Function at 0x14001bc20
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x1402ba4e0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov r12d, r9d
mov rsi, r8
mov qword [rsp + 0x40], rdx
mov rbx, rcx
mov qword [rsp + 0x58], rdx
mov rdi, qword [rsp + 0x120]
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x38], 1
mov rax, qword [0x1402b9cc8]
mov qword [rsp + 0x30], rax
mov edx, r9d
call fcn.14001a6b0
test eax, eax
jne 0x14001bca4
lea rcx, [rsp + 0x30]
call fcn.1400ca400
xor eax, eax
jmp 0x14001c691
lea rdx, str._lst_name_
lea rcx, [rsp + 0x30]
call fcn.1400ca830
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.1400ca830
lea rdx, str.__type_
lea rcx, [rsp + 0x30]
call fcn.1400ca830
cmp r12d, 0x2000
jg 0x14001bd51
je 0x14001bd48
cmp r12d, 0x1000
je 0x14001bd29
jle case.default.0x14001bd76
cmp r12d, 0x1003
jle 0x14001bd20
cmp r12d, 0x1004
jne case.default.0x14001bd76
lea rdx, str.InternalWMRecord
lea rcx, [rsp + 0x30]
call fcn.1400ca830
lea r14, [0x140000000]
jmp 0x14001bdf2
lea rdx, str.ScheduleTime
jmp 0x14001bd0a
lea rdx, str.KeywordRecord
lea rcx, [rsp + 0x30]
call fcn.1400ca830
lea r14, [0x140000000]
xor esi, esi
jmp 0x14001be03
lea r14, [0x140000000]
jmp case.0x14001bd76.8195
lea eax, [r12 - 0x2001]
cmp eax, 0x10
ja case.default.0x14001bd76
cdqe
lea r14, [0x140000000]
mov eax, dword [r14 + rax*4 + 0x1c6b4]
add rax, r14
jmp rax
lea rdx, str.char__
lea rcx, [rsp + 0x30]
call fcn.1400ca830
xor esi, esi
jmp 0x14001be03
lea rdx, str.BlockIMRecord
lea rcx, [rsp + 0x30]
call fcn.1400ca830
xor esi, esi
jmp 0x14001be03
lea rdx, str.PortRange
lea rcx, [rsp + 0x30]
call fcn.1400ca830
xor esi, esi
jmp 0x14001be03
lea rdx, str.KeyEventDef
lea rcx, [rsp + 0x30]
call fcn.1400ca830
xor esi, esi
jmp 0x14001be03
lea rdx, str.EmailRule
lea rcx, [rsp + 0x30]
call fcn.1400ca830
xor esi, esi
jmp 0x14001be03
lea rdx, str.EmailLastRecvTime
lea rcx, [rsp + 0x30]
call fcn.1400ca830
xor esi, esi
jmp 0x14001be03
lea r14, [0x140000000]
xor esi, esi
mov dword [rsp + 0x38], esi
lea rdx, [0x1401ede8c]
lea rcx, [rsp + 0x30]
call fcn.1400ca830
mov rcx, rdi
call fcn.1400a3cb0
nop
mov rcx, rdi
call fcn.1400a41d0
mov r15, rax
nop dword [rax + rax]
test r15, r15
je 0x14001c64b
mov rcx, r15
call fcn.1400a39b0
mov rdi, rax
test rax, rax
je case.0x14001c0e6.8194
cmp r12d, 0x2000
jg 0x14001c0c8
je case.0x14001c0e6.8195
cmp r12d, 0x1000
je 0x14001c079
jle case.0x14001c0e6.8194
cmp r12d, 0x1003
jle 0x14001bf4d
cmp r12d, 0x1004
jne case.0x14001c0e6.8194
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.1400ca830
lea rdx, [0x1401ede20]
mov rcx, rdi
call fcn.14010d30c
mov r13, rax
test rax, rax
je 0x14001c622
mov byte [rax], 0
mov r10, qword [rbx]
mov qword [rsp + 0x20], rsi
mov r9, rdi
lea r8, str.Package
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r10 + 0x128]
mov byte [r13], 0x2c
lea rdx, [0x1401ede20]
lea rcx, [r13 + 1]
call fcn.14010d30c
mov rdi, rax
test rax, rax
je 0x14001c622
mov byte [rax], 0
mov r10, qword [rbx]
mov qword [rsp + 0x20], rsi
lea r9, [r13 + 1]
lea r8, [0x1401ee2f0]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r10 + 0x128]
mov byte [rdi], 0x2c
mov r10, qword [rbx]
mov qword [rsp + 0x20], rsi
lea r9, [rdi + 1]
lea r8, str.Host
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r10 + 0x128]
jmp 0x14001c622
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.1400ca830
lea rdx, str._struct_name_Start__type_TimePeriod__
lea rcx, [rsp + 0x30]
call fcn.1400ca830
mov r11, qword [rbx]
mov r9d, dword [rdi]
and r9d, 0x3f
lea r8, str.Minute
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x120]
mov r11, qword [rbx]
mov r9d, dword [rdi]
shr r9d, 6
and r9d, 0x1f
lea r8, str.Hour
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x120]
mov r11, qword [rbx]
mov r9d, dword [rdi]
shr r9d, 0xb
and r9d, 7
lea r8, [0x1401ee2a8]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x120]
lea rdx, str.__struct_
lea rcx, [rsp + 0x30]
call fcn.1400ca830
lea rdx, str._struct_name_Stop__type_TimePeriod__
lea rcx, [rsp + 0x30]
call fcn.1400ca830
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
and r9d, 0x3f
lea r8, str.Minute
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x120]
mov r11, qword [rbx]
mov r9d, dword [rdi + 4]
shr r9d, 6
and r9d, 0x1f
lea r8, str.Hour
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x120]
mov r11, qword [rbx]
mov r9d, dword [rdi + 4]
shr r9d, 0xb
and r9d, 7
lea r8, [0x1401ee2a8]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x120]
lea rdx, str.__struct_
lea rcx, [rsp + 0x30]
call fcn.1400ca830
jmp 0x14001c622
mov rdi, qword [rax + 8]
test rdi, rdi
je case.0x14001c0e6.8194
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.1400ca830
mov r11, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.WholeWord
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x120]
lea r9, [rdi + 4]
mov qword [rsp + 0x20], rsi
lea r8, [0x1401ee260]
jmp 0x14001c610
lea eax, [r12 - 0x2001]
cmp eax, 0x10
ja case.0x14001c0e6.8194
cdqe
mov ecx, dword [r14 + rax*4 + 0x1c6f8]
add rcx, r14
jmp rcx
mov rax, qword [rbx]
mov qword [rsp + 0x20], rsi
mov r9, rdi
lea r8, [0x14024d112]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x128]
jmp case.0x14001c0e6.8194
mov rdi, qword [rdi + 8]
test rdi, rdi
je case.0x14001c0e6.8194
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.1400ca830
mov r11, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.imFlags
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x120]
lea r9, [rdi + 4]
mov qword [rsp + 0x20], rsi
lea r8, str.szName
jmp 0x14001c610
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.1400ca830
mov r11, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.From
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x120]
mov r11, qword [rbx]
mov r9d, dword [rdi + 4]
lea r8, [0x1401ee244]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x120]
mov r11, qword [rbx]
mov r9d, dword [rdi + 8]
lea r8, str.SelectID
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x120]
jmp 0x14001c622
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.1400ca830
mov r11, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.vKey
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x120]
mov rax, qword [rbx]
mov r9d, dword [rdi + 4]
lea r8, str.lParam
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x120]
mov byte [rsp + 0x70], 0
xor eax, eax
mov qword [rsp + 0x71], rax
mov qword [rsp + 0x79], rax
mov qword [rsp + 0x81], rax
mov qword [rsp + 0x89], rax
mov qword [rsp + 0x91], rax
mov qword [rsp + 0x99], rax
mov qword [rsp + 0xa1], rax
mov dword [rsp + 0xa9], eax
mov word [rsp + 0xad], ax
mov byte [rsp + 0xaf], al
lea r8d, [rax + 0x40]
lea rdx, [rsp + 0x70]
mov ecx, dword [rdi + 4]
call qword [sym.imp.USER32.dll_GetKeyNameTextA]
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x70]
lea r8, str.Description
jmp 0x14001c610
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.1400ca830
mov r11, qword [rbx]
mov qword [rsp + 0x20], 0x100
mov r9, rdi
lea r8, str.Name
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x128]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x100]
lea r8, str.Record
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x120]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x104]
lea r8, str.Sent
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x120]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x108]
lea r8, str.Received
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x120]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x10c]
lea r8, str.SMTPPOP
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x120]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x110]
lea r8, str.WebMail
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x120]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x114]
lea r8, [0x1401ee1dc]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x120]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x118]
lea r8, str.MAPI
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x120]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x11c]
lea r8, str.IMAP
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x120]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x124]
lea r8, str.PlainText
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x120]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x128]
lea r8, str.HTML
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x120]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x12c]
lea r8, [0x1401ee1b4]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x120]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x130]
lea r8, [0x1401ee1a8]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x120]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x134]
lea r8, str.NoAttachments
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x120]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x138]
lea r8, str.AttachmentFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x120]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x13c]
lea r8, str.AttachmentFilterSize
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x120]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x140]
lea r8, str.ToFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x120]
mov r11, qword [rbx]
lea r9, [rdi + 0x144]
mov qword [rsp + 0x20], 0x100
lea r8, str.ToFilterString
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x128]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x244]
lea r8, str.FromFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x120]
mov r11, qword [rbx]
lea r9, [rdi + 0x248]
mov qword [rsp + 0x20], 0x100
lea r8, str.FromFilterString
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x128]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x348]
lea r8, str.SubjectFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x120]
mov r11, qword [rbx]
lea r9, [rdi + 0x34c]
mov qword [rsp + 0x20], 0x100
lea r8, str.SubjectFilterString
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x128]
mov r11, qword [rbx]
mov r9d, dword [rdi + 0x44c]
lea r8, str.BodyFilter
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x120]
lea r9, [rdi + 0x450]
mov qword [rsp + 0x20], 0x100
lea r8, str.BodyFilterString
jmp 0x14001c610
lea rdx, str._struct_
lea rcx, [rsp + 0x30]
call fcn.1400ca830
mov r11, qword [rbx]
mov r9d, dword [rdi]
lea r8, str.RcvdTimeLow
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x120]
mov r11, qword [rbx]
mov r9d, dword [rdi + 4]
lea r8, str.RcvdTimeHigh
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x120]
lea r9, [rdi + 8]
mov qword [rsp + 0x20], 0x32
lea r8, str.MSG_Owner
mov r11, qword [rbx]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [r11 + 0x128]
lea rdx, str.__struct_
lea rcx, [rsp + 0x30]
call fcn.1400ca830
mov rdx, r15
mov rdi, qword [rsp + 0x50]
mov rcx, rdi
call fcn.1400a41e0
mov r15, rax
jmp 0x14001be30
mov r13, qword [rsp + 0x40]
jmp 0x14001c65c
mov rcx, rdi
call fcn.1400a3cd0
lea rdx, str.__lst_
lea rcx, [rsp + 0x30]
call fcn.1400ca830
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.1400ca8a0
nop
lea rcx, [rsp + 0x30]
call fcn.1400ca400
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14010d170
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret