Function at 0x1a00ce70
Capabilities:
Log keystrokes via input method manager
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
xor esi, esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], esi
cmp dword [0x1a02d06c], esi
jne case.default.0x1a00d1b0
mov eax, dword [edi + 4]
sub eax, 0x100
je 0x1a00ce9f
sub eax, 4
jne 0x1a00d19e
mov ebx, dword [edi + 8]
mov al, byte [edi + 0xe]
mov byte [ebp - 1], al
lea ecx, [ebx - 0x10]
cmp ecx, 9
ja case.0x1a00ceb0.19
jmp dword [ecx*4 + 0x1a00d4a8]
push 0
push 0x40002
push 0x1408
push 0
call sym.HncIMM.dll_HimControl
cmp eax, 0x800
jne 0x1a00cee1
cmp dword [0x1a02b62c], 0x3a4
je case.default.0x1a00d1b0
mov al, byte [ebp - 1]
cmp al, 0xf2
je 0x1a00cf9a
cmp al, 0x38
je 0x1a00cf9a
mov bl, byte [edi + 8]
mov dword [ebp - 0xc], 1
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov byte [0x1a03571b], bl
cmp bl, 0xe5
jne 0x1a00cf22
push dword [edi]
call dword [sym.imp.IMM32.dll_ImmGetVirtualKey]
mov byte [0x1a03571b], al
mov bl, al
cmp al, 0xe5
je 0x1a00cf30
cmp bl, 0x15
je 0x1a00cf30
cmp bl, 0x19
jne 0x1a00d08d
movzx eax, byte [edi + 0xe]
push 0x10
mov dword [ebp - 8], eax
call esi
test ax, ax
lea edx, [ebp - 1]
lea ecx, [ebp - 8]
sets byte [ebp - 1]
call fcn.1a0045e0
mov eax, dword [ebp - 8]
cmp ax, 0x7f
ja 0x1a00d07f
movzx ecx, ax
movzx eax, byte [ebp - 1]
lea eax, [eax + ecx*2]
movzx eax, word [eax*2 + 0x1a01da98]
mov dword [ebp - 8], eax
test ax, ax
jne 0x1a00d086
push 0x90
call esi
test al, 1
je 0x1a00d083
lea eax, [ebx - 0x30]
cmp al, 9
ja 0x1a00d083
movzx eax, bl
jmp 0x1a00d086
push 0
push 0x40002
push 0x1408
push 0
call sym.HncIMM.dll_HimControl
cmp eax, 0x800
je 0x1a00d19e
mov esi, 3
jmp 0x1a00d19e
push 0
push 0x40002
push 0x1408
push 0
call sym.HncIMM.dll_HimControl
cmp eax, 0x800
je 0x1a00d19e
mov esi, 4
jmp 0x1a00d19e
cmp al, 0x1d
jne 0x1a00d008
mov eax, dword [edi + 0xc]
and eax, 0x1000000
neg eax
sbb al, al
and al, 0xf1
add al, 0x10
mov byte [0x1a035718], al
jmp 0x1a00d19e
cmp al, 0x74
setne al
dec al
and al, 0x11
mov byte [0x1a035718], al
jmp 0x1a00d19e
cmp al, 0x38
jne 0x1a00d039
mov eax, dword [edi + 0xc]
and eax, 0x1000000
neg eax
sbb al, al
and al, 0xf1
add al, 0x10
mov byte [0x1a035719], al
jmp 0x1a00d19e
cmp al, 0x73
setne al
dec al
and al, 0x11
mov byte [0x1a035719], al
jmp 0x1a00d19e
cmp al, 0x2a
jne 0x1a00d05c
mov byte [0x1a03571a], 0x10
jmp 0x1a00d19e
cmp al, 0x36
jne 0x1a00d06c
mov byte [0x1a03571a], 1
jmp 0x1a00d19e
cmp al, 0x70
setne al
dec al
and al, 0x11
mov byte [0x1a03571a], al
jmp 0x1a00d19e
xor eax, eax
jmp 0x1a00d086
mov eax, dword [ebp - 8]
mov byte [0x1a03571b], al
mov bl, al
cmp bl, 0x20
je 0x1a00d0ad
cmp bl, 0xd
je 0x1a00d0ad
cmp bl, 0x30
jb 0x1a00d0a1
cmp bl, 0x39
jbe 0x1a00d0ad
sub bl, 0x41
cmp bl, 0x19
ja 0x1a00d190
push 0x10
call esi
movzx ecx, byte [0x1a03571a]
xor edx, edx
test ax, ax
push 0x12
cmovns ecx, edx
mov byte [0x1a03571a], cl
call esi
movzx ecx, byte [0x1a035719]
xor edx, edx
test ax, ax
push 0x11
cmovns ecx, edx
mov byte [0x1a035719], cl
call esi
movzx ecx, byte [0x1a035718]
xor edx, edx
mov bl, byte [0x1a035719]
test ax, ax
cmovns ecx, edx
mov dl, byte [0x1a03571a]
mov al, dl
mov byte [0x1a035718], cl
or al, bl
or al, cl
je 0x1a00d190
movzx edi, dl
shl edi, 8
movzx eax, bl
or edi, eax
movzx eax, cl
shl edi, 8
mov ecx, 1
or edi, eax
movzx eax, byte [0x1a03571b]
shl edi, 8
or edi, eax
call fcn.1a009720
cmp edi, eax
jne 0x1a00d144
mov esi, 1
jmp 0x1a00d157
mov ecx, 2
call fcn.1a009720
cmp edi, eax
jne 0x1a00d190
mov esi, 2
push 0
push 0x40002
push 0x1408
push 0
call sym.HncIMM.dll_HimControl
cmp eax, 0x800
jne 0x1a00d19e
mov ebx, dword [sym.imp.HncFoundation.dll_HncGetWinVersion]
call ebx
cmp eax, 6
je 0x1a00d185
call ebx
cmp eax, 7
jne 0x1a00d19e
mov ecx, esi
call fcn.1a0096c0
cmp edi, eax
jne 0x1a00d19e
xor esi, esi
mov eax, 3
cmp dword [ebp - 0xc], 1
cmove esi, eax
lea ecx, [ebp - 0x3c]
call fcn.1a006320
dec esi
cmp esi, 3
ja case.default.0x1a00d1b0
jmp dword [esi*4 + 0x1a00d4d0]
push 0
push 0x40002
push 0x1408
push 0
call sym.HncIMM.dll_HimControl
mov ecx, 0x412
mov edx, 0x409
cmp eax, ecx
cmove ecx, edx
call fcn.1a00ce10
mov esi, eax
cmp esi, 0xffffffff
je case.0x1a00d1b0.1
push 0
push 0x10800
push 0x1408
push 0
call sym.HncIMM.dll_HimControl
movzx eax, si
push eax
push 0x40008
push 0x1408
push 0
call sym.HncIMM.dll_HimControl
mov eax, esi
sar eax, 0x10
movzx eax, al
push eax
push 0x70008
push 0x1408
push 0
call sym.HncIMM.dll_HimControl
mov ecx, esi
call fcn.1a005a50
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x10800
push 0x1408
push 0
call sym.HncIMM.dll_HimControl
push 0
push 0x40002
push 0x1408
push 0
call sym.HncIMM.dll_HimControl
cmp eax, 0x81e
jne 0x1a00d289
push 0
push 0x70002
push 0x1408
push 0
call sym.HncIMM.dll_HimControl
shl eax, 0x10
or eax, 0x804
mov ecx, eax
call fcn.1a005a50
call fcn.1a005a20
mov esi, dword [ebp - 0x3c]
cmp eax, esi
jne 0x1a00d298
mov esi, dword [ebp - 0x38]
mov ecx, esi
movzx edi, si
sar ecx, 0x10
mov al, cl
and al, 0xf0
cmp al, 0x10
jne 0x1a00d2ad
shr esi, 0x10
jmp 0x1a00d2b0
movzx esi, cl
cmp edi, 0x804
je 0x1a00d2c0
cmp edi, 0x81e
jne 0x1a00d2ca
cmp esi, 2
jne 0x1a00d2ca
mov edi, 0x81e
lea eax, [ebp - 0x28]
push eax
push edi
call sym.HncIMM.dll_HimGetLangCfgEnv
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], esi
push eax
push edi
call sym.HncIMM.dll_HimSetLangCfgEnv
add esp, 0x10
push edi
push 0x40008
push 0x1408
push 0
call sym.HncIMM.dll_HimControl
push 0
push 0x48042
push 0x1408
push 0
call sym.HncIMM.dll_HimControl
test eax, eax
je 0x1a00d334
cmp edi, 0x411
ja 0x1a00d325
je 0x1a00d332
test edi, edi
je 0x1a00d332
cmp edi, 0x404
je 0x1a00d332
jmp 0x1a00d334
sub edi, 0x804
je 0x1a00d332
sub edi, 0x1a
jne 0x1a00d334
xor esi, esi
push esi
push 0x70008
push 0x1408
push 0
call sym.HncIMM.dll_HimControl
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x10800
push 0x1408
push 0
call sym.HncIMM.dll_HimControl
push 0
push 0x40002
push 0x1408
push 0
call sym.HncIMM.dll_HimControl
cmp eax, 0x81e
jne 0x1a00d3a1
push 0
push 0x70002
push 0x1408
push 0
call sym.HncIMM.dll_HimControl
shl eax, 0x10
or eax, 0x804
mov ecx, eax
call fcn.1a005a50
call fcn.1a005a20
mov esi, dword [ebp - 0x34]
cmp eax, esi
jne 0x1a00d3b0
mov esi, dword [ebp - 0x30]
mov ecx, esi
movzx edi, si
sar ecx, 0x10
mov al, cl
and al, 0xf0
cmp al, 0x10
jne 0x1a00d3c5
shr esi, 0x10
jmp 0x1a00d3c8
movzx esi, cl
cmp edi, 0x804
je 0x1a00d3d8
cmp edi, 0x81e
jne 0x1a00d3e2
cmp esi, 2
jne 0x1a00d3e2
mov edi, 0x81e
lea eax, [ebp - 0x28]
push eax
push edi
call sym.HncIMM.dll_HimGetLangCfgEnv
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], esi
push eax
push edi
call sym.HncIMM.dll_HimSetLangCfgEnv
add esp, 0x10
push edi
push 0x40008
push 0x1408
push 0
call sym.HncIMM.dll_HimControl
push 0
push 0x48042
push 0x1408
push 0
call sym.HncIMM.dll_HimControl
test eax, eax
je 0x1a00d44c
cmp edi, 0x411
ja 0x1a00d43d
je 0x1a00d44a
test edi, edi
je 0x1a00d44a
cmp edi, 0x404
je 0x1a00d44a
jmp 0x1a00d44c
sub edi, 0x804
je 0x1a00d44a
sub edi, 0x1a
jne 0x1a00d44c
xor esi, esi
push esi
push 0x70008
push 0x1408
push 0
call sym.HncIMM.dll_HimControl
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x10800
push 0x1408
push 0
call sym.HncIMM.dll_HimControl
push 0
push 0x62000
push 0x1402
push 0
call sym.HncIMM.dll_HimControl
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret