Function at 0x1400037b0
Capabilities:
Get geographical location
Get keyboard layout
Log keystrokes via polling

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xa8
movaps xmmword [rsp + 0x90], xmm6
mov rax, qword [0x140057010]
xor rax, rsp
mov qword [rbp - 1], rax
mov rbx, qword [0x140057908]
mov r15, r9
mov qword [rbp - 0x59], r9
mov r14d, edx
mov qword [rbp - 0x11], r8
mov r13, rcx
test rbx, rbx
je case.0x14000409a.527
mov rsi, qword [rbx + 0xa0]
test rsi, rsi
je case.0x14000409a.527
add rbx, 8
cmp edx, 0x200
ja 0x140004070
je case.0x14000389b.160
cmp edx, 7
ja 0x140003874
je 0x140003ca3
cmp edx, 2
jne case.0x14000409a.527
cmp qword [rsi + 8], rcx
jne case.0x14000409a.527
cmp dword [rsi + 0x10], 0
je case.0x14000409a.527
mov qword [rbp - 0x29], rcx
xor edi, edi
lea rcx, [rbp - 0x31]
mov dword [rbp - 0x21], edi
mov dword [rbp - 0x31], 0x18
mov dword [rbp - 0x2d], 0x80000000
call qword [sym.imp.USER32.dll_TrackMouseEvent]
jmp 0x1400040bb
lea eax, [rdx - 8]
cmp eax, 0xfd
ja case.0x14000409a.527
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x43bc]
mov ecx, dword [rdx + rax*4 + 0x43a0]
add rcx, rdx
jmp rcx
lea eax, [r14 - 0x100]
test eax, 0xfffffffb
sete dil
cmp r8, 0x100
jae case.0x14000409a.527
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
movss xmm6, dword [0x14004e74c]
shr eax, 0xf
and al, 1
cmp byte [rbx + 0x2b71], 0
je 0x1400038f8
test al, al
je 0x1400038e4
movaps xmm3, xmm6
jmp 0x1400038e7
xorps xmm3, xmm3
movzx r8d, al
mov edx, 0x1000
mov rcx, rbx
call fcn.140004d10
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
cmp byte [rbx + 0x2b71], 0
je 0x14000392e
test al, al
je 0x14000391a
movaps xmm3, xmm6
jmp 0x14000391d
xorps xmm3, xmm3
movzx r8d, al
mov edx, 0x2000
mov rcx, rbx
call fcn.140004d10
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
cmp byte [rbx + 0x2b71], 0
je 0x140003964
test al, al
je 0x140003950
movaps xmm3, xmm6
jmp 0x140003953
xorps xmm3, xmm3
movzx r8d, al
mov edx, 0x4000
mov rcx, rbx
call fcn.140004d10
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x14000398d
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x14000398d
xor r8b, r8b
jmp 0x140003990
mov r8b, 1
cmp byte [rbx + 0x2b71], 0
je 0x1400039b3
test r8b, r8b
je 0x1400039a3
movaps xmm3, xmm6
jmp 0x1400039a6
xorps xmm3, xmm3
mov edx, 0x8000
mov rcx, rbx
call fcn.140004d10
mov rbx, qword [rbp - 0x11]
mov rdx, r15
mov rcx, rbx
call fcn.1400031f0
movsxd rsi, eax
cmp esi, 0x262
jne 0x140003a13
test dil, dil
jne 0x140003a17
mov r14, qword [0x140057908]
cmp byte [r14 + 0x2b79], dil
je 0x1400039f3
movaps xmm3, xmm6
lea rcx, [r14 + 8]
mov r8b, 1
mov edx, esi
call fcn.140004d10
cmp ebx, 0x1ff
ja 0x140003a17
movsxd rax, ebx
mov dword [r14 + rax*4 + 0x2b90], 0x262
mov dword [r14 + 0x3518], ebx
jmp 0x140003a17
test eax, eax
je 0x140003a5f
mov r14, qword [0x140057908]
cmp byte [r14 + 0x2b79], 0
je 0x140003a44
test dil, dil
je 0x140003a32
movaps xmm3, xmm6
jmp 0x140003a35
xorps xmm3, xmm3
movzx r8d, dil
lea rcx, [r14 + 8]
mov edx, esi
call fcn.140004d10
cmp ebx, 0x1ff
ja 0x140003a5f
movsxd rax, ebx
mov dword [r14 + rax*4 + 0x2b90], esi
mov dword [r14 + rsi*4 + 0x2b90], ebx
cmp ebx, 0x10
jne 0x140003b1f
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
cmp al, dil
jne 0x140003ac0
mov rbx, qword [0x140057908]
cmp byte [rbx + 0x2b79], 0
je 0x140003aac
test dil, dil
je 0x140003a97
movaps xmm3, xmm6
jmp 0x140003a9a
xorps xmm3, xmm3
movzx r8d, dil
lea rcx, [rbx + 8]
mov edx, 0x210
call fcn.140004d10
mov dword [rbx + 0x2e10], 0x210
mov dword [rbx + 0x33d0], 0xa0
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
cmp al, dil
jne case.0x14000409a.527
mov rbx, qword [0x140057908]
cmp byte [rbx + 0x2b79], 0
je 0x140003b06
test dil, dil
jne 0x140003af1
xorps xmm6, xmm6
movaps xmm3, xmm6
lea rcx, [rbx + 8]
movzx r8d, dil
mov edx, 0x214
call fcn.140004d10
mov dword [rbx + 0x2e14], 0x214
mov dword [rbx + 0x33e0], 0xa1
jmp case.0x14000409a.527
cmp ebx, 0x11
jne 0x140003bdf
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
cmp al, dil
jne 0x140003b80
mov rbx, qword [0x140057908]
cmp byte [rbx + 0x2b79], 0
je 0x140003b6c
test dil, dil
je 0x140003b57
movaps xmm3, xmm6
jmp 0x140003b5a
xorps xmm3, xmm3
movzx r8d, dil
lea rcx, [rbx + 8]
mov edx, 0x20f
call fcn.140004d10
mov dword [rbx + 0x2e18], 0x20f
mov dword [rbx + 0x33cc], 0xa2
mov ecx, 0xa3
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
cmp al, dil
jne case.0x14000409a.527
mov rbx, qword [0x140057908]
cmp byte [rbx + 0x2b79], 0
je 0x140003bc6
test dil, dil
jne 0x140003bb1
xorps xmm6, xmm6
movaps xmm3, xmm6
lea rcx, [rbx + 8]
movzx r8d, dil
mov edx, 0x213
call fcn.140004d10
mov dword [rbx + 0x2e1c], 0x213
mov dword [rbx + 0x33dc], 0xa3
jmp case.0x14000409a.527
cmp ebx, 0x12
jne case.0x14000409a.527
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
cmp al, dil
jne 0x140003c40
mov rbx, qword [0x140057908]
cmp byte [rbx + 0x2b79], 0
je 0x140003c2c
test dil, dil
je 0x140003c17
movaps xmm3, xmm6
jmp 0x140003c1a
xorps xmm3, xmm3
movzx r8d, dil
lea rcx, [rbx + 8]
mov edx, 0x211
call fcn.140004d10
mov dword [rbx + 0x2e20], 0x211
mov dword [rbx + 0x33d4], 0xa4
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
cmp al, dil
jne case.0x14000409a.527
mov rbx, qword [0x140057908]
cmp byte [rbx + 0x2b79], 0
je 0x140003c86
test dil, dil
jne 0x140003c71
xorps xmm6, xmm6
movaps xmm3, xmm6
lea rcx, [rbx + 8]
movzx r8d, dil
mov edx, 0x215
call fcn.140004d10
mov dword [rbx + 0x2e24], 0x215
mov dword [rbx + 0x33e4], 0xa5
jmp case.0x14000409a.527
cmp r14d, 7
mov rdx, qword [rbx + 0xd8]
sete r8b
lea r9, [rdx + 0x4028]
movsxd rax, dword [r9]
test eax, eax
jle 0x140003cdf
lea rcx, [rax - 1]
imul rax, rcx, 0x1c
add rax, qword [rdx + 0x4030]
nop dword [rax + rax]
cmp dword [rax], 6
je 0x140003d42
sub rax, 0x1c
sub rcx, 1
jns 0x140003cd0
cmp byte [rdx + 0x2b78], 0
sete cl
cmp cl, r8b
je case.0x14000409a.527
cmp byte [rbx + 0x80], 0
je 0x140003d05
cmp r14d, 7
jne case.0x14000409a.527
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x51], xmm0
mov qword [rbp - 0x41], rax
mov rcx, r9
mov dword [rbp - 0x39], eax
mov eax, dword [rdx + 0x404c]
mov dword [rbp - 0x49], eax
inc eax
mov dword [rdx + 0x404c], eax
lea rdx, [rbp - 0x51]
mov dword [rbp - 0x51], 6
mov byte [rbp - 0x45], r8b
call fcn.140020200
jmp case.0x14000409a.527
movzx ecx, byte [rax + 0xc]
jmp 0x140003ce9
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rsi + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne case.0x14000409a.527
xor edi, edi
mov dword [rsi + 0x2c], edi
jmp case.0x14000409a.527
mov rcx, r13
call qword [sym.imp.USER32.dll_IsWindowUnicode]
test eax, eax
je 0x140003ebf
mov rsi, qword [rbp - 0x11]
lea rax, [rsi - 1]
cmp rax, 0xfffe
ja case.0x14000409a.527
test si, si
jne 0x140003db5
cmp word [rbx + 0x2b74], si
je case.0x14000409a.527
cmp byte [rbx + 0x2b71], 0
je case.0x14000409a.527
mov ecx, 0xfc00
movzx eax, si
and ax, cx
mov edx, 0xd800
movzx ecx, word [rbx + 0x2b74]
cmp ax, dx
jne 0x140003e39
test cx, cx
je 0x140003e2d
mov rcx, qword [rbx + 0xd8]
lea rdx, [rbp - 0x51]
xor edi, edi
mov dword [rbp - 0x51], 5
mov r12d, 2
mov qword [rbp - 0x41], rdi
mov dword [rbp - 0x39], edi
mov eax, dword [rcx + 0x404c]
mov dword [rbp - 0x49], eax
inc eax
mov dword [rcx + 0x404c], eax
mov eax, 0xfffd
add rcx, 0x4028
mov dword [rbp - 0x45], eax
mov dword [rbp - 0x4d], r12d
call fcn.140020200
mov word [rbx + 0x2b74], si
jmp case.0x14000409a.527
xor edi, edi
lea r12d, [rdi + 2]
test cx, cx
je 0x140003e9e
mov ecx, 0xdc00
cmp ax, cx
je 0x140003e92
mov rcx, qword [rbx + 0xd8]
lea rdx, [rbp - 0x51]
mov qword [rbp - 0x41], rdi
mov dword [rbp - 0x39], edi
mov dword [rbp - 0x51], 5
mov eax, dword [rcx + 0x404c]
mov dword [rbp - 0x49], eax
inc eax
mov dword [rcx + 0x404c], eax
mov eax, 0xfffd
add rcx, 0x4028
mov dword [rbp - 0x45], eax
mov dword [rbp - 0x4d], r12d
call fcn.140020200
jmp 0x140003e97
mov esi, 0xfffd
mov word [rbx + 0x2b74], di
mov rcx, qword [rbx + 0xd8]
movzx edx, si
test edx, edx
je case.0x14000409a.527
cmp byte [rbx + 0x2b71], dil
je case.0x14000409a.527
jmp 0x140003f0d
mov ecx, dword [rsi + 0x2c]
lea rax, [rbp - 0x19]
mov edx, 1
lea r8, [rbp - 0x11]
mov dword [rsp + 0x28], edx
xor edi, edi
mov r9d, edx
mov qword [rsp + 0x20], rax
mov word [rbp - 0x19], di
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movzx edx, word [rbp - 0x19]
mov rcx, qword [rbx + 0xd8]
test edx, edx
je case.0x14000409a.527
cmp byte [rbx + 0x2b71], dil
je case.0x14000409a.527
mov r12d, 2
mov eax, dword [rcx + 0x404c]
mov dword [rbp - 0x49], eax
inc eax
mov dword [rcx + 0x404c], eax
add rcx, 0x4028
mov dword [rbp - 0x45], edx
lea rdx, [rbp - 0x51]
mov dword [rbp - 0x51], 5
mov dword [rbp - 0x39], edi
mov qword [rbp - 0x41], rdi
mov dword [rbp - 0x4d], r12d
call fcn.140020200
jmp case.0x14000409a.527
cmp r15w, 1
jne case.0x14000409a.527
call fcn.140002840
test al, al
je case.0x14000409a.527
mov eax, 1
jmp 0x140004375
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
mov edx, 0xffffff80
xor edi, edi
mov r8, rax
and r8, rdx
mov edx, 0xff515700
lea r12d, [rdi + 2]
cmp r8, rdx
jne 0x140003f91
mov dword [rbp - 0x19], r12d
jmp 0x140003fa1
mov ecx, edi
mov eax, 0xff515780
cmp r8, rax
sete cl
mov dword [rbp - 0x19], ecx
mov ecx, dword [rsi + 0x10]
cmp r14d, 0x200
mov r15d, edi
mov qword [rsi + 8], r13
setne r15b
inc r15d
cmp ecx, r15d
je 0x140004011
cmp r14d, 0x200
mov dword [rbp - 0x31], 0x18
mov eax, 0x12
mov dword [rbp - 0x2d], 0x80000000
cmovne r12d, eax
mov qword [rbp - 0x29], r13
mov dword [rbp - 0x4d], r12d
mov dword [rbp - 0x21], edi
mov dword [rbp - 0x51], 0x18
mov qword [rbp - 0x49], r13
mov dword [rbp - 0x41], edi
test ecx, ecx
je 0x140004003
lea rcx, [rbp - 0x31]
call qword [sym.imp.USER32.dll_TrackMouseEvent]
lea rcx, [rbp - 0x51]
call qword [sym.imp.USER32.dll_TrackMouseEvent]
mov dword [rsi + 0x10], r15d
mov rcx, qword [rbp - 0x59]
movsx eax, cx
shr rcx, 0x10
mov dword [rbp - 9], eax
movsx eax, cx
mov dword [rbp - 5], eax
cmp r14d, 0xa0
jne 0x140004043
lea rdx, [rbp - 9]
mov rcx, r13
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je case.0x14000409a.527
mov rax, qword [rbx + 0xd8]
mov ecx, dword [rbp - 0x19]
mov dword [rax + 0x4048], ecx
mov rcx, rbx
movd xmm2, dword [rbp - 5]
movd xmm1, dword [rbp - 9]
cvtdq2ps xmm2, xmm2
cvtdq2ps xmm1, xmm1
call fcn.140004f20
jmp case.0x14000409a.527
lea eax, [rdx - 0x201]
cmp eax, 0xa2
ja case.0x14000409a.527
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x44d8]
mov ecx, dword [rdx + rax*4 + 0x44bc]
add rcx, rdx
jmp rcx
xor edi, edi
cmp r14d, 0x2a3
mov eax, edi
setne al
inc eax
cmp dword [rsi + 0x10], eax
jne case.0x14000409a.527
cmp qword [rsi + 8], r13
jne 0x1400040bf
mov qword [rsi + 8], rdi
movss xmm1, dword [0x14004e814]
mov rcx, rbx
movaps xmm2, xmm1
mov dword [rsi + 0x10], edi
call fcn.140004f20
jmp case.0x14000409a.527
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
mov edx, 0xffffff80
xor edi, edi
mov rcx, rax
and rcx, rdx
mov edx, 0xff515700
lea r12d, [rdi + 2]
cmp rcx, rdx
jne 0x140004101
mov dword [rbp - 0x19], r12d
jmp 0x140004114
mov r8d, edi
mov eax, 0xff515780
cmp rcx, rax
sete r8b
mov dword [rbp - 0x19], r8d
lea eax, [r14 - 0x204]
mov r15d, edi
test eax, 0xfffffffd
mov edx, 1
lea eax, [r14 - 0x207]
cmove r15d, edx
test eax, 0xfffffffd
lea eax, [r14 - 0x20b]
cmove r15d, r12d
test eax, 0xfffffffd
jne 0x140004160
mov rax, qword [rbp - 0x11]
mov r15d, edi
shr rax, 0x10
cmp ax, dx
setne r15b
add r15d, 3
cmp dword [rsi + 0x14], edi
jne 0x140004179
call qword [sym.imp.USER32.dll_GetCapture]
test rax, rax
jne 0x140004179
mov rcx, r13
call qword [sym.imp.USER32.dll_SetCapture]
mov eax, dword [rsi + 0x14]
mov r8b, 1
mov ecx, dword [rbp - 0x19]
bts eax, r15d
mov dword [rsi + 0x14], eax
mov edx, r15d
mov rax, qword [rbx + 0xd8]
mov dword [rax + 0x4048], ecx
mov rcx, rbx
call fcn.140005060
jmp case.0x14000409a.527
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
mov edx, 0xffffff80
xor edi, edi
mov rcx, rax
and rcx, rdx
mov edx, 0xff515700
lea r12d, [rdi + 2]
cmp rcx, rdx
jne 0x1400041cd
mov dword [rbp - 0x19], r12d
jmp 0x1400041dd
mov edx, edi
mov eax, 0xff515780
cmp rcx, rax
sete dl
mov dword [rbp - 0x19], edx
cmp r14d, 0x205
mov r15d, edi
sete r15b
cmp r14d, 0x208
jne 0x1400041f9
mov r15d, r12d
jmp 0x140004219
cmp r14d, 0x20c
jne 0x140004219
mov rax, qword [rbp - 0x11]
mov r15d, edi
shr rax, 0x10
cmp ax, 1
setne r15b
add r15d, 3
mov eax, dword [rsi + 0x14]
btr eax, r15d
mov dword [rsi + 0x14], eax
test eax, eax
jne 0x140004238
call qword [sym.imp.USER32.dll_GetCapture]
cmp rax, r13
jne 0x140004238
call qword [sym.imp.USER32.dll_ReleaseCapture]
mov rax, qword [rbx + 0xd8]
mov ecx, dword [rbp - 0x19]
mov dword [rax + 0x4048], ecx
mov r8, qword [rbx + 0xd8]
cmp byte [rbx + 0x2b71], dil
je case.0x14000409a.527
mov edx, 1
cmp byte [rbx + 0x58], dil
je 0x14000427f
test r15d, r15d
jne 0x14000427f
cmp byte [rbx + 0x2b2e], dil
je 0x14000427f
mov r15d, edx
mov byte [rbx + 0x2b2e], dil
movsxd rax, dword [r8 + 0x4028]
test eax, eax
jle 0x1400042b4
lea rcx, [rax - 1]
imul rax, rcx, 0x1c
add rax, qword [r8 + 0x4030]
nop dword [rax]
cmp dword [rax], 3
jne 0x1400042ab
cmp dword [rax + 0xc], r15d
je 0x140004314
sub rax, 0x1c
sub rcx, rdx
jns 0x1400042a0
mov eax, r15d
movzx ecx, byte [rax + r8 + 0xf0]
test cl, cl
je case.0x14000409a.527
mov eax, dword [r8 + 0x404c]
lea rcx, [r8 + 0x4028]
mov dword [rbp - 0x49], eax
inc eax
mov dword [r8 + 0x404c], eax
mov eax, dword [r8 + 0x4048]
mov dword [rbp - 0x4d], edx
lea rdx, [rbp - 0x51]
mov dword [rbp - 0x3d], eax
mov word [rbp - 0x40], di
mov byte [rbp - 0x3e], dil
mov dword [rbp - 0x39], edi
mov dword [rbp - 0x51], 3
mov dword [rbp - 0x45], r15d
mov byte [rbp - 0x41], dil
call fcn.140020200
jmp case.0x14000409a.527
movzx ecx, byte [rax + 0x10]
jmp 0x1400042c0
shr r8, 0x10
xorps xmm1, xmm1
movsx eax, r8w
mov rcx, rbx
movd xmm2, eax
cvtdq2ps xmm2, xmm2
divss xmm2, dword [0x14004e7bc]
call fcn.140005210
jmp case.0x14000409a.527
shr r8, 0x10
xorps xmm2, xmm2
movsx eax, r8w
mov rcx, rbx
movd xmm1, eax
cvtdq2ps xmm1, xmm1
xorps xmm1, xmmword [0x14004eb50]
divss xmm1, dword [0x14004e7bc]
call fcn.140005210
jmp case.0x14000409a.527
cmp r8d, 7
jne case.0x14000409a.527
mov byte [rsi + 0x31], 1
xor eax, eax
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.140044c50
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret