Function at 0x14017a8a0
Capabilities:
Get geographical location

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r15
lea rbp, [rsp - 0x3d8]
sub rsp, 0x4d8
mov rax, qword [0x1402ba040]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov edi, 0x1e
mov esi, edx
mov rdx, qword [0x1402c4fb8]
cmp r8, rdi
mov r12, rcx
cmovae rdi, r8
mov qword [rsp + 0x38], rdi
lea rcx, [rdi + 0x12]
call sym.SystemInformer.exe_QiCreateObject
xor ecx, ecx
mov qword [rsp + 0x30], rax
mov r11, rax
mov qword [rsp + 0x40], rcx
mov r15d, ecx
mov qword [rax], rdi
add rax, 0x10
mov qword [r11 + 8], rax
mov word [rdi + rax], cx
test byte [0x1402c1390], 1
mov rbx, qword [r11 + 8]
jne 0x14017a9eb
lock bts qword [0x1402c1390], 0x1f
jb 0x14017a9cf
lea r9d, [rcx + 4]
lea edx, [rcx + 0xe]
mov ecx, 0x400
lea r8, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14017a96e
mov rax, qword [rbp - 0x70]
test ax, ax
je 0x14017a96e
nop dword [rax]
cmp word [rbp - 0x6e], r15w
jne 0x14017a96e
mov word [0x1402bb508], ax
mov r9d, 4
lea r8, [rbp - 0x70]
mov ecx, 0x400
lea edx, [r9 + 0xb]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14017a9a2
mov rax, qword [rbp - 0x70]
test ax, ax
je 0x14017a9a2
cmp word [rbp - 0x6e], r15w
jne 0x14017a9a2
mov word [0x1402bc744], ax
cmp word [0x1402bb508], 0x2e
je 0x14017a9c1
lea rdx, [0x1402332cc]
xor ecx, ecx
call fcn.1401efe28
mov qword [0x1402c86e8], rax
lea rcx, [0x1402c1390]
call sym.SystemInformer.exe_QifSetEvent
jmp 0x14017a9e6
test byte [0x1402c1390], 1
jne 0x14017a9eb
xor edx, edx
lea rcx, [0x1402c1390]
call sym.SystemInformer.exe_QifWaitForEvent
mov r11, qword [rsp + 0x30]
test esi, esi
je 0x14017bcf8
mov qword [rsp + 0x518], r13
lea r8, [0x140000000]
mov qword [rsp + 0x4d0], r14
mov edx, 1
movaps xmmword [rsp + 0x4c0], xmm6
movsd xmm6, qword [0x14028d350]
movaps xmmword [rsp + 0x4b0], xmm7
movsd xmm7, qword [0x14028d2f8]
lea r10d, [rdx + 0x2f]
lea r9d, [r10 + 0x72]
nop word [rax + rax]
mov r14, r12
mov qword [rsp + 0x58], r12
add r12, 0x20
mov qword [rbp - 0x80], r15
dec esi
mov qword [rbp - 0x78], r12
xor r11d, r11d
mov dword [rsp + 0x70], esi
mov r13d, dword [r14]
mov r12d, r11d
mov eax, r13d
and eax, 0x3f
cmp eax, 0xc
ja case.default.0x14017aa80
cdqe
mov ecx, dword [r8 + rax*4 + 0x17bd2c]
add rcx, r8
jmp rcx
lea rsi, [r15 + 2]
cmp rdi, rsi
jae 0x14017aaff
mov rdx, qword [0x1402c4fb8]
lea rax, [rdi + rdi]
cmp rax, rsi
mov rbx, rsi
cmovae rbx, rax
mov qword [rsp + 0x38], rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_QiCreateObject
xor edx, edx
mov r8, r15
mov rdi, rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rbx + rcx], dx
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
call fcn.1402074d0
lea rcx, [rbx - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14017aaef
call fcn.14013fb00
mov rax, qword [rdi + 8]
shr r15, 1
mov qword [rsp + 0x30], rdi
lea rbx, [rax + r15*2]
movzx eax, word [r14 + 0x10]
mov r15, rsi
mov word [rbx], ax
add rbx, 2
mov qword [rsp + 0x40], rsi
jmp case.default.0x14017aa80
mov rcx, qword ds:[r14 + 0x10]
add rcx, r15
cmp rdi, rcx
jae 0x14017ab9d
mov rdx, qword [0x1402c4fb8]
lea rax, [rdi + rdi]
cmp rax, rcx
mov rbx, rcx
cmovae rbx, rax
mov qword [rsp + 0x38], rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_QiCreateObject
xor edx, edx
mov r8, r15
mov rdi, rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rbx + rcx], dx
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
call fcn.1402074d0
lea rcx, ds:[rbx - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14017ab8a
call fcn.14013fb00
mov rax, qword [rdi + 8]
mov rcx, r15
shr rcx, 1
mov qword [rsp + 0x30], rdi
lea rbx, [rax + rcx*2]
mov r8, qword [r14 + 0x10]
mov rcx, rbx
mov rdx, qword [r14 + 0x18]
call fcn.1402074d0
mov rax, qword [r14 + 0x10]
shr rax, 1
add r15, qword [r14 + 0x10]
jmp 0x14017bb79
mov rdi, qword [r14 + 0x10]
xorps xmm1, xmm1
mov rdx, rdi
mov ecx, edi
and rdx, 0xfffffffffffffff1
and ecx, 0xf
je 0x14017abf4
movdqu xmm0, xmmword [rdx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
mov dword [rsp + 0x64], ecx
je 0x14017abf0
mov edx, ecx
shr rdx, 1
jmp 0x14017ac38
add rdx, 0x10
movdqu xmm0, xmmword [rdx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x64], ecx
jne 0x14017ac2a
nop dword [rax]
movdqu xmm0, xmmword [rdx + 0x10]
add rdx, 0x10
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x64], ecx
je 0x14017ac10
sub rdx, rdi
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
mov r8, qword [rsp + 0x38]
lea rdi, [rdx + rdx]
lea rsi, [rdi + r15]
cmp r8, rsi
jae 0x14017acc2
mov rdx, qword [0x1402c4fb8]
lea rax, [r8 + r8]
cmp rax, rsi
mov r12, rsi
cmovae r12, rax
mov qword [rsp + 0x38], r12
lea rcx, [r12 + 0x12]
call sym.SystemInformer.exe_QiCreateObject
xor edx, edx
mov r8, r15
mov rbx, rax
mov qword [rax], r12
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [r12 + rcx], dx
mov r12, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [r12 + 8]
call fcn.1402074d0
lea rcx, [r12 - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14017acb2
call fcn.14013fb00
mov rax, qword [rbx + 8]
shr r15, 1
mov qword [rsp + 0x30], rbx
lea rbx, [rax + r15*2]
mov rdx, qword [r14 + 0x10]
mov r8, rdi
mov rcx, rbx
call fcn.1402074d0
shr rdi, 1
mov r15, rsi
mov qword [rsp + 0x40], rsi
lea rbx, [rbx + rdi*2]
jmp case.default.0x14017aa80
cmp r13d, 3
jne 0x14017acf5
mov rsi, qword [r14 + 0x18]
mov rdi, qword [r14 + 0x10]
jmp 0x14017ad09
mov rsi, qword [r14 + 0x10]
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rsi + rdi], r11b
jne 0x14017ad00
mov r8d, edi
lea rcx, [rsp + 0x60]
mov rdx, rsi
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeSize]
nop word [rax + rax]
test eax, eax
js case.default.0x14017aa80
lfence
mov edx, dword [rsp + 0x60]
mov r8, qword [rsp + 0x38]
lea rcx, [r15 + rdx]
cmp r8, rcx
jae 0x14017adc8
mov rdx, qword [0x1402c4fb8]
lea rax, [r8 + r8]
cmp rax, rcx
mov r12, rcx
cmovae r12, rax
mov qword [rsp + 0x38], r12
lea rcx, [r12 + 0x12]
call sym.SystemInformer.exe_QiCreateObject
xor edx, edx
mov r8, r15
mov rbx, rax
mov qword [rax], r12
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [r12 + rcx], dx
mov r12, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [r12 + 8]
call fcn.1402074d0
lea rcx, [r12 - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14017adb1
call fcn.14013fb00
mov rax, qword [rbx + 8]
mov rcx, r15
mov edx, dword [rsp + 0x60]
shr rcx, 1
mov qword [rsp + 0x30], rbx
lea rbx, [rax + rcx*2]
mov r9, rsi
mov dword [rsp + 0x20], edi
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
nop dword [rax + rax]
test eax, eax
js case.default.0x14017aa80
mov ecx, dword [rsp + 0x60]
mov eax, ecx
shr rax, 1
add r15, rcx
jmp 0x14017bb79
mov eax, dword [r14 + 0x10]
mov r12d, eax
mov r8d, eax
shr r12d, 0x1f
neg r8d
test eax, eax
cmovns r8d, eax
jmp 0x14017ae16
mov r8d, dword [r14 + 0x10]
mov r10d, 0xa
bt r13d, 8
jae 0x14017ae33
movzx eax, byte [r14 + 0xa]
cmp al, 2
jb 0x14017ae33
cmp al, 0x45
ja 0x14017ae33
mov r10d, eax
bt r13d, 0x1d
lea r9, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
lea rax, [0x140287d40]
mov r14d, r11d
cmovae r9, rax
lea rsi, [rbp + 0x39e]
test r8d, r8d
je 0x14017aee2
bt r13d, 0x10
jae 0x14017aec0
mov edi, r11d
nop word [rax + rax]
xor edx, edx
mov eax, r8d
div r10d
inc r14d
inc edi
mov r8d, eax
movsx ecx, byte [rdx + r9]
mov word [rsi], cx
sub rsi, 2
cmp edi, 3
jne 0x14017aea8
test eax, eax
je 0x14017aeac
movzx eax, word [0x1402bc744]
mov word [rsi], ax
sub rsi, 2
inc r14d
jmp 0x14017ae64
test eax, eax
jne 0x14017ae70
mov rdi, qword [rsp + 0x38]
mov edx, 1
test r12d, r12d
je 0x14017aefa
mov ecx, edx
jmp 0x14017af05
xor edx, edx
mov eax, r8d
div r10d
inc r14d
mov r8d, eax
movsx ecx, byte [rdx + r9]
mov word [rsi], cx
sub rsi, 2
test eax, eax
jne 0x14017aec0
nop
jmp 0x14017aeb1
mov eax, 0x30
lea rsi, [rbp + 0x39c]
mov word [rbp + 0x39e], ax
mov r14d, edx
jmp 0x14017aeb6
bt r13d, 0x11
mov ecx, r11d
cmovb ecx, edx
mov eax, r13d
and eax, 0x50000
cmp eax, 0x40000
jne 0x14017af36
mov rax, qword [rsp + 0x58]
movzx edx, word [rax + 6]
lea eax, [rcx + r14]
cmp eax, edx
jae 0x14017af36
mov eax, edx
or r12d, 4
sub eax, ecx
sub eax, r14d
mov dword [rsp + 0x68], eax
add ecx, eax
lea eax, ds:[rcx + r14]
lea r15, [r15 + rax*2]
cmp rdi, r15
jae 0x14017afca
mov rdx, qword [0x1402c4fb8]
lea rax, [rdi + rdi]
cmp rax, r15
mov rbx, r15
cmovae rbx, rax
mov qword [rsp + 0x38], rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_QiCreateObject
mov r13, qword [rsp + 0x30]
xor edx, edx
mov rdi, rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rbx], dx
mov rbx, qword [rsp + 0x40]
mov rdx, qword [r13 + 8]
mov r8, rbx
mov rcx, qword [rax + 8]
call fcn.1402074d0
lea rcx, [r13 - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14017afb2
call fcn.14013fb00
mov rax, qword [rdi + 8]
shr rbx, 1
mov qword [rsp + 0x30], rdi
lea rbx, [rax + rbx*2]
mov rax, qword [rsp + 0x58]
mov r13d, dword [rax]
test r12b, 1
je 0x14017afd7
mov word [rbx], 0x2d
jmp 0x14017afe3
bt r13d, 0x11
jae 0x14017afe7
mov word [rbx], 0x2b
add rbx, 2
test r12b, 4
je 0x14017b00b
mov edx, dword [rsp + 0x68]
test rdx, rdx
je 0x14017b007
mov eax, 0x30
mov rdi, rbx
movzx eax, ax
mov rcx, rdx
rep stosw word [rdi], ax
lea rbx, [rbx + rdx*2]
mov edi, r14d
lea rdx, [rsi + 2]
add rdi, rdi
mov rcx, rbx
mov r8, rdi
call fcn.1402074d0
mov r14, qword [rsp + 0x58]
add rbx, rdi
jmp 0x14017bb7d
mov ecx, 0x10
mov rax, r14
mov rax, qword [rcx + rax]
mov r12, rax
mov r8, rax
shr r12, 0x3f
neg r8
cmovs r8, rax
jmp 0x14017b055
mov r8, qword [r14 + 0x10]
mov ecx, 0xa
bt r13d, 8
jae 0x14017b071
movzx eax, byte [r14 + 0xa]
cmp al, 2
jb 0x14017b071
cmp al, 0x45
ja 0x14017b071
mov ecx, eax
bt r13d, 0x1d
lea r9, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
lea rax, [0x140287d40]
mov r14d, r11d
cmovae r9, rax
lea rsi, [rbp + 0x39e]
test r8, r8
je 0x14017b133
bt r13d, 0x10
jae 0x14017b103
mov r10d, ecx
mov edi, r11d
nop dword [rax + rax]
xor edx, edx
mov rax, r8
div r10
inc r14d
inc edi
mov r8, rax
mov eax, edx
movsx ecx, byte [rax + r9]
mov word [rsi], cx
sub rsi, 2
cmp edi, 3
jne 0x14017b0eb
test r8, r8
je 0x14017b0f0
movzx eax, word [0x1402bc744]
mov word [rsi], ax
sub rsi, 2
inc r14d
jmp 0x14017b0a5
test r8, r8
jne 0x14017b0b0
mov rdi, qword [rsp + 0x38]
mov edx, 1
test r12d, r12d
je 0x14017b147
mov ecx, edx
jmp 0x14017b152
mov edi, ecx
nop word [rax + rax]
xor edx, edx
mov rax, r8
div rdi
inc r14d
mov r8, rax
mov eax, edx
movsx ecx, byte [rax + r9]
mov word [rsi], cx
sub rsi, 2
test r8, r8
jne 0x14017b110
jmp 0x14017b0f0
mov word [rbp + 0x39e], r10w
lea rsi, [rbp + 0x39c]
mov r14d, edx
jmp 0x14017b0fa
bt r13d, 0x11
mov ecx, r11d
cmovb ecx, edx
mov eax, r13d
and eax, 0x50000
cmp eax, 0x40000
jne 0x14017b189
mov rax, qword [rsp + 0x58]
movzx edx, word [rax + 6]
lea eax, [rcx + r14]
cmp eax, edx
jae 0x14017b189
mov eax, edx
or r12d, 4
sub eax, ecx
sub eax, r14d
mov dword [rsp + 0x6c], eax
add ecx, eax
lea eax, [rcx + r14]
lea r15, [r15 + rax*2]
cmp rdi, r15
jae 0x14017b21d
mov rdx, qword [0x1402c4fb8]
lea rax, [rdi + rdi]
cmp rax, r15
mov rbx, r15
cmovae rbx, rax
mov qword [rsp + 0x38], rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_QiCreateObject
mov r13, qword [rsp + 0x30]
xor edx, edx
mov rdi, rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rbx], dx
mov rbx, qword [rsp + 0x40]
mov rdx, qword [r13 + 8]
mov r8, rbx
mov rcx, qword [rax + 8]
call fcn.1402074d0
lea rcx, [r13 - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14017b205
nop
call fcn.14013fb00
mov rax, qword [rdi + 8]
shr rbx, 1
mov qword [rsp + 0x30], rdi
lea rbx, [rax + rbx*2]
mov rax, qword [rsp + 0x58]
mov r13d, dword [rax]
nop dword [rax]
test r12b, 1
je 0x14017b22d
mov word [rbx], 0x2d
jmp 0x14017b239
bt r13d, 0x11
jae 0x14017b23d
mov word [rbx], 0x2b
add rbx, 2
nop dword [rax]
test r12b, 4
je 0x14017b00b
mov edx, dword [rsp + 0x6c]
jmp 0x14017aff1
test r13b, 0x40
je 0x14017b26a
movzx r8d, word ds:[r14 + 4]
cmp r8d, r9d
jbe 0x14017b270
mov r8d, r9d
jmp 0x14017b270
mov r8d, 6
movsd xmm0, qword [r14 + 0x10]
lea r9, [rbp - 0x5f]
mov edx, r13d
lea r15, [rbp - 0x5f]
call fcn.1401d0340
test al, al
jne 0x14017b290
mov byte [rbp - 0x5f], r12b
jmp 0x14017b2de
mov rdx, qword [0x1402c86e8]
test rdx, rdx
je 0x14017b2c2
movzx eax, byte [rbp - 0x5f]
lea rcx, [rbp - 0x5f]
test al, al
je 0x14017b2c2
cmp al, 0x2e
je 0x14017b2b9
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x14017b2a8
jmp 0x14017b2c2
movzx eax, byte [0x1402bb508]
mov byte [rcx], al
bt r13d, 0x1d
jae 0x14017b2de
lea rcx, [rbp - 0x5f]
test rdx, rdx
je 0x14017b2d9
call fcn.1401ef450
jmp 0x14017b2de
call fcn.1401ef3f0
mov r9d, dword [r14]
bt r9d, 0xf
jae 0x14017b371
movzx eax, byte ds:[rbp - 0x5f]
lea rcx, [rbp - 0x5f]
movzx r8d, byte [0x1402bb508]
test al, al
je 0x14017b314
cmp al, r8b
je 0x14017b314
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x14017b304
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x14017b371
movzx eax, byte [rcx]
test al, al
je 0x14017b336
sub al, 0x45
test al, 0xdf
je 0x14017b336
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x14017b325
movzx eax, byte [rcx - 1]
mov rdi, rcx
dec rcx
cmp al, 0x30
jne 0x14017b34f
movzx eax, byte [rcx - 1]
dec rcx
cmp al, 0x30
je 0x14017b344
cmp al, r8b
lea rdx, [rcx - 1]
cmovne rdx, rcx
nop word [rax + rax]
movzx eax, byte [rdi]
lea rdx, [rdx + 1]
mov byte [rdx], al
lea rdi, [rdi + 1]
test al, al
jne 0x14017b360
lea rax, [rbp - 0x5f]
mov r14, 0xffffffffffffffff
nop dword [rax]
inc r14
cmp byte [rax + r14], r12b
jne 0x14017b380
cmp byte [rbp - 0x5f], 0x2d
jne 0x14017b3a2
dec r14d
lea r15, [rbp - 0x5e]
xor ecx, ecx
mov r12d, 1
jmp 0x14017b3b3
bt r9d, 0x11
mov eax, 2
mov rcx, r12
cmovb r12d, eax
mov eax, r9d
and eax, 0x13000
cmp eax, 0x10000
jne 0x14017b56e
movzx eax, byte [r15]
mov rsi, r15
sub al, 0x30
mov qword [rsp + 0x48], r15
cmp al, 0xa
jae 0x14017b3ed
nop dword [rax]
movzx eax, byte [rsi + 1]
inc rsi
sub al, 0x30
cmp al, 0xa
jb 0x14017b3e0
mov r13d, esi
sub r13d, r15d
lea edi, [r13 + 2]
je 0x14017b408
mov eax, 0xaaaaaaab
mul edi
mov eax, edx
shr eax, 1
dec eax
jmp 0x14017b40a
mov eax, ecx
mov r8, qword [rsp + 0x38]
lea ecx, [rax + r14]
add ecx, ecx
mov dword [rsp + 0x50], eax
test r12d, r12d
lea eax, [rcx + 2]
cmove eax, ecx
mov rcx, qword [rsp + 0x40]
add rcx, rax
cmp r8, rcx
jae 0x14017b4ba
lea rax, [r8 + r8]
mov rdx, rcx
cmp rax, rcx
cmovae rdx, rax
mov qword [rsp + 0x38], rdx
lea rcx, [rdx + 0x12]
mov rdx, qword [0x1402c4fb8]
call sym.SystemInformer.exe_QiCreateObject
mov r8, qword [rsp + 0x38]
xor edx, edx
mov rbx, rax
mov qword [rax], r8
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + r8], dx
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
mov rcx, qword [rax + 8]
mov rdx, qword [rdx + 8]
call fcn.1402074d0
mov rcx, qword [rsp + 0x30]
mov edx, 0xffffffff
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14017b4a5
nop
call fcn.14013fb00
mov rcx, qword [rsp + 0x40]
mov rax, qword [rbx + 8]
shr rcx, 1
mov qword [rsp + 0x30], rbx
lea rbx, [rax + rcx*2]
mov eax, 0xaaaaaaab
mov ecx, r13d
mul edi
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
test r12b, 1
je 0x14017b4d8
mov word [rbx], 0x2d
jmp 0x14017b4e3
test r12b, 2
je 0x14017b4e7
mov word [rbx], 0x2b
add rbx, 2
test r13d, r13d
je 0x14017b530
nop dword [rax]
movsx eax, byte [r15]
dec ecx
mov word [rbx], ax
inc r15
mov eax, edi
add rbx, 2
dec edi
test eax, eax
jne 0x14017b52c
test ecx, ecx
je 0x14017b530
movzx eax, word [0x1402bc744]
dec ecx
mov word [rbx], ax
mov edi, 1
movsx eax, byte [r15]
mov word [rbx + 2], ax
add rbx, 4
inc r15
test ecx, ecx
jne 0x14017b4f0
mov r15, qword [rsp + 0x40]
test r12d, r12d
je 0x14017b53e
add r15, 2
sub r14d, r13d
mov r8, rbx
mov edx, r14d
mov rcx, rsi
mov edi, r14d
call sym.SystemInformer.exe_QiZeroExtendToUtf16Buffer
mov ecx, dword [rsp + 0x50]
lea rbx, [rbx + r14*2]
mov r14, qword [rsp + 0x58]
add ecx, r13d
add rcx, rdi
lea r15, [r15 + rcx*2]
jmp 0x14017bb7d
test r12d, r12d
mov rdx, rcx
setne dl
mov rcx, rdx
bt r9d, 0x12
jae 0x14017b5ad
mov rax, qword [rsp + 0x58]
mov edi, r14d
movzx r8d, word [rax + 6]
lea rax, [rdi + rdx]
cmp rax, r8
jae 0x14017b5ad
mov ecx, r8d
or r12d, 4
sub rcx, rdi
mov rax, rcx
sub rax, rdx
mov qword [rsp + 0x78], rax
mov r13, qword [rsp + 0x40]
mov r8, qword [rsp + 0x38]
mov r14d, r14d
lea rax, [r14 + rcx]
lea rsi, [rax*2]
add rsi, r13
cmp r8, rsi
jae 0x14017b642
mov rdx, qword [0x1402c4fb8]
lea rax, [r8 + r8]
cmp rax, rsi
mov rbx, rsi
cmovae rbx, rax
mov qword [rsp + 0x38], rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_QiCreateObject
xor edx, edx
mov r8, r13
mov rdi, rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rbx], dx
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
call fcn.1402074d0
lea rcx, [rbx - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14017b632
call fcn.14013fb00
mov rax, qword [rdi + 8]
shr r13, 1
mov qword [rsp + 0x30], rdi
lea rbx, [rax + r13*2]
test r12b, 1
je 0x14017b64f
mov word [rbx], 0x2d
jmp 0x14017b65a
test r12b, 2
je 0x14017b65e
mov word [rbx], 0x2b
add rbx, 2
nop
test r12b, 4
je 0x14017b685
mov rdx, qword [rsp + 0x78]
test rdx, rdx
je 0x14017b681
mov eax, 0x30
mov rdi, rbx
movzx eax, ax
mov rcx, rdx
rep stosw word [rdi], ax
lea rbx, [rbx + rdx*2]
mov r8, rbx
mov rdx, r14
mov rcx, r15
call sym.SystemInformer.exe_QiZeroExtendToUtf16Buffer
lea rbx, [rbx + r14*2]
mov qword [rsp + 0x40], rsi
mov r14, qword [rsp + 0x58]
mov r15, rsi
jmp case.default.0x14017aa80
mov rdx, qword [r14 + 0x10]
xorps xmm0, xmm0
test rdx, rdx
js 0x14017b6bc
cvtsi2sd xmm0, rdx
jmp 0x14017b6d4
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2sd xmm0, rcx
addsd xmm0, xmm0
test rdx, rdx
jne 0x14017b779
lea rsi, [r15 + 2]
cmp rdi, rsi
jae 0x14017b764
mov rdx, qword [0x1402c4fb8]
lea rax, [rdi + rdi]
cmp rax, rsi
mov rbx, rsi
cmovae rbx, rax
mov qword [rsp + 0x38], rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_QiCreateObject
xor edx, edx
mov r8, r15
mov rdi, rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rbx], dx
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
call fcn.1402074d0
lea rcx, [rbx - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14017b74e
call fcn.14013fb00
mov rax, qword [rdi + 8]
mov r10d, 0x30
shr r15, 1
mov qword [rsp + 0x30], rdi
lea rbx, [rax + r15*2]
mov word [rbx], r10w
mov r15, rsi
add rbx, 2
mov qword [rsp + 0x40], rsi
jmp case.default.0x14017aa80
bt r13d, 8
jae 0x14017b789
movzx eax, byte [r14 + 0xa]
jmp 0x14017b78f
mov eax, dword [0x1402c222c]
comisd xmm0, xmm6
jb 0x14017b7b2
cmp r12d, 7
jae 0x14017b7b2
nop dword [rax + rax]
cmp r12d, eax
jae 0x14017b7b2
mulsd xmm0, xmm7
inc r12d
comisd xmm0, xmm6
jae 0x14017b795
test r13b, 0x40
je 0x14017b7bf
movzx eax, word [r14 + 4]
jmp 0x14017b7c4
mov eax, 2
movzx r8d, ax
lea r14, [rbp - 0x5f]
cmp r8d, r9d
mov dword [rsp + 0x50], r11d
mov edx, 0x1804b
cmova r8d, r9d
lea r9, [rbp - 0x5f]
call fcn.1401d0340
movzx r8d, word [0x1402bb508]
test al, al
jne 0x14017b7f9
xor dl, dl
mov byte [rbp - 0x5f], dl
jmp 0x14017b82d
cmp qword [0x1402c86e8], 0
movzx edx, byte [rbp - 0x5f]
je 0x14017b82d
lea rcx, [rbp - 0x5f]
test dl, dl
je 0x14017b82d
movzx eax, dl
cmp al, 0x2e
je 0x14017b826
movzx eax, byte ds:[rcx + 1]
inc rcx
test al, al
jne 0x14017b812
jmp 0x14017b82d
mov byte [rcx], r8b
movzx edx, byte [rbp - 0x5f]
lea rcx, [rbp - 0x5f]
test dl, dl
je 0x14017b848
movzx eax, dl
cmp al, r8b
je 0x14017b848
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x14017b838
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x14017b8b5
movzx eax, byte [rcx]
test al, al
je 0x14017b871
nop dword [rax]
sub al, 0x45
test al, 0xdf
je 0x14017b871
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x14017b860
movzx eax, byte [rcx - 1]
mov rdi, rcx
dec rcx
cmp al, 0x30
jne 0x14017b88b
nop
movzx eax, byte [rcx - 1]
dec rcx
cmp al, 0x30
je 0x14017b880
cmp al, r8b
lea rdx, [rcx - 1]
cmovne rdx, rcx
nop word [rax + rax]
movzx eax, byte [rdi]
lea rdx, [rdx + 1]
mov byte [rdx], al
lea rdi, [rdi + 1]
test al, al
jne 0x14017b8a0
movzx edx, byte [rbp - 0x5f]
lea rax, [rbp - 0x5f]
mov r15, 0xffffffffffffffff
inc r15
cmp byte [rax + r15], 0
jne 0x14017b8c0
cmp dl, 0x2d
jne 0x14017b8e7
movzx edx, byte [rbp - 0x5e]
lea r14, [rbp - 0x5e]
mov r9d, 1
dec r15d
mov dword [rsp + 0x50], r9d
jmp 0x14017b8ec
mov r9d, dword [rsp + 0x50]
sub dl, 0x30
mov qword [rsp + 0x48], r14
mov rsi, r14
cmp dl, 0xa
jae 0x14017b90d
nop dword [rax]
movzx eax, byte [rsi + 1]
inc rsi
sub al, 0x30
cmp al, 0xa
jb 0x14017b900
mov r8d, esi
sub r8d, r14d
mov dword [rsp + 0x48], r8d
lea edi, [r8 + 2]
je 0x14017b930
mov eax, 0xaaaaaaab
mul edi
mov r13d, edx
shr r13d, 1
dec r13d
jmp 0x14017b935
xor eax, eax
mov r13d, eax
mov r10, qword [rsp + 0x40]
lea ecx, [r15 + r13]
add ecx, ecx
test r9d, r9d
lea eax, [rcx + 2]
cmove eax, ecx
mov ecx, eax
mov rax, qword [rsp + 0x38]
add rcx, r10
cmp rax, rcx
jae 0x14017b9ed
add rax, rax
mov rdx, rcx
cmp rax, rcx
cmovae rdx, rax
mov qword [rsp + 0x38], rdx
lea rcx, [rdx + 0x12]
mov rdx, qword [0x1402c4fb8]
call sym.SystemInformer.exe_QiCreateObject
mov r8, qword [rsp + 0x40]
mov rbx, rax
mov rax, qword [rsp + 0x38]
lea rcx, [rbx + 0x10]
xor edx, edx
mov qword [rbx], rax
mov qword [rbx + 8], rcx
mov word [rax + rcx], dx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rbx + 8]
mov rdx, qword [rax + 8]
call fcn.1402074d0
mov rcx, qword [rsp + 0x30]
mov edx, 0xffffffff
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14017b9cb
call fcn.14013fb00
mov r10, qword [rsp + 0x40]
mov rax, qword [rbx + 8]
mov rcx, r10
mov r8d, dword [rsp + 0x48]
mov r9d, dword [rsp + 0x50]
shr rcx, 1
mov qword [rsp + 0x30], rbx
lea rbx, [rax + rcx*2]
mov eax, 0xaaaaaaab
mov ecx, r8d
mul edi
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
test r9d, r9d
je 0x14017ba0e
mov word [rbx], 0x2d
add rbx, 2
test r8d, r8d
je 0x14017ba64
nop dword [rax]
nop word [rax + rax]
movsx eax, byte [r14]
dec ecx
mov word [rbx], ax
inc r14
mov eax, edi
add rbx, 2
dec edi
test eax, eax
jne 0x14017ba5c
test ecx, ecx
je 0x14017ba64
movzx eax, word [0x1402bc744]
dec ecx
mov word [rbx], ax
mov edi, 1
movsx eax, byte [r14]
mov word [rbx + 2], ax
add rbx, 4
inc r14
nop dword [rax]
test ecx, ecx
jne 0x14017ba20
test r9d, r9d
je 0x14017ba72
add r10, 2
mov qword [rsp + 0x40], r10
sub r15d, r8d
mov rcx, rsi
mov edx, r15d
mov r8, rbx
mov edi, r15d
call sym.SystemInformer.exe_QiZeroExtendToUtf16Buffer
mov ecx, dword ds:[rsp + 0x48]
lea rbx, [rbx + r15*2]
mov rax, qword [rsp + 0x40]
lea r15, [0x140000000]
mov r8, qword [rsp + 0x38]
add ecx, r13d
add rcx, rdi
mov r14d, r12d
add r14, r14
lea rsi, [rax + rcx*2]
mov rcx, qword [r15 + r14*8 + 0x2c13a0]
lea rax, [rsi + 2]
add rax, rcx
cmp r8, rax
jae 0x14017bb40
mov rdx, qword [0x1402c4fb8]
lea rbx, [rcx + 2]
lea rax, [r8 + r8]
add rbx, rsi
cmp rax, rbx
cmovae rbx, rax
mov qword [rsp + 0x38], rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_QiCreateObject
mov rdi, rax
mov r8, rsi
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
xor eax, eax
mov word [rbx + rcx], ax
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rdi + 8]
mov rdx, qword [rbx + 8]
call fcn.1402074d0
lea rcx, [rbx - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14017bb2d
call fcn.14013fb00
mov rax, qword [rdi + 8]
mov rcx, rsi
shr rcx, 1
mov qword [rsp + 0x30], rdi
lea rbx, [rax + rcx*2]
mov word [rbx], 0x20
lea rcx, [rbx + 2]
mov r8, qword [r15 + r14*8 + 0x2c13a0]
mov rdx, qword [r15 + r14*8 + 0x2c13a8]
call fcn.1402074d0
mov rcx, qword [r15 + r14*8 + 0x2c13a0]
mov r14, qword [rsp + 0x58]
lea rax, [rcx + 2]
shr rax, 1
lea r15, [rcx + 2]
add r15, rsi
lea rbx, [rbx + rax*2]
mov qword [rsp + 0x40], r15
mov rdi, r15
sub rdi, qword [rbp - 0x80]
test dword [r14], 0xc0000000
je 0x14017bcaa
movzx esi, word ds:[r14 + 6]
add rsi, rsi
cmp rdi, rsi
jae 0x14017bcaa
mov r12, qword [rsp + 0x38]
sub rsi, rdi
lea r13, [rsi + r15]
cmp r12, r13
jae 0x14017bc35
mov rdx, qword [0x1402c4fb8]
lea rax, [r12 + r12]
cmp rax, r13
mov r12, r13
cmovae r12, rax
mov qword [rsp + 0x38], r12
lea rcx, [r12 + 0x12]
call sym.SystemInformer.exe_QiCreateObject
mov rbx, rax
mov r8, r15
mov qword [rax], r12
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
xor eax, eax
mov word [r12 + rcx], ax
mov r12, qword [rsp + 0x30]
mov rcx, qword [rbx + 8]
mov rdx, qword [r12 + 8]
call fcn.1402074d0
lea rcx, [r12 - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14017bc25
nop dword [rax]
call fcn.14013fb00
mov rax, qword [rbx + 8]
shr r15, 1
mov qword [rsp + 0x30], rbx
lea rbx, [rax + r15*2]
mov eax, dword [r14]
test al, al
jns 0x14017bc43
movzx r12d, word [r14 + 8]
jmp 0x14017bc49
mov r12d, 0x20
shr rsi, 1
test eax, eax
jns 0x14017bc68
test rsi, rsi
je 0x14017bc62
movzx eax, r12w
mov rdi, rbx
mov rcx, rsi
rep stosw word [rdi], ax
lea r14, [rsi + rsi]
jmp 0x14017bc9f
lfence
mov rax, rdi
lea r14, [rsi + rsi]
shr rax, 1
mov r15, rbx
add rax, rax
mov r8, rdi
sub r15, rax
mov rdx, r15
lea rcx, [r15 + r14]
call fcn.1402074d0
test rsi, rsi
je 0x14017bc9f
movzx eax, r12w
mov rdi, r15
mov rcx, rsi
rep stosw word [rdi], ax
add rbx, r14
mov qword [rsp + 0x40], r13
mov r15, r13
mov esi, dword [rsp + 0x70]
lea r8, [0x140000000]
mov rdi, qword [rsp + 0x38]
mov edx, 1
mov r12, qword [rbp - 0x78]
lea r10d, [rdx + 0x2f]
lea r9d, [r10 + 0x72]
test esi, esi
jne 0x14017aa40
movaps xmm7, xmmword [rsp + 0x4b0]
movaps xmm6, xmmword [rsp + 0x4c0]
mov r14, qword [rsp + 0x4d0]
mov r13, qword [rsp + 0x518]
mov r11, qword [rsp + 0x30]
mov rcx, qword [r11 + 8]
mov qword [r11], r15
shr r15, 1
xor eax, eax
mov word [rcx + r15*2], ax
mov rax, r11
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.1401e0100
add rsp, 0x4d8
pop r15
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret