Function at 0x1a001450
Capabilities:
Log keystrokes
Log keystrokes via input method manager
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x74
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
or eax, 0xffffffff
mov dword [esp + 0x30], 0
xorps xmm0, xmm0
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x10], eax
movlpd qword [esp + 0x38], xmm0
test edi, edi
je 0x1a001aa0
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1a001551
mov esi, dword [eax]
test esi, esi
je 0x1a001551
mov ebx, dword [eax + 4]
test ebx, ebx
je 0x1a001551
mov edx, dword [edi]
xor ecx, ecx
mov eax, dword [edi + 4]
mov dword [esp + 0x34], eax
test edx, edx
jle 0x1a0014c8
cmp dword [eax], esi
jne 0x1a0014c0
cmp dword [eax + 4], 0
jne 0x1a0014c8
inc ecx
add eax, 0xc
cmp ecx, edx
jl 0x1a0014b6
cmp ecx, edx
je 0x1a001aa0
jge 0x1a0014f1
mov edi, dword [esp + 0x34]
lea eax, [ecx + ecx*2]
lea eax, [edi + eax*4]
nop dword [eax]
cmp dword [eax], esi
jne 0x1a0014e9
cmp dword [eax + 4], ebx
je 0x1a0014ff
inc ecx
add eax, 0xc
cmp ecx, edx
jl 0x1a0014e0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
lea eax, [ecx + ecx*2]
movzx edi, word [edi + eax*4 + 8]
lea eax, [esp + 0x64]
push 1
push 0x102
push 0x102
push 0
push eax
call esi
push 1
push 0x106
push 0x106
push 0
lea eax, [esp + 0x74]
push eax
call esi
push 0
push edi
push 0x111
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [edi + 4]
mov edi, dword [edi]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x14], edi
test eax, eax
je 0x1a001567
cmp dword [eax], 0
jne 0x1a0015ac
mov esi, dword [ebp + 0x10]
mov eax, dword [esi + 4]
cmp eax, 0x100
je 0x1a00157f
cmp eax, 0x104
jne 0x1a001aa0
mov eax, dword [esi + 8]
cmp eax, 0x10
je 0x1a001aa0
cmp eax, 0x11
je 0x1a001aa0
cmp eax, 0x12
je 0x1a001aa0
cmp dword [0x1a02b650], 0
jne 0x1a001aa0
jmp 0x1a0015af
mov esi, dword [ebp + 0x10]
movzx eax, word [esi + 8]
mov ecx, 0xe5
cmp ax, cx
jne 0x1a001616
push dword [esi]
call dword [sym.imp.IMM32.dll_ImmGetVirtualKey]
push 0
push 0x40002
push 0x1408
push 0
mov bl, al
call sym.HncIMM.dll_HimControl
cmp eax, 0x800
jne 0x1a001611
lea eax, [esp + 0x40]
push eax
push 0x231
push dword [esi]
call sym.HncIMM.dll__HimImmRequest_12
test eax, eax
je 0x1a001611
cmp dword [esp + 0x44], 0
je 0x1a001611
cmp bl, 0xe5
jne 0x1a001611
movzx eax, byte [esi + 0xe]
push 1
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov bl, al
movzx ebx, bl
jmp 0x1a001618
mov ebx, eax
movzx eax, bx
mov dword [esp + 0x40], eax
call fcn.1a0012a0
movzx ecx, al
xor edx, edx
shl ecx, 0x10
movzx eax, bx
or ecx, eax
mov dword [esp + 0x18], edx
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], eax
test edi, edi
jle 0x1a001788
mov ebx, dword [esp + 0x24]
lea edi, [edx + 1]
mov esi, dword [esp + 0x14]
add ebx, 0xc
nop
cmp dword [ebx - 0xc], ecx
jne 0x1a001713
cmp dword [ebx - 8], 0
jne 0x1a00173e
mov dword [esp + 0x20], 0xffffffff
mov ecx, edi
cmp edi, esi
jge 0x1a0016a5
mov eax, ebx
mov edx, dword [esp + 0x28]
cmp dword [eax], edx
mov edx, dword [esp + 0x18]
je 0x1a0016a1
inc ecx
add eax, 0xc
cmp ecx, esi
jl 0x1a001683
mov dword [esp + 0x20], 0xffffffff
jmp 0x1a0016a5
mov dword [esp + 0x20], edx
movzx esi, word [ebx - 4]
lea eax, [esp + 0x48]
push 1
push 0x102
push 0x102
push 0
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
push 1
push 0x106
push 0x106
push 0
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
push 0
push esi
push 0x111
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x1a00172d
cmp dword [esp + 0x20], eax
je 0x1a00172d
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
inc edx
inc edi
add ebx, 0xc
mov dword [esp + 0x18], edx
cmp edx, esi
jl 0x1a001660
or ecx, 0xffffffff
mov dword [esp + 0x10], ecx
jmp 0x1a001790
xor eax, eax
cmp ecx, 0xffffffff
setne al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
or eax, 0xffffffff
mov dword [esp + 0x10], eax
cmp edi, esi
jge 0x1a00178d
mov ebx, dword [esp + 0x24]
lea eax, [edi + edi*2]
lea eax, [ebx + eax*4]
cmp dword [eax], ecx
jne 0x1a00175d
cmp dword [eax + 4], 0
je 0x1a00176e
inc edi
add eax, 0xc
cmp edi, esi
jl 0x1a001753
or ecx, 0xffffffff
mov dword [esp + 0x10], ecx
jmp 0x1a001790
mov dword [esp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [esp + 0x20], edx
mov ecx, edi
mov edx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
jmp 0x1a001790
or ecx, 0xffffffff
jmp 0x1a001797
or ecx, 0xffffffff
mov edi, dword [esp + 0x14]
mov esi, dword [ebp + 0x10]
cmp edx, edi
je 0x1a001aa0
nop
cmp ecx, 0xffffffff
je 0x1a0018a2
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, eax
mov eax, edx
sub ecx, dword [esp + 0x1c]
push 0x10
sbb eax, dword [esp + 0x24]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x30], eax
call dword [sym.imp.USER32.dll_GetKeyState]
mov bx, ax
shr bx, 0xf
push 0x11
and bl, 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
and ax, cx
mov cl, bl
or cl, 2
test ax, ax
movzx edx, cl
movzx ecx, bl
cmove edx, ecx
push 0x12
mov dword [esp + 0x3c], edx
call dword [sym.imp.USER32.dll_GetKeyState]
mov ebx, dword [esp + 0x38]
mov ecx, 0x8000
and ax, cx
mov cl, bl
or cl, 4
test ax, ax
mov eax, dword [esp + 0x2c]
movzx edx, cl
movzx ecx, bl
cmove edx, ecx
test dl, dl
je 0x1a001890
test eax, eax
ja 0x1a001836
mov ecx, dword [esp + 0x14]
jb 0x1a0018a2
cmp ecx, 0x14
jbe 0x1a001894
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
push 1
push 0x102
lea eax, [eax + eax*2]
movzx esi, word [ecx + eax*4 + 8]
lea eax, [esp + 0x50]
push 0x102
push 0
push eax
call ebx
push 1
push 0x106
push 0x106
push 0
lea eax, [esp + 0x58]
push eax
call ebx
push 0
push esi
push 0x111
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esp + 0x14]
test eax, eax
ja 0x1a001836
jb 0x1a0018a2
cmp ecx, 0xc8
ja 0x1a001836
push 0
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_GetMessageW]
mov ecx, dword [esi + 4]
cmp ecx, 0x113
je 0x1a001a3d
cmp ecx, 0xf
je 0x1a001a3d
cmp ecx, 0x118
je 0x1a001a3d
cmp ecx, 0x400
jae 0x1a001a3d
cmp ecx, 0x60
je 0x1a001a3d
lea eax, [ecx - 0x100]
cmp eax, 9
ja 0x1a001a13
movzx eax, word [esi + 8]
mov ecx, 0xe5
cmp ax, cx
jne 0x1a00198f
push dword [esi]
call dword [sym.imp.IMM32.dll_ImmGetVirtualKey]
mov bl, al
cmp bl, 0xe5
jne 0x1a00196e
movzx eax, byte [esi + 0xe]
push 0x10
mov dword [esp + 0x30], eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
lea edx, [esp + 0xf]
lea ecx, [esp + 0x2c]
sets byte [esp + 0xf]
call fcn.1a0045e0
mov eax, dword [esp + 0x2c]
cmp ax, 0x7f
ja 0x1a00196c
movzx ecx, ax
movzx eax, byte [esp + 0xf]
lea eax, [eax + ecx*2]
movzx ebx, word [eax*2 + 0x1a01da98]
test bx, bx
jne 0x1a00196e
push 0x90
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x1a00196e
xor ebx, ebx
cmp bl, 0x61
jb 0x1a001987
cmp bl, 0x7a
ja 0x1a001987
movzx eax, bl
sub ax, 0x20
movzx eax, ax
movzx ebx, ax
jmp 0x1a001991
movzx eax, bl
movzx ebx, ax
jmp 0x1a001991
mov ebx, eax
cmp bx, 0x1b
je 0x1a001aa0
mov eax, dword [esi + 4]
cmp word [esp + 0x40], bx
je 0x1a0019b3
cmp eax, 0x100
je 0x1a0019d2
cmp eax, 0x104
jmp 0x1a0019bf
cmp eax, 0x101
je 0x1a0019d2
cmp eax, 0x105
je 0x1a0019d2
cmp dword [esp + 0x30], 0
mov ecx, dword [esp + 0x10]
je 0x1a0017a0
jmp 0x1a0019da
mov dword [esp + 0x30], 1
cmp eax, 0x100
je 0x1a0019f0
mov ecx, dword [esp + 0x10]
cmp eax, 0x104
jne 0x1a0017a0
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x10]
cmp eax, 0x10
je 0x1a0017a0
cmp eax, 0x11
je 0x1a0017a0
cmp eax, 0x12
jne 0x1a001a4d
jmp 0x1a0017a0
cmp ecx, 0x200
jne 0x1a001aa0
mov eax, dword [esp + 0x34]
cmp eax, 0xffffffff
je 0x1a001a2d
cmp dword [esi + 0xc], eax
jne 0x1a001aa0
mov eax, dword [esi + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
jmp 0x1a0017a0
push esi
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov ecx, dword [esp + 0x10]
jmp 0x1a0017a0
call fcn.1a0012a0
mov edx, dword [esp + 0x18]
movzx ecx, al
or ecx, 2
movzx eax, bx
mov ebx, dword [esp + 0x28]
shl ecx, 0x10
or ecx, eax
cmp edx, edi
jge 0x1a001a87
mov esi, dword [esp + 0x24]
lea eax, [edx + edx*2]
lea eax, [esi + eax*4]
cmp dword [eax], ebx
jne 0x1a001a7f
cmp dword [eax + 4], ecx
je 0x1a001aab
inc edx
add eax, 0xc
cmp edx, edi
jl 0x1a001a76
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1a0014f1
cmp dword [eax], 0
jne 0x1a0014f1
mov dword [eax], ebx
mov dword [eax + 4], ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp + 8]
lea eax, [edx + edx*2]
movzx eax, word [esi + eax*4 + 8]
lea edx, [esp + 0x48]
push eax
call fcn.1a001400
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10