Function at 0x527b60
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x4f4
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x4f0], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, 0x26
mov dword [esp + 0x5c], ecx
cmp eax, edi
mov dword [esp + 0xf4], 0
push 0
cmovae edi, eax
lea eax, [esp + 0xf4]
push 0
push eax
mov dword [esp + 0x44], edi
mov dword [esp + 0xfc], edi
call sym.SystemInformer.exe_PhCreateString3
xor ecx, ecx
mov dword [esp + 0x28], eax
test byte [0x6310a0], 1
mov dword [esp + 0x24], ecx
mov ebx, dword [eax + 4]
mov dword [esp + 0x3c], ebx
jne 0x527cda
mov esi, 0x6310a0
lock bts dword [esi], 0x1f
jb 0x527cc6
push 4
lea eax, [esp + 0xf4]
push eax
push 0xe
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea ecx, [ecx]
test eax, eax
je 0x527c22
mov ax, word [esp + 0xf0]
test ax, ax
je 0x527c22
cmp word [esp + 0xf2], 0
jne 0x527c22
mov word [0x62e688], ax
push 4
lea eax, [esp + 0xf4]
push eax
push 0xf
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x527c5b
mov ax, word [esp + 0xf0]
test ax, ax
je 0x527c5b
cmp word [esp + 0xf2], 0
jne 0x527c5b
mov word [0x62e6e8], ax
cmp word [0x62e688], 0x2e
je 0x527c79
push 0x5c9adc
push 0
call fcn.0058b0db
add esp, 8
mov dword [0x6355f4], eax
lock bts dword ds:[esi], 0
jb 0x527cd8
mov esi, dword [0x6310a4]
test esi, esi
je 0x527c95
push 0
push esi
call dword [sym.imp.ntdll.dll_NtSetEvent]
mov eax, 0xfffffffe
mov ecx, 0x6310a0
lock xadd dword [ecx], eax
shr eax, 1
and eax, 0x7fff
sub eax, 1
jne 0x527cd8
test esi, esi
je 0x527cd8
push esi
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [0x6310a4], 0
jmp 0x527cd8
test byte [0x6310a0], 1
jne 0x527cda
xor edx, edx
mov ecx, esi
call sym.SystemInformer.exe_PhfWaitForEvent
xor ecx, ecx
mov eax, dword ds:[ebp + 0xc]
test eax, eax
je 0x528fcc
fld qword [0x61d478]
fst qword [esp + 0xe0]
fld qword [0x61d400]
fst qword [esp + 0xe8]
mov dword [esp + 0x60], 3
dec eax
mov dword [esp + 0xf0], ecx
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 0x5c]
mov esi, eax
add eax, 0x18
mov dword [esp + 0x44], esi
mov dword [esp + 0x5c], eax
mov dword [esp + 0x34], 0
mov edx, dword [esi]
mov eax, edx
and eax, 0x3f
mov dword [esp + 0x40], edx
cmp eax, 0xc
ja case.default.0x527d49
jmp dword [eax*4 + 0x528ff8]
lea esi, [ecx + 2]
fstp st(1)
fstp st(0)
cmp edi, esi
jae 0x527dc1
lea eax, ds:[edi + edi]
mov dword [esp + 0x74], 0
cmp eax, esi
mov ecx, esi
push 0
cmovae ecx, eax
lea eax, [esp + 0x74]
push 0
push eax
mov dword [esp + 0x44], ecx
mov dword [esp + 0x7c], ecx
call sym.SystemInformer.exe_PhCreateString3
mov ebx, dword [esp + 0x24]
mov edi, eax
mov eax, dword [esp + 0x28]
push ebx
push dword [eax + 4]
push dword [edi + 4]
call fcn.005831c0
mov ecx, dword [esp + 0x34]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x527db5
call fcn.004fbfa0
mov eax, dword [edi + 4]
shr ebx, 1
mov dword [esp + 0x28], edi
lea ebx, [eax + ebx*2]
mov ecx, dword [esp + 0x44]
mov ax, word [ecx + 0x10]
mov ecx, esi
mov word [ebx], ax
add ebx, 2
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x24], ecx
jmp 0x528e5f
add ecx, dword [esi + 0x10]
fstp st(1)
fstp st(0)
cmp edi, ecx
jae 0x527e59
lea eax, [edi + edi]
mov dword [esp + 0x7c], 0
cmp eax, ecx
mov edx, ecx
push 0
cmovae edx, eax
lea eax, [esp + 0x7c]
push 0
push eax
mov dword [esp + 0x44], edx
mov dword [esp + 0x84], edx
call sym.SystemInformer.exe_PhCreateString3
mov ebx, dword [esp + 0x28]
mov esi, eax
mov edi, dword [esp + 0x24]
push edi
push dword [ebx + 4]
push dword [esi + 4]
call fcn.005831c0
add esp, 0xc
lea ecx, [ebx - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x527e45
jmp 0x527e40
call fcn.004fbfa0
mov eax, dword [esi + 4]
mov ecx, edi
shr ecx, 1
mov dword [esp + 0x28], esi
mov esi, dword [esp + 0x44]
lea ebx, [eax + ecx*2]
jmp 0x527e5d
mov edi, dword [esp + 0x24]
push dword [esi + 0x10]
push dword [esi + 0x14]
push ebx
call fcn.005831c0
mov eax, dword [esi + 0x10]
add esp, 0xc
shr eax, 1
add edi, dword [esi + 0x10]
mov dword [esp + 0x24], edi
lea ebx, [ebx + eax*2]
mov dword [esp + 0x3c], ebx
mov ecx, dword [esp + 0x24]
jmp 0x528e5f
push dword [esi + 0x10]
fstp st(1)
fstp st(0)
call sym.SystemInformer.exe_PhCountStringZ
mov edi, dword [esp + 0x24]
mov edx, dword [esp + 0x38]
lea esi, [eax + eax]
add edi, esi
cmp edx, edi
jae 0x527f18
lea eax, [edx + edx]
mov dword [esp + 0x84], 0
cmp eax, edi
mov ecx, edi
push 0
cmovae ecx, eax
lea eax, [esp + 0x84]
push 0
push eax
mov dword [esp + 0x44], ecx
mov dword [esp + 0x8c], ecx
call sym.SystemInformer.exe_PhCreateString3
push dword [esp + 0x24]
mov ebx, eax
mov eax, dword [esp + 0x2c]
push dword [eax + 4]
push dword [ebx + 4]
call fcn.005831c0
mov ecx, dword ds:[esp + 0x34]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x527f08
call fcn.004fbfa0
mov ecx, dword [esp + 0x24]
mov eax, dword [ebx + 4]
shr ecx, 1
mov dword [esp + 0x28], ebx
lea ebx, [eax + ecx*2]
mov ecx, dword [esp + 0x44]
push esi
push dword [ecx + 0x10]
push ebx
call fcn.005831c0
add esp, 0xc
mov ecx, edi
shr esi, 1
mov dword [esp + 0x24], ecx
lea ebx, [ebx + esi*2]
mov dword [esp + 0x3c], ebx
jmp 0x528e5f
fstp st(1)
fstp st(0)
cmp edx, 3
jne 0x527f52
mov ecx, dword [esi + 0x14]
mov esi, dword [esi + 0x10]
mov dword [esp + 0x30], ecx
jmp 0x527f69
mov ecx, dword [esi + 0x10]
mov esi, ecx
mov dword [esp + 0x30], ecx
lea edx, [esi + 1]
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x527f60
sub esi, edx
push esi
push ecx
lea eax, [esp + 0x60]
push eax
call dword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeSize]
test eax, eax
js 0x527e7f
mov edi, dword [esp + 0x24]
mov edx, dword [esp + 0x38]
lfence
mov eax, dword [esp + 0x58]
lea ecx, [eax + edi]
cmp edx, ecx
jae 0x528013
lea eax, [edx + edx]
mov dword [esp + 0x8c], 0
cmp eax, ecx
mov edx, ecx
push 0
cmovae edx, eax
lea eax, [esp + 0x8c]
push 0
push eax
mov dword [esp + 0x44], edx
mov dword [esp + 0x94], edx
call sym.SystemInformer.exe_PhCreateString3
mov ebx, dword [esp + 0x24]
mov edi, eax
mov eax, dword [esp + 0x28]
push ebx
push dword [eax + 4]
push dword [edi + 4]
call fcn.005831c0
mov ecx, dword [esp + 0x34]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x527ff9
call fcn.004fbfa0
mov eax, dword [edi + 4]
mov ecx, ebx
shr ecx, 1
mov dword [esp + 0x28], edi
mov edi, dword [esp + 0x24]
lea ebx, [eax + ecx*2]
mov eax, dword [esp + 0x58]
mov dword [esp + 0x3c], ebx
push esi
push dword [esp + 0x34]
push 0
push eax
push ebx
call dword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
test eax, eax
js 0x527e7f
mov eax, dword [esp + 0x58]
shr eax, 1
add edi, dword [esp + 0x58]
mov dword [esp + 0x24], edi
mov ecx, edi
lea ebx, [ebx + eax*2]
mov dword [esp + 0x3c], ebx
jmp 0x528e5f
mov ecx, 0x10
mov eax, esi
mov eax, dword [eax + ecx]
mov ecx, eax
shr ecx, 0x1f
mov dword [esp + 0x34], ecx
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov edx, dword [esp + 0x40]
jmp 0x52806d
mov ecx, dword [esi + 0x10]
fstp st(1)
fstp st(0)
mov dword ds:[esp + 0x50], 0xa
test edx, 0x100
je 0x52809a
mov al, byte [esi + 0xa]
cmp al, 2
jb 0x52809a
cmp al, 0x45
ja 0x52809a
movzx eax, al
mov dword [esp + 0x50], eax
test edx, 0x20000000
lea edi, [esp + 0x4f6]
mov esi, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
mov eax, 0x618470
cmovne eax, esi
xor esi, esi
mov dword [esp + 0x48], eax
test ecx, ecx
je 0x528175
test edx, 0x10000
je 0x528151
xor eax, eax
mov dword [esp + 0x3c], eax
lea ebx, [ebx]
mov eax, ecx
xor edx, edx
div dword [esp + 0x50]
inc esi
mov ecx, eax
mov eax, dword [esp + 0x48]
movsx ax, byte [eax + edx]
mov word [edi], ax
sub edi, 2
mov eax, dword [esp + 0x3c]
inc eax
mov dword [esp + 0x3c], eax
cmp eax, 3
jne 0x52813a
test ecx, ecx
je 0x52813e
movzx eax, word [0x62e6e8]
xor edx, edx
mov word [edi], ax
mov eax, ecx
div dword [esp + 0x50]
mov dword [esp + 0x3c], 1
mov ecx, eax
mov eax, dword [esp + 0x48]
movsx eax, byte [edx + eax]
mov word [edi - 2], ax
add edi, 0xfffffffc
add esi, 2
test ecx, ecx
jne 0x5280e0
mov edx, dword [esp + 0x40]
xor ecx, ecx
cmp dword [esp + 0x34], ecx
je 0x52818e
mov ecx, 1
jmp 0x52819c
mov ebx, dword [esp + 0x48]
mov eax, ecx
xor edx, edx
div dword [esp + 0x50]
inc esi
mov ecx, eax
movsx ax, byte [ebx + edx]
mov word [edi], ax
sub edi, 2
test ecx, ecx
jne 0x528155
mov ebx, dword [esp + 0x3c]
jmp 0x52813e
mov eax, 0x30
lea edi, [esp + 0x4f4]
mov word [esp + 0x4f6], ax
lea esi, [eax - 0x2f]
jmp 0x528142
test edx, 0x20000
mov eax, 1
cmovne ecx, eax
mov eax, edx
and eax, 0x50000
cmp eax, 0x40000
jne 0x5281cc
mov eax, dword [esp + 0x44]
movzx edx, word [eax + 6]
lea eax, [ecx + esi]
cmp eax, edx
jae 0x5281c8
or dword [esp + 0x34], 4
sub edx, ecx
sub edx, esi
mov dword [esp + 0x64], edx
add ecx, edx
mov edx, dword [esp + 0x40]
lea eax, [ecx + esi]
add edi, 2
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x2c], edi
lea ecx, [ecx + eax*2]
mov eax, dword [esp + 0x38]
mov dword [esp + 0x30], ecx
cmp eax, ecx
jae 0x52825e
add eax, eax
mov dword [esp + 0x94], 0
cmp eax, ecx
mov edx, ecx
push 0
cmovae edx, eax
lea eax, [esp + 0x94]
push 0
push eax
mov dword [esp + 0x44], edx
mov dword [esp + 0x9c], edx
call sym.SystemInformer.exe_PhCreateString3
push dword [esp + 0x24]
mov ebx, eax
mov eax, dword [esp + 0x2c]
push dword [eax + 4]
push dword [ebx + 4]
call fcn.005831c0
mov ecx, dword [esp + 0x34]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x528248
call fcn.004fbfa0
mov ecx, dword [esp + 0x24]
mov eax, dword [ebx + 4]
shr ecx, 1
mov dword [esp + 0x28], ebx
lea ebx, [eax + ecx*2]
mov eax, dword [esp + 0x44]
mov edx, dword [eax]
mov eax, dword [esp + 0x34]
test al, 1
je 0x52826d
mov ecx, 0x2d
jmp 0x52827a
test edx, 0x20000
je 0x528280
mov ecx, 0x2b
mov word [ebx], cx
add ebx, 2
test al, 4
je 0x5282a5
mov edx, dword [esp + 0x64]
test edx, edx
je 0x5282a2
mov ecx, edx
mov eax, 0x300030
shr ecx, 1
mov edi, ebx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x2c]
lea ebx, [ebx + edx*2]
add esi, esi
push esi
push edi
push ebx
call fcn.005831c0
mov ecx, dword [esp + 0x3c]
add esp, 0xc
add ebx, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x3c], ebx
jmp 0x528e5f
mov edx, dword [esi + 0x14]
fstp st(1)
mov eax, dword [esi + 0x10]
fstp st(0)
mov dword [esp + 0x50], eax
test edx, edx
jg 0x5282fc
jl 0x5282dd
test eax, eax
jae 0x5282fc
neg eax
mov dword [esp + 0x34], 1
adc edx, 0
neg edx
jmp 0x5282f8
mov eax, dword [esi + 0x10]
fstp st(1)
mov edx, dword [esi + 0x14]
fstp st(0)
mov dword [esp + 0x50], eax
mov esi, dword [esp + 0x40]
mov dword [esp + 0x30], 0xa
test esi, 0x100
je 0x52832c
mov ecx, dword [esp + 0x44]
mov cl, byte [ecx + 0xa]
cmp cl, 2
jb 0x52832c
lea esp, [esp]
cmp cl, 0x45
ja 0x52832c
movzx ecx, cl
mov dword [esp + 0x30], ecx
test esi, 0x20000000
lea edi, [esp + 0x4f6]
mov esi, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
mov ecx, 0x618470
cmovne ecx, esi
xor esi, esi
or eax, edx
mov dword [esp + 0x2c], ecx
je 0x5283fa
test dword [esp + 0x40], 0x10000
mov ebx, dword [esp + 0x50]
je 0x5283d0
xor eax, eax
mov dword [esp + 0x48], eax
push ebx
push 0
push dword [esp + 0x38]
push edx
push ebx
call fcn.005a02f0
pop ebx
nop
mov ebx, eax
inc esi
mov eax, dword [esp + 0x2c]
movsx cx, byte [eax + ecx]
mov eax, dword [esp + 0x48]
inc eax
mov word [edi], cx
sub edi, 2
cmp eax, 3
jne 0x5283a9
mov eax, ebx
or eax, edx
je 0x5283b3
mov ax, word [0x62e6e8]
mov word [edi], ax
sub edi, 2
inc esi
jmp 0x528362
mov dword [esp + 0x48], eax
mov eax, ebx
or eax, edx
jne 0x528368
mov ebx, dword [esp + 0x3c]
mov eax, dword ds:[esp + 0x40]
xor ecx, ecx
cmp dword [esp + 0x34], ecx
je 0x528413
mov ecx, 1
jmp 0x528420
push ebx
push 0
push dword [esp + 0x38]
push edx
push ebx
call fcn.005a02f0
pop ebx
nop
mov ebx, eax
inc esi
mov eax, dword [esp + 0x2c]
movsx ax, byte [eax + ecx]
mov word [edi], ax
mov eax, ebx
sub edi, 2
or eax, edx
jne 0x5283d0
jmp 0x5283b3
mov eax, 0x30
lea edi, [esp + 0x4f4]
mov word [esp + 0x4f6], ax
lea esi, [eax - 0x2f]
jmp 0x5283b7
test eax, 0x20000
mov edx, 1
cmovne ecx, edx
and eax, 0x50000
cmp eax, 0x40000
jne 0x52844c
mov eax, dword [esp + 0x44]
movzx edx, word [eax + 6]
lea eax, [ecx + esi]
cmp eax, edx
jae 0x52844c
or dword [esp + 0x34], 4
mov eax, edx
sub eax, ecx
sub eax, esi
mov dword [esp + 0x68], eax
add ecx, eax
lea eax, [ecx + esi]
add edi, 2
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x2c], edi
lea ecx, [ecx + eax*2]
mov eax, dword [esp + 0x38]
mov dword [esp + 0x30], ecx
cmp eax, ecx
jae 0x5284e4
add eax, eax
mov dword [esp + 0x9c], 0
cmp eax, ecx
mov edx, ecx
push 0
cmovae edx, eax
lea eax, [esp + 0x9c]
push 0
push eax
mov dword [esp + 0x44], edx
mov dword [esp + 0xa4], edx
call sym.SystemInformer.exe_PhCreateString3
push dword [esp + 0x24]
mov ebx, eax
mov eax, dword [esp + 0x2c]
push dword [eax + 4]
push dword [ebx + 4]
call fcn.005831c0
mov ecx, dword [esp + 0x34]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x5284cc
call fcn.004fbfa0
mov ecx, dword [esp + 0x24]
mov eax, dword [ebx + 4]
shr ecx, 1
mov dword [esp + 0x28], ebx
lea ebx, [eax + ecx*2]
mov eax, dword [esp + 0x44]
mov ecx, dword [eax]
jmp 0x5284e8
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x34]
test al, 1
je 0x5284f7
mov ecx, 0x2d
jmp 0x528504
test ecx, 0x20000
je 0x52850a
mov ecx, 0x2b
mov word [ebx], cx
add ebx, 2
test al, 4
je 0x52852f
mov edx, dword [esp + 0x68]
test edx, edx
je 0x52852c
mov ecx, edx
mov eax, 0x300030
shr ecx, 1
mov edi, ebx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x2c]
lea ebx, [ebx + edx*2]
add esi, esi
push esi
push edi
push ebx
call fcn.005831c0
mov ecx, dword [esp + 0x3c]
add esp, 0xc
add ebx, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x3c], ebx
jmp 0x528e5f
mov dword ds:[esp + 0x34], 0
fstp st(1)
fstp st(0)
test dl, 0x40
je 0x528578
movzx edx, word [esi + 4]
cmp edx, 0xa2
jbe 0x52857d
mov edx, 0xa2
jmp 0x52857d
mov edx, 6
fld qword ds:[esi + 0x10]
sub esp, 0x10
mov edi, dword [esp + 0x50]
lea esi, [esp + 0x109]
mov eax, esi
mov dword [esp + 0x3c], esi
mov ecx, edi
fstp qword [esp + 8]
push eax
call fcn.005723c0
test al, al
jne 0x5285b2
mov byte [esp + 0xf9], al
jmp 0x52860d
mov edx, dword [0x6355f4]
test edx, edx
je 0x5285e5
mov al, byte [esp + 0xf9]
lea ecx, [esp + 0xf9]
test al, al
je 0x5285e5
mov edi, edi
cmp al, 0x2e
je 0x5285de
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x5285d0
jmp 0x5285e5
mov al, byte [0x62e688]
mov byte [ecx], al
test edi, 0x20000000
je 0x52860d
lea eax, [esp + 0xf9]
test edx, edx
je 0x528604
push edx
push eax
call fcn.0058a88c
add esp, 8
jmp 0x52860d
push eax
call fcn.0058a830
add esp, 4
mov eax, dword ds:[esp + 0x44]
mov edx, dword [eax]
mov dword [esp + 0x30], edx
test edx, 0x8000
je 0x5286a6
mov al, byte [esp + 0xf9]
lea ecx, [esp + 0xf9]
mov ah, byte [0x62e688]
test al, al
je 0x528650
cmp al, ah
je 0x528650
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x528644
mov al, byte [ecx]
inc ecx
test al, al
je 0x5286a6
mov al, byte [ecx]
test al, al
je 0x528670
lea ecx, [ecx]
cmp al, 0x65
je 0x528670
cmp al, 0x45
je 0x528670
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x528660
mov al, byte [ecx - 1]
mov esi, ecx
dec ecx
cmp al, 0x30
jne 0x528688
lea ebx, [ebx]
mov al, byte [ecx - 1]
dec ecx
cmp al, 0x30
je 0x528680
cmp al, ah
lea edx, [ecx - 1]
cmovne edx, ecx
mov al, byte [esi]
lea edx, [edx + 1]
mov byte [edx], al
lea esi, [esi + 1]
test al, al
jne 0x528690
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
lea edi, [esp + 0xf9]
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x5286b0
sub edi, ecx
cmp byte [esp + 0xf9], 0x2d
mov dword [esp + 0x30], edi
jne 0x5286dd
dec edi
mov dword [esp + 0x34], 1
lea esi, [esp + 0xfa]
mov dword [esp + 0x30], edi
jmp 0x5286f3
mov ecx, dword [esp + 0x34]
test edx, 0x20000
mov eax, 2
cmovne ecx, eax
mov dword [esp + 0x34], ecx
mov eax, edx
and eax, 0x13000
cmp eax, 0x10000
jne 0x528897
mov al, byte [esi]
mov ecx, esi
sub al, 0x30
mov dword [esp + 0x50], esi
cmp al, 0xa
jae 0x52872e
lea esp, [esp]
mov al, byte [ecx + 1]
inc ecx
sub al, 0x30
cmp al, 0xa
jb 0x528720
mov dword [esp + 0x50], ecx
sub ecx, esi
mov dword [esp + 0x30], ecx
lea ecx, [ecx + 2]
mov dword [esp + 0x2c], ecx
je 0x52874b
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
shr eax, 1
dec eax
jmp 0x528751
xor eax, eax
mov dword [esp + 0x2c], ecx
lea ecx, [eax + edi]
mov dword [esp + 0x48], eax
add ecx, ecx
cmp dword [esp + 0x34], 0
lea eax, [ecx + 2]
cmove eax, ecx
mov ecx, dword [esp + 0x24]
add ecx, eax
mov eax, dword [esp + 0x38]
cmp eax, ecx
jae 0x5287e4
add eax, eax
mov dword [esp + 0xa4], 0
cmp eax, ecx
mov edx, ecx
push 0
cmovae edx, eax
lea eax, [esp + 0xa4]
push 0
push eax
mov dword [esp + 0x44], edx
mov dword [esp + 0xac], edx
call sym.SystemInformer.exe_PhCreateString3
push dword [esp + 0x24]
mov ebx, eax
mov eax, dword [esp + 0x2c]
push dword [eax + 4]
push dword [ebx + 4]
call fcn.005831c0
mov ecx, dword [esp + 0x34]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x5287d4
call fcn.004fbfa0
mov edx, dword [esp + 0x24]
mov ecx, dword [ebx + 4]
shr edx, 1
mov dword [esp + 0x28], ebx
lea ebx, [ecx + edx*2]
mov eax, dword [esp + 0x2c]
xor edx, edx
div dword [esp + 0x60]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
test al, 1
je 0x528802
mov eax, 0x2d
jmp 0x52880b
test al, 2
je 0x528811
mov eax, 0x2b
mov word [ebx], ax
add ebx, 2
mov eax, dword [esp + 0x30]
test eax, eax
je 0x52885a
lea esp, [esp]
movsx ax, byte [esi]
dec ecx
inc esi
mov word [ebx], ax
mov eax, edx
add ebx, 2
dec edx
test eax, eax
jne 0x528852
test ecx, ecx
je 0x528856
movzx eax, word [0x62e6e8]
dec ecx
mov word [ebx], ax
mov edx, 1
movsx eax, byte [esi]
mov word [ebx + 2], ax
add ebx, 4
inc esi
test ecx, ecx
jne 0x528820
mov eax, dword [esp + 0x30]
cmp dword [esp + 0x34], 0
mov edx, ebx
mov esi, dword [esp + 0x24]
je 0x52886a
add esi, 2
mov ecx, edi
sub ecx, eax
mov eax, dword [esp + 0x48]
add eax, edi
push edx
push ecx
lea ebx, [ebx + ecx*2]
lea esi, [esi + eax*2]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x2c], esi
mov esi, dword [esp + 0x58]
push esi
call sym.SystemInformer.exe_PhZeroExtendToUtf16Buffer
mov ecx, dword [esp + 0x24]
jmp 0x528e5f
mov eax, dword [esp + 0x44]
xor ecx, ecx
cmp dword [esp + 0x34], ecx
setne cl
test dword [eax], 0x40000
mov edx, ecx
je 0x5288d3
movzx eax, word [eax + 6]
mov dword [esp + 0x2c], eax
lea eax, [ecx + edi]
cmp eax, dword [esp + 0x2c]
jae 0x5288d3
mov eax, dword [esp + 0x2c]
or dword [esp + 0x34], 4
sub eax, ecx
sub eax, edi
mov dword [esp + 0x6c], eax
lea edx, [ecx + eax]
mov ecx, dword [esp + 0x24]
lea eax, [edx + edi]
lea ecx, [ecx + eax*2]
mov eax, dword [esp + 0x38]
mov dword [esp + 0x2c], ecx
cmp eax, ecx
jae 0x528958
add eax, eax
mov dword [esp + 0xac], 0
cmp eax, ecx
mov edx, ecx
push 0
cmovae edx, eax
lea eax, [esp + 0xac]
push 0
push eax
mov dword [esp + 0x44], edx
mov dword [esp + 0xb4], edx
call sym.SystemInformer.exe_PhCreateString3
push dword [esp + 0x24]
mov ebx, eax
mov eax, dword [esp + 0x2c]
push dword [eax + 4]
push dword [ebx + 4]
call fcn.005831c0
mov ecx, dword [esp + 0x34]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x528948
call fcn.004fbfa0
mov ecx, dword [esp + 0x24]
mov eax, dword [ebx + 4]
shr ecx, 1
mov dword [esp + 0x28], ebx
lea ebx, [eax + ecx*2]
mov eax, dword ds:[esp + 0x34]
test al, 1
je 0x52896b
mov ecx, 0x2d
jmp 0x528974
test al, 2
je 0x52897a
mov ecx, 0x2b
mov word [ebx], cx
add ebx, 2
test al, 4
je 0x52899f
mov edx, dword [esp + 0x6c]
test edx, edx
je 0x52899c
mov ecx, edx
mov eax, 0x300030
shr ecx, 1
mov edi, ebx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x30]
lea ebx, [ebx + edx*2]
mov eax, dword [esp + 0x2c]
mov edx, ebx
push edx
mov ecx, edi
mov dword [esp + 0x28], eax
push ecx
lea ebx, [ebx + edi*2]
push esi
mov dword [esp + 0x48], ebx
call sym.SystemInformer.exe_PhZeroExtendToUtf16Buffer
mov ecx, dword ds:[esp + 0x24]
jmp 0x528e5f
mov eax, dword [esp + 0x44]
xor edi, edi
mov esi, dword [esi + 0x10]
mov dword [esp + 0xb0], esi
mov dword [esp + 0xb8], edi
mov edx, dword [eax + 0x14]
mov eax, edx
mov ecx, edx
mov dword [esp + 0x3c], edi
and eax, 0x7fffffff
and ecx, 0x80000000
or esi, edx
mov dword [esp + 0xb4], eax
fild qword [esp + 0xb0]
mov dword [esp + 0xbc], ecx
fild qword [esp + 0xb8]
fchs
faddp st(1)
jne 0x528aaf
mov esi, dword [esp + 0x24]
fstp st(0)
mov eax, dword [esp + 0x38]
add esi, 2
fstp st(1)
fstp st(0)
cmp eax, esi
jae 0x528a95
add eax, eax
mov dword [esp + 0xc4], edi
cmp eax, esi
mov ecx, esi
push edi
cmovae ecx, eax
lea eax, [esp + 0xc4]
push edi
push eax
mov dword [esp + 0x44], ecx
mov dword [esp + 0xcc], ecx
call sym.SystemInformer.exe_PhCreateString3
mov ebx, dword [esp + 0x24]
mov edi, eax
mov eax, dword [esp + 0x28]
push ebx
push dword [eax + 4]
push dword [edi + 4]
call fcn.005831c0
mov ecx, dword [esp + 0x34]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x528a89
call fcn.004fbfa0
mov eax, dword [edi + 4]
shr ebx, 1
mov dword [esp + 0x28], edi
lea ebx, [eax + ebx*2]
mov eax, 0x30
mov ecx, esi
mov word [ebx], ax
add ebx, 2
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x24], ecx
jmp 0x528e5f
mov edx, dword [esp + 0x40]
mov esi, dword [esp + 0x44]
test edx, 0x100
je 0x528ac5
movzx ecx, byte [esi + 0xa]
