Function at 0x14002f440
Capabilities:
Get geographical location
Get keyboard layout
Log keystrokes via polling

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xa8
movaps xmmword [rsp + 0x90], xmm6
mov rax, qword [0x14005d010]
xor rax, rsp
mov qword [rbp - 1], rax
mov rbx, qword [0x140139b08]
mov r15, r9
mov qword [rbp - 0x59], r9
mov r14d, edx
mov qword [rbp - 0x11], r8
mov r13, rcx
test rbx, rbx
je case.0x14002fd27.527
mov rsi, qword [rbx + 0x98]
test rsi, rsi
je case.0x14002fd27.527
add rbx, 8
cmp edx, 0x200
ja 0x14002fcfd
je case.0x14002f52b.160
cmp edx, 7
ja 0x14002f504
je 0x14002f933
cmp edx, 2
jne case.0x14002fd27.527
cmp qword [rsi + 8], rcx
jne case.0x14002fd27.527
cmp dword [rsi + 0x10], 0
je case.0x14002fd27.527
mov qword [rbp - 0x29], rcx
xor edi, edi
lea rcx, [rbp - 0x31]
mov dword [rbp - 0x21], edi
mov dword [rbp - 0x31], 0x18
mov dword [rbp - 0x2d], 0x80000000
call qword [sym.imp.USER32.dll_TrackMouseEvent]
jmp 0x14002fd48
lea eax, [rdx - 8]
cmp eax, 0xfd
ja case.0x14002fd27.527
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x30040]
mov ecx, dword [rdx + rax*4 + 0x30024]
add rcx, rdx
jmp rcx
lea eax, [r14 - 0x100]
test eax, 0xfffffffb
sete dil
cmp r8, 0x100
jae case.0x14002fd27.527
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
adc eax, 0x1cdfb
cmp r14d, 7
mov rdx, qword [rbx + 0xd0]
sete r8b
lea r9, [rdx + 0x4018]
movsxd rax, dword [r9]
test eax, eax
jle 0x14002f96f
lea rcx, [rax - 1]
imul rax, rcx, 0x1c
add rax, qword [rdx + 0x4020]
nop dword [rax + rax]
cmp dword [rax], 6
je 0x14002f9cf
sub rax, 0x1c
sub rcx, 1
jns 0x14002f960
cmp byte [rdx + 0x2b70], 0
sete cl
cmp cl, r8b
je case.0x14002fd27.527
cmp byte [rbx + 0x7c], 0
je 0x14002f992
cmp r14d, 7
jne case.0x14002fd27.527
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x51], xmm0
mov qword [rbp - 0x41], rax
mov rcx, r9
mov dword [rbp - 0x39], eax
mov eax, dword [rdx + 0x403c]
mov dword [rbp - 0x49], eax
inc eax
mov dword [rdx + 0x403c], eax
lea rdx, [rbp - 0x51]
mov dword [rbp - 0x51], 6
mov byte [rbp - 0x45], r8b
call fcn.14001d4e0
jmp case.0x14002fd27.527
movzx ecx, byte [rax + 0xc]
jmp 0x14002f979
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rsi + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne case.0x14002fd27.527
xor edi, edi
mov dword [rsi + 0x2c], edi
jmp case.0x14002fd27.527
mov rcx, r13
call qword [sym.imp.USER32.dll_IsWindowUnicode]
test eax, eax
je 0x14002fb4c
mov rsi, qword [rbp - 0x11]
lea rax, [rsi - 1]
cmp rax, 0xfffe
ja case.0x14002fd27.527
test si, si
jne 0x14002fa42
cmp word [rbx + 0x2b6c], si
je case.0x14002fd27.527
cmp byte [rbx + 0x2b69], 0
je case.0x14002fd27.527
mov ecx, 0xfc00
movzx eax, si
and ax, cx
mov edx, 0xd800
movzx ecx, word [rbx + 0x2b6c]
cmp ax, dx
jne 0x14002fac6
test cx, cx
je 0x14002faba
mov rcx, qword [rbx + 0xd0]
lea rdx, [rbp - 0x51]
xor edi, edi
mov dword [rbp - 0x51], 5
mov r12d, 2
mov qword [rbp - 0x41], rdi
mov dword [rbp - 0x39], edi
mov eax, dword [rcx + 0x403c]
mov dword [rbp - 0x49], eax
inc eax
mov dword [rcx + 0x403c], eax
mov eax, 0xfffd
add rcx, 0x4018
mov dword [rbp - 0x45], eax
mov dword [rbp - 0x4d], r12d
call fcn.14001d4e0
mov word [rbx + 0x2b6c], si
jmp case.0x14002fd27.527
xor edi, edi
lea r12d, [rdi + 2]
test cx, cx
je 0x14002fb2b
mov ecx, 0xdc00
cmp ax, cx
je 0x14002fb1f
mov rcx, qword [rbx + 0xd0]
lea rdx, [rbp - 0x51]
mov qword [rbp - 0x41], rdi
mov dword [rbp - 0x39], edi
mov dword [rbp - 0x51], 5
mov eax, dword [rcx + 0x403c]
mov dword [rbp - 0x49], eax
inc eax
mov dword [rcx + 0x403c], eax
mov eax, 0xfffd
add rcx, 0x4018
mov dword [rbp - 0x45], eax
mov dword [rbp - 0x4d], r12d
call fcn.14001d4e0
jmp 0x14002fb24
mov esi, 0xfffd
mov word [rbx + 0x2b6c], di
mov rcx, qword [rbx + 0xd0]
movzx edx, si
test edx, edx
je case.0x14002fd27.527
cmp byte [rbx + 0x2b69], dil
je case.0x14002fd27.527
jmp 0x14002fb9a
mov ecx, dword [rsi + 0x2c]
lea rax, [rbp - 0x19]
mov edx, 1
lea r8, [rbp - 0x11]
mov dword [rsp + 0x28], edx
xor edi, edi
mov r9d, edx
mov qword [rsp + 0x20], rax
mov word [rbp - 0x19], di
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movzx edx, word [rbp - 0x19]
mov rcx, qword [rbx + 0xd0]
test edx, edx
je case.0x14002fd27.527
cmp byte [rbx + 0x2b69], dil
je case.0x14002fd27.527
mov r12d, 2
mov eax, dword [rcx + 0x403c]
mov dword [rbp - 0x49], eax
inc eax
mov dword [rcx + 0x403c], eax
add rcx, 0x4018
mov dword [rbp - 0x45], edx
lea rdx, [rbp - 0x51]
mov dword [rbp - 0x51], 5
mov dword [rbp - 0x39], edi
mov qword [rbp - 0x41], rdi
mov dword [rbp - 0x4d], r12d
call fcn.14001d4e0
jmp case.0x14002fd27.527
cmp r15w, 1
jne case.0x14002fd27.527
call fcn.14002e4d0
test al, al
je case.0x14002fd27.527
mov eax, 1
jmp 0x14002fffb
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
mov edx, 0xffffff80
xor edi, edi
mov r8, rax
and r8, rdx
mov edx, 0xff515700
lea r12d, [rdi + 2]
cmp r8, rdx
jne 0x14002fc1e
mov dword [rbp - 0x19], r12d
jmp 0x14002fc2e
mov ecx, edi
mov eax, 0xff515780
cmp r8, rax
sete cl
mov dword [rbp - 0x19], ecx
mov ecx, dword [rsi + 0x10]
cmp r14d, 0x200
mov r15d, edi
mov qword [rsi + 8], r13
setne r15b
inc r15d
cmp ecx, r15d
je 0x14002fc9e
cmp r14d, 0x200
mov dword [rbp - 0x31], 0x18
mov eax, 0x12
mov dword [rbp - 0x2d], 0x80000000
cmovne r12d, eax
mov qword [rbp - 0x29], r13
mov dword [rbp - 0x4d], r12d
mov dword [rbp - 0x21], edi
mov dword [rbp - 0x51], 0x18
mov qword [rbp - 0x49], r13
mov dword [rbp - 0x41], edi
test ecx, ecx
je 0x14002fc90
lea rcx, [rbp - 0x31]
call qword [sym.imp.USER32.dll_TrackMouseEvent]
lea rcx, [rbp - 0x51]
call qword [sym.imp.USER32.dll_TrackMouseEvent]
mov dword [rsi + 0x10], r15d
mov rcx, qword [rbp - 0x59]
movsx eax, cx
shr rcx, 0x10
mov dword [rbp - 9], eax
movsx eax, cx
mov dword [rbp - 5], eax
cmp r14d, 0xa0
jne 0x14002fcd0
lea rdx, [rbp - 9]
mov rcx, r13
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je case.0x14002fd27.527
mov rax, qword [rbx + 0xd0]
mov ecx, dword [rbp - 0x19]
mov dword [rax + 0x4038], ecx
mov rcx, rbx
movd xmm2, dword [rbp - 5]
movd xmm1, dword [rbp - 9]
cvtdq2ps xmm2, xmm2
cvtdq2ps xmm1, xmm1
call fcn.140001a90
jmp case.0x14002fd27.527
lea eax, [rdx - 0x201]
cmp eax, 0xa2
ja case.0x14002fd27.527
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x3015c]
mov ecx, dword [rdx + rax*4 + 0x30140]
add rcx, rdx
jmp rcx
xor edi, edi
cmp r14d, 0x2a3
mov eax, edi
setne al
inc eax
cmp dword [rsi + 0x10], eax
jne case.0x14002fd27.527
cmp qword [rsi + 8], r13
jne 0x14002fd4c
mov qword [rsi + 8], rdi
movss xmm1, dword [0x140053c64]
mov rcx, rbx
movaps xmm2, xmm1
mov dword [rsi + 0x10], edi
call fcn.140001a90
jmp case.0x14002fd27.527
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
mov edx, 0xffffff80
xor edi, edi
mov rcx, rax
and rcx, rdx
mov edx, 0xff515700
lea r12d, [rdi + 2]
cmp rcx, rdx
jne 0x14002fd8e
mov dword [rbp - 0x19], r12d
jmp 0x14002fda1
mov r8d, edi
mov eax, 0xff515780
cmp rcx, rax
sete r8b
mov dword [rbp - 0x19], r8d
lea eax, [r14 - 0x204]
mov r15d, edi
test eax, 0xfffffffd
mov edx, 1
lea eax, [r14 - 0x207]
cmove r15d, edx
test eax, 0xfffffffd
lea eax, [r14 - 0x20b]
cmove r15d, r12d
test eax, 0xfffffffd
jne 0x14002fded
mov rax, qword [rbp - 0x11]
mov r15d, edi
shr rax, 0x10
cmp ax, dx
setne r15b
add r15d, 3
cmp dword [rsi + 0x14], edi
jne 0x14002fe06
call qword [sym.imp.USER32.dll_GetCapture]
test rax, rax
jne 0x14002fe06
mov rcx, r13
call qword [sym.imp.USER32.dll_SetCapture]
mov eax, dword [rsi + 0x14]
mov r8b, 1
mov ecx, dword [rbp - 0x19]
bts eax, r15d
mov dword [rsi + 0x14], eax
mov edx, r15d
mov rax, qword [rbx + 0xd0]
mov dword [rax + 0x4038], ecx
mov rcx, rbx
call fcn.140001bd0
jmp case.0x14002fd27.527
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
mov edx, 0xffffff80
xor edi, edi
mov rcx, rax
and rcx, rdx
mov edx, 0xff515700
lea r12d, [rdi + 2]
cmp rcx, rdx
jne 0x14002fe5a
mov dword [rbp - 0x19], r12d
jmp 0x14002fe6a
mov edx, edi
mov eax, 0xff515780
cmp rcx, rax
sete dl
mov dword [rbp - 0x19], edx
cmp r14d, 0x205
mov r15d, edi
sete r15b
cmp r14d, 0x208
jne 0x14002fe86
mov r15d, r12d
jmp 0x14002fea6
cmp r14d, 0x20c
jne 0x14002fea6
mov rax, qword [rbp - 0x11]
mov r15d, edi
shr rax, 0x10
cmp ax, 1
setne r15b
add r15d, 3
mov eax, dword [rsi + 0x14]
btr eax, r15d
mov dword [rsi + 0x14], eax
test eax, eax
jne 0x14002fec5
call qword [sym.imp.USER32.dll_GetCapture]
cmp rax, r13
jne 0x14002fec5
call qword [sym.imp.USER32.dll_ReleaseCapture]
mov rax, qword [rbx + 0xd0]
mov ecx, dword [rbp - 0x19]
mov dword [rax + 0x4038], ecx
mov r8, qword [rbx + 0xd0]
cmp byte [rbx + 0x2b69], dil
je case.0x14002fd27.527
mov edx, 1
cmp byte [rbx + 0x51], dil
je 0x14002ff0c
test r15d, r15d
jne 0x14002ff0c
cmp byte [rbx + 0x2b26], dil
je 0x14002ff0c
mov r15d, edx
mov byte [rbx + 0x2b26], dil
movsxd rax, dword [r8 + 0x4018]
test eax, eax
jle 0x14002ff3a
lea rcx, [rax - 1]
imul rax, rcx, 0x1c
add rax, qword [r8 + 0x4020]
cmp dword [rax], 3
jne 0x14002ff31
cmp dword [rax + 0xc], r15d
je 0x14002ff9a
sub rax, 0x1c
sub rcx, rdx
jns 0x14002ff26
mov eax, r15d
movzx ecx, byte [rax + r8 + 0xe8]
test cl, cl
je case.0x14002fd27.527
mov eax, dword [r8 + 0x403c]
lea rcx, [r8 + 0x4018]
mov dword [rbp - 0x49], eax
inc eax
mov dword [r8 + 0x403c], eax
mov eax, dword [r8 + 0x4038]
mov dword [rbp - 0x4d], edx
lea rdx, [rbp - 0x51]
mov dword [rbp - 0x3d], eax
mov word [rbp - 0x40], di
mov byte [rbp - 0x3e], dil
mov dword [rbp - 0x39], edi
mov dword [rbp - 0x51], 3
mov dword [rbp - 0x45], r15d
mov byte [rbp - 0x41], dil
call fcn.14001d4e0
jmp case.0x14002fd27.527
movzx ecx, byte [rax + 0x10]
jmp 0x14002ff46
shr r8, 0x10
xorps xmm1, xmm1
movsx eax, r8w
mov rcx, rbx
movd xmm2, eax
cvtdq2ps xmm2, xmm2
divss xmm2, dword [0x140053c14]
call fcn.140001d80
jmp case.0x14002fd27.527
shr r8, 0x10
xorps xmm2, xmm2
movsx eax, r8w
mov rcx, rbx
movd xmm1, eax
cvtdq2ps xmm1, xmm1
xorps xmm1, xmmword [0x140054120]
divss xmm1, dword [0x140053c14]
call fcn.140001d80
jmp case.0x14002fd27.527
cmp r8d, 7
jne case.0x14002fd27.527
mov byte [rsi + 0x31], 1