Function at 0x10015c59
Capabilities:
Get geographical location
Log keystrokes via polling
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push 3
mov esi, edx
xor ebx, ebx
pop edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], 0xe08cccdd
mov dword [ebp - 4], ebx
jmp 0x10015c85
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x28], 0x52cb1363
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x10015c77
mov dword [ebp - 4], ebx
jmp 0x10015c9d
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x34], 0xc4530722
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x10015c8f
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
dec dword [ebp - 8]
cmp byte [ebp + 8], bl
je 0x10015e38
push edi
mov dword [ebp - 8], 0x622ba394
push 1
mov dword [ebp - 4], 0x8e92eda8
mov dword [ebp + 8], ebx
pop edi
jmp 0x10015cd5
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x1c], edi
inc dword [ebp + 8]
cmp dword [ebp + 8], 2
jl 0x10015ccb
mov dword [ebp - 8], edi
cmp dword [ebp - 8], ebx
jl 0x10015da6
mov dword [ebp + 8], 6
mov dword [ebp + 8], ebx
jmp 0x10015cfd
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x14], edi
inc dword [ebp + 8]
cmp dword [ebp + 8], 2
jl 0x10015cf3
mov dword [ebp - 0x10], ebx
jmp 0x10015d72
mov dword [ebp + 8], 0xd49f
mov ecx, ebx
mov dword [ebp + 8], 0x1509cf13
cmp dword [ebp + 8], ebx
je 0x10015d1f
mov ecx, edi
mov eax, dword [ebp - 8]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x1c]
inc eax
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setle dl
cmp dword [ebp + 8], 0xfffa
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edx
setg cl
mov dword [ebp - 4], ecx
mov dword [ebp + 8], ebx
jmp 0x10015d6a
mov dword [ebp - 4], ebx
jmp 0x10015d61
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1c], 0xfffffffc
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x10015d53
inc dword [ebp + 8]
cmp dword [ebp + 8], edi
jle 0x10015d4e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jle 0x10015d08
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], bl
je 0x10015d9d
push 0x37d
push 0x1e49
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
dec dword [ebp - 8]
jns 0x10015ce7
mov dword [ebp + 8], 0xffffffff
mov dword [ebp - 0xc], 0x3bc6e5c7
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], bl
je 0x10015dc9
push 0xcab
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp + 8], 0xfffffff9
cmp dword [ebp + 8], 0xffffffff
jle 0x10015deb
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
inc dword [ebp + 8]
cmp dword [ebp + 8], eax
jg 0x10015dd6
mov dword [ebp - 8], edi
mov dword [ebp - 8], 0xffffffed
pop edi
jmp 0x10015e16
cmp byte [ebp + 0xb], bl
je 0x10015e04
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], bl
je 0x10015e13
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x17
mov byte [ebp + 0xb], bl
jne 0x10015df8
cmp byte [ebp + 0xb], bl
je 0x10015e32
push 0x1682
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov eax, dword [esi]
mov dword [eax], ebx
jmp 0x10015e84
cmp byte [ecx], bl
je 0x10015e84
push 0x2465
push 0xd36
push ebx
push ebx
push 0xe21
push 0xefc
push 0x21c8
push 0x1bb7
push 0x617
push 0x169a
push 0x442
push 0x17e2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchDIBits]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret