Function at 0x40ce1a
Capabilities:
Check for time delay via gettickcount
Inspect section memory permissions
Log keystrokes via polling

Disassembly:
push ebp
sub esp, 0x50
mov eax, 0x44e82d
call fcn.0044d07c
sub esp, 0x58
push ebx
push esi
mov dword [ebp + 0x50], ecx
push edi
xor ebx, ebx
lea ecx, [ebp + 0x20]
xor edi, edi
mov dword [ebp + 0x4c], ebx
call fcn.00401c1f
mov dword [ebp - 4], ebx
test dword [ebp + 0x68], 0x200
mov esi, 0x23b
je 0x40ce63
test dword [ebp + 0x68], 0x110
je 0x40ce63
mov ecx, dword [ebp + 0x50]
push esi
call fcn.0040570a
test dword [ebp + 0x68], 0x100
je 0x40ce9e
cmp dword [ebp + 0x60], ebx
jne 0x40ce7e
mov ecx, dword [ebp + 0x50]
push 0x1fe
call fcn.0040570a
cmp dword [0x462180], 0x501
jb 0x40ce97
push dword [ebp + 0x60]
call sym.qmmacro.exe_DpiIsWindowScaled
pop ecx
test eax, eax
je 0x40ce9e
and dword [ebp + 0x68], 0xfffffeff
test dword [ebp + 0x68], 0x40000000
je 0x40cece
cmp dword [ebp + 0x5c], ebx
jne 0x40ceb5
mov ecx, dword [ebp + 0x50]
push esi
call fcn.0040570a
test byte [ebp + 0x68], 0x40
mov edi, dword [ebp + 0x5c]
je 0x40d0c9
mov dword [ebp + 0x4c], 1
jmp 0x40d0c9
mov eax, dword [ebp + 0x5c]
cmp eax, ebx
je 0x40d0b0
cmp byte [eax], 0
je 0x40d0b0
lea eax, [ebp + 0x5c]
push eax
call fcn.0040d614
mov esi, eax
pop ecx
cmp esi, ebx
je 0x40cf43
test byte [ebp + 0x68], 0x40
jne 0x40cf09
push str..ico
push dword [ebp + 0x5c]
call fcn.0042e7ce
test al, al
je 0x40cf10
mov dword [ebp + 0x4c], 1
xor eax, eax
cmp dword [ebp + 0x4c], 1
jne 0x40cf1f
test byte [ebp + 0x68], 0x20
je 0x40cf1f
inc eax
push eax
push dword [ebp + 0x4c]
push dword [ebp + 0x5c]
push esi
call fcn.0040dd1c
mov edi, eax
add esp, 0x10
cmp edi, ebx
jne 0x40d0c9
push 0x24e
jmp 0x40d00f
push 6
push str.color:
push dword [ebp + 0x5c]
call sym.qmmacro.exe_q_strnicmp
add esp, 0xc
test eax, eax
jne 0x40cf7a
mov eax, dword [ebp + 0x5c]
or dword [ebp + 0x68], 0x20000000
add eax, 6
push eax
mov dword [ebp + 0x4c], 0xff
call fcn.0043a2c0
mov edi, eax
jmp 0x40d0c9
push 6
push str.macro:
push dword [ebp + 0x5c]
call sym.qmmacro.exe_q_strnicmp
add esp, 0xc
test eax, eax
jne 0x40d01c
mov eax, dword [ebp + 0x5c]
add eax, 6
mov esi, 0x461b74
push eax
mov ecx, esi
call fcn.00402154
mov ebx, eax
test ebx, ebx
jne 0x40cfba
mov ecx, dword [ebp + 0x50]
push 0x209
call fcn.0040570a
push ebx
mov ecx, esi
call fcn.004020e0
imul eax, eax, 0x18
mov ecx, dword [0x461b74]
push dword [eax + ecx + 0xc]
lea ecx, [ebp + 0x20]
call fcn.0042c85a
push 0
push 0
lea eax, [ebp + 0x20]
push eax
push 0x24
lea ecx, [ebp + 0x30]
call fcn.00437a9a
test al, al
je 0x40d00a
push pe_nt_image_headers32
push dword [ebp + 0x34]
push dword [ebp + 0x30]
call fcn.0040da0e
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x40d0c9
push 0x23d
mov ecx, dword [ebp + 0x50]
call fcn.0040570a
jmp 0x40d0c9
xor esi, esi
test byte [ebp + 0x68], 0x20
mov dword [ebp + 0x44], ebx
je 0x40d028
inc esi
push ebx
push 0xffffffffffffffff
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp + 0x5c]
push eax
call fcn.00430c2c
add esp, 0x14
test al, al
je 0x40d046
or esi, 2
push ebx
push ebx
push dword [ebp + 0x5c]
lea ecx, [ebp + 0x20]
call fcn.00437481
test al, al
jne 0x40d062
push dword [ebp + 0x5c]
lea ecx, [ebp + 0x20]
call fcn.0042c85a
cmp esi, ebx
jne 0x40d079
push 0xffffffffffffffff
push str..bmp
lea ecx, [ebp + 0x20]
call fcn.0042b1cb
test al, al
jne 0x40d0a0
push ebx
push esi
push dword [ebp + 0x44]
mov dword [ebp + 0x4c], 1
push dword [ebp + 0x20]
call fcn.004315ee
add esp, 0x10
mov edi, eax
cmp edi, ebx
jne 0x40d0c9
push 0x1fa
jmp 0x40d00f
push 0x10
push ebx
push ebx
push ebx
push dword [ebp + 0x20]
push ebx
call fcn.00433321
jmp 0x40d090
test dword [ebp + 0x68], 0x80000000
jne 0x40d0c2
mov ecx, dword [ebp + 0x50]
push esi
