Function at 0x510640
Capabilities:
Get geographical location
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x474
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x470], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
push ebx
mov dword [esp + 0x64], eax
mov ebx, ecx
xor eax, eax
mov dword [esp + 0x60], ecx
test ecx, ecx
mov dword [esp + 0x24], ebx
push esi
sete cl
mov dword [esp + 0x18], eax
test byte [0x63090c], 1
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x4c], edi
mov byte [esp + 0x1b], cl
jne 0x51074e
mov esi, 0x63090c
lock bts dword [esi], 0x1f
setb al
test al, al
jne 0x510736
push 4
lea eax, [esp + 0x74]
push eax
push 0xe
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
nop dword [eax]
test eax, eax
je 0x5106dc
mov ax, word [esp + 0x70]
test ax, ax
je 0x5106dc
cmp word [esp + 0x72], 0
jne 0x5106dc
mov word [0x62e6c8], ax
push 4
lea eax, [esp + 0x74]
push eax
push 0xf
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x51070c
mov ax, word [esp + 0x70]
test ax, ax
je 0x51070c
cmp word [esp + 0x72], 0
jne 0x51070c
mov word [0x62e6f8], ax
cmp word [0x62e6c8], 0x2e
je 0x51072d
push 0x5d1e90
push 0
call fcn.0058f51b
add esp, 8
mov dword [0x63581c], eax
mov ecx, esi
call sym.SystemInformer.exe_Ordinal_1358
jmp 0x510748
test byte [0x63090c], 1
jne 0x51074c
xor edx, edx
mov ecx, esi
call sym.SystemInformer.exe_Ordinal_1388
mov cl, byte [esp + 0x1b]
xor eax, eax
cmp dword [ebp + 0xc], 0
mov esi, dword [ebp + 0x14]
je 0x511937
mov byte [esp + 0x1b], cl
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x50], 3
nop word [eax + eax]
dec ecx
mov dword [esp + 0x70], eax
mov eax, dword [edi]
mov edx, edi
mov dword [ebp + 0xc], ecx
mov ecx, dword [esp + 0x4c]
add dword [esp + 0x4c], 0x18
mov dword [esp + 0x3c], eax
and eax, 0x3f
mov dword [esp + 0x48], edi
mov dword [esp + 0x20], 0
cmp eax, 0xd
ja case.default.0x5107a9
jmp dword [eax*4 + 0x51198c]
cmp byte [esp + 0x1b], 0
jne 0x51160d
mov eax, dword [esp + 0x1c]
add eax, 2
cmp esi, eax
jae 0x5107e5
mov eax, dword ds:[esp + 0x1c]
add ebx, 2
add eax, 2
mov byte [esp + 0x1b], 1
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], eax
jmp 0x51087e
mov ax, word [edi + 0x10]
jmp 0x51160a
cmp byte [esp + 0x1b], 0
jne 0x51082f
mov eax, dword ds:[esp + 0x1c]
mov ecx, dword [edi + 0x10]
add eax, ecx
cmp esi, eax
jae 0x510822
mov eax, ecx
mov byte [esp + 0x1b], 1
shr eax, 1
lea ebx, [ebx + eax*2]
mov eax, dword [esp + 0x1c]
add eax, ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], eax
jmp 0x51087e
push ecx
push dword [edi + 0x14]
push ebx
call fcn.00586310
add esp, 0xc
mov eax, dword [edi + 0x10]
shr eax, 1
lea ebx, [ebx + eax*2]
mov eax, dword [esp + 0x1c]
add eax, dword [edi + 0x10]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], eax
jmp 0x51087e
push dword [edi + 0x10]
call sym.SystemInformer.exe_Ordinal_1322
cmp byte [esp + 0x1b], 0
mov esi, eax
jne 0x51086c
mov ecx, dword [esp + 0x1c]
lea edx, [esi + esi]
add ecx, edx
cmp dword [ebp + 0x14], ecx
jae 0x5108d3
mov byte [esp + 0x1b], 1
lea ebx, [ebx + esi*2]
lea eax, [esi + esi]
mov dword [esp + 0x2c], ebx
add dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x48]
mov ecx, eax
sub ecx, dword [esp + 0x70]
mov edx, dword [edi]
test edx, 0xc0000000
je 0x511925
movzx esi, word ds:[edi + 6]
add esi, esi
cmp ecx, esi
jae 0x511925
sub esi, ecx
cmp byte [esp + 0x1b], 0
jne 0x511910
add eax, esi
cmp dword [ebp + 0x14], eax
jae 0x5118ac
mov byte [esp + 0x1b], 1
jmp 0x511910
push edx
push dword [edi + 0x10]
push ebx
call fcn.00586310
add esp, 0xc
jmp 0x51086c
cmp dword [esp + 0x3c], 3
jne 0x5108f1
mov edi, dword [edi + 0x14]
mov esi, dword [ecx + 0x10]
jmp 0x510909
mov edi, dword [ecx + 0x10]
mov esi, edi
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x510900
sub esi, ecx
push esi
push edi
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeSize]
test eax, eax
js case.default.0x5107a9
cmp byte [esp + 0x1b], 0
jne 0x51096e
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x54]
add eax, ecx
cmp dword [ebp + 0x14], eax
jae 0x510953
mov eax, ecx
mov byte [esp + 0x1b], 1
shr eax, 1
lea ebx, [ebx + eax*2]
mov eax, dword [esp + 0x1c]
add eax, ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], eax
jmp 0x51087e
push esi
push edi
push 0
push ecx
push ebx
lfence
call dword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
test eax, eax
js case.default.0x5107a9
mov ecx, dword [esp + 0x54]
mov eax, ecx
shr eax, 1
lea ebx, [ebx + eax*2]
mov eax, dword [esp + 0x1c]
add eax, ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], eax
jmp 0x51087e
mov eax, dword ds:[edx + 0x10]
mov ecx, eax
cdq
mov esi, eax
shr ecx, 0x1f
xor esi, edx
mov dword [esp + 0x20], ecx
sub esi, edx
jmp 0x5109a5
mov esi, dword [edi + 0x10]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x34], 0xa
test edx, 0x100
je 0x5109cb
mov cl, byte [edi + 0xa]
mov al, cl
sub al, 2
cmp al, 0x43
ja 0x5109cb
movzx eax, cl
mov dword [esp + 0x34], eax
test edx, 0x20000000
mov ecx, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
mov eax, 0x61f460
cmovne eax, ecx
xor edi, edi
mov dword [esp + 0x40], eax
lea ecx, [esp + 0x476]
test esi, esi
je 0x510a90
test edx, 0x10000
je 0x510a69
xor eax, eax
mov dword [esp + 0x38], eax
mov eax, esi
xor edx, edx
div dword [esp + 0x34]
inc edi
mov esi, eax
mov dword [esp + 0x24], edi
mov eax, dword [esp + 0x40]
movsx ax, byte [eax + edx]
mov word [ecx], ax
sub ecx, 2
mov eax, dword [esp + 0x38]
inc eax
mov dword [esp + 0x38], eax
cmp eax, 3
jne 0x510a63
test esi, esi
je 0x510aad
movzx eax, word [0x62e6f8]
xor edx, edx
mov word [ecx], ax
mov eax, esi
div dword [esp + 0x34]
mov dword [esp + 0x38], 1
mov esi, eax
mov eax, dword [esp + 0x40]
movsx eax, byte [eax + edx]
mov word [ecx - 2], ax
add ecx, 0xfffffffc
add edi, 2
mov dword [esp + 0x24], edi
test esi, esi
jne 0x510a01
jmp 0x510aad
mov ebx, eax
nop dword [eax + eax]
mov eax, esi
xor edx, edx
div dword [esp + 0x34]
inc edi
mov esi, eax
movsx ax, byte [ebx + edx]
mov word [ecx], ax
sub ecx, 2
test esi, esi
jne 0x510a70
mov ebx, dword [esp + 0x2c]
jmp 0x510aa9
mov eax, 0x30
lea ecx, [esp + 0x474]
mov word [esp + 0x476], ax
mov edi, 1
mov dword [esp + 0x24], edi
mov esi, dword [esp + 0x3c]
xor edx, edx
cmp dword [esp + 0x20], edx
je 0x510ac2
mov edx, 1
jmp 0x510ad0
test esi, 0x20000
mov eax, 1
cmovne edx, eax
mov eax, esi
mov dword [esp + 0x34], edx
and eax, 0x50000
cmp eax, 0x40000
jne 0x510b0d
mov eax, dword [esp + 0x48]
movzx esi, word [eax + 6]
lea eax, [edx + edi]
cmp eax, esi
jae 0x510b09
or dword [esp + 0x20], 4
sub esi, edx
sub esi, edi
add edx, esi
mov dword [esp + 0x60], esi
mov dword [esp + 0x34], edx
mov esi, dword [esp + 0x3c]
add ecx, 2
cmp byte [esp + 0x1b], 0
mov dword [esp + 0x30], ecx
jne 0x510ba6
lea eax, [edx + edi]
mov edx, dword [esp + 0x1c]
lea eax, [edx + eax*2]
cmp dword [ebp + 0x14], eax
jae 0x510b47
mov eax, dword [esp + 0x34]
mov ecx, edx
add eax, edi
mov byte [esp + 0x1b], 1
lea ecx, [ecx + eax*2]
mov dword [esp + 0x1c], ecx
jmp case.default.0x5107a9
mov eax, dword [esp + 0x20]
test al, 1
je 0x510b56
mov edx, 0x2d
jmp 0x510b63
test esi, 0x20000
je 0x510b69
mov edx, 0x2b
mov word [ebx], dx
add ebx, 2
test al, 4
je 0x510b92
mov edx, dword [esp + 0x60]
test edx, edx
je 0x510b8f
mov ecx, edx
mov eax, 0x300030
shr ecx, 1
mov edi, ebx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov ecx, dword [esp + 0x30]
mov edi, dword [esp + 0x24]
lea ebx, [ebx + edx*2]
lea esi, [edi + edi]
push esi
push ecx
push ebx
call fcn.00586310
add esp, 0xc
add ebx, esi
mov dword [esp + 0x2c], ebx
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x1c]
add eax, edi
lea ecx, [ecx + eax*2]
mov dword [esp + 0x1c], ecx
jmp case.default.0x5107a9
mov eax, dword [edi + 0x14]
mov esi, dword [edi + 0x10]
mov dword [esp + 0x44], esi
mov dword [esp + 0x38], eax
test eax, eax
jg 0x510bf3
jl 0x510bd4
test esi, esi
jae 0x510bf3
neg esi
mov dword [esp + 0x20], 1
adc eax, 0
neg eax
jmp 0x510beb
mov esi, dword [edi + 0x10]
mov eax, dword [edi + 0x14]
mov dword [esp + 0x38], eax
mov dword [esp + 0x44], esi
mov edi, dword [esp + 0x3c]
mov dword [esp + 0x34], 0xa
mov dword [esp + 0x24], 0
test edi, 0x100
je 0x510c3a
mov eax, dword [esp + 0x48]
mov dword [esp + 0x34], 0xa
mov dword [esp + 0x24], 0
mov cl, byte [eax + 0xa]
mov al, cl
sub al, 2
cmp al, 0x43
ja 0x510c3a
movzx eax, cl
cdq
mov dword [esp + 0x34], eax
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x38]
test edi, 0x20000000
mov eax, 0x61f460
lea edi, [esp + 0x476]
mov ecx, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
cmovne eax, ecx
mov dword [esp + 0x30], eax
xor eax, eax
mov dword [esp + 0x40], eax
mov eax, esi
or eax, edx
je 0x510d63
test dword [esp + 0x3c], 0x10000
je 0x510d0d
xor eax, eax
mov dword [esp + 0x28], eax
push dword [esp + 0x24]
push dword [esp + 0x38]
push edx
push esi
call fcn.005a5370
push dword [esp + 0x24]
mov esi, eax
mov eax, dword [esp + 0x3c]
push dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x50]
push eax
call fcn.005a5300
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x38], edx
movsx cx, byte [eax + esi]
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x44]
inc eax
mov word [edi], cx
sub edi, 2
mov ecx, dword [esp + 0x40]
inc ecx
mov dword [esp + 0x40], ecx
cmp eax, 3
jne 0x510cf9
mov eax, esi
or eax, edx
je 0x510d80
mov ax, word [0x62e6f8]
mov word [edi], ax
sub edi, 2
inc ecx
mov dword [esp + 0x40], ecx
jmp 0x510c7a
mov dword [esp + 0x28], eax
mov eax, esi
or eax, edx
mov dword [esp + 0x40], ecx
jne 0x510c80
jmp 0x510d80
mov ebx, dword [esp + 0x34]
push dword [esp + 0x24]
push ebx
push edx
push esi
call fcn.005a5370
push dword [esp + 0x24]
mov esi, eax
mov eax, dword [esp + 0x3c]
push ebx
push eax
mov eax, dword [esp + 0x50]
push eax
call fcn.005a5300
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x44], eax
inc ecx
mov eax, dword [esp + 0x30]
mov dword [esp + 0x38], edx
mov dword [esp + 0x40], ecx
movsx ax, byte [eax + esi]
mov esi, dword [esp + 0x44]
mov word [edi], ax
mov eax, esi
sub edi, 2
or eax, edx
jne 0x510d11
mov ebx, dword [esp + 0x2c]
jmp 0x510d80
mov eax, 0x30
lea edi, [esp + 0x474]
mov ecx, 1
mov word [esp + 0x476], ax
mov dword [esp + 0x40], ecx
mov esi, dword [esp + 0x3c]
xor edx, edx
cmp dword [esp + 0x20], edx
je 0x510d93
mov edx, 1
jmp 0x510da1
test esi, 0x20000
mov eax, 1
cmovne edx, eax
mov eax, esi
mov dword [esp + 0x28], edx
and eax, 0x50000
cmp eax, 0x40000
jne 0x510ddb
mov eax, dword ds:[esp + 0x48]
movzx esi, word [eax + 6]
lea eax, [edx + ecx]
cmp eax, esi
jae 0x510dd7
or dword [esp + 0x20], 4
sub esi, edx
sub esi, ecx
add edx, esi
mov dword [esp + 0x64], esi
mov dword [esp + 0x28], edx
mov esi, dword [esp + 0x3c]
add edi, 2
cmp byte [esp + 0x1b], 0
mov dword [esp + 0x30], edi
jne 0x510e76
lea eax, [edx + ecx]
mov edx, dword [esp + 0x1c]
lea eax, [edx + eax*2]
cmp dword [ebp + 0x14], eax
jae 0x510e17
mov eax, dword [esp + 0x40]
mov ecx, edx
add eax, dword [esp + 0x28]
mov byte [esp + 0x1b], 1
lea ecx, [ecx + eax*2]
mov dword [esp + 0x1c], ecx
jmp case.default.0x5107a9
mov eax, dword [esp + 0x20]
test al, 1
je 0x510e26
mov edx, 0x2d
jmp 0x510e33
test esi, 0x20000
je 0x510e39
mov edx, 0x2b
mov word [ebx], dx
add ebx, 2
test al, 4
je 0x510e62
mov edx, dword [esp + 0x64]
test edx, edx
je 0x510e5f
mov ecx, edx
mov eax, 0x300030
shr ecx, 1
mov edi, ebx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x30]
mov ecx, dword [esp + 0x40]
lea ebx, [ebx + edx*2]
lea esi, [ecx + ecx]
push esi
push edi
push ebx
call fcn.00586310
add esp, 0xc
add ebx, esi
mov dword [esp + 0x2c], ebx
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x1c]
add eax, dword [esp + 0x28]
lea ecx, [ecx + eax*2]
mov dword [esp + 0x1c], ecx
jmp case.default.0x5107a9
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x20], 0
test cl, 0x40
je 0x510eb2
movzx edx, word [edi + 4]
cmp edx, 0xa2
jbe 0x510eb7
mov edx, 0xa2
jmp 0x510eb7
mov edx, 6
movss xmm0, dword [edi + 0x10]
lea eax, [esp + 0x79]
sub esp, 8
mov dword [esp + 0x30], eax
push eax
call fcn.00576160
test al, al
jne 0x510ed7
mov byte [esp + 0x79], al
jmp 0x510f2c
mov edx, dword [0x63581c]
nop dword [eax]
test edx, edx
je 0x510f05
mov al, byte [esp + 0x79]
lea ecx, [esp + 0x79]
test al, al
je 0x510f05
cmp al, 0x2e
je 0x510efe
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x510ef0
jmp 0x510f05
mov al, byte [0x62e6c8]
mov byte [ecx], al
test dword [esp + 0x3c], 0x20000000
je 0x510f2c
lea eax, [esp + 0x79]
test edx, edx
je 0x510f23
push edx
push eax
call fcn.0058ecc3
add esp, 8
jmp 0x510f2c
push eax
call fcn.0058ec67
add esp, 4
mov edi, dword [edi]
test edi, 0x8000
je 0x510fa4
mov al, byte [esp + 0x79]
lea ecx, [esp + 0x79]
mov ah, byte [0x62e6c8]
test al, al
je 0x510f54
cmp al, ah
je 0x510f54
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x510f48
mov al, byte [ecx]
inc ecx
test al, al
je 0x510fa4
mov dl, byte ds:[ecx]
test dl, dl
je 0x510f79
mov al, dl
cmp dl, 0x65
je 0x510f79
cmp al, 0x45
je 0x510f79
mov al, byte [ecx + 1]
inc ecx
mov dl, al
test al, al
jne 0x510f66
mov al, byte ds:[ecx - 1]
mov esi, ecx
dec ecx
cmp al, 0x30
jne 0x510f8c
mov al, byte [ecx - 1]
dec ecx
cmp al, 0x30
je 0x510f84
cmp al, ah
lea edx, [ecx - 1]
cmovne edx, ecx
mov al, byte ds:[esi]
lea edx, [edx + 1]
mov byte [edx], al
lea esi, [esi + 1]
test al, al
jne 0x510f94
lea esi, [esp + 0x79]
lea ecx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x510fb0
sub esi, ecx
cmp byte [esp + 0x79], 0x2d
mov dword [esp + 0x30], esi
jne 0x510fdb
lea edx, [esp + 0x7a]
mov dword [esp + 0x20], 1
dec esi
mov dword [esp + 0x28], edx
mov dword [esp + 0x30], esi
jmp 0x510ff5
mov ecx, dword [esp + 0x20]
test edi, 0x20000
mov edx, dword [esp + 0x28]
mov eax, 2
cmovne ecx, eax
mov dword [esp + 0x20], ecx
mov eax, edi
and eax, 0x13000
cmp eax, 0x10000
jne 0x511145
mov al, byte [edx]
mov edi, edx
sub al, 0x30
cmp al, 0xa
jae 0x51101f
mov al, byte [edi + 1]
inc edi
sub al, 0x30
cmp al, 0xa
jb 0x511015
mov eax, edi
sub eax, edx
mov dword [esp + 0x24], eax
lea edx, [eax + 2]
mov dword [esp + 0x38], edx
je 0x511042
mov eax, 0xaaaaaaab
mul edx
mov eax, edx
mov edx, dword [esp + 0x38]
shr eax, 1
dec eax
jmp 0x511044
xor eax, eax
lea ecx, [eax + esi]
mov dword [esp + 0x34], eax
add ecx, ecx
cmp byte [esp + 0x1b], 0
jne 0x511079
cmp dword [esp + 0x20], 0
lea eax, [ecx + 2]
cmove eax, ecx
mov ecx, dword [esp + 0x1c]
add eax, ecx
cmp dword [ebp + 0x14], eax
jae 0x511079
mov eax, dword [esp + 0x24]
mov dl, 1
mov byte [esp + 0x1b], dl
jmp 0x51110a
mov ecx, dword [esp + 0x24]
mov eax, edx
xor edx, edx
div dword [esp + 0x50]
cmp byte [esp + 0x1b], 0
jne 0x5110fe
mov eax, dword [esp + 0x20]
test al, 1
je 0x51109b
mov eax, 0x2d
jmp 0x5110a4
test al, 2
je 0x5110ae
mov eax, 0x2b
mov word [ebx], ax
add ebx, 2
mov dword [esp + 0x2c], ebx
mov eax, dword [esp + 0x24]
test eax, eax
je 0x511102
mov esi, dword [esp + 0x28]
nop word [eax + eax]
movsx ax, byte [esi]
dec ecx
inc esi
mov word [ebx], ax
mov eax, edx
add ebx, 2
dec edx
test eax, eax
jne 0x5110f2
test ecx, ecx
je 0x5110f6
movzx eax, word [0x62e6f8]
dec ecx
mov word [ebx], ax
mov edx, 1
movsx eax, byte [esi]
mov word [ebx + 2], ax
add ebx, 4
inc esi
test ecx, ecx
jne 0x5110c0
mov esi, dword [esp + 0x30]
mov dword [esp + 0x2c], ebx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
mov dl, byte [esp + 0x1b]
cmp dword [esp + 0x20], 0
je 0x511118
add ecx, 2
mov dword [esp + 0x1c], ecx
add eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x1c]
sub esi, dword [esp + 0x24]
lea ecx, [ecx + eax*2]
mov dword [esp + 0x1c], ecx
test dl, dl
jne case.default.0x5107a9
push ebx
push esi
push edi
call sym.SystemInformer.exe_Ordinal_1461
nop dword [eax + eax]
jmp 0x51086c
mov eax, dword ds:[esp + 0x48]
xor ecx, ecx
cmp dword [esp + 0x20], ecx
setne cl
test dword [eax], 0x40000
mov edi, ecx
mov dword [esp + 0x28], edi
je 0x51118f
movzx eax, word [eax + 6]
mov dword [esp + 0x30], eax
lea eax, [ecx + esi]
mov dword [esp + 0x28], edi
cmp eax, dword [esp + 0x30]
jae 0x51118f
mov eax, dword [esp + 0x30]
or dword [esp + 0x20], 4
sub eax, ecx
sub eax, esi
mov dword [esp + 0x58], eax
lea edi, [ecx + eax]
mov dword [esp + 0x28], edi
cmp byte [esp + 0x1b], 0
jne 0x511225
mov ecx, dword [esp + 0x1c]
lea eax, [edi + esi]
lea eax, [ecx + eax*2]
cmp dword [ebp + 0x14], eax
jae 0x5111bc
mov eax, ecx
mov byte [esp + 0x1b], 1
lea eax, [eax + edi*2]
mov dword [esp + 0x1c], eax
jmp 0x51087e
mov eax, dword [esp + 0x20]
test al, 1
je 0x5111cb
mov ecx, 0x2d
jmp 0x5111d4
test al, 2
je 0x5111de
mov ecx, 0x2b
mov word [ebx], cx
add ebx, 2
mov dword [esp + 0x2c], ebx
nop
test al, 4
je 0x511225
mov eax, dword [esp + 0x58]
test eax, eax
je 0x511206
mov ecx, eax
mov edi, ebx
shr ecx, 1
mov eax, 0x300030
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x28]
mov eax, dword [esp + 0x58]
lea ebx, [ebx + eax*2]
mov eax, dword [esp + 0x1c]
push ebx
push esi
push edx
lea eax, [eax + edi*2]
mov dword [esp + 0x28], eax
call sym.SystemInformer.exe_Ordinal_1461
nop dword [eax]
jmp 0x51086c
cmp byte [esp + 0x1b], 0
mov eax, dword [esp + 0x1c]
lea eax, [eax + edi*2]
mov dword [esp + 0x1c], eax
jne 0x51087e
push ebx
push esi
push edx
call sym.SystemInformer.exe_Ordinal_1461
jmp 0x51086c
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x20], 0
test cl, 0x40
je 0x51126f
movzx edx, word ds:[edi + 4]
cmp edx, 0xa2
jbe 0x511274
mov edx, 0xa2
jmp 0x511274
mov edx, 6
movsd xmm0, qword [edi + 0x10]
lea eax, [esp + 0x79]
sub esp, 0x10
mov dword [esp + 0x38], eax
movsd qword [esp + 8], xmm0
push eax
call fcn.00576380
test al, al
jne 0x51129a
mov byte [esp + 0x79], al
jmp 0x5112ec
mov edx, dword [0x63581c]
test edx, edx
je 0x5112c5
mov al, byte [esp + 0x79]
lea ecx, [esp + 0x79]
test al, al
je 0x5112c5
cmp al, 0x2e
je 0x5112be
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x5112b0
jmp 0x5112c5
mov al, byte [0x62e6c8]
mov byte [ecx], al
test dword [esp + 0x3c], 0x20000000
je 0x5112ec
lea eax, [esp + 0x79]
test edx, edx
je 0x5112e3
push edx
push eax
call fcn.0058ecc3
add esp, 8
jmp 0x5112ec
push eax
call fcn.0058ec67
add esp, 4
mov edi, dword [edi]
test edi, 0x8000
je 0x51136e
mov al, byte [esp + 0x79]
lea ecx, [esp + 0x79]
mov ah, byte [0x62e6c8]
test al, al
je 0x51131c
nop dword [eax]
cmp al, ah
je 0x51131c
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x511310
mov al, byte ds:[ecx]
inc ecx
test al, al
je 0x51136e
mov dl, byte [ecx]
test dl, dl
je 0x511344
mov al, dl
nop dword [eax]
cmp dl, 0x65
je 0x511344
cmp al, 0x45
je 0x511344
mov al, byte ds:[ecx + 1]
inc ecx
mov dl, al
test al, al
jne 0x511330
mov al, byte [ecx - 1]
mov esi, ecx
dec ecx
cmp al, 0x30
jne 0x511358
nop
mov al, byte [ecx - 1]
dec ecx
cmp al, 0x30
je 0x511350
cmp al, ah
lea edx, [ecx - 1]
cmovne edx, ecx
mov al, byte [esi]
lea edx, [edx + 1]
mov byte [edx], al
lea esi, [esi + 1]
test al, al
jne 0x511360
lea esi, [esp + 0x79]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x511375
sub esi, ecx
cmp byte [esp + 0x79], 0x2d
mov dword [esp + 0x30], esi
jne 0x5113a2
lea edx, ds:[esp + 0x7a]
mov dword [esp + 0x20], 1
dec esi
mov dword [esp + 0x28], edx
mov dword [esp + 0x30], esi
jmp 0x5113bc
mov ecx, dword [esp + 0x20]
test edi, 0x20000
mov edx, dword [esp + 0x28]
mov eax, 2
cmovne ecx, eax
mov dword [esp + 0x20], ecx
mov eax, edi
and eax, 0x13000
cmp eax, 0x10000
jne 0x5114d0
mov al, byte [edx]
mov edi, edx
sub al, 0x30
cmp al, 0xa
jae 0x5113e4
mov al, byte ds:[edi + 1]
inc edi
sub al, 0x30
cmp al, 0xa
jb 0x5113d8
mov eax, edi
sub eax, edx
mov dword [esp + 0x24], eax
lea edx, [eax + 2]
mov dword [esp + 0x38], edx
je 0x511407
mov eax, 0xaaaaaaab
mul edx
mov eax, edx
mov edx, dword [esp + 0x38]
shr eax, 1
dec eax
jmp 0x511409
xor eax, eax
lea ecx, [eax + esi]
mov dword [esp + 0x34], eax
add ecx, ecx
cmp byte [esp + 0x1b], 0
jne 0x51143e
cmp dword [esp + 0x20], 0
lea eax, [ecx + 2]
cmove eax, ecx
mov ecx, dword [esp + 0x1c]
add eax, ecx
cmp dword [ebp + 0x14], eax
jae 0x51143e
mov eax, dword [esp + 0x24]
mov dl, 1
mov byte [esp + 0x1b], dl
jmp 0x51110a
mov ecx, dword [esp + 0x24]
mov eax, edx
xor edx, edx
div dword [esp + 0x50]
cmp byte [esp + 0x1b], 0
jne 0x5110fe
mov eax, dword [esp + 0x20]
test al, 1
je 0x511464
mov eax, 0x2d
jmp 0x51146d
test al, 2
je 0x511477
mov eax, 0x2b
mov word [ebx], ax
add ebx, 2
mov dword [esp + 0x2c], ebx
mov eax, dword ds:[esp + 0x24]
test eax, eax
je 0x511102
mov esi, dword [esp + 0x28]
nop dword [eax]
movsx ax, byte ds:[esi]
dec ecx
inc esi
mov word [ebx], ax
mov eax, edx
add ebx, 2
dec edx
test eax, eax
jne 0x5114c7
test ecx, ecx
je 0x5110f6
movzx eax, word [0x62e6f8]
dec ecx
mov word [ebx], ax
mov edx, 1
movsx eax, byte [esi]
mov word [ebx + 2], ax
add ebx, 4
inc esi
test ecx, ecx
jne 0x511490
jmp 0x5110f6
mov eax, dword [esp + 0x48]
xor ecx, ecx
cmp dword [esp + 0x20], ecx
setne cl
test dword [eax], 0x40000
mov edi, ecx
mov dword [esp + 0x28], edi
je 0x51151e
movzx eax, word ds:[eax + 6]
mov dword [esp + 0x30], eax
lea eax, [ecx + esi]
mov dword [esp + 0x28], edi
cmp eax, dword [esp + 0x30]
jae 0x51151e
mov eax, dword [esp + 0x30]
or dword [esp + 0x20], 4
sub eax, ecx
sub eax, esi
mov dword [esp + 0x5c], eax
lea edi, [ecx + eax]
mov dword [esp + 0x28], edi
cmp byte [esp + 0x1b], 0
jne 0x511225
mov ecx, dword [esp + 0x1c]
lea eax, [edi + esi]
lea eax, [ecx + eax*2]
cmp dword [ebp + 0x14], eax
jae 0x51154b
mov eax, ecx
mov byte [esp + 0x1b], 1
lea eax, [eax + edi*2]
mov dword [esp + 0x1c], eax
jmp 0x51087e
mov eax, dword [esp + 0x20]
test al, 1
je 0x51155a
mov ecx, 0x2d
jmp 0x511563
test al, 2
je 0x51156d
mov ecx, 0x2b
mov word [ebx], cx
add ebx, 2
mov dword [esp + 0x2c], ebx
test al, 4
je 0x511225
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x511597
mov ecx, eax
mov edi, ebx
shr ecx, 1
mov eax, 0x300030
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x28]
mov eax, dword [esp + 0x5c]
lea ebx, [ebx + eax*2]
mov eax, dword [esp + 0x1c]
push ebx
push esi
push edx
lea eax, [eax + edi*2]
mov dword [esp + 0x28], eax
call sym.SystemInformer.exe_Ordinal_1461
jmp 0x51086c
mov eax, dword [esp + 0x48]
mov edi, dword [edi + 0x10]
mov ecx, edi
mov dword [esp + 0x30], 0
mov esi, dword [eax + 0x14]
mov edx, esi
call fcn.005a7190
or edi, esi
jne 0x511625
cmp byte [esp + 0x1b], 0
jne 0x51160d
mov eax, dword ds:[esp + 0x1c]
add eax, 2
cmp dword [ebp + 0x14], eax
jae 0x511605
mov eax, dword ds:[esp + 0x1c]
add ebx, 2
add eax, 2
mov byte [esp + 0x1b], 1
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], eax
jmp 0x51087e
mov eax, 0x30
mov word [ebx], ax
mov eax, dword ds:[esp + 0x1c]
add ebx, 2
add eax, 2
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], eax
jmp 0x51087e
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x48]
test ecx, 0x100
je 0x51163b
movzx eax, byte [edx + 0xa]
jmp 0x511640
mov eax, dword [0x6314c0]
movsd xmm1, qword [0x624528]
comisd xmm0, xmm1
mov edi, dword [esp + 0x30]
jb 0x511674
movsd xmm2, qword [0x624500]
nop word [eax + eax]
cmp edi, 7
jae 0x511674
cmp edi, eax
jae 0x511674
mulsd xmm0, xmm2
inc edi
comisd xmm0, xmm1
jae 0x511660
test cl, 0x40
je 0x51167f
movzx eax, word [edx + 4]
jmp 0x511684
mov eax, 2
movzx edx, ax
lea esi, [esp + 0x79]
cmp edx, 0xa2
mov dword [esp + 0x34], 0
mov eax, 0xa2
mov ecx, 0x1804c
cmova edx, eax
sub esp, 0x10
mov eax, esi
movsd qword [esp + 8], xmm0
push eax
call fcn.00576380
test al, al
jne 0x5116c2
mov byte ds:[esp + 0x79], al
jmp 0x5116ed
cmp dword [0x63581c], 0
je 0x5116ed
mov al, byte [esp + 0x79]
lea ecx, [esp + 0x79]
test al, al
je 0x5116ed
cmp al, 0x2e
je 0x5116e6
mov al, byte ds:[ecx + 1]
inc ecx
test al, al
jne 0x5116d7
jmp 0x5116ed
mov al, byte [0x62e6c8]
mov byte [ecx], al
lea ecx, [esp + 0x79]
call fcn.0050edc0
lea ecx, [esp + 0x79]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x511700
sub ecx, edx
cmp byte [esp + 0x79], 0x2d
mov dword [esp + 0x38], ecx
jne 0x511725
dec ecx
mov dword [esp + 0x34], 1
lea esi, [esp + 0x7a]
mov dword [esp + 0x38], ecx
mov al, byte [esi]
mov edx, esi
sub al, 0x30
mov dword [esp + 0x40], esi
cmp al, 0xa
jae 0x511741
mov al, byte [edx + 1]
inc edx
sub al, 0x30
cmp al, 0xa
jb 0x511733
mov dword [esp + 0x40], edx
sub edx, esi
mov dword [esp + 0x24], edx
lea edx, [edx + 2]
mov dword [esp + 0x30], edx
je 0x51175e
mov eax, 0xaaaaaaab
mul edx
mov eax, edx
shr eax, 1
dec eax
jmp 0x511764
xor eax, eax
mov dword [esp + 0x30], edx
lea edx, [eax + ecx]
mov dword [esp + 0x28], eax
add edx, edx
cmp byte [esp + 0x1b], 0
jne 0x511794
cmp dword [esp + 0x34], 0
lea eax, [edx + 2]
cmove eax, edx
mov edx, dword [esp + 0x1c]
add eax, edx
cmp dword [ebp + 0x14], eax
jae 0x511794
mov byte [esp + 0x1b], 1
jmp 0x511806
mov eax, dword [esp + 0x30]
xor edx, edx
div dword [esp + 0x50]
cmp byte [esp + 0x1b], 0
mov ecx, dword [esp + 0x24]
jne 0x5117fe
cmp dword [esp + 0x34], 0
je 0x5117bb
mov eax, 0x2d
mov word [ebx], ax
add ebx, 2
mov eax, dword ds:[esp + 0x24]
test eax, eax
je 0x51185f
movsx ax, byte [esi]
dec ecx
inc esi
mov word [ebx], ax
mov eax, edx
add ebx, 2
dec edx
test eax, eax
jne 0x5117fa
test ecx, ecx
je 0x5117fe
movzx eax, word [0x62e6f8]
dec ecx
mov word [ebx], ax
mov edx, 1
movsx eax, byte [esi]
mov word [ebx + 2], ax
add ebx, 4
inc esi
test ecx, ecx
jne 0x5117c8
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x34], 0
je 0x511818
add edx, 2
mov dword [esp + 0x1c], edx
add eax, dword [esp + 0x28]
mov edx, dword [esp + 0x1c]
sub ecx, dword [esp + 0x24]
cmp byte [esp + 0x1b], 0
mov dword [esp + 0x38], ecx
lea esi, [edx + eax*2]
jne 0x51188b
push ebx
push ecx
push dword [esp + 0x48]
call sym.SystemInformer.exe_Ordinal_1461
mov ecx, dword [esp + 0x38]
mov eax, dword [edi*8 + 0x630920]
add eax, 2
lea esi, [esi + ecx*2]
add eax, esi
lea ebx, [ebx + ecx*2]
cmp dword [ebp + 0x14], eax
jae 0x511869
mov byte [esp + 0x1b], 1
jmp 0x51188b
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x1c]
jmp 0x51180a
mov eax, 0x20
mov word [ebx], ax
lea eax, [ebx + 2]
push dword [edi*8 + 0x630920]
push dword [edi*8 + 0x630924]
push eax
call fcn.00586310
add esp, 0xc
mov ecx, dword [edi*8 + 0x630920]
lea eax, [ecx + 2]
shr eax, 1
lea ebx, [ebx + eax*2]
lea eax, [ecx + 2]
mov dword [esp + 0x2c], ebx
add eax, esi
mov dword [esp + 0x1c], eax
jmp 0x51087e
test dl, dl
jns 0x5118b6
movzx eax, word [edi + 8]
jmp 0x5118bb
mov eax, 0x20
mov edi, esi
mov dword [esp + 0x30], eax
shr edi, 1
test edx, edx
jns 0x5118d1
test edi, edi
je 0x511910
mov ecx, edi
mov edi, ebx
jmp 0x5118fd
mov eax, ecx
mov edx, ebx
and eax, 0xfffffffe
sub edx, eax
push ecx
push edx
lfence
lea eax, [edx + edi*2]
mov dword [esp + 0x78], edx
push eax
call fcn.00586310
add esp, 0xc
test edi, edi
je 0x511910
mov eax, dword [esp + 0x30]
mov ecx, edi
mov edi, dword [esp + 0x70]
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov eax, esi
shr eax, 1
lea ebx, [ebx + eax*2]
mov eax, dword [esp + 0x1c]
add eax, esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], eax
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov edi, dword [esp + 0x4c]
test ecx, ecx
jne 0x510770
mov dl, byte ds:[esp + 0x1b]
add eax, 2
test dl, dl
jne 0x51194a
cmp esi, eax
jae 0x511985
mov dl, 1
mov edi, dword [esp + 0x68]
mov ecx, eax
test edi, edi
je 0x51195f
test esi, esi
je 0x51195f
xor eax, eax
mov word [edi], ax
mov eax, ecx
mov ecx, dword [esp + 0x6c]
test ecx, ecx
je 0x511969
mov dword [ecx], eax
mov ecx, dword [esp + 0x47c]
test dl, dl
pop edi
pop esi
sete al
pop ebx
xor ecx, esp
call fcn.00583f7f
mov esp, ebp
pop ebp
ret 0x14
xor ecx, ecx
mov word [ebx], cx
jmp 0x51195f