Function at 0x140081f60
Capabilities:
Get geographical location
Get keyboard layout
Log keystrokes via polling

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r14, r9
mov rdi, r8
mov r12d, edx
mov r13, rcx
mov rax, qword [0x1401129a8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], r8
call fcn.140032130
test rax, rax
je 0x140082c14
call fcn.14003c1b0
mov rbp, qword [rax + 0x90]
test rbp, rbp
je 0x140082c14
xor ebx, ebx
call fcn.14003c1b0
mov r15, rax
cmp r12d, 0x1ff
jle 0x1400820a4
lea eax, [r12 - 0x200]
cmp eax, 0xa3
ja case.0x140081feb.527
lea rcx, [0x140082c38]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
and eax, 0xffffff80
mov ecx, 0xff515700
lea rdx, [rcx + 0x80]
xor ebx, ebx
cmp rax, rdx
sete bl
cmp rax, rcx
mov eax, 2
cmove ebx, eax
mov ecx, r12d
and ecx, 0xfffffffd
xor esi, esi
cmp ecx, 0x204
sete sil
lea ecx, [r12 - 0x207]
test ecx, 0xfffffffd
cmove esi, eax
cmp r12d, 0x20d
je 0x14008204a
cmp r12d, 0x20b
jne 0x140082062
and edi, 0xffff0000
xor eax, eax
cmp edi, 0x10000
sete al
mov esi, 4
sub esi, eax
cmp dword [rbp + 0x14], 0
jne 0x14008207c
call qword [sym.imp.USER32.dll_GetCapture]
test rax, rax
jne 0x14008207c
mov rcx, r13
call qword [sym.imp.USER32.dll_SetCapture]
mov eax, 1
mov ecx, esi
shl eax, cl
or dword [rbp + 0x14], eax
mov rcx, r15
mov edx, ebx
call fcn.1400303b0
mov rcx, r15
mov edx, esi
mov r8b, 1
call fcn.140030090
jmp 0x140082c14
cmp r12d, 0x7d
jg 0x1400820eb
lea eax, [r12 - 7]
cmp eax, 2
jb 0x14008227d
cmp r12d, 0x20
je 0x1400822da
cmp r12d, 0x51
jne case.0x140081feb.527
call fcn.140032130
test rax, rax
je 0x1400824af
call fcn.14003c1b0
mov rsi, qword [rax + 0x90]
jmp 0x1400824b1
lea eax, [r12 - 0x100]
cmp eax, 5
ja 0x140082376
mov ecx, 0x33
bt ecx, eax
jae 0x140082341
cmp rdi, 0xff
ja 0x140082c14
and r12d, 0xfffffffb
call fcn.14003c1b0
mov rbx, rax
mov rsi, qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, select
call rsi
movzx r8d, ax
shr r8d, 0xf
mov rcx, rbx
mov edx, 0x1000
call fcn.14002fea0
mov ecx, select
call rsi
movzx r8d, ax
shr r8d, 0xf
mov rcx, rbx
mov edx, 0x2000
call fcn.14002fea0
mov ecx, reloc.WS2_32.dll_select
call rsi
movzx r8d, ax
shr r8d, 0xf
mov rcx, rbx
mov edx, 0x4000
call fcn.14002fea0
mov ecx, 0x5d
call rsi
movzx r8d, ax
shr r8d, 0xf
mov rcx, rbx
mov edx, 0x8000
call fcn.14002fea0
test r14d, 0x1000000
mov esi, 0x10d
cmove esi, edi
cmp rdi, 0xd
cmovne esi, edi
lea eax, [rsi - 8]
cmp eax, 0x105
ja case.0x1400821d2.10
mov r15d, 0x200
lea rcx, [0x140082ec8]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov r15d, 0x20b
jmp case.0x1400821d2.9
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
and eax, 0xffffff80
mov ecx, 0xff515700
lea rdx, [rcx + 0x80]
xor esi, esi
cmp rax, rdx
sete sil
cmp rax, rcx
mov eax, 2
cmove esi, eax
xor ecx, ecx
cmp r12d, 0x205
sete cl
cmp r12d, 0x208
cmove ecx, eax
and edi, 0xffff0000
xor eax, eax
cmp edi, 0x10000
sete al
mov edi, 4
sub edi, eax
cmp r12d, 0x20c
cmovne edi, ecx
mov eax, 0xfffffffe
mov ecx, edi
rol eax, cl
and dword [rbp + 0x14], eax
jne 0x14008225f
call qword [sym.imp.USER32.dll_GetCapture]
cmp rax, r13
jne 0x14008225f
call qword [sym.imp.USER32.dll_ReleaseCapture]
mov rcx, r15
mov edx, esi
call fcn.1400303b0
xor ebx, ebx
mov rcx, r15
mov edx, edi
xor r8d, r8d
call fcn.140030090
jmp case.0x140081feb.527
cmp r12d, 7
sete dl
mov rcx, r15
call fcn.1400304a0
jmp 0x140082c14
xor eax, eax
cmp r12d, 0x2a3
sete al
mov ecx, 2
sub ecx, eax
cmp dword [rbp + 0x10], ecx
jne 0x140082c14
cmp qword [rbp + 8], r13
jne 0x1400822bb
mov qword [rbp + 8], 0
mov dword [rbp + 0x10], 0
movss xmm1, dword [0x1400da9f0]
mov rcx, r15
movaps xmm2, xmm1
call fcn.14002ff00
jmp 0x140082c14
cmp r14w, 1
jne 0x140082c14
mov ebx, 1
call fcn.140081ea0
test al, al
je 0x140082c14
jmp case.0x140081feb.527
sar edi, 0x10
cvtsi2ss xmm2, edi
divss xmm2, dword [0x1400db348]
xorps xmm1, xmm1
jmp 0x140082322
sar edi, 0x10
cvtsi2ss xmm1, edi
divss xmm1, dword [0x1400e33ac]
xorps xmm2, xmm2
mov rcx, r15
call fcn.140030310
jmp 0x140082c14
cmp edi, 7
jne 0x140082c14
mov byte [rbp + 0x32], 1
jmp 0x140082c14
cmp eax, 2
jne 0x140082376
mov rcx, r13
call qword [sym.imp.USER32.dll_IsWindowUnicode]
test eax, eax
je 0x1400824eb
lea rax, [rdi - 1]
cmp rax, 0xfffe
ja 0x140082c14
mov rcx, r15
mov edx, edi
call fcn.14002f750
jmp 0x140082c14
cmp r12d, 0x7e
je 0x1400824a6
cmp r12d, 0xa0
jne case.0x140081feb.527
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
and eax, 0xffffff80
mov ecx, 0xff515700
lea rdx, [rcx + 0x80]
xor edi, edi
cmp rax, rdx
sete dil
cmp rax, rcx
mov esi, 2
cmove edi, esi
xor eax, eax
cmp r12d, 0x200
sete al
sub esi, eax
mov qword [rbp + 8], r13
cmp dword [rbp + 0x10], esi
je 0x140082433
xor eax, eax
cmp r12d, 0x200
setne al
movabs rcx, 0x8000000000000018
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], r13
mov dword [rsp + 0x60], 0
mov dword [rsp + 0x38], 0x18
shl eax, 4
or eax, 2
mov dword [rsp + 0x3c], eax
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x48], 0
cmp dword [rbp + 0x10], 0
je 0x140082425
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_TrackMouseEvent]
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_TrackMouseEvent]
mov dword [rbp + 0x10], esi
movsx eax, r14w
mov dword [rsp + 0x50], eax
sar r14d, 0x10
mov dword [rsp + 0x54], r14d
mov esi, dword [r15]
and esi, 0x400
cmp r12d, 0x200
jne 0x140082468
test esi, esi
je 0x140082468
lea rdx, [rsp + 0x50]
mov rcx, r13
call qword [sym.imp.USER32.dll_ClientToScreen]
cmp r12d, 0xa0
jne 0x140082483
test esi, esi
jne 0x140082483
lea rdx, [rsp + 0x50]
mov rcx, r13
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rcx, r15
mov edx, edi
call fcn.1400303b0
cvtsi2ss xmm2, dword [rsp + 0x54]
cvtsi2ss xmm1, dword [rsp + 0x50]
mov rcx, r15
call fcn.14002ff00
jmp 0x140082c14
mov byte [rbp + 0x30], 1
jmp 0x140082c14
xor esi, esi
xor ebx, ebx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr eax, 0x10
add rsi, 0x2c
mov ecx, eax
mov edx, 0x20001004
mov r8, rsi
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne case.0x140081feb.527
mov dword [rsi], 0
jmp 0x140082c14
mov word [rsp + 0x50], 0
mov ecx, dword [rbp + 0x2c]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 1
lea r8, [rsp + 0x68]
mov edx, 1
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movzx edx, word [rsp + 0x50]
mov rcx, r15
call fcn.14002f4e0
jmp 0x140082c14
shr r14d, 0x10
movzx edi, r14b
jmp 0x140082a92
mov r15d, 0x20d
jmp case.0x1400821d2.9
mov r15d, 0x263
jmp case.0x1400821d2.9
mov r15d, 0x25f
jmp case.0x1400821d2.9
mov r15d, 0x20e
jmp case.0x1400821d2.9
mov r15d, 0x20c
jmp case.0x1400821d2.9
mov r15d, 0x205
jmp case.0x1400821d2.9
mov r15d, 0x206
jmp case.0x1400821d2.9
mov r15d, 0x208
jmp case.0x1400821d2.9
mov r15d, 0x207
jmp case.0x1400821d2.9
mov r15d, 0x201
jmp case.0x1400821d2.9
mov r15d, 0x203
jmp case.0x1400821d2.9
mov r15d, 0x202
jmp case.0x1400821d2.9
mov r15d, 0x204
jmp case.0x1400821d2.9
mov r15d, 0x209
jmp case.0x1400821d2.9
mov r15d, 0x218
jmp case.0x1400821d2.9
mov r15d, 0x219
jmp case.0x1400821d2.9
mov r15d, 0x21a
jmp case.0x1400821d2.9
mov r15d, 0x21b
jmp case.0x1400821d2.9
mov r15d, 0x21c
jmp case.0x1400821d2.9
mov r15d, 0x21d
jmp case.0x1400821d2.9
mov r15d, 0x21e
jmp case.0x1400821d2.9
mov r15d, 0x21f
jmp case.0x1400821d2.9
mov r15d, 0x220
jmp case.0x1400821d2.9
mov r15d, 0x221
jmp case.0x1400821d2.9
mov r15d, 0x222
jmp case.0x1400821d2.9
mov r15d, 0x223
jmp case.0x1400821d2.9
mov r15d, 0x224
jmp case.0x1400821d2.9
mov r15d, 0x225
jmp case.0x1400821d2.9
mov r15d, 0x226
jmp case.0x1400821d2.9
mov r15d, 0x227
jmp case.0x1400821d2.9
mov r15d, 0x228
jmp case.0x1400821d2.9
mov r15d, 0x22a
jmp case.0x1400821d2.9
mov r15d, 0x22b
jmp case.0x1400821d2.9
mov r15d, 0x22c
jmp case.0x1400821d2.9
mov r15d, 0x22d
jmp case.0x1400821d2.9
mov r15d, 0x22e
jmp case.0x1400821d2.9
mov r15d, 0x22f
jmp case.0x1400821d2.9
mov r15d, 0x231
jmp case.0x1400821d2.9
mov r15d, 0x232
jmp case.0x1400821d2.9
mov r15d, 0x233
jmp case.0x1400821d2.9
mov r15d, 0x234
jmp case.0x1400821d2.9
mov r15d, 0x236
jmp case.0x1400821d2.9
mov r15d, 0x237
jmp case.0x1400821d2.9
mov r15d, 0x238
jmp case.0x1400821d2.9
mov r15d, 0x23b
jmp case.0x1400821d2.9
mov r15d, 0x212
jmp case.0x1400821d2.9
mov r15d, 0x217
jmp case.0x1400821d2.9
mov r15d, 0x266
jmp case.0x1400821d2.9
mov r15d, 0x26b
jmp case.0x1400821d2.9
mov r15d, 0x26d
jmp case.0x1400821d2.9
mov r15d, 0x271
jmp case.0x1400821d2.9
mov r15d, 0x23c
jmp case.0x1400821d2.9
mov r15d, 0x23d
jmp case.0x1400821d2.9
mov r15d, 0x23e
jmp case.0x1400821d2.9
mov r15d, 0x23f
jmp case.0x1400821d2.9
mov r15d, 0x241
jmp case.0x1400821d2.9
mov r15d, 0x242
jmp case.0x1400821d2.9
mov r15d, 0x243
jmp case.0x1400821d2.9
mov r15d, 0x244
jmp case.0x1400821d2.9
mov r15d, 0x245
jmp case.0x1400821d2.9
mov r15d, 0x246
jmp case.0x1400821d2.9
mov r15d, 0x247
jmp case.0x1400821d2.9
mov r15d, 0x248
jmp case.0x1400821d2.9
mov r15d, 0x249
jmp case.0x1400821d2.9
mov r15d, 0x24b
jmp case.0x1400821d2.9
mov r15d, 0x24c
jmp case.0x1400821d2.9
mov r15d, 0x24d
jmp case.0x1400821d2.9
mov r15d, 0x24e
jmp case.0x1400821d2.9
mov r15d, 0x250
jmp case.0x1400821d2.9
mov r15d, 0x251
jmp case.0x1400821d2.9
mov r15d, 0x252
jmp case.0x1400821d2.9
mov r15d, 0x253
jmp case.0x1400821d2.9
mov r15d, 0x214
jmp case.0x1400821d2.9
mov r15d, 0x213
jmp case.0x1400821d2.9
mov r15d, 0x215
jmp case.0x1400821d2.9
mov r15d, 0x276
jmp case.0x1400821d2.9
mov r15d, 0x259
jmp case.0x1400821d2.9
mov r15d, 0x25a
jmp case.0x1400821d2.9
mov r15d, 0x255
jmp case.0x1400821d2.9
mov r15d, 0x257
jmp case.0x1400821d2.9
mov r15d, 0x258
jmp case.0x1400821d2.9
mov r15d, 0x25e
jmp case.0x1400821d2.9
mov r15d, 0x25b
jmp case.0x1400821d2.9
mov r15d, 0x25c
jmp case.0x1400821d2.9
mov r15d, 0x25d
jmp case.0x1400821d2.9
mov r15d, 0x254
jmp case.0x1400821d2.9
mov r15d, 0x273
jmp case.0x1400821d2.9
shr r14d, 0x10
movzx edi, r14b
mov r15d, 0x262
cmp r12d, 0x100
je 0x140082a59
call fcn.14003c1b0
mov rbx, rax
mov rcx, rax
mov edx, 0x262
mov r8b, 1
call fcn.14002fea0
mov dword [rsp + 0x20], 0xffffffff
mov rcx, rbx
mov edx, 0x262
mov r8d, esi
mov r9d, edi
call fcn.14002fed0
mov r15d, 0x262
jmp 0x140082a59
mov r15d, 0x20a
jmp case.0x1400821d2.9
mov r15d, 0x229
jmp case.0x1400821d2.9
mov r15d, 0x230
jmp case.0x1400821d2.9
mov r15d, 0x235
jmp case.0x1400821d2.9
mov r15d, 0x239
jmp case.0x1400821d2.9
mov r15d, 0x23a
jmp case.0x1400821d2.9
mov r15d, 0x216
jmp case.0x1400821d2.9
mov r15d, 0x264
jmp case.0x1400821d2.9
mov r15d, 0x265
jmp case.0x1400821d2.9
mov r15d, 0x267
jmp case.0x1400821d2.9
mov r15d, 0x268
jmp case.0x1400821d2.9
mov r15d, 0x269
jmp case.0x1400821d2.9
mov r15d, 0x26a
jmp case.0x1400821d2.9
mov r15d, 0x26c
jmp case.0x1400821d2.9
mov r15d, 0x270
jmp case.0x1400821d2.9
mov r15d, 0x272
jmp case.0x1400821d2.9
mov r15d, 0x26e
jmp case.0x1400821d2.9
mov r15d, 0x26f
jmp case.0x1400821d2.9
mov r15d, 0x240
jmp case.0x1400821d2.9
mov r15d, 0x24a
jmp case.0x1400821d2.9
mov r15d, 0x24f
jmp case.0x1400821d2.9
mov r15d, 0x261
jmp case.0x1400821d2.9
mov r15d, 0x260
jmp case.0x1400821d2.9
mov r15d, 0x210
jmp case.0x1400821d2.9
mov r15d, 0x20f
jmp case.0x1400821d2.9
mov r15d, 0x211
jmp case.0x1400821d2.9
mov r15d, 0x275
jmp case.0x1400821d2.9
mov r15d, 0x256
shr r14d, 0x10
movzx edi, r14b
cmp r12d, 0x100
sete bl
call fcn.14003c1b0
mov rbp, rax
mov rcx, rax
mov edx, r15d
mov r8d, ebx
call fcn.14002fea0
mov dword [rsp + 0x20], 0xffffffff
mov rcx, rbp
mov edx, r15d
mov r8d, esi
mov r9d, edi
call fcn.14002fed0
cmp esi, 0x12
je 0x140082b26
cmp esi, 0x11
je 0x140082b9c
cmp esi, 0x10
jne 0x140082c14
cmp r12d, 0x100
sete bl
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
sets al
xor al, bl
jne 0x140082ae9
cmp r12d, 0x100
sete dl
mov ecx, 0x210
mov r8d, 0xa0
mov r9d, edi
call fcn.1400832e0
cmp r12d, 0x100
sete bl
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
sets al
xor al, bl
jne 0x140082c14
cmp r12d, 0x100
sete dl
mov ecx, 0x214
mov r8d, 0xa1
jmp 0x140082c0c
cmp r12d, 0x100
sete bl
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
sets al
xor al, bl
jne 0x140082b62
cmp r12d, 0x100
sete dl
mov ecx, 0x211
mov r8d, 0xa4
mov r9d, edi
call fcn.1400832e0
cmp r12d, 0x100
sete bl
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
sets al
xor al, bl
jne 0x140082c14
cmp r12d, 0x100
sete dl
mov ecx, 0x215
mov r8d, 0xa5
jmp 0x140082c0c
cmp r12d, 0x100
sete bl
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
sets al
xor al, bl
jne 0x140082bd8
cmp r12d, 0x100
sete dl
mov ecx, 0x20f
mov r8d, 0xa2
mov r9d, edi
call fcn.1400832e0
cmp r12d, 0x100
sete bl
mov ecx, 0xa3
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
sets al
xor al, bl
jne 0x140082c14
cmp r12d, 0x100
sete dl
mov ecx, 0x213
mov r8d, 0xa3
mov r9d, edi
call fcn.1400832e0
xor ebx, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400a0150
mov rax, rbx
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret