Function at 0x1a015cd0
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf40
mov eax, dword [0x1a02400c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0xf40], 0
push esi
push edi
xorps xmm0, xmm0
mov dword [ebp - 0xf30], ebx
push dword [ebx]
lea eax, [ebp - 0xf38]
movq qword [ebp - 0xf38], xmm0
mov dword [ebp - 0xf3c], eax
call dword [sym.imp.IMM32.dll_ImmGetContext]
mov ebx, dword [ebx + 0xc]
mov edi, eax
call dword [sym.imp.HncFoundation.dll_HncGetWinVersion]
mov esi, dword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
test bl, bl
jns 0x1a015d70
push 0
push 0
push 0x80
push edi
call esi
push 0xffffffffffffffeb
push dword [0x1a02b604]
movzx eax, ax
mov dword [ebp - 0xf28], eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, eax
je 0x1a015d70
mov eax, dword [eax]
test eax, eax
je 0x1a015d70
mov ecx, dword [ebp - 0xf28]
mov word [eax + 0x420], cx
mov word [eax + 0x132c], cx
nop dword [eax]
test ebx, 0x100
je 0x1a015db2
push 0
push 0
push 0x100
push edi
call esi
push 0xffffffffffffffeb
push dword [0x1a02b604]
movzx eax, ax
mov dword [ebp - 0xf28], eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, eax
je 0x1a015db2
mov eax, dword [eax]
test eax, eax
je 0x1a015db2
mov ecx, dword [ebp - 0xf28]
mov word [eax + 0x132e], cx
test ebx, 0x800
je 0x1a0160cf
push 0
push 0
push 3
call sym.HncIMM.dll_HimClear
push 0
push 0
push 0x800
push edi
call esi
test eax, eax
je 0x1a0160e0
xor eax, eax
push 0x280
push eax
mov word [ebp - 0x294], ax
lea eax, [ebp - 0x514]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x514]
push 0x280
push eax
push 0x800
push edi
call esi
push ecx
lea edx, [ebp - 0x514]
mov ecx, 0x800
call fcn.1a0050f0
add esp, 4
test ebx, 0x1000
je 0x1a015f8d
push 0x280
lea eax, [ebp - 0xa1c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa1c]
push 0x280
push eax
push 0x1000
push edi
call esi
push 0xffffffffffffffeb
push dword [0x1a02b604]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, eax
je 0x1a015ebb
mov esi, dword [eax]
test esi, esi
je 0x1a015eb5
mov ax, word [ebp - 0xa1c]
xor edx, edx
cmp ax, word [esi + 0x1d36]
ja 0x1a015eb5
mov eax, 0x140
cmp dx, ax
jae 0x1a015eb5
movzx ecx, dx
inc edx
movzx eax, word [ebp + ecx*2 - 0xa1c]
mov word [esi + ecx*2 + 0x1fb8], ax
movzx eax, dx
movzx eax, word [ebp + eax*2 - 0xa1c]
cmp ax, word [esi + 0x1d36]
jbe 0x1a015e83
mov esi, dword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
test ebx, 0x200
je 0x1a015fc2
xor eax, eax
push 0x280
push eax
mov word [ebp - 0x294], ax
lea eax, [ebp - 0x514]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x514]
push 0x280
push eax
push 0x200
push edi
call esi
push 0xffffffffffffffeb
push dword [0x1a02b604]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, eax
je 0x1a016003
mov edx, dword [eax]
mov dword [ebp - 0xf2c], edx
test edx, edx
je 0x1a016003
lea ecx, [ebp - 0x514]
lea eax, [ecx + 2]
mov dword [ebp - 0xf28], eax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1a015f30
sub ecx, dword [ebp - 0xf28]
mov eax, 0x13f
sar ecx, 1
cmp ecx, eax
cmovb eax, ecx
mov word [edx + 0xe2a], ax
movzx eax, ax
push eax
lea eax, [ebp - 0x514]
push eax
lea eax, [edx + 0xbaa]
push 0x140
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov ecx, dword [ebp - 0xf2c]
add esp, 0x10
xor edx, edx
movzx eax, word [ecx + 0xe2a]
mov word [ecx + eax*2 + 0xbaa], dx
jmp 0x1a016003
push ecx
lea edx, [ebp - 0xa1c]
mov ecx, 0x20
call fcn.1a004eb0
add esp, 4
test eax, eax
je 0x1a015ebb
push ecx
lea edx, [ebp - 0xa1c]
mov ecx, 0x20
call fcn.1a0050f0
add esp, 4
jmp 0x1a015ebb
push 0x282
lea eax, [ebp - 0x514]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 8
lea edx, [ebp - 0x514]
mov ecx, 1
call fcn.1a004eb0
add esp, 4
test eax, eax
je 0x1a016003
push ecx
lea edx, [ebp - 0x514]
mov ecx, 1
call fcn.1a0050f0
add esp, 4
test ebx, 0x400
je 0x1a0160a4
push 0x280
lea eax, [ebp - 0xa1c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa1c]
push 0x280
push eax
push 0x400
push edi
call esi
push 0xffffffffffffffeb
push dword [0x1a02b604]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, eax
je 0x1a0160e0
mov esi, dword [eax]
test esi, esi
je 0x1a0160e0
mov ax, word [ebp - 0xa1c]
xor edx, edx
cmp ax, word [esi + 0xe2a]
ja 0x1a0160e0
nop
mov eax, 0x140
cmp dx, ax
jae 0x1a0160e0
movzx ecx, dx
inc edx
movzx eax, word [ebp + ecx*2 - 0xa1c]
mov word [esi + ecx*2 + 0x10ac], ax
movzx eax, dx
movzx eax, word [ebp + eax*2 - 0xa1c]
cmp ax, word [esi + 0xe2a]
jbe 0x1a016070
jmp 0x1a0160e0
push ecx
lea edx, [ebp - 0xa1c]
mov ecx, 4
call fcn.1a004eb0
add esp, 4
test eax, eax
je 0x1a0160e0
push ecx
lea edx, [ebp - 0xa1c]
mov ecx, 4
call fcn.1a0050f0
jmp 0x1a0160da
push ecx
mov ecx, 3
call fcn.1a015c00
add esp, 4
nop dword [eax]
test bl, 8
je 0x1a016329
push 0x282
lea eax, [ebp - 0x514]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
push 0x282
push eax
mov word [ebp - 0xca4], ax
lea eax, [ebp - 0xa1c]
push eax
call sub.VCRUNTIME140.dll_memset
push 0x280
lea eax, [ebp - 0xf24]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
lea eax, [ebp - 0xf24]
add esp, 0x24
push 0x280
push eax
push 8
push edi
call esi
mov ecx, dword [0x1a02b650]
lea edx, [ebp - 0xf24]
test eax, eax
mov eax, 1
cmovg ecx, eax
mov dword [0x1a02b650], ecx
push ecx
lea ecx, [eax + 7]
call fcn.1a0050f0
add esp, 4
test bl, 0x10
je 0x1a01620a
push 0x282
lea eax, [ebp - 0x514]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0
push 0
push 0x10
push edi
call esi
push 0x140
mov dword [ebp - 0xf2c], eax
lea eax, [ebp - 0x514]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x514]
push 0x140
push eax
push 0x10
push edi
call esi
mov edx, dword [ebp - 0xf2c]
xor ecx, ecx
test edx, edx
jle 0x1a0161f6
nop dword [eax]
cmp dword [0x1a02b62c], 0x3b5
mov eax, 5
je 0x1a0161e9
movzx eax, byte [ebp + ecx - 0x514]
mov word [ebp + ecx*2 - 0xa1c], ax
inc ecx
cmp ecx, edx
jl 0x1a0161d0
push ecx
lea edx, [ebp - 0xa1c]
mov ecx, 0x10
call fcn.1a0050f0
add esp, 4
test bl, 0x20
je 0x1a016252
xor eax, eax
push 0x280
push eax
mov word [ebp - 0x79c], ax
lea eax, [ebp - 0xa1c]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa1c]
push 0x280
push eax
push 0x20
push edi
call esi
push ecx
lea edx, [ebp - 0xa1c]
mov ecx, 0x20
call fcn.1a0050f0
add esp, 4
test bl, 1
je 0x1a01629a
xor eax, eax
push 0x280
push eax
mov word [ebp - 0x294], ax
lea eax, [ebp - 0x514]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x514]
push 0x280
push eax
push 1
push edi
call esi
push ecx
lea edx, [ebp - 0x514]
mov ecx, 1
call fcn.1a0050f0
add esp, 4
test bl, 2
je 0x1a0162e2
xor eax, eax
push 0x280
push eax
mov word [ebp - 0x294], ax
lea eax, [ebp - 0x514]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x514]
push 0x280
push eax
push 2
push edi
call esi
push ecx
lea edx, [ebp - 0x514]
mov ecx, 2
call fcn.1a0050f0
add esp, 4
test bl, 4
je 0x1a016341
xor eax, eax
push 0x280
push eax
mov word [ebp - 0x79c], ax
lea eax, [ebp - 0xa1c]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa1c]
push 0x280
push eax
push 4
push edi
call esi
push ecx
lea edx, [ebp - 0xa1c]
mov ecx, 4
call fcn.1a0050f0
jmp 0x1a01633e
push ecx
mov ecx, 2
mov dword [0x1a02b650], 0
call fcn.1a015c00
add esp, 4
test ebx, ebx
jne 0x1a016351
push ecx
lea ecx, [ebx + 4]
call fcn.1a015c00
add esp, 4
mov eax, dword [ebp - 0xf30]
push edi
push dword [eax]
call dword [sym.imp.IMM32.dll_ImmReleaseContext]
mov ecx, dword [ebp - 0xf40]
xor esi, esi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test ecx, ecx
jle 0x1a01639b
mov eax, dword [ebp - 0xf3c]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x1a016396
sub eax, 8
cmp dword [eax], 0xdddd
jne 0x1a016396
push eax
call edi
mov ecx, dword [ebp - 0xf40]
add esp, 4
inc esi
cmp esi, ecx
jl 0x1a016372
cmp ecx, 2
jle 0x1a0163ab
push dword [ebp - 0xf3c]
call edi
add esp, 4
mov ecx, dword [ebp - 8]
mov eax, 3
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1a01aaa5
mov esp, ebp
pop ebp
ret