Function at 0x7ff7c00efb50
Capabilities:
Get geographical location

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r15
lea rbp, [rsp - 0x3c8]
sub rsp, 0x4c8
mov rax, qword [0x7ff7c01ca008]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov r13d, 0x1e
mov edi, edx
mov rdx, qword [0x7ff7c01d3b58]
cmp r8, r13
mov rbx, rcx
cmovae r13, r8
mov qword [rsp + 0x40], r13
lea rcx, [r13 + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov r8, rax
mov qword [rsp + 0x48], r9
mov r15d, r9d
mov qword [rax], r13
add rax, 0x10
mov qword [r8 + 8], rax
mov word [rax + r13], r9w
test byte [0x7ff7c01d0bd0], 1
mov rsi, qword [r8 + 8]
jne 0x7ff7c00efcaa
lock bts qword [0x7ff7c01d0bd0], 0x1f
jb 0x7ff7c00efc8b
lea r9d, [r15 + 4]
mov ecx, 0x400
lea r8, [rbp - 0x80]
lea edx, [r15 + 0xe]
call qword [sym.imp.kernel32.dll_GetLocaleInfoW]
test eax, eax
je 0x7ff7c00efc21
mov rax, qword [rbp - 0x80]
test ax, ax
je 0x7ff7c00efc21
movzx edx, word [0x7ff7c01d0be0]
cmp word [rbp - 0x7e], r15w
cmove dx, ax
mov word [0x7ff7c01d0be0], dx
mov r9d, 4
lea r8, [rbp - 0x80]
mov ecx, 0x400
lea edx, [r9 + 0xb]
call qword [sym.imp.kernel32.dll_GetLocaleInfoW]
test eax, eax
je 0x7ff7c00efc5e
mov rax, qword [rbp - 0x80]
test ax, ax
je 0x7ff7c00efc5e
movzx edx, word [0x7ff7c01d0be4]
cmp word [rbp - 0x7e], r15w
cmove dx, ax
mov word [0x7ff7c01d0be4], dx
cmp word [0x7ff7c01d0be0], 0x2e
je 0x7ff7c00efc7d
lea rdx, [0x7ff7c0152200]
xor ecx, ecx
call fcn.7ff7c012c1c8
mov qword [0x7ff7c01d75b0], rax
lea rcx, [0x7ff7c01d0bd0]
call sym.ProcessHacker.exe_PhfSetEvent
jmp 0x7ff7c00efca2
test byte [0x7ff7c01d0bd0], 1
jne 0x7ff7c00efcaa
xor edx, edx
lea rcx, [0x7ff7c01d0bd0]
call sym.ProcessHacker.exe_PhfWaitForEvent
mov r8, qword [rsp + 0x30]
xor r9d, r9d
nop word [rax + rax]
test edi, edi
je 0x7ff7c00f0efd
mov qword [rsp + 0x508], r12
lea r10, [0x7ff7bffc0000]
mov qword [rsp + 0x4c0], r14
mov r8d, 2
movaps xmmword [rsp + 0x4b0], xmm6
movsd xmm6, qword [0x7ff7c01a9500]
movaps xmmword [rsp + 0x4a0], xmm7
movsd xmm7, qword [0x7ff7c01a94a8]
jmp 0x7ff7c00efd03
xor r9d, r9d
mov r14, rbx
mov qword [rsp + 0x50], rbx
dec edi
mov qword [rsp + 0x70], r15
mov rdx, rbx
mov dword [rsp + 0x64], edi
add rbx, 0x20
mov r12d, r9d
mov r11d, dword [r14]
mov eax, r11d
and eax, 0x3f
mov qword [rsp + 0x78], rbx
cmp eax, 0xc
ja case.default.0x7ff7c00efd46
cdqe
mov ecx, dword [r10 + rax*4 + 0x130f34]
add rcx, r10
jmp rcx
lea rbx, ds:[r15 + 2]
cmp r13, rbx
jae 0x7ff7c00efdcd
mov rdx, qword [0x7ff7c01d3b58]
lea rax, [r13*2]
cmp rax, rbx
mov rsi, rbx
cmovae rsi, rax
mov qword [rsp + 0x40], rsi
lea rcx, [rsi + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
xor edx, edx
mov r8, r15
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], rsi
mov qword [rax + 8], rcx
mov word [rsi + rcx], dx
mov rsi, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [rsi + 8]
call fcn.7ff7c0125120
lea rcx, [rsi - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x7ff7c00efdbd
call fcn.7ff7c00c6290
mov rax, qword [rdi + 8]
shr r15, 1
mov qword [rsp + 0x30], rdi
lea rsi, [rax + r15*2]
movzx eax, word [r14 + 0x10]
mov r15, rbx
mov word [rsi], ax
add rsi, 2
mov qword [rsp + 0x48], rbx
jmp case.default.0x7ff7c00efd46
mov r8, qword ds:[r14 + 0x10]
lea rcx, [r8 + r15]
cmp r13, rcx
jae 0x7ff7c00efe74
mov rdx, qword [0x7ff7c01d3b58]
lea rax, [r13*2]
cmp rax, rcx
mov rbx, rcx
cmovae rbx, rax
mov qword [rsp + 0x40], rbx
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
xor edx, edx
mov r8, r15
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rbx + rcx], dx
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
call fcn.7ff7c0125120
lea rcx, [rbx - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x7ff7c00efe5d
call fcn.7ff7c00c6290
mov rax, qword [rdi + 8]
mov rcx, r15
mov r8, qword [r14 + 0x10]
shr rcx, 1
mov qword [rsp + 0x30], rdi
lea rsi, [rax + rcx*2]
mov rdx, qword [r14 + 0x18]
mov rcx, rsi
call fcn.7ff7c0125120
mov rax, qword ds:[r14 + 0x10]
shr rax, 1
add r15, qword [r14 + 0x10]
jmp 0x7ff7c00f0d72
mov rcx, qword [r14 + 0x10]
call sym.ProcessHacker.exe_PhCountStringZ
lea rdi, [rax + rax]
lea r14, [rdi + r15]
cmp r13, r14
jae 0x7ff7c00eff2a
mov rdx, qword [0x7ff7c01d3b58]
lea rax, ds:[r13*2]
cmp rax, r14
mov rsi, r14
cmovae rsi, rax
mov qword [rsp + 0x40], rsi
lea rcx, [rsi + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
xor edx, edx
mov r8, r15
mov rbx, rax
lea rcx, [rax + 0x10]
mov qword [rax], rsi
mov qword [rax + 8], rcx
mov word [rsi + rcx], dx
mov rsi, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [rsi + 8]
call fcn.7ff7c0125120
lea rcx, ds:[rsi - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x7ff7c00eff1a
call fcn.7ff7c00c6290
mov rax, qword [rbx + 8]
shr r15, 1
mov qword [rsp + 0x30], rbx
lea rsi, [rax + r15*2]
mov rax, qword [rsp + 0x50]
mov r8, rdi
mov rcx, rsi
mov rdx, qword [rax + 0x10]
call fcn.7ff7c0125120
shr rdi, 1
mov r15, r14
mov qword [rsp + 0x48], r14
mov r14, qword [rsp + 0x50]
lea rsi, [rsi + rdi*2]
jmp case.default.0x7ff7c00efd46
cmp r11d, 3
jne 0x7ff7c00eff67
mov rbx, qword [r14 + 0x18]
mov rdi, qword [r14 + 0x10]
jmp 0x7ff7c00eff7b
mov rbx, qword [r14 + 0x10]
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], 0
jne 0x7ff7c00eff72
mov r8d, edi
lea rcx, [rsp + 0x58]
mov rdx, rbx
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeSize]
nop dword [rax]
test eax, eax
js case.default.0x7ff7c00efd46
mov edx, dword [rsp + 0x58]
lea rcx, [r15 + rdx]
cmp r13, rcx
jae 0x7ff7c00f0031
mov rdx, qword [0x7ff7c01d3b58]
lea rax, ds:[r13*2]
cmp rax, rcx
mov r12, rcx
cmovae r12, rax
mov qword [rsp + 0x40], r12
lea rcx, [r12 + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
xor edx, edx
mov r8, r15
mov rsi, rax
lea rcx, [rax + 0x10]
mov qword [rax], r12
mov qword [rax + 8], rcx
mov word [r12 + rcx], dx
mov r12, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [r12 + 8]
call fcn.7ff7c0125120
lea rcx, ds:[r12 - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x7ff7c00f001a
call fcn.7ff7c00c6290
mov rax, qword [rsi + 8]
mov rcx, r15
mov edx, dword [rsp + 0x58]
shr rcx, 1
mov qword [rsp + 0x30], rsi
lea rsi, [rax + rcx*2]
mov r9, rbx
mov dword [rsp + 0x20], edi
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
test eax, eax
js case.default.0x7ff7c00efd46
mov ecx, dword [rsp + 0x58]
mov eax, ecx
jmp 0x7ff7c00f0d6c
mov eax, dword [r14 + 0x10]
mov r12d, eax
mov edi, eax
shr r12d, 0x1f
neg edi
test eax, eax
cmovns edi, eax
jmp 0x7ff7c00f0071
mov edi, dword [r14 + 0x10]
mov r10d, 0xa
bt r11d, 8
jae 0x7ff7c00f008d
movzx ecx, byte [r14 + 0xa]
lea eax, [rcx - 2]
cmp al, 0x43
ja 0x7ff7c00f008d
mov r10d, ecx
bt r11d, 0x1d
lea r9, [0x7ff7c01d19c0]
lea rax, [0x7ff7c01d1970]
cmovae r9, rax
lea rbx, [rbp + 0x38e]
xor r13d, r13d
mov r14d, r13d
test edi, edi
je 0x7ff7c00f012e
bt r11d, 0x10
jae 0x7ff7c00f0110
mov r8d, r13d
xor edx, edx
mov eax, edi
div r10d
inc r14d
inc r8d
mov edi, eax
movsx ecx, byte [rdx + r9]
mov word [rbx], cx
sub rbx, 2
cmp r8d, 3
jne 0x7ff7c00f00fc
test eax, eax
je 0x7ff7c00f0100
movzx eax, word [0x7ff7c01d0be4]
mov r8d, r13d
mov word [rbx], ax
sub rbx, 2
inc r14d
test edi, edi
jne 0x7ff7c00f00c3
mov eax, 1
test r12d, r12d
je 0x7ff7c00f014b
mov ecx, eax
jmp 0x7ff7c00f0156
xor edx, edx
mov eax, edi
div r10d
inc r14d
mov edi, eax
movsx ecx, byte [rdx + r9]
mov word [rbx], cx
sub rbx, 2
test eax, eax
jne 0x7ff7c00f0110
jmp 0x7ff7c00f0100
mov eax, 0x30
lea rbx, [rbp + 0x38c]
mov word [rbp + 0x38e], ax
mov eax, 1
mov r14d, eax
jmp 0x7ff7c00f0105
bt r11d, 0x11
mov ecx, r13d
cmovb ecx, eax
mov r13, qword [rsp + 0x50]
and r11d, 0x50000
cmp r11d, 0x40000
jne 0x7ff7c00f0189
movzx edx, word [r13 + 6]
lea eax, [rcx + r14]
cmp eax, edx
jae 0x7ff7c00f0189
mov eax, edx
or r12d, 4
sub eax, ecx
sub eax, r14d
mov dword [rsp + 0x5c], eax
add ecx, eax
lea eax, [rcx + r14]
lea r15, [r15 + rax*2]
mov rax, qword [rsp + 0x40]
cmp rax, r15
jae 0x7ff7c00f0218
mov rdx, qword [0x7ff7c01d3b58]
add rax, rax
cmp rax, r15
mov rsi, r15
cmovae rsi, rax
mov qword [rsp + 0x40], rsi
lea rcx, [rsi + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
xor edx, edx
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], rsi
mov qword [rax + 8], rcx
mov word [rcx + rsi], dx
mov rdx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
mov rcx, qword [rax + 8]
mov r8, rsi
mov rdx, qword [rdx + 8]
call fcn.7ff7c0125120
mov rcx, qword [rsp + 0x30]
mov edx, 0xffffffff
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x7ff7c00f0208
call fcn.7ff7c00c6290
mov rax, qword [rdi + 8]
shr rsi, 1
mov qword [rsp + 0x30], rdi
lea rsi, [rax + rsi*2]
test r12b, 1
je 0x7ff7c00f0225
mov eax, 0x2d
jmp 0x7ff7c00f0234
test dword [r13], 0x20000
je 0x7ff7c00f023b
mov eax, 0x2b
mov word [rsi], ax
add rsi, 2
test r12b, 4
je 0x7ff7c00f025f
mov edx, dword [rsp + 0x5c]
test rdx, rdx
je 0x7ff7c00f025b
mov eax, 0x30
mov rdi, rsi
movzx eax, ax
mov rcx, rdx
rep stosw word [rdi], ax
lea rsi, [rsi + rdx*2]
mov edi, r14d
lea rdx, [rbx + 2]
add rdi, rdi
mov rcx, rsi
mov r8, rdi
call fcn.7ff7c0125120
mov r14, qword [rsp + 0x50]
add rsi, rdi
jmp 0x7ff7c00f0d76
mov rax, qword [rdx + 0x10]
mov r12, rax
cqo
mov rdi, rax
shr r12, 0x3f
xor rdi, rdx
sub rdi, rdx
jmp 0x7ff7c00f029e
mov rdi, qword [r14 + 0x10]
mov r9d, 0xa
bt r11d, 8
jae 0x7ff7c00f02bb
movzx eax, byte [r14 + 0xa]
cmp al, 2
jb 0x7ff7c00f02bb
cmp al, 0x45
ja 0x7ff7c00f02bb
mov r9d, eax
bt r11d, 0x1d
lea r10, [0x7ff7c01d19c0]
lea rax, [0x7ff7c01d1970]
cmovae r10, rax
lea rbx, [rbp + 0x38e]
xor r13d, r13d
mov r14d, r13d
test rdi, rdi
je 0x7ff7c00f0377
bt r11d, 0x10
jae 0x7ff7c00f0350
mov r8d, r13d
xor edx, edx
mov rax, rdi
div r9
inc r14d
inc r8d
mov rdi, rax
mov eax, edx
movsx ecx, byte [rax + r10]
mov word [rbx], cx
sub rbx, 2
cmp r8d, 3
jne 0x7ff7c00f0330
test rdi, rdi
je 0x7ff7c00f0335
movzx eax, word [0x7ff7c01d0be4]
mov r8d, r13d
mov word [rbx], ax
sub rbx, 2
inc r14d
test rdi, rdi
jne 0x7ff7c00f02f2
mov eax, 1
test r12d, r12d
je 0x7ff7c00f0394
mov ecx, eax
jmp 0x7ff7c00f039f
xor edx, edx
mov rax, rdi
div r9
inc r14d
mov rdi, rax
mov eax, edx
movsx ecx, byte [rax + r10]
mov word [rbx], cx
sub rbx, 2
test rdi, rdi
jne 0x7ff7c00f0350
jmp 0x7ff7c00f0335
mov eax, 0x30
lea rbx, [rbp + 0x38c]
mov word [rbp + 0x38e], ax
mov eax, 1
mov r14d, eax
jmp 0x7ff7c00f033a
bt r11d, 0x11
mov ecx, r13d
cmovb ecx, eax
mov r13, qword ds:[rsp + 0x50]
and r11d, 0x50000
cmp r11d, 0x40000
jne 0x7ff7c00f03d7
movzx edx, word [r13 + 6]
lea eax, [rcx + r14]
cmp eax, edx
jae 0x7ff7c00f03d7
mov eax, edx
or r12d, 4
sub eax, ecx
sub eax, r14d
mov dword [rsp + 0x60], eax
add ecx, eax
lea eax, [rcx + r14]
lea r15, [r15 + rax*2]
mov rax, qword [rsp + 0x40]
cmp rax, r15
jae 0x7ff7c00f046a
mov rdx, qword [0x7ff7c01d3b58]
add rax, rax
cmp rax, r15
mov rsi, r15
cmovae rsi, rax
mov qword [rsp + 0x40], rsi
lea rcx, [rsi + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rdi, rax
xor edx, edx
lea rcx, [rax + 0x10]
mov qword [rax], rsi
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x30]
mov word [rcx + rsi], dx
mov rsi, qword [rsp + 0x48]
mov rcx, qword [rdi + 8]
mov r8, rsi
mov rdx, qword [rax + 8]
call fcn.7ff7c0125120
mov rcx, qword [rsp + 0x30]
mov edx, 0xffffffff
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x7ff7c00f045a
call fcn.7ff7c00c6290
mov rax, qword [rdi + 8]
shr rsi, 1
mov qword [rsp + 0x30], rdi
lea rsi, [rax + rsi*2]
nop word [rax + rax]
test r12b, 1
je 0x7ff7c00f047d
mov eax, 0x2d
jmp 0x7ff7c00f048c
test dword [r13], 0x20000
je 0x7ff7c00f0493
mov eax, 0x2b
mov word [rsi], ax
add rsi, 2
test r12b, 4
je 0x7ff7c00f025f
mov edx, dword [rsp + 0x60]
jmp 0x7ff7c00f0245
test r11b, 0x40
je 0x7ff7c00f04c0
movzx r8d, word [r14 + 4]
mov eax, 0xa2
cmp r8d, eax
jbe 0x7ff7c00f04c6
mov r8d, eax
jmp 0x7ff7c00f04c6
mov r8d, 6
movsd xmm0, qword [r14 + 0x10]
lea r9, [rbp - 0x6f]
mov edx, r11d
lea rbx, [rbp - 0x6f]
call fcn.7ff7c00ef970
mov edx, dword [r14]
bt edx, 0xf
jae 0x7ff7c00f04f1
lea rcx, [rbp - 0x6f]
call fcn.7ff7c00efac0
mov edx, dword [r14]
lea rax, [rbp - 0x6f]
mov r14, 0xffffffffffffffff
nop dword [rax]
inc r14
cmp byte [rax + r14], 0
jne 0x7ff7c00f0500
cmp byte ds:[rbp - 0x6f], 0x2d
jne 0x7ff7c00f0523
dec r14d
lea rbx, [rbp - 0x6e]
xor ecx, ecx
mov r13d, 1
jmp 0x7ff7c00f0538
mov ecx, 0
bt edx, 0x11
mov r13d, ecx
mov eax, 2
cmovb r13d, eax
mov eax, edx
and eax, 0x13000
cmp eax, 0x10000
jne 0x7ff7c00f076c
movzx eax, byte [rbx]
mov rdi, rbx
sub al, 0x30
cmp al, 0xa
jae 0x7ff7c00f056d
nop word [rax + rax]
movzx eax, byte [rdi + 1]
inc rdi
sub al, 0x30
cmp al, 0xa
jb 0x7ff7c00f0560
mov r15d, edi
sub r15d, ebx
mov dword [rsp + 0x38], r15d
je 0x7ff7c00f0592
lea ecx, ds:[r15 + 2]
mov eax, 0xaaaaaaab
mul ecx
mov r12d, edx
shr r12d, 1
dec r12d
jmp 0x7ff7c00f0595
mov r12d, ecx
mov r10, qword [rsp + 0x48]
lea eax, [r12 + r14]
lea ecx, [rax + rax]
test r13d, r13d
lea eax, [rcx + 2]
cmove eax, ecx
mov ecx, eax
mov rax, qword [rsp + 0x40]
add rcx, r10
cmp rax, rcx
jae 0x7ff7c00f0644
add rax, rax
mov rdx, rcx
cmp rax, rcx
cmovae rdx, rax
mov qword [rsp + 0x40], rdx
lea rcx, [rdx + 0x12]
mov rdx, qword [0x7ff7c01d3b58]
call sym.ProcessHacker.exe_PhCreateObject
mov r8, qword [rsp + 0x48]
mov rsi, rax
mov rax, qword [rsp + 0x40]
lea rcx, [rsi + 0x10]
xor edx, edx
mov qword [rsi + 8], rcx
mov qword [rsi], rax
mov word [rcx + rax], dx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsi + 8]
mov rdx, qword [rax + 8]
call fcn.7ff7c0125120
mov rcx, qword [rsp + 0x30]
mov edx, 0xffffffff
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x7ff7c00f062c
call fcn.7ff7c00c6290
mov r10, qword [rsp + 0x48]
mov rax, qword [rsi + 8]
mov rcx, r10
shr rcx, 1
mov qword [rsp + 0x30], rsi
lea rsi, [rax + rcx*2]
lea r8d, [r15 + 2]
mov eax, 0xaaaaaaab
mul r8d
mov ecx, r15d
shr edx, 1
lea eax, [rdx + rdx*2]
sub r8d, eax
test r13b, 1
je 0x7ff7c00f0668
mov eax, 0x2d
jmp 0x7ff7c00f0673
test r13b, 2
je 0x7ff7c00f067a
mov eax, 0x2b
mov word [rsi], ax
add rsi, 2
test r15d, r15d
je 0x7ff7c00f06c6
mov r15d, 2
nop word [rax + rax]
movsx eax, byte [rbx]
lea rbx, [rbx + 1]
mov word [rsi], ax
dec ecx
mov eax, r8d
add rsi, r15
dec r8d
test eax, eax
jne 0x7ff7c00f06bd
test ecx, ecx
je 0x7ff7c00f06c1
movzx eax, word [0x7ff7c01d0be4]
mov r8d, r15d
mov word [rsi], ax
add rsi, r15
test ecx, ecx
jne 0x7ff7c00f0690
mov r15d, dword [rsp + 0x38]
test r13d, r13d
lea r9, [r10 + 2]
mov rcx, rsi
cmove r9, r10
sub r14d, r15d
mov edx, r14d
lea r10d, [r12 + r15]
mov r8d, r14d
and rdx, 0xfffffffffffffffc
je 0x7ff7c00f071c
nop word [rax + rax]
movzx eax, byte [rdi]
mov word [rcx], ax
movzx eax, byte [rdi + 1]
mov word [rcx + 2], ax
movzx eax, byte [rdi + 2]
mov word [rcx + 4], ax
movzx eax, byte [rdi + 3]
add rdi, 4
mov word [rcx + 6], ax
add rcx, 8
sub rdx, 4
jne 0x7ff7c00f06f0
mov rax, r8
and eax, 3
sub rax, 1
je 0x7ff7c00f0750
sub rax, 1
je 0x7ff7c00f0743
nop
cmp rax, 1
jne 0x7ff7c00f0756
movzx eax, byte [rdi]
mov word [rcx], ax
add rcx, 2
inc rdi
movzx eax, byte [rdi]
mov word [rcx], ax
add rcx, 2
inc rdi
movzx eax, byte [rdi]
mov word [rcx], ax
lea rax, [r14 + r10]
lea rsi, [rsi + r14*2]
mov r14, qword [rsp + 0x50]
lea r15, [r9 + rax*2]
jmp 0x7ff7c00f0d76
test r13d, r13d
setne cl
mov r15, rcx
bt edx, 0x12
jae 0x7ff7c00f07aa
mov rax, qword ds:[rsp + 0x50]
mov edx, r14d
movzx edi, word [rax + 6]
lea rax, [rcx + rdx]
cmp rax, rdi
jae 0x7ff7c00f07aa
mov r15d, edi
or r13d, 4
sub r15, rdx
mov rax, r15
sub rax, rcx
mov qword [rsp + 0x68], rax
mov r12, qword [rsp + 0x48]
mov r14d, r14d
lea rax, [r14 + r15]
lea rcx, [r12 + rax*2]
mov rax, qword [rsp + 0x40]
cmp rax, rcx
jae 0x7ff7c00f083a
mov rdx, qword [0x7ff7c01d3b58]
add rax, rax
cmp rax, rcx
mov rsi, rcx
cmovae rsi, rax
mov qword [rsp + 0x40], rsi
lea rcx, [rsi + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
xor edx, edx
mov r8, r12
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], rsi
mov qword [rax + 8], rcx
mov word [rcx + rsi], dx
mov rsi, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [rsi + 8]
call fcn.7ff7c0125120
lea rcx, [rsi - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x7ff7c00f0827
call fcn.7ff7c00c6290
mov rax, qword [rdi + 8]
mov rcx, r12
shr rcx, 1
mov qword [rsp + 0x30], rdi
lea rsi, [rax + rcx*2]
test r13b, 1
je 0x7ff7c00f0847
mov eax, 0x2d
jmp 0x7ff7c00f0852
test r13b, 2
je 0x7ff7c00f0859
mov eax, 0x2b
mov word [rsi], ax
add rsi, 2
test r13b, 4
je 0x7ff7c00f087e
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x7ff7c00f087a
mov eax, 0x30
mov rdi, rsi
movzx eax, ax
mov rcx, rdx
rep stosw word [rdi], ax
lea rsi, [rsi + rdx*2]
mov rdx, r14
mov rcx, rsi
and rdx, 0xfffffffffffffffc
je 0x7ff7c00f08bc
nop word [rax + rax]
movzx eax, byte [rbx]
mov word [rcx], ax
movzx eax, byte [rbx + 1]
mov word [rcx + 2], ax
movzx eax, byte [rbx + 2]
mov word [rcx + 4], ax
movzx eax, byte [rbx + 3]
add rbx, 4
mov word [rcx + 6], ax
add rcx, 8
sub rdx, 4
jne 0x7ff7c00f0890
mov rax, r14
and eax, 3
sub rax, 1
je 0x7ff7c00f08f0
sub rax, 1
je 0x7ff7c00f08e3
nop
cmp rax, 1
jne 0x7ff7c00f08f6
movzx eax, byte [rbx]
mov word [rcx], ax
add rcx, 2
inc rbx
movzx eax, byte [rbx]
mov word [rcx], ax
add rcx, 2
inc rbx
movzx eax, byte [rbx]
mov word [rcx], ax
lea rax, [r14 + r15]
mov r15, r12
lea rsi, [rsi + r14*2]
mov r14, qword [rsp + 0x50]
lea r15, [r12 + rax*2]
jmp 0x7ff7c00f0d76
mov rdx, qword [r14 + 0x10]
mov ebx, r9d
xorps xmm0, xmm0
test rdx, rdx
js 0x7ff7c00f0925
cvtsi2sd xmm0, rdx
jmp 0x7ff7c00f093d
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2sd xmm0, rcx
addsd xmm0, xmm0
test rdx, rdx
jne 0x7ff7c00f09e3
lea rbx, [r15 + 2]
cmp r13, rbx
jae 0x7ff7c00f09ca
mov rdx, qword [0x7ff7c01d3b58]
lea rax, [r13*2]
cmp rax, rbx
mov rsi, rbx
cmovae rsi, rax
mov qword [rsp + 0x40], rsi
lea rcx, [rsi + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
xor edx, edx
mov r8, r15
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], rsi
mov qword [rax + 8], rcx
mov word [rcx + rsi], dx
mov rsi, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [rsi + 8]
call fcn.7ff7c0125120
lea rcx, ds:[rsi - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x7ff7c00f09ba
call fcn.7ff7c00c6290
mov rax, qword [rdi + 8]
shr r15, 1
mov qword [rsp + 0x30], rdi
lea rsi, [rax + r15*2]
mov eax, 0x30
mov qword [rsp + 0x48], rbx
mov word [rsi], ax
mov r15, rbx
add rsi, 2
jmp case.default.0x7ff7c00efd46
bt r11d, 8
jae 0x7ff7c00f09f2
movzx eax, byte ds:[r14 + 0xa]
jmp 0x7ff7c00f09f8
mov eax, dword [0x7ff7c01d1968]
comisd xmm0, xmm6
jb 0x7ff7c00f0a15
nop
cmp ebx, 7
jae 0x7ff7c00f0a15
cmp ebx, eax
jae 0x7ff7c00f0a15
mulsd xmm0, xmm7
inc ebx
comisd xmm0, xmm6
jae 0x7ff7c00f0a00
test r11b, 0x40
je 0x7ff7c00f0a22
movzx eax, word [r14 + 4]
jmp 0x7ff7c00f0a25
mov eax, r8d
movzx r8d, ax
lea r15, [rbp - 0x6f]
mov eax, 0xa2
mov dword [rsp + 0x38], r9d
cmp r8d, eax
lea r9, [rbp - 0x6f]
mov edx, 0x1804b
cmova r8d, eax
call fcn.7ff7c00ef970
lea rcx, [rbp - 0x6f]
call fcn.7ff7c00efac0
lea rax, [rbp - 0x6f]
mov r14, 0xffffffffffffffff
inc r14
cmp byte [rax + r14], 0
jne 0x7ff7c00f0a60
cmp byte ds:[rbp - 0x6f], 0x2d
jne 0x7ff7c00f0a87
mov eax, 1
lea r15, [rbp - 0x6e]
mov r10d, eax
mov dword [rsp + 0x38], eax
dec r14d
jmp 0x7ff7c00f0a8a
mov r10d, r12d
movzx eax, byte [r15]
mov rdi, r15
sub al, 0x30
cmp al, 0xa
jae 0x7ff7c00f0aad
nop word [rax + rax]
movzx eax, byte [rdi + 1]
inc rdi
sub al, 0x30
cmp al, 0xa
jb 0x7ff7c00f0aa0
mov r13d, edi
sub r13d, r15d
je 0x7ff7c00f0acb
lea ecx, [r13 + 2]
mov eax, 0xaaaaaaab
mul ecx
mov r12d, edx
shr r12d, 1
dec r12d
jmp 0x7ff7c00f0ad0
xor eax, eax
mov r12d, eax
mov r11, qword ds:[rsp + 0x48]
lea eax, [r12 + r14]
lea ecx, [rax + rax]
test r10d, r10d
lea eax, [rcx + 2]
cmove eax, ecx
mov ecx, eax
mov rax, qword [rsp + 0x40]
add rcx, r11
cmp rax, rcx
jae 0x7ff7c00f0b85
add rax, rax
mov rdx, rcx
cmp rax, rcx
cmovae rdx, rax
mov qword [rsp + 0x40], rdx
lea rcx, [rdx + 0x12]
mov rdx, qword [0x7ff7c01d3b58]
call sym.ProcessHacker.exe_PhCreateObject
mov r8, qword [rsp + 0x48]
mov rsi, rax
mov rax, qword [rsp + 0x40]
lea rcx, [rsi + 0x10]
xor edx, edx
mov qword [rsi + 8], rcx
mov qword [rsi], rax
mov word [rcx + rax], dx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsi + 8]
mov rdx, qword [rax + 8]
call fcn.7ff7c0125120
mov rcx, qword [rsp + 0x30]
mov edx, 0xffffffff
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x7ff7c00f0b68
call fcn.7ff7c00c6290
mov r11, qword [rsp + 0x48]
mov rax, qword [rsi + 8]
mov rcx, r11
mov r10d, dword [rsp + 0x38]
shr rcx, 1
mov qword [rsp + 0x30], rsi
lea rsi, [rax + rcx*2]
lea r8d, [r13 + 2]
mov eax, 0xaaaaaaab
mul r8d
mov ecx, r13d
shr edx, 1
lea eax, [rdx + rdx*2]
sub r8d, eax
test r10d, r10d
je 0x7ff7c00f0bad
mov eax, 0x2d
mov word [rsi], ax
add rsi, 2
nop dword [rax]
test r13d, r13d
je 0x7ff7c00f0bf9
mov r10d, 2
nop dword [rax + rax]
movsx eax, byte [r15]
lea r15, [r15 + 1]
mov word [rsi], ax
dec ecx
mov eax, r8d
add rsi, r10
dec r8d
test eax, eax
jne 0x7ff7c00f0bee
test ecx, ecx
je 0x7ff7c00f0bf4
movzx eax, word [0x7ff7c01d0be4]
mov r8d, r10d
mov word [rsi], ax
add rsi, r10
nop
test ecx, ecx
jne 0x7ff7c00f0bc0
mov r10d, dword [rsp + 0x38]
test r10d, r10d
lea r9, [r11 + 2]
lea r10d, [r12 + r13]
mov rcx, rsi
cmove r9, r11
sub r14d, r13d
mov edx, r14d
mov r8d, r14d
and rdx, 0xfffffffffffffffc
je 0x7ff7c00f0c4c
nop word [rax + rax]
movzx eax, byte [rdi]
mov word [rcx], ax
movzx eax, byte [rdi + 1]
mov word [rcx + 2], ax
movzx eax, byte [rdi + 2]
mov word [rcx + 4], ax
movzx eax, byte [rdi + 3]
add rdi, 4
mov word [rcx + 6], ax
add rcx, 8
sub rdx, 4
jne 0x7ff7c00f0c20
mov rax, r8
and eax, 3
sub rax, 1
je 0x7ff7c00f0c7e
sub rax, 1
je 0x7ff7c00f0c71
cmp rax, 1
jne 0x7ff7c00f0c84
movzx eax, byte [rdi]
mov word [rcx], ax
add rcx, 2
inc rdi
movzx eax, byte [rdi]
mov word [rcx], ax
add rcx, 2
inc rdi
movzx eax, byte [rdi]
mov word [rcx], ax
mov r12, qword [rsp + 0x40]
lea rax, [r10 + r14]
mov edi, ebx
lea rsi, [rsi + r14*2]
add rdi, rdi
lea r14, [r9 + rax*2]
lea r15, [0x7ff7bffc0000]
lea rax, [r14 + 2]
mov rcx, qword [r15 + rdi*8 + 0x210c20]
add rax, rcx
cmp r12, rax
jae 0x7ff7c00f0d36
mov rdx, qword [0x7ff7c01d3b58]
lea rax, [r12 + r12]
lea r12, [rcx + 2]
add r12, r14
cmp rax, r12
cmovae r12, rax
mov qword [rsp + 0x40], r12
lea rcx, [r12 + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rsi, qword [rsp + 0x30]
mov rbx, rax
mov r8, r14
lea rcx, [rax + 0x10]
mov qword [rax], r12
mov qword [rax + 8], rcx
xor eax, eax
mov word [rcx + r12], ax
mov rdx, qword [rsi + 8]
mov rcx, qword [rbx + 8]
call fcn.7ff7c0125120
lea rcx, [rsi - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x7ff7c00f0d23
call fcn.7ff7c00c6290
mov rax, qword [rbx + 8]
mov rcx, r14
shr rcx, 1
mov qword [rsp + 0x30], rbx
lea rsi, [rax + rcx*2]
mov eax, 0x20
lea rcx, [rsi + 2]
mov word [rsi], ax
mov r8, qword [r15 + rdi*8 + 0x210c20]
mov rdx, qword [r15 + rdi*8 + 0x210c28]
call fcn.7ff7c0125120
mov rcx, qword [r15 + rdi*8 + 0x210c20]
lea r15, [r14 + 2]
mov r14, qword [rsp + 0x50]
lea rax, [rcx + 2]
shr rax, 1
add r15, rcx
lea rsi, [rsi + rax*2]
mov qword [rsp + 0x48], r15
mov eax, dword ds:[r14]
mov rdi, r15
sub rdi, qword [rsp + 0x70]
test eax, 0xc0000000
je 0x7ff7c00f0eb2
movzx ebx, word [r14 + 6]
add rbx, rbx
cmp rdi, rbx
jae 0x7ff7c00f0eb2
mov rcx, qword [rsp + 0x40]
sub rbx, rdi
lea r13, [rbx + r15]
cmp rcx, r13
jae 0x7ff7c00f0e41
mov rdx, qword [0x7ff7c01d3b58]
lea rax, [rcx + rcx]
cmp rax, r13
mov r12, r13
cmovae r12, rax
mov qword [rsp + 0x40], r12
lea rcx, [r12 + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rsi, rax
mov r8, r15
lea rcx, [rax + 0x10]
mov qword [rax], r12
mov qword [rax + 8], rcx
xor eax, eax
mov word [r12 + rcx], ax
mov r12, qword [rsp + 0x30]
mov rcx, qword [rsi + 8]
mov rdx, qword [r12 + 8]
call fcn.7ff7c0125120
lea rcx, [r12 - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x7ff7c00f0e2e
call fcn.7ff7c00c6290
mov rax, qword [rsi + 8]
shr r15, 1
mov qword [rsp + 0x30], rsi
lea rsi, [rax + r15*2]
mov eax, dword [r14]
test al, al
jns 0x7ff7c00f0e4c
movzx r12d, word [r14 + 8]
jmp 0x7ff7c00f0e52
mov r12d, 0x20
shr rbx, 1
test eax, eax
jns 0x7ff7c00f0e72
test rbx, rbx
je 0x7ff7c00f0e6b
movzx eax, r12w
mov rdi, rsi
mov rcx, rbx
rep stosw word [rdi], ax
lea r14, ds:[rbx + rbx]
jmp 0x7ff7c00f0ea7
mov rax, rdi
lea r14, [rbx + rbx]
shr rax, 1
mov r15, rsi
add rax, rax
mov r8, rdi
sub r15, rax
mov rdx, r15
lea rcx, [r15 + r14]
call fcn.7ff7c0125120
test rbx, rbx
je 0x7ff7c00f0ea7
movzx eax, r12w
mov rdi, r15
mov rcx, rbx
rep stosw word [rdi], ax
add rsi, r14
mov qword [rsp + 0x48], r13
mov r15, r13
mov edi, dword ds:[rsp + 0x64]
lea r10, [0x7ff7bffc0000]
mov r13, qword [rsp + 0x40]
mov r8d, 2
mov rbx, qword [rsp + 0x78]
test edi, edi
jne 0x7ff7c00efd00
mov r8, qword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x4a0]
movaps xmm6, xmmword [rsp + 0x4b0]
mov r14, qword [rsp + 0x4c0]
mov r12, qword [rsp + 0x508]
mov rcx, qword [r8 + 8]
mov qword [r8], r15
shr r15, 1
xor eax, eax
mov word [rcx + r15*2], ax
mov rax, r8
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.7ff7c0121390
add rsp, 0x4c8
pop r15
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
nop
ret