Function at 0x18001dc40
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2b0
mov rax, qword [0x180059178]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
lea eax, [rdx + 0xc]
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x48], r8
mov r12, rcx
mov qword [rsp + 0x80], rcx
mov dword [rsp + 0x30], eax
cmp edx, eax
jae 0x18001defb
mov r14, qword [rsp + 0x58]
lea ebp, [rdx - 0xe4]
mov rbx, qword [rsp + 0x58]
lea rdx, [0x180000000]
mov r15, qword [rsp + 0x58]
movabs rdi, 0x2c00780025
mov dword [rsp + 0x38], ebp
xor esi, esi
movabs r13, 0x20005c003a
movabs r10, 0x7500680073
mov ecx, eax
cmp ebp, 0x1b
ja case.default.0x18001dcea
mov ecx, dword [rdx + rbp*4 + 0x1e104]
add rcx, rdx
jmp rcx
mov r8d, 1
lea rdx, [0x18004fbf4]
lea rcx, [rsp + 0x90]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r8d, 5
mov qword [rsp + 0xac], rdi
lea rdx, [0x18004fbf8]
lea rcx, [rsp + 0xb2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov qword [rsp + 0xba], r13
mov r8, qword [rsp + 0x48]
lea rdx, [0x180000000]
mov r9, qword [rsp + 0x40]
movabs r10, 0x7500680073
jmp case.0x18001dcea.6
mov rcx, qword [str.RSD_PTR]
mov r8d, 6
mov rdx, r12
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x18001dd32
mov eax, esi
jmp 0x18001deff
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x50], 0x80
mov dword [rsp + 0x60], esi
jmp 0x18001ded9
mov eax, dword [0x18004fc04]
mov dword [rsp + 0xc0], eax
movzx eax, word [0x18004fc08]
mov word [rsp + 0xc4], ax
mov byte [rsp + 0x34], 1
jmp case.0x18001dcea.6
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
lea r13, [rcx + 1]
lea r13, [rdx + r13*2]
lea rax, [rcx + r13]
cmp qword [r12 + 0x18], rax
jb 0x18001defb
mov rdi, qword [rsp + 0x68]
cmp r14, rdi
je 0x18001dec8
nop
mov ebp, 0x115
nop word [rax + rax]
mov eax, ebp
sub eax, 0x113
je 0x18001df61
sub eax, 1
je 0x18001df30
cmp eax, 1
jne 0x18001de8f
mov rax, rdi
lea rsi, [rcx + r14]
sub rax, r14
mov rbx, rdx
cmp rcx, rax
mov r15, r13
cmovge rsi, rdi
cmp r14, rsi
je 0x18001de8d
lea r12, [0x180000000]
movzx edi, byte [r14]
mov eax, edi
movsx ecx, dil
shr rax, 4
movzx eax, byte [rax + r12 + 0x48980]
mov byte [rbx], al
movsx rax, dil
and eax, 0xf
movzx eax, byte [rax + r12 + 0x48980]
mov byte [rbx + 1], al
add rbx, 2
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isprint]
test eax, eax
mov edx, 0x3f
cmovne edx, edi
inc r14
mov byte [r15], dl
inc r15
cmp r14, rsi
jne 0x18001de32
mov r12, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x68]
xor esi, esi
mov rcx, qword [rsp + 0x70]
dec ebp
mov rdx, qword [rsp + 0x78]
cmp ebp, 0x112
ja 0x18001ddf0
cmp r14, rdi
jne 0x18001dde0
mov ebp, dword [rsp + 0x38]
movabs r10, 0x7500680073
mov r9, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
movabs r13, 0x20005c003a
lea rdx, [0x180000000]
movabs rdi, 0x2c00780025
mov ecx, dword [rsp + 0x30]
inc ebp
mov dword [rsp + 0x38], ebp
lea eax, [rbp + 0xe4]
cmp eax, ecx
jb 0x18001dcd7
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1800461b0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rdi, r13
sub rdi, rbx
cmp rbx, r13
cmova rdi, rsi
test rdi, rdi
je 0x18001df52
mov r8, rdi
mov dl, 0x20
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
add rbx, rdi
mov rdi, qword [rsp + 0x68]
mov qword [r12 + 0x20], r15
jmp 0x18001de8f
mov rcx, r12
call qword [0x1800560f8]
jmp 0x18001de8f
test r9, r9
je 0x18001defb
cmp dword [r8], 0
je 0x18001defb
jmp case.0x18001dcea.6
mov eax, dword [r8]
mov r14, r9
add rax, r9
mov qword [rsp + 0x68], rax
jmp case.0x18001dcea.6
mov dword [rsp + 0x90], 0x70
mov qword [rsp + 0x92], r10
jmp case.0x18001dcea.6
mov r8d, 2
lea rdx, [0x18004fc0c]
lea rcx, [rsp + 0x90]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov eax, dword [0x18004fc14]
movsd xmm0, qword [str.___0]
mov dword [rsp + 0x9c], eax
movzx eax, word [0x18004fc28]
mov dword [rsp + 0xa0], 0x20
mov word [rsp + 0xaa], ax
movsd qword [rsp + 0xa2], xmm0
jmp 0x18001dd32
mov rdi, qword [rsp + 0x58]
xor r8d, r8d
mov r9d, dword [rsp + 0x60]
mov rcx, rdi
mov edx, dword [rsp + 0x50]
call sub.IMM32.dll_ImmGetCompositionStringW
test eax, eax
jne 0x18001e025
mov byte [rsp + 0x34], al
jmp 0x18001e04f
cmp byte [rsp + 0x34], 0
je 0x18001e04f
xor r9d, r9d
mov dword [rsp + 0x28], esi
xor r8d, r8d
mov dword [rsp + 0x50], 0x12
mov rcx, rdi
mov qword [rsp + 0x20], rsi
lea edx, [r9 + 0x12]
call sub.IMM32.dll_ImmSetCompositionStringW
lea rcx, [rsp + 0x90]
call qword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
mov rdx, qword [0x180059fc8]
cmp rdx, qword [0x180059fd0]
je 0x18001e08b
mov rax, qword [r12]
movabs rdi, 0x2c00780025
mov qword [rdx], rax
add qword [0x180059fc8], 8
jmp 0x18001dd32
mov r8, r12
lea rcx, [0x180059fc0]
call fcn.180005fe0
movabs rdi, 0x2c00780025
jmp 0x18001dd32
mov rax, qword [0x180056008]
mov rcx, qword [r12 + 0x38]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rcx
jmp case.0x18001dcea.6
lea rbx, str.RSD_PTR
lea rdi, [0x180056c70]
mov rcx, qword [rbx]
mov r8d, 4
mov rdx, r12
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x18001dd6c
inc esi
add rbx, 8
cmp rbx, rdi
jl 0x18001e0d2
mov eax, 0x1b
jmp 0x18001deff