Function at 0x1a005ac0
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x798
mov eax, dword [0x1a02400c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0xffffffffffffffeb
push dword [0x1a02b604]
mov dword [ebp - 0x798], esi
xor edi, edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, eax
je 0x1a005e42
mov ebx, dword [eax]
mov dword [ebp - 0x794], ebx
test ebx, ebx
je 0x1a005e42
push 0x78a
lea eax, [ebp - 0x790]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
movzx eax, word [ebx + 0x1d36]
add esp, 0xc
mov ecx, eax
test ax, ax
jne 0x1a005b58
cmp word [ebx + 0x15b0], di
jne 0x1a005cc2
lea eax, [ebp - 0x790]
push eax
push 0x101
push 0x1400
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
movzx ecx, word [ebx + 0x1d36]
mov edi, eax
test cx, cx
je 0x1a005cc2
movzx eax, word [ebx + 4]
cmp eax, 0x800
jne 0x1a005b71
call sym.HncIMM.dll_HimSysGetImeLang
cmp eax, 0x411
je 0x1a005b94
cmp eax, 0x804
je 0x1a005b94
cmp eax, 0x81e
je 0x1a005b94
cmp eax, 0x404
je 0x1a005b94
mov eax, 1
jmp 0x1a005b96
xor eax, eax
mov edx, dword [ebp - 0x794]
lea edi, [ebp - 0x790]
mov word [ebp - 0xa], ax
add ebx, 0x1ab2
xor eax, eax
mov ecx, 0xa0
mov word [ebp - 0x10], ax
lea esi, [edx + 0x1ab6]
movzx eax, word [ebx]
mov word [ebp - 0xe], ax
movzx eax, word [edx + 0x1ab4]
mov word [ebp - 0xc], ax
movzx eax, word [edx + 8]
mov word [ebp - 8], ax
lea eax, [ebp - 0x790]
rep movsd dword es:[edi], dword [esi]
push eax
lea esi, [edx + 0x1d38]
mov ecx, 0xa0
push 0x101
lea edi, [ebp - 0x510]
rep movsd dword es:[edi], dword [esi]
push 0x1400
push dword [ebp - 0x798]
lea esi, [edx + 0x1fb8]
mov ecx, 0xa0
lea edi, [ebp - 0x290]
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x786
push 0
push ebx
mov edi, eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp word [ebp - 8], 0
jne 0x1a005cbc
lea ecx, [ebp - 0x790]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1a005c42
sub ecx, edx
sar ecx, 1
je 0x1a005cbc
movzx eax, word [ebp + ecx*2 - 0x792]
mov ecx, eax
cmp eax, 0x20
je 0x1a005ca9
mov eax, 0x3000
cmp cx, ax
je 0x1a005ca9
mov esi, ecx
push esi
push str.___________:___.__
call dword [sym.imp.VCRUNTIME140.dll_wcschr]
add esp, 8
test eax, eax
jne 0x1a005ca9
mov eax, 0x2018
cmp si, ax
je 0x1a005ca9
mov eax, 0x2019
cmp si, ax
je 0x1a005ca9
mov eax, 0x201c
cmp si, ax
je 0x1a005ca9
mov eax, 0x201d
cmp si, ax
jne 0x1a005cbc
push 0
push 0x162000
push 0x1402
push 0
call sym.HncIMM.dll_HimControl
mov ebx, dword [ebp - 0x794]
cmp word [ebx + 0x15b0], 0
je 0x1a005e20
movzx eax, word [ebx + 4]
cmp eax, 0x800
jne 0x1a005ce0
call sym.HncIMM.dll_HimSysGetImeLang
cmp eax, 0x411
je 0x1a005d07
cmp eax, 0x804
je 0x1a005d07
cmp eax, 0x81e
je 0x1a005d07
cmp eax, 0x404
je 0x1a005d07
mov esi, 1
mov word [ebp - 0xa], si
jmp 0x1a005d10
xor ecx, ecx
mov word [ebp - 0xa], cx
lea esi, [ecx + 1]
mov edx, dword [0x1a02b62c]
cmp eax, 0x412
je 0x1a005d43
mov ecx, dword [ebx + 4]
mov eax, ecx
sar eax, 0x10
and al, 0xf0
cmp al, 0x20
jne 0x1a005d33
cmp edx, 0x3b5
je 0x1a005d43
cmp ecx, 0xe0000
je 0x1a005d43
xor eax, eax
mov word [ebp - 0x10], ax
jmp 0x1a005d47
mov word [ebp - 0x10], si
movzx eax, word [ebx + 0x132c]
lea esi, [ebx + 0x1330]
mov word [ebp - 0xe], ax
mov ecx, 0x50
movzx eax, word [ebx + 0x132e]
lea edi, [ebp - 0x790]
mov word [ebp - 0xc], ax
movzx eax, word [ebx + 8]
mov word [ebp - 8], ax
rep movsd dword es:[edi], dword [esi]
lea esi, [ebx + 0x15b2]
mov ecx, 0x50
lea edi, [ebp - 0x510]
rep movsd dword es:[edi], dword [esi]
lea esi, [ebx + 0x1832]
mov ecx, 0x50
lea edi, [ebp - 0x290]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x798]
cmp edx, 0x3a4
jne 0x1a005ddb
push edi
call dword [sym.imp.IMM32.dll_ImmGetContext]
mov esi, eax
test esi, esi
je 0x1a005ddb
call dword [sym.imp.HncFoundation.dll_HncGetWinVersion]
push 0
push 0
push 0x80
push esi
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
push esi
push edi
mov word [ebp - 0xe], ax
call dword [sym.imp.IMM32.dll_ImmReleaseContext]
lea eax, [ebp - 0x790]
push eax
push 0x100
push 0x1400
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x280
push 0
push 0x1a0353e0
mov edi, eax
call sub.VCRUNTIME140.dll_memset
lea eax, [ebx + 0x424]
push eax
push 0x140
push 0x1a0353e0
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0x18
test edi, edi
jne 0x1a005e2d
push edi
push edi
push 4
call sym.HncIMM.dll_HimClear
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1a01aaa5
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1a01aaa5
mov esp, ebp
pop ebp
ret 4