Function at 0x14007a5a0
Capabilities:
Get geographical location
Get keyboard layout
Log keystrokes via polling

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r14, r9
mov rdi, r8
mov r13d, edx
mov r12, rcx
mov rax, qword [0x1403295b8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], r8
call fcn.14007fae0
test rax, rax
je 0x14007b254
call fcn.1400896e0
mov r15, rax
call fcn.14007fae0
test rax, rax
je 0x14007a5fe
call fcn.1400896e0
mov rsi, qword [rax + 0x90]
jmp 0x14007a600
xor esi, esi
xor ebx, ebx
cmp r13d, 0x1ff
jle 0x14007a6e7
lea eax, [r13 - 0x200]
cmp eax, 0xa3
ja case.0x14007a62f.527
lea rcx, [0x14007b278]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
and eax, 0xffffff80
mov ecx, 0xff515700
lea rdx, [rcx + 0x80]
xor ebx, ebx
cmp rax, rdx
sete bl
cmp rax, rcx
mov eax, 2
cmove ebx, eax
mov ecx, r13d
and ecx, 0xfffffffd
xor ebp, ebp
cmp ecx, 0x204
sete bpl
lea ecx, [r13 - 0x207]
test ecx, 0xfffffffd
cmove ebp, eax
cmp r13d, 0x20d
je 0x14007a68d
cmp r13d, 0x20b
jne 0x14007a6a5
and edi, 0xffff0000
xor eax, eax
cmp edi, 0x10000
sete al
mov ebp, 4
sub ebp, eax
cmp dword [rsi + 0x14], 0
jne 0x14007a6bf
call qword [sym.imp.USER32.dll_GetCapture]
test rax, rax
jne 0x14007a6bf
mov rcx, r12
call qword [sym.imp.USER32.dll_SetCapture]
mov eax, 1
mov ecx, ebp
shl eax, cl
or dword [rsi + 0x14], eax
mov rcx, r15
mov edx, ebx
call fcn.14007d610
mov rcx, r15
mov edx, ebp
mov r8b, 1
call fcn.14007d470
jmp 0x14007b254
cmp r13d, 0x7d
jg 0x14007a72d
lea eax, [r13 - 7]
cmp eax, 2
jb 0x14007a8bd
cmp r13d, 0x20
je 0x14007a91a
cmp r13d, 0x51
jne case.0x14007a62f.527
call fcn.14007fae0
test rax, rax
je 0x14007aaef
call fcn.1400896e0
mov rsi, qword [rax + 0x90]
jmp 0x14007aaf1
lea eax, [r13 - 0x100]
cmp eax, 5
ja 0x14007a9b6
mov ecx, 0x33
bt ecx, eax
jae 0x14007a981
cmp rdi, 0xff
ja 0x14007b254
and r13d, 0xfffffffb
call fcn.1400896e0
mov rbx, rax
mov rsi, qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, reloc.WS2_32.dll_recvfrom
call rsi
movzx r8d, ax
shr r8d, 0xf
mov rcx, rbx
mov edx, 0x1000
call fcn.14007d2b0
mov ecx, reloc.WS2_32.dll_recv
call rsi
movzx r8d, ax
shr r8d, 0xf
mov rcx, rbx
mov edx, 0x2000
call fcn.14007d2b0
mov ecx, reloc.WS2_32.dll_select
call rsi
movzx r8d, ax
shr r8d, 0xf
mov rcx, rbx
mov edx, 0x4000
call fcn.14007d2b0
mov ecx, 0x5d
call rsi
movzx r8d, ax
shr r8d, 0xf
mov rcx, rbx
mov edx, 0x8000
call fcn.14007d2b0
cmp rdi, 0xd
mov ebp, 0x10d
cmovne ebp, edi
test r14d, 0x1000000
cmove ebp, edi
lea eax, [rbp - 8]
cmp eax, 0x105
ja case.0x14007a813.10
mov r15d, 0x200
lea rcx, [0x14007b508]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov r15d, 0x20b
jmp case.0x14007a813.9
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
and eax, 0xffffff80
mov ecx, 0xff515700
lea rdx, [rcx + 0x80]
xor ebx, ebx
cmp rax, rdx
sete bl
cmp rax, rcx
mov eax, 2
cmove ebx, eax
xor ecx, ecx
cmp r13d, 0x205
sete cl
cmp r13d, 0x208
cmove ecx, eax
and edi, 0xffff0000
xor eax, eax
cmp edi, 0x10000
sete al
mov edi, 4
sub edi, eax
cmp r13d, 0x20c
cmovne edi, ecx
mov eax, 0xfffffffe
mov ecx, edi
rol eax, cl
and dword [rsi + 0x14], eax
jne 0x14007a89f
call qword [sym.imp.USER32.dll_GetCapture]
cmp rax, r12
jne 0x14007a89f
call qword [sym.imp.USER32.dll_ReleaseCapture]
mov rcx, r15
mov edx, ebx
call fcn.14007d610
xor ebx, ebx
mov rcx, r15
mov edx, edi
xor r8d, r8d
call fcn.14007d470
jmp case.0x14007a62f.527
cmp r13d, 7
sete dl
mov rcx, r15
call fcn.14007d6f0
jmp 0x14007b254
xor eax, eax
cmp r13d, 0x2a3
sete al
mov ecx, 2
sub ecx, eax
cmp dword [rsi + 0x10], ecx
jne 0x14007b254
cmp qword [rsi + 8], r12
jne 0x14007a8fb
mov qword [rsi + 8], 0
mov dword [rsi + 0x10], 0
movss xmm1, dword [0x14025f0c4]
mov rcx, r15
movaps xmm2, xmm1
call fcn.14007d310
jmp 0x14007b254
cmp r14w, 1
jne 0x14007b254
mov ebx, 1
call fcn.14007a4e0
test al, al
je 0x14007b254
jmp case.0x14007a62f.527
sar edi, 0x10
cvtsi2ss xmm2, edi
divss xmm2, dword [0x14025f0c0]
xorps xmm1, xmm1
jmp 0x14007a962
sar edi, 0x10
cvtsi2ss xmm1, edi
divss xmm1, dword [0x14025f0bc]
xorps xmm2, xmm2
mov rcx, r15
call fcn.14007d570
jmp 0x14007b254
cmp edi, 7
jne 0x14007b254
mov byte [rsi + 0x32], 1
jmp 0x14007b254
cmp eax, 2
jne 0x14007a9b6
mov rcx, r12
call qword [sym.imp.USER32.dll_IsWindowUnicode]
test eax, eax
je 0x14007ab2b
lea rax, [rdi - 1]
cmp rax, 0xfffe
ja 0x14007b254
mov rcx, r15
mov edx, edi
call fcn.14007cb90
jmp 0x14007b254
cmp r13d, 0x7e
je 0x14007aae6
cmp r13d, 0xa0
jne case.0x14007a62f.527
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
and eax, 0xffffff80
mov ecx, 0xff515700
lea rdx, [rcx + 0x80]
xor edi, edi
cmp rax, rdx
sete dil
cmp rax, rcx
mov ebx, 2
cmove edi, ebx
xor eax, eax
cmp r13d, 0x200
sete al
sub ebx, eax
mov qword [rsi + 8], r12
cmp dword [rsi + 0x10], ebx
je 0x14007aa73
xor eax, eax
cmp r13d, 0x200
setne al
movabs rcx, 0x8000000000000018
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], r12
mov dword [rsp + 0x60], 0
mov dword [rsp + 0x38], Ordinal_27
shl eax, 4
or eax, 2
mov dword [rsp + 0x3c], eax
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x48], 0
cmp dword [rsi + 0x10], 0
je 0x14007aa65
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_TrackMouseEvent]
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_TrackMouseEvent]
mov dword [rsi + 0x10], ebx
movsx eax, r14w
mov dword [rsp + 0x50], eax
sar r14d, 0x10
mov dword [rsp + 0x54], r14d
mov esi, dword [r15]
and esi, 0x400
cmp r13d, 0x200
jne 0x14007aaa8
test esi, esi
je 0x14007aaa8
lea rdx, [rsp + 0x50]
mov rcx, r12
call qword [sym.imp.USER32.dll_ClientToScreen]
cmp r13d, 0xa0
jne 0x14007aac3
test esi, esi
jne 0x14007aac3
lea rdx, [rsp + 0x50]
mov rcx, r12
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rcx, r15
mov edx, edi
call fcn.14007d610
cvtsi2ss xmm2, dword [rsp + 0x54]
cvtsi2ss xmm1, dword [rsp + 0x50]
mov rcx, r15
call fcn.14007d310
jmp 0x14007b254
mov byte [rsi + 0x30], 1
jmp 0x14007b254
xor esi, esi
xor ebx, ebx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr eax, 0x10
add rsi, 0x2c
mov ecx, eax
mov edx, 0x20001004
mov r8, rsi
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne case.0x14007a62f.527
mov dword [rsi], 0
jmp 0x14007b254
mov word [rsp + 0x50], 0
mov ecx, dword [rsi + 0x2c]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 1
lea r8, [rsp + 0x68]
mov edx, 1
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movzx edx, word [rsp + 0x50]
mov rcx, r15
call fcn.14007c920
jmp 0x14007b254
shr r14d, 0x10
movzx r14d, r14b
jmp 0x14007b0d2
mov r15d, 0x20d
jmp case.0x14007a813.9
mov r15d, 0x263
jmp case.0x14007a813.9
mov r15d, 0x25f
jmp case.0x14007a813.9
mov r15d, 0x20e
jmp case.0x14007a813.9
mov r15d, 0x20c
jmp case.0x14007a813.9
mov r15d, 0x205
jmp case.0x14007a813.9
mov r15d, 0x206
jmp case.0x14007a813.9
mov r15d, 0x208
jmp case.0x14007a813.9
mov r15d, 0x207
jmp case.0x14007a813.9
mov r15d, 0x201
jmp case.0x14007a813.9
mov r15d, 0x203
jmp case.0x14007a813.9
mov r15d, 0x202
jmp case.0x14007a813.9
mov r15d, 0x204
jmp case.0x14007a813.9
shr r14d, 0x10
movzx r14d, r14b
mov r15d, 0x262
cmp r13d, 0x100
je 0x14007b099
call fcn.1400896e0
mov rbx, rax
mov rcx, rax
mov edx, 0x262
mov r8b, 1
call fcn.14007d2b0
mov dword [rsp + 0x20], 0xffffffff
mov rcx, rbx
mov edx, 0x262
mov r8d, ebp
mov r9d, r14d
call fcn.14007d2e0
mov r15d, 0x262
jmp 0x14007b099
mov r15d, 0x209
jmp case.0x14007a813.9
mov r15d, 0x218
jmp case.0x14007a813.9
mov r15d, 0x219
jmp case.0x14007a813.9
mov r15d, 0x21a
jmp case.0x14007a813.9
mov r15d, 0x21b
jmp case.0x14007a813.9
mov r15d, 0x21c
jmp case.0x14007a813.9
mov r15d, 0x21d
jmp case.0x14007a813.9
mov r15d, 0x21e
jmp case.0x14007a813.9
mov r15d, 0x21f
jmp case.0x14007a813.9
mov r15d, 0x220
jmp case.0x14007a813.9
mov r15d, 0x221
jmp case.0x14007a813.9
mov r15d, 0x222
jmp case.0x14007a813.9
mov r15d, 0x223
jmp case.0x14007a813.9
mov r15d, 0x224
jmp case.0x14007a813.9
mov r15d, 0x225
jmp case.0x14007a813.9
mov r15d, 0x226
jmp case.0x14007a813.9
mov r15d, 0x227
jmp case.0x14007a813.9
mov r15d, 0x228
jmp case.0x14007a813.9
mov r15d, 0x22a
jmp case.0x14007a813.9
mov r15d, 0x22b
jmp case.0x14007a813.9
mov r15d, 0x22c
jmp case.0x14007a813.9
mov r15d, 0x22d
jmp case.0x14007a813.9
mov r15d, 0x22e
jmp case.0x14007a813.9
mov r15d, 0x22f
jmp case.0x14007a813.9
mov r15d, 0x231
jmp case.0x14007a813.9
mov r15d, 0x232
jmp case.0x14007a813.9
mov r15d, 0x233
jmp case.0x14007a813.9
mov r15d, 0x234
jmp case.0x14007a813.9
mov r15d, 0x236
jmp case.0x14007a813.9
mov r15d, 0x237
jmp case.0x14007a813.9
mov r15d, 0x238
jmp case.0x14007a813.9
mov r15d, 0x23b
jmp case.0x14007a813.9
mov r15d, 0x212
jmp case.0x14007a813.9
mov r15d, 0x217
jmp case.0x14007a813.9
mov r15d, 0x266
jmp case.0x14007a813.9
mov r15d, 0x26b
jmp case.0x14007a813.9
mov r15d, 0x26d
jmp case.0x14007a813.9
mov r15d, 0x271
jmp case.0x14007a813.9
mov r15d, 0x23c
jmp case.0x14007a813.9
mov r15d, 0x23d
jmp case.0x14007a813.9
mov r15d, 0x23e
jmp case.0x14007a813.9
mov r15d, 0x23f
jmp case.0x14007a813.9
mov r15d, 0x241
jmp case.0x14007a813.9
mov r15d, 0x242
jmp case.0x14007a813.9
mov r15d, 0x243
jmp case.0x14007a813.9
mov r15d, 0x244
jmp case.0x14007a813.9
mov r15d, 0x245
jmp case.0x14007a813.9
mov r15d, 0x246
jmp case.0x14007a813.9
mov r15d, 0x247
jmp case.0x14007a813.9
mov r15d, 0x248
jmp case.0x14007a813.9
mov r15d, 0x249
jmp case.0x14007a813.9
mov r15d, 0x24b
jmp case.0x14007a813.9
mov r15d, 0x24c
jmp case.0x14007a813.9
mov r15d, 0x24d
jmp case.0x14007a813.9
mov r15d, 0x24e
jmp case.0x14007a813.9
mov r15d, 0x250
jmp case.0x14007a813.9
mov r15d, 0x251
jmp case.0x14007a813.9
mov r15d, 0x252
jmp case.0x14007a813.9
mov r15d, 0x253
jmp case.0x14007a813.9
mov r15d, 0x214
jmp case.0x14007a813.9
mov r15d, 0x213
jmp case.0x14007a813.9
mov r15d, 0x215
jmp case.0x14007a813.9
mov r15d, 0x276
jmp case.0x14007a813.9
mov r15d, 0x259
jmp case.0x14007a813.9
mov r15d, 0x25a
jmp case.0x14007a813.9
mov r15d, 0x255
jmp case.0x14007a813.9
mov r15d, 0x257
jmp case.0x14007a813.9
mov r15d, 0x258
jmp case.0x14007a813.9
mov r15d, 0x25e
jmp case.0x14007a813.9
mov r15d, 0x25b
jmp case.0x14007a813.9
mov r15d, 0x25c
jmp case.0x14007a813.9
mov r15d, 0x25d
jmp case.0x14007a813.9
mov r15d, 0x254
jmp case.0x14007a813.9
mov r15d, 0x273
jmp case.0x14007a813.9
mov r15d, 0x20a
jmp case.0x14007a813.9
mov r15d, 0x229
jmp case.0x14007a813.9
mov r15d, 0x230
jmp case.0x14007a813.9
mov r15d, 0x235
jmp case.0x14007a813.9
mov r15d, 0x239
jmp case.0x14007a813.9
mov r15d, 0x23a
jmp case.0x14007a813.9
mov r15d, 0x216
jmp case.0x14007a813.9
mov r15d, 0x264
jmp case.0x14007a813.9
mov r15d, 0x265
jmp case.0x14007a813.9
mov r15d, 0x267
jmp case.0x14007a813.9
mov r15d, 0x268
jmp case.0x14007a813.9
mov r15d, 0x269
jmp case.0x14007a813.9
mov r15d, 0x26a
jmp case.0x14007a813.9
mov r15d, 0x26c
jmp case.0x14007a813.9
mov r15d, 0x270
jmp case.0x14007a813.9
mov r15d, 0x272
jmp case.0x14007a813.9
mov r15d, 0x26e
jmp case.0x14007a813.9
mov r15d, 0x26f
jmp case.0x14007a813.9
mov r15d, 0x240
jmp case.0x14007a813.9
mov r15d, 0x24a
jmp case.0x14007a813.9
mov r15d, 0x24f
jmp case.0x14007a813.9
mov r15d, 0x261
jmp case.0x14007a813.9
mov r15d, 0x260
jmp case.0x14007a813.9
mov r15d, 0x210
jmp case.0x14007a813.9
mov r15d, 0x20f
jmp case.0x14007a813.9
mov r15d, 0x211
jmp case.0x14007a813.9
mov r15d, 0x275
jmp case.0x14007a813.9
mov r15d, 0x256
shr r14d, 0x10
movzx r14d, r14b
cmp r13d, 0x100
sete bl
call fcn.1400896e0
mov rdi, rax
mov rcx, rax
mov edx, r15d
mov r8d, ebx
call fcn.14007d2b0
mov dword [rsp + 0x20], 0xffffffff
mov rcx, rdi
mov edx, r15d
mov r8d, ebp
mov r9d, r14d
call fcn.14007d2e0
cmp ebp, 0x12
je 0x14007b166
cmp ebp, 0x11
je 0x14007b1dc
cmp ebp, 0x10
jne 0x14007b254
cmp r13d, 0x100
sete bl
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
sets al
xor al, bl
jne 0x14007b129
cmp r13d, 0x100
sete dl
mov ecx, 0x210
mov r8d, 0xa0
mov r9d, r14d
call fcn.14007b920
cmp r13d, 0x100
sete bl
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
sets al
xor al, bl
jne 0x14007b254
cmp r13d, 0x100
sete dl
mov ecx, 0x214
mov r8d, 0xa1
jmp 0x14007b24c
cmp r13d, 0x100
sete bl
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
sets al
xor al, bl
jne 0x14007b1a2
cmp r13d, 0x100
sete dl
mov ecx, 0x211
mov r8d, 0xa4
mov r9d, r14d
call fcn.14007b920
cmp r13d, 0x100
sete bl
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
sets al
xor al, bl
jne 0x14007b254
cmp r13d, 0x100
sete dl
mov ecx, 0x215
mov r8d, 0xa5
jmp 0x14007b24c
cmp r13d, 0x100
sete bl
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
sets al
xor al, bl
jne 0x14007b218
cmp r13d, 0x100
sete dl
mov ecx, 0x20f
mov r8d, 0xa2
mov r9d, r14d
call fcn.14007b920
cmp r13d, 0x100
sete bl
mov ecx, 0xa3
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
sets al
xor al, bl
jne 0x14007b254
cmp r13d, 0x100
sete dl
mov ecx, 0x213
mov r8d, 0xa3
mov r9d, r14d
call fcn.14007b920
xor ebx, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140141380
mov rax, rbx
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret