Function at 0x300105ac
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov ecx, dword [ebp + 0xc]
mov esi, eax
mov eax, 0x401
cmp ecx, eax
ja 0x300107d4
je 0x300107b2
mov eax, ecx
sub eax, 7
je 0x30010758
sub eax, 0xf9
je 0x3001071f
dec eax
dec eax
je 0x300106e8
sub eax, 0xf
je 0x3001062b
sub eax, 6
je 0x3001061c
sub eax, 0x11c
jne 0x3001094d
push dword [ebp + 0x10]
mov ecx, esi
call fcn.3001faf2
jmp 0x30010949
push dword [ebp + 0x10]
mov ecx, esi
call fcn.30010962
jmp 0x30010949
movzx ecx, word [ebp + 0x10]
mov eax, 0x3ee
cmp ecx, eax
jg 0x300106a0
je 0x30010684
sub ecx, 0x22
je 0x30010673
sub ecx, 0x3c7
je 0x3001066c
dec ecx
je 0x30010665
dec ecx
je 0x3001065e
dec ecx
jne 0x30010949
push ebx
push ebx
push ebx
push 0x2ec
jmp 0x30010678
push ebx
push ebx
push ebx
push 3
jmp 0x30010678
push ebx
push ebx
push ebx
push 0x17
jmp 0x30010678
push ebx
push ebx
push ebx
push 0x12
jmp 0x30010678
push ebx
push ebx
push ebx
push 0x6d
mov ecx, esi
call fcn.30010bd8
jmp 0x30010949
cmp dword [esi + 0x464], ebx
jne 0x30010699
push 0x30
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x30010949
push ebx
push ebx
push ebx
push 4
jmp 0x30010678
sub ecx, 0x3fc
je 0x300106de
sub ecx, 0x2e
je 0x300106d4
sub ecx, 0x86
je 0x300106c8
dec ecx
jne 0x30010949
mov ecx, esi
call fcn.3000dc44
jmp 0x30010949
mov ecx, esi
call fcn.3000dc82
jmp 0x30010949
push ebx
push ebx
push ebx
push 0x3d8
jmp 0x30010678
push ebx
push ebx
push ebx
push 0x3cb
jmp 0x30010678
cmp dword [ebp + 0x10], 0x1b
jne 0x30010949
push dword [0x30035438]
call dword [sym.imp.MSO9.DLL_Ordinal_474]
test eax, eax
je 0x30010949
and dword [esi + 0x504], 0xffffffdf
push ebx
push dword [0x30035438]
call dword [sym.imp.MSO9.DLL_Ordinal_590]
jmp 0x30010949
cmp dword [ebp + 0x10], 0x70
jne 0x30010949
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x30010949
or dword [esi + 0x504], 0x20
push 0x7f8b
push ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push 1
jmp 0x3001070e
mov eax, dword [esi + 0x4b8]
test byte [eax + 5], 2
je 0x30010785
and byte [eax + 5], 0xfd
test byte [eax + 5], 1
jne 0x30010949
push ebx
push ebx
push 0x40d
push edi
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x30010949
mov esi, dword [esi + 0x470]
cmp esi, ebx
je 0x300107a5
mov esi, dword [esi + 0x90]
cmp esi, ebx
je 0x300107a5
push esi
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x30010949
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 7
jmp 0x30010954
mov eax, dword [ebp + 0x14]
cmp eax, ebx
jne 0x300107c7
mov eax, dword [esi + 0x470]
cmp eax, ebx
je 0x30010949
push eax
mov ecx, esi
call fcn.3000efe4
jmp 0x30010949
cmp ecx, 0x405
jb 0x3001094d
cmp ecx, 0x407
jbe 0x3001093e
cmp ecx, 0x409
je 0x30010932
cmp ecx, 0x40a
je 0x3001091c
cmp ecx, 0x40b
je 0x300108d4
cmp ecx, 0x40d
je 0x30010849
cmp ecx, 0x40e
jne 0x3001094d
mov eax, dword [esi + 0x4b8]
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov ecx, esi
call fcn.3000f6bc
push 0x30
push 0x1001b
call fcn.3002ac66
jmp 0x30010949
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov dword [ebp + 0x10], eax
call edi
sub eax, dword [ebp + 0x10]
cmp eax, 0x1388
jbe 0x300108b7
push ebx
push 0x50
push 0x50
lea eax, [ebp - 0x1c]
push dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x30010854
lea eax, [ebp - 0x1c]
push eax
push dword [0x30035438]
call dword [sym.imp.MSO9.DLL_Ordinal_800]
mov eax, dword [esi + 0x4b4]
add esi, 0x4b4
push 5
push dword [eax + 0xa4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi]
push ebx
push ebx
push 7
push dword [eax + 0xa4]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x30010949
mov esi, dword [esi + 0x470]
cmp esi, ebx
je 0x30010949
mov esi, dword [esi + 0x90]
cmp esi, ebx
je 0x30010949
jmp 0x30010799
cmp esi, ebx
je 0x30010949
mov edi, dword [esi + 0x470]
cmp edi, ebx
je 0x30010949
or byte [edi + 3], 0x10
push 1
push ebx
mov ecx, edi
call fcn.30015350
push edi
mov ecx, esi
call fcn.3000efe4
mov eax, dword [esi + 0x4b8]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.USER32.dll_GetSystemMenu]
cmp eax, ebx
je 0x30010949
push 1
push 0xf060
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
jmp 0x30010949
xor eax, eax
cmp dword [ebp + 0x14], 1
sete al
push eax
xor eax, eax
cmp dword [ebp + 0x10], 1
sete al
push eax
jmp 0x30010935
push 1
push ebx
mov ecx, esi
call fcn.30023340
jmp 0x30010949
push dword [ebp + 0x14]
push ecx
mov ecx, esi
call fcn.30023ae4
xor eax, eax
jmp 0x3001095b
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ecx
push edi
call dword [sym.imp.USER32.dll_DefWindowProcA]
pop edi
pop esi
pop ebx
leave
ret 0x10