Function at 0x527c90
Capabilities:
Log keystrokes via input method manager

Disassembly:
sub esp, 0x20c
push ebp
push edi
call fcn.005268a0
mov ebp, eax
mov eax, dword [esp + 0x21c]
sub ebp, 2
neg ebp
sbb ebp, ebp
inc ebp
test ah, 8
jne 0x527cbe
pop edi
xor eax, eax
pop ebp
add esp, 0x20c
ret
mov eax, dword [esp + 0x218]
push eax
call sub.IMM32.dll_ImmGetContext
mov edi, eax
test edi, edi
mov dword [esp + 8], edi
jne 0x527cde
pop edi
pop ebp
add esp, 0x20c
ret
test ebp, ebp
push esi
push 0
push 0
push 0x800
push edi
je 0x527cf4
call sub.IMM32.dll_ImmGetCompositionStringW
jmp 0x527cf9
call sub.IMM32.dll_ImmGetCompositionStringA
mov esi, eax
test esi, esi
jle 0x527ed0
mov ecx, dword [0x5debe0]
push ebx
push esi
call dword [ecx + 0x14]
add esp, 4
test ebp, ebp
mov ebx, eax
je 0x527d2b
push esi
push ebx
push 0x800
push edi
call sub.IMM32.dll_ImmGetCompositionStringW
mov ebp, eax
jmp 0x527df0
call fcn.00527c60
push esi
push ebx
push 0x800
push edi
mov ebp, eax
call sub.IMM32.dll_ImmGetCompositionStringA
lea edx, [esp + 0x74]
mov esi, eax
mov eax, dword [0x5debe0]
push edx
call dword [eax + 0x1f0]
mov edx, dword [0x5e0134]
mov eax, dword [0x5debe0]
lea ecx, [esp + 0x78]
push ecx
push esi
push ebx
push edx
call dword [eax + 0x4a8]
mov edx, dword [esp + 0x88]
mov eax, dword [0x5debe0]
lea ecx, [esp + 0x15c]
push ecx
push 0xffffffffffffffff
push edx
push ebp
call dword [eax + 0x53c]
mov ebp, dword [esp + 0x170]
add esp, 0x24
cmp esi, ebp
jge 0x527daf
mov ecx, dword [0x5debe0]
push ebx
call dword [ecx + 0x18]
mov edx, dword [0x5debe0]
push ebp
call dword [edx + 0x14]
add esp, 8
mov ebx, eax
mov esi, dword [esp + 0x148]
mov ecx, ebp
mov eax, ecx
shr ecx, 2
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [0x5debe0]
lea ecx, [esp + 0x74]
push ecx
call dword [edx + 0x1e8]
mov ecx, dword [0x5debe0]
lea eax, [esp + 0x14c]
push eax
call dword [ecx + 0x1e8]
add esp, 8
mov edx, dword [esp + 0x220]
push edx
call fcn.00528220
mov edx, eax
xor eax, eax
mov ecx, 0x18
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov eax, dword [edx]
mov ecx, dword [eax + 0x5c]
mov dword [esp + 0x1c], ecx
mov eax, dword [edx]
mov esi, dword [eax + 0x5c]
add esp, 4
inc esi
mov dword [eax + 0x5c], esi
mov dword [esp + 0x1c], 0xfffffffe
mov eax, dword [edx]
mov dword [esp + 0x20], eax
mov ecx, dword [edx + 0x14]
mov dword [esp + 0x24], ecx
mov eax, dword [edx + 8]
mov ecx, dword [edx]
mov edx, dword [ecx + 0x88]
lea eax, [eax + eax*4]
shl eax, 4
mov eax, dword [eax + edx + 8]
xor esi, esi
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], esi
call fcn.00560000
mov dword [esp + 0x44], eax
call sub.KERNEL32.dll_GetTickCount
test ebp, ebp
mov dword [esp + 0x30], eax
mov dword [esp + 0x4c], 1
mov dword [esp + 0x48], esi
mov dword [esp + 0x54], 2
jle 0x527ebe
mov cl, byte [esi + ebx]
inc esi
mov byte [esp + 0x50], cl
mov dl, byte [esi + ebx]
lea eax, [esp + 0x14]
push 0
push eax
mov byte [esp + 0x59], dl
inc esi
mov dword [esp + 0x1c], 2
call fcn.004d7ba0
lea ecx, [esp + 0x1c]
push 0
push ecx
mov dword [esp + 0x24], 3
call fcn.004d7ba0
add esp, 0x10
cmp esi, ebp
jl 0x527e7f
mov edx, dword [0x5debe0]
push ebx
call dword [edx + 0x18]
mov edi, dword [esp + 0x14]
add esp, 4
pop ebx
mov eax, dword [esp + 0x21c]
push edi
push eax
call sub.IMM32.dll_ImmReleaseContext
pop esi
pop edi
mov eax, 1
pop ebp
add esp, 0x20c
ret