Function at 0x40e220
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
sub esp, 0x28
or al, byte [esp + 0x34]
push ebx
mov ebx, dword [esp + 0x30]
push ebp
push esi
mov esi, ecx
lea ecx, [ebx - 1]
push edi
mov byte [esp + 0x18], al
cmp cl, 5
ja 0x40e242
cmp bl, 3
jne 0x40e24a
lea edx, [ebx + 0x66]
cmp dl, 5
ja 0x40e251
mov byte [esp + 0x17], 1
jmp 0x40e256
mov byte [esp + 0x17], 0
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp bl, 0x4c
jne 0x40e2fe
cmp dword [0x4c3908], 1
jne 0x40e2fe
cmp byte [0x4c0dc7], 0
jne 0x40e2fe
cmp dword [esp + 0x50], 0
jne 0x40e2fe
cmp byte [0x4c4e46], 0
je 0x40e2fe
test al, 0xc0
jne 0x40e2fe
test byte [0x4c4a82], 0xc0
je 0x40e2fe
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4c4a78]
cmp eax, 0x32
jae 0x40e2fe
xor ebp, ebp
cmp esi, ebp
jle 0x40e2fe
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x4c3fc0]
jne 0x40e2fe
push 0x5b
call edi
mov ecx, 0x8000
test cx, ax
jne 0x40e2dd
push 0x5c
call edi
mov edx, 0x8000
test dx, ax
je 0x40e2fe
push 1
push 0x8000012f
mov dword [0x4be3c4], ebp
call fcn.004012b0
add esp, 8
mov dword [0x4be3c4], 1
jmp 0x40e2c1
test esi, esi
jle 0x40e4fb
mov ebp, esi
mov esi, dword [esp + 0x18]
cmp dword [0x4c3908], 0
jne 0x40e371
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4c4abc]
mov ecx, dword [0x4be3fc]
cmp eax, dword [ecx + 0xd0]
jbe 0x40e371
push 0
push 0
push 0
push 0
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x40e366
push 1
push 0xffffffffffffffff
mov dword [0x4be3c4], 0
call fcn.004012b0
add esp, 8
mov dword [0x4be3c4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4c4abc], eax
cmp byte [esp + 0x4c], 0
jne 0x40e499
cmp dword [0x4c3908], 0
je 0x40e38f
mov al, byte [0x4c0dcf]
jmp 0x40e481
cmp dword [0x4c1fd8], 0
je 0x40e3a2
mov al, byte [0x4c1ea5]
jmp 0x40e481
push 0xa0
xor bl, bl
call edi
mov ecx, 0x8000
test cx, ax
je 0x40e3b7
mov bl, 0x10
push 0xa1
call edi
mov edx, 0x8000
test dx, ax
je 0x40e3cb
or bl, 0x20
push 0xa2
call edi
mov ecx, 0x8000
test cx, ax
je 0x40e3df
or bl, 1
push 0xa3
call edi
mov edx, 0x8000
test dx, ax
je 0x40e3f3
or bl, 2
push 0xa4
call edi
mov ecx, 0x8000
test cx, ax
je 0x40e407
or bl, 4
push 0xa5
call edi
mov edx, 0x8000
test dx, ax
je 0x40e41b
or bl, 8
push 0x5b
call edi
mov ecx, 0x8000
test cx, ax
je 0x40e42c
or bl, 0x40
push 0x5c
call edi
mov edx, 0x8000
test dx, ax
je 0x40e43d
or bl, 0x80
cmp dword [0x4c1fd8], 0
je 0x40e47a
mov al, bl
not al
and al, byte [0x4c1ea5]
je 0x40e47a
mov cl, byte [0x4c1ea7]
not al
and byte [0x4c1ea5], al
and byte [0x4c1ea6], al
and cl, al
mov al, cl
mov byte [0x4c1ea7], cl
mov ecx, 0x4c1ec8
call fcn.00411270
movzx eax, bl
mov ebx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x50]
push 1
push 0
push ecx
push eax
push esi
mov eax, 0xffc3d44f
call fcn.00410ac0
add esp, 0x14
cmp byte [esp + 0x17], 0
je 0x40e4d5
cmp dword [esp + 0x50], 0
jne 0x40e4d5
mov eax, dword [0x4be3fc]
movzx ecx, byte [eax + 0xe7]
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x54]
push edx
mov edx, dword [esp + 0x5c]
push ecx
push 1
push edx
push eax
mov al, byte [esp + 0x70]
mov cl, bl
call fcn.0040fbb0
add esp, 0x14
jmp 0x40e4f4
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x48]
push 0xffc3d44d
push 1
push ecx
push edx
push ebx
push eax
call fcn.0040eb50
add esp, 0x18
dec ebp
jne 0x40e30c
cmp byte [esp + 0x4c], 0
jne 0x40e63b
cmp dword [0x4c3908], 0
je 0x40e51a
mov bl, byte [0x4c0dcf]
jmp 0x40e606
cmp dword [0x4c1fd8], 0
je 0x40e52e
mov bl, byte [0x4c1ea5]
jmp 0x40e606
push 0xa0
xor bl, bl
call edi
mov ecx, 0x8000
test cx, ax
je 0x40e543
mov bl, 0x10
push 0xa1
call edi
mov edx, 0x8000
test dx, ax
je 0x40e557
or bl, 0x20
push 0xa2
call edi
mov ecx, 0x8000
test cx, ax
je 0x40e56b
or bl, 1
push 0xa3
call edi
mov edx, 0x8000
test dx, ax
je 0x40e57f
or bl, 2
push 0xa4
call edi
mov ecx, 0x8000
test cx, ax
je 0x40e593
or bl, 4
push 0xa5
call edi
mov edx, 0x8000
test dx, ax
je 0x40e5a7
or bl, 8
push 0x5b
call edi
mov ecx, 0x8000
test cx, ax
je 0x40e5b8
or bl, 0x40
push 0x5c
call edi
mov edx, 0x8000
test dx, ax
je 0x40e5c9
or bl, 0x80
cmp dword [0x4c1fd8], 0
je 0x40e606
mov al, bl
not al
and al, byte [0x4c1ea5]
je 0x40e606
mov cl, byte [0x4c1ea7]
not al
and byte [0x4c1ea5], al
and byte [0x4c1ea6], al
and cl, al
mov al, cl
mov byte [0x4c1ea7], cl
mov ecx, 0x4c1ec8
call fcn.00411270
mov cl, bl
mov al, cl
xor al, byte [esp + 0x44]
mov byte [esp + 0x4c], cl
and al, cl
and al, 0xcc
je 0x40e63b
mov edx, dword [esp + 0x50]
push 0
not al
push 1
push edx
mov edx, dword [esp + 0x58]
and al, cl
movzx eax, al
push edx
push eax
mov eax, 0xffc3d44d
call fcn.00410ac0
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret