Function at 0x18006ea10
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2f0]
sub rsp, 0x3f0
mov rax, qword [0x1800a3d18]
xor rax, rsp
mov qword [rbp + 0x2e0], rax
mov qword [rsp + 0x40], r9
mov r14, r8
mov edi, edx
mov dword [rsp + 0x4c], edx
mov rsi, rcx
xor r12d, r12d
mov qword [rsp + 0x58], r12
mov qword [rbp + 8], r12
mov qword [rbp + 0x10], 0xf
mov byte [rbp - 8], r12b
mov ebx, edx
imul eax, edx, 0x4f9
mov dword [rsp + 0x50], eax
lea edx, [r12 + 0x6c]
cmp ebx, eax
ja 0x18006ee57
movabs rcx, 0x3100720063
mov r12d, dword [rsp + 0x54]
mov r15, qword [rsp + 0x78]
mov r13d, dword [rsp + 0x54]
xor edi, edi
mov eax, 0x6d
cmp ebx, 0x10d0
ja 0x18006eca9
je 0x18006edcc
cmp ebx, 0x10f
ja 0x18006ebfc
je 0x18006ebbd
cmp ebx, 0x10
je 0x18006ebb1
cmp ebx, 0x1e
je 0x18006eb5a
cmp ebx, 0x3c
je 0x18006eb3c
cmp ebx, 0x58
jne 0x18006ee3f
lea ecx, [rax - 0x4d]
call fcn.18008eb60
mov rdi, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x18006eb24
mov rcx, qword [rsp + 0x40]
mov r8, qword [rcx + 8]
mov rdx, qword [rcx]
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, rax
call fcn.180027360
jmp 0x18006eb26
xor edi, edi
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 8], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp + 8], xmm1
xor edi, edi
jmp 0x18006ee2b
mov rcx, qword [r9 + 8]
inc rcx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r15, rax
test rax, rax
je 0x18006edb3
jmp 0x18006ee2b
cmp qword [r9], 0xffffffffffffffff
je 0x18006ee3f
mov edx, 0x23
nop dword [rax]
mov eax, edx
sub eax, 0x22
je 0x18006eb91
cmp eax, 1
jne 0x18006eba5
mov eax, dword [rsi]
cmp eax, 0x40
jae 0x18006eba5
mov ecx, eax
mov rax, qword [r9]
mov qword [rsi + rcx*8 + 8], rax
inc dword [rsi]
jmp 0x18006eba5
mov rax, qword [r14]
cmp rax, 0xffffffffffffffff
je 0x18006eb9f
cmp qword [r9], rax
jbe 0x18006eba5
mov rax, qword [r9]
mov qword [r14], rax
dec edx
cmp edx, 0x21
ja 0x18006eb70
jmp 0x18006ee30
mov word [rbp + 0x88], ax
jmp 0x18006ee3f
mov r9d, dword [r14]
lea r8, [0x18009765c]
mov edx, 0x14
lea rcx, [rbp + 0xa0]
call fcn.18008e040
mov r13d, eax
mov eax, dword [rsi]
test eax, eax
cmovle eax, edi
movsxd r8, eax
lea rdx, [rbp + 0xa0]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x18006ee2b
cmp ebx, 0x440
je 0x18006ec8a
cmp ebx, 0x870
je 0x18006ec67
cmp ebx, 0xca0
je 0x18006ec46
cmp ebx, 0xff0
jne 0x18006ee3f
mov r8, qword [r9 + 8]
mov rdx, qword [r9]
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
mov r9, qword [rsp + 0x40]
mov rax, qword [r9 + 8]
mov byte [r15 + rax], 0
jmp 0x18006ee30
mov dword [rbp + 0x48], 0x797254
movzx eax, word [0x18009764c]
mov word [rbp + 0x4b], ax
movzx eax, byte [0x18009764e]
mov byte [rbp + 0x4d], al
jmp 0x18006ee3f
mov qword [rbp + 0x8e], rcx
mov r8d, 0xa
lea rdx, [rbp + 0x94]
lea ecx, [r8 + 0xa]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ltow]
jmp 0x18006ee2b
mov eax, dword [0x180097650]
mov dword [rbp + 0x8a], eax
movzx eax, word [0x180097654]
mov word [rbp + 0x8e], ax
jmp 0x18006ee3f
cmp ebx, 0x1fa4
ja 0x18006ed67
je 0x18006ed41
cmp ebx, 0x1500
je 0x18006ed1c
cmp ebx, 0x1760
je 0x18006ed06
cmp ebx, 0x1930
je 0x18006ece8
cmp ebx, 0x1d60
jne 0x18006ee3f
mov byte [rbp + 0x56], 0x6e
jmp 0x18006ee3f
mov word [rbp + 0x53], dx
movzx eax, word [0x180095300]
mov word [rbp + 0x54], ax
movzx eax, byte [0x180095302]
mov byte [rbp + 0x56], al
jmp 0x18006ee3f
lea r9, [rbp - 8]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0x34]
call fcn.18006d6c0
jmp 0x18006ee2b
movzx eax, word [0x18009513c]
mov word [rbp + 0x4f], ax
movzx eax, word [0x180097658]
mov word [rbp + 0x51], ax
movzx eax, byte [0x18009765a]
mov byte [rbp + 0x53], al
jmp 0x18006ee3f
mov r9, r14
mov r8, rsi
lea rdx, str.numEffectiveHosts
mov rcx, r15
call fcn.18008ea80
mov r12d, eax
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18006ee2b
cmp ebx, 0x2190
je 0x18006ee10
cmp ebx, 0x25c0
je 0x18006edf2
cmp ebx, 0x2f58
je 0x18006ed99
cmp ebx, 0x47fc
jne 0x18006ee3f
mov dword [rsp + 0x3c], r13d
jmp 0x18006ee3f
mov eax, 6
nop
cmp eax, 6
je 0x18006edbd
cmp eax, 0x65
jne 0x18006edc2
mov eax, dword [rsp + 0x3c]
mov qword [rsp + 0x58], rax
mov rbx, qword [rsp + 0x58]
jmp 0x18006f6b3
mov dword [rsp + 0x3c], r12d
add eax, 0x5f
cmp eax, 0xc4
jb 0x18006eda0
lea rcx, [rbp + 0x48]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x18006edd3
movzx eax, word [0x180097664]
mov word [rcx], ax
movzx eax, byte [0x180097666]
mov byte [rcx + 2], al
jmp 0x18006ee35
mov dword [rbp + 0x58], 0x3a2520
movzx eax, word [0x180097660]
mov word [rbp + 0x5b], ax
movzx eax, byte [0x180097662]
mov byte [rbp + 0x5d], al
jmp 0x18006ee3f
mov byte [rbp + 0x57], 0
mov r8d, 1
lea rdx, [0x180095314]
lea rcx, [rbp + 0x48]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r9, qword [rsp + 0x40]
mov edx, 0x6c
movabs rcx, 0x3100720063
imul eax, dword [rsp + 0x4c], 0x43
add ebx, eax
cmp ebx, dword [rsp + 0x50]
jbe 0x18006ea9d
xor r12d, r12d
mov edi, dword [rsp + 0x4c]
lea eax, [rdi + 0xb6e]
mov dword [rsp + 0x38], eax
cmp edi, eax
jae 0x18006f6af
mov esi, 0x65
lea rbx, str.libeay32
lea rdx, [0x180000000]
mov r11d, 0x4558
lea r10d, [rsi - 0x37]
movabs r8, 0x7ffffffffffffffe
mov r14d, 0x5441
mov r15d, 0x6163
mov r13d, dword [rsp + 0x54]
cmp edi, 0x4e0
ja 0x18006efac
je 0x18006f70b
cmp edi, 0x1de
ja 0x18006ef2e
je 0x18006ef22
mov eax, edi
sub eax, 0x10
je 0x18006ef06
sub eax, 0x9a
je 0x18006eeed
sub eax, 0x65
je 0x18006f6af
cmp eax, 0x35
mov eax, dword [rsp + 0x38]
jne 0x18006f7cc
mov dword [rbp + 0x74], 0x6c
jmp 0x18006f7cc
mov eax, dword [0x180097684]
mov dword [rbp + 0x70], eax
movzx eax, word [0x180097688]
mov word [rbp + 0x74], ax
jmp 0x18006f7c8
mov r8d, 1
lea rdx, [0x180094058]
lea rcx, [rbp + 0x48]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x18006f7ab
mov dword [rbp + 0x76], 0x65
jmp 0x18006f7cc
cmp edi, 0x278
je 0x18006efa0
cmp edi, 0x312
je 0x18006ef87
cmp edi, 0x3ac
je 0x18006ef5c
cmp edi, 0x446
jne 0x18006f7cc
mov byte [rsp + 0x35], 1
jmp 0x18006f7cc
mov r8d, 0xa
lea rdx, [rbp + 0x7e]
lea ecx, [r8 - 8]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultow]
movups xmm0, xmmword [rbp + 0x18]
movups xmmword [rbp + 0x30], xmm0
movsd xmm1, qword [rbp + 0x28]
movsd qword [rbp + 0x40], xmm1
jmp 0x18006f7ab
mov eax, dword [0x180097748]
mov dword [rbp + 0x7a], eax
movzx eax, word [0x18009774c]
mov word [rbp + 0x7e], ax
jmp 0x18006f7c8
mov dword [rbp + 0x78], 0x61
jmp 0x18006f7cc
cmp edi, 0x7e2
ja 0x18006f66c
je 0x18006f024
cmp edi, 0x57a
je 0x18006f01b
cmp edi, 0x614
je 0x18006f00e
cmp edi, 0x6ae
je 0x18006f004
cmp edi, 0x748
jne 0x18006f7cc
lea rax, [rbp + 0x70]
mov qword [rbp + 0x40], rax
mov r9d, dword [rsp + 0x64]
xor r8d, r8d
mov edx, dword [rsp + 0x60]
mov rcx, qword [rbp - 0x80]
call sub.IMM32.dll_ImmGetCompositionStringW
mov dword [rsp + 0x54], eax
jmp 0x18006f7ab
mov dword [rsp + 0x64], r12d
jmp 0x18006f7cc
mov dword [rsp + 0x60], 0x80
jmp 0x18006f7cc
mov qword [rbp + 0x38], rbx
jmp 0x18006f7cc
mov dword [rsp + 0x50], r12d
lea rbx, [rbp + 0x30]
mov qword [rsp + 0x58], rbx
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r12w
mov dword [rsp + 0x30], 0x125
mov esi, r12d
mov dword [rsp + 0x48], r12d
mov eax, dword [rsp + 0x30]
cmp esi, 0x1e
ja 0x18006f5be
mov eax, esi
mov ecx, dword [rdx + rax*4 + 0x6f880]
add rcx, rdx
jmp rcx
inc eax
mov dword [rsp + 0x30], eax
inc esi
mov dword [rsp + 0x48], esi
cmp eax, 0x144
mov r9, qword [rsp + 0x40]
jb 0x18006f057
mov rcx, qword [rbp - 0x50]
cmp rcx, 8
jb 0x18006f61a
lea rdx, [rcx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006f615
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006f840
call fcn.18008eb9c
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
add rbx, 8
mov qword [rsp + 0x58], rbx
cmp eax, 3
mov r9, qword [rsp + 0x40]
lea rdx, [0x180000000]
movabs r8, 0x7ffffffffffffffe
mov r10d, 0x2e
mov r11d, 0x4558
jb 0x18006f032
mov edi, dword [rsp + 0x4c]
lea rbx, str.libeay32
lea esi, [r10 + 0x37]
jmp 0x18006f7c1
cmp edi, 0x87c
je 0x18006f79a
cmp edi, 0x916
je 0x18006f784
cmp edi, 0x9b0
je 0x18006f71f
cmp edi, 0xa4a
jne 0x18006f7cc
mov ecx, 0xbe
mov eax, ecx
sub eax, 0xbe
je 0x18006f6f8
cmp eax, 1
jne 0x18006f6fd
mov ebx, dword [rsp + 0x3c]
mov rdx, qword [rbp + 0x10]
cmp rdx, 0x10
jb 0x18006f84c
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006f847
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18006f847
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov byte [rsp + 0x3c], 1
inc ecx
cmp ecx, 0xc0
jb 0x18006f6a1
mov eax, dword [rsp + 0x38]
lea rcx, [rbp + 0x88]
mov qword [rbp + 0x30], rcx
mov qword [rbp - 0x80], r12
jmp 0x18006f7cc
cmp byte [rsp + 0x35], 0
je 0x18006f7cc
mov ebx, 0xc0
mov edi, dword [rsp + 0x60]
cmp ebx, 0xc0
je 0x18006f760
cmp ebx, 0x8400
jne 0x18006f765
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov edx, edi
mov rcx, qword [rbp - 0x80]
call sub.IMM32.dll_ImmSetCompositionStringW
jmp 0x18006f765
mov edi, 0x12
add ebx, 0x8340
cmp ebx, 0x10680
jbe 0x18006f733
mov dword [rsp + 0x60], edi
mov edi, dword [rsp + 0x4c]
lea rbx, str.libeay32
jmp 0x18006f7ab
mov ecx, r12d
movzx eax, byte [rsp + 0x35]
cmp dword [rsp + 0x54], 0
cmovne ecx, eax
mov byte [rsp + 0x35], cl
jmp 0x18006f7c8
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.SHLWAPI.dll_PathCanonicalizeA]
movabs r8, 0x7ffffffffffffffe
mov r10d, 0x2e
mov r11d, 0x4558
lea rdx, [0x180000000]
mov eax, dword [rsp + 0x38]
add edi, 0x9a
mov dword [rsp + 0x4c], edi
cmp edi, eax
jae 0x18006f6af
mov r9, qword [rsp + 0x40]
jmp 0x18006eea1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.18008eb9c
mov eax, ebx
mov rcx, qword [rbp + 0x2e0]
xor rcx, rsp
call fcn.18008f350
mov rbx, qword [rsp + 0x438]
add rsp, 0x3f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret