Function at 0x4b1220
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x28], edi
mov eax, dword [esi + 4]
push 0x3ec
push eax
call dword [sym.imp.USER32.dll_KillTimer]
cmp dword [esi + 0x110], edi
je 0x4b125e
mov ecx, dword [esi + 0x110]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
test eax, eax
je 0x4b125e
mov dword [esi + 0x110], edi
mov edx, dword [esi + 4]
push 1
xor ebx, ebx
push ebx
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
push 0x10
shr eax, 0xf
and eax, 1
mov dword [ebp - 0x10], eax
call edi
mov ecx, dword [esi + 4]
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov ebx, dword [sym.imp.USER32.dll_GetClientRect]
shr eax, 0xf
and eax, 1
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x54]
push eax
push ecx
call ebx
or eax, 0xffffffff
lea edx, [ebp - 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
push edx
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.004a8010
movzx eax, word [ebp + 8]
add eax, 0xfffffff7
cmp eax, 0x1f
ja case.0x4b12d8.10
movzx ecx, byte [eax + 0x4b1ac0]
jmp dword [ecx*4 + 0x4b1a98]
mov eax, dword [esi + 0x388]
mov ecx, dword [ebp - 0xc]
dec eax
inc ecx
cmp ecx, eax
jge 0x4b12f0
mov eax, ecx
mov edx, dword [ebp - 8]
push edx
push eax
mov ecx, esi
call fcn.004a9b50
cmp dword [ebp - 0x10], 0
jne 0x4b1a8d
mov edi, dword [ebp - 0x14]
mov ecx, dword [esi + 0xb8]
mov edx, dword [esi + 0xb4]
neg edi
sbb edi, edi
and edi, 4
push edi
push ecx
push edx
mov ecx, esi
call fcn.004affe0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 0xc]
dec eax
xor ecx, ecx
test eax, eax
setle cl
dec ecx
and eax, ecx
jmp 0x4b12f0
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x34]
xor edi, edi
push eax
push ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
call ebx
cmp dword [esi + 0x28], edi
je 0x4b1364
mov eax, dword [esi + 0xac]
jmp 0x4b1366
xor eax, eax
mov edx, dword [esi + 0xa8]
mov ecx, dword [ebp - 0x28]
push edx
sub ecx, eax
push ecx
mov dword [ebp - 0x30], eax
call fcn.004ecd91
add esp, 8
cmp eax, 1
mov dword [ebp - 0x28], edx
mov ecx, eax
jg 0x4b138d
mov ecx, 1
mov eax, dword [esi + 0x388]
mov edi, dword [ebp - 0xc]
dec eax
lea edx, [ecx + edi - 1]
cmp edx, eax
jge 0x4b12f0
mov ecx, dword [esi + 4]
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x34]
push eax
push ecx
call ebx
cmp dword [esi + 0x28], 0
je 0x4b13c9
mov eax, dword [esi + 0xac]
jmp 0x4b13cb
xor eax, eax
mov edx, dword [esi + 0xa8]
mov ecx, dword [ebp - 0x28]
push edx
sub ecx, eax
push ecx
mov dword [ebp - 0x30], eax
call fcn.004ecd91
add esp, 8
cmp eax, 1
mov dword [ebp - 0x28], edx
jg 0x4b13f0
mov eax, 1
lea eax, [eax + edi - 1]
jmp 0x4b12f0
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x34]
xor edi, edi
push eax
push ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
call ebx
cmp dword [esi + 0x28], edi
je 0x4b141e
mov eax, dword [esi + 0xac]
jmp 0x4b1420
xor eax, eax
mov edx, dword [esi + 0xa8]
mov ecx, dword [ebp - 0x28]
push edx
sub ecx, eax
push ecx
mov dword [ebp - 0x30], eax
call fcn.004ecd91
add esp, 8
cmp eax, 1
mov dword [ebp - 0x28], edx
jg 0x4b1445
mov eax, 1
mov edi, dword [ebp - 0xc]
mov edx, edi
sub edx, eax
inc edx
test edx, edx
jle 0x4b14ab
mov ecx, dword [esi + 4]
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x34]
push eax
push ecx
call ebx
cmp dword [esi + 0x28], 0
je 0x4b1477
mov eax, dword [esi + 0xac]
jmp 0x4b1479
xor eax, eax
mov edx, dword [esi + 0xa8]
mov ecx, dword [ebp - 0x28]
push edx
sub ecx, eax
push ecx
mov dword [ebp - 0x30], eax
call fcn.004ecd91
add esp, 8
cmp eax, 1
mov dword [ebp - 0x28], edx
jg 0x4b149e
mov eax, 1
mov edx, dword [ebp - 8]
sub edi, eax
inc edi
push edx
push edi
jmp 0x4b12f5
mov edx, dword [ebp - 8]
xor edi, edi
push edx
push edi
jmp 0x4b12f5
mov eax, dword [ebp - 8]
push eax
push 0
jmp 0x4b12f5
mov ecx, dword [ebp - 8]
mov edx, dword [esi + 0x388]
push ecx
dec edx
push edx
jmp 0x4b12f5
cmp dword [esi + 0x50], 0
je 0x4b14f1
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
dec eax
xor ecx, ecx
test eax, eax
setle cl
dec ecx
and eax, ecx
push eax
push edx
jmp 0x4b12f5
mov edi, dword [ebp - 0x10]
mov eax, dword [esi + 4]
mov ebx, dword [sym.imp.USER32.dll_GetScrollPos]
neg edi
sbb edi, edi
push 0
and edi, 0x2d
push eax
add edi, 5
call ebx
sub eax, edi
test eax, eax
jle 0x4b1530
mov ecx, dword [esi + 4]
push 0
push ecx
call ebx
mov edx, dword [esi + 4]
push 1
sub eax, edi
push eax
push 0
push edx
call dword [sym.imp.USER32.dll_SetScrollPos]
jmp 0x4b12fc
mov edx, dword [esi + 4]
push 1
xor eax, eax
push eax
push eax
push edx
call dword [sym.imp.USER32.dll_SetScrollPos]
jmp 0x4b12fc
cmp dword [esi + 0x50], 0
je 0x4b1565
mov eax, dword [esi + 0x358]
mov ecx, dword [ebp - 8]
dec eax
inc ecx
cmp ecx, eax
jge 0x4b155c
mov eax, ecx
push eax
mov eax, dword [ebp - 0xc]
jmp 0x4b12f4
mov ecx, dword [esi + 4]
mov ebx, dword [sym.imp.USER32.dll_GetScrollPos]
push 0
push ecx
call ebx
mov edi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x4c]
neg edi
sbb edi, edi
sub ecx, dword [ebp - 0x54]
and edi, 0x2d
add edi, 5
lea edx, [edi + eax]
cmp edx, ecx
jge 0x4b15ab
mov eax, dword [esi + 4]
push 0
push eax
call ebx
mov ecx, dword [esi + 4]
push 1
add eax, edi
push eax
push 0
push ecx
call dword [sym.imp.USER32.dll_SetScrollPos]
jmp 0x4b12fc
push 1
mov eax, ecx
mov ecx, dword [esi + 4]
push eax
push 0
push ecx
call dword [sym.imp.USER32.dll_SetScrollPos]
jmp 0x4b12fc
cmp dword [ebp - 0x10], 0
jne 0x4b1a8d
cmp dword [esi + 0x50], 0
je 0x4b1306
mov edi, dword [ebp - 0x14]
test edi, edi
je 0x4b15fb
mov eax, dword [ebp - 8]
dec eax
xor edx, edx
test eax, eax
setle dl
mov ecx, esi
dec edx
and eax, edx
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.004a9b50
jmp 0x4b1309
mov eax, dword [esi + 0x358]
mov ecx, dword [ebp - 8]
dec eax
inc ecx
cmp ecx, eax
jge 0x4b160c
mov eax, ecx
push eax
mov eax, dword [ebp - 0xc]
push eax
mov ecx, esi
call fcn.004a9b50
jmp 0x4b1309
mov edi, dword [ebp + 8]
mov ebx, dword [ebp - 0xc]
cmp di, 0x20
jne 0x4b1713
mov eax, dword [ebp - 8]
push eax
mov ecx, esi
call fcn.004a52f0
mov edi, eax
push edi
push ebx
mov ecx, esi
call fcn.004acc70
test al, 8
jne 0x4b1710
push edi
push ebx
mov ecx, esi
call fcn.004acba0
sub eax, 4
je 0x4b16b4
sub eax, 1
jne 0x4b1710
push edi
push ebx
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, esi
call fcn.004ad140
mov eax, dword [eax]
push eax
call fcn.004eb0b4
add esp, 4
lea ecx, [ebp - 0x1c]
mov dword [ebp + 8], eax
call fcn.00492ef0
cmp dword [ebp + 8], 0
jge 0x4b1692
push 0x51319c
jmp 0x4b16a0
jle 0x4b169b
push 0x513404
jmp 0x4b16a0
push 0x5131a0
push edi
push ebx
mov ecx, esi
call fcn.004a3c00
mov edx, dword [ebp - 8]
push 0xfffffa1e
push edx
jmp 0x4b16f5
push edi
push ebx
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
call fcn.004ad140
mov eax, dword [eax]
push eax
call fcn.004eb0b4
add esp, 4
test eax, eax
mov eax, 0x51319c
jg 0x4b16da
mov eax, 0x5131a0
push eax
push edi
push ebx
mov ecx, esi
call fcn.004a3c00
lea ecx, [ebp - 0x20]
call fcn.00492ef0
mov ecx, dword [ebp - 8]
push 0xfffffa1e
push ecx
push ebx
mov ecx, esi
call fcn.004a9020
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.004aad90
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 8]
cmp dword [ebp - 0x10], 0
je 0x4b1779
cmp di, 0x41
jne 0x4b1a8d
cmp dword [esi + 0x4c], 0
jne 0x4b1a8d
lea ebx, [esi + 0x360]
mov ecx, ebx
call fcn.004a04a0
xor edi, edi
cmp dword [esi + 0x388], edi
mov dword [ebp + 8], edi
jle 0x4b1762
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x30]
push eax
mov ecx, ebx
call fcn.004a8e40
inc edi
cmp edi, dword [esi + 0x388]
mov dword [ebp + 8], edi
jl 0x4b1747
mov ecx, dword [esi + 4]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push edi
call fcn.004eccdc
add esp, 4
test eax, eax
je 0x4b1a8d
push edi
call fcn.004eccb6
add esp, 4
test eax, eax
je 0x4b1a8d
mov edx, dword [esi + 0xd4]
push edx
mov ecx, esi
call fcn.004a52f0
mov dword [ebp - 0x14], eax
lea eax, [ebx + 1]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [ebp - 0xc]
mov edi, eax
call fcn.00465290
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0xc]
call fcn.004a7eb0
sub edi, dword [esi + 0x104]
cmp edi, 0x320
lea edi, [esi + 0x10c]
jae 0x4b18a4
lea edx, [ebp - 0xc]
push edx
push 1
lea eax, [ebp - 0x24]
push eax
mov ecx, edi
call fcn.0048e4f0
push eax
call fcn.004a6e80
add esp, 8
lea ecx, [ebp - 0x24]
mov byte [ebp - 1], al
call fcn.00492ef0
cmp byte [ebp - 1], 0
je 0x4b181c
mov ecx, dword [ebp + 8]
push ecx
mov ecx, edi
call fcn.004a7fa0
mov edx, dword [ebp - 0x14]
push edx
push ebx
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.004ad140
mov ecx, dword [edi]
mov eax, dword [ecx - 0xc]
cmp eax, 1
jle 0x4b185b
push eax
lea edx, [ebp - 0x38]
push edx
lea ecx, [ebp - 0x10]
mov ebx, 1
call fcn.0048e4f0
mov eax, dword [eax]
push eax
mov ecx, edi
call fcn.00492c00
test eax, eax
jne 0x4b185e
mov byte [ebp + 0xb], bl
jmp 0x4b1862
mov bl, byte [ebp - 0x28]
mov byte [ebp + 0xb], 0
test bl, 1
je 0x4b186f
lea ecx, [ebp - 0x38]
call fcn.00492ef0
cmp byte [ebp + 0xb], 0
je 0x4b189a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [ebp - 0x10]
mov dword [esi + 0x104], eax
call fcn.00492ef0
lea ecx, [ebp - 0xc]
call fcn.00492ef0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea ecx, [ebp - 0x10]
call fcn.00492ef0
jmp 0x4b18de
lea eax, [ebp - 0xc]
push eax
push 1
lea ecx, [ebp - 0x3c]
push ecx
mov ecx, edi
call fcn.0048e4f0
push eax
call fcn.004a6e80
add esp, 8
lea ecx, [ebp - 0x3c]
mov bl, al
call fcn.00492ef0
test bl, bl
je 0x4b18d3
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0xc]
push edx
mov ecx, edi
call fcn.0046d500
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [ebp - 0x18]
cmp ebx, dword [esi + 0x388]
mov dword [esi + 0x104], eax
jge 0x4b1993
lea esp, [esp]
mov eax, dword [ebp - 0x14]
push eax
push ebx
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
call fcn.004ad140
mov edx, dword [edi]
mov eax, dword [edx - 0xc]
push eax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x10]
call fcn.0048e4f0
mov eax, dword [eax]
test eax, eax
je 0x4b1a2e
mov ecx, dword [edi]
push eax
push ecx
call fcn.004eb4e2
add esp, 8
test eax, eax
mov eax, dword [ebp - 0x40]
sete byte [ebp + 0xb]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b195d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [ebp + 0xb], 0
jne 0x4b1a38
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b1986
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
inc ebx
cmp ebx, dword [esi + 0x388]
jl 0x4b1900
xor ebx, ebx
cmp dword [esi + 0x388], ebx
jle 0x4b1a6e
mov ecx, dword [ebp - 0x14]
push ecx
push ebx
lea edx, [ebp - 0x10]
push edx
mov ecx, esi
call fcn.004ad140
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
push eax
lea ecx, [ebp - 0x44]
push ecx
lea ecx, [ebp - 0x10]
call fcn.0048e4f0
mov eax, dword [eax]
test eax, eax
je 0x4b1a2e
mov ecx, dword [edi]
push eax
push ecx
call fcn.004eb4e2
add esp, 8
test eax, eax
mov eax, dword [ebp - 0x44]
sete byte [ebp + 0xb]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4b19fa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [ebp + 0xb], 0
jne 0x4b1a38
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b1a1f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
inc ebx
cmp ebx, dword [esi + 0x388]
jl 0x4b19a1
jmp 0x4b1a6e
push 0x80004005
call fcn.0045f890
mov edi, dword [ebp - 8]
push 1
push edi
push ebx
mov ecx, esi
call fcn.004affe0
push edi
push ebx
mov ecx, esi
call fcn.004a9930
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b1a6e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b1a8d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc