Function at 0x4096a2
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x485008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x831733], 2
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x5c], esi
jne 0x4099eb
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x60], ebx
call ebx
sub eax, dword [0x801ee0]
cmp eax, 0x2ee0
jb 0x4099eb
cmp dword [esi], 0
jne 0x4096ec
call ebx
mov dword [esi], eax
lea eax, [esi + 4]
push str.Qualify
push eax
call fcn.00409288
or dword [ebp - 0x58], 0xffffffff
lea ebx, [esi + 0x58]
pop ecx
mov dword [esi + 0x50], 1
xor edi, edi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
pop ecx
mov dword [ebp - 0x4c], ebx
cmp byte [edi + 0x485df8], 0
jne 0x409726
mov byte [ebx], 0
jmp 0x40995c
mov byte [ebx], 1
mov al, byte [edi + 0x485e24]
mov byte [ebx + 1], al
mov eax, dword [edi + 0x485e28]
mov dword [ebx + 4], eax
mov eax, dword [edi + 0x485e1c]
mov dword [ebx + 8], eax
mov eax, dword [edi + 0x485e20]
mov dword [ebx + 0xc], eax
movzx eax, byte [0x83172f]
imul ebx, eax, 0x88
lea eax, [edi + 0x485df9]
mov dword [ebp - 0x48], eax
lea ecx, [ebx + 0x7e6c20]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x409789
test dl, dl
je 0x409785
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x409789
add eax, 2
add ecx, 2
test dl, dl
jne 0x409769
xor eax, eax
jmp 0x40978e
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4097d1
lea ecx, [ebx + 0x7e6c38]
lea eax, [edi + 0x485e11]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4097be
test dl, dl
je 0x4097ba
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4097be
add eax, 2
add ecx, 2
test dl, dl
jne 0x40979e
xor eax, eax
jmp 0x4097c3
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4097d1
movzx eax, byte [edi + 0x485e24]
mov dword [ebp - 0x58], eax
xor ecx, ecx
mov eax, 0x7e6c20
and dword [ebp - 0x50], ecx
mov dword [ebp - 0x54], eax
mov edx, eax
mov eax, dword [ebp - 0x48]
mov bl, byte [eax]
cmp bl, byte [edx]
jne 0x409803
test bl, bl
je 0x4097ff
mov bl, byte [eax + 1]
cmp bl, byte [edx + 1]
jne 0x409803
add eax, 2
add edx, 2
test bl, bl
jne 0x4097e3
xor eax, eax
jmp 0x409808
sbb eax, eax
or eax, 1
test eax, eax
je 0x40982d
mov ebx, dword [ebp - 0x50]
mov edx, 0x88
mov eax, dword [ebp - 0x54]
add ebx, edx
add eax, edx
mov dword [ebp - 0x50], ebx
inc ecx
mov dword [ebp - 0x54], eax
cmp ebx, 0x8800
jb 0x4097de
or ecx, 0xffffffff
test ecx, ecx
jle 0x409879
imul ebx, ecx, 0x88
lea eax, [edi + 0x485e11]
lea ecx, [ebx + 0x7e6c38]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x409863
test dl, dl
je 0x40985f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x409863
add eax, 2
add ecx, 2
test dl, dl
jne 0x409843
xor eax, eax
jmp 0x409868
sbb eax, eax
or eax, 1
test eax, eax
jne 0x409879
cmp byte [ebx + 0x7e6c71], al
sete al
inc al
jmp 0x40987b
xor al, al
mov ebx, dword [ebp - 0x4c]
mov byte [ebx + 0x184], al
mov eax, dword [edi + 0x485e30]
test eax, eax
je 0x409899
add eax, 0x20
push eax
call fcn.00404bcc
jmp 0x40989c
or eax, 0xffffffff
mov dword [ebx + 0x5c], eax
movzx eax, byte [edi + 0x485e24]
push eax
lea eax, [ebx + 0x10]
push 0x470268
push eax
call fcn.00409288
lea eax, [edi + 0x485e11]
push eax
lea eax, [ebx + 0x138]
push 0x47026c
push eax
call fcn.00409288
add esp, 0x18
cmp dword [0x7ef85c], 0
je 0x4098fc
cmp byte [edi + 0x485e24], 1
je 0x4098fc
imul eax, dword [0x4899f8], 0x3c
mov ebx, 0x470274
mov ecx, dword [edi + 0x485e18]
sub ecx, dword [eax + 0x485e18]
jmp 0x409907
mov ecx, dword [edi + 0x485e18]
mov ebx, 0x470270
push 0x40
lea edx, [ebp - 0x44]
call fcn.00402e44
push eax
push ebx
mov ebx, dword [ebp - 0x4c]
lea eax, [ebx + 0xec]
push eax
call fcn.00409288
add esp, 0x10
push 0x11
call esi
test al, al
jns 0x409947
push 0x10
call esi
test al, al
jns 0x409947
mov eax, dword [edi + 0x485e30]
mov ecx, 0x46e0ce
test eax, eax
cmovne ecx, eax
jmp 0x40994a
mov ecx, dword [ebp - 0x48]
push ecx
lea eax, [ebx + 0x60]
push 0x470278
push eax
call fcn.004092ef
add esp, 0xc
add edi, 0x3c
add ebx, 0x188
mov dword [ebp - 0x4c], ebx
cmp edi, 0x3c00
jb 0x409715
mov esi, dword [ebp - 0x5c]
mov ebx, dword [ebp - 0x58]
mov byte [esi + 0x54], 0
cmp dword [esi + 0x18858], ebx
je 0x4099ee
mov edi, dword [ebp - 0x60]
call edi
sub eax, dword [esi + 0x18860]
mov edx, 0x3e8
mov ecx, dword [esi + 0x18858]
shl eax, 2
cmp eax, edx
jle 0x4099ac
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
jmp 0x4099d3
sub edx, eax
imul ecx, eax
movd xmm1, edx
cvtdq2ps xmm1, xmm1
movd xmm0, ecx
mulss xmm1, dword [esi + 0x1885c]
cvtdq2ps xmm0, xmm0
addss xmm1, xmm0
divss xmm1, dword [0x47d2f8]
movss dword [esi + 0x1885c], xmm1
mov dword [esi + 0x18858], ebx
call edi
mov dword [esi + 0x18860], eax
jmp 0x4099ee
and dword [esi], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00445b7e
leave
ret