp - 8], eax
push dword [ebp + 8]
call fcn.0045e2ea
add esp, 8
cmp dword [ebp - 8], 0
je 0x406265
push esi
push dword [ebp + 8]
call fcn.0045e304
add esp, 8
cmp ebx, 0x8fc
jne 0x406290
cmp dword [edi + reloc.USER32.DLL_CreateWindowExA], 0
je 0x406290
push 1
push 0xa28
push 0x111
push dword [edi + reloc.USER32.DLL_CreateWindowExA]
call dword [sym.imp.USER32.DLL_SendMessageA]
jmp 0x4062c8
push 0
push ebx
push 0x111
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_SendMessageA]
jmp 0x4062c8
push 1
call dword [sym.imp.USER32.DLL_GetAsyncKeyState]
mov ebx, eax
mov ecx, dword [ebp - 4]
and ebx, 1
mov edx, dword [ecx + 0x38c]
cmp edx, dword [edi + 0x32f0]
jne 0x4062d7
test ebx, ebx
je 0x4062d7
xor eax, eax
mov dword [edi + 0x32f0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0xd
ja case.0x4062e0.0
jmp dword [esi*4 + 0x46acf8]
mov ebx, 0x834
jmp 0x406301
mov ebx, 0x898
jmp 0x406301
mov ebx, 0x514
jmp 0x406301
mov ebx, 0x9c4
push esi
push dword [ebp + 8]
call fcn.0045e2ea
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x38c]
mov dword [edi + 0x32f0], edx
mov edx, ebx
and edx, 0xffff
push edx
push dword [ecx + 0x58]
call dword [sym.imp.USER32.DLL_LoadMenuA]
mov dword [ebp - 0xc], eax
add esp, 8
cmp ebx, 0x514
jne 0x406346
push dword [ebp - 0xc]
call fcn.00408780
add esp, 4
jmp 0x406391
cmp ebx, 0x834
jne 0x406364
mov ecx, dword [ebp - 4]
push dword [ecx + 0x684]
push dword [ebp - 0xc]
call fcn.004087a4
add esp, 8
jmp 0x406391
cmp ebx, 0x898
jne 0x406391
push dword [ebp - 4]
push edi
push eax
call fcn.004087e0
push dword [ebp - 4]
push edi
push dword [ebp - 0xc]
call fcn.00408830
push dword [ebp - 4]
push edi
push dword [ebp - 0xc]
call fcn.00408870
add esp, 0x24
push 0
push dword [ebp - 0xc]
call dword [sym.imp.USER32.DLL_GetSubMenu]
mov ebx, dword [edi + 0x3518]
add ebx, 0xfffffffd
push esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0
push dword [ebp + 8]
call fcn.0045e3aa
add ebx, eax
add esp, 8
lea edx, [ebx + 0x96]
mov ecx, dword [edi + 0x3520]
cmp edx, ecx
jle 0x4063d7
mov dword [ebp - 0x14], 8
lea ebx, [ecx - 3]
mov dword [ebp - 0x10], ebx
mov edx, dword [edi + 0x351c]
add edx, 0x2c
mov dword [ebp - 0x1c], edx
or dword [ebp - 0x14], 0x100
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ebx, eax
push 0
push dword [ebp + 8]
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x20]
call dword [sym.imp.USER32.DLL_TrackPopupMenuEx]
test eax, eax
mov dword [ebp - 0x18], eax
je 0x406426
push 0
push dword [ebp - 0x18]
push 0x111
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_SendMessageA]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, ebx
mov ebx, eax
call dword [sym.imp.USER32.DLL_GetDoubleClickTime]
sub ebx, eax
test ebx, ebx
js 0x406442
cmp dword [ebp - 0x18], 0
je 0x40644a
xor ecx, ecx
mov dword [edi + 0x32f0], ecx
push dword [ebp - 0xc]
mov edi, dword [ebp + 8]
call dword [sym.imp.USER32.DLL_DestroyMenu]
push esi
push edi
call fcn.0045e2b9
add esp, 8
cmp dword [ebp - 0x18], 0
je case.0x4062e0.0
cmp esi, 0xa
jne case.0x4062e0.0
push esi
call fcn.0040ebf0
add esp, 4
pop edi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret