Function at 0x6619f4
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov esi, eax
mov byte [ebp - 1], cl
mov ebx, edx
cmp dword [esi + 0x354], 0
je 0x661d45
test bl, bl
jne 0x661a3a
cmp byte [ebp - 1], 0
jne 0x661a3a
cmp byte [ebp + 0xc], 0
jne 0x661a3a
cmp byte [ebp + 8], 0
jne 0x661a3a
call sub.KERNEL32.DLL_GetTickCount
sub eax, 0x2d
cmp eax, dword [esi + 0x39c]
jb 0x661d45
push 0x10
call sub.USER32.DLL_GetAsyncKeyState
test ah, 0x80
setne al
and eax, 1
test bl, bl
mov byte [ebp - 2], al
jne 0x661a71
push 0x25
call sub.USER32.DLL_GetAsyncKeyState
test ah, 0x80
jne 0x661a71
mov dl, 1
mov eax, 0x1b5
call fcn.00543da4
test al, al
jne 0x661a71
xor edx, edx
jmp 0x661a76
mov edx, 1
cmp byte [ebp - 1], 0
mov ebx, edx
jne 0x661a9e
push 0x27
call sub.USER32.DLL_GetAsyncKeyState
test ah, 0x80
jne 0x661a9e
mov dl, 1
mov eax, 0x1b7
call fcn.00543da4
test al, al
jne 0x661a9e
xor ecx, ecx
jmp 0x661aa3
mov ecx, 1
mov byte [ebp - 3], cl
cmp byte [ebp + 0xc], 0
jne 0x661acc
push 0x26
call sub.USER32.DLL_GetAsyncKeyState
test ah, 0x80
jne 0x661acc
mov dl, 1
mov eax, 0x1b6
call fcn.00543da4
test al, al
jne 0x661acc
xor ecx, ecx
jmp 0x661ad1
mov ecx, 1
mov byte [ebp - 4], cl
cmp byte [ebp + 8], 0
jne 0x661afa
push 0x28
call sub.USER32.DLL_GetAsyncKeyState
test ah, 0x80
jne 0x661afa
mov dl, 1
mov eax, 0x1b8
call fcn.00543da4
test al, al
jne 0x661afa
xor eax, eax
jmp 0x661aff
mov eax, 1
xor edx, edx
test bl, bl
jne 0x661b15
cmp byte [ebp - 3], 0
jne 0x661b15
cmp byte [ebp - 4], 0
jne 0x661b15
test al, al
je 0x661b18
or edx, 1
cmp byte [ebp - 3], 0
jne 0x661b41
test bl, bl
jne 0x661b41
cmp byte [ebp - 4], 0
jne 0x661b41
test al, al
jne 0x661b41
mov byte [esi + 0x3a0], 0
xor ecx, ecx
mov dword [esi + 0x398], ecx
mov dword [esi + 0x394], ecx
cmp byte [ebp - 2], 0
jne 0x661bb5
cmp byte [ebp - 3], 0
jne 0x661b62
test bl, bl
je 0x661b62
cmp dword [esi + 0x394], 0
jle 0x661b62
xor ecx, ecx
mov dword [esi + 0x394], ecx
test bl, bl
jne 0x661b7d
cmp byte [ebp - 3], 0
je 0x661b7d
cmp dword [esi + 0x394], 0
jge 0x661b7d
xor ecx, ecx
mov dword [esi + 0x394], ecx
test al, al
jne 0x661b98
cmp byte [ebp - 4], 0
je 0x661b98
cmp dword [esi + 0x398], 0
jle 0x661b98
xor ecx, ecx
mov dword [esi + 0x398], ecx
cmp byte [ebp - 4], 0
jne 0x661bf1
test al, al
je 0x661bf1
cmp dword [esi + 0x398], 0
jge 0x661bf1
xor ecx, ecx
mov dword [esi + 0x398], ecx
jmp 0x661bf1
test bl, bl
je 0x661bc3
mov dword [esi + 0x394], 0xffffffd8
cmp byte [ebp - 3], 0
je 0x661bd3
mov dword [esi + 0x394], 0x28
cmp byte [ebp - 4], 0
je 0x661be3
mov dword [esi + 0x398], 0xffffffd8
test al, al
je 0x661bf1
mov dword [esi + 0x398], 0x28
cmp byte [ebp - 3], 0
jne 0x661c09
test bl, bl
jne 0x661c09
cmp byte [ebp - 4], 0
jne 0x661c09
test al, al
je 0x661d05
test bl, bl
je 0x661c32
mov ecx, dword [esi + 0x394]
cmp ecx, 0xffffffe2
jle 0x661c32
test ecx, ecx
je 0x661c27
mov ecx, dword [esi + 0x394]
add ecx, 0xfffffffe
jmp 0x661c2c
mov ecx, 0xfffffffe
mov dword [esi + 0x394], ecx
cmp byte [ebp - 3], 0
je 0x661c5d
mov ecx, dword [esi + 0x394]
cmp ecx, 0x1e
jge 0x661c5d
test ecx, ecx
je 0x661c52
mov ecx, dword [esi + 0x394]
add ecx, 2
jmp 0x661c57
mov ecx, 2
mov dword [esi + 0x394], ecx
test bl, bl
jne 0x661c87
cmp byte [ebp - 3], 0
jne 0x661c87
cmp dword [esi + 0x394], 0
jle 0x661c78
dec dword [esi + 0x394]
jmp 0x661c87
cmp dword [esi + 0x394], 0
jge 0x661c87
inc dword [esi + 0x394]
cmp byte [ebp - 4], 0
je 0x661cb2
mov ecx, dword [esi + 0x398]
cmp ecx, 0xffffffe2
jle 0x661cb2
test ecx, ecx
je 0x661ca7
mov ecx, dword [esi + 0x398]
add ecx, 0xfffffffe
jmp 0x661cac
mov ecx, 0xfffffffe
mov dword [esi + 0x398], ecx
test al, al
je 0x661cdb
mov ecx, dword [esi + 0x398]
cmp ecx, 0x1e
jge 0x661cdb
test ecx, ecx
je 0x661cd0
mov ecx, dword [esi + 0x398]
add ecx, 2
jmp 0x661cd5
mov ecx, 2
mov dword [esi + 0x398], ecx
cmp byte [ebp - 4], 0
jne 0x661d05
test al, al
jne 0x661d05
cmp dword [esi + 0x398], 0
jle 0x661cf6
dec dword [esi + 0x398]
jmp 0x661d05
cmp dword [esi + 0x398], 0
jge 0x661d05
inc dword [esi + 0x398]
test edx, edx
je 0x661d3a
lea eax, [ebp - 0xc]
push eax
call sub.USER32.DLL_GetCursorPos
test eax, eax
je 0x661d33
mov edx, dword [esi + 0x398]
sar edx, 1
add edx, dword [ebp - 8]
push edx
mov eax, dword [esi + 0x394]
sar eax, 1
add eax, dword [ebp - 0xc]
push eax
call sub.USER32.DLL_SetCursorPos
mov byte [esi + 0x3a0], 1
call sub.KERNEL32.DLL_GetTickCount
mov dword [esi + 0x39c], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8