Function at 0x2bbf0fcc0
Capabilities:
Log keystrokes via input method manager

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x108
mov rsi, rcx
cmp edx, 0x51
je 0x2bbf0fff8
ja 0x2bbf0fd70
cmp edx, 0x14
je 0x2bbf0fd99
ja 0x2bbf0fdc8
cmp edx, 1
je 0x2bbf0fd99
cmp edx, 0xf
jne 0x2bbf0fde0
mov edx, 0xf
mov qword [rsp + 0x168], r9
mov qword [rsp + 0x160], r8
call sym.GenerateXEvent
mov r9, qword [rsp + 0x168]
mov edx, 0xf
mov rcx, rsi
mov r8, qword [rsp + 0x160]
call qword [sym.imp.USER32.dll_DefWindowProcW]
mov rbp, qword [0x2bc041fd0]
mov rbx, rax
mov rax, qword [rbp]
call qword [rax + 0x6f8]
mov rax, rbx
add rsp, 0x108
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp edx, 0x10f
je 0x2bbf0fe40
ja 0x2bbf0fda8
cmp edx, 0x109
jne 0x2bbf0fde0
cmp r8, 0xffff
je 0x2bbf0fdcd
mov edx, 0x109
call sym.GenerateXEvent
mov rbp, qword [0x2bc041fd0]
xor ebx, ebx
jmp 0x2bbf0fd48
lea eax, [rdx - 0x400]
cmp eax, 0xd
ja 0x2bbf0fde0
call sym.tcl9tk90.dll_TkWinEmbeddedEventProc
mov rbp, qword [0x2bc041fd0]
mov rbx, rax
jmp 0x2bbf0fd48
cmp edx, 0x20
jne 0x2bbf0fde0
mov rbp, qword [0x2bc041fd0]
mov ebx, 1
jmp 0x2bbf0fd48
lea rax, [rsp + 0x38]
mov rcx, rsi
mov qword [rsp + 0x168], r9
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x160], r8
mov dword [rsp + 0x158], edx
call sym.TkTranslateWinEvent
mov edx, dword [rsp + 0x158]
mov r8, qword [rsp + 0x160]
test eax, eax
mov r9, qword [rsp + 0x168]
je 0x2bbf10008
mov rbx, qword [rsp + 0x38]
mov rbp, qword [0x2bc041fd0]
jmp 0x2bbf0fd48
mov qword [rsp + 0x38], 0
test r9d, 0x800
je 0x2bbf0ffd8
mov qword [rsp + 0x168], r9
mov qword [rsp + 0x160], r8
call sym.ImmGetContext
mov r8, qword [rsp + 0x160]
mov r9, qword [rsp + 0x168]
test rax, rax
mov r12, rax
je 0x2bbf0ffd8
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800
mov rcx, rax
call sym.ImmGetCompositionStringW
mov rbp, qword [0x2bc041fd0]
mov ebx, eax
test eax, eax
jle 0x2bbf0ffc0
movsxd rcx, eax
mov rax, qword [rbp]
call qword [rax + 0x28]
mov r9d, ebx
mov edx, 0x800
mov rcx, r12
mov r8, rax
mov r13, rax
lea rbx, [rsp + 0x40]
call sym.ImmGetCompositionStringW
mov rcx, rsi
mov rdi, rbx
mov r14d, eax
mov r15d, eax
shr r14d, 0x1f
add r14d, eax
call sym.tcl9tk90.dll_Tk_HWNDToWindow
mov ecx, 0x18
sar r14d, 1
mov rdx, rax
xor eax, eax
rep stosq qword [rdi], rax
xor edi, edi
mov rcx, qword [rdx]
movq xmm0, qword [rdx + 0x28]
mov dword [rsp + 0x48], 0xfffffffd
mov qword [rsp + 0x50], rcx
mov eax, dword [rcx + 0x90]
lea r8d, [rax + 1]
mov dword [rsp + 0x44], eax
mov dword [rcx + 0x90], r8d
movsxd r8, dword [rdx + 0x10]
mov rax, r8
shl rax, 4
sub rax, r8
mov r8, qword [rcx + 0xe0]
lea rax, [r8 + rax*8]
movhps xmm0, qword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm0
call sym.tcl9tk90.dll_TkWinGetModifierState
mov dword [rsp + 0x84], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x8c], 1
mov dword [rsp + 0x70], eax
cmp r15d, 1
jg 0x2bbf0ff9d
jmp 0x2bbf0ffb6
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x40], 2
add rdi, 1
call sym.tcl9tk90.dll_Tk_QueueWindowEvent
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x40], 3
call sym.tcl9tk90.dll_Tk_QueueWindowEvent
cmp r14d, edi
jle 0x2bbf0ffb6
movzx edx, word [r13 + rdi*2]
mov eax, edx
mov dword [rsp + 0x88], edx
and ax, 0xfc00
cmp ax, 0xd800
jne 0x2bbf0ff70
mov rax, qword [rbp]
mov rcx, r13
call qword [rax + 0x30]
mov rdx, r12
mov rcx, rsi
xor ebx, ebx
call sym.ImmReleaseContext
jmp 0x2bbf0fd48
mov edx, 0x10f
mov rcx, rsi
call qword [sym.imp.USER32.dll_DefWindowProcW]
mov rbp, qword [0x2bc041fd0]
mov rbx, rax
jmp 0x2bbf0fd48
mov ecx, r8d
call sym.UpdateInputLanguage
jmp 0x2bbf0fdcd
mov rcx, rsi
call qword [sym.imp.USER32.dll_DefWindowProcW]
mov rbp, qword [0x2bc041fd0]
mov rbx, rax
jmp 0x2bbf0fd48