Function at 0x10003d40
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x10038080]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add eax, 0x124f484
push 0
push eax
call fcn.1000a450
add eax, 0x5394
push 0
push eax
call fcn.1000a450
add esp, 0x10
mov dword [0x1004a38c], eax
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
cmp eax, 0x88760868
je 0x100040c8
mov eax, dword [0x1004a38c]
push 0
push 7
push eax
mov ecx, dword [eax]
call dword [ecx + 0xe4]
mov eax, dword [0x1004a38c]
push 0x1004a360
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc0]
cmp dword [0x1004a334], 1
jne 0x10003e2a
cmp byte [0x1004a388], 0
jne 0x10003dd0
mov byte [0x1004a388], 1
jmp 0x10003e19
push 0x75
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x10003e2a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x1004a304]
add ecx, 0x3e8
cmp eax, ecx
jbe 0x10003e2a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp byte [0x10038b04], 1
mov dword [0x1004a304], eax
jne 0x10003e12
mov byte [0x10038b04], 0
xor ecx, ecx
jmp 0x10003e1e
mov byte [0x10038b04], 1
mov ecx, 1
push 0
push 0
call fcn.10003300
add esp, 8
mov eax, dword [0x1004a378]
cmp eax, 1
jne 0x10003e78
cmp byte [0x1004a30b], 0
jne 0x10003e81
cmp dword [0x1004a3d4], 0x438
mov ecx, eax
mov byte [0x1004a30b], al
jne 0x10003e64
push 0x438
push 0x6c0
call fcn.10003300
add esp, 8
jmp 0x10003e81
push 0x258
push 0x320
call fcn.10003300
add esp, 8
jmp 0x10003e81
test eax, eax
jne 0x10003e81
mov byte [0x1004a30b], al
cmp dword [0x1004a3a4], 0
jne 0x10003f8a
cmp dword [0x1004a348], 0
jne 0x100040c8
mov eax, dword [0x1004a2e0]
mov dword [esp + 0x18], 0
test eax, eax
je 0x10003eb1
cmp eax, 0xffffffff
jne 0x10003ecd
lea eax, [esp + 0x18]
push eax
push 0
push 0x1048c
push str.OTTO
call dword [sym.imp.GDI32.dll_AddFontMemResourceEx]
mov dword [0x1004a2e0], eax
mov cl, 0x50
mov byte [esp + 0xc], 0x35
mov bh, cl
mov byte [esp + 0xa], 0x40
xor cl, byte [esp + 0xc]
mov al, 0x77
xor al, byte [esp + 0xc]
mov ah, 0x46
mov byte [esp + 0xd], al
mov dl, 0x57
mov al, byte [esp + 0xa]
mov ch, 0x15
mov byte [esp + 0xe], cl
mov dh, 0x7b
mov cl, byte [esp + 0xc]
mov bl, 0x54
xor al, cl
mov byte [esp + 0xb], bh
push 0x1004a3a4
mov byte [esp + 0x19], al
xor ah, cl
mov al, byte [esp + 0xf]
xor dl, cl
xor al, cl
mov byte [esp + 0x15], ah
mov byte [esp + 0x1a], al
xor bl, cl
lea eax, [esp + 0x11]
mov byte [esp + 0x1b], 0
push eax
push 0x30
push 6
push 0
push 1
push 0
push 1
push 0x190
push 0
push 0x1c
push dword [0x1004a38c]
xor ch, cl
mov byte [esp + 0x3f], dl
xor dh, cl
mov byte [esp + 0x40], bl
xor bh, cl
mov byte [esp + 0x42], ch
mov byte [esp + 0x43], dh
mov byte [esp + 0x44], bh
mov byte [esp + 0x47], 0
call dword [sym.imp.d3dx9_43.dll_D3DXCreateFontA]
push 0x1004a348
push dword [0x1004a38c]
call dword [sym.imp.d3dx9_43.dll_D3DXCreateLine]
cmp dword [0x1004a3a4], 0
je 0x100040c8
cmp dword [0x1004a348], 0
je 0x100040c8
cmp byte [0x1004a30a], 1
jne 0x10004035
mov eax, dword [0x1004a390]
cmp eax, 1
jne 0x10003fb5
mov ecx, 0xffff0000
jmp 0x10003ff2
cmp eax, 2
jne 0x10003fc1
mov ecx, 0xff00ff00
jmp 0x10003ff2
cmp eax, 3
jne 0x10003fcd
mov ecx, 0xff8000ff
jmp 0x10003ff2
cmp eax, 4
jne 0x10003fd9
mov ecx, 0xff0000ff
jmp 0x10003ff2
cmp eax, 5
jne 0x10003fe5
mov ecx, 0xffffff00
jmp 0x10003ff2
mov ecx, dword [esp + 0x18]
or edx, 0xffffffff
cmp eax, 6
cmove ecx, edx
mov eax, dword [0x1004a36c]
shr eax, 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100340a0]
mov eax, dword [0x1004a368]
shr eax, 1
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100340a0]
cvtpd2ps xmm0, xmm0
call fcn.100038f0
cmp dword [0x1004a300], 1
jne 0x1000409c
mov eax, dword [0x1004a394]
cmp eax, 1
je 0x1000408b
cmp eax, 2
jne 0x1000405b
mov ecx, dword [0x1004a368]
lea edx, [eax + 0x1c]
lea ecx, [ecx - 0x6e]
jmp 0x10004092
cmp eax, 3
jne 0x10004070
mov edx, dword [0x1004a36c]
lea ecx, [eax + 0x1b]
push 1
lea edx, [edx - 0x78]
jmp 0x10004094
cmp eax, 4
jne 0x1000408b
mov edx, dword [0x1004a36c]
mov ecx, dword [0x1004a368]
push 1
lea edx, [edx - 0x78]
lea ecx, [ecx - 0x6e]
jmp 0x10004094
mov edx, 0x1e
mov ecx, edx
push 0
call fcn.10003af0
add esp, 4
mov eax, dword [0x1004a3a4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [0x1004a3a4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [0x1004a348]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [0x1004a348]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x4c]
mov ecx, dword [esp + 0x1c]
pop ebx
xor ecx, esp
call fcn.1000c98f
mov esp, ebp
pop ebp
ret