Function at 0x140157f20
Capabilities:
Get geographical location

Disassembly:
mov r11, rsp
push rbp
push rsi
push r12
lea rbp, [r11 - 0x408]
sub rsp, 0x4f0
mov rax, qword [0x1402c0040]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov r12, qword [rbp + 0x430]
mov rax, rcx
mov qword [r11 + 0x10], rbx
mov rbx, r9
mov qword [r11 - 0x20], rdi
mov rdi, r8
mov qword [r11 - 0x28], r13
mov qword [r11 - 0x30], r14
mov r14, r8
mov qword [rbp - 0x80], r8
xor r8d, r8d
test r14, r14
mov qword [r11 - 0x38], r15
mov qword [rsp + 0x38], rbx
mov r15d, edx
sete sil
mov qword [rsp + 0x58], rcx
test byte [0x1402c6ba0], 1
mov r13d, r8d
mov qword [rbp - 0x78], r12
jne 0x14015807a
lock bts qword [0x1402c6ba0], 0x1f
setb al
test al, al
jne 0x140158056
mov r9d, 4
lea r8, [rbp - 0x70]
mov edx, 0xe
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x140157fe6
mov rax, qword [rbp - 0x70]
test ax, ax
je 0x140157fe6
cmp word [rbp - 0x6e], r13w
jne 0x140157fe6
mov word [0x1402c1518], ax
mov r9d, 4
lea r8, [rbp - 0x70]
mov edx, 0xf
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x140158021
mov rax, qword [rbp - 0x70]
test ax, ax
je 0x140158021
cmp word [rbp - 0x6e], r13w
jne 0x140158021
mov word [0x1402c2118], ax
cmp word [0x1402c1518], 0x2e
je 0x140158040
lea rdx, [0x140239898]
xor ecx, ecx
call fcn.1401f42b8
mov qword [0x1402cebd8], rax
lea rcx, [0x1402c6ba0]
call sym.SystemInformer.exe_PhfSetEvent
mov rax, qword [rsp + 0x58]
xor r8d, r8d
jmp 0x14015807a
test byte [0x1402c6ba0], 1
jne 0x140158077
xor edx, edx
lea rcx, [0x1402c6ba0]
call sym.SystemInformer.exe_PhfWaitForEvent
mov rax, qword [rsp + 0x58]
xor r8d, r8d
jmp 0x14015807a
mov rax, rcx
nop word [rax + rax]
test r15d, r15d
je 0x14015920a
movaps xmmword [rsp + 0x4c0], xmm6
lea r9, [0x140000000]
movsd xmm6, qword [0x140291b80]
mov r11d, 0x30
movaps xmmword [rsp + 0x4b0], xmm7
movsd xmm7, qword [0x140291b30]
mov byte [rsp + 0x30], sil
jmp 0x1401580c3
xor r8d, r8d
mov rdx, rax
mov qword [rbp - 0x70], rax
mov rdi, rax
mov qword [rsp + 0x78], r13
mov r10, rax
dec r15d
add rax, 0x20
mov dword [rsp + 0x60], r15d
mov r12d, dword [rdx]
mov r15d, r8d
mov qword [rsp + 0x58], rax
mov eax, r12d
and eax, 0x3f
cmp eax, 0xd
ja case.default.0x140158106
mov ecx, dword [r9 + rax*4 + 0x15928c]
add rcx, r9
jmp rcx
test sil, sil
jne 0x140158131
lea rax, [r13 + 2]
cmp rbx, rax
jae 0x140158128
add r14, 2
mov byte [rsp + 0x30], 1
add r13, 2
jmp case.default.0x140158106
movzx eax, word [r10 + 0x10]
mov word [r14], ax
add r14, 2
add r13, 2
jmp case.default.0x140158106
nop
test sil, sil
jne 0x140158174
mov r8, qword [r10 + 0x10]
lea rax, [r8 + r13]
cmp rbx, rax
jae 0x140158165
mov rax, r8
mov byte [rsp + 0x30], 1
shr rax, 1
add r13, r8
jmp 0x140159116
mov rdx, qword [r10 + 0x18]
mov rcx, r14
call fcn.14020be40
mov r10, rdi
mov rax, qword ds:[r10 + 0x10]
shr rax, 1
add r13, qword [r10 + 0x10]
jmp 0x140159116
mov rdx, qword [r10 + 0x10]
xorps xmm1, xmm1
mov rdi, rdx
mov ecx, edx
and rdi, 0xfffffffffffffff1
and ecx, 0xf
je 0x1401581b7
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdi]
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
je 0x1401581b3
mov edi, ecx
shr rdi, 1
jmp 0x1401581f3
add rdi, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdi]
pmovmskb eax, xmm0
bsf ecx, eax
jne 0x1401581e5
nop word [rax + rax]
add rdi, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdi]
pmovmskb eax, xmm0
bsf ecx, eax
je 0x1401581d0
sub rdi, rdx
mov eax, ecx
sar rdi, 1
shr rax, 1
add rdi, rax
test sil, sil
jne 0x140158225
lea r8, [rdi + rdi]
lea rax, [r8 + r13]
cmp rbx, rax
jae 0x140158218
mov byte [rsp + 0x30], 1
lea r14, [r14 + rdi*2]
lea r13, [r13 + rdi*2]
jmp case.default.0x140158106
mov rcx, r14
call fcn.14020be40
lea r14, [r14 + rdi*2]
lea r13, [r13 + rdi*2]
jmp case.default.0x140158106
cmp r12d, 3
jne 0x140158243
mov rbx, qword [r10 + 0x18]
mov rdi, qword [rdx + 0x10]
jmp 0x140158259
mov rbx, qword [rdx + 0x10]
mov rdi, 0xffffffffffffffff
nop
inc rdi
cmp byte [rbx + rdi], 0
jne 0x140158250
mov r8d, edi
lea rcx, [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeSize]
test eax, eax
js case.default.0x140158106
test sil, sil
mov rsi, qword [rsp + 0x38]
jne 0x1401582c8
mov ecx, dword [rsp + 0x40]
lea rax, [rcx + r13]
cmp rsi, rax
jae 0x14015829f
mov eax, ecx
mov byte [rsp + 0x30], 1
shr rax, 1
add r13, rcx
lea r14, [r14 + rax*2]
jmp 0x14015911f
lfence
mov edx, dword [rsp + 0x40]
mov r9, rbx
xor r8d, r8d
mov dword [rsp + 0x20], edi
mov rcx, r14
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
nop dword [rax]
test eax, eax
js 0x14015911f
mov ecx, dword [rsp + 0x40]
mov eax, ecx
shr rax, 1
add r13, rcx
lea r14, [r14 + rax*2]
jmp 0x14015911f
mov eax, dword [r10 + 0x10]
mov r15d, eax
mov r8d, eax
shr r15d, 0x1f
neg r8d
test eax, eax
cmovns r8d, eax
jmp 0x1401582fa
mov r8d, dword [r10 + 0x10]
mov r11d, 0xa
bt r12d, 8
jae 0x140158316
movzx ecx, byte [r10 + 0xa]
lea eax, [rcx - 2]
cmp al, 0x43
ja 0x140158316
mov r11d, ecx
bt r12d, 0x1d
lea r10, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
lea rax, [0x14028c560]
cmovae r10, rax
lea r9, [rbp + 0x39e]
xor esi, esi
mov ebx, esi
test r8d, r8d
je 0x1401583c6
bt r12d, 0x10
jae 0x1401583a2
mov edi, esi
xor edx, edx
mov eax, r8d
div r11d
inc ebx
inc edi
mov r8d, eax
movsx ecx, byte [rdx + r10]
mov word [r9], cx
sub r9, 2
cmp edi, 3
jne 0x14015838a
test eax, eax
je 0x14015838e
movzx eax, word [0x1402c2118]
mov word [r9], ax
sub r9, 2
inc ebx
jmp 0x140158350
test eax, eax
jne 0x140158352
mov eax, 1
mov edi, 0x30
test r15d, r15d
je 0x1401583e2
mov esi, eax
jmp 0x1401583ea
xor edx, edx
mov eax, r8d
div r11d
inc ebx
mov r8d, eax
movsx ecx, byte [rdx + r10]
mov word [r9], cx
sub r9, 2
test eax, eax
jne 0x1401583a2
jmp 0x14015838e
mov edi, 0x30
lea r9, [rbp + 0x39c]
mov eax, 1
mov word [rbp + 0x39e], di
mov ebx, eax
jmp 0x140158398
bt r12d, 0x11
cmovb esi, eax
mov eax, r12d
and eax, 0x50000
cmp eax, 0x40000
jne 0x14015841a
mov rcx, qword [rbp - 0x70]
lea eax, [rsi + rbx]
movzx ecx, word [rcx + 6]
cmp eax, ecx
jae 0x14015841a
mov edx, ecx
or r15d, 4
sub edx, esi
sub edx, ebx
mov dword [rsp + 0x50], edx
add esi, edx
jmp 0x14015841e
mov edx, dword [rsp + 0x50]
cmp byte [rsp + 0x30], 0
jne 0x1401584a1
lea eax, [rsi + rbx]
lea rax, [rax*2]
add rax, r13
cmp qword [rsp + 0x38], rax
jae 0x140158450
lea eax, [rsi + rbx]
mov byte [rsp + 0x30], 1
lea r13, [r13 + rax*2]
jmp case.default.0x140158106
test r15b, 1
je 0x14015845e
mov word [r14], 0x2d
jmp 0x14015846b
bt r12d, 0x11
jae 0x14015846f
mov word [r14], 0x2b
add r14, 2
test r15b, 4
je 0x14015848a
test rdx, rdx
je 0x140158486
movzx eax, di
mov rcx, rdx
mov rdi, r14
rep stosw word [rdi], ax
lea r14, [r14 + rdx*2]
mov edi, ebx
lea rdx, [r9 + 2]
add rdi, rdi
mov rcx, r14
mov r8, rdi
call fcn.14020be40
add r14, rdi
lea eax, [rsi + rbx]
lea r13, [r13 + rax*2]
jmp case.default.0x140158106
mov rax, qword [rdi + 0x10]
mov r15, rax
mov rdi, rax
shr r15, 0x3f
neg rdi
cmovs rdi, rax
jmp 0x1401584c9
mov rdi, qword [r10 + 0x10]
mov r10d, 0xa
bt r12d, 8
jae 0x1401584e7
movzx ecx, byte ds:[rdx + 0xa]
lea eax, [rcx - 2]
cmp al, 0x43
ja 0x1401584e7
mov r10d, ecx
bt r12d, 0x1d
lea r11, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
lea rax, [0x14028c560]
cmovae r11, rax
lea r9, [rbp + 0x39e]
xor esi, esi
mov ebx, esi
test rdi, rdi
je 0x1401585b0
bt r12d, 0x10
jae 0x140158582
mov r8d, esi
nop dword [rax]
xor edx, edx
mov rax, rdi
div r10
mov rax, rdi
inc ebx
mov rcx, rdx
inc r8d
xor edx, edx
div r10
mov rdi, rax
mov eax, ecx
movsx ecx, byte [rax + r11]
mov word [r9], cx
sub r9, 2
cmp r8d, 3
jne 0x140158568
test rdi, rdi
je 0x14015856d
movzx eax, word [0x1402c2118]
mov word [r9], ax
sub r9, 2
inc ebx
jmp 0x140158519
test rdi, rdi
jne 0x140158520
mov eax, 1
mov edi, 0x30
test r15d, r15d
je 0x1401585cc
mov esi, eax
jmp 0x1401585d4
xor edx, edx
mov rax, rdi
div r10
mov rax, rdi
inc ebx
mov rcx, rdx
xor edx, edx
div r10
mov rdi, rax
mov eax, ecx
movsx ecx, byte [rax + r11]
mov word [r9], cx
sub r9, 2
test rdi, rdi
jne 0x140158582
jmp 0x14015856d
mov edi, 0x30
lea r9, [rbp + 0x39c]
mov eax, 1
mov word [rbp + 0x39e], di
mov ebx, eax
jmp 0x140158577
bt r12d, 0x11
cmovb esi, eax
mov eax, r12d
and eax, 0x50000
cmp eax, 0x40000
jne 0x140158608
mov rax, qword [rbp - 0x70]
movzx ecx, word [rax + 6]
lea eax, [rsi + rbx]
cmp eax, ecx
jae 0x140158608
mov edx, ecx
or r15d, 4
sub edx, esi
sub edx, ebx
mov dword [rsp + 0x54], edx
add esi, edx
jmp 0x14015860c
mov edx, dword [rsp + 0x54]
cmp byte [rsp + 0x30], 0
jne 0x1401584a1
lea eax, [rsi + rbx]
lea rax, [rax*2]
add rax, r13
cmp qword [rsp + 0x38], rax
jae 0x14015863e
lea eax, [rsi + rbx]
mov byte [rsp + 0x30], 1
lea r13, [r13 + rax*2]
jmp case.default.0x140158106
nop
test r15b, 1
je 0x14015864e
mov word [r14], 0x2d
jmp 0x14015865b
bt r12d, 0x11
jae 0x14015865f
mov word [r14], 0x2b
add r14, 2
nop
test r15b, 4
je 0x14015867b
test rdx, rdx
je 0x140158677
movzx eax, di
mov rcx, rdx
mov rdi, r14
rep stosw word [rdi], ax
lea r14, [r14 + rdx*2]
mov edi, ebx
lea rdx, [r9 + 2]
add rdi, rdi
mov rcx, r14
mov r8, rdi
call fcn.14020be40
lea eax, [rsi + rbx]
add r14, rdi
lea r13, [r13 + rax*2]
jmp case.default.0x140158106
nop
test r12b, 0x40
je 0x1401586ba
movzx r8d, word [r10 + 4]
mov eax, 0xa2
cmp r8d, eax
jbe 0x1401586c0
mov r8d, eax
jmp 0x1401586c0
mov r8d, 6
movss xmm0, dword [r10 + 0x10]
lea r9, [rbp - 0x5f]
mov edx, r12d
lea rbx, [rbp - 0x5f]
call fcn.1401d5980
test al, al
jne 0x1401586df
mov byte [rbp - 0x5f], al
jmp 0x140158731
mov rdx, qword [0x1402cebd8]
test rdx, rdx
je 0x140158711
movzx eax, byte [rbp - 0x5f]
test al, al
je 0x140158711
lea rcx, [rbp - 0x5f]
cmp al, 0x2e
je 0x140158708
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1401586f7
jmp 0x140158711
movzx eax, byte [0x1402c1518]
mov byte [rcx], al
bt r12d, 0x1d
jae 0x140158731
lea rcx, ds:[rbp - 0x5f]
test rdx, rdx
je 0x14015872c
call fcn.1401f38e4
jmp 0x140158731
call fcn.1401f3884
mov r9d, dword ds:[rdi]
mov r10, rdi
bt r9d, 0xf
jae 0x1401587e4
movzx eax, byte [rbp - 0x5f]
lea rcx, [rbp - 0x5f]
movzx r8d, byte [0x1402c1518]
test al, al
je 0x140158770
nop word [rax + rax]
cmp al, r8b
je 0x140158770
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140158760
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1401587e4
movzx edx, byte ds:[rcx]
test dl, dl
je 0x14015879e
movzx eax, dl
cmp dl, 0x65
je 0x14015879e
cmp al, 0x45
je 0x14015879e
movzx eax, byte [rcx + 1]
inc rcx
movzx edx, al
test al, al
jne 0x140158787
movzx eax, byte [rcx - 1]
mov rdi, rcx
dec rcx
cmp al, 0x30
jne 0x1401587bb
nop dword [rax]
movzx eax, byte [rcx - 1]
dec rcx
cmp al, 0x30
je 0x1401587b0
cmp al, r8b
lea rdx, [rcx - 1]
cmovne rdx, rcx
nop word [rax + rax]
movzx eax, byte ds:[rdi]
lea rdx, [rdx + 1]
mov byte [rdx], al
lea rdi, [rdi + 1]
test al, al
jne 0x1401587d0
lea rax, [rbp - 0x5f]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1401587f0
cmp byte [rbp - 0x5f], 0x2d
mov r15d, 1
jne 0x140158815
dec r8d
lea rbx, [rbp - 0x5e]
xor r11d, r11d
mov esi, r15d
jmp 0x14015882b
mov r11d, 0
bt r9d, 0x11
mov esi, r11d
mov eax, 2
cmovb esi, eax
mov eax, r9d
and eax, 0x13000
cmp eax, 0x10000
jne 0x14015896a
movzx eax, byte [rbx]
mov r9, rbx
sub al, 0x30
cmp al, 0xa
jae 0x14015885e
nop word [rax + rax]
movzx eax, byte [r9 + 1]
inc r9
sub al, 0x30
cmp al, 0xa
jb 0x140158850
mov r10d, r9d
sub r10d, ebx
lea edi, [r10 + 2]
je 0x14015887a
mov eax, 0xaaaaaaab
mul edi
mov r11d, edx
shr r11d, 1
dec r11d
movzx r12d, byte [rsp + 0x30]
lea ecx, [r11 + r8]
add ecx, ecx
test r12b, r12b
jne 0x1401588aa
test esi, esi
lea eax, [rcx + 2]
cmove eax, ecx
add rax, r13
cmp qword [rsp + 0x38], rax
jae 0x1401588aa
mov r12b, 1
mov byte [rsp + 0x30], r12b
jmp 0x14015892f
mov eax, 0xaaaaaaab
mov ecx, r10d
mul edi
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
test r12b, r12b
jne 0x14015892f
test sil, 1
je 0x1401588d3
mov word [r14], 0x2d
jmp 0x1401588df
test sil, 2
je 0x1401588e3
mov word [r14], 0x2b
add r14, 2
test r10d, r10d
je 0x14015892f
nop dword [rax + rax]
movsx eax, byte [rbx]
dec ecx
mov word [r14], ax
inc rbx
mov eax, edi
add r14, 2
dec edi
test eax, eax
jne 0x14015892b
test ecx, ecx
je 0x14015892f
movzx eax, word [0x1402c2118]
dec ecx
mov word [r14], ax
mov edi, r15d
movsx eax, byte [rbx]
mov word [r14 + 2], ax
add r14, 4
inc rbx
test ecx, ecx
jne 0x1401588f0
test esi, esi
je 0x140158937
add r13, 2
lea eax, [r11 + r10]
lea r13, [r13 + rax*2]
test r12b, r12b
jne case.default.0x140158106
sub r8d, r10d
mov rcx, r9
mov edi, r8d
mov r8, r14
mov edx, edi
call sym.SystemInformer.exe_PhZeroExtendToUtf16Buffer
lea r14, [r14 + rdi*2]
lea r13, [r13 + rdi*2]
jmp case.default.0x140158106
test esi, esi
mov rcx, r11
setne cl
mov rdx, rcx
bt r9d, 0x12
jae 0x1401589a3
movzx r9d, word [r10 + 6]
mov edi, r8d
lea rax, [rdi + rcx]
cmp rax, r9
jae 0x1401589a3
mov edx, r9d
or esi, 4
sub rdx, rdi
mov r9, rdx
sub r9, rcx
mov qword [rsp + 0x68], r9
jmp 0x1401589a8
mov r9, qword [rsp + 0x68]
movzx r12d, byte [rsp + 0x30]
test r12b, r12b
jne 0x140158a27
mov eax, r8d
add rax, rdx
lea rax, [rax*2]
add rax, r13
cmp qword [rsp + 0x38], rax
jae 0x1401589da
mov byte [rsp + 0x30], 1
lea r13, [r13 + rdx*2]
jmp case.default.0x140158106
nop word [rax + rax]
test sil, 1
je 0x1401589ee
mov word [r14], 0x2d
jmp 0x1401589fa
test sil, 2
je 0x1401589fe
mov word [r14], 0x2b
add r14, 2
nop
test sil, 4
je 0x140158a27
test r9, r9
je 0x140158a1c
mov edi, 0x30
mov rcx, r9
movzx eax, di
mov rdi, r14
rep stosw word [rdi], ax
lea r14, [r14 + r9*2]
lea r13, [r13 + rdx*2]
jmp 0x140158a35
lea r13, [r13 + rdx*2]
test r12b, r12b
jne case.default.0x140158106
mov edi, r8d
mov rcx, rbx
mov edx, edi
mov r8, r14
call sym.SystemInformer.exe_PhZeroExtendToUtf16Buffer
lea r14, [r14 + rdi*2]
lea r13, [r13 + rdi*2]
jmp case.default.0x140158106
test r12b, 0x40
je 0x140158a6d
movzx r8d, word [r10 + 4]
mov eax, 0xa2
cmp r8d, eax
jbe 0x140158a73
mov r8d, eax
jmp 0x140158a73
mov r8d, 6
movsd xmm0, qword [r10 + 0x10]
lea r9, [rbp - 0x5f]
mov edx, r12d
lea rbx, [rbp - 0x5f]
call fcn.1401d5c00
test al, al
jne 0x140158a92
mov byte [rbp - 0x5f], al
jmp 0x140158aec
mov rdx, qword [0x1402cebd8]
test rdx, rdx
je 0x140158acb
movzx eax, byte [rbp - 0x5f]
test al, al
je 0x140158acb
lea rcx, [rbp - 0x5f]
nop word [rax + rax]
cmp al, 0x2e
je 0x140158ac2
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140158ab0
nop
jmp 0x140158acb
movzx eax, byte [0x1402c1518]
mov byte [rcx], al
bt r12d, 0x1d
jae 0x140158aec
lea rcx, [rbp - 0x5f]
test rdx, rdx
je 0x140158ae7
nop dword [rax + rax]
call fcn.1401f38e4
jmp 0x140158aec
call fcn.1401f3884
mov r9d, dword [rdi]
mov r10, rdi
bt r9d, 0xf
jae 0x140158b91
movzx eax, byte [rbp - 0x5f]
lea rcx, [rbp - 0x5f]
movzx r8d, byte [0x1402c1518]
test al, al
je 0x140158b24
cmp al, r8b
je 0x140158b24
movzx eax, byte ds:[rcx + 1]
inc rcx
test al, al
jne 0x140158b11
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140158b91
movzx edx, byte [rcx]
test dl, dl
je 0x140158b52
movzx eax, dl
cmp dl, 0x65
je 0x140158b52
nop dword [rax]
cmp al, 0x45
je 0x140158b52
movzx eax, byte [rcx + 1]
inc rcx
movzx edx, al
test al, al
jne 0x140158b38
movzx eax, byte ds:[rcx - 1]
mov rdi, rcx
dec rcx
cmp al, 0x30
jne 0x140158b6f
movzx eax, byte [rcx - 1]
dec rcx
cmp al, 0x30
je 0x140158b64
cmp al, r8b
lea rdx, [rcx - 1]
cmovne rdx, rcx
nop word [rax + rax]
movzx eax, byte [rdi]
