Function at 0x4099fd
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x485008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x831733], 1
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x5c], esi
jne 0x409ebd
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x4c], ebx
call ebx
sub eax, dword [0x801ee0]
cmp eax, 0x2ee0
jb 0x409ebd
cmp byte [0x835420], 0
jne 0x409d58
cmp dword [esi], 0
jne 0x409a54
call ebx
mov dword [esi], eax
movzx eax, byte [0x83172f]
lea edi, [esi + 4]
imul eax, eax, 0x88
movzx edx, word [eax + 0x7e6c3e]
movzx eax, byte [0x831735]
test dx, dx
je 0x409a9e
cmp byte [0x831735], 1
mov ecx, 0x47027c
mov ebx, 0x46e0cf
cmovbe ecx, ebx
push ecx
push eax
push edx
push str._d__d_lap_s
push edi
call fcn.00409288
add esp, 0x14
jmp 0x409ac2
cmp byte [0x831735], 1
mov edx, 0x46e0da
mov ecx, 0x47028c
cmovbe ecx, edx
push ecx
push eax
push str._d_lap_s
push edi
call fcn.00409288
add esp, 0x10
xor ebx, ebx
mov dword [esi + 0x50], 2
mov dword [ebp - 0x54], ebx
mov eax, 0x7e6c08
mov ecx, ebx
mov edx, 0x88
cmp byte [eax], bl
je 0x409ae9
cmp byte [eax + 0x69], bl
je 0x409ae9
cmp byte [eax + 0x35], 1
je 0x409af7
add ecx, edx
add eax, edx
cmp ecx, 0x8800
jb 0x409ada
jmp 0x409afa
mov dword [ebp - 0x54], eax
lea eax, [esi + 0x59]
mov dword [ebp - 0x58], ebx
mov ecx, ebx
mov dword [ebp - 0x50], 0x100
or edx, 0xffffffff
mov dword [ebp - 0x60], ecx
mov esi, eax
mov dword [ebp - 0x48], edx
mov edi, 0x7e6c3d
mov eax, ebx
cmp byte [edi - 0x35], bl
je 0x409c8a
cmp byte [edi + 0x34], bl
je 0x409c8a
cmp byte [edi], bl
je 0x409c8a
mov byte [esi - 1], 1
mov cl, byte [edi]
cmp byte [esi], cl
je 0x409b5d
call dword [ebp - 0x4c]
mov edx, dword [ebp - 0x48]
mov dword [esi + 0xb], eax
movzx eax, byte [esi]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [esi + 3], xmm0
mov al, byte [edi]
mov byte [esi], al
mov cl, byte [edi]
movzx eax, byte [0x83172f]
cmp dword [ebp - 0x58], eax
mov eax, dword [edi + 0x37]
mov dword [esi + 7], eax
movzx eax, byte [edi + 0xb]
movzx ecx, cl
cmovne ecx, edx
imul eax, eax, 0xe4
mov dword [ebp - 0x48], ecx
mov eax, dword [eax + 0x492118]
test eax, eax
je 0x409b95
add eax, 0x20
push eax
call fcn.00404bcc
jmp 0x409b98
or eax, 0xffffffff
mov dword [esi + 0x5b], eax
movzx eax, byte [edi]
push eax
lea eax, [esi + 0xf]
push 0x47029c
push eax
call fcn.00409288
lea eax, [edi - 5]
push eax
lea eax, [esi + 0x137]
push 0x4702a0
push eax
call fcn.00409288
add esp, 0x18
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x409be1
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x409be1
push 0x41
jmp 0x409be3
push 0x18
pop eax
add eax, 0xffffffcb
add eax, edi
push eax
lea eax, [esi + 0x5f]
push 0x4702a4
push eax
call fcn.004092ef
mov ecx, dword [ebp - 0x54]
add esp, 0xc
mov byte [esi + 0x183], bl
test ecx, ecx
je 0x409c68
mov ax, word [edi + 3]
cmp ax, word [ecx + 0x38]
jne 0x409c68
mov al, byte [edi - 0x34]
cmp al, byte [ecx + 1]
jne 0x409c68
cmp dword [ecx + 4], ebx
je 0x409c68
cmp dword [edi - 0x31], ebx
je 0x409c61
cmp byte [edi], 1
je 0x409c61
call dword [ebp - 0x4c]
sub eax, dword [edi - 0x21]
cmp eax, 0x1388
ja 0x409c61
mov eax, dword [ebp - 0x54]
lea edx, [ebp - 0x44]
mov ecx, dword [edi - 0x31]
push ebx
push 0x40
sub ecx, dword [eax + 4]
call fcn.00402ebf
push eax
lea eax, [esi + 0xeb]
push 0x4702a8
push eax
call fcn.00409288
add esp, 0x14
jmp 0x409c7b
push 0x46e0db
jmp 0x409c6d
push 0x46e0ed
lea eax, [esi + 0xeb]
push eax
call fcn.00409288
pop ecx
pop ecx
mov ecx, dword [ebp - 0x60]
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x60], ecx
jmp 0x409c8d
mov byte [esi - 1], bl
inc eax
add edi, 0x88
add esi, 0x188
mov dword [ebp - 0x58], eax
sub dword [ebp - 0x50], 1
jne 0x409b1b
mov esi, dword [ebp - 0x5c]
mov byte [esi + 0x54], cl
cmp dword [esi + 0x18858], edx
je 0x409d47
movzx eax, byte [0x83172f]
mov edi, 0x3e8
cmp dword [0x83f7dc], eax
mov edx, 0xfa
mov ebx, dword [ebp - 0x4c]
mov ecx, edi
cmovne ecx, edx
mov dword [esi + 0x18864], ecx
call ebx
sub eax, dword [esi + 0x18860]
xor edx, edx
imul eax, eax, 0x3e8
mov ecx, dword [esi + 0x18858]
div dword [esi + 0x18864]
cmp eax, edi
jle 0x409d07
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
jmp 0x409d2e
sub edi, eax
imul ecx, eax
movd xmm1, edi
cvtdq2ps xmm1, xmm1
movd xmm0, ecx
mulss xmm1, dword [esi + 0x1885c]
cvtdq2ps xmm0, xmm0
addss xmm1, xmm0
divss xmm1, dword [0x47d2f8]
mov ecx, dword [ebp - 0x48]
movss dword [esi + 0x1885c], xmm1
mov dword [esi + 0x18858], ecx
call ebx
mov dword [esi + 0x18860], eax
movzx eax, byte [0x83172f]
mov dword [0x83f7dc], eax
jmp 0x409ec0
cmp dword [esi], 0
jne 0x409d61
call ebx
mov dword [esi], eax
lea eax, [esi + 4]
push str.Results
push eax
call fcn.00409288
xor ebx, ebx
mov dword [esi + 0x50], 1
pop ecx
mov edx, ebx
mov dword [esi + 0x18858], ebx
mov eax, ebx
mov dword [ebp - 0x50], edx
pop ecx
mov dword [ebp - 0x4c], eax
imul ecx, eax, 0x34
imul edi, eax, 0x188
mov dword [ebp - 0x48], ecx
add edi, esi
cmp byte [ecx + 0x835420], bl
je 0x409ea6
lea edx, [eax + 1]
mov byte [edi + 0x58], 2
movd xmm0, edx
inc al
cvtdq2ps xmm0, xmm0
mov byte [edi + 0x59], al
mov dword [ebp - 0x5c], edx
movss dword [edi + 0x5c], xmm0
mov eax, dword [ecx + 0x835440]
mov dword [edi + 0x60], eax
mov eax, dword [ecx + 0x83544c]
test eax, eax
je 0x409de0
add eax, 0x20
push eax
call fcn.00404bcc
mov edx, dword [ebp - 0x5c]
jmp 0x409de3
or eax, 0xffffffff
push edx
mov dword [edi + 0xb4], eax
lea eax, [edi + 0x68]
push 0x4702b4
push eax
call fcn.00409288
mov eax, dword [ebp - 0x48]
lea eax, [eax + 0x835439]
push eax
lea eax, [edi + 0x190]
push 0x4702b8
push eax
call fcn.00409288
add esp, 0x18
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x409e39
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x409e39
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 0x83544c]
jmp 0x409e42
mov eax, dword [ebp - 0x48]
lea eax, [eax + 0x835421]
push eax
lea eax, [edi + 0xb8]
push 0x4702bc
push eax
call fcn.004092ef
add esp, 0xc
add edi, 0x144
cmp dword [ebp - 0x4c], ebx
jne 0x409e71
push 0x46e0ee
push edi
call fcn.00409288
pop ecx
pop ecx
jmp 0x409e9a
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x44]
push ebx
push 0x40
mov ecx, dword [eax + 0x835450]
sub ecx, dword [0x835450]
call fcn.00402ebf
push eax
push 0x4702c0
push edi
call fcn.00409288
add esp, 0x14
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x4c]
inc edx
mov dword [ebp - 0x50], edx
jmp 0x409ea9
mov byte [edi + 0x58], bl
inc eax
mov dword [ebp - 0x4c], eax
cmp eax, 0x100
jb 0x409d8a
mov byte [esi + 0x54], dl
jmp 0x409ec0
and dword [esi], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00445b7e
leave
ret