Function at 0x1402ddc8e
Capabilities:
Log keystrokes via input method manager

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15, rdx
mov rsi, rcx
movabs rbx, 0x8000000000000000
mov r14, qword [rdx + 8]
lea rdi, [rsp + 0x50]
mov rcx, rdi
mov rdx, r14
mov r8d, 8
call fcn.1402de023
mov rax, qword [rdi]
cmp rax, rbx
jne 0x1402ddcdc
mov qword [rsi], 2
jmp 0x1402ddfe3
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rsi
lea rcx, [rsp + 0x50]
mov rdi, qword [rcx + 8]
mov rsi, qword [rcx + 0x10]
mov rdx, r14
mov r8d, 0x10
call fcn.1402de14f
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x50]
xor r12d, r12d
mov qword [rsp + 0x48], rax
cmp rax, rbx
mov rcx, qword [rsp + 0x60]
mov r8d, 1
cmovne r8, qword [rsp + 0x58]
cmove rcx, r12
mov qword [rsp + 0x38], rsi
lea r14, [rdi + rsi]
test rcx, rcx
mov qword [rsp + 0x28], rdi
je 0x1402dde55
xor edx, edx
xor r9d, r9d
mov r10, rdi
xor edi, edi
xor r12d, r12d
cmp r10, r14
je 0x1402dde57
movzx r15d, byte [r8 + rdx]
movzx r11d, byte [r10]
test r11b, r11b
js 0x1402ddd6b
inc r10
jmp 0x1402dddd7
mov ebx, r11d
and ebx, 0x1f
movzx esi, byte [r10 + 1]
and esi, 0x3f
cmp r11b, 0xdf
jbe 0x1402dddbd
movzx eax, byte [r10 + 2]
shl esi, 6
and eax, 0x3f
or eax, esi
cmp r11b, 0xf0
jb 0x1402dddcb
movzx r11d, byte [r10 + 3]
and ebx, 7
shl ebx, 0x12
shl eax, 6
and r11d, 0x3f
or r11d, eax
or r11d, ebx
cmp r11d, 0x110000
je 0x1402dde57
add r10, 4
jmp 0x1402dddd7
add r10, 2
shl ebx, 6
or ebx, esi
mov r11d, ebx
jmp 0x1402dddd7
add r10, 3
shl ebx, 0xc
or eax, ebx
mov r11d, eax
test rdi, rdi
je 0x1402dddee
mov edi, 1
test r12, r12
je 0x1402dde02
mov r12d, 1
jmp 0x1402dde13
mov edi, 1
or r15d, 2
cmp r15d, 3
jne 0x1402dde11
mov rbp, r9
jmp 0x1402dde13
or r15d, 2
cmp r15d, 3
jne 0x1402dde50
xor r12d, r12d
jmp 0x1402dde13
xor edi, edi
mov eax, 1
cmp r11d, 0x80
jb 0x1402dde3f
mov eax, 2
cmp r11d, 0x800
jb 0x1402dde3f
cmp r11d, 0x10000
mov eax, 4
sbb rax, 0
add r9, rax
inc rdx
cmp rcx, rdx
jne 0x1402ddd4f
jmp 0x1402dde57
mov r13, r9
jmp 0x1402ddde6
xor edi, edi
mov rax, qword [rsp + 0x48]
shl rax, 1
test rax, rax
je 0x1402dde72
mov rcx, qword [0x1403f9220]
xor edx, edx
call fcn.1402e3f64
test rdi, rdi
je 0x1402dde99
test r12, r12
cmove r13, qword [rsp + 0x38]
mov eax, 1
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x1402ddfc3
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 8]
mov edx, pe_nt_image_headers64
xor r8d, r8d
xor r9d, r9d
mov rdi, qword [rsp + 0x28]
call sub.imm32.dll_ImmGetCompositionStringW
test eax, eax
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x20]
js 0x1402ddfb0
je 0x1402ddfb4
mov ecx, eax
xor r13d, r13d
mov rdx, rdi
mov eax, 1
cmp rdx, r14
je 0x1402ddfbb
movzx r9d, byte [rdx]
test r9b, r9b
js 0x1402ddef6
inc rdx
jmp 0x1402ddf77
mov r8d, r9d
and r8d, 0x1f
movzx r11d, byte [rdx + 1]
and r11d, 0x3f
cmp r9b, 0xe0
jb 0x1402ddf50
movzx r10d, byte [rdx + 2]
shl r11d, 6
and r10d, 0x3f
or r10d, r11d
cmp r9b, 0xf0
jb 0x1402ddf60
movzx r9d, byte [rdx + 3]
and r8d, 7
shl r8d, 0x12
shl r10d, 6
and r9d, 0x3f
or r9d, r10d
or r9d, r8d
cmp r9d, 0x110000
je 0x1402ddff4
add rdx, 4
jmp 0x1402ddf6e
add rdx, 2
shl r8d, 6
or r8d, r11d
mov r9d, r8d
jmp 0x1402ddf6e
add rdx, 3
shl r8d, 0xc
or r10d, r8d
mov r9d, r10d
cmp r9d, 0x80
jae 0x1402ddf8e
mov r8d, 1
add r13, r8
mov rbp, r13
dec rcx
jne 0x1402ddedc
jmp 0x1402ddfc3
mov r8d, 2
cmp r9d, 0x800
jb 0x1402ddf7d
cmp r9d, 0x10000
mov r8d, 4
sbb r8, 0
jmp 0x1402ddf7d
xor eax, eax
jmp 0x1402ddfc3
xor r13d, r13d
xor ebp, ebp
jmp 0x1402ddfbe
mov rbp, r13
mov eax, 1
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], rdi
mov rcx, qword [rsp + 0x38]
mov qword [rsi + 0x20], rcx
mov qword [rsi], rax
mov qword [rsi + 8], rbp
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x30], r13
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, 1
mov rbp, r13
jmp 0x1402ddfc3