Function at 0x18001ca20
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x240]
sub rsp, 0x340
mov rax, qword [0x1800a8088]
xor rax, rsp
mov qword [rbp + 0x230], rax
imul eax, ecx, 0xb20
mov r15, rdx
mov qword [rbp - 8], rdx
mov rsi, r8
mov qword [rbp - 0x28], r8
mov edx, ecx
mov dword [rsp + 0x60], ecx
mov r14d, ecx
mov dword [rsp + 0x74], ecx
mov dword [rbp - 0x44], eax
cmp ecx, eax
ja case.0x18001cd4b.0
mov r13, qword [rbp - 0x30]
xor ebx, ebx
mov r12, qword [rbp - 0x20]
lea rcx, [0x180000000]
mov r9d, 0x65
mov r10d, 0x6e6b
lea r11d, [r9 + 0x12]
lea r8d, [r9 + 0xa]
cmp r14d, 0xb034
ja 0x18001cc46
je 0x18001cc1d
cmp r14d, 0x124
ja 0x18001cba0
je 0x18001cb92
mov eax, r14d
sub eax, 0x81
je 0x18001cb6d
sub eax, 0x3e
je 0x18001caef
cmp eax, 0x2e
jne 0x18001cfdb
mov qword [rbp], rbx
mov dword [rbp - 0x54], ebx
jmp 0x18001cfdb
mov rax, qword [r15]
test rax, rax
je 0x18001d016
cmp qword [rax + 8], 0
je 0x18001d016
mov esi, dword [rax + 4]
mov ecx, dword [rax]
cmp ecx, esi
jl 0x18001d016
test esi, esi
js 0x18001d016
test ecx, ecx
jle 0x18001d016
sub esi, 1
movsxd rdi, esi
js 0x18001cb54
nop dword [rax + rax]
mov rax, qword [r15]
mov rcx, qword [rax + 8]
movzx ecx, byte [rcx + rdi]
call fcn.18006c4c8
test eax, eax
je 0x18001cff4
dec esi
sub rdi, 1
jns 0x18001cb30
mov edx, dword [rsp + 0x60]
mov rax, qword [r15]
mov rsi, qword [rbp - 0x28]
mov rcx, qword [rax + 8]
mov byte [rcx], 0
mov rax, qword [r15]
mov dword [rax + 4], ebx
jmp 0x18001cfdb
mov rax, qword [r15]
test rax, rax
je 0x18001cb8a
mov ecx, dword [rax + 4]
mov dword [rbp - 0x40], ecx
test ecx, ecx
js 0x18001cb8a
cmp qword [rax + 8], 0
jne 0x18001cfdb
mov rax, rbx
jmp 0x18001d03b
test r15, r15
je case.0x18001cd4b.0
jmp 0x18001cfdb
cmp r14d, 0x5a33
je 0x18001cbcf
cmp r14d, 0x858d
je 0x18001d010
cmp r14d, 0xa5b7
jne 0x18001cfdb
mov qword [rbp + 8], rbx
mov dword [rbp - 0x58], ebx
jmp 0x18001cfdb
movsxd rdi, dword [rbp - 0x40]
lea rcx, [rdi + 1]
call fcn.18006cfe0
mov r8, rax
test rax, rax
je 0x18001cb8a
mov rdx, rbx
test rdi, rdi
jle 0x18001cc0e
nop dword [rax]
mov rax, qword [r15]
mov rcx, qword [rax + 8]
movzx eax, byte [rdx + rcx]
test al, al
jne 0x18001cc02
movzx eax, byte [rsi]
mov byte [rdx + r8], al
inc rdx
cmp rdx, rdi
jl 0x18001cbf0
mov byte [rdi + r8], 0
mov qword [rsp + 0x68], r8
jmp 0x18001cfd7
mov rdi, qword [r15 + 8]
test rdi, rdi
je 0x18001cfdb
nop word [rax + rax]
mov rcx, qword [rdi + 0x10]
call fcn.18006c3d8
mov rdi, qword [rdi]
test rdi, rdi
jne 0x18001cc30
jmp 0x18001cfd7
cmp r14d, 0x1ef4b
ja 0x18001ccf7
je 0x18001ccef
cmp r14d, 0xb3e5
je case.0x18001cd4b.0
cmp r14d, 0xcc2c
je 0x18001cca0
cmp r14d, 0x14a81
jne 0x18001cfdb
mov ecx, 0x30
mov dword [rbp - 0x5c], 5
mov dword [rbp - 0x50], 0x80
call fcn.18006cfe0
mov r13, rax
mov qword [rbp - 0x30], rax
jmp 0x18001cfd7
mov rdx, qword [r15 + 8]
test rdx, rdx
je 0x18001ccb6
xor r8d, r8d
mov ecx, 0x124
call fcn.18001ca20
mov rdx, qword [r15 + 0x10]
test rdx, rdx
je 0x18001cccc
xor r8d, r8d
mov ecx, 0x124
call fcn.18001ca20
mov rdx, qword [r15 + 0x18]
test rdx, rdx
je 0x18001cce2
xor r8d, r8d
mov ecx, 0x124
call fcn.18001ca20
mov rcx, r15
call fcn.18006c3d8
jmp 0x18001cfd7
mov dword [rbp - 0x60], ebx
jmp 0x18001cfdb
cmp r14d, 0x29415
je 0x18001cfb8
cmp r14d, 0x338df
je 0x18001cf55
cmp r14d, 0x3dda9
jne 0x18001cfdb
mov edi, dword [rbp - 0x64]
cmp edi, 3
jne 0x18001d020
mov esi, 6
mov dword [rsp + 0x70], esi
cmp esi, 6
ja case.default.0x18001cd4b
mov eax, esi
mov ecx, dword [rcx + rax*4 + 0x1d068]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov rax, qword [r13 + 0x28]
mov qword [r15], rax
mov qword [rbp - 0x10], rbx
mov dword [rbp - 0x6c], ebx
mov dword [rbp - 0x70], ebx
mov dword [rbp - 0x74], 0xa
jmp 0x18001cdb0
mov dword [rbp - 0x68], ebx
mov dword [rbp - 0x80], ebx
mov dword [rsp + 0x7c], 0xa
mov dword [rsp + 0x78], reloc.OLEAUT32.dll_SafeArrayLock
jmp 0x18001cdb0
mov r12, qword [sym.imp.RPCRT4.dll_IUnknown_Release_Proxy]
mov rcx, r13
mov dword [rbp - 0x78], reloc.OLEAUT32.dll_SafeArrayLock
mov qword [rbp - 0x18], rbx
mov dword [rbp - 0x7c], ebx
call fcn.18006c3d8
mov r11d, VarBoolFromStr
mov r10d, 0x6e6b
lea r9d, [r11 - 0x12]
lea r8d, [r11 - 8]
lea rcx, [0x180000000]
dec esi
mov dword [rsp + 0x70], esi
lea eax, [rsi + 0xe7]
cmp eax, 0xe6
ja 0x18001cd33
mov rsi, qword [rbp - 0x28]
jmp 0x18001cfd7
mov rcx, rbx
call qword [sym.imp.USER32.dll_WindowFromPoint]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rbp - 0x38], rax
test rax, rax
je 0x18001cd9c
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_ReleaseDC]
mov qword [rbp - 0x38], rbx
jmp 0x18001cd9c
mov edi, 0x69
lea ebx, [rdi + 5]
lea esi, [rdi - 0x44]
lea r15d, [rdi - 0xa]
lea r13d, [rdi - 0x19]
lea r14d, [rdi + 9]
nop
mov eax, edi
sub eax, 0x65
je 0x18001ce85
sub eax, 1
je 0x18001ce6f
sub eax, 1
je 0x18001ce61
sub eax, 1
je 0x18001ce4f
cmp eax, 1
jne 0x18001cec1
mov dword [rbp + 0x10], 0x6e5549
mov dword [rbp + 0x13], 0x6f6e6b
jmp 0x18001cec1
mov word [rbp + 0x16], r11w
mov word [rbp + 0x17], bx
mov dword [rbp + 0x18], 0x65525f
jmp 0x18001cec1
mov dword [rbp + 0x1b], 0x7361656c
mov word [rbp + 0x1f], r9w
jmp 0x18001cec1
mov word [rbp + 0x20], r15w
mov word [rbp + 0x21], r13w
mov word [rbp + 0x22], r14w
mov word [rbp + 0x23], r8w
jmp 0x18001cec1
mov dword [rbp + 0x24], 0x207978
lea rdx, [rbp + 0x10]
mov eax, 0xa70
mov word [rbp + 0x27], si
mov r8, r12
mov word [rbp + 0x28], ax
lea rcx, [rbp + 0x30]
mov byte [rbp + 0x2a], 0
call fcn.180001120
mov r8d, 0x6f
mov r10d, 0x6e6b
lea r9d, [r8 - 0xa]
lea r11d, [r8 + 8]
dec edi
cmp edi, 0x64
ja 0x18001ce20
mov eax, dword [rsp + 0x78]
xor ebx, ebx
mov r9d, dword [rbp - 0x74]
mov r8d, dword [rbp - 0x70]
mov edx, dword [rbp - 0x6c]
mov rcx, qword [rbp - 0x38]
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x40], eax
mov eax, dword [rbp - 0x80]
mov dword [rsp + 0x38], eax
mov eax, dword [rbp - 0x7c]
mov dword [rsp + 0x30], eax
mov rax, qword [rbp - 0x18]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp - 0x78]
mov dword [rsp + 0x20], eax
call qword [sym.imp.MSIMG32.dll_AlphaBlend]
mov r9d, dword [rbp - 0x68]
xor r8d, r8d
mov rcx, qword [rbp - 0x10]
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.IMM32.dll_ImmEnumRegisterWordW]
mov esi, dword [rsp + 0x70]
mov r14d, dword [rsp + 0x74]
mov r15, qword [rbp - 8]
mov r13, qword [rbp - 0x30]
jmp 0x18001cd9c
mov dword [rsp + 0x68], 1
jmp 0x18001cdb0
mov r9, r13
mov r8d, 0x71
mov rdx, rsi
xor ecx, ecx
call fcn.180029130
mov r9d, dword [rbp - 0x54]
xor edx, edx
mov r8, qword [rbp]
xor ecx, ecx
mov dword [rbp - 0x64], eax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x40], rax
mov eax, dword [rbp - 0x4c]
mov dword [rsp + 0x38], eax
mov eax, dword [rbp - 0x60]
mov dword [rsp + 0x30], eax
mov eax, dword [rbp - 0x5c]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp - 0x58]
mov dword [rsp + 0x20], eax
call qword [sym.imp.oledlg.dll_OleUIAddVerbMenuW]
mov r9d, dword [rbp - 0x48]
xor r8d, r8d
mov edx, dword [rbp - 0x50]
mov rcx, qword [rbp + 8]
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringA]
jmp 0x18001cfd7
test r13, r13
je 0x18001d02e
xor edx, edx
mov dword [rbp - 0x4c], ebx
mov r9, r13
mov dword [rbp - 0x48], ebx
xor ecx, ecx
lea r8d, [rdx + 0x52]
call fcn.18004f9d0
mov qword [rbp - 0x20], rbx
mov edx, dword [rsp + 0x60]
imul eax, edx, 0xb2
add r14d, eax
mov dword [rsp + 0x74], r14d
cmp r14d, dword [rbp - 0x44]
ja case.0x18001cd4b.0
jmp 0x18001ca86
mov rdx, qword [r15]
cmp dword [rdx], esi
jle 0x18001d00a
mov rax, qword [rdx + 8]
movsxd rcx, esi
mov byte [rax + rcx + 1], 0
mov rdx, qword [r15]
lea eax, [rsi + 1]
mov dword [rdx + 4], eax
mov dword [rsp + 0x68], ebx
jmp case.0x18001cd4b.0
mov dword [rsp + 0x68], 0xffffffff
jmp case.0x18001cd4b.0
mov rcx, r13
call fcn.18006c3d8
mov dword [rsp + 0x68], edi
jmp case.0x18001cd4b.0
mov dword [rsp + 0x68], 6
mov rax, qword [rsp + 0x68]
mov rcx, qword [rbp + 0x230]
xor rcx, rsp
call fcn.1800618d0
mov rbx, qword [rsp + 0x380]
add rsp, 0x340
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret