Function at 0x180020660
Capabilities:
Get file size
Log keystrokes via input method manager
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x18003acf8]
xor rax, rsp
mov qword [rbp + 0x140], rax
movzx ebx, byte [rsp + 0x40]
mov esi, r8d
mov dword [rsp + 0x50], r8d
mov rdi, rcx
mov r8, rdx
mov qword [rbp - 0x30], rdx
mov qword [rbp - 0x68], rcx
lea edx, [rsi + 9]
mov dword [rsp + 0x44], edx
cmp esi, edx
jae case.0x1800207b4.5
movzx r13d, byte [rsp + 0x40]
lea edx, [rsi - 0x73]
mov r15d, dword [rsp + 0x54]
lea r10, [0x180000000]
mov r12d, dword [rsp + 0x54]
xor r9d, r9d
mov r14, qword [rbp - 0x70]
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x48], edx
cmp edx, 9
ja case.default.0x1800206f7
mov ecx, dword [r10 + rdx*4 + 0x20bdc]
add rcx, r10
jmp rcx
mov rax, qword [str.IS_CLIENT_THREAD_dcontext_]
mov rdi, r9
test rax, rax
je 0x180020738
nop dword [rax + rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
lea r10, [0x180000000]
lea rdi, [rdi + 1]
mov rax, qword [r10 + rdi*8 + 0x37cc0]
test rax, rax
jne 0x180020710
mov edx, dword [rsp + 0x48]
xor r9d, r9d
mov rax, qword [str.if__currentValue___n__delta___maxInt__]
mov rdi, r9
test rax, rax
je case.0x1800206f7.8
nop dword [rax + rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
lea r10, [0x180000000]
lea rdi, [rdi + 1]
mov rax, qword [r10 + rdi*8 + 0x38530]
test rax, rax
jne 0x180020750
jmp 0x180020baf
cmp qword [rbp - 0x78], 0xffffffffffffffff
jne 0x1800208d2
mov r14d, r9d
nop dword [rax]
nop dword [rax + rax]
cmp r14d, 0xe6
ja case.0x1800207b4.6
mov eax, r14d
movzx eax, byte [r10 + rax + 0x20c20]
mov ecx, dword [r10 + rax*4 + 0x20c04]
add rcx, r10
jmp rcx
mov r9d, dword [rsp + 0x5c]
xor r8d, r8d
mov edx, dword [rsp + 0x64]
mov rcx, qword [rbp - 0x50]
call sub.IMM32.dll_ImmGetCompositionStringW
xor bl, bl
xor r9d, r9d
jmp 0x1800208b0
mov dword [rsp + 0x5c], r9d
test r13b, r13b
je case.0x1800207b4.6
mov esi, 0x12a
nop dword [rax + rax]
mov eax, esi
sub eax, 0x12a
je 0x18002086e
sub eax, 1
je 0x180020857
sub eax, 1
je 0x18002084d
cmp eax, 1
jne 0x180020877
test r13b, r13b
je 0x180020877
mov edi, 0xd8
cmp edi, 0xd8
je 0x180020834
cmp edi, 0x2d90
jne 0x18002083a
mov r8d, r15d
lea rdx, [rbp + 0x30]
mov ecx, r12d
call qword [sym.imp.WINMM.dll_waveOutGetErrorTextA]
jmp 0x18002083a
mov r15d, 0x104
add edi, 0x2cb8
cmp edi, 0x5970
jbe 0x180020812
xor r9d, r9d
jmp 0x180020877
test r12d, r12d
jne 0x180020877
xor r13b, r13b
jmp 0x180020877
mov rcx, qword [rbp - 0x58]
lea rdx, [rsp + 0x60]
call qword [sym.imp.WINMM.dll_waveOutGetID]
mov r12d, eax
xor r9d, r9d
jmp 0x180020877
mov dword [rsp + 0x60], r9d
mov qword [rbp - 0x58], r9
inc esi
cmp esi, 0x12e
jb 0x1800207f0
jmp 0x1800208b0
mov r13b, 1
jmp case.0x1800207b4.6
mov qword [rbp - 0x50], r9
jmp case.0x1800207b4.6
mov dword [rsp + 0x64], 0x80
call qword [sym.imp.WINMM.dll_waveOutGetNumDevs]
movzx r13d, r13b
mov r9d, 0
test eax, eax
cmove r13d, r9d
lea r10, [0x180000000]
add r14d, 0x2e
lea eax, [r14 + 0x74]
cmp eax, 0x188
jb 0x180020790
mov esi, dword [rsp + 0x50]
mov edx, dword [rsp + 0x48]
mov dword [rsp + 0x58], r9d
mov r14, r9
mov qword [rbp - 0x70], r9
jmp case.0x1800206f7.8
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x74], r9d
cmp eax, dword [rsp + 0x58]
je 0x180020a97
mov esi, 0xca
nop dword [rax + rax]
cmp esi, 0x274
ja 0x18002098d
je 0x18002096a
cmp esi, 0xca
je 0x180020a81
cmp esi, 0x158
je 0x18002094f
cmp esi, 0x1e6
jne 0x180020a81
mov qword [rdi + 0x10], r9
mov rax, rdi
cmp qword [rdi + 0x18], 0x10
mov qword [rbp - 0x80], 0xffffffffffffffff
jb 0x180020947
mov rax, qword [rdi]
mov byte [rax], 0
jmp 0x180020a81
xorps xmm0, xmm0
mov byte [rsp + 0x40], 1
xor eax, eax
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 0x28], rax
movups xmmword [rbp + 0x18], xmm0
jmp 0x180020a81
mov rcx, qword [rbp - 0x80]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.dbghelp.dll_SymInitialize]
xor r9d, r9d
test eax, eax
jne 0x180020a81
mov byte [rsp + 0x40], al
jmp 0x180020a81
cmp esi, 0x302
je 0x1800209dd
cmp esi, 0x390
je 0x1800209d6
cmp esi, 0x41e
jne 0x180020a81
movzx eax, bl
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.1800259a0
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x250
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor bl, bl
jmp 0x180020a81
lea r9, [rbp - 0x60]
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x5c]
lea rcx, [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
cmp byte [rsp + 0x40], 0
je 0x180020a7e
mov r14, qword [rbp - 0x48]
mov edi, 0x19
mov eax, edi
sub eax, 0x19
je 0x180020a76
sub eax, 0x49
je 0x180020a54
cmp eax, 0x49
jne 0x180020a38
mov rcx, qword [rbp - 0x80]
lea r9, [rbp - 0x20]
lea r8, [rsp + 0x68]
mov rdx, r14
call qword [sym.imp.dbghelp.dll_SymGetLineFromAddr64]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.dbghelp.dll_SymCleanup]
xor r9d, r9d
add edi, 0x49
cmp edi, 0xf4
jb 0x180020a07
mov rdi, qword [rbp - 0x68]
mov qword [rbp - 0x48], r14
mov r14, qword [rbp - 0x70]
jmp 0x180020a81
xor r9d, r9d
xorps xmm0, xmm0
xor eax, eax
mov dword [rsp + 0x68], r9d
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp], rax
movups xmmword [rbp - 0x10], xmm0
mov dword [rbp - 0x20], 0x28
jmp 0x180020a3b
xor r9d, r9d
mov r14d, r9d
jmp 0x180020a3b
xor r9d, r9d
add esi, 0x8e
cmp esi, 0x4ac
jb 0x180020900
mov esi, dword [rsp + 0x50]
mov r8d, dword [rsp + 0x70]
lea r9, [rsp + 0x6c]
mov rcx, qword [rbp - 0x40]
mov rdx, r14
call sub.IMM32.dll_ImmEscapeW
jmp 0x180020ba8
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x38], r9
jmp case.0x1800206f7.8
cmp qword [r8 + 0x18], 8
mov rcx, r8
jb 0x180020acc
mov rcx, qword [r8]
mov qword [rsp + 0x30], r9
mov edx, 0x80000000
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp - 0x78], rax
jmp 0x180020ba8
cmp qword [rdi + 0x18], 0x10
mov rdx, rdi
jb 0x180020b09
mov rdx, qword [rdi]
mov r8d, dword [rsp + 0x4c]
mov rcx, qword [rbp - 0x78]
mov qword [rsp + 0x20], r9
lea r9, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x6c], 0x100b
jmp 0x180020ba8
mov rcx, qword [rbp - 0x78]
xor edx, edx
mov dword [rsp + 0x54], 0x13
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, eax
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x4c], eax
call fcn.180021650
jmp 0x180020ba8
mov dword [rsp + 0x70], 3
mov dword [rsp + 0x78], 4
jmp case.0x1800206f7.8
mov edi, 0xbc
mov eax, edi
sub eax, 0xbc
je 0x180020b87
cmp eax, 1
jne 0x180020b9e
jmp 0x1800209ac
mov r9d, dword [rsp + 0x74]
mov r8d, dword [rsp + 0x78]
mov edx, dword [rsp + 0x54]
mov rcx, qword [rbp - 0x38]
call sub.IMM32.dll_ImmNotifyIME
inc edi
cmp edi, 0xbe
jb 0x180020b74
lea r10, [0x180000000]
mov edx, dword [rsp + 0x48]
xor r9d, r9d
mov eax, dword [rsp + 0x44]
inc esi
inc edx
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x48], edx
cmp esi, eax
jae case.0x1800207b4.5
mov rdi, qword [rbp - 0x68]
mov r8, qword [rbp - 0x30]
jmp 0x1800206e3