Function at 0x6902c611
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x28]
push ebp
push esi
mov esi, dword [esp + 0x2c]
push edi
mov dword [esp + 0x10], 1
mov dword [esi + 4], ebx
call dword [sym.imp.USER32.dll_GetMessagePos]
mov ecx, eax
lea edx, [esp + 0x14]
and ecx, 0xffff
push edx
shr eax, 0x10
push ebx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
call dword [sym.imp.USER32.dll_GetMessageTime]
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov ebp, 0x10
push ebp
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0
call edi
test ah, 0x80
je 0x6902c498
mov eax, dword [esi + 0x14]
or al, 1
mov dword [esi + 0x14], eax
push 0x14
call edi
test al, 1
je 0x6902c4a8
mov eax, dword [esi + 0x14]
or al, 2
mov dword [esi + 0x14], eax
push 0x11
call edi
test ah, 0x80
je 0x6902c4b9
mov eax, dword [esi + 0x14]
or al, 0x14
mov dword [esi + 0x14], eax
push 0x12
call edi
test ah, 0x80
je 0x6902c4ca
mov eax, dword [esi + 0x14]
or al, 8
mov dword [esi + 0x14], eax
mov eax, dword [esp + 0x38]
cmp eax, 0xf
ja 0x6902c5d2
je 0x6902c588
cmp eax, 6
ja case.0x6902cb66.284
jmp dword [eax*4 + 0x6902cdd0]
call sym.IML32.dll_imIMEServiceFixActiveInput
xor edx, edx
mov eax, dword [esp + 0x10]
cmp word [esp + 0x3c], dx
mov dword [esi], 0x12
pop edi
setne dl
mov dword [esi + 0x18], edx
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
mov eax, dword [esp + 0x3c]
cmp eax, 2
jne 0x6902c524
mov dword [esi], 0xf
jmp 0x6902c52f
dec eax
neg eax
sbb eax, eax
and al, 0xfe
add eax, ebp
mov dword [esi], eax
mov eax, dword [esp + 0x40]
pop edi
mov ecx, eax
and ecx, 0xffff
shr eax, 0x10
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0xc]
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [esi], 0xd
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
mov eax, dword [esp + 0x10]
mov dword [esi], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
lea ecx, [esp + 0x1c]
push 0
push ecx
push ebx
call dword [sym.imp.USER32.dll_GetUpdateRect]
test eax, eax
mov dword [esp + 0x10], eax
je case.0x6902cc1d.7
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x18], edx
mov edx, dword [esp + 0x28]
mov dword [esi], 0x15
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x24], edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
cmp eax, 0x114
ja 0x6902cb3d
je 0x6902cb32
cmp eax, 0x101
ja 0x6902c920
je 0x6902c89f
add eax, 0xfffffff0
cmp eax, 0xf0
ja case.0x6902cb66.284
xor ecx, ecx
mov cl, byte [eax + 0x6902ce0c]
jmp dword [ecx*4 + 0x6902cdec]
call sym.IML32.dll_imIMEGetCompositionActive
test eax, eax
jne case.0x6902cb66.284
mov edi, dword [esp + 0x3c]
cmp edi, ebp
je case.0x6902cb66.284
cmp edi, 0x14
je case.0x6902cb66.284
cmp edi, 0x11
je case.0x6902cb66.284
cmp edi, 0x12
je case.0x6902cb66.284
cmp edi, 0x73
jne 0x6902c65c
test byte [esi + 0x14], 4
je 0x6902c65c
cmp ebx, dword [0x6908943c]
jne case.0x6902cb66.284
mov ecx, dword [esi + 0x14]
mov eax, ecx
mov edx, ecx
shr eax, 1
and eax, 1
and edx, 1
xor eax, edx
mov edx, ecx
and edx, 4
je 0x6902c70c
test cl, 8
jne 0x6902c70c
cmp edi, 0x41
jb 0x6902c68b
cmp edi, 0x5a
jbe 0x6902c699
cmp edi, 0x30
jb 0x6902c70c
cmp edi, 0x39
ja 0x6902c70c
test eax, eax
jne 0x6902c70c
test edi, edi
jbe 0x6902ca2e
cmp edi, 0xc0
jae 0x6902ca2e
mov cl, byte [edi + 0x69079a8c]
test eax, eax
mov byte [esi + 0x18], cl
je 0x6902c6c6
cmp edi, 0x41
jb 0x6902c6f1
cmp edi, 0x5a
ja 0x6902c6f1
jmp 0x6902c6e8
cmp edi, 0x41
jb 0x6902c6de
cmp edi, 0x5a
ja 0x6902c6de
mov edx, edi
and edx, 0xff
add edx, 0x20
mov dword [esi + 0x1c], edx
cmp edi, 0x30
jb 0x6902c6f1
cmp edi, 0x39
ja 0x6902c6f1
and edi, 0xff
mov dword [esi + 0x1c], edi
mov eax, dword [esp + 0x10]
mov dword [esi + 0x20], 1
mov dword [esi], 0xa
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
cmp edi, 0xbe
jne 0x6902c73e
test edx, edx
je 0x6902c74a
mov byte [esi + 0x18], 0x2f
mov dword [esi + 0x1c], 0
mov eax, dword [esp + 0x10]
mov dword [esi + 0x20], 1
mov dword [esi], 0xa
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
test edi, edi
jbe 0x6902c755
cmp edi, 0xc0
jae 0x6902c755
mov al, byte [edi + 0x69079a8c]
mov byte [esi + 0x18], al
jmp 0x6902c759
mov byte [esi + 0x18], 0x7f
cmp edi, 9
je 0x6902c76f
push 2
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
test eax, eax
jne case.0x6902cb66.284
cmp edi, 0x60
jb 0x6902c77d
cmp edi, 0x69
jbe case.0x6902cb66.284
cmp edi, 0x90
je case.0x6902cb66.284
test edi, edi
jbe 0x6902c71c
cmp edi, 0x92
jae 0x6902c71c
xor ecx, ecx
mov cl, byte [edi + 0x69079b4c]
mov dword [esi + 0x1c], ecx
jmp 0x6902c723
mov eax, dword [esp + 0x10]
mov dword [esi], 0x18
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
mov eax, dword [esp + 0x3c]
xor edx, edx
test eax, eax
setne dl
push edx
push ebx
mov dword [esi], 0x16
mov dword [esi + 0x18], eax
call fcn.6903a830
pop edi
pop esi
mov eax, dword [esp + 8]
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
call sym.IML32.dll_imIMEServiceFixActiveInput
mov eax, dword [esp + 0x40]
cmp ax, 5
jne 0x6902c821
call dword [sym.imp.USER32.dll_GetFocus]
mov edi, eax
push edi
call fcn.6902d710
test eax, eax
je 0x6902c806
mov dword [0x6907c2fc], edi
mov eax, dword [esp + 0x10]
mov dword [esi + 0x18], 0
mov dword [esi], 0x11
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
cmp ax, 8
jne 0x6902c806
mov eax, dword [esp + 0x10]
mov dword [esi + 0x18], ebp
mov dword [esi], 0x11
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
mov eax, dword [esp + 0x10]
mov dword [esi], 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
cmp bx, word [esp + 0x3c]
mov dword [esi], 0x1a
jne 0x6902cd4e
mov eax, dword [esp + 0x10]
mov dword [esi + 4], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
push ebx
mov dword [esi], 0x1c
mov dword [esi + 0x18], 0
call fcn.6902d950
push ebx
call fcn.6903a230
pop edi
pop esi
mov eax, dword [esp + 8]
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
mov eax, dword [esp + 0x3c]
cmp eax, ebp
je case.0x6902cb66.284
cmp eax, 0x14
je case.0x6902cb66.284
cmp eax, 0x11
je case.0x6902cb66.284
cmp eax, 0x12
je case.0x6902cb66.284
xor ecx, ecx
cmp eax, ecx
jbe 0x6902c902
cmp eax, 0xc0
jae 0x6902c902
mov cl, byte [eax + 0x69079a8c]
xor edx, edx
mov byte [esi + 0x18], cl
mov dl, byte [eax + 0x69079b4c]
mov eax, dword [esp + 0x10]
mov dword [esi + 0x1c], edx
mov dword [esi + 0x20], 1
mov dword [esi], 0xb
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
mov eax, dword [esp + 0x10]
mov byte [esi + 0x18], 0x7f
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], ecx
mov dword [esi], 0xb
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
add eax, 0xfffffefe
cmp eax, 0x11
ja case.0x6902cb66.284
xor ecx, ecx
mov cl, byte [eax + 0x6902cf1c]
jmp dword [ecx*4 + 0x6902cf00]
call sym.IML32.dll_imIMEServiceFixActiveInput
mov eax, dword [esp + 0x3c]
cmp eax, 0x70
jb case.0x6902cb66.284
cmp eax, 0x87
ja case.0x6902cb66.284
mov dl, byte [eax + 0x69079a8c]
mov eax, dword [esp + 0x10]
mov byte [esi + 0x18], dl
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x20], 1
mov dword [esi], 0xa
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
mov eax, dword [esp + 0x3c]
cmp eax, 9
je case.0x6902cb66.284
cmp eax, 0xd
jne 0x6902c9c3
test dword [esp + 0x40], 0x1000000
je 0x6902c9c3
mov eax, dword [esp + 0x10]
mov byte [esi + 0x18], 0x4c
mov dword [esi + 0x1c], 3
mov dword [esi + 0x20], 1
mov dword [esi], 0xa
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
mov ecx, dword [esi + 0x14]
test cl, 4
je 0x6902c9f4
test cl, 8
jne 0x6902c9f4
cmp eax, 3
je case.0x6902cc1d.7
cmp eax, 0x16
je case.0x6902cc1d.7
cmp eax, 0x18
je case.0x6902cc1d.7
cmp eax, 0x1a
je case.0x6902cc1d.7
mov ecx, eax
mov dword [esi + 0x20], 1
and ecx, 0xff
test eax, eax
mov dword [esi + 0x1c], ecx
jbe 0x6902ca2e
cmp eax, 0x100
jae 0x6902ca2e
mov dl, byte [eax + 0x69079be0]
mov eax, dword [esp + 0x10]
mov byte [esi + 0x18], dl
mov dword [esi], 0xa
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
mov eax, dword [esp + 0x10]
mov byte [esi + 0x18], 0x7f
mov dword [esi], 0xa
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
call sym.IML32.dll_imIMEServiceFixActiveInput
mov eax, dword [esp + 0x3c]
mov dword [esi], 0x17
and eax, 0xffff
pop edi
mov ecx, eax
shr ecx, 8
and eax, 0xff
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0xc]
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
mov eax, dword [esp + 0x10]
mov dword [esi], 0x19
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
call sym.IML32.dll_imIMEServiceAvailable
test eax, eax
je case.0x6902cb66.284
mov eax, dword [esp + 0x40]
test ah, 8
jne 0x6902caaf
call sym.IML32.dll_imIMEGetCompositionActive
test eax, eax
je case.0x6902cb66.284
push 0x28
mov dword [esi], 0x1d
call sym.IML32.dll_Ordinal_1124
mov ebp, eax
test ebp, ebp
mov dword [esi + 0x20], ebp
je 0x6902cb1d
mov esi, dword [esp + 0x40]
mov ecx, 0xa
xor eax, eax
mov edi, ebp
push ebp
push esi
rep stosd dword es:[edi], eax
push ebx
mov dword [ebp], 1
call sym.IML32.dll_imIMEUnpackText
push ebp
push esi
push ebx
call sym.IML32.dll_imIMEUnpackSelection
mov edx, dword [ebp + 8]
push edx
call sym.IML32.dll_imIMESetLastSelectionLeft
call sym.IML32.dll_imIMEGetCompositionActive
test eax, eax
jne 0x6902cb1d
call sym.IML32.dll_imIMEGetCompositionJustFixed
test eax, eax
jne 0x6902cb1d
push ebx
call sym.IML32.dll_imIMESetActiveCompositionWindow
push 1
call sym.IML32.dll_imIMESetCompositionActive
mov dword [0x6907c300], 1
push 0
call sym.IML32.dll_imIMESetCompositionJustFixed
pop edi
pop esi
mov eax, dword [esp + 8]
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
mov dword [esi], 0x13
jmp 0x6902cc02
cmp eax, 0x205
ja 0x6902cccc
je 0x6902ccc4
add eax, 0xfffffeeb
cmp eax, 0xef
ja case.0x6902cb66.284
xor ecx, ecx
mov cl, byte [eax + 0x6902cf50]
jmp dword [ecx*4 + 0x6902cf30]
mov eax, dword [esp + 0x10]
mov dword [esi], 9
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
mov dword [esi], 6
jmp 0x6902cd00
mov eax, dword [esp + 0x40]
test eax, eax
jne case.0x6902cc1d.7
mov edx, dword [esp + 0x3c]
shr edx, 0x10
cmp edx, 0xffff
jne case.0x6902cc1d.7
mov eax, dword [0x6907c2fc]
test eax, eax
je case.0x6902cc1d.7
mov esi, dword [sym.imp.USER32.dll_PostMessageA]
push 0
push 1
push 0x86
push eax
call esi
mov eax, dword [0x6907c2fc]
push ebx
push 1
push 6
push eax
call esi
mov ecx, dword [0x6907c2fc]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
mov eax, dword [esp + 8]
pop ebp
mov dword [0x6907c2fc], 0
pop ebx
add esp, 0x1c
ret 0x14
mov dword [esi], 0x14
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
mov eax, ecx
mov dword [esi + 0x20], edx
and eax, 0xffff
cmp eax, 8
ja case.0x6902cc1d.7
jmp dword [eax*4 + 0x6902d040]
mov eax, dword [esp + 0x10]
mov dword [esi + 0x18], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
mov eax, dword [esp + 0x10]
mov dword [esi + 0x18], 3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
mov eax, dword [esp + 0x10]
mov dword [esi + 0x18], 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
mov eax, dword [esp + 0x10]
mov dword [esi + 0x18], 5
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
mov eax, dword [esp + 0x10]
mov dword [esi + 0x18], 6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
mov eax, dword [esp + 0x10]
mov dword [esi + 0x18], 7
shr ecx, 0x10
mov dword [esi + 0x1c], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
mov dword [esi], 0
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
mov dword [esi], 5
jmp 0x6902cd00
cmp eax, 0x209
ja 0x6902cd26
je case.0x6902cb66.282
sub eax, 0x206
je 0x6902ccf2
dec eax
je case.0x6902cb66.280
dec eax
jne case.0x6902cb66.284
mov dword [esi], 1
jmp 0x6902cd00
mov dword [esi], 2
jmp 0x6902cd00
mov dword [esi], 7
jmp 0x6902cd00
mov dword [esi], 3
call sym.IML32.dll_imIMEServiceFixActiveInput
mov eax, dword [esp + 0x40]
pop edi
movsx ecx, ax
shr eax, 0x10
movsx edx, ax
mov eax, dword [esp + 0xc]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
cmp eax, 0x282
je 0x6902cd62
cmp eax, 0x311
jne case.0x6902cb66.284
mov eax, dword [esp + 0x3c]
mov dword [esi], 0x1a
cmp bx, ax
mov dword [esi + 4], eax
je case.0x6902cc1d.7
push ebx
call fcn.6903a9c0
pop edi
pop esi
mov eax, dword [esp + 8]
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
call sym.IML32.dll_imIMEServiceAvailable
test eax, eax
je case.0x6902cb66.284
mov eax, dword [esp + 0x3c]
mov dword [esi], 0x1d
cmp eax, 5
jne case.0x6902cb66.284
push 0x28
call sym.IML32.dll_Ordinal_1124
mov ebp, eax
mov ecx, 0xa
xor eax, eax
mov edi, ebp
mov dword [esi + 0x20], ebp
push 1
rep stosd dword es:[edi], eax
mov dword [ebp], 2
call sym.IML32.dll_imIMESetCandidateWindowActive
call sym.IML32.dll_imIMEGetLastSelectionLeft
push 0
mov dword [ebp + 4], eax
call sym.IML32.dll_imIMESetLastSelectionLeft
pop edi
pop esi
mov eax, dword [esp + 0x38]
pop ebp
mov dword [0x69079a88], eax
mov eax, dword [esp + 4]
pop ebx
add esp, 0x1c
ret 0x14