Function at 0x180062390
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e8]
sub rsp, 0x2e8
movzx ebx, byte [rbp + 0x230]
mov eax, ecx
shl eax, 5
mov rdi, r8
xor r8d, r8d
mov dword [rsp + 0x48], ecx
mov dword [rsp + 0x20], r8d
mov esi, ecx
mov dword [rsp + 0x24], eax
cmp ecx, eax
ja case.0x180062478.0
movzx r15d, byte [rbp + 0x230]
lea r14d, [r8 + 0x2e]
mov eax, dword [rbp + 0x230]
mov ecx, dword [rsp + 0x24]
lea r10, [0x180000000]
mov r11d, 0x16
movabs r9, 0x7fffffffffffffff
cmp esi, 0x9f4
ja 0x180062ab5
je 0x180062aae
mov eax, esi
sub eax, 0xc4
je 0x180062aa4
sub eax, 0x4b
je 0x180062a3b
sub eax, 0x2c5
je 0x180062a26
cmp eax, 0x310
jne 0x180062b26
cmp qword [rdi + 0x10], 0x35
jb 0x180062b26
mov r13d, 0x15
nop
cmp r13d, 0x15
ja case.default.0x180062478
mov eax, r13d
mov ecx, dword [r10 + rax*4 + 0x62b58]
add rcx, r10
jmp rcx
mov r14d, 0xb
mov qword [rsp + 0x40], 0xf
cmp qword [rdi + 0x10], r14
mov r12, rdi
mov byte [rsp + 0x28], 0
cmovb r14, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0x10
jb 0x1800624a4
mov r12, qword [rdi]
cmp r14, 0xf
ja 0x1800624ca
mov r8, r14
mov qword [rsp + 0x38], r14
mov rdx, r12
lea rcx, [rsp + 0x28]
call fcn.18006fd90
mov byte [rsp + r14 + 0x28], 0
jmp 0x180062560
cmp r14, r9
ja 0x180062b3f
mov rsi, r14
or rsi, 0xf
cmp rsi, r9
jbe 0x1800624e4
mov rsi, r9
jmp 0x1800624ec
cmp rsi, 0x16
cmovb rsi, r11
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x180062525
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180062b4b
mov rcx, rax
call fcn.18006da94
test rax, rax
je 0x180062b51
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180062537
test rcx, rcx
je 0x180062534
call fcn.18006da94
mov rdi, rax
jmp 0x180062537
mov rdi, r8
mov r8, r14
mov qword [rsp + 0x38], r14
mov rdx, r12
mov qword [rsp + 0x40], rsi
mov rcx, rdi
call fcn.18006fd90
mov byte [rdi + r14], 0
mov qword [rsp + 0x28], rdi
mov rdi, qword [rbp + 0x240]
or dword [rsp + 0x20], 1
lea rdx, [rsp + 0x28]
lea rcx, [0x1800b9098]
call fcn.180006590
mov rax, qword [rsp + 0x40]
cmp rax, 0x10
jb 0x1800625b4
mov rcx, qword [rsp + 0x28]
lea rdx, [rax + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800625af
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180062b51
call fcn.18006dad0
xor r8d, r8d
mov qword [rbp - 0x50], r8
mov r11d, 0x16
lea r10, [0x180000000]
movabs r9, 0x7fffffffffffffff
lea r14d, [r11 + 0x18]
jmp case.default.0x180062478
movzx eax, byte [rbp + 0x248]
mov ecx, r8d
cmp dword [rsp + 0x4c], 0
mov dword [rsp + 0x50], 0x100b
cmove ecx, eax
mov byte [rbp + 0x248], cl
jmp case.default.0x180062478
mov qword [rsp + 0x68], r8
mov dword [rsp + 0x54], 3
jmp case.default.0x180062478
mov qword [rbp - 0x58], r8
jmp case.default.0x180062478
mov rcx, qword [rbp - 0x48]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x70]
call sub.urlmon.dll_CreateURLMoniker
mov dword [rsp + 0x4c], eax
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x40], 0xf
mov byte [rsp + 0x28], 0
cmp rax, 0x11
jb 0x180062b45
add rax, 0xffffffffffffffef
mov r14d, 0x24
cmp rax, r14
cmovb r14, rax
cmp qword [rdi + 0x18], 0x10
mov rax, rdi
jb 0x18006266c
mov rax, qword [rdi]
lea r12, [rax + 0x11]
cmp r14, 0xf
ja 0x180062696
mov r8, r14
mov qword [rsp + 0x38], r14
mov rdx, r12
lea rcx, [rsp + 0x28]
call fcn.18006fd90
mov byte [rsp + r14 + 0x28], 0
jmp 0x18006273a
movabs rax, 0x7fffffffffffffff
cmp r14, rax
ja 0x180062b3f
mov rsi, r14
or rsi, 0xf
cmp rsi, rax
jbe 0x1800626ba
mov rsi, rax
jmp 0x1800626c7
cmp rsi, 0x16
mov eax, 0x16
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x180062700
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180062b4b
mov rcx, rax
call fcn.18006da94
test rax, rax
je 0x180062b51
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180062711
test rcx, rcx
je 0x18006270f
call fcn.18006da94
mov rdi, rax
jmp 0x180062711
xor edi, edi
mov r8, r14
mov qword [rsp + 0x38], r14
mov rdx, r12
mov qword [rsp + 0x40], rsi
mov rcx, rdi
call fcn.18006fd90
mov byte [rdi + r14], 0
mov qword [rsp + 0x28], rdi
mov rdi, qword [rbp + 0x240]
or dword [rsp + 0x20], 2
lea rcx, [0x1800b9078]
lea rdx, [rsp + 0x28]
call fcn.180006590
mov rax, qword [rsp + 0x40]
cmp rax, 0x10
jb 0x18006278e
mov rcx, qword [rsp + 0x28]
lea rdx, [rax + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180062789
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180062b51
call fcn.18006dad0
xor r8d, r8d
jmp 0x1800625bb
mov dword [rbp - 0x78], 0x2e
jmp case.default.0x180062478
cmp byte [rbp + 0x248], 0
je case.default.0x180062478
mov rcx, qword [rsp + 0x68]
call sub.urlmon.dll_IsAsyncMoniker
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
xor r8d, r8d
lea r10, [0x180000000]
movabs r9, 0x7fffffffffffffff
lea r11d, [r8 + 0x16]
jmp case.default.0x180062478
movsd xmm0, qword [0x18009db8e]
movzx eax, word [0x18009db96]
movsd qword [rsp + 0x7e], xmm0
mov word [rbp - 0x7a], ax
mov word [rbp - 0x78], r8w
jmp case.default.0x180062478
mov word [rbp - 0x62], r8w
lea rdx, [0x18009dbda]
mov r8d, 4
lea rcx, [rsp + 0x70]
call fcn.1800743d0
xor r8d, r8d
lea r10, [0x180000000]
movabs r9, 0x7fffffffffffffff
lea r11d, [r8 + 0x16]
jmp case.default.0x180062478
mov byte [rbp + 0x248], 1
jmp case.default.0x180062478
mov r8d, dword [rsp + 0x54]
lea r9, [rsp + 0x50]
mov rdx, qword [rbp - 0x58]
mov rcx, qword [rbp - 0x50]
call sub.IMM32.dll_ImmEscapeW
xor r8d, r8d
lea r10, [0x180000000]
mov bl, 1
movabs r9, 0x7fffffffffffffff
lea r11d, [r8 + 0x16]
jmp case.default.0x180062478
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x40], 0xf
mov byte [rsp + 0x28], 0
cmp rax, 0xb
jb 0x180062b45
add rax, 0xfffffffffffffff5
mov r14d, 6
cmp rax, r14
cmovb r14, rax
cmp qword [rdi + 0x18], 0x10
mov rax, rdi
jb 0x1800628b9
mov rax, qword [rdi]
lea r12, [rax + 0xb]
cmp r14, 0xf
ja 0x1800628ef
mov r8, r14
mov qword [rsp + 0x38], r14
mov rdx, r12
lea rcx, [rsp + 0x28]
call fcn.18006fd90
or dword [rsp + 0x20], 4
lea rcx, [0x1800b90b8]
mov byte [rsp + r14 + 0x28], 0
jmp 0x180062746
cmp r14, r9
ja 0x180062b3f
mov rsi, r14
or rsi, 0xf
cmp rsi, r9
jbe 0x180062909
mov rsi, r9
jmp 0x180062911
cmp rsi, 0x16
cmovb rsi, r11
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x18006294a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180062b4b
mov rcx, rax
call fcn.18006da94
test rax, rax
je 0x180062b51
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x18006295c
test rcx, rcx
je 0x180062959
call fcn.18006da94
mov rdi, rax
jmp 0x18006295c
mov rdi, r8
mov r8, r14
mov qword [rsp + 0x38], r14
mov rdx, r12
mov qword [rsp + 0x40], rsi
mov rcx, rdi
call fcn.18006fd90
or dword [rsp + 0x20], 4
lea rcx, [0x1800b90b8]
mov byte [rdi + r14], 0
mov qword [rsp + 0x28], rdi
mov rdi, qword [rbp + 0x240]
jmp 0x180062746
mov word [rsp + 0x7e], r8w
jmp case.default.0x180062478
mov dword [rbp - 0x72], 0x6b0073
jmp case.default.0x180062478
movsd xmm0, qword [str.llvm.hexagon.V6.vtmpybus]
movzx eax, word [0x18009dbf0]
movsd qword [rsp + 0x70], xmm0
mov word [rsp + 0x78], ax
mov word [rsp + 0x7a], r8w
jmp case.default.0x180062478
mov dword [rsp + 0x7a], 0x380078
jmp case.default.0x180062478
mov word [rbp - 0x6e], r14w
jmp case.default.0x180062478
mov qword [rbp - 0x48], r8
jmp case.default.0x180062478
mov word [rbp - 0x6e], r8w
jmp case.default.0x180062478
movsd xmm0, qword [str.cmpnleps__0__1]
movzx eax, word [0x18009dc28]
movsd qword [rbp - 0x6c], xmm0
mov word [rbp - 0x64], ax
jmp case.default.0x180062478
mov dword [rbp - 0x76], 0x61006d
mov word [rbp - 0x72], r8w
dec r13d
lea eax, [r13 + 0x14]
cmp eax, 0x13
ja 0x180062460
mov esi, dword [rsp + 0x48]
jmp 0x180062b1b
mov dword [rsp + 0x64], 0x80
mov dword [rsp + 0x58], 3
jmp 0x180062b26
mov r8, rdx
mov r9d, 4
nop dword [rax]
nop dword [rax + rax]
mov edx, 0xa4
mov eax, edx
sub eax, 0xa1
je 0x180062a82
sub eax, 2
je 0x180062a6e
cmp eax, 1
jne 0x180062a8f
movzx r15d, byte [r8]
jmp 0x180062a8f
cmp r15b, 0x41
jb 0x180062a7c
and r15b, 0xdf
sub r15b, 7
add r15b, 0xd0
jmp 0x180062a8f
mov ecx, dword [rdi]
shl ecx, 4
movzx eax, r15b
or ecx, eax
mov dword [rdi], ecx
dec edx
cmp edx, 0xa0
ja 0x180062a55
inc r8
sub r9, 1
jne 0x180062a50
jmp 0x180062b1b
mov qword [rbp - 0x38], r8
mov qword [rbp - 0x40], r8
jmp 0x180062b26
mov dword [rsp + 0x60], r8d
jmp 0x180062b2c
cmp esi, 0xd04
je 0x180062afe
cmp esi, 0x1014
je 0x180062ae4
cmp esi, 0x1324
jne 0x180062b2c
movzx eax, bl
add rsp, 0x2e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r9d, dword [rsp + 0x5c]
lea r8, [rbp - 0x30]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rbp - 0x40]
call sub.IMM32.dll_ImmGetGuideLineW
xor bl, bl
jmp 0x180062b1b
mov r9d, dword [rsp + 0x60]
xor r8d, r8d
mov edx, dword [rsp + 0x64]
mov rcx, qword [rbp - 0x38]
mov dword [rsp + 0x5c], 0x104
call sub.IMM32.dll_ImmGetCompositionStringA
mov rdx, qword [rbp + 0x238]
mov ecx, dword [rsp + 0x24]
mov eax, dword [rbp + 0x230]
lea esi, [rsi + rax*4]
mov dword [rsp + 0x48], esi
cmp esi, ecx
ja case.0x180062478.0
xor r8d, r8d
jmp 0x1800623f8
call fcn.180032b70
int3
call fcn.180032bd0
int3
call fcn.1800326d0
int3
call fcn.180073fa4
int3