Function at 0x6ca45810
Capabilities:
Get keyboard layout
Log keystrokes via input method manager

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x50
mov ebx, dword [esp + 0x74]
mov edx, dword [esp + 0x68]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x6ca45898
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x6ca45898
mov ebp, dword [ebx + 0x2c]
test ebp, ebp
je 0x6ca45898
cmp edx, 0x10f
je 0x6ca45c28
ja 0x6ca458a8
mov eax, 1
cmp edx, 0x10d
je 0x6ca4589a
cmp edx, 0x10e
jne 0x6ca45890
mov dword [ebx + 0xa0], 0
xor eax, eax
xor ebp, ebp
mov word [ebx + 0x40], bp
mov word [ebx + 0x80], ax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x6ca96bd8
call fcn.6c972410
xor eax, eax
jmp 0x6ca4589a
cmp edx, 0x51
je 0x6ca458d8
lea esi, [esi]
xor eax, eax
add esp, 0x50
pop ebx
pop esi
pop edi
pop ebp
ret
cmp edx, 0x281
je 0x6ca45970
cmp edx, 0x282
jne 0x6ca45898
mov eax, dword [esp + 0x6c]
sub eax, 3
cmp eax, 0xb
ja case.0x6ca458cc.7
jmp dword [eax*4 + 0x6ca96c64]
mov esi, dword [ebx + 0x14ec]
mov dword [esp], 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [ebx + 0x14ec], eax
sub esp, 4
cmp eax, dword [0x6cb1cc0c]
je 0x6ca45924
mov edx, eax
mov dword [0x6cb1cc0c], eax
and edx, 0x3ff
cmp edx, 0x11
je 0x6ca45dff
cmp edx, 0x12
je 0x6ca45df0
cmp edx, 4
je 0x6ca45dd0
mov edi, dword [ebx + 0x150c]
test edi, edi
jne 0x6ca4593f
cmp eax, 0xe0060404
setne al
movzx eax, al
mov dword [ebx + 0x14b8], eax
mov eax, ebx
call fcn.6ca438f0
xor esi, dword [ebx + 0x14ec]
and esi, 0x3ff
je 0x6ca45898
mov esi, dword [ebx + 0x28]
test esi, esi
je 0x6ca45898
mov eax, ebx
call fcn.6ca44030
jmp 0x6ca45898
mov eax, dword [esp + 0x70]
mov dword [eax], 0
xor eax, eax
jmp 0x6ca4589a
mov eax, 1
jmp 0x6ca4589a
mov dword [esp], 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [ebx + 0x14ec], eax
sub esp, 4
cmp eax, dword [0x6cb1cc0c]
je 0x6ca45898
mov edx, eax
mov dword [0x6cb1cc0c], eax
and edx, 0x3ff
cmp edx, 0x11
je 0x6ca45ee8
cmp edx, 0x12
je 0x6ca45ed7
cmp edx, 4
jne 0x6ca45898
shr ax, 0xa
cmp ax, 2
je 0x6ca45ed7
mov dword [ebx + 0x14bc], 1
jmp 0x6ca45898
mov esi, dword [ebx + 0x150c]
test esi, esi
jne 0x6ca45898
mov dword [ebx + 0x14c0], 1
mov eax, ebx
mov dword [ebx + 0xa4], 1
call fcn.6ca43a10
mov eax, dword [esp + 0x64]
mov dword [esp], eax
call sub.IMM32.DLL_ImmGetContext
sub esp, 4
mov ecx, eax
mov dword [esp + 0x20], eax
mov eax, 1
test ecx, ecx
je 0x6ca4589a
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], ecx
call sub.IMM32.DLL_ImmGetCandidateListW
sub esp, 0x10
mov ebp, eax
test eax, eax
jne 0x6ca45ef9
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
lea esi, [esi]
mov eax, dword [esp + 0x64]
mov dword [esp], eax
call sub.IMM32.DLL_ImmReleaseContext
mov eax, 1
sub esp, 8
jmp 0x6ca4589a
xor edx, edx
mov eax, ebx
call fcn.6ca43b20
mov ebp, dword [ebx + 0x150c]
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov esi, eax
mov dword [esp + 0x2c], 0
test ebp, ebp
jne 0x6ca45bb1
xor edi, edi
xor edx, edx
mov eax, ebx
mov word [ebx + 0x80], di
call fcn.6ca43b20
test eax, eax
mov dword [esp + 0x18], eax
je 0x6ca45bb1
mov eax, dword [esp + 0x64]
mov dword [esp], eax
call sub.IMM32.DLL_ImmGetContext
sub esp, 4
mov edi, eax
test eax, eax
je 0x6ca45bb1
mov eax, dword [ebx + 0x14f4]
mov edx, dword [esp + 0x18]
test eax, eax
je 0x6ca4608d
lea edx, [esp + 0x2c]
lea ebp, [esp + 0x28]
mov dword [esp + 8], 0
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], ecx
mov dword [esp + 4], 0
mov dword [esp], edi
call eax
sub esp, 0x18
test eax, eax
je 0x6ca45b7d
mov ecx, 0x10
lea edx, [esp + 0x2c]
mov dword [esp + 0x10], ebp
cmp eax, ecx
mov dword [esp + 0x14], edx
cmovbe ecx, eax
lea eax, [esp + 0x24]
mov dword [esp], edi
mov dword [esp + 0xc], eax
lea eax, [esp + 0x30]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
call dword [ebx + 0x14f4]
sub esp, 0x18
mov dword [esp + 8], eax
lea eax, [esp + 0x30]
mov dword [esp + 4], eax
lea eax, [ebx + 0x80]
mov dword [esp], eax
call fcn.6c9d7b30
mov eax, dword [esp + 0x64]
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.IMM32.DLL_ImmReleaseContext
mov eax, ebx
sub esp, 8
call fcn.6ca43a10
cmp esi, 0x5000404
je 0x6ca45e24
ja 0x6ca45e0e
cmp esi, 0x4020804
je 0x6ca45be8
jbe 0x6ca45e5a
sub esi, 0x4030404
and esi, 0xfffeffff
jne 0x6ca45898
lea esi, [esi]
nop
mov eax, dword [esp + 0x70]
mov eax, dword [eax]
sub eax, 1
cmp eax, 1
setbe al
movzx eax, al
jmp 0x6ca4589a
mov dword [ebx + 0x14c0], 0
mov eax, ebx
mov dword [ebx + 0xa4], 0
call fcn.6ca43a10
mov eax, 1
jmp 0x6ca4589a
mov eax, dword [esp + 0x64]
mov dword [esp], eax
call sub.IMM32.DLL_ImmGetContext
sub esp, 4
mov esi, eax
mov eax, dword [esp + 0x70]
mov eax, dword [eax]
test ah, 8
jne 0x6ca45cf0
test al, 8
je 0x6ca45ce4
mov eax, dword [ebx + 0x150c]
test eax, eax
jne 0x6ca45c63
xor eax, eax
mov word [ebx + 0x80], ax
lea eax, [ebx + 0x40]
mov dword [esp + 0xc], 0x3e
mov dword [esp + 8], eax
mov dword [esp + 4], 8
mov dword [esp], esi
call sub.IMM32.DLL_ImmGetCompositionStringW
xor edx, edx
sub esp, 0x10
mov edi, edx
test eax, eax
mov dword [esp + 0xc], 0
cmovns edi, eax
mov dword [esp + 8], 0
mov dword [esp + 4], pe_nt_image_headers32
shr edi, 1
mov dword [esp], esi
mov ebp, edi
call sub.IMM32.DLL_ImmGetCompositionStringW
movzx eax, ax
sub esp, 0x10
lea edx, [eax - 1]
mov dword [ebx + 0xa0], eax
cmp edx, 0x1e
ja 0x6ca45cd6
cmp word [ebx + eax*2 + 0x40], 0x3000
lea edx, [eax + 0x20]
je 0x6ca45e77
xor eax, eax
mov word [ebx + ebp*2 + 0x40], ax
mov eax, ebx
call fcn.6ca43a10
mov dword [esp + 4], esi
jmp 0x6ca45a80
lea ebp, [ebx + 0x40]
mov dword [esp + 0xc], 0x3e
mov dword [esp + 8], ebp
mov dword [esp + 4], 0x800
mov dword [esp], esi
call sub.IMM32.DLL_ImmGetCompositionStringW
xor edx, edx
sub esp, 0x10
mov edi, edx
test eax, eax
cmovns edi, eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], pe_nt_image_headers32
shr edi, 1
mov dword [esp], esi
mov dword [esp + 0x18], edi
call fcn.6ca61780
movzx eax, ax
sub esp, 0x10
lea ecx, [eax - 1]
mov dword [ebx + 0xa0], eax
mov edx, dword [esp + 0x18]
cmp ecx, 0x1e
ja 0x6ca45d69
cmp word [ebx + eax*2 + 0x40], 0x3000
lea ecx, [eax + 0x20]
je 0x6ca45ea7
xor eax, eax
mov word [ebx + edx*2 + 0x40], ax
mov dword [esp], ebp
call fcn.6c9d7b00
mov dword [esp + 8], ebp
lea eax, [eax + eax + 2]
mov dword [esp + 4], 0x6ca96b83
mov dword [esp + 0xc], eax
mov dword [esp], 0x6ca96b8c
call fcn.6c9cfa90
mov dword [esp], eax
mov edi, eax
call fcn.6c972380
mov dword [esp], edi
call fcn.6c9d3b40
mov eax, dword [esp + 0x70]
xor edx, edx
xor ecx, ecx
mov word [ebx + 0x40], dx
mov word [ebx + 0x80], cx
mov dword [ebx + 0xa0], 0
mov eax, dword [eax]
jmp 0x6ca45c48
mov edx, eax
shr dx, 0xa
cmp dx, 2
setne dl
movzx edx, dl
mov dword [ebx + 0x14bc], edx
jmp 0x6ca45924
mov dword [ebx + 0x14bc], 0
jmp 0x6ca45924
mov dword [ebx + 0x14bc], 1
jmp 0x6ca45924
cmp esi, 0x5030804
je 0x6ca45e24
jbe 0x6ca45e46
cmp esi, 0x6000404
jne 0x6ca45898
mov eax, dword [esp + 0x70]
mov eax, dword [eax]
lea edx, [eax - 0x10]
cmp edx, 1
setbe dl
sub eax, 0x1a
cmp eax, 2
setbe al
or eax, edx
movzx eax, al
jmp 0x6ca4589a
sub esi, 0x5010404
and esi, 0xfffeffff
jne 0x6ca45898
jmp 0x6ca45e24
cmp esi, 0x4010804
je 0x6ca45be8
cmp esi, 0x4020404
je 0x6ca45be8
jmp 0x6ca45898
lea ecx, [eax + 1]
cmp edi, ecx
jle 0x6ca45e9f
mov ecx, edi
add edx, edx
sub ecx, eax
lea eax, [ecx + ecx - 2]
mov dword [esp + 8], eax
lea eax, [ebx + edx + 2]
mov dword [esp + 4], eax
lea eax, [ebx + edx]
mov dword [esp], eax
call sub.msvcrt.dll_memmove
lea ebp, [edi - 1]
jmp 0x6ca45cd6
lea edx, [eax + 1]
cmp edi, edx
jle 0x6ca45ecf
mov edx, edi
add ecx, ecx
sub edx, eax
lea eax, [edx + edx - 2]
mov dword [esp + 8], eax
lea eax, [ebx + ecx + 2]
mov dword [esp + 4], eax
lea eax, [ebx + ecx]
mov dword [esp], eax
call sub.msvcrt.dll_memmove
lea edx, [edi - 1]
jmp 0x6ca45d69
mov dword [ebx + 0x14bc], 0
xor eax, eax
jmp 0x6ca4589a
mov dword [ebx + 0x14bc], 1
xor eax, eax
jmp 0x6ca4589a
mov dword [esp], eax
call fcn.6c9d3a30
mov edi, eax
test eax, eax
je 0x6ca45a71
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.IMM32.DLL_ImmGetCandidateListW
sub esp, 0x10
test eax, eax
je 0x6ca46080
cmp word [ebx + 0x14ec], 0x804
mov eax, dword [edi + 0xc]
mov dword [ebx + 0x14b0], eax
mov eax, dword [edi + 8]
mov dword [ebx + 0x14a8], eax
je 0x6ca461d7
mov eax, dword [edi + 0x14]
mov ecx, 0xa
cmp eax, ecx
mov dword [esp + 0x18], eax
cmovbe ecx, eax
mov dword [ebx + 0x14b4], ecx
test eax, eax
je 0x6ca45f7c
mov eax, dword [edi + 0xc]
xor edx, edx
div ecx
imul eax, ecx
mov dword [esp + 0x18], eax
lea ebp, [ebx + 0xa8]
mov dword [esp + 8], 0x1400
mov dword [esp + 4], 0
mov dword [esp], ebp
call fcn.6c9d74f0
mov eax, dword [esp + 0x18]
cmp eax, dword [edi + 8]
jae 0x6ca46066
mov dword [esp + 0x1c], edi
mov ecx, ebp
cmp dword [ebx + 0x14b4], esi
jbe 0x6ca46062
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
mov ebp, dword [eax + edi*4 + 0x18]
mov edi, dword [ebx + 0x14b8]
add ebp, eax
add edi, esi
mov eax, 0xcccccccd
mul edi
mov eax, edx
shr eax, 3
lea edx, [eax + eax*4]
mov eax, edi
add edx, edx
sub eax, edx
add eax, 0x30
mov word [ecx], ax
mov edi, dword [ebx + 0x14bc]
lea eax, [ecx + 2]
test edi, edi
je 0x6ca46000
mov word [ecx + 2], 0x20
lea eax, [ecx + 4]
movzx edx, word [ebp]
test dx, dx
je 0x6ca4603e
mov edi, eax
add ebp, 2
sub edi, ecx
sub ebp, eax
cmp edi, 0x1fe
jbe 0x6ca4602c
jmp 0x6ca4603e
mov edi, eax
sub edi, ecx
cmp edi, 0x1fe
ja 0x6ca4603e
lea edi, [eax + ebp]
add eax, 2
mov word [eax - 2], dx
movzx edx, word [edi]
test dx, dx
jne 0x6ca46020
mov edi, dword [esp + 0x1c]
xor edx, edx
add dword [esp + 0x18], 1
add esi, 1
mov word [eax], dx
add ecx, 0x200
mov eax, dword [esp + 0x18]
cmp eax, dword [edi + 8]
jb 0x6ca45fad
mov edi, dword [esp + 0x1c]
mov eax, dword [ebx + 0x14ec]
and eax, 0x3ff
cmp eax, 0x12
jne 0x6ca46080
mov dword [ebx + 0x14b0], 0xffffffff
mov dword [esp], edi
call fcn.6c9d3b40
jmp 0x6ca45a71
mov dword [esp + 0x18], edx
mov dword [esp], edi
call dword [ebx + 0x14fc]
push ecx
mov edx, dword [esp + 0x18]
mov ebp, eax
cmp edx, 0x4020804
je 0x6ca461b7
jbe 0x6ca46137
cmp edx, 0x5010404
je 0x6ca460d1
jbe 0x6ca46180
cmp edx, 0x5020404
je 0x6ca460d1
cmp edx, 0x5030804
jne 0x6ca46118
mov eax, dword [ebp + 0x124]
mov dword [esp], eax
call dword [ebx + 0x1504]
push ecx
mov eax, dword [eax + 4]
test eax, eax
je 0x6ca46118
mov edx, dword [eax + 0x18]
test edx, edx
je 0x6ca46118
mov eax, dword [edx + 0x60]
add edx, 0x40
add eax, 1
mov ecx, 0x10
mov dword [esp + 4], edx
cmp eax, ecx
cmova eax, ecx
mov dword [esp + 8], eax
lea eax, [ebx + 0x80]
mov dword [esp], eax
call fcn.6c9d7b30
mov eax, dword [ebp + 0x124]
mov dword [esp], eax
call dword [ebx + 0x1508]
push eax
mov dword [esp], edi
call dword [ebx + 0x1500]
push edx
jmp 0x6ca45b97
cmp edx, 0x4010804
jne 0x6ca461aa
mov edx, 1
mov eax, ebx
call fcn.6ca43b20
cmp eax, 2
mov eax, dword [ebp + 0x124]
sbb edx, edx
add edx, 8
mov dword [esp], eax
mov dword [esp + 0x18], edx
call dword [ebx + 0x1504]
push edx
mov edx, dword [esp + 0x18]
mov edx, dword [eax + edx*4]
test edx, edx
je 0x6ca46118
mov eax, dword [edx + 0x9c]
add edx, 0x38
jmp 0x6ca460f5
sub edx, 0x4030404
and edx, 0xfffeffff
jne 0x6ca46118
mov eax, dword [ebp + 0x124]
mov dword [esp], eax
call dword [ebx + 0x1504]
push edx
mov edx, dword [eax + 0x18]
test edx, edx
jne 0x6ca46172
jmp 0x6ca46118
cmp edx, 0x4020404
je 0x6ca4618e
jmp 0x6ca46118
mov eax, dword [eax + 0x124]
mov dword [esp], eax
call dword [ebx + 0x1504]
push ecx
mov edx, dword [eax + 0x20]
test edx, edx
jne 0x6ca460ef
jmp 0x6ca46118
xor edx, edx
mov eax, ebx
call fcn.6ca43b20
test eax, eax
je 0x6ca45f53
xor edx, edx
mov dword [esp + 0x1c], esi
xor ebp, ebp
mov esi, ebx
mov dword [esp + 0x18], 0
mov ebx, edx
jmp 0x6ca46224
mov eax, dword [edi + ebp*4 + 0x18]
add eax, edi
mov dword [esp], eax
call fcn.6c9d7b00
add eax, 1
add ebx, eax
cmp ebx, 0x12
jbe 0x6ca46221
cmp ebp, dword [edi + 0xc]
ja 0x6ca4622c
mov dword [esp + 0x18], ebp
mov ebx, eax
add ebp, 1
cmp ebp, dword [esi + 0x14a8]
jb 0x6ca461fe
mov ebx, esi
sub ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov dword [ebx + 0x14b4], ebp
jmp 0x6ca45f7c