Function at 0x100017d0
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
add ebx, 0x8c
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x44]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
add edi, 0xfffffff9
lea eax, [ebp - 0xc]
mov dword [ebp - 0x20], ecx
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [ebp - 0xc]
cmp ecx, ebx
jl 0x100018f7
lea eax, [ebx + 0x14]
cmp ecx, eax
jg 0x100018f7
mov ecx, dword [ebp - 8]
cmp ecx, edi
jl 0x100018f7
lea eax, [edi + 0x10]
cmp ecx, eax
jg 0x100018f7
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 1
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cwde
shr eax, 0x10
test eax, eax
je 0x100018a0
cmp byte [0x10006680], 0
je 0x10001887
cmp dword [0x10006684], 0
je 0x100018a7
call edi
mov ecx, dword [0x10006684]
add ecx, 0x3e8
cmp ecx, eax
ja 0x100018a7
mov byte [0x10006680], 1
call edi
mov dword [0x10006684], eax
mov eax, dword [esi]
test eax, eax
js 0x100018a7
inc eax
mov dword [esi], eax
jmp 0x100018a7
mov byte [0x10006680], 0
push 1
call ebx
cwde
shr eax, 0x10
test eax, eax
je 0x100018f0
cmp byte [0x10006680], 0
je 0x100018d7
cmp dword [0x10006684], 0
je 0x100018f7
call edi
mov ecx, dword [0x10006684]
add ecx, 0x3e8
cmp ecx, eax
ja 0x100018f7
mov byte [0x10006680], 1
call edi
mov dword [0x10006684], eax
mov eax, dword [esi]
test eax, eax
je 0x100018f7
dec eax
mov dword [esi], eax
jmp 0x100018f7
mov byte [0x10006680], 0
mov eax, dword [esi]
test eax, eax
js case.default.0x10001903
dec eax
cmp eax, 0xb
ja case.default.0x10001903
jmp dword [eax*4 + 0x10001a58]
mov esi, 0xffff0000
jmp 0x1000195e
mov esi, 0xff00ff00
jmp 0x1000195e
mov esi, 0xe10000ff
jmp 0x1000195e
mov esi, 0xff00ffff
jmp 0x1000195e
mov esi, 0xffee7621
jmp 0x1000195e
or esi, 0xffffffff
jmp 0x1000195e
mov esi, 0xffffa500
jmp 0x1000195e
mov esi, 0xff7d00ff
jmp 0x1000195e
mov esi, 0xff808080
jmp 0x1000195e
mov esi, 0xffeec900
jmp 0x1000195e
mov esi, 0x3c5a5a5a
jmp 0x1000195e
mov dword [esi], 0
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
add eax, 0x8e
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
add eax, 0x12
mov dword [ebp - 0xc], eax
lea ecx, [edi - 5]
lea eax, [ecx + 0xe]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], eax
mov eax, dword [ebx]
push 0x144
push ebx
call dword [eax + 0x164]
mov eax, dword [ebx]
push 1
push 0x1b
push ebx
call dword [eax + 0xe4]
mov eax, dword [ebx]
push 6
push 0x14
push ebx
call dword [eax + 0xe4]
mov eax, dword [ebx]
push 5
push 0x1b
push ebx
call dword [eax + 0xe4]
mov eax, dword [ebx]
push 1
push ecx
mov dword [esp], 0x3f800000
lea ecx, [ebp - 0x14]
push esi
push 1
push ecx
push 1
push ebx
call dword [eax + 0xac]
mov esi, dword [ebp + 8]
add edi, 0xfffffffa
push ebx
push 0xffffff00
push 0xf
push 1
push edi
add esi, 0x8d
push esi
call fcn.10001040
push ebx
push 0xffffff00
push 1
push 0x13
lea eax, [edi + 0xf]
push eax
push esi
call fcn.10001040
push ebx
push 0xffffff00
push 1
push 0x13
push edi
push esi
call fcn.10001040
push ebx
push 0xffffff00
push 0x10
push 1
push edi
lea eax, [esi + 0x13]
push eax
call fcn.10001040
mov eax, dword [ebp + 8]
push 0x100
push dword [ebp - 0x1c]
add eax, 0x26
push 0xffdadada
push edi
push eax
mov ecx, dword [ebp - 0x20]
call fcn.10001170
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000272d
mov esp, ebp
pop ebp
ret 0x40