Function at 0x510720
Capabilities:
Get geographical location
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x474
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x470], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
push ebx
mov dword [esp + 0x64], eax
mov ebx, ecx
xor eax, eax
mov dword [esp + 0x60], ecx
test ecx, ecx
mov dword [esp + 0x24], ebx
push esi
sete cl
mov dword [esp + 0x18], eax
test byte [0x630910], 1
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x4c], edi
mov byte [esp + 0x1b], cl
jne 0x51082e
mov esi, 0x630910
lock bts dword [esi], 0x1f
setb al
test al, al
jne 0x510816
push 4
lea eax, [esp + 0x74]
push eax
push 0xe
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
nop dword [eax]
test eax, eax
je 0x5107bc
mov ax, word [esp + 0x70]
test ax, ax
je 0x5107bc
cmp word [esp + 0x72], 0
jne 0x5107bc
mov word [0x62e6c8], ax
push 4
lea eax, [esp + 0x74]
push eax
push 0xf
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x5107ec
mov ax, word [esp + 0x70]
test ax, ax
je 0x5107ec
cmp word [esp + 0x72], 0
jne 0x5107ec
mov word [0x62e6f8], ax
cmp word [0x62e6c8], 0x2e
je 0x51080d
push 0x5d1e90
push 0
call fcn.0058f53b
add esp, 8
mov dword [0x6357f8], eax
mov ecx, esi
call sym.SystemInformer.exe_Ordinal_1358
jmp 0x510828
test byte [0x630910], 1
jne 0x51082c
xor edx, edx
mov ecx, esi
call sym.SystemInformer.exe_Ordinal_1388
mov cl, byte [esp + 0x1b]
xor eax, eax
cmp dword [ebp + 0xc], 0
mov esi, dword [ebp + 0x14]
je 0x511a17
mov byte [esp + 0x1b], cl
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x50], 3
nop word [eax + eax]
dec ecx
mov dword [esp + 0x70], eax
mov eax, dword [edi]
mov edx, edi
mov dword [ebp + 0xc], ecx
mov ecx, dword [esp + 0x4c]
add dword [esp + 0x4c], 0x18
mov dword [esp + 0x3c], eax
and eax, 0x3f
mov dword [esp + 0x48], edi
mov dword [esp + 0x20], 0
cmp eax, 0xd
ja case.default.0x510889
jmp dword [eax*4 + 0x511a6c]
cmp byte [esp + 0x1b], 0
jne 0x5116ed
mov eax, dword [esp + 0x1c]
add eax, 2
cmp esi, eax
jae 0x5108c5
mov eax, dword ds:[esp + 0x1c]
add ebx, 2
add eax, 2
mov byte [esp + 0x1b], 1
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], eax
jmp 0x51095e
mov ax, word [edi + 0x10]
jmp 0x5116ea
cmp byte [esp + 0x1b], 0
jne 0x51090f
mov eax, dword ds:[esp + 0x1c]
mov ecx, dword [edi + 0x10]
add eax, ecx
cmp esi, eax
jae 0x510902
mov eax, ecx
mov byte [esp + 0x1b], 1
shr eax, 1
lea ebx, [ebx + eax*2]
mov eax, dword [esp + 0x1c]
add eax, ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], eax
jmp 0x51095e
push ecx
push dword [edi + 0x14]
push ebx
call fcn.00586330
add esp, 0xc
mov eax, dword [edi + 0x10]
shr eax, 1
lea ebx, [ebx + eax*2]
mov eax, dword [esp + 0x1c]
add eax, dword [edi + 0x10]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], eax
jmp 0x51095e
push dword [edi + 0x10]
call sym.SystemInformer.exe_Ordinal_1322
cmp byte [esp + 0x1b], 0
mov esi, eax
jne 0x51094c
mov ecx, dword [esp + 0x1c]
lea edx, [esi + esi]
add ecx, edx
cmp dword [ebp + 0x14], ecx
jae 0x5109b3
mov byte [esp + 0x1b], 1
lea ebx, [ebx + esi*2]
lea eax, [esi + esi]
mov dword [esp + 0x2c], ebx
add dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x48]
mov ecx, eax
sub ecx, dword [esp + 0x70]
mov edx, dword [edi]
test edx, 0xc0000000
je 0x511a05
movzx esi, word ds:[edi + 6]
add esi, esi
cmp ecx, esi
jae 0x511a05
sub esi, ecx
cmp byte [esp + 0x1b], 0
jne 0x5119f0
add eax, esi
cmp dword [ebp + 0x14], eax
jae 0x51198c
mov byte [esp + 0x1b], 1
jmp 0x5119f0
push edx
push dword [edi + 0x10]
push ebx
call fcn.00586330
add esp, 0xc
jmp 0x51094c
cmp dword [esp + 0x3c], 3
jne 0x5109d1
mov edi, dword [edi + 0x14]
mov esi, dword [ecx + 0x10]
jmp 0x5109e9
mov edi, dword [ecx + 0x10]
mov esi, edi
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x5109e0
sub esi, ecx
push esi
push edi
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeSize]
test eax, eax
js case.default.0x510889
cmp byte [esp + 0x1b], 0
jne 0x510a4e
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x54]
add eax, ecx
cmp dword [ebp + 0x14], eax
jae 0x510a33
mov eax, ecx
mov byte [esp + 0x1b], 1
shr eax, 1
lea ebx, [ebx + eax*2]
mov eax, dword [esp + 0x1c]
add eax, ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], eax
jmp 0x51095e
push esi
push edi
push 0
push ecx
push ebx
lfence
call dword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
test eax, eax
js case.default.0x510889
mov ecx, dword [esp + 0x54]
mov eax, ecx
shr eax, 1
lea ebx, [ebx + eax*2]
mov eax, dword [esp + 0x1c]
add eax, ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], eax
jmp 0x51095e
mov eax, dword ds:[edx + 0x10]
mov ecx, eax
cdq
mov esi, eax
shr ecx, 0x1f
xor esi, edx
mov dword [esp + 0x20], ecx
sub esi, edx
jmp 0x510a85
mov esi, dword [edi + 0x10]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x34], 0xa
test edx, 0x100
je 0x510aab
mov cl, byte [edi + 0xa]
mov al, cl
sub al, 2
cmp al, 0x43
ja 0x510aab
movzx eax, cl
mov dword [esp + 0x34], eax
test edx, 0x20000000
mov ecx, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
mov eax, 0x61f470
cmovne eax, ecx
xor edi, edi
mov dword [esp + 0x40], eax
lea ecx, [esp + 0x476]
test esi, esi
je 0x510b70
test edx, 0x10000
je 0x510b49
xor eax, eax
mov dword [esp + 0x38], eax
mov eax, esi
xor edx, edx
div dword [esp + 0x34]
inc edi
mov esi, eax
mov dword [esp + 0x24], edi
mov eax, dword [esp + 0x40]
movsx ax, byte [eax + edx]
mov word [ecx], ax
sub ecx, 2
mov eax, dword [esp + 0x38]
inc eax
mov dword [esp + 0x38], eax
cmp eax, 3
jne 0x510b43
test esi, esi
je 0x510b8d
movzx eax, word [0x62e6f8]
xor edx, edx
mov word [ecx], ax
mov eax, esi
div dword [esp + 0x34]
mov dword [esp + 0x38], 1
mov esi, eax
mov eax, dword [esp + 0x40]
movsx eax, byte [eax + edx]
mov word [ecx - 2], ax
add ecx, 0xfffffffc
add edi, 2
mov dword [esp + 0x24], edi
test esi, esi
jne 0x510ae1
jmp 0x510b8d
mov ebx, eax
nop dword [eax + eax]
mov eax, esi
xor edx, edx
div dword [esp + 0x34]
inc edi
mov esi, eax
movsx ax, byte [ebx + edx]
mov word [ecx], ax
sub ecx, 2
test esi, esi
jne 0x510b50
mov ebx, dword [esp + 0x2c]
jmp 0x510b89
mov eax, 0x30
lea ecx, [esp + 0x474]
mov word [esp + 0x476], ax
mov edi, 1
mov dword [esp + 0x24], edi
mov esi, dword [esp + 0x3c]
xor edx, edx
cmp dword [esp + 0x20], edx
je 0x510ba2
mov edx, 1
jmp 0x510bb0
test esi, 0x20000
mov eax, 1
cmovne edx, eax
mov eax, esi
mov dword [esp + 0x34], edx
and eax, 0x50000
cmp eax, 0x40000
jne 0x510bed
mov eax, dword [esp + 0x48]
movzx esi, word [eax + 6]
lea eax, [edx + edi]
cmp eax, esi
jae 0x510be9
or dword [esp + 0x20], 4
sub esi, edx
sub esi, edi
add edx, esi
mov dword [esp + 0x60], esi
mov dword [esp + 0x34], edx
mov esi, dword [esp + 0x3c]
add ecx, 2
cmp byte [esp + 0x1b], 0
mov dword [esp + 0x30], ecx
jne 0x510c86
lea eax, [edx + edi]
mov edx, dword [esp + 0x1c]
lea eax, [edx + eax*2]
cmp dword [ebp + 0x14], eax
jae 0x510c27
mov eax, dword [esp + 0x34]
mov ecx, edx
add eax, edi
mov byte [esp + 0x1b], 1
lea ecx, [ecx + eax*2]
mov dword [esp + 0x1c], ecx
jmp case.default.0x510889
mov eax, dword [esp + 0x20]
test al, 1
je 0x510c36
mov edx, 0x2d
jmp 0x510c43
test esi, 0x20000
je 0x510c49
mov edx, 0x2b
mov word [ebx], dx
add ebx, 2
test al, 4
je 0x510c72
mov edx, dword [esp + 0x60]
test edx, edx
je 0x510c6f
mov ecx, edx
mov eax, 0x300030
shr ecx, 1
mov edi, ebx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov ecx, dword [esp + 0x30]
mov edi, dword [esp + 0x24]
lea ebx, [ebx + edx*2]
lea esi, [edi + edi]
push esi
push ecx
push ebx
call fcn.00586330
add esp, 0xc
add ebx, esi
mov dword [esp + 0x2c], ebx
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x1c]
add eax, edi
lea ecx, [ecx + eax*2]
mov dword [esp + 0x1c], ecx
jmp case.default.0x510889
mov eax, dword [edi + 0x14]
mov esi, dword [edi + 0x10]
mov dword [esp + 0x44], esi
mov dword [esp + 0x38], eax
test eax, eax
jg 0x510cd3
jl 0x510cb4
test esi, esi
jae 0x510cd3
neg esi
mov dword [esp + 0x20], 1
adc eax, 0
neg eax
jmp 0x510ccb
mov esi, dword [edi + 0x10]
mov eax, dword [edi + 0x14]
mov dword [esp + 0x38], eax
mov dword [esp + 0x44], esi
mov edi, dword [esp + 0x3c]
mov dword [esp + 0x34], 0xa
mov dword [esp + 0x24], 0
test edi, 0x100
je 0x510d1a
mov eax, dword [esp + 0x48]
mov dword [esp + 0x34], 0xa
mov dword [esp + 0x24], 0
mov cl, byte [eax + 0xa]
mov al, cl
sub al, 2
cmp al, 0x43
ja 0x510d1a
movzx eax, cl
cdq
mov dword [esp + 0x34], eax
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x38]
test edi, 0x20000000
mov eax, 0x61f470
lea edi, [esp + 0x476]
mov ecx, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
cmovne eax, ecx
mov dword [esp + 0x30], eax
xor eax, eax
mov dword [esp + 0x40], eax
mov eax, esi
or eax, edx
je 0x510e43
test dword [esp + 0x3c], 0x10000
je 0x510ded
xor eax, eax
mov dword [esp + 0x28], eax
push dword [esp + 0x24]
push dword [esp + 0x38]
push edx
push esi
call fcn.005a5390
push dword [esp + 0x24]
mov esi, eax
mov eax, dword [esp + 0x3c]
push dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x50]
push eax
call fcn.005a5320
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x38], edx
movsx cx, byte [eax + esi]
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x44]
inc eax
mov word [edi], cx
sub edi, 2
mov ecx, dword [esp + 0x40]
inc ecx
mov dword [esp + 0x40], ecx
cmp eax, 3
jne 0x510dd9
mov eax, esi
or eax, edx
je 0x510e60
mov ax, word [0x62e6f8]
mov word [edi], ax
sub edi, 2
inc ecx
mov dword [esp + 0x40], ecx
jmp 0x510d5a
mov dword [esp + 0x28], eax
mov eax, esi
or eax, edx
mov dword [esp + 0x40], ecx
jne 0x510d60
jmp 0x510e60
mov ebx, dword [esp + 0x34]
push dword [esp + 0x24]
push ebx
push edx
push esi
call fcn.005a5390
push dword [esp + 0x24]
mov esi, eax
mov eax, dword [esp + 0x3c]
push ebx
push eax
mov eax, dword [esp + 0x50]
push eax
call fcn.005a5320
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x44], eax
inc ecx
mov eax, dword [esp + 0x30]
mov dword [esp + 0x38], edx
mov dword [esp + 0x40], ecx
movsx ax, byte [eax + esi]
mov esi, dword [esp + 0x44]
mov word [edi], ax
mov eax, esi
sub edi, 2
or eax, edx
jne 0x510df1
mov ebx, dword [esp + 0x2c]
jmp 0x510e60
mov eax, 0x30
lea edi, [esp + 0x474]
mov ecx, 1
mov word [esp + 0x476], ax
mov dword [esp + 0x40], ecx
mov esi, dword [esp + 0x3c]
xor edx, edx
cmp dword [esp + 0x20], edx
je 0x510e73
mov edx, 1
jmp 0x510e81
test esi, 0x20000
mov eax, 1
cmovne edx, eax
mov eax, esi
mov dword [esp + 0x28], edx
and eax, 0x50000
cmp eax, 0x40000
jne 0x510ebb
mov eax, dword ds:[esp + 0x48]
movzx esi, word [eax + 6]
lea eax, [edx + ecx]
cmp eax, esi
jae 0x510eb7
or dword [esp + 0x20], 4
sub esi, edx
sub esi, ecx
add edx, esi
mov dword [esp + 0x64], esi
mov dword [esp + 0x28], edx
mov esi, dword [esp + 0x3c]
add edi, 2
cmp byte [esp + 0x1b], 0
mov dword [esp + 0x30], edi
jne 0x510f56
lea eax, [edx + ecx]
mov edx, dword [esp + 0x1c]
lea eax, [edx + eax*2]
cmp dword [ebp + 0x14], eax
jae 0x510ef7
mov eax, dword [esp + 0x40]
mov ecx, edx
add eax, dword [esp + 0x28]
mov byte [esp + 0x1b], 1
lea ecx, [ecx + eax*2]
mov dword [esp + 0x1c], ecx
jmp case.default.0x510889
mov eax, dword [esp + 0x20]
test al, 1
je 0x510f06
mov edx, 0x2d
jmp 0x510f13
test esi, 0x20000
je 0x510f19
mov edx, 0x2b
mov word [ebx], dx
add ebx, 2
test al, 4
je 0x510f42
mov edx, dword [esp + 0x64]
test edx, edx
je 0x510f3f
mov ecx, edx
mov eax, 0x300030
shr ecx, 1
mov edi, ebx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x30]
mov ecx, dword [esp + 0x40]
lea ebx, [ebx + edx*2]
lea esi, [ecx + ecx]
push esi
push edi
push ebx
call fcn.00586330
add esp, 0xc
add ebx, esi
mov dword [esp + 0x2c], ebx
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x1c]
add eax, dword [esp + 0x28]
lea ecx, [ecx + eax*2]
mov dword [esp + 0x1c], ecx
jmp case.default.0x510889
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x20], 0
test cl, 0x40
je 0x510f92
movzx edx, word [edi + 4]
cmp edx, 0xa2
jbe 0x510f97
mov edx, 0xa2
jmp 0x510f97
mov edx, 6
movss xmm0, dword [edi + 0x10]
lea eax, [esp + 0x79]
sub esp, 8
mov dword [esp + 0x30], eax
push eax
call fcn.00576180
test al, al
jne 0x510fb7
mov byte [esp + 0x79], al
jmp 0x51100c
mov edx, dword [0x6357f8]
nop dword [eax]
test edx, edx
je 0x510fe5
mov al, byte [esp + 0x79]
lea ecx, [esp + 0x79]
test al, al
je 0x510fe5
cmp al, 0x2e
je 0x510fde
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x510fd0
jmp 0x510fe5
mov al, byte [0x62e6c8]
mov byte [ecx], al
test dword [esp + 0x3c], 0x20000000
je 0x51100c
lea eax, [esp + 0x79]
test edx, edx
je 0x511003
push edx
push eax
call fcn.0058ece3
add esp, 8
jmp 0x51100c
push eax
call fcn.0058ec87
add esp, 4
mov edi, dword [edi]
test edi, 0x8000
je 0x511084
mov al, byte [esp + 0x79]
lea ecx, [esp + 0x79]
mov ah, byte [0x62e6c8]
test al, al
je 0x511034
cmp al, ah
je 0x511034
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x511028
mov al, byte [ecx]
inc ecx
test al, al
je 0x511084
mov dl, byte ds:[ecx]
test dl, dl
je 0x511059
mov al, dl
cmp dl, 0x65
je 0x511059
cmp al, 0x45
je 0x511059
mov al, byte [ecx + 1]
inc ecx
mov dl, al
test al, al
jne 0x511046
mov al, byte ds:[ecx - 1]
mov esi, ecx
dec ecx
cmp al, 0x30
jne 0x51106c
mov al, byte [ecx - 1]
dec ecx
cmp al, 0x30
je 0x511064
cmp al, ah
lea edx, [ecx - 1]
cmovne edx, ecx
mov al, byte ds:[esi]
lea edx, [edx + 1]
mov byte [edx], al
lea esi, [esi + 1]
test al, al
jne 0x511074
lea esi, [esp + 0x79]
lea ecx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x511090
sub esi, ecx
cmp byte [esp + 0x79], 0x2d
mov dword [esp + 0x30], esi
jne 0x5110bb
lea edx, [esp + 0x7a]
mov dword [esp + 0x20], 1
dec esi
mov dword [esp + 0x28], edx
mov dword [esp + 0x30], esi
jmp 0x5110d5
mov ecx, dword [esp + 0x20]
test edi, 0x20000
mov edx, dword [esp + 0x28]
mov eax, 2
cmovne ecx, eax
mov dword [esp + 0x20], ecx
mov eax, edi
and eax, 0x13000
cmp eax, 0x10000
jne 0x511225
mov al, byte [edx]
mov edi, edx
sub al, 0x30
cmp al, 0xa
jae 0x5110ff
mov al, byte [edi + 1]
inc edi
sub al, 0x30
cmp al, 0xa
jb 0x5110f5
mov eax, edi
sub eax, edx
mov dword [esp + 0x24], eax
lea edx, [eax + 2]
mov dword [esp + 0x38], edx
je 0x511122
mov eax, 0xaaaaaaab
mul edx
mov eax, edx
mov edx, dword [esp + 0x38]
shr eax, 1
dec eax
jmp 0x511124
xor eax, eax
lea ecx, [eax + esi]
mov dword [esp + 0x34], eax
add ecx, ecx
cmp byte [esp + 0x1b], 0
jne 0x511159
cmp dword [esp + 0x20], 0
lea eax, [ecx + 2]
cmove eax, ecx
mov ecx, dword [esp + 0x1c]
add eax, ecx
cmp dword [ebp + 0x14], eax
jae 0x511159
mov eax, dword [esp + 0x24]
mov dl, 1
mov byte [esp + 0x1b], dl
jmp 0x5111ea
mov ecx, dword [esp + 0x24]
mov eax, edx
xor edx, edx
div dword [esp + 0x50]
cmp byte [esp + 0x1b], 0
jne 0x5111de
mov eax, dword [esp + 0x20]
test al, 1
je 0x51117b
mov eax, 0x2d
jmp 0x511184
test al, 2
je 0x51118e
mov eax, 0x2b
mov word [ebx], ax
add ebx, 2
mov dword [esp + 0x2c], ebx
mov eax, dword [esp + 0x24]
test eax, eax
je 0x5111e2
mov esi, dword [esp + 0x28]
nop word [eax + eax]
movsx ax, byte [esi]
dec ecx
inc esi
mov word [ebx], ax
mov eax, edx
add ebx, 2
dec edx
test eax, eax
jne 0x5111d2
test ecx, ecx
je 0x5111d6
movzx eax, word [0x62e6f8]
dec ecx
mov word [ebx], ax
mov edx, 1
movsx eax, byte [esi]
mov word [ebx + 2], ax
add ebx, 4
inc esi
test ecx, ecx
jne 0x5111a0
mov esi, dword [esp + 0x30]
mov dword [esp + 0x2c], ebx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
mov dl, byte [esp + 0x1b]
cmp dword [esp + 0x20], 0
je 0x5111f8
add ecx, 2
mov dword [esp + 0x1c], ecx
add eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x1c]
sub esi, dword [esp + 0x24]
lea ecx, [ecx + eax*2]
mov dword [esp + 0x1c], ecx
test dl, dl
jne case.default.0x510889
push ebx
push esi
push edi
call sym.SystemInformer.exe_Ordinal_1461
nop dword [eax + eax]
jmp 0x51094c
mov eax, dword ds:[esp + 0x48]
xor ecx, ecx
cmp dword [esp + 0x20], ecx
setne cl
test dword [eax], 0x40000
mov edi, ecx
mov dword [esp + 0x28], edi
je 0x51126f
movzx eax, word [eax + 6]
mov dword [esp + 0x30], eax
lea eax, [ecx + esi]
mov dword [esp + 0x28], edi
cmp eax, dword [esp + 0x30]
jae 0x51126f
mov eax, dword [esp + 0x30]
or dword [esp + 0x20], 4
sub eax, ecx
sub eax, esi
mov dword [esp + 0x58], eax
lea edi, [ecx + eax]
mov dword [esp + 0x28], edi
cmp byte [esp + 0x1b], 0
jne 0x511305
mov ecx, dword [esp + 0x1c]
lea eax, [edi + esi]
lea eax, [ecx + eax*2]
cmp dword [ebp + 0x14], eax
jae 0x51129c
mov eax, ecx
mov byte [esp + 0x1b], 1
lea eax, [eax + edi*2]
mov dword [esp + 0x1c], eax
jmp 0x51095e
mov eax, dword [esp + 0x20]
test al, 1
je 0x5112ab
mov ecx, 0x2d
jmp 0x5112b4
test al, 2
je 0x5112be
mov ecx, 0x2b
mov word [ebx], cx
add ebx, 2
mov dword [esp + 0x2c], ebx
nop
test al, 4
je 0x511305
mov eax, dword [esp + 0x58]
test eax, eax
je 0x5112e6
mov ecx, eax
mov edi, ebx
shr ecx, 1
mov eax, 0x300030
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x28]
mov eax, dword [esp + 0x58]
lea ebx, [ebx + eax*2]
mov eax, dword [esp + 0x1c]
push ebx
push esi
push edx
lea eax, [eax + edi*2]
mov dword [esp + 0x28], eax
call sym.SystemInformer.exe_Ordinal_1461
nop dword [eax]
jmp 0x51094c
cmp byte [esp + 0x1b], 0
mov eax, dword [esp + 0x1c]
lea eax, [eax + edi*2]
mov dword [esp + 0x1c], eax
jne 0x51095e
push ebx
push esi
push edx
call sym.SystemInformer.exe_Ordinal_1461
jmp 0x51094c
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x20], 0
test cl, 0x40
je 0x51134f
movzx edx, word ds:[edi + 4]
cmp edx, 0xa2
jbe 0x511354
mov edx, 0xa2
jmp 0x511354
mov edx, 6
movsd xmm0, qword [edi + 0x10]
lea eax, [esp + 0x79]
sub esp, 0x10
mov dword [esp + 0x38], eax
movsd qword [esp + 8], xmm0
push eax
call fcn.005763a0
test al, al
jne 0x51137a
mov byte [esp + 0x79], al
jmp 0x5113cc
mov edx, dword [0x6357f8]
test edx, edx
je 0x5113a5
mov al, byte [esp + 0x79]
lea ecx, [esp + 0x79]
test al, al
je 0x5113a5
cmp al, 0x2e
je 0x51139e
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x511390
jmp 0x5113a5
mov al, byte [0x62e6c8]
mov byte [ecx], al
test dword [esp + 0x3c], 0x20000000
je 0x5113cc
lea eax, [esp + 0x79]
test edx, edx
je 0x5113c3
push edx
push eax
call fcn.0058ece3
add esp, 8
jmp 0x5113cc
push eax
call fcn.0058ec87
add esp, 4
mov edi, dword [edi]
test edi, 0x8000
je 0x51144e
mov al, byte [esp + 0x79]
lea ecx, [esp + 0x79]
mov ah, byte [0x62e6c8]
test al, al
je 0x5113fc
nop dword [eax]
cmp al, ah
je 0x5113fc
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x5113f0
mov al, byte ds:[ecx]
inc ecx
test al, al
je 0x51144e
mov dl, byte [ecx]
test dl, dl
je 0x511424
mov al, dl
nop dword [eax]
cmp dl, 0x65
je 0x511424
cmp al, 0x45
je 0x511424
mov al, byte ds:[ecx + 1]
inc ecx
mov dl, al
test al, al
jne 0x511410
mov al, byte [ecx - 1]
mov esi, ecx
dec ecx
cmp al, 0x30
jne 0x511438
nop
mov al, byte [ecx - 1]
dec ecx
cmp al, 0x30
je 0x511430
cmp al, ah
lea edx, [ecx - 1]
cmovne edx, ecx
mov al, byte [esi]
lea edx, [edx + 1]
mov byte [edx], al
lea esi, [esi + 1]
test al, al
jne 0x511440
lea esi, [esp + 0x79]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x511455
sub esi, ecx
cmp byte [esp + 0x79], 0x2d
mov dword [esp + 0x30], esi
jne 0x511482
lea edx, ds:[esp + 0x7a]
mov dword [esp + 0x20], 1
dec esi
mov dword [esp + 0x28], edx
mov dword [esp + 0x30], esi
jmp 0x51149c
mov ecx, dword [esp + 0x20]
test edi, 0x20000
mov edx, dword [esp + 0x28]
mov eax, 2
cmovne ecx, eax
mov dword [esp + 0x20], ecx
mov eax, edi
and eax, 0x13000
cmp eax, 0x10000
jne 0x5115b0
mov al, byte [edx]
mov edi, edx
sub al, 0x30
cmp al, 0xa
jae 0x5114c4
mov al, byte ds:[edi + 1]
inc edi
sub al, 0x30
cmp al, 0xa
jb 0x5114b8
mov eax, edi
sub eax, edx
mov dword [esp + 0x24], eax
lea edx, [eax + 2]
mov dword [esp + 0x38], edx
je 0x5114e7
mov eax, 0xaaaaaaab
mul edx
mov eax, edx
mov edx, dword [esp + 0x38]
shr eax, 1
dec eax
jmp 0x5114e9
xor eax, eax
lea ecx, [eax + esi]
mov dword [esp + 0x34], eax
add ecx, ecx
cmp byte [esp + 0x1b], 0
jne 0x51151e
cmp dword [esp + 0x20], 0
lea eax, [ecx + 2]
cmove eax, ecx
mov ecx, dword [esp + 0x1c]
add eax, ecx
cmp dword [ebp + 0x14], eax
jae 0x51151e
mov eax, dword [esp + 0x24]
mov dl, 1
mov byte [esp + 0x1b], dl
jmp 0x5111ea
mov ecx, dword [esp + 0x24]
mov eax, edx
xor edx, edx
div dword [esp + 0x50]
cmp byte [esp + 0x1b], 0
jne 0x5111de
mov eax, dword [esp + 0x20]
test al, 1
je 0x511544
mov eax, 0x2d
jmp 0x51154d
test al, 2
je 0x511557
mov eax, 0x2b
mov word [ebx], ax
add ebx, 2
mov dword [esp + 0x2c], ebx
mov eax, dword ds:[esp + 0x24]
test eax, eax
je 0x5111e2
mov esi, dword [esp + 0x28]
nop dword [eax]
movsx ax, byte ds:[esi]
dec ecx
inc esi
mov word [ebx], ax
mov eax, edx
add ebx, 2
dec edx
test eax, eax
jne 0x5115a7
test ecx, ecx
je 0x5111d6
movzx eax, word [0x62e6f8]
dec ecx
mov word [ebx], ax
mov edx, 1
movsx eax, byte [esi]
mov word [ebx + 2], ax
add ebx, 4
inc esi
test ecx, ecx
jne 0x511570
jmp 0x5111d6
mov eax, dword [esp + 0x48]
xor ecx, ecx
cmp dword [esp + 0x20], ecx
setne cl
test dword [eax], 0x40000
mov edi, ecx
mov dword [esp + 0x28], edi
je 0x5115fe
movzx eax, word ds:[eax + 6]
mov dword [esp + 0x30], eax
lea eax, [ecx + esi]
mov dword [esp + 0x28], edi
cmp eax, dword [esp + 0x30]
jae 0x5115fe
mov eax, dword [esp + 0x30]
or dword [esp + 0x20], 4
sub eax, ecx
sub eax, esi
mov dword [esp + 0x5c], eax
lea edi, [ecx + eax]
mov dword [esp + 0x28], edi
cmp byte [esp + 0x1b], 0
jne 0x511305
mov ecx, dword [esp + 0x1c]
lea eax, [edi + esi]
lea eax, [ecx + eax*2]
cmp dword [ebp + 0x14], eax
jae 0x51162b
mov eax, ecx
mov byte [esp + 0x1b], 1
lea eax, [eax + edi*2]
mov dword [esp + 0x1c], eax
jmp 0x51095e
mov eax, dword [esp + 0x20]
test al, 1
je 0x51163a
mov ecx, 0x2d
jmp 0x511643
test al, 2
je 0x51164d
mov ecx, 0x2b
mov word [ebx], cx
add ebx, 2
mov dword [esp + 0x2c], ebx
test al, 4
je 0x511305
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x511677
mov ecx, eax
mov edi, ebx
shr ecx, 1
mov eax, 0x300030
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x28]
mov eax, dword [esp + 0x5c]
lea ebx, [ebx + eax*2]
mov eax, dword [esp + 0x1c]
push ebx
push esi
push edx
lea eax, [eax + edi*2]
mov dword [esp + 0x28], eax
call sym.SystemInformer.exe_Ordinal_1461
jmp 0x51094c
mov eax, dword [esp + 0x48]
mov edi, dword [edi + 0x10]
mov ecx, edi
mov dword [esp + 0x30], 0
mov esi, dword [eax + 0x14]
mov edx, esi
call fcn.005a71b0
or edi, esi
jne 0x511705
cmp byte [esp + 0x1b], 0
jne 0x5116ed
mov eax, dword ds:[esp + 0x1c]
add eax, 2
cmp dword [ebp + 0x14], eax
jae 0x5116e5
mov eax, dword ds:[esp + 0x1c]
add ebx, 2
add eax, 2
mov byte [esp + 0x1b], 1
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], eax
jmp 0x51095e
mov eax, 0x30
mov word [ebx], ax
mov eax, dword ds:[esp + 0x1c]
add ebx, 2
add eax, 2
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], eax
jmp 0x51095e
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x48]
test ecx, 0x100
je 0x51171b
movzx eax, byte [edx + 0xa]
jmp 0x511720
mov eax, dword [0x6314bc]
movsd xmm1, qword [0x624538]
comisd xmm0, xmm1
mov edi, dword [esp + 0x30]
jb 0x511754
movsd xmm2, qword [0x624510]
nop word [eax + eax]
cmp edi, 7
jae 0x511754
cmp edi, eax
jae 0x511754
mulsd xmm0, xmm2
inc edi
comisd xmm0, xmm1
jae 0x511740
test cl, 0x40
je 0x51175f
movzx eax, word [edx + 4]
jmp 0x511764
mov eax, 2
movzx edx, ax
lea esi, [esp + 0x79]
cmp edx, 0xa2
mov dword [esp + 0x34], 0
mov eax, 0xa2
mov ecx, 0x1804c
cmova edx, eax
sub esp, 0x10
mov eax, esi
movsd qword [esp + 8], xmm0
push eax
call fcn.005763a0
test al, al
jne 0x5117a2
mov byte ds:[esp + 0x79], al
jmp 0x5117cd
cmp dword [0x6357f8], 0
je 0x5117cd
mov al, byte [esp + 0x79]
lea ecx, [esp + 0x79]
test al, al
je 0x5117cd
cmp al, 0x2e
je 0x5117c6
mov al, byte ds:[ecx + 1]
inc ecx
test al, al
jne 0x5117b7
jmp 0x5117cd
mov al, byte [0x62e6c8]
mov byte [ecx], al
lea ecx, [esp + 0x79]
call fcn.0050eea0
lea ecx, [esp + 0x79]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5117e0
sub ecx, edx
cmp byte [esp + 0x79], 0x2d
mov dword [esp + 0x38], ecx
jne 0x511805
dec ecx
mov dword [esp + 0x34], 1
lea esi, [esp + 0x7a]
mov dword [esp + 0x38], ecx
mov al, byte [esi]
mov edx, esi
sub al, 0x30
mov dword [esp + 0x40], esi
cmp al, 0xa
jae 0x511821
mov al, byte [edx + 1]
inc edx
sub al, 0x30
cmp al, 0xa
jb 0x511813
mov dword [esp + 0x40], edx
sub edx, esi
mov dword [esp + 0x24], edx
lea edx, [edx + 2]
mov dword [esp + 0x30], edx
je 0x51183e
mov eax, 0xaaaaaaab
mul edx
mov eax, edx
shr eax, 1
dec eax
jmp 0x511844
xor eax, eax
mov dword [esp + 0x30], edx
lea edx, [eax + ecx]
mov dword [esp + 0x28], eax
add edx, edx
cmp byte [esp + 0x1b], 0
jne 0x511874
cmp dword [esp + 0x34], 0
lea eax, [edx + 2]
cmove eax, edx
mov edx, dword [esp + 0x1c]
add eax, edx
cmp dword [ebp + 0x14], eax
jae 0x511874
mov byte [esp + 0x1b], 1
jmp 0x5118e6
mov eax, dword [esp + 0x30]
xor edx, edx
div dword [esp + 0x50]
cmp byte [esp + 0x1b], 0
mov ecx, dword [esp + 0x24]
jne 0x5118de
cmp dword [esp + 0x34], 0
je 0x51189b
mov eax, 0x2d
mov word [ebx], ax
add ebx, 2
mov eax, dword ds:[esp + 0x24]
test eax, eax
je 0x51193f
movsx ax, byte [esi]
dec ecx
inc esi
mov word [ebx], ax
mov eax, edx
add ebx, 2
dec edx
test eax, eax
jne 0x5118da
test ecx, ecx
je 0x5118de
movzx eax, word [0x62e6f8]
dec ecx
mov word [ebx], ax
mov edx, 1
movsx eax, byte [esi]
mov word [ebx + 2], ax
add ebx, 4
inc esi
test ecx, ecx
jne 0x5118a8
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x34], 0
je 0x5118f8
add edx, 2
mov dword [esp + 0x1c], edx
add eax, dword [esp + 0x28]
mov edx, dword [esp + 0x1c]
sub ecx, dword [esp + 0x24]
cmp byte [esp + 0x1b], 0
mov dword [esp + 0x38], ecx
lea esi, [edx + eax*2]
jne 0x51196b
push ebx
push ecx
push dword [esp + 0x48]
call sym.SystemInformer.exe_Ordinal_1461
mov ecx, dword [esp + 0x38]
mov eax, dword [edi*8 + 0x630920]
add eax, 2
lea esi, [esi + ecx*2]
add eax, esi
lea ebx, [ebx + ecx*2]
cmp dword [ebp + 0x14], eax
jae 0x511949
mov byte [esp + 0x1b], 1
jmp 0x51196b
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x1c]
jmp 0x5118ea
mov eax, 0x20
mov word [ebx], ax
lea eax, [ebx + 2]
push dword [edi*8 + 0x630920]
push dword [edi*8 + 0x630924]
push eax
call fcn.00586330
add esp, 0xc
mov ecx, dword [edi*8 + 0x630920]
lea eax, [ecx + 2]
shr eax, 1
lea ebx, [ebx + eax*2]
lea eax, [ecx + 2]
mov dword [esp + 0x2c], ebx
add eax, esi
mov dword [esp + 0x1c], eax
jmp 0x51095e
test dl, dl
jns 0x511996
movzx eax, word [edi + 8]
jmp 0x51199b
mov eax, 0x20
mov edi, esi
mov dword [esp + 0x30], eax
shr edi, 1
test edx, edx
jns 0x5119b1
test edi, edi
je 0x5119f0
mov ecx, edi
mov edi, ebx
jmp 0x5119dd
mov eax, ecx
mov edx, ebx
and eax, 0xfffffffe
sub edx, eax
push ecx
push edx
lfence
lea eax, [edx + edi*2]
mov dword [esp + 0x78], edx
push eax
call fcn.00586330
add esp, 0xc
test edi, edi
je 0x5119f0
mov eax, dword [esp + 0x30]
mov ecx, edi
mov edi, dword [esp + 0x70]
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov eax, esi
shr eax, 1
lea ebx, [ebx + eax*2]
mov eax, dword [esp + 0x1c]
add eax, esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], eax
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov edi, dword [esp + 0x4c]
test ecx, ecx
jne 0x510850
mov dl, byte ds:[esp + 0x1b]
add eax, 2
test dl, dl
jne 0x511a2a
cmp esi, eax
jae 0x511a65
mov dl, 1
mov edi, dword [esp + 0x68]
mov ecx, eax
test edi, edi
je 0x511a3f
test esi, esi
je 0x511a3f
xor eax, eax
mov word [edi], ax
mov eax, ecx
mov ecx, dword [esp + 0x6c]
test ecx, ecx
je 0x511a49
mov dword [ecx], eax
mov ecx, dword [esp + 0x47c]
test dl, dl
pop edi
pop esi
sete al
pop ebx
xor ecx, esp
call fcn.00583f9f
mov esp, ebp
pop ebp
ret 0x14
xor ecx, ecx
mov word [ebx], cx
jmp 0x511a3f