Function at 0x44b2f0
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [ebx + 0x1892ec]
test edi, edi
je 0x44b53f
mov eax, dword [ebp + 0xc]
sub eax, 0x102
je 0x44b47a
sub eax, 0xd
jne 0x44b53f
mov dword [ebx + 0x18d57b], eax
mov eax, dword [ebp + 0x14]
test eax, 0x800
je 0x44b3ed
mov edi, dword [ebp + 8]
push edi
call sub.IMM32.dll_ImmGetContext
push 0
push 0
mov esi, eax
push 0x800
push esi
call sub.IMM32.dll_ImmGetCompositionStringW
mov ecx, 4
cmp eax, ecx
cmovg eax, ecx
push eax
lea eax, [ebx + 0x18d57b]
push eax
push 0x800
push esi
call sub.IMM32.dll_ImmGetCompositionStringW
push esi
push edi
call sub.IMM32.dll_ImmReleaseContext
mov esi, dword [ebx + 0x1892ec]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x44b378
lea edi, [ebx + 0x18d57b]
sub esi, ecx
mov edx, edi
lea ecx, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x44b390
sub edx, ecx
movzx ecx, byte [ebx + 0x18d57a]
lea eax, [edx + esi]
cmp eax, ecx
jge 0x44b46b
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44b3b0
mov ebx, dword [ebx + 0x1892ec]
sub ecx, edx
mov edx, ebx
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x44b3c4
sub edx, esi
lea eax, [ecx + 1]
push edi
push eax
lea eax, [ebx + edx]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy_s
add esp, 0xc
mov dword [edi], 0
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
test al, 8
je 0x44b536
mov edi, dword [ebp + 8]
push edi
call sub.IMM32.dll_ImmGetContext
push 0
push 0
mov esi, eax
push 8
push esi
call sub.IMM32.dll_ImmGetCompositionStringW
mov ecx, 4
cmp eax, ecx
cmovg eax, ecx
push eax
lea eax, [ebx + 0x18d57b]
push eax
push 8
push esi
call sub.IMM32.dll_ImmGetCompositionStringW
push esi
push edi
call sub.IMM32.dll_ImmReleaseContext
mov esi, dword [ebx + 0x1892ec]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x44b436
lea edi, [ebx + 0x18d57b]
sub esi, ecx
mov edx, edi
lea ecx, [edx + 1]
nop word [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x44b450
sub edx, ecx
movzx ecx, byte [ebx + 0x18d57a]
lea eax, [edx + esi]
cmp eax, ecx
jl 0x44b536
mov dword [edi], 0
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
mov edx, dword [ebp + 0x10]
cmp edx, 8
jne 0x44b4ff
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44b487
sub ecx, edx
je 0x44b536
mov esi, edi
lea ecx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x44b4a0
sub esi, ecx
mov ecx, ebx
lea eax, [esi - 1]
push eax
push edi
call fcn.00449b60
sub eax, 1
je 0x44b4e7
sub eax, 1
je 0x44b4c4
sub eax, 1
jne 0x44b4ec
mov byte [edi + esi - 2], 0
mov eax, dword [ebx + 0x1892ec]
pop edi
mov byte [esi + eax - 1], 0
mov al, 1
pop esi
mov dword [ebx + 0x18d57b], 0
pop ebx
pop ebp
ret 0x10
mov byte [edi + esi - 1], 0
pop edi
pop esi
mov dword [ebx + 0x18d57b], 0
mov al, 1
pop ebx
pop ebp
ret 0x10
cmp edx, 9
je 0x44b536
cmp edx, 0xd
je 0x44b536
cmp edx, 0x1b
je 0x44b536
mov ecx, edi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44b513
movzx eax, byte [ebx + 0x18d57a]
sub ecx, esi
dec eax
cmp ecx, eax
jge 0x44b53f
mov byte [edi + ecx], dl
mov eax, dword [ebx + 0x1892ec]
mov byte [ecx + eax + 1], 0
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 0x10
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 0x10