Function at 0x4341c0
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x23c
mov ebx, eax
mov esi, edx
call fcn.00433f18
and esi, 0x800
jne 0x4341e8
xor eax, eax
add esp, 0x23c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, eax
mov dword [esp], ebx
call sub.IMM32.DLL_ImmGetContext
push esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x4341db
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x800
mov eax, dword [esp + 0x18]
mov dword [esp], eax
xor eax, eax
cmp edi, 2
sete al
mov edi, eax
je 0x434438
call sub.IMM32.DLL_ImmGetCompositionStringA
sub esp, 0x10
mov esi, eax
test esi, esi
jle 0x434413
mov dword [esp], esi
mov eax, dword [0x68bb7c]
call dword [eax + 0x14]
mov dword [esp + 0x1c], eax
test edi, edi
jne 0x434448
mov edi, dword [0x68b2ac]
test edi, edi
je 0x434497
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x800
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sub.IMM32.DLL_ImmGetCompositionStringA
sub esp, 0x10
mov esi, eax
lea ebp, [esp + 0x88]
mov dword [esp], ebp
mov eax, dword [0x68bb7c]
call dword [eax + 0x1f0]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], esi
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [0x68b2a8]
mov dword [esp], eax
mov eax, dword [0x68bb7c]
call dword [eax + 0x4a8]
lea eax, [esp + 0x15c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xffffffff
mov eax, dword [esp + 0x88]
mov dword [esp + 4], eax
mov dword [esp], edi
mov eax, dword [0x68bb7c]
call dword [eax + 0x53c]
mov eax, dword [esp + 0x160]
mov dword [esp + 0x14], eax
cmp esi, eax
jl 0x434470
mov esi, dword [esp + 0x15c]
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
rep movsb byte es:[edi], byte [esi]
mov dword [esp], ebp
mov eax, dword [0x68bb7c]
call dword [eax + 0x1e8]
lea eax, [esp + 0x15c]
mov dword [esp], eax
mov eax, dword [0x68bb7c]
call dword [eax + 0x1e8]
mov ebp, dword [esp + 0x14]
mov dword [esp], ebx
call fcn.00416574
mov edx, eax
lea esi, [esp + 0x28]
mov ecx, 0x60
xor eax, eax
mov edi, esi
rep stosb byte es:[edi], al
mov ecx, dword [edx]
mov eax, dword [ecx + 0x5c]
mov dword [esp + 0x2c], eax
inc eax
mov dword [ecx + 0x5c], eax
mov dword [esp + 0x30], 0xfffffffe
mov dword [esp + 0x34], ecx
mov eax, dword [edx + 0x14]
mov dword [esp + 0x38], eax
mov eax, dword [edx + 8]
lea eax, [eax + eax*4]
shl eax, 4
add eax, dword [ecx + 0x88]
mov eax, dword [eax + 8]
mov dword [esp + 0x3c], eax
call fcn.00481bfc
mov dword [esp + 0x58], eax
call fcn.005da9a0
mov dword [esp + 0x44], eax
mov dword [esp + 0x60], 1
mov dword [esp + 0x5c], 0
mov dword [esp + 0x68], 2
test ebp, ebp
jle 0x434404
mov edi, dword [esp + 0x1c]
dec ebp
and ebp, 0xfffffffe
lea ebp, [edi + ebp + 2]
nop
mov al, byte [edi]
mov byte [esp + 0x64], al
mov al, byte [edi + 1]
mov byte [esp + 0x65], al
mov dword [esp + 0x28], 2
mov dword [esp + 4], 0
mov dword [esp], esi
call fcn.004179e0
mov dword [esp + 0x28], 3
mov dword [esp + 4], 0
mov dword [esp], esi
call fcn.004179e0
add edi, 2
cmp edi, ebp
jne 0x4343c0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov eax, dword [0x68bb7c]
call dword [eax + 0x18]
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.IMM32.DLL_ImmReleaseContext
sub esp, 8
mov eax, 1
add esp, 0x23c
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.IMM32.DLL_ImmGetCompositionStringW
sub esp, 0x10
mov esi, eax
jmp 0x434234
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 0x800
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sub.IMM32.DLL_ImmGetCompositionStringW
sub esp, 0x10
mov ebp, eax
jmp 0x434335
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov eax, dword [0x68bb7c]
call dword [eax + 0x18]
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov eax, dword [0x68bb7c]
call dword [eax + 0x14]
mov dword [esp + 0x1c], eax
jmp 0x4342fd
mov dword [esp + 4], 0x6008bd
mov dword [esp], 0
mov eax, dword [0x68bb7c]
call dword [eax + 0x4bc]
mov edi, eax
mov dword [0x68b2ac], eax
jmp 0x434261