Function at 0x762ee0d3
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push dword [ebp + 8]
call sym.IMM32.dll_ImmGetContext
push dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
call sym.IMM32.dll_ImmLockImeDpi
xor ebx, ebx
mov esi, eax
cmp esi, ebx
mov dword [ebp - 8], ebx
je 0x762ee1a3
push dword [ebp - 0xc]
call sym.IMM32.dll_ImmLockIMC
mov edi, eax
cmp edi, ebx
je 0x762ee19d
cmp byte [ebp + 0x10], 0xe7
mov byte [ebp - 1], bl
jne 0x762ee131
mov eax, dword [esi + 0x10]
test al, 0x20
jne 0x762ee131
test eax, 0x80000
je 0x762ee2a3
mov byte [ebp - 1], 1
push 0x100
push ebx
call fcn.762e9949
mov ebx, eax
test ebx, ebx
je 0x762ee193
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x762ee184
cmp byte [ebp - 1], 0
mov eax, dword [ebp + 0x10]
je 0x762ee15b
and eax, 0xffff
push ebx
push dword [ebp + 0x14]
push eax
push dword [ebp - 0xc]
call dword [esi + 0x78]
test eax, eax
je 0x762ee184
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x144], 1
mov dword [edi + 0x140], eax
mov dword [ebp - 8], 2
push ebx
push 0
push dword [0x762f6888]
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
push dword [ebp - 0xc]
call sym.IMM32.dll_ImmUnlockIMC
push esi
call sym.IMM32.dll_ImmUnlockImeDpi
call sym.IMM32.dll_CtfImmIsCiceroStartedInThread
test eax, eax
je 0x762ee1ce
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0xc]
call fcn.762f3d3b
test eax, eax
jne 0x762ee1e9
mov eax, dword [ebp + 0xc]
shr eax, 0x10
and ax, 0xf000
cmp ax, 0xe000
jne 0x762ee1f9
cmp dword [ebp + 0x18], 0xffffffff
je 0x762ee1f9
push dword [ebp + 0x18]
push dword [ebp + 0xc]
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.762e6b88
test eax, eax
je 0x762ee1f9
cmp dword [ebp + 0x10], 0x19
jne 0x762ee1f5
cmp dword [ebp + 0x18], 0x30
je 0x762ee1f9
or dword [ebp - 8], 1
test byte [ebp - 8], 2
je 0x762ee45e
push dword [ebp - 0xc]
call sym.IMM32.dll_ImmGetAppCompatFlags
test eax, 0x10000
je 0x762ee45e
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
and ax, 0x3ff
cmp ax, 0x12
jne 0x762ee23d
cmp dword [ebp + 0x10], 0xe5
je 0x762ee45e
test byte [ebp - 8], 1
jne 0x762ee45e
push dword [ebp + 8]
mov dword [ebp + 0xc], ebx
call sym.IMM32.dll_ImmGetContext
push eax
mov dword [ebp + 0x18], eax
call sym.IMM32.dll_ImmLockIMC
mov esi, eax
cmp esi, ebx
je 0x762ee447
cmp dword [esi + 0x144], ebx
jne 0x762ee2b8
mov edi, dword [esi + 0x128]
cmp edi, ebx
je 0x762ee437
push dword [esi + 0x12c]
call sym.IMM32.dll_ImmLockIMCC
cmp eax, ebx
je 0x762ee298
push eax
push edi
push dword [ebp + 0x18]
push dword [ebp + 8]
call fcn.762edd6a
push dword [esi + 0x12c]
call sym.IMM32.dll_ImmUnlockIMCC
mov dword [esi + 0x128], ebx
jmp 0x762ee437
cmp dword [edi + 4], ebx
je 0x762ee195
mov dword [ebp - 8], 0x10
jmp 0x762ee195
push ebx
push dword [ebp + 8]
mov dword [esi + 0x144], ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
mov dword [ebp - 0x14], eax
call sym.IMM32.dll_ImmLockImeDpi
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x762ee437
push 0x100
push ebx
call fcn.762e9949
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x10], edi
je 0x762ee437
push edi
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
jne 0x762ee30d
push edi
push ebx
jmp 0x762ee3a1
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x10]
test al, 2
mov ebx, dword [esi + 0x140]
je 0x762ee38b
test eax, 0x80000
je 0x762ee351
push 0
push 1
lea eax, [ebp + 0x12]
push eax
mov eax, dword [ebp + 0x14]
push edi
shr eax, 0x10
push eax
push ebx
call dword [sym.imp.USER32.dll_ToUnicode]
cmp eax, 1
jne 0x762ee38b
movzx eax, word [ebp + 0x12]
shl eax, 0x10
and ebx, 0xff
or ebx, eax
jmp 0x762ee38b
push dword [ebp - 0x14]
and dword [ebp + 0x10], 0
push 0
lea eax, [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
push edi
shr eax, 0x10
push eax
push ebx
call dword [sym.imp.USER32.dll_ToAsciiEx]
test eax, eax
jle 0x762ee38b
movzx eax, word [ebp + 0x10]
shl eax, 8
and ebx, 0xff
or ebx, eax
cmp bl, 0xe7
je 0x762ee38b
and ebx, 0xffff
push 0xc04
push 0
call fcn.762e9949
mov edi, eax
test edi, edi
jne 0x762ee3b2
push dword [ebp - 0x10]
push eax
push dword [0x762f6888]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x762ee437
push dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
push 0
push edi
push dword [ebp - 0x10]
shr eax, 0x10
push eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [edi], 0x100
call dword [eax + 0x84]
mov ebx, eax
cmp ebx, 0x100
jle 0x762ee405
push dword [esi + 0x12c]
call sym.IMM32.dll_ImmLockIMCC
test eax, eax
je 0x762ee419
push eax
push ebx
push dword [ebp + 0x18]
push dword [ebp + 8]
call fcn.762edd6a
push dword [esi + 0x12c]
call sym.IMM32.dll_ImmUnlockIMCC
jmp 0x762ee419
test ebx, ebx
jle 0x762ee419
lea eax, [edi + 4]
push eax
push ebx
push dword [ebp + 0x18]
push dword [ebp + 8]
call fcn.762edd6a
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push dword [0x762f6888]
call esi
push edi
push 0
push dword [0x762f6888]
call esi
push dword [ebp + 0xc]
call sym.IMM32.dll_ImmUnlockImeDpi
push dword [ebp + 0x18]
call sym.IMM32.dll_ImmUnlockIMC
push dword [ebp + 0x18]
push dword [ebp + 8]
call sym.IMM32.dll_ImmReleaseContext
mov eax, dword [ebp - 8]
and eax, 0xfffffffd
or eax, 0x10
mov dword [ebp - 8], eax
push dword [ebp - 0xc]
push dword [ebp + 8]
call sym.IMM32.dll_ImmReleaseContext
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 0x14