Function at 0x18000ab70
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x18008b088]
xor rax, rsp
mov qword [rbp + 0x3f], rax
lea r9, [0x18008af90]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 6]
call fcn.18000b620
mov bl, 1
movzx edi, bl
xor r15d, r15d
mov qword [rbp + 0x1f], r15
mov qword [rbp + 0x27], 0xf
mov byte [rbp + 0xf], r15b
mov r9d, 0xcb
xor r8d, r8d
lea rdx, [rbp + 0xf]
xor ecx, ecx
call fcn.18000f410
test al, al
jne 0x18000acdc
mov dword [rbp + 0x2f], 0x746573
mov eax, 0x5f
mov word [rbp + 0x32], ax
mov dword [rbp + 0x33], 0x6f7250
mov eax, 0x67
mov word [rbp + 0x36], ax
mov eax, 0x72
mov word [rbp + 0x37], ax
mov dword [rbp + 0x38], 0x496d61
mov eax, 0x64
mov word [rbp + 0x3b], ax
mov qword [rbp - 0x31], r15
lea rax, [rbp + 0x2f]
mov rdi, 0xffffffffffffffff
nop
inc rdi
cmp byte [rax + rdi], 0
jne 0x18000ac30
lea r9, [rbp - 0x31]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov dword [rbp - 0x39], r15d
mov qword [rbp - 0x29], r15
movzx ebx, bl
test eax, eax
cmovne ebx, r15d
lea r9, [rbp - 0x29]
lea r8, [rbp - 0x39]
mov edx, edi
lea rcx, [rbp + 0x2f]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
mov esi, eax
test bl, bl
je 0x18000ac9c
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x31]
call sub.RPCRT4.dll_MesIncrementalHandleReset
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x18000ac9c
call sub.RPCRT4.dll_MesHandleFree
test esi, esi
jne 0x18000ae00
mov qword [rbp - 0x21], r15
lea r8, [rbp - 0x21]
mov edx, edi
lea rcx, [rbp + 0x2f]
call sub.RPCRT4.dll_MesDecodeBufferHandleCreate
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x18000acc5
call sub.RPCRT4.dll_MesHandleFree
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x18000ae00
call sub.RPCRT4.dll_MesHandleFree
jmp 0x18000ae00
call sub.IMM32.dll_ImmCreateContext
mov rsi, rax
mov qword [rbp - 1], r15
mov qword [rbp + 7], 0xf
mov byte [rbp - 0x11], 0
mov qword [rbp - 0x19], r15
movsd xmm0, qword [0x18008b038]
mulsd xmm0, qword [0x180083398]
addsd xmm0, qword [0x180083380]
cvttsd2si rcx, xmm0
mov dword [rbp - 0x39], ecx
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
mov r9d, 0x51
lea r8, [rbp + 0xf]
lea rdx, [rbp - 0x39]
lea rcx, [0x18008afb8]
call fcn.180028140
lea rdx, [rbp - 0x19]
xor ecx, ecx
call sub.IMM32.dll_ImmGetStatusWindowPos
mov r14d, eax
test rsi, rsi
cmove edi, r15d
xor r9d, r9d
xor r8d, r8d
mov edx, 0xe7
lea rcx, [rbp - 0x11]
call fcn.18004e300
test al, al
jne 0x18000ad7c
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80
xor ecx, ecx
call sub.IMM32.dll_ImmGetCompositionStringW
jmp 0x18000adb2
movzx ebx, bl
test r14d, r14d
cmove ebx, r15d
test dil, dil
je 0x18000ad93
mov rcx, rsi
call sub.IMM32.dll_ImmDestroyContext
test bl, bl
je 0x18000ada2
lea rdx, [rbp - 0x19]
xor ecx, ecx
call sub.IMM32.dll_ImmSetStatusWindowPos
xor r8d, r8d
xor edx, edx
mov ecx, 0xdc
call fcn.18003ee10
nop
mov rdx, qword [rbp + 7]
cmp rdx, 0x10
jb 0x18000adf0
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000adeb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000adeb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18006cd18
mov qword [rbp - 1], r15
mov qword [rbp + 7], 0xf
mov byte [rbp - 0x11], 0
mov rdx, qword [rbp + 0x27]
cmp rdx, 0x10
jb 0x18000ae3e
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ae39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000ae39
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18006cd18
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.18006d4c0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret