Function at 0x1400276b0
Capabilities:
Log keystrokes via polling
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xb0
mov qword [rbp - 0x41], 0xfffffffffffffffe
mov qword [rsp + 0xe0], rbx
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov esi, r8d
mov r14d, edx
mov dword [rbp - 0x51], r8d
mov rbx, qword [rbp + 0x7f]
cmp qword [r9 + 0x10], 0
jne 0x1400276fe
mov ecx, 0x5c
jmp 0x14002770c
cmp qword [r9 + 0x18], 8
jb 0x140027708
mov r9, qword [r9]
movzx ecx, word [r9]
call qword [sym.imp.USER32.dll_VkKeyScanW]
movzx edi, al
mov r9, rbx
lea r8, [rbp - 0x51]
mov edx, edi
call fcn.140027f20
mov qword [rbp + 0x1f], 7
xor r15d, r15d
mov qword [rbp + 0x17], r15
mov word [rbp + 7], r15w
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp + 7]
call fcn.140006b90
nop
cmp qword [rbp + 0x17], r15
jne 0x140027844
lea rax, [rbp - 0x49]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.Control_PanelInput_MethodHot_Keys
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002783d
mov ebx, r15d
nop word [rax + rax]
mov qword [rbp - 0x21], 7
mov qword [rbp - 0x29], r15
mov word [rbp - 0x39], r15w
lea r8d, [rbx + 0x64]
lea rdx, str._08d
lea rcx, [rbp - 0x39]
call fcn.140061ab0
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
cmovae rdx, qword [rbp - 0x39]
lea rax, [rbp - 0x51]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140027807
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp qword [rbp - 0x21], 8
jb 0x1400277fe
mov rcx, qword [rbp - 0x39]
call fcn.1400bd20c
inc ebx
cmp ebx, 0x64
jge 0x14002782c
jmp 0x140027790
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.140006b90
nop
cmp qword [rbp - 0x21], 8
jb 0x14002782c
mov rcx, qword [rbp - 0x39]
call fcn.1400bd20c
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rbp + 0x17], 0
jne 0x140027844
xor bl, bl
jmp 0x140027a75
mov qword [rbp - 1], 7
mov qword [rbp - 9], r15
mov word [rbp - 0x19], r15w
lea r9, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae r9, qword [rbp + 7]
lea r8, str.Control_PanelInput_MethodHot_Keys
lea rdx, [0x1401261a8]
lea rcx, [rbp - 0x19]
call fcn.140061ab0
lea rdx, [rbp - 0x19]
mov rcx, 0xffffffff80000001
call fcn.1400ba1c0
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rdx, qword [rbp - 0x19]
lea rax, [rbp - 0x49]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400279a9
mov dword [rbp - 0x51], r14d
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x51]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
lea rdx, str.Target_IME
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp - 0x51], esi
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x51]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
lea rdx, str.Key_Modifiers
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp - 0x51], edi
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x51]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
lea rdx, str.Virtual_Key
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x21], 7
mov qword [rbp - 0x29], r15
mov word [rbp - 0x39], r15w
mov r8d, r14d
lea rdx, [0x140125ed8]
lea rcx, [rbp - 0x39]
call fcn.140061ab0
lea rcx, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
cmovae rcx, qword [rbp - 0x39]
mov edx, 0x10
call qword [sym.imp.USER32.dll_LoadKeyboardLayoutW]
nop
cmp qword [rbp - 0x21], 8
jb 0x1400279a2
mov rcx, qword [rbp - 0x39]
call fcn.1400bd20c
mov bl, 1
jmp 0x140027a54
mov ecx, 0x800
call fcn.1400bbc88
mov rdi, rax
mov ecx, 0x800
call fcn.1400bbc88
mov rbx, rax
test rdi, rdi
je 0x140027a45
test rax, rax
je 0x140027a3d
xor edx, edx
mov r8d, 0x800
mov rcx, rdi
call fcn.1400c2130
lea rax, [0x140127458]
mov qword [rsp + 0x20], rax
lea r9, str.RC::RCInputManagerBase::RegisterMyImeHotKey
lea r8, str._s__:__s
mov edx, 0x400
mov rcx, rdi
call fcn.140007140
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call fcn.1400c2130
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.Control_PanelInput_MethodHot_Keys
mov r8, rdi
mov edx, 0x400
mov rcx, rbx
call fcn.140007140
mov rcx, rbx
call fcn.140015100
mov rcx, rdi
call fcn.1400bd2dc
test rbx, rbx
je 0x140027a52
mov rcx, rbx
call fcn.1400bd2dc
xor bl, bl
cmp qword [rbp - 1], 8
jb 0x140027a64
mov rcx, qword [rbp - 0x19]
call fcn.1400bd20c
mov qword [rbp - 1], 7
mov qword [rbp - 9], r15
mov word [rbp - 0x19], r15w
cmp qword [rbp + 0x1f], 8
jb 0x140027a85
mov rcx, qword [rbp + 7]
call fcn.1400bd20c
movzx eax, bl
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400bcae0
mov rbx, qword [rsp + 0xe0]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret