Function at 0x40c9f0
Capabilities:
Check for time delay via gettickcount
Get keyboard layout
Log keystrokes via polling

Disassembly:
sub esp, 0x88
push esi
mov esi, dword [esp + 0x9c]
test esi, esi
jg 0x40ca0c
mov eax, esi
pop esi
add esp, 0x88
ret
mov cl, byte [esp + 0x98]
xor eax, eax
test cl, 0xc0
je 0x40ca1f
mov eax, 8
test cl, 0xc
je 0x40ca27
or eax, 1
test cl, 0x30
je 0x40ca2f
or eax, 4
test cl, 3
je 0x40ca37
or eax, 2
or eax, dword [esp + 0x94]
mov dword [esp + 0x44], eax
xor eax, eax
mov dword [esp + 0x15], eax
mov dword [esp + 0x19], eax
push ebx
mov bl, byte [esp + 0x94]
test bl, bl
mov dword [esp + 0x21], eax
mov word [esp + 0x25], ax
mov byte [esp + 0x18], 0
mov byte [esp + 0x27], al
jge 0x40ca82
movzx ecx, bl
push ecx
push 0x45151c
lea edx, [esp + 0x20]
push 0x10
push edx
call fcn.0043c2b0
add esp, 0x10
mov al, byte [esp + 0x18]
test al, al
push ebp
push edi
jne 0x40cad4
sub ebx, 0x80
and ebx, 0xff
movzx ebp, byte [ebx + 0x45c5c0]
test ebp, ebp
je 0x40cdd1
cmp ebp, 0x20
jl 0x40cab8
cmp ebp, 0x80
jl 0x40cdd1
push 0xa
lea eax, [esp + 0x24]
push eax
push ebp
call fcn.004448ca
mov al, byte [esp + 0x2c]
add esp, 0xc
test al, al
je 0x40cdd1
test esi, esi
jle 0x40cb8a
mov ecx, dword [esp + 0xa8]
mov ebx, dword [esp + 0xb0]
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ebp, dword [sym.imp.USER32.dll_PeekMessageA]
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [esp + 0x14], ecx
call esi
sub eax, dword [0x45ef34]
cmp eax, 5
jbe 0x40cb41
push 0
push 0
push 0
push 0
lea edx, [esp + 0x70]
push edx
call ebp
test eax, eax
je 0x40cb3a
push 0
push 0xffffffffffffffff
mov byte [0x45b056], 0
call fcn.00401650
add esp, 8
mov byte [0x45b056], 1
call esi
mov dword [0x45ef34], eax
lea eax, [esp + 0x20]
push ebx
push eax
call fcn.0040bb40
mov eax, dword [0x45d620]
add esp, 8
test eax, eax
jl 0x40cb80
mov cl, byte [0x45f111]
test cl, cl
je 0x40cb67
push eax
call edi
jmp 0x40cb80
push 0
push eax
mov byte [0x45b056], 0
call fcn.00401650
add esp, 8
mov byte [0x45b056], 1
dec dword [esp + 0x14]
jne 0x40cb00
mov eax, dword [0x45d800]
test eax, eax
je 0x40cb9e
mov cl, byte [0x45d6fc]
jmp 0x40cdb6
mov al, byte [0x45f111]
test al, al
mov byte [esp + 0x12], 0
jne 0x40cc32
mov al, byte [0x45f112]
test al, al
jne 0x40cc32
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0xa0
call esi
test ah, ah
jns 0x40cbcf
mov byte [esp + 0x12], 0x10
push 0xa1
call esi
test ah, ah
jns 0x40cbdf
or byte [esp + 0x12], 0x20
push 0xa2
call esi
test ah, ah
jns 0x40cbef
or byte [esp + 0x12], 1
push 0xa3
call esi
test ah, ah
jns 0x40cbff
or byte [esp + 0x12], 2
push 0xa4
call esi
test ah, ah
jns 0x40cc0f
or byte [esp + 0x12], 4
push 0xa5
call esi
test ah, ah
jns 0x40cc1f
or byte [esp + 0x12], 8
push 0x5b
call esi
test ah, ah
jns 0x40cc2c
or byte [esp + 0x12], 0x40
push 0x5c
call esi
jmp 0x40ccad
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
call esi
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
test edx, edx
js 0x40cc51
push 0x10
call ebx
test ah, ah
jns 0x40cc56
mov byte [esp + 0x12], 0x10
push 0x11
call esi
movsx eax, ax
test eax, eax
js 0x40cc69
push 0x11
call ebx
test ah, ah
jns 0x40cc6e
or byte [esp + 0x12], 1
push 0x12
call esi
movsx ecx, ax
test ecx, ecx
js 0x40cc81
push 0x12
call ebx
test ah, ah
jns 0x40cc86
or byte [esp + 0x12], 4
push 0x5b
call esi
movsx edx, ax
test edx, edx
js 0x40cc99
push 0x5b
call ebx
test ah, ah
jns 0x40cc9e
or byte [esp + 0x12], 0x40
push 0x5c
call esi
movsx eax, ax
test eax, eax
js 0x40ccb1
push 0x5c
call ebx
test ah, ah
jns 0x40ccb6
or byte [esp + 0x12], 0x80
mov eax, dword [0x45d800]
test eax, eax
je 0x40cdb2
mov cl, byte [esp + 0x12]
mov al, byte [0x45d6fc]
not cl
and cl, al
je 0x40cdb2
mov bl, byte [0x45d6fd]
mov al, byte [0x45d6fe]
not cl
and bl, cl
mov byte [0x45d6fd], bl
and al, cl
mov dl, byte [0x45d6fc]
mov bl, al
shl bl, 7
mov byte [0x45d7a2], bl
mov bl, al
and bl, 0xfe
shl bl, 6
mov byte [0x45d7a3], bl
mov bl, al
and bl, 0xfc
shl bl, 5
mov byte [0x45d7a4], bl
mov bl, al
and bl, 0xf8
shl bl, 4
mov byte [0x45d7a5], bl
and dl, cl
mov bl, al
and bl, 0xc0
shl bl, 1
mov byte [0x45d6fc], dl
mov cl, al
mov dl, al
mov byte [0x45d75b], bl
mov byte [0x45d6fe], al
mov bl, 0x80
and al, bl
and cl, 0xf0
and dl, 0xe0
shl cl, 3
mov byte [0x45d75c], al
shl dl, 2
xor al, al
cmp cl, al
mov byte [0x45d7a0], cl
mov byte [0x45d7a1], dl
jne 0x40cd76
cmp dl, al
mov byte [0x45d710], al
je 0x40cd7c
mov byte [0x45d710], bl
cmp byte [0x45d7a2], al
jne 0x40cd91
cmp byte [0x45d7a3], al
mov byte [0x45d711], al
je 0x40cd97
mov byte [0x45d711], bl
cmp byte [0x45d7a4], al
jne 0x40cdac
cmp byte [0x45d7a5], al
mov byte [0x45d712], al
je 0x40cdb2
mov byte [0x45d712], bl
mov cl, byte [esp + 0x12]
mov eax, dword [esp + 0xa4]
mov byte [esp + 0x14], cl
mov edx, dword [esp + 0x14]
push 0xffc3d44d
push edx
push eax
jmp 0x40d2c1
mov eax, dword [0x45fcac]
test eax, eax
jne 0x40ce45
lea ecx, [esp + 0x54]
push ecx
mov dword [0x45fcac], 1
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
mov ebx, 1
xor edx, edx
mov dl, byte [ebx + 0x45c5b4]
push edx
call dword [sym.imp.USER32.dll_VkKeyScanA]
cmp ax, 0xffff
je 0x40ce1d
mov edi, 0x451518
lea esi, [esp + 0x5a]
mov ecx, 3
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x40ce24
mov byte [ebx + 0x45c5b4], 0x20
inc ebx
cmp ebx, 7
jle 0x40cdf4
mov edi, 0x451514
lea esi, [esp + 0x5a]
mov ecx, 3
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x40ce45
mov byte [0x45c5b8], 0x20
xor eax, eax
mov dword [esp + 0x41], eax
mov dword [esp + 0x45], eax
mov ecx, ebp
sar ecx, 4
mov bl, byte [ecx + 0x45c5b4]
cmp bl, 0x20
mov dword [esp + 0x49], eax
mov word [esp + 0x4d], ax
mov byte [esp + 0x40], 0
mov byte [esp + 0x4f], al
mov byte [esp + 0x12], al
mov byte [esp + 0x14], bl
je 0x40cebe
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.USER32.dll_VkKeyScanA]
cmp ax, 0xffff
jne 0x40ceb9
sub ebx, 0x80
and ebx, 0xff
movzx eax, byte [ebx + 0x45c5c0]
cmp eax, 0x20
jl 0x40cea9
cmp eax, 0x80
jl 0x40cebe
push 0xa
lea ecx, [esp + 0x44]
push ecx
push eax
call fcn.004448ca
add esp, 0xc
mov byte [esp + 0x12], 1
xor edx, edx
mov dword [esp + 0x31], edx
mov dword [esp + 0x35], edx
and ebp, 0xf
mov bl, byte [ebp + str._aAeEiIoOuUyYnN]
cmp bl, 0x20
mov dword [esp + 0x39], edx
mov word [esp + 0x3d], dx
mov byte [esp + 0x30], 0
mov byte [esp + 0x3f], dl
mov byte [esp + 0x13], dl
mov byte [esp + 0x1c], bl
je 0x40cf35
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
cmp ax, 0xffff
jne 0x40cf30
sub ebx, 0x80
and ebx, 0xff
movzx eax, byte [ebx + 0x45c5c0]
cmp eax, 0x20
jl 0x40cf20
cmp eax, 0x80
jl 0x40cf35
push 0xa
lea ecx, [esp + 0x34]
push ecx
push eax
call fcn.004448ca
add esp, 0xc
mov byte [esp + 0x13], 1
mov al, byte [esp + 0x12]
test al, al
jne 0x40cf52
mov al, byte [esp + 0x13]
test al, al
jne 0x40cf52
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x88
ret
mov eax, dword [esp + 0xa8]
test eax, eax
jle 0x40d063
mov edi, dword [esp + 0xb0]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ebp, dword [sym.imp.USER32.dll_PeekMessageA]
mov esi, dword [esp + 0x50]
mov edx, eax
mov dword [esp + 0x18], edx
mov edi, edi
call ebx
sub eax, dword [0x45ef34]
cmp eax, 5
jbe 0x40cfc4
push 0
push 0
push 0
push 0
lea eax, [esp + 0x8c]
push eax
call ebp
test eax, eax
je 0x40cfbd
push 0
push 0xffffffffffffffff
mov byte [0x45b056], 0
call fcn.00401650
add esp, 8
mov byte [0x45b056], 1
call ebx
mov dword [0x45ef34], eax
mov al, byte [esp + 0x12]
test al, al
je 0x40cff4
mov al, byte [esp + 0x40]
test al, al
push edi
je 0x40cfe4
lea ecx, [esp + 0x44]
push ecx
call fcn.0040bb40
add esp, 8
jmp 0x40cff4
mov edx, dword [esp + 0x18]
push 2
push esi
push edx
call fcn.0040c710
add esp, 0x10
mov al, byte [esp + 0x13]
test al, al
je 0x40d024
mov al, byte [esp + 0x30]
test al, al
push edi
je 0x40d014
lea eax, [esp + 0x34]
push eax
call fcn.0040bb40
add esp, 8
jmp 0x40d024
mov ecx, dword [esp + 0x20]
push 2
push esi
push ecx
call fcn.0040c710
add esp, 0x10
mov eax, dword [0x45d620]
test eax, eax
jl 0x40d059
mov cl, byte [0x45f111]
test cl, cl
je 0x40d040
push eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x40d059
push 0
push eax
mov byte [0x45b056], 0
call fcn.00401650
add esp, 8
mov byte [0x45b056], 1
dec dword [esp + 0x18]
jne 0x40cf80
mov eax, dword [0x45d800]
test eax, eax
je 0x40d077
mov dl, byte [0x45d6fc]
jmp 0x40d2ab
mov al, byte [0x45f111]
xor bl, bl
test al, al
mov byte [esp + 0x12], bl
jne 0x40d120
mov al, byte [0x45f112]
test al, al
jne 0x40d120
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0xa0
call esi
test ah, ah
jns 0x40d0ae
mov bl, 0x10
mov byte [esp + 0x12], bl
push 0xa1
call esi
test ah, ah
jns 0x40d0c0
or bl, 0x20
mov byte [esp + 0x12], bl
push 0xa2
call esi
test ah, ah
jns 0x40d0d2
or bl, 1
mov byte [esp + 0x12], bl
push 0xa3
call esi
test ah, ah
jns 0x40d0e4
or bl, 2
mov byte [esp + 0x12], bl
push 0xa4
call esi
test ah, ah
jns 0x40d0f6
or bl, 4
mov byte [esp + 0x12], bl
push 0xa5
call esi
test ah, ah
jns 0x40d108
or bl, 8
mov byte [esp + 0x12], bl
push 0x5b
call esi
test ah, ah
jns 0x40d117
or bl, 0x40
mov byte [esp + 0x12], bl
push 0x5c
call esi
jmp 0x40d1a2
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
call esi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
js 0x40d13f
push 0x10
call edi
test ah, ah
jns 0x40d145
mov bl, 0x10
mov byte [esp + 0x12], bl
push 0x11
call esi
movsx ecx, ax
test ecx, ecx
js 0x40d158
push 0x11
call edi
test ah, ah
jns 0x40d15f
or bl, 1
mov byte [esp + 0x12], bl
push 0x12
call esi
movsx edx, ax
test edx, edx
js 0x40d172
push 0x12
call edi
test ah, ah
jns 0x40d179
or bl, 4
mov byte [esp + 0x12], bl
push 0x5b
call esi
movsx eax, ax
test eax, eax
js 0x40d18c
push 0x5b
call edi
test ah, ah
jns 0x40d193
or bl, 0x40
mov byte [esp + 0x12], bl
push 0x5c
call esi
movsx ecx, ax
test ecx, ecx
js 0x40d1a6
push 0x5c
call edi
test ah, ah
jns 0x40d1ad
or bl, 0x80
mov byte [esp + 0x12], bl
mov eax, dword [0x45d800]
test eax, eax
je 0x40d2a7
mov al, byte [0x45d6fc]
mov cl, bl
not cl
and cl, al
je 0x40d2a7
mov bl, byte [0x45d6fd]
mov al, byte [0x45d6fe]
not cl
and bl, cl
mov byte [0x45d6fd], bl
and al, cl
mov dl, byte [0x45d6fc]
mov bl, al
shl bl, 7
mov byte [0x45d7a2], bl
mov bl, al
and bl, 0xfe
shl bl, 6
mov byte [0x45d7a3], bl
mov bl, al
and bl, 0xfc
shl bl, 5
mov byte [0x45d7a4], bl
mov bl, al
and bl, 0xf8
shl bl, 4
mov byte [0x45d7a5], bl
and dl, cl
mov bl, al
and bl, 0xc0
shl bl, 1
mov byte [0x45d6fc], dl
mov cl, al
mov dl, al
mov byte [0x45d75b], bl
mov byte [0x45d6fe], al
mov bl, 0x80
and al, bl
and cl, 0xf0
and dl, 0xe0
shl cl, 3
mov byte [0x45d75c], al
shl dl, 2
xor al, al
cmp cl, al
mov byte [0x45d7a0], cl
mov byte [0x45d7a1], dl
jne 0x40d26b
cmp dl, al
mov byte [0x45d710], al
je 0x40d271
mov byte [0x45d710], bl
cmp byte [0x45d7a2], al
jne 0x40d286
cmp byte [0x45d7a3], al
mov byte [0x45d711], al
je 0x40d28c
mov byte [0x45d711], bl
cmp byte [0x45d7a4], al
jne 0x40d2a1
cmp byte [0x45d7a5], al
mov byte [0x45d712], al
je 0x40d2a7
mov byte [0x45d712], bl
mov dl, byte [esp + 0x12]
mov ecx, dword [esp + 0xa4]
mov byte [esp + 0x18], dl
mov eax, dword [esp + 0x18]
push 0xffc3d44d
push eax
push ecx
call fcn.0040b420
mov eax, dword [esp + 0xb4]
add esp, 0xc
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x88
ret