Function at 0x10003b70
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x10038080]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add eax, 0x12491d4
push 0
push eax
call fcn.1000a370
add eax, 0x5494
push 0
push eax
call fcn.1000a370
add esp, 0x10
mov dword [0x1004a38c], eax
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
cmp eax, 0x88760868
je 0x10003ef8
mov eax, dword [0x1004a38c]
push 0
push 7
push eax
mov ecx, dword [eax]
call dword [ecx + 0xe4]
mov eax, dword [0x1004a38c]
push 0x1004a360
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc0]
cmp dword [0x1004a334], 1
jne 0x10003c5a
cmp byte [0x1004a388], 0
jne 0x10003c00
mov byte [0x1004a388], 1
jmp 0x10003c49
push 0x75
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x10003c5a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x1004a304]
add ecx, 0x3e8
cmp eax, ecx
jbe 0x10003c5a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp byte [0x10038b04], 1
mov dword [0x1004a304], eax
jne 0x10003c42
mov byte [0x10038b04], 0
xor ecx, ecx
jmp 0x10003c4e
mov byte [0x10038b04], 1
mov ecx, 1
push 0
push 0
call fcn.10003130
add esp, 8
mov eax, dword [0x1004a378]
cmp eax, 1
jne 0x10003ca8
cmp byte [0x1004a30b], 0
jne 0x10003cb1
cmp dword [0x1004a3d4], 0x438
mov ecx, eax
mov byte [0x1004a30b], al
jne 0x10003c94
push 0x438
push 0x6c0
call fcn.10003130
add esp, 8
jmp 0x10003cb1
push 0x258
push 0x320
call fcn.10003130
add esp, 8
jmp 0x10003cb1
test eax, eax
jne 0x10003cb1
mov byte [0x1004a30b], al
cmp dword [0x1004a3a4], 0
jne 0x10003dba
cmp dword [0x1004a348], 0
jne 0x10003ef8
mov eax, dword [0x1004a2e0]
mov dword [esp + 0x18], 0
test eax, eax
je 0x10003ce1
cmp eax, 0xffffffff
jne 0x10003cfd
lea eax, [esp + 0x18]
push eax
push 0
push 0x1048c
push str.OTTO
call dword [sym.imp.GDI32.dll_AddFontMemResourceEx]
mov dword [0x1004a2e0], eax
mov cl, 0x1e
mov byte [esp + 0xc], 0x7b
mov bh, cl
mov byte [esp + 0xa], 0xe
xor cl, byte [esp + 0xc]
mov al, 0x39
xor al, byte [esp + 0xc]
mov ah, 8
mov byte [esp + 0xd], al
mov dl, 0x19
mov al, byte [esp + 0xa]
mov ch, 0x5b
mov byte [esp + 0xe], cl
mov dh, 0x35
mov cl, byte [esp + 0xc]
mov bl, 0x1a
xor al, cl
mov byte [esp + 0xb], bh
push 0x1004a3a4
mov byte [esp + 0x19], al
xor ah, cl
mov al, byte [esp + 0xf]
xor dl, cl
xor al, cl
mov byte [esp + 0x15], ah
mov byte [esp + 0x1a], al
xor bl, cl
lea eax, [esp + 0x11]
mov byte [esp + 0x1b], 0
push eax
push 0x30
push 6
push 0
push 1
push 0
push 1
push 0x190
push 0
push 0x1c
push dword [0x1004a38c]
xor ch, cl
mov byte [esp + 0x3f], dl
xor dh, cl
mov byte [esp + 0x40], bl
xor bh, cl
mov byte [esp + 0x42], ch
mov byte [esp + 0x43], dh
mov byte [esp + 0x44], bh
mov byte [esp + 0x47], 0
call dword [sym.imp.d3dx9_43.dll_D3DXCreateFontA]
push 0x1004a348
push dword [0x1004a38c]
call dword [sym.imp.d3dx9_43.dll_D3DXCreateLine]
cmp dword [0x1004a3a4], 0
je 0x10003ef8
cmp dword [0x1004a348], 0
je 0x10003ef8
cmp byte [0x1004a30a], 1
jne 0x10003e65
mov eax, dword [0x1004a390]
cmp eax, 1
jne 0x10003de5
mov ecx, 0xffff0000
jmp 0x10003e22
cmp eax, 2
jne 0x10003df1
mov ecx, 0xff00ff00
jmp 0x10003e22
cmp eax, 3
jne 0x10003dfd
mov ecx, 0xff8000ff
jmp 0x10003e22
cmp eax, 4
jne 0x10003e09
mov ecx, 0xff0000ff
jmp 0x10003e22
cmp eax, 5
jne 0x10003e15
mov ecx, 0xffffff00
jmp 0x10003e22
mov ecx, dword [esp + 0x18]
or edx, 0xffffffff
cmp eax, 6
cmove ecx, edx
mov eax, dword [0x1004a36c]
shr eax, 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10034090]
mov eax, dword [0x1004a368]
shr eax, 1
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10034090]
cvtpd2ps xmm0, xmm0
call fcn.10003720
cmp dword [0x1004a300], 1
jne 0x10003ecc
mov eax, dword [0x1004a394]
cmp eax, 1
je 0x10003ebb
cmp eax, 2
jne 0x10003e8b
mov ecx, dword [0x1004a368]
lea edx, [eax + 0x1c]
lea ecx, [ecx - 0x6e]
jmp 0x10003ec2
cmp eax, 3
jne 0x10003ea0
mov edx, dword [0x1004a36c]
lea ecx, [eax + 0x1b]
push 1
lea edx, [edx - 0x78]
jmp 0x10003ec4
cmp eax, 4
jne 0x10003ebb
mov edx, dword [0x1004a36c]
mov ecx, dword [0x1004a368]
push 1
lea edx, [edx - 0x78]
lea ecx, [ecx - 0x6e]
jmp 0x10003ec4
mov edx, 0x1e
mov ecx, edx
push 0
call fcn.10003920
add esp, 4
mov eax, dword [0x1004a3a4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [0x1004a3a4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [0x1004a348]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [0x1004a348]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x4c]
mov ecx, dword [esp + 0x1c]
pop ebx
xor ecx, esp
call fcn.1000c80f
mov esp, ebp
pop ebp
ret