jmp 0x528acb
mov ecx, dword [0x631938]
fcomi st(2)
jb 0x528ae3
cmp edi, 7
jae 0x528adf
cmp edi, ecx
jae 0x528adf
fmul st(1)
inc edi
fcomi st(2)
jae 0x528acf
mov dword [esp + 0x3c], edi
fstp st(2)
fstp st(0)
test dl, 0x40
je 0x528af2
movzx eax, word [esi + 4]
jmp 0x528af7
mov eax, 2
movzx edx, ax
lea edi, [esp + 0xf9]
cmp edx, 0xa2
mov dword [esp + 0x50], 0
mov eax, 0xa2
mov ecx, 0x1804b
cmova edx, eax
sub esp, 0x10
mov eax, edi
fstp qword [esp + 8]
push eax
call fcn.005723c0
test al, al
jne 0x528b3a
xor dl, dl
mov byte [esp + 0xf9], dl
jmp 0x528b75
cmp dword [0x6355f4], 0
mov dl, byte [esp + 0xf9]
je 0x528b75
lea ecx, [esp + 0xf9]
test dl, dl
je 0x528b75
mov al, dl
cmp al, 0x2e
je 0x528b66
mov al, byte ds:[ecx + 1]
inc ecx
test al, al
jne 0x528b57
jmp 0x528b75
mov ax, word [0x62e688]
mov byte [ecx], al
mov dl, byte [esp + 0xf9]
lea ecx, ds:[esp + 0xf9]
test dl, dl
je 0x528b96
mov al, dl
cmp al, byte [0x62e688]
je 0x528b96
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x528b86
mov al, byte [ecx]
inc ecx
test al, al
je 0x528beb
mov al, byte ds:[ecx]
test al, al
je 0x528bb4
cmp al, 0x65
je 0x528bb4
cmp al, 0x45
je 0x528bb4
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x528ba4
mov al, byte [ecx - 1]
mov esi, ecx
dec ecx
cmp al, 0x30
jne 0x528bc8
mov edi, edi
mov al, byte [ecx - 1]
dec ecx
cmp al, 0x30
je 0x528bc0
cmp al, byte [0x62e688]
lea edx, [ecx - 1]
cmovne edx, ecx
mov al, byte ds:[esi]
lea edx, [edx + 1]
mov byte [edx], al
lea esi, [esi + 1]
test al, al
jne 0x528bd4
mov dl, byte [esp + 0xf9]
lea esi, [esp + 0xf9]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x528bf5
sub esi, ecx
mov dword [esp + 0x34], esi
cmp dl, 0x2d
jne 0x528c22
mov dl, byte [esp + 0xfa]
lea edi, [esp + 0xfa]
dec esi
mov dword [esp + 0x50], 1
mov dword [esp + 0x34], esi
sub dl, 0x30
mov dword [esp + 0x48], edi
mov ecx, edi
cmp dl, 0xa
jae 0x528c3e
mov al, byte [ecx + 1]
inc ecx
sub al, 0x30
cmp al, 0xa
jb 0x528c30
mov dword [esp + 0x48], ecx
sub ecx, edi
mov dword [esp + 0x30], ecx
lea ecx, [ecx + 2]
mov dword [esp + 0x2c], ecx
je 0x528c5b
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
shr eax, 1
dec eax
jmp 0x528c61
xor eax, eax
mov dword [esp + 0x2c], ecx
lea ecx, ds:[eax + esi]
mov dword [esp + 0x40], eax
add ecx, ecx
cmp dword [esp + 0x50], 0
lea eax, [ecx + 2]
cmove eax, ecx
mov ecx, dword [esp + 0x24]
add ecx, eax
mov eax, dword [esp + 0x38]
cmp eax, ecx
jae 0x528cf8
add eax, eax
mov dword [esp + 0xcc], 0
cmp eax, ecx
mov edx, ecx
push 0
cmovae edx, eax
lea eax, [esp + 0xcc]
push 0
push eax
mov dword [esp + 0x44], edx
mov dword [esp + 0xd4], edx
call sym.SystemInformer.exe_PhCreateString3
push dword [esp + 0x24]
mov ebx, eax
mov eax, dword [esp + 0x2c]
push dword [eax + 4]
push dword [ebx + 4]
call fcn.005831c0
mov ecx, dword ds:[esp + 0x34]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x528ce8
call fcn.004fbfa0
mov edx, dword [esp + 0x24]
mov ecx, dword [ebx + 4]
shr edx, 1
mov dword [esp + 0x28], ebx
lea ebx, [ecx + edx*2]
mov eax, dword [esp + 0x2c]
xor edx, edx
div dword [esp + 0x60]
cmp dword [esp + 0x50], 0
mov ecx, dword [esp + 0x30]
je 0x528d18
mov eax, 0x2d
mov word [ebx], ax
add ebx, 2
mov eax, dword ds:[esp + 0x30]
test eax, eax
je 0x528d5e
movsx ax, byte [edi]
dec ecx
inc edi
mov word [ebx], ax
mov eax, edx
add ebx, 2
dec edx
test eax, eax
jne 0x528d56
test ecx, ecx
je 0x528d5a
movzx eax, word [0x62e6e8]
dec ecx
mov word [ebx], ax
mov edx, 1
movsx eax, byte [edi]
mov word [ebx + 2], ax
add ebx, 4
inc edi
test ecx, ecx
jne 0x528d24
mov eax, dword [esp + 0x30]
cmp dword [esp + 0x50], 0
je 0x528d6a
add dword [esp + 0x24], 2
push ebx
sub esi, eax
push esi
push dword [esp + 0x50]
call sym.SystemInformer.exe_PhZeroExtendToUtf16Buffer
mov eax, dword [esp + 0x34]
lea edi, [ebx + esi*2]
add eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
lea ebx, [ecx + eax*2]
mov ecx, dword [esi*8 + 0x6310b0]
mov dword [esp + 0x2c], ebx
lea eax, [ecx + 2]
add eax, ebx
cmp edx, eax
jae 0x528e17
add ecx, 2
mov dword [esp + 0xd4], 0
lea eax, [edx + edx]
add ecx, ebx
cmp eax, ecx
push 0
cmovae ecx, eax
lea eax, [esp + 0xd4]
push 0
push eax
mov dword [esp + 0x44], ecx
mov dword [esp + 0xdc], ecx
call sym.SystemInformer.exe_PhCreateString3
mov edi, eax
mov eax, dword [esp + 0x28]
push ebx
push dword [eax + 4]
push dword [edi + 4]
call fcn.005831c0
mov ecx, dword [esp + 0x34]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x528e09
call fcn.004fbfa0
mov eax, dword [edi + 4]
mov ecx, ebx
shr ecx, 1
mov dword [esp + 0x28], edi
lea edi, [eax + ecx*2]
mov eax, 0x20
mov word [edi], ax
lea eax, [edi + 2]
push dword [esi*8 + 0x6310b0]
push dword [esi*8 + 0x6310b4]
push eax
call fcn.005831c0
mov ecx, dword [esi*8 + 0x6310b0]
add esp, 0xc
lea eax, [ecx + 2]
shr eax, 1
lea ebx, [edi + eax*2]
mov eax, dword [esp + 0x2c]
add eax, 2
mov dword [esp + 0x3c], ebx
add ecx, eax
mov dword [esp + 0x24], ecx
jmp 0x528e5f
fstp st(1)
fstp st(0)
mov eax, dword [esp + 0x44]
mov edi, ecx
sub edi, dword [esp + 0xf0]
test dword [eax], 0xc0000000
je 0x528faa
movzx esi, word ds:[eax + 6]
add esi, esi
cmp edi, esi
jae 0x528faa
mov edx, dword [esp + 0x38]
sub esi, edi
add ecx, esi
mov dword [esp + 0x48], ecx
cmp edx, ecx
jae 0x528f13
lea eax, [edx + edx]
mov dword [esp + 0xdc], 0
cmp eax, ecx
mov edx, ecx
push 0
cmovae edx, eax
lea eax, [esp + 0xdc]
push 0
push eax
mov dword [esp + 0x44], edx
mov dword [esp + 0xe4], edx
call sym.SystemInformer.exe_PhCreateString3
push dword ds:[esp + 0x24]
mov ebx, eax
mov eax, dword [esp + 0x2c]
push dword [eax + 4]
push dword [ebx + 4]
call fcn.005831c0
mov ecx, dword [esp + 0x34]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x528eff
call fcn.004fbfa0
mov ecx, dword [esp + 0x24]
mov eax, dword [ebx + 4]
shr ecx, 1
mov dword [esp + 0x28], ebx
lea ebx, [eax + ecx*2]
mov eax, dword [esp + 0x44]
mov ecx, dword [eax]
test cl, cl
jns 0x528f1f
movzx eax, word [eax + 8]
jmp 0x528f24
mov eax, 0x20
shr esi, 1
mov dword [esp + 0x2c], eax
test ecx, ecx
jns 0x528f4d
test esi, esi
je 0x528f49
movzx edx, ax
mov ecx, esi
mov eax, edx
mov edi, ebx
shl edx, 0x10
or eax, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
add esi, esi
jmp 0x528f9c
mov eax, edi
mov ecx, ebx
and eax, 0xfffffffe
sub ecx, eax
lea eax, [esi + esi]
push edi
mov dword [esp + 0x34], eax
add eax, ecx
push ecx
lfence
push eax
mov dword [esp + 0xfc], ecx
call fcn.005831c0
add esp, 0xc
test esi, esi
je 0x528f98
mov eax, dword [esp + 0x2c]
mov ecx, esi
mov edi, dword [esp + 0xf0]
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x48]
add ebx, esi
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x24], ecx
mov eax, dword ds:[ebp + 0xc]
fld qword [esp + 0xe0]
fld qword [esp + 0xe8]
mov edi, dword [esp + 0x38]
test eax, eax
jne 0x527d0a
fstp st(1)
fstp st(0)
mov edx, dword [esp + 0x28]
xor esi, esi
pop edi
mov eax, dword [edx + 4]
mov dword [edx], ecx
shr ecx, 1
mov word [eax + ecx*2], si
mov eax, edx
mov ecx, dword [esp + 0x4f8]
pop esi
pop ebx
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret 0xc