Function at 0x1000c340
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100214c5
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x1002a0f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movsd xmm0, qword [0x1002aa58]
ucomisd xmm0, qword [0x10022b70]
lahf
test ah, 0x44
jp 0x1000cb6c
movsd xmm0, qword [0x1002aa30]
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x20], esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
sub esp, 0xc
mov dword [ebp - 4], 0
mov ecx, esp
push 8
push str.deydokuv
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, 0xedaef55
mov ecx, 0x282cc805
mov dword [ebp - 4], 0xffffffff
call ebx
cvttsd2si eax, qword [0x1002aa48]
movsd qword [ebp - 0x34], xmm0
movsd xmm0, qword [0x1002aa50]
push eax
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x20], esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
movsd xmm0, qword [0x1002aa30]
sub esp, 0xc
mov dword [ebp - 4], 1
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
push 0
push 0x1a1f348a
call dword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
movsd xmm0, qword [0x1002aa58]
add esp, 0x24
mov dword [ebp - 0x10], eax
mov esi, esp
mov dword [ebp - 0x20], esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
add esp, 0xc
movsd xmm0, qword [0x1002aa28]
mov dword [ebp - 4], 2
call fcn.10014e70
push edx
push eax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0xe
push str.asvotuowapaqaj
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
sub esp, 0x18
mov byte [ebp - 4], 3
mov esi, esp
movsd xmm0, qword [0x1002aa60]
mov dword [ebp - 0x18], esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
sub esp, 0xc
mov byte [ebp - 4], 4
mov ecx, esp
push 6
push str.igyaje
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
mov dword [ebp - 4], 0xffffffff
call sub.IMM32.dll_ImmRegisterWordA
movsd xmm0, qword [0x1002aa28]
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
movsd qword [esp + 0x18], xmm0
push 9
push str.aoicekiic
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
cvttsd2si eax, qword [0x1002aa30]
push eax
call ebx
movsd xmm0, qword [0x1002aa70]
add esp, 0xc
mov dword [ebp - 0x1c], eax
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
add esp, 0xc
call dword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
mov ecx, esp
mov dword [ebp - 0x24], esp
push 6
push str.qiafto
mov dword [ebp - 0x20], eax
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
movsd xmm0, qword [0x1002aa30]
sub esp, 0x18
mov dword [ebp - 4], 5
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
movsd xmm0, qword [0x1002aa50]
add esp, 0x30
mov ebx, eax
push 0
push 0x12dd0885
sub esp, 0x18
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
add esp, 0xc
push 0
movsd xmm0, qword [0x10022948]
push 0x148ced2a
sub esp, 8
movsd qword [esp], xmm0
call sub.IMM32.dll_ImmGetIMEFileNameA
sub esp, 0x18
mov ecx, esp
fstp qword [ebp - 0x3c]
push 0xa
push str.Iyduroyyoc
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerW]
movsd xmm0, qword [0x1002aa58]
sub esp, 0x18
mov edi, eax
mov dword [ebp - 0x28], esp
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
movsd xmm0, qword [0x1002aa48]
sub esp, 0xc
mov dword [ebp - 4], 6
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
call sub.IMM32.dll_ImmGetCompositionStringW
movsd xmm1, qword [0x10022ae8]
mov esi, eax
divsd xmm1, qword [ebp - 0x34]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
movd xmm0, dword [ebp - 0x10]
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm0
movsd qword [ebp - 0x34], xmm1
call fcn.10014f20
movsd xmm1, qword [ebp - 0x34]
mulsd xmm1, xmm0
movsd xmm0, qword [0x10022928]
subsd xmm0, xmm1
movsd xmm1, qword [0x100227d8]
movsd qword [ebp - 0x2c], xmm0
movd xmm0, dword [ebp - 0x1c]
cvtdq2pd xmm0, xmm0
divsd xmm1, xmm0
movsd xmm0, qword [0x1002aa48]
movsd qword [ebp - 0x34], xmm1
call fcn.10014e70
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_GetServiceKeyNameA]
movsd xmm1, qword [ebp - 0x34]
divsd xmm1, xmm0
movd xmm0, dword [ebp - 0x20]
movsd xmm2, qword [ebp - 0x2c]
cvtdq2pd xmm0, xmm0
subsd xmm2, xmm1
mulsd xmm0, qword [0x100228f0]
addsd xmm2, xmm0
movsd qword [ebp - 0x2c], xmm2
call sub.IMM32.dll_ImmGetIMEFileNameA
movsd xmm1, qword [0x100227b8]
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
fstp qword [ebp - 0x34]
divsd xmm1, xmm0
movsd xmm2, qword [ebp - 0x34]
mulsd xmm1, qword [ebp - 0x3c]
mulsd xmm2, xmm1
movd xmm0, edi
sub esp, 0x18
cvtdq2pd xmm0, xmm0
mulsd xmm2, xmm0
movd xmm0, esi
mov esi, esp
cvtdq2pd xmm0, xmm0
mulsd xmm2, xmm0
movsd xmm0, qword [ebp - 0x2c]
mov dword [ebp - 0x28], esp
subsd xmm0, xmm2
movsd qword [0x1002aa60], xmm0
movsd xmm0, qword [0x1002aa30]
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
sub esp, 0xc
mov dword [ebp - 4], 7
mov ecx, esp
push 8
push str.deydokuv
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, 0xedaef55
mov ecx, 0x282cc805
mov dword [ebp - 4], 0xffffffff
call edi
cvttsd2si eax, qword [0x1002aa48]
movsd qword [ebp - 0x3c], xmm0
movsd xmm0, qword [0x1002aa50]
push eax
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x28], esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
movsd xmm0, qword [0x1002aa30]
sub esp, 0xc
mov dword [ebp - 4], 8
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
push 0
push 0x1a1f348a
call dword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
movsd xmm0, qword [0x1002aa58]
add esp, 0x24
mov dword [ebp - 0x20], eax
mov esi, esp
mov dword [ebp - 0x28], esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
add esp, 0xc
movsd xmm0, qword [0x1002aa28]
mov dword [ebp - 4], 9
call fcn.10014e70
push edx
push eax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x24], esp
mov dword [ecx], 0
push 0xe
push str.asvotuowapaqaj
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
movsd xmm0, qword [0x1002aa60]
sub esp, 0x18
mov byte [ebp - 4], 0xa
mov esi, esp
mov dword [ebp - 0x1c], esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
sub esp, 0xc
mov byte [ebp - 4], 0xb
mov ecx, esp
push 6
push str.igyaje
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
mov dword [ebp - 4], 0xffffffff
call sub.IMM32.dll_ImmRegisterWordA
movsd xmm0, qword [0x1002aa28]
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
movsd qword [esp + 0x18], xmm0
push 9
push str.aoicekiic
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
cvttsd2si eax, qword [0x1002aa30]
push eax
call edi
movsd xmm0, qword [0x1002aa70]
add esp, 0xc
mov dword [ebp - 0x14], eax
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
add esp, 0xc
call dword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
mov ecx, esp
mov dword [ebp - 0x28], esp
push 6
push str.qiafto
mov dword [ebp - 0x10], eax
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
movsd xmm0, qword [0x1002aa30]
sub esp, 0x18
mov dword [ebp - 4], 0xc
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
add esp, 0x30
mov ebx, eax
push 0
push 0x12dd0885
sub esp, 0x18
movsd xmm0, qword [0x1002aa50]
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
movsd xmm0, qword [0x10022948]
add esp, 0xc
push 0
push 0x148ced2a
sub esp, 8
movsd qword [esp], xmm0
call sub.IMM32.dll_ImmGetIMEFileNameA
sub esp, 0x18
mov ecx, esp
fstp qword [ebp - 0x34]
push 0xa
push str.Iyduroyyoc
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerW]
movsd xmm0, qword [0x1002aa58]
sub esp, 0x18
mov edi, eax
mov dword [ebp - 0x28], esp
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
movsd xmm0, qword [0x1002aa48]
sub esp, 0xc
mov dword [ebp - 4], 0xd
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
call sub.IMM32.dll_ImmGetCompositionStringW
movsd xmm1, qword [0x10022ae8]
mov esi, eax
divsd xmm1, qword [ebp - 0x3c]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
movd xmm0, dword [ebp - 0x20]
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm0
movsd qword [ebp - 0x3c], xmm1
call fcn.10014f20
movsd xmm1, qword [ebp - 0x3c]
mulsd xmm1, xmm0
movsd xmm0, qword [0x10022790]
subsd xmm0, xmm1
movsd xmm1, qword [0x100227d8]
movsd qword [ebp - 0x2c], xmm0
movd xmm0, dword [ebp - 0x14]
cvtdq2pd xmm0, xmm0
divsd xmm1, xmm0
movsd xmm0, qword [0x1002aa48]
movsd qword [ebp - 0x3c], xmm1
call fcn.10014e70
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_GetServiceKeyNameA]
movsd xmm2, qword [ebp - 0x3c]
divsd xmm2, xmm0
movd xmm0, dword [ebp - 0x10]
movsd xmm1, qword [ebp - 0x2c]
cvtdq2pd xmm0, xmm0
subsd xmm1, xmm2
mulsd xmm0, qword [0x100228f0]
addsd xmm1, xmm0
movsd qword [ebp - 0x2c], xmm1
call sub.IMM32.dll_ImmGetIMEFileNameA
movsd xmm2, qword [0x100227b8]
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
fstp qword [ebp - 0x3c]
divsd xmm2, xmm0
movsd xmm1, qword [ebp - 0x3c]
mulsd xmm2, qword [ebp - 0x34]
movd xmm0, edi
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
mulsd xmm1, xmm0
movd xmm0, esi
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm0
movsd xmm0, qword [ebp - 0x2c]
subsd xmm0, xmm1
movsd qword [0x1002aa58], xmm0
push 0
call fcn.10004600
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret