Function at 0x14004fd70
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x1401385c0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov r14d, r9d
mov rdi, r8
mov qword [rsp + 0x48], rdx
mov rbx, rcx
mov qword [rsp + 0x50], rdx
mov r15, qword [rsp + 0x120]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x58], r15
mov dword [rsp + 0x38], 1
mov rax, qword [0x1401380e0]
mov qword [rsp + 0x30], rax
mov edx, r9d
call fcn.140054580
test eax, eax
jne 0x14004fdf4
lea rcx, [rsp + 0x30]
call fcn.1400471b0
xor eax, eax
jmp 0x1400508cf
lea rdx, str._lst_name_
lea rcx, [rsp + 0x30]
call fcn.140047490
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140047490
lea rdx, str.__type_
lea rcx, [rsp + 0x30]
call fcn.140047490
cmp r14d, 0x2000
jg 0x14004fe8d
je 0x14004fe84
cmp r14d, 0x1000
je 0x14004fe65
jle case.default.0x14004feb1
cmp r14d, 0x1003
jle 0x14004fe5c
cmp r14d, 0x1004
jne case.default.0x14004feb1
lea rdx, str.InternalWMRecord
jmp 0x14004fe6c
lea rdx, str.ScheduleTime
jmp 0x14004fe6c
lea rdx, str.KeywordRecord
lea rcx, [rsp + 0x30]
call fcn.140047490
lea r12, [0x140000000]
xor esi, esi
jmp 0x14004ff57
lea r12, [0x140000000]
jmp case.0x14004feb1.8195
lea eax, [r14 - 0x2001]
cmp eax, 0x14
ja case.default.0x14004feb1
cdqe
lea r12, [0x140000000]
mov eax, dword [r12 + rax*4 + 0x508f4]
add rax, r12
jmp rax
lea rdx, str.char__
lea rcx, [rsp + 0x30]
call fcn.140047490
xor esi, esi
jmp 0x14004ff57
lea rdx, str.BlockIMRecord
lea rcx, [rsp + 0x30]
call fcn.140047490
xor esi, esi
jmp 0x14004ff57
lea rdx, str.PortRange
lea rcx, [rsp + 0x30]
call fcn.140047490
xor esi, esi
jmp 0x14004ff57
lea rdx, str.KeyEventDef
lea rcx, [rsp + 0x30]
call fcn.140047490
jmp 0x14004fe7d
lea rdx, str.EmailRule
lea rcx, [rsp + 0x30]
call fcn.140047490
jmp 0x14004fe7d
lea rdx, str.EmailLastRecvTime
lea rcx, [rsp + 0x30]
call fcn.140047490
jmp 0x14004fe7d
lea rdx, str.ChromeSigs
lea rcx, [rsp + 0x30]
call fcn.140047490
jmp case.0x14004feb1.8194
lea r12, [0x140000000]
xor esi, esi
mov dword [rsp + 0x38], esi
lea rdx, [0x1400ebb04]
lea rcx, [rsp + 0x30]
call fcn.140047490
mov rcx, r15
call fcn.140040fe0
nop
mov rcx, r15
call fcn.1400413a0
mov r13, rax
nop dword [rax]
test r13, r13
je 0x140050889
mov rcx, r13
call fcn.140041390
mov rdi, rax
test rax, rax
je case.0x14005025d.8194
cmp r14d, 0x2000
jg 0x140050240
je case.0x14005025d.8195
cmp r14d, 0x1000
je 0x1400501e1
jle case.0x14005025d.8194
cmp r14d, 0x1003
jle 0x1400500ba
cmp r14d, 0x1004
jne case.0x14005025d.8194
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.140047490
lea rdx, [0x1401066d8]
mov rcx, rdi
call fcn.14006138c
mov r15, rax
test rax, rax
je 0x14005009f
mov byte [rax], 0
mov r10, qword [rbx]
mov qword [rsp + 0x20], rsi
mov r9, rdi
lea r8, str.Package
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r10 + 0x130]
mov byte [r15], 0x2c
lea rdx, [0x1401066d8]
lea rcx, [r15 + 1]
call fcn.14006138c
mov rdi, rax
test rax, rax
je 0x14005009f
mov byte [rax], 0
cmp byte [r15 + 1], 0
je 0x140050075
mov r10, qword [rbx]
mov qword [rsp + 0x20], rsi
lea r9, [r15 + 1]
lea r8, [0x1400ecc48]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r10 + 0x130]
mov byte [rdi], 0x2c
cmp byte [rdi + 1], 0
je 0x14005009f
mov rax, qword [rbx]
mov qword [rsp + 0x20], rsi
lea r9, [rdi + 1]
lea r8, str.Host
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
lea rdx, str.__struct_
lea rcx, [rsp + 0x30]
call fcn.140047490
mov r15, qword [rsp + 0x40]
jmp case.0x14005025d.8194
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.140047490
lea rdx, str._struct_name_Start__type_TimePeriod__
lea rcx, [rsp + 0x30]
call fcn.140047490
mov rax, qword [rbx]
mov r9d, dword [rdi]
and r9d, 0x3f
lea r8, str.Minute
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi]
shr r9d, 6
and r9d, 0x1f
lea r8, str.Hour
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi]
shr r9d, 0xb
and r9d, 7
lea r8, [0x1400ecbd0]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
lea rdx, str.__struct_
lea rcx, [rsp + 0x30]
call fcn.140047490
lea rdx, str._struct_name_Stop__type_TimePeriod__
lea rcx, [rsp + 0x30]
call fcn.140047490
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
and r9d, 0x3f
lea r8, str.Minute
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
shr r9d, 6
and r9d, 0x1f
lea r8, str.Hour
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
shr r9d, 0xb
and r9d, 7
lea r8, [0x1400ecbd0]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
lea rdx, str.__struct_
lea rcx, [rsp + 0x30]
call fcn.140047490
jmp 0x140050865
mov rdi, qword [rax + 8]
test rdi, rdi
je case.0x14005025d.8194
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.140047490
mov rax, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.WholeWord
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
lea r9, [rdi + 4]
mov qword [rsp + 0x20], rsi
lea r8, str.szKeyword
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
jmp 0x140050865
lea eax, [r14 - 0x2001]
cmp eax, 0x14
ja case.0x14005025d.8194
cdqe
mov ecx, dword [r12 + rax*4 + 0x50948]
add rcx, r12
jmp rcx
mov rax, qword [rbx]
mov qword [rsp + 0x20], rsi
mov r9, rdi
lea r8, [0x140105e08]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
jmp case.0x14005025d.8194
mov rdi, qword [rdi + 8]
test rdi, rdi
je case.0x14005025d.8194
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.140047490
mov rax, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.imFlags
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
lea r9, [rdi + 4]
mov qword [rsp + 0x20], rsi
lea r8, str.szName
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
jmp 0x140050865
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.140047490
mov rax, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.From
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
lea r8, [0x1400be930]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov r9d, dword [rdi + 8]
lea r8, str.SelectID
jmp 0x140050854
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.140047490
mov rax, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.vKey
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
lea r8, str.lParam
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
xor eax, eax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
lea r8d, [rax + 0x40]
lea rdx, [rsp + 0x70]
mov ecx, dword [rdi + 4]
call qword [sym.imp.USER32.dll_GetKeyNameTextA]
mov rax, qword [rbx]
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x70]
lea r8, str.Description
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
jmp 0x140050865
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.140047490
mov rax, qword [rbx]
mov qword [rsp + 0x20], 0x100
mov r9, rdi
lea r8, str.Name
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x100]
lea r8, str.Record
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x104]
lea r8, str.Sent
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x108]
lea r8, str.Received
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x10c]
lea r8, str.SMTPPOP
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x110]
lea r8, str.WebMail
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x114]
lea r8, [0x1400bda00]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x118]
lea r8, str.MAPI
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x11c]
lea r8, str.IMAP
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x124]
lea r8, str.PlainText
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x128]
lea r8, str.HTML
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x12c]
lea r8, [0x1400e7a1c]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x130]
lea r8, [0x1400be970]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x134]
lea r8, str.NoAttachments
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x138]
lea r8, str.AttachmentFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x13c]
lea r8, str.AttachmentFilterSize
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x140]
lea r8, str.ToFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
lea r9, [rdi + 0x144]
mov qword [rsp + 0x20], 0x100
lea r8, str.ToFilterString
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x244]
lea r8, str.FromFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
lea r9, [rdi + 0x248]
mov qword [rsp + 0x20], 0x100
lea r8, str.FromFilterString
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x348]
lea r8, str.SubjectFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
lea r9, [rdi + 0x34c]
mov qword [rsp + 0x20], 0x100
lea r8, str.SubjectFilterString
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x44c]
lea r8, str.BodyFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
lea r9, [rdi + 0x450]
mov qword [rsp + 0x20], 0x100
lea r8, str.BodyFilterString
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
jmp 0x140050865
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.140047490
mov rax, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.RcvdTimeLow
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
lea r8, str.RcvdTimeHigh
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
lea r9, [rdi + 8]
mov qword [rsp + 0x20], gethostbyname
lea r8, str.MSG_Owner
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
jmp 0x140050865
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.140047490
mov rax, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.ProductVersionMS
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
lea r8, str.ProductVersionLS
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 8]
lea r8, str.NameOffsetFromThis
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x10]
lea r8, str.ShouldDisplayInExtensionSettingsAddressLow
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x14]
lea r8, str.ShouldDisplayInExtensionSettingsAddressHigh
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x18]
lea r8, str.ToolbarFunctionToDetourAddressLow
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov r9d, dword [rdi + 0x1c]
lea r8, str.ToolbarFunctionToDetourAddressHigh
mov rax, qword [rbx]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
lea rdx, str.__struct_
lea rcx, [rsp + 0x30]
call fcn.140047490
mov rdx, r13
mov rcx, r15
call fcn.140041400
mov r13, rax
jmp 0x14004ff80
mov rbx, qword [rsp + 0x48]
jmp 0x14005089a
mov rcx, r15
call fcn.1400414e0
lea rdx, str.__lst_
lea rcx, [rsp + 0x30]
call fcn.140047490
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140047430
nop
lea rcx, [rsp + 0x30]
call fcn.1400471b0
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14005f0d0
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret