Function at 0x1015fb40
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x101db820]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, byte [0x102733d4]
test eax, eax
jne 0x1015fb60
jmp 0x1015fe17
push 7
mov ecx, 0x101e1298
call fcn.1014cb70
movzx ecx, al
test ecx, ecx
jne 0x1015fbe5
push 8
mov ecx, 0x101e1298
call fcn.1014cb70
movzx edx, al
test edx, edx
jne 0x1015fbe5
push 0xc
mov ecx, 0x101e1298
call fcn.1014cb70
movzx eax, al
test eax, eax
jne 0x1015fbe5
push 0xe
mov ecx, 0x101e1298
call fcn.1014cb70
movzx ecx, al
test ecx, ecx
jne 0x1015fbe5
push 0xf
mov ecx, 0x101e1298
call fcn.1014cb70
movzx edx, al
test edx, edx
jne 0x1015fbe5
push 0x41
mov ecx, 0x101e1298
call fcn.1014cb70
movzx eax, al
test eax, eax
jne 0x1015fbe5
push 0x4e
mov ecx, 0x101e1298
call fcn.1014cb70
movzx ecx, al
test ecx, ecx
je 0x1015fbea
jmp 0x1015fe17
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x10272eec]
cmp eax, 0x5dc
jae 0x1015fc02
jmp 0x1015fe17
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x8000
je 0x1015fe17
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
je 0x1015fe17
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x68], ecx
cmp dword [ebp - 0x68], 0
je 0x1015fc43
mov edx, dword [ebp - 0x68]
movsx eax, word [edx]
test eax, eax
jge 0x1015fc48
jmp 0x1015fe17
mov byte [ebp - 0x60], 0
push 0x5b
push 0
lea ecx, [ebp - 0x5f]
push ecx
call fcn.100754c0
add esp, 0xc
push 0x5c
push 0x78
lea ecx, [ebp - 0x60]
call fcn.10051dc0
mov dword [ebp - 0x64], 0xffffffff
push 0x4d
mov ecx, 0x101e1298
call fcn.1014cb70
movzx edx, al
test edx, edx
je 0x1015fcf2
mov eax, dword [0x101dcd34]
sub eax, 0x17c
cmp dword [0x879340c], eax
jbe 0x1015fced
mov ecx, dword [ebp - 0x68]
movsx edx, byte [ecx + 0x43]
mov eax, dword [ebp - 0x68]
movsx ecx, byte [eax + 0x44]
lea edx, [edx + ecx*8 + 0xc]
mov dword [ebp - 0x64], edx
mov eax, dword [0x101dcd34]
sub eax, 0x17c
cmp dword [0x879340c], eax
jbe 0x1015fced
mov ecx, dword [0x101dcd34]
sub ecx, 0xbe
cmp dword [0x879340c], ecx
jae 0x1015fced
mov edx, dword [ebp - 0x64]
add edx, 0x40
mov dword [ebp - 0x64], edx
cmp dword [0x8793410], 0x82
jle 0x1015fced
mov eax, dword [ebp - 0x64]
add eax, 0x20
mov dword [ebp - 0x64], eax
jmp 0x1015fd90
push 0xd
mov ecx, 0x101e1298
call fcn.1014cb70
movzx ecx, al
test ecx, ecx
je 0x1015fd90
push 0x10
mov ecx, 0x101e1298
call fcn.1014cb70
movzx edx, al
test edx, edx
je 0x1015fd59
mov eax, dword [0x101dcd34]
sub eax, 0x17c
cmp dword [0x879340c], eax
jbe 0x1015fd57
mov ecx, dword [0x101dcd34]
sub ecx, 0xbe
cmp dword [0x879340c], ecx
jae 0x1015fd57
mov edx, dword [ebp - 0x68]
movsx eax, byte [edx + 0x43]
mov ecx, dword [ebp - 0x68]
movsx edx, byte [ecx + 0x44]
lea eax, [eax + edx*8 + 0xc]
mov dword [ebp - 0x64], eax
jmp 0x1015fd90
mov ecx, dword [0x101dcd34]
sub ecx, 0xbe
cmp dword [0x879340c], ecx
jbe 0x1015fd90
mov edx, dword [0x879340c]
cmp edx, dword [0x101dcd34]
jae 0x1015fd90
mov eax, dword [ebp - 0x68]
movsx ecx, byte [eax + 0x43]
mov edx, dword [ebp - 0x68]
movsx eax, byte [edx + 0x44]
lea ecx, [ecx + eax*8 + 0xc]
mov dword [ebp - 0x64], ecx
mov edx, dword [ebp - 0x64]
mov dword [ebp - 0x5c], edx
mov ecx, 0x102048e0
call fcn.10016320
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x70], 0x101e3d80
push 0xffffffffffffffff
mov eax, dword [ebp - 0x6c]
imul eax, eax, 0x64
add eax, dword [ebp - 0x70]
push eax
lea ecx, [ebp - 0x4d]
push ecx
call fcn.1005b010
add esp, 0xc
mov edx, 1
imul edx, edx, 0x3c
mov byte [ebp + edx - 0x4d], 0
push 0xffffffffffffffff
mov eax, dword [0x101e3644]
push eax
lea ecx, [ebp - 0x58]
push ecx
call fcn.10001f00
add esp, 0xc
mov edx, 1
imul edx, edx, 0xa
mov byte [ebp + edx - 0x58], 0
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
movzx ecx, byte [ebp - 0x5f]
push ecx
lea edx, [ebp - 0x60]
push edx
call fcn.101687a0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10272eec], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006cdc0
mov esp, ebp
pop ebp
ret