Function at 0x1400ea9a0
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
lea rbp, [rax - 0x6d8]
sub rsp, 0x7c8
mov qword [rax - 0x18], rbx
mov rbx, r9
mov qword [rax - 0x20], rdi
mov rdi, r8
mov qword [rax - 0x28], r12
mov r12, r8
xor r8d, r8d
mov qword [rax - 0x30], r13
test r12, r12
mov qword [rax - 0x38], r14
mov r14d, edx
mov rax, rcx
sete sil
mov r13d, r8d
test byte [0x14018e290], 1
jne 0x1400eaadd
lock bts qword [0x14018e290], 0x1f
jae 0x1400eaa28
test byte [0x14018e290], 1
jne 0x1400eaadd
xor edx, edx
lea rcx, [0x14018e290]
call sym.ProcessHacker.exe_PhfWaitForEvent
jmp 0x1400eaad3
mov r9d, 4
lea r8, [rsp + 0x70]
mov ecx, 0x400
lea edx, [r9 + 0xa]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1400eaa68
mov rax, qword [rsp + 0x70]
test ax, ax
je 0x1400eaa68
movzx edx, word [0x14018e218]
cmp word [rsp + 0x72], r13w
cmove dx, ax
mov word [0x14018e218], dx
mov r9d, 4
lea r8, [rsp + 0x70]
mov ecx, 0x400
lea edx, [r9 + 0xb]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1400eaaa8
mov rax, qword [rsp + 0x70]
test ax, ax
je 0x1400eaaa8
movzx ecx, word [0x14018dfb4]
cmp word [rsp + 0x72], r13w
cmove cx, ax
mov word [0x14018dfb4], cx
cmp word [0x14018e218], 0x2e
je 0x1400eaac7
lea rdx, [0x140162f16]
xor ecx, ecx
call fcn.140115fc8
mov qword [0x1401941c0], rax
lea rcx, [0x14018e290]
call sym.ProcessHacker.exe_PhfSetEvent
mov rax, qword [rbp + 0x6e0]
xor r8d, r8d
test r14d, r14d
je 0x1400eb866
mov qword [rsp + 0x798], r15
lea r11, [0x140000000]
movaps xmmword [rsp + 0x780], xmm6
mov r10d, 2
movsd xmm6, qword [0x14016e6d0]
movaps xmmword [rsp + 0x770], xmm7
movsd xmm7, qword [0x14016e678]
movaps xmmword [rsp + 0x760], xmm8
movsd xmm8, qword [0x14016e710]
mov dword [rsp + 0x50], esi
jmp 0x1400eab43
xor r8d, r8d
mov rdx, rax
mov qword [rsp + 0x58], rax
mov rdi, rax
mov qword [rbp - 0x70], r13
mov r9, rax
dec r14d
add rax, 0x20
mov dword [rbp + 0x6e8], r14d
mov r15d, dword [rdx]
mov r14d, r8d
mov qword [rbp + 0x6e0], rax
mov eax, r15d
and eax, 0x3f
cmp eax, 0xc
ja case.default.0x1400eab8c
cdqe
mov ecx, dword [r11 + rax*4 + 0xeb8dc]
add rcx, r11
jmp rcx
test sil, sil
jne 0x1400eabb8
lea rax, [r13 + 2]
cmp rbx, rax
jae 0x1400eabae
add r12, 2
mov byte [rsp + 0x50], 1
add r13, 2
jmp case.default.0x1400eab8c
movzx eax, word [r9 + 0x10]
mov word [r12], ax
add r12, 2
add r13, 2
jmp case.default.0x1400eab8c
test sil, sil
jne 0x1400eabfd
mov r8, qword [r9 + 0x10]
lea rax, [r8 + r13]
cmp rbx, rax
jae 0x1400eabee
mov rax, r8
mov byte [rsp + 0x50], 1
shr rax, 1
add r13, r8
lea r12, [r12 + rax*2]
jmp case.default.0x1400eab8c
mov rdx, qword [r9 + 0x18]
mov rcx, r12
call fcn.14010e700
mov r9, rdi
mov rax, qword [r9 + 0x10]
shr rax, 1
add r13, qword [r9 + 0x10]
lea r12, [r12 + rax*2]
jmp case.default.0x1400eab8c
mov rcx, qword [r9 + 0x10]
call sym.ProcessHacker.exe_PhCountStringZ
mov rdi, rax
add rdi, rdi
test sil, sil
jne 0x1400eac55
lea rcx, [rdi + r13]
cmp rbx, rcx
jae 0x1400eac41
mov rax, rdi
mov byte [rsp + 0x50], 1
shr rax, 1
add r13, rdi
jmp 0x1400eb769
mov r11, qword [rsp + 0x58]
mov r8, rdi
mov rcx, r12
mov rdx, qword [r11 + 0x10]
call fcn.14010e700
mov rax, rdi
shr rax, 1
add r13, rdi
jmp 0x1400eb769
cmp r15d, 3
jne 0x1400eac73
mov rbx, qword [r9 + 0x18]
mov rdi, qword [rdx + 0x10]
jmp 0x1400eac89
mov rbx, qword [rdx + 0x10]
or rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp byte [rbx + rdi], 0
jne 0x1400eac80
mov r8d, edi
lea rcx, [rsp + 0x60]
mov rdx, rbx
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeSize]
test eax, eax
js 0x1400eb76d
test sil, sil
jne 0x1400eace7
mov ecx, dword [rsp + 0x60]
lea rax, [rcx + r13]
cmp qword [rbp + 0x6f8], rax
jae 0x1400eacca
mov eax, ecx
mov byte [rsp + 0x50], 1
shr rax, 1
add r13, rcx
jmp 0x1400eb769
mov edx, ecx
mov dword [rsp + 0x20], edi
mov rcx, r12
mov r9, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
test eax, eax
js 0x1400eb76d
mov ecx, dword [rsp + 0x60]
mov eax, ecx
shr rax, 1
add r13, rcx
jmp 0x1400eb769
mov eax, dword [r9 + 0x10]
mov r14d, eax
mov edi, eax
shr r14d, 0x1f
neg edi
test eax, eax
cmovns edi, eax
jmp 0x1400ead12
mov edi, dword [r9 + 0x10]
mov r11d, 0xa
bt r15d, 8
jae 0x1400ead2f
movzx ecx, byte [r9 + 0xa]
lea eax, [rcx - 2]
cmp al, 0x43
ja 0x1400ead2f
movzx r11d, cl
bt r15d, 0x1d
lea r10, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
lea rax, str.0123456789abcdefghijklmnopqrstuvwxyz_________._:_________
cmovae r10, rax
lea r9, [rbp + 0x39e]
xor esi, esi
mov ebx, esi
test edi, edi
je 0x1400eadce
bt r15d, 0x10
jae 0x1400eadb0
mov r8d, esi
nop
xor edx, edx
mov eax, edi
div r11d
inc ebx
inc r8d
mov edi, eax
movsx ecx, byte [rdx + r10]
mov word [r9], cx
sub r9, 2
cmp r8d, 3
jne 0x1400ead99
test eax, eax
je 0x1400ead9d
movzx eax, word [0x14018dfb4]
mov r8d, esi
mov word [r9], ax
sub r9, 2
inc ebx
test edi, edi
jne 0x1400ead60
mov eax, 1
lea edi, [rax + 0x2f]
test r14d, r14d
je 0x1400eadea
mov esi, eax
jmp 0x1400eadf2
xor edx, edx
mov eax, edi
div r11d
inc ebx
mov edi, eax
movsx ecx, byte [rdx + r10]
mov word [r9], cx
sub r9, 2
test eax, eax
jne 0x1400eadb0
jmp 0x1400ead9d
mov edi, 0x30
lea r9, [rbp + 0x39c]
mov eax, 1
mov word [rbp + 0x39e], di
mov ebx, eax
jmp 0x1400eada5
bt r15d, 0x11
cmovb esi, eax
mov eax, r15d
and eax, 0x50000
cmp eax, 0x40000
jne 0x1400eae24
mov r11, qword [rsp + 0x58]
lea eax, [rsi + rbx]
movzx ecx, word [r11 + 6]
cmp eax, ecx
jae 0x1400eae24
mov edx, ecx
or r14d, 4
sub edx, esi
sub edx, ebx
mov dword [rsp + 0x64], edx
add esi, edx
jmp 0x1400eae28
mov edx, dword [rsp + 0x64]
cmp byte [rsp + 0x50], 0
jne 0x1400eaeac
lea eax, [rsi + rbx]
lea rax, [rax*2]
add rax, r13
cmp qword [rbp + 0x6f8], rax
jae 0x1400eae58
lea eax, [rsi + rbx]
mov byte [rsp + 0x50], 1
lea r13, [r13 + rax*2]
jmp 0x1400eb76d
test r14b, 1
je 0x1400eae65
mov eax, 0x2d
jmp 0x1400eae71
bt r15d, 0x11
jae 0x1400eae7a
mov eax, 0x2b
mov word [r12], ax
add r12, 2
test r14b, 4
je 0x1400eae95
test rdx, rdx
je 0x1400eae91
movzx eax, di
mov rcx, rdx
mov rdi, r12
rep stosw word [rdi], ax
lea r12, [r12 + rdx*2]
mov edi, ebx
lea rdx, [r9 + 2]
add rdi, rdi
mov rcx, r12
mov r8, rdi
call fcn.14010e700
add r12, rdi
lea eax, [rsi + rbx]
lea r13, [r13 + rax*2]
jmp 0x1400eb76d
mov rax, qword [rdi + 0x10]
mov r14, rax
cqo
mov rdi, rax
shr r14, 0x3f
xor rdi, rdx
sub rdi, rdx
jmp 0x1400eaed5
mov rdi, qword [r9 + 0x10]
mov r10d, 0xa
bt r15d, 8
jae 0x1400eaef2
movzx ecx, byte [r9 + 0xa]
lea eax, [rcx - 2]
cmp al, 0x43
ja 0x1400eaef2
movzx r10d, cl
bt r15d, 0x1d
lea r11, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
lea rax, str.0123456789abcdefghijklmnopqrstuvwxyz_________._:_________
cmovae r11, rax
lea r9, [rbp + 0x39e]
xor esi, esi
mov ebx, esi
test rdi, rdi
je 0x1400eafb3
bt r15d, 0x10
jae 0x1400eaf90
mov r8d, esi
nop word [rax + rax]
xor edx, edx
mov rax, rdi
div r10
inc ebx
inc r8d
mov rdi, rax
mov eax, edx
movsx ecx, byte [rax + r11]
mov word [r9], cx
sub r9, 2
cmp r8d, 3
jne 0x1400eaf6e
test rdi, rdi
je 0x1400eaf73
movzx eax, word [0x14018dfb4]
mov r8d, esi
mov word [r9], ax
sub r9, 2
inc ebx
test rdi, rdi
jne 0x1400eaf30
mov eax, 1
lea edi, [rax + 0x2f]
test r14d, r14d
je 0x1400eafcf
mov esi, eax
jmp 0x1400eafd7
xor edx, edx
mov rax, rdi
div r10
inc ebx
mov rdi, rax
mov eax, edx
movsx ecx, byte [rax + r11]
mov word [r9], cx
sub r9, 2
test rdi, rdi
jne 0x1400eaf90
jmp 0x1400eaf73
mov edi, 0x30
lea r9, [rbp + 0x39c]
mov eax, 1
mov word [rbp + 0x39e], di
mov ebx, eax
jmp 0x1400eaf7b
bt r15d, 0x11
cmovb esi, eax
mov eax, r15d
and eax, 0x50000
cmp eax, 0x40000
jne 0x1400eb009
mov r11, qword [rsp + 0x58]
lea eax, [rsi + rbx]
movzx ecx, word [r11 + 6]
cmp eax, ecx
jae 0x1400eb009
mov edx, ecx
or r14d, 4
sub edx, esi
sub edx, ebx
mov dword [rsp + 0x68], edx
add esi, edx
jmp 0x1400eb00d
mov edx, dword [rsp + 0x68]
cmp byte [rsp + 0x50], 0
jne 0x1400eaeac
lea eax, [rsi + rbx]
lea rax, [rax*2]
add rax, r13
cmp qword [rbp + 0x6f8], rax
jae 0x1400eb041
lea eax, [rsi + rbx]
mov byte [rsp + 0x50], 1
lea r13, [r13 + rax*2]
jmp 0x1400eb76d
test r14b, 1
je 0x1400eb04e
mov eax, 0x2d
jmp 0x1400eb05a
bt r15d, 0x11
jae 0x1400eb063
mov eax, 0x2b
mov word [r12], ax
add r12, 2
test r14b, 4
je 0x1400eb07e
test rdx, rdx
je 0x1400eb07a
movzx eax, di
mov rcx, rdx
mov rdi, r12
rep stosw word [rdi], ax
lea r12, [r12 + rdx*2]
mov edi, ebx
lea rdx, [r9 + 2]
add rdi, rdi
mov rcx, r12
mov r8, rdi
call fcn.14010e700
lea eax, [rsi + rbx]
add r12, rdi
lea r13, [r13 + rax*2]
jmp 0x1400eb76d
mov ecx, r15d
test r15b, 0x40
je 0x1400eb0bc
movzx edx, word [r9 + 4]
mov eax, 0xa2
cmp edx, eax
cmova edx, eax
jmp 0x1400eb0c1
mov edx, 6
bt r15d, 0xc
jae 0x1400eb0cf
mov eax, 0x65
jmp 0x1400eb0e3
mov eax, 0x66
bt r15d, 0xd
jae 0x1400eb0e3
mov r15d, ecx
mov eax, 0x61
movsd xmm0, qword [r9 + 0x10]
lea ecx, [rax - 0x20]
bt r15d, 0x1d
movsd qword [rbp - 0x80], xmm0
lea r9, [rbp + 0x3a0]
cmovae ecx, eax
lea rsi, [rbp - 0x5f]
mov rax, qword [0x1401941c0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r8
mov r8d, 0x3ff
mov dword [rsp + 0x30], edx
lea rdx, [rbp - 0x5f]
mov dword [rsp + 0x28], ecx
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x20], 0x15e
call fcn.1401177f8
mov r9d, dword [rdi]
mov r11, rdi
movzx edx, byte [rbp - 0x5f]
bt r9d, 0xf
jae 0x1400eb1d4
movzx r8d, byte [0x14018e218]
lea rcx, [rbp - 0x5f]
test dl, dl
je 0x1400eb175
lea rcx, [rbp - 0x5f]
movzx eax, dl
cmp al, r8b
je 0x1400eb175
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1400eb165
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400eb1d4
movzx eax, byte [rcx]
test al, al
je 0x1400eb197
sub al, 0x45
test al, 0xdf
je 0x1400eb197
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1400eb186
movzx eax, byte [rcx - 1]
mov rdi, rcx
dec rcx
cmp al, 0x30
jne 0x1400eb1b0
movzx eax, byte [rcx - 1]
dec rcx
cmp al, 0x30
je 0x1400eb1a5
cmp al, r8b
lea rdx, [rcx - 1]
cmovne rdx, rcx
nop dword [rax + rax]
movzx eax, byte [rdi]
lea rdi, [rdi + 1]
inc rdx
mov byte [rdx], al
test al, al
jne 0x1400eb1c0
movzx edx, byte [rbp - 0x5f]
lea rax, [rbp - 0x5f]
or r10, 0xffffffffffffffff
nop dword [rax]
inc r10
cmp byte [rax + r10], 0
jne 0x1400eb1e0
mov r14d, 2
cmp dl, 0x2d
jne 0x1400eb204
dec r10d
lea ebx, [r14 - 1]
xor ecx, ecx
lea rsi, [rbp - 0x5e]
jmp 0x1400eb214
mov ecx, 0
bt r9d, 0x11
mov ebx, ecx
cmovb ebx, r14d
mov eax, r9d
and eax, 0x13000
cmp eax, 0x10000
jne 0x1400eb362
movzx eax, byte [rsi]
mov r9, rsi
sub al, 0x30
cmp al, 0xa
jae 0x1400eb24e
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r9 + 1]
inc r9
sub al, 0x30
cmp al, 0xa
jb 0x1400eb240
mov r8d, r9d
sub r8d, esi
je 0x1400eb26c
lea edi, [r8 + 2]
mov eax, 0xaaaaaaab
mul edi
mov r11d, edx
shr r11d, 1
dec r11d
jmp 0x1400eb272
mov r11d, ecx
mov edi, r14d
mov r15d, dword [rsp + 0x50]
lea eax, [r11 + r10]
lea ecx, [rax + rax]
test r15b, r15b
jne 0x1400eb2a9
lea eax, [rcx + 2]
movzx r15d, r15b
test ebx, ebx
cmove eax, ecx
mov ecx, eax
mov eax, 1
add rcx, r13
cmp qword [rbp + 0x6f8], rcx
cmovb r15d, eax
mov dword [rsp + 0x50], r15d
mov eax, 0xaaaaaaab
mov ecx, r8d
mul edi
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
test r15b, r15b
jne 0x1400eb325
test bl, 1
je 0x1400eb2cb
mov eax, 0x2d
jmp 0x1400eb2d5
test bl, 2
je 0x1400eb2de
mov eax, 0x2b
mov word [r12], ax
add r12, 2
test r8d, r8d
je 0x1400eb325
nop dword [rax]
nop word [rax + rax]
movsx eax, byte [rsi]
lea rsi, [rsi + 1]
mov word [r12], ax
dec ecx
mov eax, edi
add r12, 2
dec edi
test eax, eax
jne 0x1400eb321
test ecx, ecx
je 0x1400eb325
movzx eax, word [0x14018dfb4]
mov edi, r14d
mov word [r12], ax
add r12, 2
test ecx, ecx
jne 0x1400eb2f0
test ebx, ebx
lea rdi, [r13 + 2]
lea eax, [r11 + r8]
cmove rdi, r13
lea r13, [rdi + rax*2]
test r15b, r15b
jne 0x1400eb76d
sub r10d, r8d
mov rcx, r9
mov edx, r10d
mov r8, r12
mov edi, r10d
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
lea r12, [r12 + rdi*2]
lea r13, [r13 + rdi*2]
jmp 0x1400eb76d
test ebx, ebx
setne cl
mov rdx, rcx
bt r9d, 0x12
jae 0x1400eb398
movzx r8d, word [r11 + 6]
mov edi, r10d
lea rax, [rcx + rdi]
cmp rax, r8
jae 0x1400eb398
mov edx, r8d
or ebx, 4
sub rdx, rdi
mov r8, rdx
sub r8, rcx
mov qword [rsp + 0x78], r8
jmp 0x1400eb39d
mov r8, qword [rsp + 0x78]
mov r15d, dword [rsp + 0x50]
test r15b, r15b
jne 0x1400eb409
mov eax, r10d
add rax, rdx
lea rax, [rax*2]
add rax, r13
cmp qword [rbp + 0x6f8], rax
jae 0x1400eb3cb
mov r15b, 1
mov dword [rsp + 0x50], r15d
jmp 0x1400eb409
test bl, 1
je 0x1400eb3d7
mov eax, 0x2d
jmp 0x1400eb3e1
test bl, 2
je 0x1400eb3ea
mov eax, 0x2b
mov word [r12], ax
add r12, 2
test bl, 4
je 0x1400eb409
test r8, r8
je 0x1400eb405
mov eax, 0x30
mov rdi, r12
movzx eax, ax
mov rcx, r8
rep stosw word [rdi], ax
lea r12, [r12 + r8*2]
lea r13, [r13 + rdx*2]
test r15b, r15b
jne 0x1400eb76d
mov r8, r12
mov edx, r10d
mov rcx, rsi
mov edi, r10d
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
lea r12, [r12 + rdi*2]
lea r13, [r13 + rdi*2]
jmp 0x1400eb76d
mov rax, qword [r9 + 0x10]
xorps xmm0, xmm0
mov ebx, r8d
cvtsi2sd xmm0, rax
test rax, rax
jns 0x1400eb44f
addsd xmm0, xmm8
jne 0x1400eb48c
test sil, sil
jne 0x1400eb47f
lea rax, [r13 + 2]
cmp qword [rbp + 0x6f8], rax
jae 0x1400eb475
add r12, 2
mov byte [rsp + 0x50], 1
add r13, 2
jmp case.default.0x1400eab8c
mov eax, 0x30
mov word [r12], ax
add r12, 2
add r13, 2
jmp case.default.0x1400eab8c
bt r15d, 8
jae 0x1400eb49a
movzx eax, byte [r9 + 0xa]
jmp 0x1400eb4a0
mov eax, dword [0x140190e48]
comisd xmm0, xmm6
jb 0x1400eb4bb
cmp ebx, 7
jae 0x1400eb4bb
cmp ebx, eax
jae 0x1400eb4bb
mulsd xmm0, xmm7
inc ebx
comisd xmm0, xmm6
jae 0x1400eb4a6
test r15b, 0x40
je 0x1400eb4c8
movzx eax, word [r9 + 4]
jmp 0x1400eb4cb
mov eax, r10d
movzx ecx, ax
lea r9, [rbp + 0x500]
mov eax, 0xa2
movsd qword [rbp - 0x78], xmm0
cmp ecx, eax
lea rdx, [rbp - 0x5f]
lea rsi, [rbp - 0x5f]
cmova ecx, eax
mov rax, qword [0x1401941c0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r8
mov r8d, 0x3ff
mov dword [rsp + 0x30], ecx
lea rcx, [rbp - 0x78]
mov dword [rsp + 0x28], 0x66
mov qword [rsp + 0x20], 0x15e
call fcn.1401177f8
movzx edx, byte [rbp - 0x5f]
lea rcx, [rbp - 0x5f]
movzx r8d, byte [0x14018e218]
test dl, dl
je 0x1400eb550
lea rcx, [rbp - 0x5f]
movzx eax, dl
nop dword [rax]
cmp al, r8b
je 0x1400eb550
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1400eb540
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400eb5b4
movzx eax, byte [rcx]
test al, al
je 0x1400eb572
sub al, 0x45
test al, 0xdf
je 0x1400eb572
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1400eb561
movzx eax, byte [rcx - 1]
mov rdi, rcx
dec rcx
cmp al, 0x30
jne 0x1400eb58b
movzx eax, byte [rcx - 1]
dec rcx
cmp al, 0x30
je 0x1400eb580
cmp al, r8b
lea rdx, [rcx - 1]
cmovne rdx, rcx
nop word [rax + rax]
movzx eax, byte [rdi]
lea rdi, [rdi + 1]
inc rdx
mov byte [rdx], al
test al, al
jne 0x1400eb5a0
movzx edx, byte [rbp - 0x5f]
lea rax, [rbp - 0x5f]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400eb5c0
cmp dl, 0x2d
jne 0x1400eb5dc
mov r14d, 1
lea rsi, [rbp - 0x5e]
dec r8d
movzx eax, byte [rsi]
mov r9, rsi
sub al, 0x30
cmp al, 0xa
jae 0x1400eb5fe
nop dword [rax + rax]
movzx eax, byte [r9 + 1]
inc r9
sub al, 0x30
cmp al, 0xa
jb 0x1400eb5f0
mov r10d, r9d
sub r10d, esi
je 0x1400eb61c
lea edi, [r10 + 2]
mov eax, 0xaaaaaaab
mul edi
mov r11d, edx
shr r11d, 1
dec r11d
jmp 0x1400eb624
xor eax, eax
mov r11d, eax
lea edi, [rax + 2]
mov r15d, dword [rsp + 0x50]
lea eax, [r11 + r8]
lea ecx, [rax + rax]
test r15b, r15b
jne 0x1400eb65c
lea eax, [rcx + 2]
movzx r15d, r15b
test r14d, r14d
cmove eax, ecx
mov ecx, eax
add rcx, r13
cmp qword [rbp + 0x6f8], rcx
mov ecx, 1
cmovb r15d, ecx
mov dword [rsp + 0x50], r15d
mov eax, 0xaaaaaaab
mov ecx, r10d
mul edi
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
test r15b, r15b
jne 0x1400eb6c7
test r14d, r14d
je 0x1400eb685
mov eax, 0x2d
mov word [r12], ax
add r12, 2
test r10d, r10d
je 0x1400eb6c7
nop word [rax + rax]
movsx eax, byte [rsi]
lea rsi, [rsi + 1]
mov word [r12], ax
dec ecx
mov eax, edi
add r12, 2
dec edi
test eax, eax
jne 0x1400eb6c3
test ecx, ecx
je 0x1400eb6c7
movzx eax, word [0x14018dfb4]
mov edi, 2
mov word [r12], ax
add r12, 2
test ecx, ecx
jne 0x1400eb690
test r14d, r14d
lea rdi, [r13 + 2]
lea eax, [r11 + r10]
cmove rdi, r13
lea rsi, [rdi + rax*2]
test r15b, r15b
jne 0x1400eb749
sub r8d, r10d
mov rcx, r9
mov edi, r8d
mov r8, r12
mov edx, edi
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
lea rsi, [rsi + rdi*2]
mov rdx, rbx
add rdx, rdx
lea r12, [r12 + rdi*2]
lea rdi, [0x140000000]
lea rcx, [rsi + 2]
add rcx, qword [rdi + rdx*8 + 0x18e220]
cmp qword [rbp + 0x6f8], rcx
jae 0x1400eb723
mov byte [rsp + 0x50], 1
jmp 0x1400eb750
mov eax, 0x20
lea rcx, [r12 + 2]
mov word [r12], ax
mov r8, qword [rdi + rdx*8 + 0x18e220]
mov rdx, qword [rdi + rdx*8 + 0x18e228]
call fcn.14010e700
jmp 0x1400eb750
lea rdi, [0x140000000]
add rbx, rbx
mov rcx, qword [rdi + rbx*8 + 0x18e220]
lea rax, [rcx + 2]
shr rax, 1
lea r13, [rcx + 2]
add r13, rsi
lea r12, [r12 + rax*2]
mov r9, qword [rsp + 0x58]
mov ecx, dword [r9]
mov r8, r13
sub r8, qword [rbp - 0x70]
test ecx, 0xc0000000
je 0x1400eb80f
movzx ebx, word [r9 + 6]
add rbx, rbx
cmp r8, rbx
jae 0x1400eb80f
sub rbx, r8
cmp byte [rsp + 0x50], 0
jne 0x1400eb802
lea rax, [rbx + r13]
cmp qword [rbp + 0x6f8], rax
jae 0x1400eb7b3
mov byte [rsp + 0x50], 1
jmp 0x1400eb802
test cl, cl
jns 0x1400eb7be
movzx r14d, word [r9 + 8]
jmp 0x1400eb7c4
mov r14d, 0x20
mov rsi, rbx
shr rsi, 1
test ecx, ecx
jns 0x1400eb7d8
test rsi, rsi
je 0x1400eb802
mov rdi, r12
jmp 0x1400eb7f8
mov rax, r8
mov rdi, r12
shr rax, 1
add rax, rax
sub rdi, rax
mov rdx, rdi
lea rcx, [rdi + rsi*2]
call fcn.14010e700
test rsi, rsi
je 0x1400eb802
mov rcx, rsi
movzx eax, r14w
rep stosw word [rdi], ax
mov rax, rbx
shr rax, 1
add r13, rbx
lea r12, [r12 + rax*2]
mov r14d, dword [rbp + 0x6e8]
lea r11, [0x140000000]
mov esi, dword [rsp + 0x50]
mov r10d, 2
mov rbx, qword [rbp + 0x6f8]
mov rax, qword [rbp + 0x6e0]
test r14d, r14d
jne 0x1400eab40
mov rdi, qword [rbp + 0x6f0]
movaps xmm8, xmmword [rsp + 0x760]
movaps xmm7, xmmword [rsp + 0x770]
movaps xmm6, xmmword [rsp + 0x780]
mov r15, qword [rsp + 0x798]
mov r14, qword [rsp + 0x7a0]
lea rax, [r13 + 2]
mov r13, qword [rsp + 0x7a8]
test sil, sil
jne 0x1400eb887
cmp rbx, rax
jae 0x1400eb8d3
mov sil, 1
mov rcx, rax
test rdi, rdi
je 0x1400eb89c
test rbx, rbx
je 0x1400eb89c
xor eax, eax
mov word [rdi], ax
mov rax, rcx
mov rcx, qword [rbp + 0x700]
mov r12, qword [rsp + 0x7b0]
mov rdi, qword [rsp + 0x7b8]
mov rbx, qword [rsp + 0x7c0]
test rcx, rcx
je 0x1400eb8c3
mov qword [rcx], rax
test sil, sil
sete al
add rsp, 0x7c8
pop rsi
pop rbp
ret
xor ecx, ecx
mov word [r12], cx
jmp 0x1400eb89c