Function at 0x14017bd60
Capabilities:
Get geographical location

Disassembly:
mov r11, rsp
push rbp
push rsi
push r12
push r13
lea rbp, [r11 - 0x3f8]
sub rsp, 0x4d8
mov rax, qword [0x1402ba040]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov r12, qword [rbp + 0x420]
mov rax, rcx
mov qword [r11 + 0x10], rbx
mov rbx, r9
mov qword [r11 - 0x28], rdi
mov rdi, r8
mov qword [r11 - 0x30], r14
mov r14d, edx
mov qword [r11 - 0x38], r15
mov r15, r8
mov qword [rsp + 0x78], r8
xor r8d, r8d
test r15, r15
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x58], rcx
mov r13d, r8d
sete sil
mov qword [rbp - 0x80], r12
test byte [0x1402c1390], 1
jne 0x14017bea6
lock bts qword [0x1402c1390], 0x1f
jb 0x14017be87
lea r9d, ds:[r8 + 4]
mov ecx, 0x400
lea r8, [rbp - 0x78]
lea edx, [r13 + 0xe]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14017be21
mov rax, qword [rbp - 0x78]
test ax, ax
je 0x14017be21
cmp word [rbp - 0x76], r13w
jne 0x14017be21
mov word [0x1402bb508], ax
mov r9d, 4
lea r8, [rbp - 0x78]
mov ecx, 0x400
lea edx, [r9 + 0xb]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14017be55
mov rax, qword [rbp - 0x78]
test ax, ax
je 0x14017be55
cmp word [rbp - 0x76], r13w
jne 0x14017be55
mov word [0x1402bc744], ax
cmp word [0x1402bb508], 0x2e
je 0x14017be74
lea rdx, [0x1402332cc]
xor ecx, ecx
call fcn.1401efe28
mov qword [0x1402c86e8], rax
lea rcx, [0x1402c1390]
nop dword [rax + rax]
call sym.SystemInformer.exe_QifSetEvent
jmp 0x14017be9e
test byte [0x1402c1390], 1
jne 0x14017bea6
xor edx, edx
lea rcx, [0x1402c1390]
call sym.SystemInformer.exe_QifWaitForEvent
mov rax, qword [rsp + 0x58]
xor r8d, r8d
test r14d, r14d
je 0x14017ccf5
movaps xmmword [rsp + 0x4b0], xmm6
lea r9, [0x140000000]
movsd xmm6, qword [0x14028d350]
mov r11d, 1
movaps xmmword [rsp + 0x4a0], xmm7
movsd xmm7, qword [0x14028d2f8]
mov byte [rsp + 0x30], sil
jmp 0x14017bef3
xor r8d, r8d
mov rdx, rax
mov qword [rsp + 0x50], rax
mov rdi, rax
mov qword [rsp + 0x70], r13
mov r10, rax
dec r14d
add rax, 0x20
mov dword [rsp + 0x60], r14d
mov r12d, dword [rdx]
mov r14d, r8d
mov qword [rsp + 0x58], rax
mov eax, r12d
and eax, 0x3f
cmp eax, 0xc
ja case.default.0x14017bf39
cdqe
mov ecx, dword [r9 + rax*4 + 0x17cd70]
add rcx, r9
jmp rcx
nop dword [rax + rax]
test sil, sil
jne 0x14017bf6e
lea rax, [r13 + 2]
cmp rbx, rax
jae 0x14017bf65
add r15, 2
mov byte [rsp + 0x30], 1
add r13, 2
jmp case.default.0x14017bf39
movzx eax, word [r10 + 0x10]
mov word [r15], ax
add r15, 2
add r13, 2
jmp case.default.0x14017bf39
nop dword [rax + rax]
test sil, sil
jne 0x14017bfb4
mov r8, qword [r10 + 0x10]
lea rax, [r8 + r13]
cmp rbx, rax
jae 0x14017bfa5
mov rax, r8
mov byte [rsp + 0x30], 1
shr rax, 1
add r13, r8
jmp 0x14017cc07
mov rdx, qword [r10 + 0x18]
mov rcx, r15
call fcn.1402074d0
mov r10, rdi
mov rax, qword ds:[r10 + 0x10]
shr rax, 1
add r13, qword [r10 + 0x10]
jmp 0x14017cc07
mov rdx, qword [r10 + 0x10]
xorps xmm1, xmm1
mov rdi, rdx
mov ecx, edx
and rdi, 0xfffffffffffffff1
and ecx, 0xf
je 0x14017bff7
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdi]
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
je 0x14017bff3
mov edi, ecx
shr rdi, 1
jmp 0x14017c033
add rdi, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdi]
pmovmskb eax, xmm0
bsf ecx, eax
jne 0x14017c025
nop word [rax + rax]
add rdi, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdi]
pmovmskb eax, xmm0
bsf ecx, eax
je 0x14017c010
sub rdi, rdx
mov eax, ecx
sar rdi, 1
shr rax, 1
add rdi, rax
test sil, sil
jne 0x14017c065
lea r8, [rdi + rdi]
lea rax, [r8 + r13]
cmp rbx, rax
jae 0x14017c058
mov byte [rsp + 0x30], 1
lea r15, [r15 + rdi*2]
lea r13, [r13 + rdi*2]
jmp case.default.0x14017bf39
mov rcx, r15
call fcn.1402074d0
lea r15, [r15 + rdi*2]
lea r13, [r13 + rdi*2]
jmp case.default.0x14017bf39
cmp r12d, 3
jne 0x14017c083
mov rbx, qword [r10 + 0x18]
mov rdi, qword [rdx + 0x10]
jmp 0x14017c099
mov rbx, qword [rdx + 0x10]
mov rdi, 0xffffffffffffffff
nop
inc rdi
cmp byte [rbx + rdi], 0
jne 0x14017c090
mov r8d, edi
lea rcx, [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeSize]
test eax, eax
js case.default.0x14017bf39
test sil, sil
mov rsi, qword [rsp + 0x38]
jne 0x14017c108
mov ecx, dword [rsp + 0x40]
lea rax, [rcx + r13]
cmp rsi, rax
jae 0x14017c0df
mov eax, ecx
mov byte [rsp + 0x30], 1
shr rax, 1
add r13, rcx
lea r15, [r15 + rax*2]
jmp 0x14017cc10
lfence
mov edx, dword [rsp + 0x40]
mov r9, rbx
xor r8d, r8d
mov dword [rsp + 0x20], edi
mov rcx, r15
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
nop dword [rax]
test eax, eax
js 0x14017cc10
mov ecx, dword [rsp + 0x40]
mov eax, ecx
shr rax, 1
add r13, rcx
lea r15, [r15 + rax*2]
jmp 0x14017cc10
mov eax, dword [r10 + 0x10]
mov r14d, eax
mov r8d, eax
shr r14d, 0x1f
neg r8d
test eax, eax
cmovns r8d, eax
jmp 0x14017c13a
mov r8d, dword [r10 + 0x10]
mov r11d, 0xa
bt r12d, 8
jae 0x14017c156
movzx ecx, byte [r10 + 0xa]
lea eax, [rcx - 2]
cmp al, 0x43
ja 0x14017c156
mov r11d, ecx
bt r12d, 0x1d
lea r10, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
lea rax, [0x140287d40]
cmovae r10, rax
lea r9, [rbp + 0x38e]
xor esi, esi
mov ebx, esi
test r8d, r8d
je 0x14017c202
bt r12d, 0x10
jae 0x14017c1e0
mov edi, esi
xor edx, edx
mov eax, r8d
div r11d
inc ebx
inc edi
mov r8d, eax
movsx ecx, byte [rdx + r10]
mov word [r9], cx
sub r9, 2
cmp edi, 3
jne 0x14017c1ca
test eax, eax
je 0x14017c1ce
movzx eax, word [0x1402bc744]
mov word [r9], ax
sub r9, 2
inc ebx
jmp 0x14017c190
test eax, eax
jne 0x14017c192
mov eax, 1
lea edi, [rax + 0x2f]
test r14d, r14d
je 0x14017c21e
mov esi, eax
jmp 0x14017c226
xor edx, edx
mov eax, r8d
div r11d
inc ebx
mov r8d, eax
movsx ecx, byte [rdx + r10]
mov word [r9], cx
sub r9, 2
test eax, eax
jne 0x14017c1e0
nop
jmp 0x14017c1ce
mov edi, 0x30
lea r9, [rbp + 0x38c]
mov eax, 1
mov word [rbp + 0x38e], di
mov ebx, eax
jmp 0x14017c1d6
bt r12d, 0x11
cmovb esi, eax
mov eax, r12d
and eax, 0x50000
cmp eax, 0x40000
jne 0x14017c258
mov r10, qword [rsp + 0x50]
lea eax, [rsi + rbx]
movzx ecx, word [r10 + 6]
cmp eax, ecx
jae 0x14017c258
mov edx, ecx
or r14d, 4
sub edx, esi
sub edx, ebx
mov dword [rsp + 0x44], edx
add esi, edx
jmp 0x14017c25c
mov edx, dword [rsp + 0x44]
cmp byte [rsp + 0x30], 0
jne 0x14017c2db
lea eax, [rsi + rbx]
lea rax, [rax*2]
add rax, r13
cmp qword [rsp + 0x38], rax
jae 0x14017c28a
lea eax, [rsi + rbx]
mov byte [rsp + 0x30], 1
lea r13, [r13 + rax*2]
jmp case.default.0x14017bf39
test r14b, 1
je 0x14017c298
mov word [r15], 0x2d
jmp 0x14017c2a5
bt r12d, 0x11
jae 0x14017c2a9
mov word [r15], 0x2b
add r15, 2
test r14b, 4
je 0x14017c2c4
test rdx, rdx
je 0x14017c2c0
movzx eax, di
mov rcx, rdx
mov rdi, r15
rep stosw word [rdi], ax
lea r15, [r15 + rdx*2]
mov edi, ebx
lea rdx, [r9 + 2]
add rdi, rdi
mov rcx, r15
mov r8, rdi
call fcn.1402074d0
add r15, rdi
lea eax, [rsi + rbx]
lea r13, [r13 + rax*2]
jmp case.default.0x14017bf39
mov rax, qword [rdi + 0x10]
mov r14, rax
mov r8, rax
shr r14, 0x3f
neg r8
cmovs r8, rax
jmp 0x14017c303
mov r8, qword [r10 + 0x10]
mov edx, 0xa
bt r12d, 8
jae 0x14017c31d
movzx ecx, byte [r10 + 0xa]
lea eax, [rcx - 2]
cmp al, 0x43
ja 0x14017c31d
mov edx, ecx
bt r12d, 0x1d
lea r10, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
lea rax, [0x140287d40]
cmovae r10, rax
lea r9, [rbp + 0x38e]
xor esi, esi
mov ebx, esi
test r8, r8
je 0x14017c3e7
mov r11d, edx
bt r12d, 0x10
jae 0x14017c3c0
mov edi, esi
nop word [rax + rax]
xor edx, edx
mov rax, r8
div r11
inc ebx
inc edi
mov r8, rax
mov eax, edx
movsx ecx, byte [rax + r10]
mov word [r9], cx
sub r9, 2
cmp edi, 3
jne 0x14017c39d
test r8, r8
je 0x14017c3a5
movzx eax, word [0x1402bc744]
mov word [r9], ax
sub r9, 2
inc ebx
jmp 0x14017c353
nop dword [rax]
test r8, r8
jne 0x14017c360
mov edi, 0x30
lea r11d, [rdi - 0x2f]
test r14d, r14d
je 0x14017c3ff
mov esi, r11d
jmp 0x14017c408
xor edx, edx
mov rax, r8
div r11
inc ebx
mov r8, rax
mov eax, edx
movsx ecx, byte [rax + r10]
mov word [r9], cx
sub r9, 2
test r8, r8
jne 0x14017c3c0
jmp 0x14017c3a5
mov edi, 0x30
lea r9, [rbp + 0x38c]
mov word [rbp + 0x38e], di
mov ebx, r11d
jmp 0x14017c3ae
bt r12d, 0x11
cmovb esi, r11d
mov eax, r12d
and eax, 0x50000
cmp eax, 0x40000
jne 0x14017c43a
mov r10, qword [rsp + 0x50]
lea eax, [rsi + rbx]
movzx ecx, word [r10 + 6]
cmp eax, ecx
jae 0x14017c43a
mov edx, ecx
or r14d, 4
sub edx, esi
sub edx, ebx
mov dword [rsp + 0x48], edx
add esi, edx
jmp 0x14017c43e
mov edx, dword [rsp + 0x48]
cmp byte [rsp + 0x30], 0
jne 0x14017c2db
lea eax, [rsi + rbx]
lea rax, [rax*2]
add rax, r13
cmp qword [rsp + 0x38], rax
jae 0x14017c470
lea eax, [rsi + rbx]
mov byte [rsp + 0x30], 1
lea r13, [r13 + rax*2]
jmp case.default.0x14017bf39
test r14b, 1
je 0x14017c47e
mov word [r15], 0x2d
jmp 0x14017c48b
bt r12d, 0x11
jae 0x14017c48f
mov word [r15], 0x2b
add r15, 2
test r14b, 4
je 0x14017c4aa
test rdx, rdx
je 0x14017c4a6
movzx eax, di
mov rcx, rdx
mov rdi, r15
rep stosw word [rdi], ax
lea r15, [r15 + rdx*2]
mov edi, ebx
lea rdx, [r9 + 2]
add rdi, rdi
mov rcx, r15
mov r8, rdi
call fcn.1402074d0
lea eax, [rsi + rbx]
add r15, rdi
lea r13, [r13 + rax*2]
jmp case.default.0x14017bf39
test r12b, 0x40
je 0x14017c4ea
movzx r8d, word ds:[r10 + 4]
mov eax, 0xa2
cmp r8d, eax
jbe 0x14017c4f0
mov r8d, eax
jmp 0x14017c4f0
mov r8d, 6
movsd xmm0, qword [r10 + 0x10]
lea r9, [rbp - 0x6f]
mov edx, r12d
lea rbx, [rbp - 0x6f]
call fcn.1401d0340
test al, al
jne 0x14017c50f
mov byte [rbp - 0x6f], al
jmp 0x14017c55e
mov rdx, qword [0x1402c86e8]
test rdx, rdx
je 0x14017c542
movzx eax, byte ds:[rbp - 0x6f]
test al, al
je 0x14017c542
lea rcx, [rbp - 0x6f]
cmp al, 0x2e
je 0x14017c539
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x14017c528
jmp 0x14017c542
movzx eax, byte [0x1402bb508]
mov byte [rcx], al
bt r12d, 0x1d
jae 0x14017c55e
lea rcx, [rbp - 0x6f]
test rdx, rdx
je 0x14017c559
call fcn.1401ef450
jmp 0x14017c55e
call fcn.1401ef3f0
mov r9d, dword [rdi]
mov r10, rdi
bt r9d, 0xf
jae 0x14017c611
movzx ecx, byte ds:[rbp - 0x6f]
lea rax, [rbp - 0x6f]
movzx r8d, byte [0x1402bb508]
test cl, cl
je 0x14017c59d
movzx edx, cl
movzx ecx, dl
cmp dl, r8b
je 0x14017c59d
movzx ecx, byte [rax + 1]
inc rax
movzx edx, cl
test cl, cl
jne 0x14017c587
inc rax
test cl, cl
je 0x14017c611
movzx ecx, byte [rax]
test cl, cl
je 0x14017c5c4
nop dword [rax + rax]
sub cl, 0x45
test cl, 0xdf
je 0x14017c5c4
movzx ecx, byte ds:[rax + 1]
inc rax
test cl, cl
jne 0x14017c5b0
movzx edi, byte [rax - 1]
mov rdx, rax
dec rax
cmp dil, 0x30
jne 0x14017c5ed
nop dword [rax]
nop dword [rax + rax]
movzx edi, byte [rax - 1]
dec rax
cmp dil, 0x30
je 0x14017c5e0
cmp dil, r8b
lea rcx, [rax - 1]
cmovne rcx, rax
nop dword [rax + rax]
movzx eax, byte [rdx]
lea rcx, [rcx + 1]
mov byte [rcx], al
lea rdx, [rdx + 1]
test al, al
jne 0x14017c600
lea rax, [rbp - 0x6f]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14017c620
cmp byte [rbp - 0x6f], 0x2d
mov r14d, 1
jne 0x14017c644
dec r8d
lea rbx, [rbp - 0x6e]
xor ecx, ecx
mov esi, r14d
jmp 0x14017c658
mov ecx, 0
bt r9d, 0x11
mov esi, ecx
mov eax, 2
cmovb esi, eax
mov eax, r9d
and eax, 0x13000
cmp eax, 0x10000
jne 0x14017c79b
movzx eax, byte [rbx]
mov r9, rbx
sub al, 0x30
cmp al, 0xa
jae 0x14017c68e
mov qword [rbp - 0x78], rbx
nop dword [rax + rax]
movzx eax, byte [r9 + 1]
inc r9
sub al, 0x30
cmp al, 0xa
jb 0x14017c680
mov r10d, r9d
sub r10d, ebx
lea edi, [r10 + 2]
je 0x14017c6ac
mov eax, 0xaaaaaaab
mul edi
mov r11d, edx
shr r11d, 1
dec r11d
jmp 0x14017c6af
mov r11d, ecx
movzx r12d, byte ds:[rsp + 0x30]
lea ecx, [r11 + r8]
add ecx, ecx
test r12b, r12b
jne 0x14017c6e2
test esi, esi
lea eax, [rcx + 2]
cmove eax, ecx
add rax, r13
cmp qword [rsp + 0x38], rax
jae 0x14017c6e2
mov r12b, 1
mov byte [rsp + 0x30], r12b
jmp 0x14017c75f
mov eax, 0xaaaaaaab
mov ecx, r10d
mul edi
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
test r12b, r12b
jne 0x14017c75f
test sil, 1
je 0x14017c706
mov word [r15], 0x2d
jmp 0x14017c712
test sil, 2
je 0x14017c716
mov word [r15], 0x2b
add r15, 2
test r10d, r10d
je 0x14017c75f
nop dword [rax + rax]
movsx eax, byte [rbx]
dec ecx
mov word [r15], ax
inc rbx
mov eax, edi
add r15, 2
dec edi
test eax, eax
jne 0x14017c75b
test ecx, ecx
je 0x14017c75f
movzx eax, word [0x1402bc744]
dec ecx
mov word [r15], ax
mov edi, r14d
movsx eax, byte [rbx]
mov word [r15 + 2], ax
add r15, 4
inc rbx
test ecx, ecx
jne 0x14017c720
nop
test esi, esi
je 0x14017c768
add r13, 2
lea eax, [r11 + r10]
lea r13, [r13 + rax*2]
test r12b, r12b
jne case.default.0x14017bf39
sub r8d, r10d
mov rcx, r9
mov edi, r8d
mov r8, r15
mov edx, edi
call sym.SystemInformer.exe_QiZeroExtendToUtf16Buffer
lea r15, [r15 + rdi*2]
lea r13, [r13 + rdi*2]
jmp case.default.0x14017bf39
test esi, esi
setne cl
mov rdx, rcx
bt r9d, 0x12
jae 0x14017c7d1
movzx r9d, word [r10 + 6]
mov edi, r8d
lea rax, [rcx + rdi]
cmp rax, r9
jae 0x14017c7d1
mov edx, r9d
or esi, 4
sub rdx, rdi
mov r9, rdx
sub r9, rcx
mov qword [rsp + 0x68], r9
jmp 0x14017c7d6
mov r9, qword [rsp + 0x68]
movzx r12d, byte ds:[rsp + 0x30]
test r12b, r12b
jne 0x14017c857
mov eax, r8d
add rax, rdx
lea rax, [rax*2]
add rax, r13
cmp qword [rsp + 0x38], rax
jae 0x14017c80c
mov byte [rsp + 0x30], 1
lea r13, [r13 + rdx*2]
jmp case.default.0x14017bf39
test sil, 1
je 0x14017c81a
mov word [r15], 0x2d
jmp 0x14017c82c
nop word [rax + rax]
test sil, 2
je 0x14017c830
mov word [r15], 0x2b
add r15, 2
test sil, 4
je 0x14017c857
test r9, r9
je 0x14017c84c
mov eax, 0x30
mov rdi, r15
movzx eax, ax
mov rcx, r9
rep stosw word [rdi], ax
lea r15, [r15 + r9*2]
lea r13, [r13 + rdx*2]
jmp 0x14017c869
lea r13, ds:[r13 + rdx*2]
test r12b, r12b
jne case.default.0x14017bf39
mov edi, r8d
mov rcx, rbx
mov edx, edi
mov r8, r15
call sym.SystemInformer.exe_QiZeroExtendToUtf16Buffer
lea r15, [r15 + rdi*2]
lea r13, [r13 + rdi*2]
jmp case.default.0x14017bf39
mov rdx, qword [r10 + 0x10]
mov esi, r8d
xorps xmm0, xmm0
test rdx, rdx
js 0x14017c89d
cvtsi2sd xmm0, rdx
jmp 0x14017c8b5
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2sd xmm0, rcx
addsd xmm0, xmm0
test rdx, rdx
jne 0x14017c8fe
nop word [rax + rax]
cmp byte [rsp + 0x30], dl
jne 0x14017c8ec
lea rax, [r13 + 2]
cmp rbx, rax
jae 0x14017c8e6
mov rsi, qword [rsp + 0x38]
add r15, 2
add r13, 2
mov byte [rsp + 0x30], 1
jmp 0x14017cc15
mov word [r15], 0x30
mov rsi, qword [rsp + 0x38]
add r15, 2
add r13, 2
jmp 0x14017cc15
bt r12d, 8
jae 0x14017c90c
movzx eax, byte [r10 + 0xa]
jmp 0x14017c912
mov eax, dword [0x1402c222c]
comisd xmm0, xmm6
jb 0x14017c930
cmp esi, 7
jae 0x14017c930
nop dword [rax]
cmp esi, eax
jae 0x14017c930
mulsd xmm0, xmm7
inc esi
comisd xmm0, xmm6
jae 0x14017c918
test r12b, 0x40
je 0x14017c93d
movzx eax, word [r10 + 4]
jmp 0x14017c942
mov eax, 2
movzx r8d, ax
lea r9, [rbp - 0x6f]
mov eax, 0xa2
lea rbx, [rbp - 0x6f]
cmp r8d, eax
mov edx, 0x1804b
cmova r8d, eax
call fcn.1401d0340
movzx r8d, word [0x1402bb508]
test al, al
jne 0x14017c97a
xor dil, dil
mov byte [rbp - 0x6f], dil
jmp 0x14017c9ad
cmp qword [0x1402c86e8], 0
movzx edi, byte [rbp - 0x6f]
je 0x14017c9ad
test dil, dil
je 0x14017c9ad
lea rcx, [rbp - 0x6f]
movzx eax, dil
cmp al, 0x2e
je 0x14017c9a6
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x14017c995
jmp 0x14017c9ad
mov byte [rcx], r8b
movzx edi, byte [rbp - 0x6f]
lea rax, [rbp - 0x6f]
movzx ecx, dil
test dil, dil
je 0x14017c9d6
movzx edx, cl
nop dword [rax]
movzx ecx, dl
cmp dl, r8b
je 0x14017c9d6
movzx ecx, byte [rax + 1]
inc rax
movzx edx, cl
test cl, cl
jne 0x14017c9c0
inc rax
test cl, cl
je 0x14017ca48
movzx ecx, byte [rax]
test cl, cl
je 0x14017c9f7
sub cl, 0x45
test cl, 0xdf
je 0x14017c9f7
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
jne 0x14017c9e4
movzx edi, byte [rax - 1]
mov rdx, rax
dec rax
cmp dil, 0x30
jne 0x14017ca1d
nop word [rax + rax]
movzx edi, byte [rax - 1]
dec rax
cmp dil, 0x30
je 0x14017ca10
cmp dil, r8b
lea rcx, [rax - 1]
cmovne rcx, rax
nop dword [rax + rax]
movzx eax, byte ds:[rdx]
lea rcx, [rcx + 1]
mov byte [rcx], al
lea rdx, [rdx + 1]
test al, al
jne 0x14017ca30
movzx edi, byte [rbp - 0x6f]
lea rax, [rbp - 0x6f]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14017ca53
nop dword [rax]
cmp dil, 0x2d
jne 0x14017ca73
mov r14d, 1
lea rbx, [rbp - 0x6e]
dec r8d
movzx eax, byte [rbx]
mov r9, rbx
sub al, 0x30
cmp al, 0xa
jae 0x14017ca9e
mov qword [rbp - 0x78], rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r9 + 1]
inc r9
sub al, 0x30
cmp al, 0xa
jb 0x14017ca90
mov r10d, r9d
sub r10d, ebx
lea edi, [r10 + 2]
je 0x14017cabc
mov eax, 0xaaaaaaab
mul edi
mov r11d, edx
shr r11d, 1
dec r11d
jmp 0x14017cabf
xor r11d, r11d
movzx r12d, byte [rsp + 0x30]
lea ecx, [r11 + r8]
add ecx, ecx
test r12b, r12b
jne 0x14017caf1
test r14d, r14d
lea eax, [rcx + 2]
cmove eax, ecx
add rax, r13
cmp qword [rsp + 0x38], rax
jae 0x14017caf1
mov r12b, 1
mov byte [rsp + 0x30], r12b
jmp 0x14017cb64
mov eax, 0xaaaaaaab
mov ecx, r10d
mul edi
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
test r12b, r12b
jne 0x14017cb64
test r14d, r14d
je 0x14017cb16
mov word [r15], 0x2d
add r15, 2
test r10d, r10d
je 0x14017cb64
nop dword [rax + rax]
movsx eax, byte [rbx]
dec ecx
mov word [r15], ax
inc rbx
mov eax, edi
add r15, 2
dec edi
test eax, eax
jne 0x14017cb5d
test ecx, ecx
je 0x14017cb64
movzx eax, word [0x1402bc744]
dec ecx
mov word [r15], ax
mov edi, 1
movsx eax, byte [rbx]
mov word [r15 + 2], ax
add r15, 4
inc rbx
nop dword [rax]
test ecx, ecx
jne 0x14017cb20
test r14d, r14d
je 0x14017cb6d
add r13, 2
lea eax, ds:[r11 + r10]
lea rbx, [rax*2]
add rbx, r13
test r12b, r12b
jne 0x14017cbe5
sub r8d, r10d
mov rcx, r9
mov edi, r8d
mov r8, r15
mov edx, edi
call sym.SystemInformer.exe_QiZeroExtendToUtf16Buffer
mov edx, esi
lea rbx, [rbx + rdi*2]
add rdx, rdx
lea r9, [0x140000000]
lea rcx, [rbx + 2]
lea r15, [r15 + rdi*2]
add rcx, qword [r9 + rdx*8 + 0x2c13a0]
cmp qword [rsp + 0x38], rcx
jae 0x14017cbc6
mov byte [rsp + 0x30], 1
jmp 0x14017cbec
mov word [r15], 0x20
lea rcx, [r15 + 2]
mov r8, qword [r9 + rdx*8 + 0x2c13a0]
mov rdx, qword [r9 + rdx*8 + 0x2c13a8]
call fcn.1402074d0
lea r9, [0x140000000]
mov eax, esi
add rax, rax
mov rcx, qword [r9 + rax*8 + 0x2c13a0]
lea rax, [rcx + 2]
shr rax, 1
lea r13, [rcx + 2]
add r13, rbx
lea r15, [r15 + rax*2]
mov rsi, qword [rsp + 0x38]
mov r10, qword [rsp + 0x50]
mov ecx, dword [r10]
mov r8, r13
sub r8, qword [rsp + 0x70]
test ecx, 0xc0000000
je 0x14017ccb2
movzx ebx, word [r10 + 6]
add rbx, rbx
cmp r8, rbx
jae 0x14017ccb2
sub rbx, r8
cmp byte [rsp + 0x30], 0
jne 0x14017cca5
lea rax, [rbx + r13]
cmp rsi, rax
jae 0x14017cc53
mov byte [rsp + 0x30], 1
jmp 0x14017cca5
test cl, cl
jns 0x14017cc5e
movzx r14d, word [r10 + 8]
jmp 0x14017cc64
mov r14d, 0x20
mov rsi, rbx
shr rsi, 1
test ecx, ecx
jns 0x14017cc78
test rsi, rsi
je 0x14017cca5
mov rdi, r15
jmp 0x14017cc9b
lfence
mov rax, r8
mov rdi, r15
shr rax, 1
add rax, rax
sub rdi, rax
mov rdx, rdi
lea rcx, [rdi + rsi*2]
call fcn.1402074d0
test rsi, rsi
je 0x14017cca5
mov rcx, rsi
movzx eax, r14w
rep stosw word [rdi], ax
mov rax, rbx
shr rax, 1
add r13, rbx
lea r15, [r15 + rax*2]
mov r14d, dword [rsp + 0x60]
lea r9, [0x140000000]
movzx esi, byte [rsp + 0x30]
mov r11d, 1
mov rbx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x58]
test r14d, r14d
jne 0x14017bef0
movaps xmm7, xmmword [rsp + 0x4a0]
movaps xmm6, xmmword [rsp + 0x4b0]
mov rdi, qword [rsp + 0x78]
mov r12, qword [rbp - 0x80]
mov r14, qword ss:[rsp + 0x4c8]
test sil, sil
jne 0x14017cd11
lea rax, [r13 + 2]
cmp rbx, rax
jae 0x14017cd68
mov sil, 1
test rdi, rdi
je 0x14017cd20
test rbx, rbx
je 0x14017cd20
xor eax, eax
mov word [rdi], ax
mov r15, qword [rsp + 0x4c0]
mov rdi, qword [rsp + 0x4d0]
mov rbx, qword [rsp + 0x508]
test r12, r12
je 0x14017cd45
lea rax, [r13 + 2]
mov qword [r12], rax
test sil, sil
sete al
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.1401e0100
add rsp, 0x4d8
pop r13
pop r12
pop rsi
pop rbp
ret
xor eax, eax
mov word [r15], ax
jmp 0x14017cd20