Function at 0x10016fb0
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
cmp dword [0x10094d58], 0
je 0x10017243
mov ecx, dword [0x10094b2c]
sub ecx, dword [0x10096b54]
add ecx, dword [0x10096c80]
mov eax, dword [0x10096d28]
mov ecx, dword [ecx + eax]
call fcn.10008040
test eax, eax
jle 0x10017243
mov eax, dword [0x10096e94]
cmp dword [eax], 1
jne 0x10017243
mov eax, dword [0x10094df4]
cmp dword [eax], 0
je 0x10017243
mov cl, byte [0x10094c07]
mov al, byte [0x10094c14]
test cl, cl
je 0x10017031
test al, al
jne 0x10017031
mov eax, dword [0x100949b8]
mov byte [0x10094c14], 1
movss xmm0, dword [eax + 0x11c]
movss dword [0x10094b00], xmm0
jmp 0x10017035
cmp al, 1
jne 0x1001703c
mov byte [0x10094c5f], 1
test cl, cl
jne 0x1001704c
mov byte [0x10094c14], cl
mov byte [0x10094c5f], cl
mov eax, dword [0x10094d58]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
cmp eax, 1
jne 0x1001712b
push 0x20
call edi
cwde
shr eax, 0x10
test eax, eax
je 0x100170bd
cmp byte [0x100977a0], 0
je 0x10017095
cmp dword [0x100977a4], 0
je 0x100170c4
call esi
mov ecx, dword [0x100977a4]
add ecx, 0xa
cmp ecx, eax
ja 0x100170c4
mov byte [0x100977a0], 1
call esi
movss xmm0, dword [0x10094b00]
addss xmm0, dword [0x1008dac8]
mov dword [0x100977a4], eax
movss dword [0x10094b00], xmm0
jmp 0x100170c4
mov byte [0x100977a0], 0
push 0xa2
call edi
cwde
shr eax, 0x10
test eax, eax
je 0x100171e8
cmp byte [0x10097bb0], 0
je 0x10017100
cmp dword [0x10097bb4], 0
je 0x100171ef
call esi
mov ecx, dword [0x10097bb4]
add ecx, 0xa
cmp ecx, eax
ja 0x100171ef
mov byte [0x10097bb0], 1
call esi
movss xmm0, dword [0x10094b00]
subss xmm0, dword [0x1008dac8]
mov dword [0x10097bb4], eax
movss dword [0x10094b00], xmm0
jmp 0x100171ef
cmp eax, 2
jne 0x100171ef
push 0x20
call edi
cwde
shr eax, 0x10
test eax, eax
je 0x10017189
cmp byte [0x100977a0], 0
je 0x10017161
cmp dword [0x100977a4], 0
je 0x10017190
call esi
mov ecx, dword [0x100977a4]
add ecx, 0xa
cmp ecx, eax
ja 0x10017190
mov byte [0x100977a0], 1
call esi
movss xmm0, dword [0x10094b00]
addss xmm0, dword [0x1008dac4]
mov dword [0x100977a4], eax
movss dword [0x10094b00], xmm0
jmp 0x10017190
mov byte [0x100977a0], 0
push 0xa2
call edi
cwde
shr eax, 0x10
test eax, eax
je 0x100171e8
cmp byte [0x10097bb0], 0
je 0x100171c0
cmp dword [0x10097bb4], 0
je 0x100171ef
call esi
mov ecx, dword [0x10097bb4]
add ecx, 0xa
cmp ecx, eax
ja 0x100171ef
mov byte [0x10097bb0], 1
call esi
movss xmm0, dword [0x10094b00]
subss xmm0, dword [0x1008dac4]
mov dword [0x10097bb4], eax
movss dword [0x10094b00], xmm0
jmp 0x100171ef
mov byte [0x10097bb0], 0
push 0x45
call edi
cwde
shr eax, 0x10
test eax, eax
je 0x1001723a
cmp byte [0x100978c8], 0
je 0x1001721c
cmp dword [0x100978cc], 0
je 0x10017241
call esi
mov ecx, dword [0x100978cc]
add ecx, 0x64
cmp ecx, eax
ja 0x10017241
mov byte [0x100978c8], 1
call esi
cmp byte [0x10094c07], 0
mov dword [0x100978cc], eax
sete byte [0x10094c07]
jmp 0x10017241
mov byte [0x100978c8], 0
pop edi
pop esi
mov eax, dword [0x10096e94]
mov eax, dword [eax]
cmp eax, 5
je 0x10017278
cmp eax, 4
je 0x10017278
mov ecx, dword [0x10094b2c]
sub ecx, dword [0x10096b54]
add ecx, dword [0x10096c80]
mov eax, dword [0x10096d28]
mov ecx, dword [ecx + eax]
call fcn.10008040
cmp eax, 1
jge 0x1001727f
mov byte [0x10094c07], 0
ret