Function at 0x180005af0
Capabilities:
Get geographical location
Log keystrokes via polling
Set uefi variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
xor edi, edi
xor r9d, r9d
xor r8d, r8d
mov word [rsp + 0x20], di
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMenu]
call qword [sym.imp.USER32.dll_InSendMessage]
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MoveWindow]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetAncestor]
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetUserObjectSecurity]
xor r9d, r9d
mov word [rsp + 0x20], di
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetGeoInfoW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProfileStringW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MoveWindow]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DialogBoxParamW]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStringTypeExW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CheckRadioButton]
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumberFormatW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeServerSessionId]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyNameTextW]
mov qword [rsp + 0x38], rdi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov qword [rsp + 0x28], rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowContextHelpId]
call qword [sym.imp.KERNEL32.dll_FlushProcessWriteBuffers]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DebugSetProcessKillOnExit]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommState]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadStackGuarantee]
mov eax, dword [rbx]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret