Function at 0x18001d3e0
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc90
mov rsi, rcx
mov r14, r8
imul ecx, edx, 0x6d2
mov r12d, edx
mov edi, edx
mov dword [rsp + 0xcd8], ecx
cmp edx, ecx
ja 0x18001d569
mov rbp, qword [rsp + 0xcf0]
xor ebx, ebx
movzx r15d, byte [rsp + 0xcd8]
mov eax, ecx
mov r13, qword [rsp + 0x80]
nop dword [rax]
cmp edi, 0x3309
ja 0x18001d5a5
je 0x18001d58c
mov eax, edi
sub eax, 0x43
je 0x18001d53e
sub eax, 0x32
je 0x18001d4ac
sub eax, 0x18
je 0x18001d482
cmp eax, 0x70
mov eax, dword [rsp + 0xcd8]
jne 0x18001d6b0
mov r15b, 1
mov r13, rbx
jmp 0x18001d6b0
cmp qword [r14], 0
mov rax, rbx
jbe 0x18001d6a9
nop
mov edx, dword [rsi]
mov ecx, eax
and ecx, 3
shl ecx, 3
shr edx, cl
mov byte [rax + rbp], dl
inc rax
cmp rax, qword [r14]
jb 0x18001d490
jmp 0x18001d6a9
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x48], rbx
xor r9d, r9d
mov qword [rsp + 0x40], rbx
xor r8d, r8d
mov qword [rsp + 0x38], rbx
mov ecx, 0x96
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x68], 0x800
call fcn.180021330
mov dword [rsp + 0x70], eax
lea r9, [rsp + 0x90]
lea rax, [rsp + 0x68]
mov edx, 0xbf
lea r8, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x490]
call fcn.180036440
mov ecx, dword [rsi]
cmp eax, ecx
jne 0x18001d6cd
mov r8d, ecx
lea rdx, [rsp + 0x490]
mov rcx, r14
call fcn.18006ba90
jmp 0x18001d6a9
xor r9d, r9d
xor edx, edx
xor ecx, ecx
lea r8d, [r9 + 0x53]
call fcn.180063980
test eax, eax
je 0x18001d6a9
mov r9, rbp
mov r8, rsi
mov edx, 0x52
mov rcx, r14
call fcn.18004c090
movzx eax, byte [rsp + 0xcd8]
mov rbx, qword [rsp + 0xcd0]
add rsp, 0xc90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r9, rbp
mov r8d, 0xb1
mov rdx, r14
mov rcx, rsi
call fcn.1800334d0
jmp 0x18001d6a9
cmp edi, 0xc0b7
je 0x18001d681
cmp edi, 0x18071
je 0x18001d602
cmp edi, 0x2402b
je 0x18001d5d1
cmp edi, 0x2ffe5
jne 0x18001d6b0
mov al, 1
jmp 0x18001d571
test r15b, r15b
je 0x18001d6b0
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov dword [rsp + 0x60], 0x12
mov rcx, r13
mov qword [rsp + 0x20], rbx
lea edx, [r9 + 0x12]
call sub.IMM32.dll_ImmSetCompositionStringA
jmp 0x18001d6a9
cmp qword [rsi + 0x18], 0x10
mov rdx, rsi
jb 0x18001d60f
mov rdx, qword [rsi]
mov r8d, dword [rsi + 0x10]
mov rcx, rbp
call qword [rsp + 0x80]
cmp eax, dword [rsi + 0x10]
jne 0x18001d6c6
mov r9d, dword [rsp + 0x78]
xor r8d, r8d
mov edx, dword [rsp + 0x60]
mov rcx, r13
call sub.IMM32.dll_ImmGetCompositionStringA
mov rcx, qword [r14]
lea rdx, [rsp + 0x70]
mov r9, qword [rsp + 0xce8]
mov r8, rbp
mov qword [rsp + 0x70], rcx
mov ebx, eax
mov ecx, 0x74
call fcn.18001dab0
mov rdx, qword [rsp + 0xce8]
test ebx, ebx
mov ebx, 0
movzx r15d, r15b
mov ecx, 0xdf
cmove r15d, ebx
call fcn.18001e480
jmp 0x18001d6a9
mov edx, 0xad
mov dword [rsp + 0x60], 0x80
lea r8, str.ssleay32.dll
lea ecx, [rdx - 0x41]
call fcn.18000a770
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x78], ebx
mov eax, dword [rsp + 0xcd8]
imul ecx, r12d, 0xc2
add edi, ecx
cmp edi, eax
jbe 0x18001d440
jmp 0x18001d569
xor al, al
jmp 0x18001d571
lea rcx, str._IpcMessageHandlerClass::OnCreateMessagePort
call fcn.18002cc20
int3