Function at 0x14012cfc0
Capabilities:
Get geographical location

Disassembly:
mov r11, rsp
push rbp
push rsi
push r13
push r14
lea rbp, [r11 - 0x3f8]
sub rsp, 0x4d8
mov rax, qword [0x140237008]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov r14, qword [rbp + 0x420]
mov rax, rcx
mov qword [r11 + 0x10], rbx
mov ebx, edx
mov qword [r11 - 0x28], rdi
mov rdi, r8
mov qword [r11 - 0x30], r12
mov r12, r8
mov qword [rsp + 0x78], r8
xor r8d, r8d
test r12, r12
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x60], rcx
mov r13d, r8d
sete sil
mov qword [rbp - 0x80], r14
test byte [0x14023e830], 1
jne 0x14012d115
lock bts qword [0x14023e830], 0x1f
nop dword [rax]
jb 0x14012d0f1
lea r9d, [r8 + 4]
mov ecx, 0x400
lea r8, [rbp - 0x78]
lea edx, [r13 + 0xe]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
nop dword [rax]
test eax, eax
je 0x14012d084
mov rax, qword [rbp - 0x78]
test ax, ax
je 0x14012d084
movzx edx, word [0x14023e638]
cmp word [rbp - 0x76], r13w
cmove dx, ax
mov word [0x14023e638], dx
mov r9d, 4
lea r8, [rbp - 0x78]
mov ecx, 0x400
lea edx, [r9 + 0xb]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
nop dword [rax]
test eax, eax
je 0x14012d0c4
mov rax, qword [rbp - 0x78]
test ax, ax
je 0x14012d0c4
movzx edx, word [0x14023e8b0]
cmp word [rbp - 0x76], r13w
cmove dx, ax
mov word [0x14023e8b0], dx
cmp word [0x14023e638], 0x2e
je 0x14012d0e3
lea rdx, [0x1401b790c]
xor ecx, ecx
call fcn.140191588
mov qword [0x140244e00], rax
lea rcx, [0x14023e830]
call sym.ProcessHacker.exe_PhfSetEvent
jmp 0x14012d108
test byte [0x14023e830], 1
jne 0x14012d115
xor edx, edx
lea rcx, [0x14023e830]
call sym.ProcessHacker.exe_PhfWaitForEvent
mov rax, qword [rsp + 0x60]
xor r8d, r8d
mov r9, qword [rsp + 0x38]
test ebx, ebx
je 0x14012df34
mov qword [rsp + 0x4c0], r15
lea r11, [0x140000000]
movaps xmmword [rsp + 0x4b0], xmm6
movsd xmm6, qword [0x140211988]
movaps xmmword [rsp + 0x4a0], xmm7
movsd xmm7, qword [0x140211930]
mov byte [rsp + 0x30], sil
jmp 0x14012d168
mov r9, qword [rsp + 0x38]
xor r8d, r8d
mov rdx, rax
mov qword [rsp + 0x40], rax
mov rdi, rax
mov r10, rax
add rax, 0x20
dec ebx
mov qword [rsp + 0x60], rax
mov r14d, r8d
mov r15d, dword [rdx]
mov eax, r15d
and eax, 0x3f
mov dword [rsp + 0x68], ebx
mov rbx, r13
mov qword [rsp + 0x48], rbx
cmp eax, 0xc
ja case.default.0x14012d1b6
cdqe
mov ecx, dword [r11 + rax*4 + 0x12dfac]
add rcx, r11
jmp rcx
test sil, sil
jne 0x14012d1e2
lea rax, [r13 + 2]
cmp r9, rax
jae 0x14012d1d8
add r12, 2
mov byte [rsp + 0x30], 1
add r13, 2
jmp case.default.0x14012d1b6
movzx eax, word [r10 + 0x10]
mov word [r12], ax
add r12, 2
add r13, 2
jmp case.default.0x14012d1b6
test sil, sil
jne 0x14012d22b
mov r8, qword ds:[r10 + 0x10]
lea rax, [r8 + r13]
cmp r9, rax
jae 0x14012d21c
mov rax, r8
mov byte [rsp + 0x30], 1
shr rax, 1
add r13, r8
lea r12, [r12 + rax*2]
jmp case.default.0x14012d1b6
mov rdx, qword [r10 + 0x18]
mov rcx, r12
call fcn.140188690
mov r10, rdi
mov rax, qword [r10 + 0x10]
shr rax, 1
add r13, qword [r10 + 0x10]
lea r12, [r12 + rax*2]
jmp case.default.0x14012d1b6
mov rcx, qword [r10 + 0x10]
call sym.ProcessHacker.exe_PhCountStringZ
test sil, sil
mov rsi, qword [rsp + 0x38]
lea rdi, [rax + rax]
jne 0x14012d27a
lea rax, [rdi + r13]
cmp rsi, rax
jae 0x14012d266
mov byte [rsp + 0x30], 1
jmp 0x14012d27a
mov rax, qword [rsp + 0x40]
mov r8, rdi
mov rcx, r12
mov rdx, qword [rax + 0x10]
call fcn.140188690
mov r10, qword [rsp + 0x40]
mov rax, rdi
shr rax, 1
add r13, rdi
lea r12, [r12 + rax*2]
jmp 0x14012de52
cmp r15d, 3
jne 0x14012d2a2
mov rbx, qword ds:[r10 + 0x18]
mov rdi, qword [rdx + 0x10]
jmp 0x14012d2b9
mov rbx, qword [rdx + 0x10]
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp byte [rbx + rdi], 0
jne 0x14012d2b0
mov r8d, edi
lea rcx, [rsp + 0x50]
mov rdx, rbx
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeSize]
test eax, eax
js 0x14012da9f
test sil, sil
mov rsi, qword [rsp + 0x38]
jne 0x14012d312
mov ecx, dword [rsp + 0x50]
lea rax, [rcx + r13]
cmp rsi, rax
jae 0x14012d2f0
mov byte [rsp + 0x30], 1
jmp 0x14012d316
lfence
mov edx, dword [rsp + 0x50]
mov r9, rbx
xor r8d, r8d
mov dword [rsp + 0x20], edi
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
test eax, eax
js 0x14012dab3
mov ecx, dword [rsp + 0x50]
mov r10, qword [rsp + 0x40]
mov rax, rcx
mov rbx, qword [rsp + 0x48]
shr rax, 1
add r13, rcx
lea r12, [r12 + rax*2]
jmp 0x14012de52
mov eax, dword [r10 + 0x10]
mov r14d, eax
mov edi, eax
shr r14d, 0x1f
neg edi
test eax, eax
cmovns edi, eax
jmp 0x14012d34c
mov edi, dword [r10 + 0x10]
mov r11d, 0xa
bt r15d, 8
jae 0x14012d368
movzx ecx, byte [r10 + 0xa]
lea eax, [rcx - 2]
cmp al, 0x43
ja 0x14012d368
mov r11d, ecx
bt r15d, 0x1d
lea r10, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
lea rax, str.0123456789abcdefghijklmnopqrstuvwxyz_________._:_________
cmovae r10, rax
lea r9, [rbp + 0x38e]
xor esi, esi
mov ebx, esi
test edi, edi
je 0x14012d416
bt r15d, 0x10
jae 0x14012d3f0
mov r8d, esi
nop dword [rax]
xor edx, edx
mov eax, edi
div r11d
inc ebx
inc r8d
mov edi, eax
movsx ecx, byte [rdx + r10]
mov word [r9], cx
sub r9, 2
cmp r8d, 3
jne 0x14012d3de
test eax, eax
je 0x14012d40c
movzx eax, word [0x14023e8b0]
mov r8d, esi
mov word [r9], ax
sub r9, 2
inc ebx
nop
test edi, edi
jne 0x14012d3a0
lea eax, [rdi + 1]
lea edi, [rax + 0x2f]
jmp 0x14012d430
xor edx, edx
mov eax, edi
div r11d
inc ebx
mov edi, eax
movsx ecx, byte [rdx + r10]
mov word [r9], cx
sub r9, 2
test eax, eax
jne 0x14012d3f0
mov eax, 1
lea edi, [rax + 0x2f]
jmp 0x14012d430
mov edi, 0x30
lea r9, [rbp + 0x38c]
mov eax, 1
mov word [rbp + 0x38e], di
mov ebx, eax
test r14d, r14d
je 0x14012d439
mov esi, eax
jmp 0x14012d441
bt r15d, 0x11
cmovb esi, eax
mov eax, r15d
and eax, 0x50000
cmp eax, 0x40000
jne 0x14012d476
mov rax, qword ds:[rsp + 0x40]
movzx ecx, word [rax + 6]
lea eax, [rsi + rbx]
cmp eax, ecx
jae 0x14012d476
mov edx, ecx
or r14d, 4
sub edx, esi
sub edx, ebx
mov dword [rsp + 0x54], edx
add esi, edx
jmp 0x14012d47a
mov edx, dword [rsp + 0x54]
cmp byte ds:[rsp + 0x30], 0
jne 0x14012d4fd
lea eax, [rsi + rbx]
lea rax, [rax*2]
add rax, r13
cmp qword [rsp + 0x38], rax
jae 0x14012d4a9
lea eax, [rsi + rbx]
mov byte [rsp + 0x30], 1
lea r13, [r13 + rax*2]
jmp 0x14012de43
test r14b, 1
je 0x14012d4b6
mov eax, 0x2d
jmp 0x14012d4c2
bt r15d, 0x11
jae 0x14012d4cb
mov eax, 0x2b
mov word [r12], ax
add r12, 2
test r14b, 4
je 0x14012d4e6
test rdx, rdx
je 0x14012d4e2
movzx eax, di
mov rcx, rdx
mov rdi, r12
rep stosw word [rdi], ax
lea r12, [r12 + rdx*2]
mov edi, ebx
lea rdx, [r9 + 2]
add rdi, rdi
mov rcx, r12
mov r8, rdi
call fcn.140188690
add r12, rdi
lea eax, [rsi + rbx]
lea r13, [r13 + rax*2]
jmp 0x14012de43
mov rax, qword [rdi + 0x10]
mov r14, rax
cqo
mov rdi, rax
shr r14, 0x3f
xor rdi, rdx
sub rdi, rdx
jmp 0x14012d526
mov rdi, qword [r10 + 0x10]
mov r10d, 0xa
bt r15d, 8
jae 0x14012d547
mov rax, qword ds:[rsp + 0x40]
movzx ecx, byte [rax + 0xa]
lea eax, [rcx - 2]
cmp al, 0x43
ja 0x14012d547
mov r10d, ecx
bt r15d, 0x1d
lea r11, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
lea rax, str.0123456789abcdefghijklmnopqrstuvwxyz_________._:_________
cmovae r11, rax
lea r9, [rbp + 0x38e]
xor esi, esi
mov ebx, esi
test rdi, rdi
je 0x14012d5fb
bt r15d, 0x10
jae 0x14012d5d0
mov r8d, esi
nop dword [rax]
xor edx, edx
mov rax, rdi
div r10
inc ebx
inc r8d
mov rdi, rax
mov eax, edx
movsx ecx, byte [rax + r11]
mov word [r9], cx
sub r9, 2
cmp r8d, 3
jne 0x14012d5bf
test rdi, rdi
je 0x14012d5f1
movzx eax, word [0x14023e8b0]
mov r8d, esi
mov word [r9], ax
sub r9, 2
inc ebx
nop
test rdi, rdi
jne 0x14012d580
lea eax, [rdi + 1]
lea edi, [rax + 0x2f]
jmp 0x14012d615
xor edx, edx
mov rax, rdi
div r10
inc ebx
mov rdi, rax
mov eax, edx
movsx ecx, byte [rax + r11]
mov word [r9], cx
sub r9, 2
test rdi, rdi
jne 0x14012d5d0
mov eax, 1
lea edi, [rax + 0x2f]
jmp 0x14012d615
mov edi, 0x30
lea r9, [rbp + 0x38c]
mov eax, 1
mov word [rbp + 0x38e], di
mov ebx, eax
test r14d, r14d
je 0x14012d61e
mov esi, eax
jmp 0x14012d626
bt r15d, 0x11
cmovb esi, eax
mov eax, r15d
and eax, 0x50000
cmp eax, 0x40000
jne 0x14012d657
mov rax, qword [rsp + 0x40]
movzx ecx, word [rax + 6]
lea eax, [rsi + rbx]
cmp eax, ecx
jae 0x14012d657
mov edx, ecx
or r14d, 4
sub edx, esi
sub edx, ebx
mov dword [rsp + 0x58], edx
add esi, edx
jmp 0x14012d65b
mov edx, dword [rsp + 0x58]
cmp byte [rsp + 0x30], 0
jne 0x14012d4fd
lea eax, [rsi + rbx]
lea rax, [rax*2]
add rax, r13
cmp qword [rsp + 0x38], rax
jae 0x14012d68d
lea eax, [rsi + rbx]
mov byte [rsp + 0x30], 1
lea r13, [r13 + rax*2]
jmp 0x14012de43
test r14b, 1
je 0x14012d69a
mov eax, 0x2d
jmp 0x14012d6a7
bt r15d, 0x11
jae 0x14012d6b0
mov eax, 0x2b
mov word [r12], ax
add r12, 2
test r14b, 4
je 0x14012d6cb
test rdx, rdx
je 0x14012d6c7
movzx eax, di
mov rcx, rdx
mov rdi, r12
rep stosw word [rdi], ax
lea r12, [r12 + rdx*2]
mov edi, ebx
lea rdx, [r9 + 2]
add rdi, rdi
mov rcx, r12
mov r8, rdi
call fcn.140188690
lea eax, [rsi + rbx]
add r12, rdi
lea r13, [r13 + rax*2]
jmp 0x14012de43
mov esi, r8d
test r15b, 0x40
je 0x14012d70c
movzx r8d, word [r10 + 4]
mov eax, 0xa2
cmp r8d, eax
jbe 0x14012d712
mov r8d, eax
jmp 0x14012d712
mov r8d, 6
movsd xmm0, qword [r10 + 0x10]
lea r9, [rbp - 0x6f]
mov edx, r15d
lea rbx, [rbp - 0x6f]
call fcn.140175aa0
test al, al
jne 0x14012d731
mov byte [rbp - 0x6f], al
jmp 0x14012d78c
mov rdx, qword [0x140244e00]
test rdx, rdx
je 0x14012d76b
movzx eax, byte [rbp - 0x6f]
test al, al
je 0x14012d76b
lea rcx, [rbp - 0x6f]
nop dword [rax]
cmp al, 0x2e
je 0x14012d762
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x14012d750
nop
jmp 0x14012d76b
movzx eax, byte [0x14023e638]
mov byte [rcx], al
bt r15d, 0x1d
jae 0x14012d78c
lea rcx, [rbp - 0x6f]
test rdx, rdx
je 0x14012d787
nop dword [rax + rax]
call fcn.140190bbc
jmp 0x14012d78c
call fcn.140190b5c
mov r9d, dword [rdi]
mov r10, rdi
bt r9d, 0xf
jae 0x14012d844
movzx ecx, byte [rbp - 0x6f]
lea rax, [rbp - 0x6f]
movzx r8d, byte [0x14023e638]
test cl, cl
je 0x14012d7ca
movzx edx, cl
movzx ecx, dl
cmp dl, r8b
je 0x14012d7ca
movzx ecx, byte [rax + 1]
inc rax
movzx edx, cl
test cl, cl
jne 0x14012d7b4
inc rax
test cl, cl
je 0x14012d844
movzx ecx, byte [rax]
test cl, cl
je 0x14012d7f0
sub cl, 0x45
test cl, 0xdf
je 0x14012d7f0
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
jne 0x14012d7d8
movzx edi, byte ds:[rax - 1]
mov rdx, rax
dec rax
cmp dil, 0x30
jne 0x14012d81d
nop word [rax + rax]
movzx edi, byte [rax - 1]
dec rax
cmp dil, 0x30
je 0x14012d810
cmp dil, r8b
lea rcx, [rax - 1]
cmovne rcx, rax
nop dword [rax + rax]
movzx eax, byte ds:[rdx]
lea rcx, [rcx + 1]
mov byte [rcx], al
lea rdx, [rdx + 1]
test al, al
jne 0x14012d830
lea rax, [rbp - 0x6f]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14012d850
cmp byte ds:[rbp - 0x6f], 0x2d
jne 0x14012d870
mov esi, 1
lea rbx, [rbp - 0x6e]
dec r8d
jmp 0x14012d87c
bt r9d, 0x11
jae 0x14012d87c
mov esi, 2
mov eax, r9d
and eax, 0x13000
cmp eax, 0x10000
jne 0x14012d9ca
movzx eax, byte [rbx]
mov r9, rbx
sub al, 0x30
cmp al, 0xa
jae 0x14012d8ae
nop dword [rax + rax]
movzx eax, byte [r9 + 1]
inc r9
sub al, 0x30
cmp al, 0xa
jb 0x14012d8a0
mov r10d, r9d
sub r10d, ebx
je 0x14012d8cc
lea ecx, [r10 + 2]
mov eax, 0xaaaaaaab
mul ecx
mov r11d, edx
shr r11d, 1
dec r11d
jmp 0x14012d8cf
xor r11d, r11d
movzx r15d, byte ds:[rsp + 0x30]
lea eax, [r11 + r8]
lea ecx, [rax + rax]
test r15b, r15b
jne 0x14012d905
test esi, esi
lea eax, [rcx + 2]
cmove eax, ecx
add rax, r13
cmp qword [rsp + 0x38], rax
jae 0x14012d905
mov r15b, 1
mov byte [rsp + 0x30], r15b
jmp 0x14012d987
lea edi, [r10 + 2]
mov eax, 0xaaaaaaab
mul edi
mov ecx, r10d
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
test r15b, r15b
jne 0x14012d987
nop
test sil, 1
je 0x14012d92d
mov eax, 0x2d
jmp 0x14012d938
test sil, 2
je 0x14012d941
mov eax, 0x2b
mov word [r12], ax
add r12, 2
test r10d, r10d
je 0x14012d987
nop word [rax + rax]
movsx eax, byte [rbx]
lea rbx, [rbx + 1]
mov word [r12], ax
dec ecx
mov eax, edi
add r12, 2
dec edi
test eax, eax
jne 0x14012d983
test ecx, ecx
je 0x14012d987
movzx eax, word [0x14023e8b0]
mov edi, 2
mov word [r12], ax
add r12, 2
test ecx, ecx
jne 0x14012d950
test esi, esi
je 0x14012d98f
add r13, 2
lea eax, ds:[r11 + r10]
lea r13, [r13 + rax*2]
test r15b, r15b
jne 0x14012de43
sub r8d, r10d
mov rcx, r9
mov edi, r8d
mov r8, r12
mov edx, edi
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
lea r12, [r12 + rdi*2]
lea r13, [r13 + rdi*2]
jmp 0x14012de43
xor ecx, ecx
test esi, esi
setne cl
mov rdx, rcx
bt r9d, 0x12
jae 0x14012da02
movzx r9d, word [r10 + 6]
mov edi, r8d
lea rax, [rcx + rdi]
cmp rax, r9
jae 0x14012da02
mov edx, r9d
or esi, 4
sub rdx, rdi
mov r9, rdx
sub r9, rcx
mov qword [rsp + 0x70], r9
jmp 0x14012da07
mov r9, qword [rsp + 0x70]
movzx r15d, byte [rsp + 0x30]
test r15b, r15b
jne 0x14012da8d
mov eax, r8d
add rax, rdx
lea rax, [rax*2]
add rax, r13
cmp qword [rsp + 0x38], rax
jae 0x14012da39
mov byte [rsp + 0x30], 1
lea r13, [r13 + rdx*2]
jmp 0x14012de48
test sil, 1
je 0x14012da46
mov eax, 0x2d
jmp 0x14012da51
test sil, 2
je 0x14012da5a
mov eax, 0x2b
mov word [r12], ax
add r12, 2
nop word [rax + rax]
test sil, 4
je 0x14012da8d
test r9, r9
je 0x14012da7c
mov eax, 0x30
mov rdi, r12
movzx eax, ax
mov rcx, r9
rep stosw word [rdi], ax
lea r12, [r12 + r9*2]
mov rcx, rbx
lea r13, [r13 + rdx*2]
jmp 0x14012d9af
lea r13, [r13 + rdx*2]
test r15b, r15b
jne 0x14012daa4
mov rcx, rbx
jmp 0x14012d9af
mov r10, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x48]
jmp 0x14012de52
mov r10, qword ds:[rsp + 0x40]
mov rbx, qword [rsp + 0x48]
jmp 0x14012de52
mov rdx, qword [r10 + 0x10]
mov esi, r8d
xorps xmm0, xmm0
test rdx, rdx
js 0x14012dadb
cvtsi2sd xmm0, rdx
jmp 0x14012daf3
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2sd xmm0, rcx
addsd xmm0, xmm0
test rdx, rdx
jne 0x14012db30
cmp byte [rsp + 0x30], dl
jne 0x14012db23
lea rax, [r13 + 2]
cmp r9, rax
jae 0x14012db19
add r12, 2
mov byte [rsp + 0x30], 1
add r13, 2
jmp case.default.0x14012d1b6
mov eax, 0x30
mov word [r12], ax
add r12, 2
add r13, 2
jmp case.default.0x14012d1b6
bt r15d, 8
jae 0x14012db3e
movzx eax, byte [r10 + 0xa]
jmp 0x14012db44
mov eax, dword [0x14023f728]
comisd xmm0, xmm6
jb 0x14012db65
nop word [rax + rax]
cmp esi, 7
jae 0x14012db65
cmp esi, eax
jae 0x14012db65
mulsd xmm0, xmm7
inc esi
comisd xmm0, xmm6
jae 0x14012db50
test r15b, 0x40
je 0x14012db72
movzx eax, word [r10 + 4]
jmp 0x14012db77
mov eax, 2
movzx r8d, ax
lea r9, [rbp - 0x6f]
mov eax, 0xa2
lea rbx, [rbp - 0x6f]
cmp r8d, eax
mov edx, 0x1804b
cmova r8d, eax
call fcn.140175aa0
movzx r8d, word [0x14023e638]
test al, al
jne 0x14012dbae
xor dil, dil
mov byte [rbp - 0x6f], dil
jmp 0x14012dbe9
cmp qword [0x140244e00], 0
movzx edi, byte [rbp - 0x6f]
je 0x14012dbe9
nop dword [rax]
test dil, dil
je 0x14012dbe9
lea rcx, [rbp - 0x6f]
movzx eax, dil
nop dword [rax]
cmp al, 0x2e
je 0x14012dbe2
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x14012dbd0
nop
jmp 0x14012dbe9
mov byte [rcx], r8b
movzx edi, byte [rbp - 0x6f]
lea rax, [rbp - 0x6f]
movzx ecx, dil
test dil, dil
je 0x14012dc16
movzx edx, cl
nop dword [rax]
movzx ecx, dl
cmp dl, r8b
je 0x14012dc16
movzx ecx, byte [rax + 1]
inc rax
movzx edx, cl
test cl, cl
jne 0x14012dc00
inc rax
test cl, cl
je 0x14012dc88
movzx ecx, byte [rax]
test cl, cl
je 0x14012dc37
sub cl, 0x45
test cl, 0xdf
je 0x14012dc37
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
jne 0x14012dc24
movzx edi, byte [rax - 1]
mov rdx, rax
dec rax
cmp dil, 0x30
jne 0x14012dc5d
nop word [rax + rax]
movzx edi, byte [rax - 1]
dec rax
cmp dil, 0x30
je 0x14012dc50
cmp dil, r8b
lea rcx, [rax - 1]
cmovne rcx, rax
nop dword [rax + rax]
movzx eax, byte ds:[rdx]
lea rcx, [rcx + 1]
mov byte [rcx], al
lea rdx, [rdx + 1]
test al, al
jne 0x14012dc70
movzx edi, byte [rbp - 0x6f]
lea rax, [rbp - 0x6f]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14012dc93
nop dword [rax]
cmp dil, 0x2d
jne 0x14012dcb3
mov r14d, 1
lea rbx, [rbp - 0x6e]
dec r8d
movzx eax, byte [rbx]
mov r9, rbx
sub al, 0x30
cmp al, 0xa
jae 0x14012dcce
nop
movzx eax, byte [r9 + 1]
inc r9
sub al, 0x30
cmp al, 0xa
jb 0x14012dcc0
mov r10d, r9d
sub r10d, ebx
je 0x14012dcec
lea ecx, [r10 + 2]
mov eax, 0xaaaaaaab
mul ecx
mov r11d, edx
shr r11d, 1
dec r11d
jmp 0x14012dcef
xor r11d, r11d
movzx r15d, byte ds:[rsp + 0x30]
lea eax, [r11 + r8]
lea ecx, [rax + rax]
test r15b, r15b
jne 0x14012dd22
test r14d, r14d
lea eax, [rcx + 2]
cmove eax, ecx
add rax, r13
cmp qword [rsp + 0x38], rax
jae 0x14012dd22
mov r15b, 1
mov byte [rsp + 0x30], r15b
jmp 0x14012dd97
lea edi, [r10 + 2]
mov eax, 0xaaaaaaab
mul edi
mov ecx, r10d
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
test r15b, r15b
jne 0x14012dd97
nop dword [rax]
test r14d, r14d
je 0x14012dd53
mov eax, 0x2d
mov word [r12], ax
add r12, 2
test r10d, r10d
je 0x14012dd97
nop dword [rax + rax]
movsx eax, byte [rbx]
lea rbx, [rbx + 1]
mov word [r12], ax
dec ecx
mov eax, edi
add r12, 2
dec edi
test eax, eax
jne 0x14012dd93
test ecx, ecx
je 0x14012dd97
movzx eax, word [0x14023e8b0]
mov edi, 2
mov word [r12], ax
add r12, 2
test ecx, ecx
jne 0x14012dd60
test r14d, r14d
je 0x14012dda0
add r13, 2
lea eax, [r11 + r10]
lea rbx, [rax*2]
add rbx, r13
test r15b, r15b
jne 0x14012de1d
sub r8d, r10d
mov rcx, r9
mov edi, r8d
mov r8, r12
mov edx, edi
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
mov edx, esi
lea rbx, [rbx + rdi*2]
add rdx, rdx
lea r12, [r12 + rdi*2]
mov edi, esi
lea rcx, [rbx + 2]
lea rsi, [0x140000000]
add rcx, qword [rsi + rdx*8 + 0x23e840]
cmp qword [rsp + 0x38], rcx
jae 0x14012ddf7
mov byte [rsp + 0x30], 1
jmp 0x14012de26
mov eax, 0x20
lea rcx, [r12 + 2]
mov word [r12], ax
mov r8, qword [rsi + rdx*8 + 0x23e840]
mov rdx, qword [rsi + rdx*8 + 0x23e848]
call fcn.140188690
jmp 0x14012de26
mov edi, esi
lea rsi, [0x140000000]
add rdi, rdi
lea r13, [rbx + 2]
mov rcx, qword [rsi + rdi*8 + 0x23e840]
lea rax, [rcx + 2]
shr rax, 1
add r13, rcx
lea r12, [r12 + rax*2]
mov r10, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x38]
mov ecx, dword ds:[r10]
mov r8, r13
sub r8, rbx
test ecx, 0xc0000000
je 0x14012def6
movzx ebx, word [r10 + 6]
add rbx, rbx
cmp r8, rbx
jae 0x14012def6
sub rbx, r8
cmp byte [rsp + 0x30], 0
jne 0x14012dee9
lea rax, [rbx + r13]
cmp rsi, rax
jae 0x14012de97
mov byte [rsp + 0x30], 1
jmp 0x14012dee9
test cl, cl
jns 0x14012dea2
movzx r14d, word [r10 + 8]
jmp 0x14012dea8
mov r14d, 0x20
mov rsi, rbx
shr rsi, 1
test ecx, ecx
jns 0x14012debc
test rsi, rsi
je 0x14012dee9
mov rdi, r12
jmp 0x14012dedf
lfence
mov rax, r8
mov rdi, r12
shr rax, 1
add rax, rax
sub rdi, rax
mov rdx, rdi
lea rcx, [rdi + rsi*2]
call fcn.140188690
test rsi, rsi
je 0x14012dee9
mov rcx, rsi
movzx eax, r14w
rep stosw word [rdi], ax
mov rax, rbx
shr rax, 1
add r13, rbx
lea r12, [r12 + rax*2]
mov ebx, dword [rsp + 0x68]
lea r11, [0x140000000]
movzx esi, byte [rsp + 0x30]
mov rax, qword [rsp + 0x60]
test ebx, ebx
jne 0x14012d160
mov rdi, qword [rsp + 0x78]
mov r14, qword [rbp - 0x80]
movaps xmm7, xmmword [rsp + 0x4a0]
movaps xmm6, xmmword [rsp + 0x4b0]
mov r15, qword [rsp + 0x4c0]
mov rbx, qword [rsp + 0x508]
mov rcx, qword [rsp + 0x38]
test sil, sil
jne 0x14012df52
lea rax, [r13 + 2]
cmp rcx, rax
jae 0x14012dfa1
mov sil, 1
test rdi, rdi
je 0x14012df61
test rcx, rcx
je 0x14012df61
xor eax, eax
mov word [rdi], ax
mov r12, qword [rsp + 0x4c8]
mov rdi, qword [rsp + 0x4d0]
test r14, r14
je 0x14012df7d
lea rax, [r13 + 2]
mov qword [r14], rax
test sil, sil
sete al
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.1401848a0
add rsp, 0x4d8
pop r14
pop r13
pop rsi
pop rbp
ret
xor eax, eax
mov word [r12], ax
jmp 0x14012df61