Function at 0x140098510
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov r12d, r9d
mov rsi, r8
mov qword [rsp + 0x40], rdx
mov rbx, rcx
mov qword [rsp + 0x58], rdx
mov rdi, qword [rsp + 0x120]
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x38], 1
mov rax, qword [0x140160e18]
mov qword [rsp + 0x30], rax
mov edx, r9d
call fcn.140097100
test eax, eax
jne 0x140098594
lea rcx, [rsp + 0x30]
call fcn.14002d2c0
xor eax, eax
jmp 0x14009905c
lea rdx, str._lst_name_
lea rcx, [rsp + 0x30]
call fcn.14002d580
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.14002d580
lea rdx, str.__type_
lea rcx, [rsp + 0x30]
call fcn.14002d580
cmp r12d, 0x2000
jg 0x14009867f
cmp r12d, 0x2000
je 0x140098676
cmp r12d, 0x1000
je 0x140098657
cmp r12d, 0x1000
jle 0x14009864b
cmp r12d, 0x1002
jle 0x14009862c
cmp r12d, 0x1003
jne 0x140098620
lea rdx, str.InternalWMRecord
lea rcx, [rsp + 0x30]
call fcn.14002d580
lea r14, [0x140000000]
xor esi, esi
jmp 0x140098731
lea r14, [0x140000000]
jmp case.0x1400986a4.8194
lea rdx, str.ScheduleTime
lea rcx, [rsp + 0x30]
call fcn.14002d580
lea r14, [0x140000000]
xor esi, esi
jmp 0x140098731
lea r14, [0x140000000]
jmp case.0x1400986a4.8194
lea rdx, str.KeywordRecord
lea rcx, [rsp + 0x30]
call fcn.14002d580
lea r14, [0x140000000]
xor esi, esi
jmp 0x140098731
lea r14, [0x140000000]
jmp case.0x1400986a4.8195
lea eax, [r12 - 0x2001]
cmp eax, 0xd
ja case.default.0x1400986a4
cdqe
lea r14, [0x140000000]
mov eax, dword [r14 + rax*4 + 0x99080]
add rax, r14
jmp rax
lea rdx, str.char__
lea rcx, [rsp + 0x30]
call fcn.14002d580
xor esi, esi
jmp 0x140098731
lea rdx, str.BlockIMRecord
lea rcx, [rsp + 0x30]
call fcn.14002d580
xor esi, esi
jmp 0x140098731
lea rdx, str.PortRange
lea rcx, [rsp + 0x30]
call fcn.14002d580
xor esi, esi
jmp 0x140098731
lea rdx, str.KeyEventDef
lea rcx, [rsp + 0x30]
call fcn.14002d580
xor esi, esi
jmp 0x140098731
lea rdx, str.EmailRule
lea rcx, [rsp + 0x30]
call fcn.14002d580
xor esi, esi
jmp 0x140098731
lea rdx, str.EmailLastRecvTime
lea rcx, [rsp + 0x30]
call fcn.14002d580
xor esi, esi
jmp 0x140098731
lea r14, [0x140000000]
xor esi, esi
mov dword [rsp + 0x38], esi
lea rdx, [0x140106d9c]
lea rcx, [rsp + 0x30]
call fcn.14002d580
mov rcx, rdi
call fcn.1400389c0
nop
mov rcx, rdi
call fcn.140039050
mov r15, rax
test r15, r15
je 0x140099016
mov rcx, r15
call fcn.140038640
mov rdi, rax
test rax, rax
je case.0x140098a4a.8194
cmp r12d, 0x2000
jg 0x140098a2c
cmp r12d, 0x2000
je case.0x140098a4a.8195
cmp r12d, 0x1000
je 0x1400989c8
cmp r12d, 0x1000
jle case.0x140098a4a.8194
cmp r12d, 0x1002
jle 0x14009888b
cmp r12d, 0x1003
jne case.0x140098a4a.8194
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.14002d580
lea rdx, [0x1400f076c]
mov rcx, rdi
call fcn.1400c2e00
mov r13, rax
test rax, rax
je 0x140098875
mov byte [rax], 0
mov r10, qword [rbx]
mov dword [rsp + 0x20], esi
mov r9, rdi
lea r8, str.Package
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r10 + 0x160]
mov byte [r13], 0x2c
lea rdx, [0x1400f076c]
lea rcx, [r13 + 1]
call fcn.1400c2e00
mov rdi, rax
test rax, rax
je 0x140098875
mov byte [rax], 0
mov r10, qword [rbx]
mov dword [rsp + 0x20], esi
lea r9, [r13 + 1]
lea r8, [0x140107cf4]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r10 + 0x160]
mov byte [rdi], 0x2c
mov r10, qword [rbx]
mov dword [rsp + 0x20], esi
lea r9, [rdi + 1]
lea r8, str.Host
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r10 + 0x160]
lea rdx, str.__struct_
lea rcx, [rsp + 0x30]
call fcn.14002d580
jmp case.0x140098a4a.8194
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.14002d580
lea rdx, str._struct_name_Start__type_TimePeriod__
lea rcx, [rsp + 0x30]
call fcn.14002d580
mov r11, qword [rbx]
mov r9d, dword [rdi]
and r9d, 0x3f
lea r8, str.Minute
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x158]
mov r11, qword [rbx]
mov r9d, dword [rdi]
shr r9d, 6
and r9d, 0x1f
lea r8, str.Hour
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x158]
mov r11, qword [rbx]
mov r9d, dword [rdi]
shr r9d, 0xb
and r9d, 7
lea r8, [0x140106d54]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x158]
lea rdx, str.__struct_
lea rcx, [rsp + 0x30]
call fcn.14002d580
lea rdx, str._struct_name_Stop__type_TimePeriod__
lea rcx, [rsp + 0x30]
call fcn.14002d580
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
and r9d, 0x3f
lea r8, str.Minute
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x158]
mov r11, qword [rbx]
mov r9d, dword [rdi + 4]
shr r9d, 6
and r9d, 0x1f
lea r8, str.Hour
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x158]
mov r11, qword [rbx]
mov r9d, dword [rdi + 4]
shr r9d, 0xb
and r9d, 7
lea r8, [0x140106d54]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x158]
lea rdx, str.__struct_
lea rcx, [rsp + 0x30]
call fcn.14002d580
lea rdx, str.__struct_
lea rcx, [rsp + 0x30]
call fcn.14002d580
jmp case.0x140098a4a.8194
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.14002d580
mov r11, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.WholeWord
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x158]
mov r11, qword [rbx]
lea r9, [rdi + 4]
mov dword [rsp + 0x20], esi
lea r8, [0x140107cd0]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x160]
lea rdx, str.__struct_
lea rcx, [rsp + 0x30]
call fcn.14002d580
jmp case.0x140098a4a.8194
lea eax, [r12 - 0x2001]
cmp eax, 0xd
ja case.0x140098a4a.8194
cdqe
mov ecx, dword [r14 + rax*4 + 0x990b8]
add rcx, r14
jmp rcx
mov rax, qword [rbx]
mov dword [rsp + 0x20], esi
mov r9, rdi
lea r8, [0x1400e4ec8]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x160]
jmp case.0x140098a4a.8194
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.14002d580
mov r11, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.imFlags
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x158]
mov r11, qword [rbx]
lea r9, [rdi + 4]
mov dword [rsp + 0x20], esi
lea r8, str.szName
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x160]
lea rdx, str.__struct_
lea rcx, [rsp + 0x30]
call fcn.14002d580
jmp case.0x140098a4a.8194
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.14002d580
mov r11, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.From
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x158]
mov r11, qword [rbx]
mov r9d, dword [rdi + 4]
lea r8, [0x140107cb4]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x158]
mov r11, qword [rbx]
mov r9d, dword [rdi + 8]
lea r8, str.SelectID
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x158]
lea rdx, str.__struct_
lea rcx, [rsp + 0x30]
call fcn.14002d580
jmp case.0x140098a4a.8194
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.14002d580
mov r11, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.vKey
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x158]
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
lea r8, str.lParam
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x158]
mov byte [rsp + 0x70], 0
xor eax, eax
mov qword [rsp + 0x71], rax
mov qword [rsp + 0x79], rax
mov qword [rsp + 0x81], rax
mov qword [rsp + 0x89], rax
mov qword [rsp + 0x91], rax
mov qword [rsp + 0x99], rax
mov qword [rsp + 0xa1], rax
mov dword [rsp + 0xa9], eax
mov word [rsp + 0xad], ax
mov byte [rsp + 0xaf], al
lea r8d, [rax + 0x40]
lea rdx, [rsp + 0x70]
mov ecx, dword [rdi + 4]
call qword [sym.imp.USER32.dll_GetKeyNameTextA]
mov r11, qword [rbx]
mov dword [rsp + 0x20], esi
lea r9, [rsp + 0x70]
lea r8, str.Description
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x160]
lea rdx, str.__struct_
lea rcx, [rsp + 0x30]
call fcn.14002d580
jmp case.0x140098a4a.8194
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.14002d580
mov r11, qword [rbx]
mov dword [rsp + 0x20], 0x100
mov r9, rdi
lea r8, str.Name
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x160]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x100]
lea r8, str.Record
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x158]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x104]
lea r8, str.Sent
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x158]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x108]
lea r8, str.Received
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x158]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x10c]
lea r8, str.SMTPPOP
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x158]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x110]
lea r8, str.WebMail
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x158]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x114]
lea r8, [0x140107c4c]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x158]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x118]
lea r8, str.MAPI
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x158]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x11c]
lea r8, str.IMAP
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x158]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x120]
lea r8, str.PlainText
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x158]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x124]
lea r8, str.HTML
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x158]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x128]
lea r8, [0x140107c2c]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x158]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x12c]
lea r8, [0x140107c20]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x158]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x130]
lea r8, str.NoAttachments
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x158]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x134]
lea r8, str.AttachmentFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x158]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x138]
lea r8, str.AttachmentFilterSize
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x158]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x13c]
lea r8, str.ToFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x158]
mov r11, qword [rbx]
lea r9, [rdi + 0x140]
mov dword [rsp + 0x20], 0x100
lea r8, str.ToFilterString
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x160]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x240]
lea r8, str.FromFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x158]
mov r11, qword [rbx]
lea r9, [rdi + 0x244]
mov dword [rsp + 0x20], 0x100
lea r8, str.FromFilterString
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x160]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x344]
lea r8, str.SubjectFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x158]
mov r11, qword [rbx]
lea r9, [rdi + 0x348]
mov dword [rsp + 0x20], 0x100
lea r8, str.SubjectFilterString
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x160]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x448]
lea r8, str.BodyFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x158]
mov r11, qword [rbx]
lea r9, [rdi + 0x44c]
mov dword [rsp + 0x20], 0x100
lea r8, str.BodyFilterString
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x160]
lea rdx, str.__struct_
lea rcx, [rsp + 0x30]
call fcn.14002d580
jmp case.0x140098a4a.8194
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.14002d580
mov r11, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.RcvdTimeLow
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x158]
mov r11, qword [rbx]
mov r9d, dword [rdi + 4]
lea r8, str.RcvdTimeHigh
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x158]
mov r11, qword [rbx]
lea r9, [rdi + 8]
mov dword [rsp + 0x20], 0x19
lea r8, str.MSG_Owner
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x160]
lea rdx, str.__struct_
lea rcx, [rsp + 0x30]
call fcn.14002d580
mov rdx, r15
mov rdi, qword [rsp + 0x50]
mov rcx, rdi
call fcn.140039060
mov r15, rax
jmp 0x140098756
mov r13, qword [rsp + 0x40]
jmp 0x140099027
mov rcx, rdi
call fcn.140038a10
lea rdx, str.__lst_
lea rcx, [rsp + 0x30]
call fcn.14002d580
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.14002d5f0
nop
lea rcx, [rsp + 0x30]
call fcn.14002d2c0
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400c2a20
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret