Function at 0x48aa80
Capabilities:
Get geographical location
Get keyboard layout
Log keystrokes via input method manager
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x52dac1
mov eax, dword fs:[0]
push eax
sub esp, 0x778
mov eax, dword [0x53a090]
xor eax, esp
mov dword [esp + 0x770], eax
push ebx
push esi
push edi
mov eax, dword [0x53a090]
xor eax, esp
push eax
lea eax, [esp + 0x788]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x20], ebx
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov edi, dword [sym.imp.IMM32.dll_ImmGetContext]
mov ecx, 0x412
cmp ax, cx
sete al
mov byte [esp + 0x1b], al
test al, al
mov eax, dword [ebp + 0xc]
je 0x48b087
test al, 8
je 0x48b087
push dword [ebx + 8]
call edi
test eax, eax
je 0x48b084
push 0x18e
lea ecx, [esp + 0x2d0]
push ecx
push 8
push eax
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
mov ecx, dword [ebx + 0xba4]
sub ecx, dword [ebx + 0xba0]
lea esi, [ebx + 0xba0]
sar ecx, 4
dec ecx
mov dword [esp + 0x1c], eax
cdq
shl ecx, 4
add ecx, dword [esi]
sub eax, edx
sar eax, 1
mov edi, dword [ecx]
lea edx, [ecx + 8]
mov dword [esp + 0x2c], eax
mov eax, dword [edx]
cmp eax, edi
jne 0x48ab52
mov eax, dword [edx + 4]
cmp eax, dword [ecx + 4]
setl al
test al, al
jne 0x48ab5b
mov ecx, edx
cmp dword [esp + 0x1c], 0
mov eax, dword [ecx]
mov dword [esp + 0x14], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x48], eax
je 0x48af04
mov dl, byte [0x569504]
test dl, dl
jne 0x48aea0
mov ecx, ebx
call fcn.004ab480
mov eax, dword [esi + 4]
sub eax, dword [esi]
sar eax, 4
cmp eax, 1
ja 0x48abad
mov ecx, esi
call fcn.004c5460
test al, al
je 0x48abad
cmp byte [ebx + 0x80a], 0
jne 0x48abad
xor al, al
jmp 0x48abaf
mov al, 1
mov ecx, dword [ebx + 0xc30]
mov byte [esp + 0x1c], al
mov dword [esp + 0x24], ecx
mov dword [esp + 0x44], ecx
mov byte [esp + 0x48], al
test al, al
je 0x48abd1
add ecx, 0x4c
call fcn.004c6850
mov dword [esp + 0x790], 0
xor ecx, ecx
xor edi, edi
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], ecx
mov byte [esp + 0x790], 1
mov eax, dword [esi + 4]
sub eax, dword [esi]
sar eax, 4
test eax, eax
je 0x48ac34
xor ebx, ebx
mov eax, dword [esi]
add eax, edi
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x3c]
call fcn.00485190
mov eax, dword [esi + 4]
sub eax, dword [esi]
inc ebx
sar eax, 4
add edi, 0x10
cmp ebx, eax
jb 0x48ac02
mov edi, dword [esp + 0x3c]
mov ebx, dword [esp + 0x20]
mov ecx, dword [esp + 0x38]
cmp edi, ecx
je 0x48ae52
lea esp, [esp]
mov esi, dword [edi - 4]
add edi, 0xfffffffc
mov edx, dword [esi + 8]
mov eax, dword [esi]
lea ecx, [esi + 8]
cmp edx, eax
jne 0x48ac58
mov eax, dword [ecx + 4]
cmp eax, dword [esi + 4]
setl al
test al, al
mov eax, esi
jne 0x48ac63
mov eax, ecx
mov ebx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x6c], eax
mov eax, dword [esi]
mov dword [esp + 0x28], ebx
cmp edx, eax
jne 0x48ac7c
mov eax, dword [ecx + 4]
cmp eax, dword [esi + 4]
setl al
test al, al
jne 0x48ac85
mov ecx, esi
push dword [esp + 0x28]
mov eax, dword [ecx + 4]
push dword [ecx]
mov ebx, dword [esp + 0x28]
mov ecx, ebx
mov dword [esp + 0x74], eax
call fcn.004a0b30
test al, al
jne 0x48ae46
mov ecx, dword [esi + 8]
mov edx, dword [esi]
lea eax, [esi + 8]
cmp ecx, edx
jne 0x48acba
mov eax, dword [eax + 4]
cmp eax, dword [esi + 4]
lea eax, [esi + 8]
setl byte [esp + 0x14]
cmp byte [esp + 0x14], 0
jne 0x48acc8
mov eax, esi
mov ebx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x6c], eax
cmp ecx, edx
jne 0x48ad4a
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 4]
jne 0x48ad40
cmp byte [ebx + 0x80a], 0
je 0x48adb8
mov eax, dword [ebx + 0xc30]
add eax, 4
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [esp + 0x14]
cmp ecx, eax
jge 0x48adb8
push ecx
mov ecx, dword [ebx + 0xc30]
call fcn.004be8b0
test al, al
jne 0x48adb8
push dword [esp + 0x14]
mov ecx, dword [ebx + 0xc30]
call fcn.004c05e0
mov dword [esi + 0xc], 0
mov dword [esi + 4], 0
jmp 0x48adb8
cmp ecx, edx
jne 0x48ad4a
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 4]
setg al
test al, al
je 0x48ad57
mov eax, ecx
sub eax, edx
jmp 0x48ad5b
mov eax, edx
sub eax, ecx
test eax, eax
je 0x48ad9e
cmp ecx, edx
jne 0x48ad69
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 4]
setg al
test al, al
je 0x48ad74
sub ecx, edx
jmp 0x48ad7a
mov eax, ecx
mov ecx, edx
sub ecx, eax
test ecx, ecx
jle 0x48ad8e
push ecx
push dword [esp + 0x18]
mov ecx, dword [ebx + 0xc30]
call fcn.004bfbf0
mov dword [esi + 0xc], 0
mov dword [esi + 4], 0
jmp 0x48adb8
cmp edx, ecx
jne 0x48adb8
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jle 0x48adae
mov eax, ecx
test eax, eax
js 0x48adb8
mov dword [esi + 4], eax
mov dword [esi + 0xc], eax
push dword [esi + 4]
mov ecx, ebx
push dword [esp + 0x18]
call fcn.004ab3b0
mov dword [esi + 0xc], 0
mov dword [esi + 4], 0
cmp dword [ebx + 0x7c0], 0
mov dword [esp + 0x14], eax
je 0x48ae46
push ecx
push ebx
lea ecx, [esp + 0x38]
call fcn.00489d90
mov byte [esp + 0x790], 2
mov esi, dword [esp + 0x30]
test esi, esi
je 0x48ae32
mov eax, dword [ebx + 0xc30]
push dword [esp + 0x14]
mov ecx, dword [eax + 4]
add eax, 4
push eax
call dword [ecx + 0x14]
push eax
push esi
mov ecx, ebx
call fcn.004a2a50
test al, al
je 0x48ae32
mov ecx, ebx
call fcn.004ab1b0
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x38]
mov ecx, ebx
call fcn.0049fdc0
mov byte [esp + 0x790], 1
test esi, esi
je 0x48ae46
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
mov ecx, dword [esp + 0x38]
cmp edi, ecx
jne 0x48ac40
test ecx, ecx
je 0x48ae5f
push ecx
call fcn.00510ee0
add esp, 4
mov dword [esp + 0x790], 0xffffffff
cmp byte [esp + 0x1c], 0
je 0x48ae7d
mov ecx, dword [esp + 0x24]
add ecx, 0x4c
call fcn.004c68c0
cmp dword [ebx + 0x7c0], 0
je 0x48ae8d
mov ecx, ebx
call fcn.004ab1b0
mov al, byte [ebx + 0x80a]
mov dl, byte [0x569504]
mov byte [0x5695a4], al
jmp 0x48aea5
mov al, byte [0x5695a4]
cmp dword [0x563f48], 0
jge 0x48aec7
test al, al
jne 0x48aec7
mov eax, dword [ebx + 0x77c]
mov dword [0x563f48], eax
mov dword [ebx + 0x77c], 2
cmp dword [0x563fa0], 0
jge 0x48aeee
mov ecx, dword [ebx + 0xc30]
xor eax, eax
cmp byte [ecx + 0x48], al
mov byte [ecx + 0x48], 0
setne al
mov dword [ecx + 0x5c], 0
mov dword [0x563fa0], eax
test dl, dl
jne 0x48aefb
mov byte [0x569504], 1
jmp 0x48af5d
mov ecx, ebx
call fcn.004acd00
jmp 0x48af5d
mov eax, dword [0x563f48]
test eax, eax
js 0x48af1d
mov dword [ebx + 0x77c], eax
mov dword [0x563f48], 0xffffffff
cmp byte [0x569504], 0
je 0x48af34
mov ecx, ebx
mov byte [0x569504], 0
call fcn.004acd00
mov eax, dword [0x563fa0]
test eax, eax
js 0x48af5d
mov ecx, dword [ebx + 0xc30]
cmp eax, 1
sete al
mov byte [ecx + 0x48], al
mov dword [ecx + 0x5c], 0
mov dword [0x563fa0], 0xffffffff
push 0
push dword [esp + 0x18]
mov ecx, ebx
push 1
push 0
call fcn.004a0df0
mov eax, dword [ebx + 0xc30]
mov byte [ebx + 0x80a], 0
test eax, eax
je 0x48afdf
cmp dword [eax + 0x1c8], 0xfde9
jne 0x48afdf
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x2cc]
call fcn.00493090
mov edx, dword [esp + 0x2c]
mov esi, eax
lea eax, [esp + 0x74]
push esi
push eax
lea ecx, [esp + 0x2d4]
call fcn.004930f0
add esp, 8
cmp esi, 0x258
jae 0x48afda
mov eax, dword [ebx]
push 0
push esi
lea ecx, [esp + 0x7c]
push ecx
mov ecx, ebx
mov byte [esp + esi + 0x80], 0
call dword [eax + 0x48]
jmp 0x48b062
call fcn.0050f29e
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 0xa
lea ecx, [esp + 0x6c]
push ecx
movzx eax, ax
push 0x1004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x48b00e
lea eax, [esp + 0x68]
push eax
call fcn.0051119e
add esp, 4
mov edi, dword [esp + 0x2c]
push 0
push 0
push 0x18f
lea ecx, [esp + 0x80]
push ecx
push edi
lea ecx, [esp + 0x2e0]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
xor esi, esi
test edi, edi
jle 0x48b062
lea ecx, [ecx]
mov cl, byte [esp + esi + 0x74]
mov eax, dword [ebx]
push 0
mov byte [esp + 0x20], cl
push 1
lea ecx, [esp + 0x24]
push ecx
mov ecx, ebx
mov byte [esp + 0x29], 0
call dword [eax + 0x48]
inc esi
cmp esi, edi
jl 0x48b040
mov al, byte [0x5695a4]
push 0
push dword [esp + 0x18]
mov ecx, ebx
push 1
push 0
mov byte [ebx + 0x80a], al
call fcn.004a0df0
mov edi, dword [sym.imp.IMM32.dll_ImmGetContext]
mov eax, dword [ebp + 0xc]
test eax, 0x800
je 0x48b2fc
cmp byte [0x569504], 0
je 0x48b0a9
mov ecx, ebx
mov byte [0x569504], 0
call fcn.004acd00
mov eax, dword [0x563f48]
test eax, eax
js 0x48b0c2
mov dword [ebx + 0x77c], eax
mov dword [0x563f48], 0xffffffff
mov eax, dword [0x563fa0]
test eax, eax
js 0x48b0eb
mov ecx, dword [ebx + 0xc30]
cmp eax, 1
sete al
mov byte [ecx + 0x48], al
mov dword [ecx + 0x5c], 0
mov dword [0x563fa0], 0xffffffff
cmp byte [esp + 0x1b], 0
je 0x48b177
cmp byte [0x5695a4], 0
je 0x48b170
push dword [ebx + 8]
call edi
mov esi, eax
test esi, esi
je 0x48b170
push 0x18e
lea eax, [esp + 0x78]
push eax
push 0x800
push esi
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
push 0
cdq
push 0
push 0x18f
sub eax, edx
lea ecx, [esp + 0x2d8]
push ecx
sar eax, 1
push eax
lea eax, [esp + 0x88]
push eax
push 0
call fcn.0048a490
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, 3
mov eax, dword [esp + 0x20]
push esi
push dword [eax + 8]
sete bl
call dword [sym.imp.IMM32.dll_ImmReleaseContext]
test bl, bl
mov ebx, dword [esp + 0x20]
je 0x48b170
mov ecx, ebx
call fcn.004acd00
mov byte [ebx + 0x80a], 0
push dword [ebx + 8]
call edi
mov dword [esp + 0x24], eax
test eax, eax
je 0x48b2e6
push 0x18e
lea ecx, [esp + 0x460]
push ecx
push 0x800
push eax
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
cdq
sub eax, edx
mov edi, eax
mov eax, dword [ebx + 0xc30]
sar edi, 1
test eax, eax
je 0x48b20a
cmp dword [eax + 0x1c8], 0xfde9
jne 0x48b20a
mov edx, edi
lea ecx, [esp + 0x45c]
call fcn.00493090
mov esi, eax
lea eax, [esp + 0x74]
push esi
push eax
mov edx, edi
lea ecx, [esp + 0x464]
call fcn.004930f0
add esp, 8
cmp esi, 0x258
jae 0x48afda
mov eax, dword [ebx]
push 0
push esi
lea ecx, [esp + 0x7c]
push ecx
mov ecx, ebx
mov byte [esp + esi + 0x80], 0
call dword [eax + 0x48]
jmp 0x48b289
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 0xa
lea ecx, [esp + 0x6c]
push ecx
movzx eax, ax
push 0x1004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x48b239
lea eax, [esp + 0x68]
push eax
call fcn.0051119e
add esp, 4
push 0
push 0
push 0x18f
lea ecx, [esp + 0x5f8]
push ecx
push edi
lea ecx, [esp + 0x470]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
xor esi, esi
test edi, edi
jle 0x48b289
mov cl, byte [esp + esi + 0x5ec]
mov eax, dword [ebx]
push 0
mov byte [esp + 0x18], cl
push 1
lea ecx, [esp + 0x1c]
push ecx
mov ecx, ebx
mov byte [esp + 0x21], 0
call dword [eax + 0x48]
inc esi
cmp esi, edi
jl 0x48b264
mov ecx, dword [ebx + 0xbc8]
mov eax, dword [ebx + 0xba0]
add ecx, ecx
push dword [eax + ecx*8 + 4]
push dword [eax + ecx*8]
lea eax, [esp + 0x38]
push eax
mov ecx, ebx
call fcn.0049eb10
fld dword [esp + 0x30]
mov dword [esp + 0x4c], 2
call fcn.0052af70
fld dword [esp + 0x34]
mov dword [esp + 0x50], eax
call fcn.0052af70
mov esi, dword [esp + 0x24]
mov dword [esp + 0x54], eax
lea eax, [esp + 0x4c]
push eax
push esi
call dword [sym.imp.IMM32.dll_ImmSetCompositionWindow]
push esi
push dword [ebx + 8]
call dword [sym.imp.IMM32.dll_ImmReleaseContext]
cmp byte [esp + 0x1b], 0
je 0x48b2f8
mov al, byte [0x5695a4]
mov byte [ebx + 0x80a], al
xor eax, eax
jmp 0x48b30e
push eax
push dword [ebp + 8]
push 0x10f
push dword [ebx + 8]
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [esp + 0x788]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x770]
xor ecx, esp
call fcn.0050ecf7
mov esp, ebp
pop ebp
ret 8