call fcn.0040570a
or dword [ebp + 0x68], 0x10000000
cmp dword [ebp + 0x74], 0
lea ecx, [ebp - 0x64]
setne byte [ebp + 0x4b]
call fcn.0040c071
mov byte [ebp - 4], 1
cmp dword [ebp + 0x64], 0
mov al, byte [ebp + 0x4c]
mov dword [ebp - 0x10], edi
mov byte [ebp - 0x11], al
jne 0x40d0fd
xor eax, eax
lea edi, [ebp]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp]
mov dword [ebp + 0x64], eax
jmp 0x40d10f
test dword [ebp + 0x68], 0x280
je 0x40d10f
mov edi, dword [ebp + 0x64]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov esi, dword [ebp + 0x64]
lea edi, [ebp + 0x10]
cmp byte [ebp + 0x4b], 0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x40d1e6
mov ecx, dword [ebp + 0x50]
call fcn.00422614
mov ebx, eax
mov eax, dword [ebp + 0x68]
mov dword [ebp + 0x40], ebx
neg ebx
sbb ebx, ebx
and ebx, 0x3c
add ebx, 0x28
and eax, 0x80000000
mov dword [ebp + 0x44], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
push dword [ebp + 0x70]
mov dword [ebp + 0x4c], eax
push dword [ebp + 0x60]
lea eax, [ebp - 0x64]
push dword [ebp + 0x6c]
push dword [ebp + 0x68]
push dword [ebp + 0x64]
push 1
push eax
call fcn.0040c180
mov edi, eax
add esp, 0x1c
cmp edi, 1
jbe 0x40d17d
mov ecx, dword [ebp + 0x50]
push edi
call fcn.0040570a
cmp dword [ebp + 0x44], 0
je 0x40d18c
xor eax, eax
test edi, edi
sete al
mov edi, eax
test edi, edi
je 0x40d207
cmp dword [ebp + 0x74], 0
je 0x40d254
call esi
mov esi, eax
push 0xa
pop eax
sub eax, dword [ebp + 0x4c]
add esi, eax
cmp dword [ebp + 0x40], 0
je 0x40d1b7
cmp ebx, 0x1f4
jae 0x40d1b7
add ebx, 0x28
cmp esi, ebx
jae 0x40d1bd
mov esi, ebx
mov ecx, dword [ebp + 0x50]
push esi
call fcn.004056f4
cmp dword [ebp + 0x74], 0xffffffff
je 0x40d1d7
cmp esi, dword [ebp + 0x74]
jbe 0x40d1d4
mov esi, dword [ebp + 0x74]
sub dword [ebp + 0x74], esi
mov edi, dword [ebp + 0x64]
lea esi, [ebp + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x40d145
push dword [ebp + 0x70]
lea eax, [ebp - 0x64]
push dword [ebp + 0x60]
push dword [ebp + 0x6c]
push dword [ebp + 0x68]
push dword [ebp + 0x64]
push 0
push eax
call fcn.0040c180
add esp, 0x1c
test eax, eax
jne 0x40d282
test dword [ebp + 0x68], 0x400
je 0x40d2c1
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
xor bl, bl
push 1
call esi
test ax, ax
jl 0x40d237
push 2
call esi
test ax, ax
jl 0x40d237
push 4
call esi
test ax, ax
jge 0x40d245
mov ecx, dword [ebp + 0x50]
push 0x14
mov bl, 1
call fcn.004056f4
jmp 0x40d21c
test bl, bl
je 0x40d2c1
mov edi, dword [ebp + 0x64]
lea esi, [ebp + 0x10]
jmp 0x40d115
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
call fcn.0040c0d1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x20]
call fcn.00401c2f
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add ebp, 0x54
leave
ret 0x1c
cmp eax, 1
je 0x40d290
mov ecx, dword [ebp + 0x50]
push eax
call fcn.0040570a
test byte [ebp + 0x68], 2
je 0x40d2a3
mov ecx, dword [ebp + 0x50]
push 0x204
call fcn.0040570a
xor bl, bl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
call fcn.0040c0d1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x20]
call fcn.00401c2f
mov al, bl
jmp 0x40d26e
mov eax, dword [ebp + 0x68]
and eax, 0x80000201
cmp eax, 1
jne 0x40d326
mov ecx, dword [ebp + 0x64]
mov esi, dword [ecx]
mov eax, dword [ecx + 8]
sub eax, esi
cmp eax, 0x3c
jge 0x40d2e6
cdq
sub eax, edx
mov edi, eax
sar edi, 1
jmp 0x40d2e9
push 0x1e
pop edi
mov eax, dword [ecx + 0xc]
add edi, esi
mov esi, dword [ecx + 4]
sub eax, esi
cmp eax, 0x3c
jge 0x40d2ff
cdq
sub eax, edx
sar eax, 1
jmp 0x40d302
push 0x1e
pop eax
mov ecx, dword [ebp + 0x50]
add eax, esi
push eax
push edi
call fcn.0040bd95
mov ecx, dword [ebp + 0x50]
call fcn.00422614
shr eax, 2
test eax, eax
je 0x40d326
mov ecx, dword [ebp + 0x50]
push eax
call fcn.004056f4
mov bl, 1
jmp 0x40d2a5