Function at 0x14004e220
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x140132280]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov r14d, r9d
mov rdi, r8
mov qword [rsp + 0x48], rdx
mov rbx, rcx
mov qword [rsp + 0x50], rdx
mov r15, qword [rsp + 0x120]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x58], r15
mov dword [rsp + 0x38], 1
mov rax, qword [0x1401319e0]
mov qword [rsp + 0x30], rax
mov edx, r9d
call fcn.140053070
test eax, eax
jne 0x14004e2a4
lea rcx, [rsp + 0x30]
call fcn.1400446d0
xor eax, eax
jmp 0x14004ed7f
lea rdx, str._lst_name_
lea rcx, [rsp + 0x30]
call fcn.1400449b0
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1400449b0
lea rdx, str.__type_
lea rcx, [rsp + 0x30]
call fcn.1400449b0
cmp r14d, 0x2000
jg 0x14004e33d
je 0x14004e334
cmp r14d, 0x1000
je 0x14004e315
jle case.default.0x14004e361
cmp r14d, 0x1003
jle 0x14004e30c
cmp r14d, 0x1004
jne case.default.0x14004e361
lea rdx, str.InternalWMRecord
jmp 0x14004e31c
lea rdx, str.ScheduleTime
jmp 0x14004e31c
lea rdx, str.KeywordRecord
lea rcx, [rsp + 0x30]
call fcn.1400449b0
lea r12, [0x140000000]
xor esi, esi
jmp 0x14004e407
lea r12, [0x140000000]
jmp case.0x14004e361.8195
lea eax, [r14 - 0x2001]
cmp eax, 0x14
ja case.default.0x14004e361
cdqe
lea r12, [0x140000000]
mov eax, dword [r12 + rax*4 + 0x4eda4]
add rax, r12
jmp rax
lea rdx, str.char__
lea rcx, [rsp + 0x30]
call fcn.1400449b0
xor esi, esi
jmp 0x14004e407
lea rdx, str.BlockIMRecord
lea rcx, [rsp + 0x30]
call fcn.1400449b0
xor esi, esi
jmp 0x14004e407
lea rdx, str.PortRange
lea rcx, [rsp + 0x30]
call fcn.1400449b0
xor esi, esi
jmp 0x14004e407
lea rdx, str.KeyEventDef
lea rcx, [rsp + 0x30]
call fcn.1400449b0
jmp 0x14004e32d
lea rdx, str.EmailRule
lea rcx, [rsp + 0x30]
call fcn.1400449b0
jmp 0x14004e32d
lea rdx, str.EmailLastRecvTime
lea rcx, [rsp + 0x30]
call fcn.1400449b0
jmp 0x14004e32d
lea rdx, str.ChromeSigs
lea rcx, [rsp + 0x30]
call fcn.1400449b0
jmp case.0x14004e361.8194
lea r12, [0x140000000]
xor esi, esi
mov dword [rsp + 0x38], esi
lea rdx, [0x1400d34cc]
lea rcx, [rsp + 0x30]
call fcn.1400449b0
mov rcx, r15
call fcn.140043a20
nop
mov rcx, r15
call fcn.140043de0
mov r13, rax
nop dword [rax]
test r13, r13
je 0x14004ed39
mov rcx, r13
call fcn.140043dd0
mov rdi, rax
test rax, rax
je case.0x14004e70d.8194
cmp r14d, 0x2000
jg 0x14004e6f0
je case.0x14004e70d.8195
cmp r14d, 0x1000
je 0x14004e691
jle case.0x14004e70d.8194
cmp r14d, 0x1003
jle 0x14004e56a
cmp r14d, 0x1004
jne case.0x14004e70d.8194
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.1400449b0
lea rdx, [0x140103508]
mov rcx, rdi
call fcn.1400650cc
mov r15, rax
test rax, rax
je 0x14004e54f
mov byte [rax], 0
mov r10, qword [rbx]
mov qword [rsp + 0x20], rsi
mov r9, rdi
lea r8, str.Package
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r10 + 0x130]
mov byte [r15], 0x2c
lea rdx, [0x140103508]
lea rcx, [r15 + 1]
call fcn.1400650cc
mov rdi, rax
test rax, rax
je 0x14004e54f
mov byte [rax], 0
cmp byte [r15 + 1], 0
je 0x14004e525
mov r10, qword [rbx]
mov qword [rsp + 0x20], rsi
lea r9, [r15 + 1]
lea r8, [0x1400d45e8]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r10 + 0x130]
mov byte [rdi], 0x2c
cmp byte [rdi + 1], 0
je 0x14004e54f
mov rax, qword [rbx]
mov qword [rsp + 0x20], rsi
lea r9, [rdi + 1]
lea r8, str.Host
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
lea rdx, str.__struct_
lea rcx, [rsp + 0x30]
call fcn.1400449b0
mov r15, qword [rsp + 0x40]
jmp case.0x14004e70d.8194
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.1400449b0
lea rdx, str._struct_name_Start__type_TimePeriod__
lea rcx, [rsp + 0x30]
call fcn.1400449b0
mov rax, qword [rbx]
mov r9d, dword [rdi]
and r9d, 0x3f
lea r8, str.Minute
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi]
shr r9d, 6
and r9d, 0x1f
lea r8, str.Hour
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi]
shr r9d, 0xb
and r9d, 7
lea r8, [0x1400d4570]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
lea rdx, str.__struct_
lea rcx, [rsp + 0x30]
call fcn.1400449b0
lea rdx, str._struct_name_Stop__type_TimePeriod__
lea rcx, [rsp + 0x30]
call fcn.1400449b0
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
and r9d, 0x3f
lea r8, str.Minute
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
shr r9d, 6
and r9d, 0x1f
lea r8, str.Hour
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
shr r9d, 0xb
and r9d, 7
lea r8, [0x1400d4570]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
lea rdx, str.__struct_
lea rcx, [rsp + 0x30]
call fcn.1400449b0
jmp 0x14004ed15
mov rdi, qword [rax + 8]
test rdi, rdi
je case.0x14004e70d.8194
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.1400449b0
mov rax, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.WholeWord
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
lea r9, [rdi + 4]
mov qword [rsp + 0x20], rsi
lea r8, [0x1400cf900]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
jmp 0x14004ed15
lea eax, [r14 - 0x2001]
cmp eax, 0x14
ja case.0x14004e70d.8194
cdqe
mov ecx, dword [r12 + rax*4 + 0x4edf8]
add rcx, r12
jmp rcx
mov rax, qword [rbx]
mov qword [rsp + 0x20], rsi
mov r9, rdi
lea r8, [0x140102c40]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
jmp case.0x14004e70d.8194
mov rdi, qword [rdi + 8]
test rdi, rdi
je case.0x14004e70d.8194
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.1400449b0
mov rax, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.imFlags
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
lea r9, [rdi + 4]
mov qword [rsp + 0x20], rsi
lea r8, str.szName
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
jmp 0x14004ed15
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.1400449b0
mov rax, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.From
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
lea r8, [0x1400cfe80]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov r9d, dword [rdi + 8]
lea r8, str.SelectID
jmp 0x14004ed04
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.1400449b0
mov rax, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.vKey
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
lea r8, str.lParam
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
xor eax, eax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
lea r8d, [rax + 0x40]
lea rdx, [rsp + 0x70]
mov ecx, dword [rdi + 4]
call qword [sym.imp.USER32.dll_GetKeyNameTextA]
mov rax, qword [rbx]
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x70]
lea r8, str.Description
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
jmp 0x14004ed15
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.1400449b0
mov rax, qword [rbx]
mov qword [rsp + 0x20], 0x100
mov r9, rdi
lea r8, str.Name
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x100]
lea r8, str.Record
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x104]
lea r8, str.Sent
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x108]
lea r8, str.Received
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x10c]
lea r8, str.SMTPPOP
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x110]
lea r8, str.WebMail
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x114]
lea r8, [0x1400d2020]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x118]
lea r8, str.MAPI
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x11c]
lea r8, str.IMAP
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x124]
lea r8, str.PlainText
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x128]
lea r8, str.HTML
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x12c]
lea r8, [0x1400cf3b0]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x130]
lea r8, [0x1400cf3c0]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x134]
lea r8, str.NoAttachments
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x138]
lea r8, str.AttachmentFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x13c]
lea r8, str.AttachmentFilterSize
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x140]
lea r8, str.ToFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
lea r9, [rdi + 0x144]
mov qword [rsp + 0x20], 0x100
lea r8, str.ToFilterString
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x244]
lea r8, str.FromFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
lea r9, [rdi + 0x248]
mov qword [rsp + 0x20], 0x100
lea r8, str.FromFilterString
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x348]
lea r8, str.SubjectFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
lea r9, [rdi + 0x34c]
mov qword [rsp + 0x20], 0x100
lea r8, str.SubjectFilterString
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x44c]
lea r8, str.BodyFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
lea r9, [rdi + 0x450]
mov qword [rsp + 0x20], 0x100
lea r8, str.BodyFilterString
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
jmp 0x14004ed15
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.1400449b0
mov rax, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.RcvdTimeLow
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
lea r8, str.RcvdTimeHigh
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
lea r9, [rdi + 8]
mov qword [rsp + 0x20], gethostname
lea r8, str.MSG_Owner
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
jmp 0x14004ed15
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.1400449b0
mov rax, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.ProductVersionMS
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
lea r8, str.ProductVersionLS
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 8]
lea r8, str.NameOffsetFromThis
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x10]
lea r8, str.ShouldDisplayInExtensionSettingsAddressLow
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x14]
lea r8, str.ShouldDisplayInExtensionSettingsAddressHigh
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x18]
lea r8, str.ToolbarFunctionToDetourAddressLow
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov r9d, dword [rdi + 0x1c]
lea r8, str.ToolbarFunctionToDetourAddressHigh
mov rax, qword [rbx]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
lea rdx, str.__struct_
lea rcx, [rsp + 0x30]
call fcn.1400449b0
mov rdx, r13
mov rcx, r15
call fcn.140043e40
mov r13, rax
jmp 0x14004e430
mov rbx, qword [rsp + 0x48]
jmp 0x14004ed4a
mov rcx, r15
call fcn.140043f20
lea rdx, str.__lst_
lea rcx, [rsp + 0x30]
call fcn.1400449b0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140044950
nop
lea rcx, [rsp + 0x30]
call fcn.1400446d0
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140063ed0
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret