Function at 0x40ecc0
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
sub esp, 0x240
mov eax, dword [0x453140]
xor eax, esp
mov dword [esp + 0x23c], eax
cmp dword [esp + 0x244], 0
push ebx
push ebp
push esi
push edi
mov esi, ecx
jne 0x40eceb
mov al, 1
jmp 0x40f62e
mov byte [esp + 0x14], 0
call fcn.00405b40
mov al, byte [esi + 0x17a]
test al, al
jne 0x40ed07
cmp byte [esi + 0x181], al
je 0x40ed1c
mov ecx, dword [esi + 0xdc]
test ecx, ecx
je 0x40ed1c
test al, al
jne 0x40ed38
mov cl, byte [ecx + 0x6d]
mov byte [esp + 0x14], cl
test al, al
jne 0x40ed38
cmp byte [esi + 0x181], al
je 0x40edd3
cmp byte [esi + 0x182], al
je 0x40edd3
mov eax, dword [esi + 0x17c]
test eax, eax
je 0x40edba
cmp byte [eax + 0x6c], 0
je 0x40ed4e
cmp byte [eax + 0x6e], 0
je 0x40edba
push eax
mov ecx, esi
call fcn.004050d0
cmp eax, 0xffffffff
je 0x40ed84
xor edx, edx
cmp byte [esi + 0x180], dl
mov ecx, esi
setne dl
lea edx, [edx + edx - 1]
add eax, edx
push eax
call fcn.00405190
test eax, eax
je 0x40ed84
cmp byte [eax + 0x6c], 0
je 0x40ed84
cmp byte [eax + 0x6e], 0
je 0x40edba
mov ecx, esi
call fcn.004059c0
push 0
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x447624
call fcn.00401da0
mov eax, dword [esp + 0x38]
push eax
push 1
push esi
call fcn.004246c0
add esp, 0x28
push eax
mov ecx, esi
call fcn.0040e370
cmp byte [esi + 0x178], 0
jne 0x40edca
mov ecx, esi
call fcn.004059c0
push 0
mov ecx, esi
call fcn.00404400
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
cmp byte [esi + 0x181], 0
mov ebx, dword [esi + 0x4c]
mov ebp, dword [esi + 0x50]
mov edx, dword [esi + 0x54]
mov eax, dword [esi + 0x58]
mov byte [esp + 0x13], 0
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], eax
je 0x40f086
mov cl, byte [esi + 0x182]
test cl, cl
je 0x40ee93
mov eax, dword [esi + 0xdc]
test eax, eax
je 0x40ee8b
cmp dword [esi + 0x18c], 0
jne 0x40ee8b
mov ecx, dword [esp + 0x1c]
sub ecx, dword [esi + 0x188]
mov edx, dword [esp + 0x18]
sub edx, dword [esi + 0x184]
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
sub esp, 8
mov dword [esp + 0x1c], edx
add eax, 0x1a0
fstp dword [esp + 4]
fild dword [esp + 0x1c]
fstp dword [esp]
push eax
call fcn.00402ff0
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
add esp, 0xc
mov dword [esi + 0x188], ecx
mov ecx, dword [esi + 0xdc]
push 0
mov dword [esi + 0x184], eax
call fcn.004213f0
jmp 0x40f086
test cl, cl
jne 0x40f086
mov eax, dword [esi + 0x184]
mov ecx, dword [esp + 0x18]
lea edx, [eax + 6]
cmp ecx, edx
mov edx, dword [esp + 0x1c]
jg 0x40eec7
add eax, 0xfffffffa
cmp ecx, eax
jl 0x40eec7
mov eax, dword [esi + 0x188]
lea ecx, [eax + 6]
cmp edx, ecx
jg 0x40eec7
add eax, 0xfffffffa
cmp edx, eax
jge 0x40f086
cmp byte [esi + 0x9e], 0
je 0x40eedd
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x40eee3
cmp byte [esi + 5], 0
je 0x40eeef
mov byte [esi + 0x181], 0
jmp 0x40f086
mov ecx, dword [esi + 0xdc]
mov byte [esi + 0x182], 1
call fcn.00421000
mov edx, dword [esi + 0x170]
mov eax, dword [esi + 0x174]
mov edi, dword [esi + 0xdc]
mov dword [esi + 0x184], edx
fild dword [esi + 0x184]
mov dword [esi + 0x188], eax
fld dword [edi + 0x1a0]
fcompp
fnstsw ax
test ah, 0x41
jne 0x40ef45
fld dword [edi + 0x1a0]
call fcn.00432350
mov dword [esi + 0x184], eax
fild dword [esi + 0x188]
fld dword [edi + 0x1a4]
fcompp
fnstsw ax
test ah, 0x41
jne 0x40ef6b
fld dword [edi + 0x1a4]
call fcn.00432350
mov dword [esi + 0x188], eax
fild dword [esi + 0x184]
fld dword [edi + 0x1a8]
fcompp
fnstsw ax
test ah, 5
jp 0x40ef91
fld dword [edi + 0x1a8]
call fcn.00432350
mov dword [esi + 0x184], eax
fild dword [esi + 0x188]
fld dword [edi + 0x1ac]
fcompp
fnstsw ax
test ah, 5
jp 0x40efb7
fld dword [edi + 0x1ac]
call fcn.00432350
mov dword [esi + 0x188], eax
push edi
mov ecx, esi
call fcn.004050d0
mov ecx, dword [esi + 0xdc]
push 0
push 0
sub esp, 0x1c
mov dword [ecx + 0x4c], eax
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x447624
call fcn.00401da0
mov edx, dword [esp + 0x38]
push edx
push 1
push esi
call fcn.004246c0
add esp, 0x28
push eax
mov ecx, esi
call fcn.0040e370
mov eax, dword [esi + 0xdc]
push eax
mov ecx, esi
call fcn.0040e7d0
mov ecx, dword [esi + 0xdc]
mov edx, dword [ecx + 4]
mov edi, dword [sym.imp.USER32.dll_SetWindowPos]
push 0x603
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edx
call edi
mov eax, dword [esi + 0xcc]
push 0x603
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
call edi
push 0
mov ecx, esi
call fcn.00405050
cmp eax, 1
jge 0x40f081
cmp dword [esi + 0x17c], 0
je 0x40f081
push 0
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x447624
call fcn.00401da0
push 1
push 0
push esi
call fcn.004246c0
add esp, 0x28
push eax
mov ecx, esi
call fcn.0040e370
mov byte [esp + 0x13], 1
cmp byte [esi + 0x9f], 0
mov cl, byte [esi + 0x178]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov byte [esi + 0x179], cl
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
jne 0x40f0c5
cmp byte [esi + 0xa1], 0
jne 0x40f0c5
cmp dword [esi + 0x98], 0
jg case.default.0x40f0d0
mov eax, dword [esi + 0x90]
cmp eax, 3
ja case.default.0x40f0d0
jmp dword [eax*4 + 0x40f64c]
mov ecx, dword [esi + 0x5c]
mov dword [esp + 0x34], ecx
jmp case.default.0x40f0d0
mov edx, dword [esi + 0x60]
mov dword [esp + 0x38], edx
jmp case.default.0x40f0d0
mov eax, dword [esi + 0x64]
mov dword [esp + 0x3c], eax
jmp case.default.0x40f0d0
mov ecx, dword [esi + 0x68]
mov dword [esp + 0x40], ecx
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ebx, dword [sym.imp.USER32.dll_PtInRect]
push edx
push eax
lea ecx, [esp + 0x3c]
push ecx
call ebx
mov ebp, dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
setne al
xor edi, edi
test al, al
mov byte [esi + 0x178], al
je 0x40f163
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push edx
push eax
call dword [sym.imp.USER32.dll_WindowFromPoint]
push 3
push eax
call dword [sym.imp.USER32.dll_GetAncestor]
cmp dword [esi + 0xb0], 2
mov edi, eax
jne 0x40f163
cmp edi, dword [esi + 0xc8]
je 0x40f163
push 2
push edi
call ebp
test eax, eax
je 0x40f163
mov byte [esi + 0x178], 0
cmp byte [esi + 0x178], 0
je 0x40f208
push 0x206
lea ecx, [esp + 0x4a]
push 0
push ecx
mov word [esp + 0x50], 0
call fcn.00431940
add esp, 0xc
push 0x104
lea edx, [esp + 0x48]
push edx
push edi
call dword [sym.imp.USER32.dll_GetClassNameW]
mov ecx, str.32768
lea eax, [esp + 0x44]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40f1cb
test dx, dx
je 0x40f1c7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40f1cb
add eax, 4
add ecx, 4
test dx, dx
jne 0x40f1a5
xor eax, eax
jmp 0x40f1d0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40f1da
mov byte [esi + 0x178], al
cmp byte [esi + 0x178], 0
je 0x40f208
mov eax, dword [esi + 0xc8]
push 3
push eax
call ebp
test eax, eax
je 0x40f208
cmp eax, edi
je 0x40f201
push 3
push eax
call ebp
test eax, eax
jne 0x40f1f2
jmp 0x40f208
mov byte [esi + 0x178], 0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push eax
push ecx
lea edi, [esi + 0x5c]
push edi
call ebx
test eax, eax
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
je 0x40f293
mov eax, dword [esi + 0x90]
cmp eax, 2
jne 0x40f238
mov edi, dword [edi]
add edi, 4
cmp edx, edi
jle 0x40f264
test eax, eax
jne 0x40f246
mov edi, dword [esi + 0x60]
add edi, 4
cmp ecx, edi
jle 0x40f264
cmp eax, 3
jne 0x40f255
mov edi, dword [esi + 0x64]
sub edi, 4
cmp edx, edi
jge 0x40f264
cmp eax, 1
jne 0x40f293
mov edi, dword [esi + 0x68]
sub edi, 4
cmp ecx, edi
jl 0x40f293
test eax, eax
je 0x40f26d
cmp eax, 1
jne 0x40f279
cmp edx, dword [esp + 0x24]
jl 0x40f279
cmp edx, dword [esp + 0x2c]
jle 0x40f28f
cmp eax, 2
je 0x40f283
cmp eax, 3
jne 0x40f293
cmp ecx, dword [esp + 0x28]
jl 0x40f293
cmp ecx, dword [esp + 0x30]
jg 0x40f293
mov al, 1
jmp 0x40f295
xor al, al
cmp byte [esi + 0x9f], 0
je 0x40f2a9
test al, al
je 0x40f2a9
mov byte [esi + 0x178], 1
cmp byte [esi + 0xa1], 0
je 0x40f2bd
test al, al
je 0x40f2bd
mov byte [esi + 0x178], 1
cmp byte [esi + 0x178], 0
je 0x40f2e7
cmp edx, dword [esi + 0x170]
jne 0x40f2d6
cmp ecx, dword [esi + 0x174]
je 0x40f2e7
mov dword [esi + 0x170], edx
mov dword [esi + 0x174], ecx
mov byte [esp + 0x13], 1
cmp byte [esi + 0x1d5], 0
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [sym.imp.USER32.dll_KillTimer]
je 0x40f497
mov edx, dword [esi + 0x160]
mov byte [esp + 0x13], 1
mov dword [esi + 0x168], edx
call ebp
cmp byte [esi + 0x9f], 0
mov edi, eax
mov dword [esi + 0x160], edi
mov dword [esi + 0xbc], 0
je 0x40f429
mov eax, dword [esi + 0x90]
test eax, eax
je 0x40f355
cmp eax, 1
je 0x40f355
fild dword [esi + 0x29c]
fadd dword [esi + 0x138]
fiadd dword [esi + 0x2a4]
jmp 0x40f367
fild dword [esi + 0x2a0]
fadd dword [esi + 0x138]
fiadd dword [esi + 0x2a8]
call fcn.00432350
mov dword [esi + 0xbc], eax
mov eax, dword [esi + 0x98]
add dword [esi + 0xbc], eax
mov ecx, dword [esi + 0xbc]
mov dword [esp + 0x14], ecx
mov ecx, dword [esi + 0x158]
test ecx, ecx
ja 0x40f397
mov ecx, 1
mov eax, dword [esi + 0x168]
mov edx, edi
sub edx, eax
test edx, edx
mov dword [esp + 0x20], edx
fild dword [esp + 0x20]
jge 0x40f3b3
fadd dword [0x4476f8]
test ecx, ecx
mov dword [esp + 0x20], ecx
fild dword [esp + 0x20]
jge 0x40f3c5
fadd dword [0x4476f8]
fdivp st(1)
mov edx, dword [esi + 0x164]
mov ecx, dword [esi + 0x15c]
sub edi, eax
lea eax, [edi + edx]
cmp eax, ecx
mov dword [esi + 0x164], eax
fimul dword [esp + 0x14]
fstp dword [esp + 0x14]
jb 0x40f431
cmp edx, ecx
jb 0x40f3f2
test ecx, ecx
jne 0x40f3f9
mov ecx, esi
call fcn.00402580
cmp byte [esi + 0x178], 0
je 0x40f40e
fld dword [esi + 0xb8]
fsub dword [esp + 0x14]
jmp 0x40f42b
mov eax, dword [esi + 0xcc]
push eax
call fcn.00427560
fld dword [esi + 0xb8]
fadd dword [esp + 0x18]
add esp, 4
jmp 0x40f42b
fldz
fstp dword [esi + 0xb8]
fldz
fcom dword [esi + 0xb8]
fnstsw ax
test ah, 0x41
jne 0x40f45a
mov ecx, dword [esi + 0xc8]
fstp dword [esi + 0xb8]
push 1
push ecx
mov byte [esi + 0x1d5], 0
call ebx
jmp 0x40f45c
fstp st(0)
fild dword [esi + 0xbc]
fstp dword [esp + 0x14]
fld dword [esi + 0xb8]
fld dword [esp + 0x14]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 5
jp 0x40f495
mov edx, dword [esi + 0xc8]
fstp dword [esi + 0xb8]
push 1
push edx
mov byte [esi + 0x1d5], 0
call ebx
jmp 0x40f497
fstp st(0)
cmp byte [esi + 0x1d4], 0
je 0x40f58e
mov eax, dword [esi + 0x150]
mov byte [esp + 0x13], 1
mov dword [esi + 0x154], eax
call ebp
mov dword [esi + 0x150], eax
sub eax, dword [esi + 0x154]
test eax, eax
mov dword [esp + 0x20], eax
fild dword [esp + 0x20]
jge 0x40f4d5
fadd dword [0x4476f8]
mov ecx, dword [esi + 0x148]
fild dword [esi + 0x148]
test ecx, ecx
jge 0x40f4eb
fadd dword [0x4476f8]
cmp byte [esi + 0x178], 0
fdivp st(1)
fld dword [esi + 0x13c]
fsub dword [esi + 0x138]
fmulp st(1)
fstp dword [esp + 0x14]
je 0x40f549
cmp dword [esi + 0x144], 0
je 0x40f549
fld dword [esp + 0x14]
fadd dword [esi + 0x140]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fst dword [esi + 0x140]
fld dword [esi + 0x13c]
fcompp
fnstsw ax
test ah, 0x41
jp 0x40f58e
mov edx, dword [esi + 0xc8]
fld dword [esi + 0x13c]
push 0
push edx
jmp 0x40f57f
fld dword [esi + 0x140]
fsub dword [esp + 0x14]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fst dword [esi + 0x140]
fld dword [esi + 0x138]
fcompp
fnstsw ax
test ah, 1
jne 0x40f58e
mov eax, dword [esi + 0xc8]
fld dword [esi + 0x138]
push 0
push eax
fstp dword [esi + 0x140]
mov byte [esi + 0x1d4], 0
call ebx
cmp byte [esi + 0x1d7], 0
mov bl, 1
jne 0x40f59d
mov bl, byte [esp + 0x13]
movzx eax, byte [esi + 0x178]
cmp al, byte [esi + 0x179]
je 0x40f629
mov ecx, dword [esi + 0xc8]
push eax
push ecx
call fcn.00427580
add esp, 8
cmp byte [esi + 0x178], 0
jne 0x40f5cc
mov ecx, esi
call fcn.004059c0
cmp dword [esi + 0x2d8], 0
jne 0x40f602
cmp byte [esi + 0x9f], 0
je 0x40f602
fldz
fcomp dword [esi + 0xb8]
fnstsw ax
test ah, 0x44
jnp 0x40f602
fld dword [esi + 0xb8]
fild dword [esi + 0xbc]
fcompp
fnstsw ax
test ah, 0x41
jne 0x40f609
mov ecx, esi
call fcn.00402580
cmp byte [esi + 0x9f], 0
je 0x40f619
mov ecx, esi
call fcn.004025d0
cmp byte [esi + 0xa1], 0
je 0x40f629
mov ecx, esi
call fcn.00405ae0
test bl, bl
setne al
mov ecx, dword [esp + 0x24c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004320c7
add esp, 0x240
ret 4