lea rdx, [rdx + 1]
mov byte [rdx], al
lea rdi, [rdi + 1]
test al, al
jne 0x140158b80
lea rax, [rbp - 0x5f]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140158ba0
cmp byte [rbp - 0x5f], 0x2d
mov r15d, 1
jne 0x140158bc5
dec r8d
lea rbx, [rbp - 0x5e]
xor r11d, r11d
mov esi, r15d
jmp 0x140158bdb
mov r11d, 0
bt r9d, 0x11
mov esi, r11d
mov eax, 2
cmovb esi, eax
mov eax, r9d
and eax, 0x13000
cmp eax, 0x10000
jne 0x140158cf0
movzx eax, byte [rbx]
mov r9, rbx
sub al, 0x30
cmp al, 0xa
jae 0x140158c0e
nop word [rax + rax]
movzx eax, byte [r9 + 1]
inc r9
sub al, 0x30
cmp al, 0xa
jb 0x140158c00
mov r10d, r9d
sub r10d, ebx
lea edi, [r10 + 2]
je 0x140158c2a
mov eax, 0xaaaaaaab
mul edi
mov r11d, edx
shr r11d, 1
dec r11d
movzx r12d, byte [rsp + 0x30]
lea ecx, [r11 + r8]
add ecx, ecx
test r12b, r12b
jne 0x140158c5a
test esi, esi
lea eax, [rcx + 2]
cmove eax, ecx
add rax, r13
cmp qword [rsp + 0x38], rax
jae 0x140158c5a
mov r12b, 1
mov byte [rsp + 0x30], r12b
jmp 0x14015892f
mov eax, 0xaaaaaaab
mov ecx, r10d
mul edi
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
test r12b, r12b
jne 0x14015892f
test sil, 1
je 0x140158c82
mov word [r14], 0x2d
jmp 0x140158c8e
test sil, 2
je 0x140158c92
mov word [r14], 0x2b
add r14, 2
test r10d, r10d
je 0x14015892f
nop dword [rax + rax]
movsx eax, byte [rbx]
dec ecx
mov word [r14], ax
inc rbx
mov eax, edi
add r14, 2
dec edi
test eax, eax
jne 0x140158ce7
nop dword [rax + rax]
test ecx, ecx
je 0x14015892f
movzx eax, word [0x1402c2118]
dec ecx
mov word [r14], ax
mov edi, r15d
movsx eax, byte [rbx]
mov word [r14 + 2], ax
add r14, 4
inc rbx
test ecx, ecx
jne 0x140158ca0
jmp 0x14015892f
test esi, esi
mov rcx, r11
setne cl
mov rdx, rcx
bt r9d, 0x12
jae 0x140158d29
movzx r9d, word [r10 + 6]
mov edi, r8d
lea rax, [rdi + rcx]
cmp rax, r9
jae 0x140158d29
mov edx, r9d
or esi, 4
sub rdx, rdi
mov r9, rdx
sub r9, rcx
mov qword [rsp + 0x70], r9
jmp 0x140158d2e
mov r9, qword [rsp + 0x70]
movzx r12d, byte [rsp + 0x30]
test r12b, r12b
jne 0x140158db0
mov eax, r8d
add rax, rdx
lea rax, [rax*2]
add rax, r13
cmp qword [rsp + 0x38], rax
jae 0x140158d65
mov byte ds:[rsp + 0x30], 1
lea r13, [r13 + rdx*2]
jmp case.default.0x140158106
test sil, 1
je 0x140158d73
mov word [r14], 0x2d
jmp 0x140158d7f
test sil, 2
je 0x140158d83
mov word [r14], 0x2b
add r14, 2
test sil, 4
je 0x140158db0
test r9, r9
je 0x140158d9f
mov edi, 0x30
mov rcx, r9
movzx eax, di
mov rdi, r14
rep stosw word [rdi], ax
lea r14, [r14 + r9*2]
mov rcx, rbx
lea r13, [r13 + rdx*2]
jmp 0x14015894f
lea r13, [r13 + rdx*2]
test r12b, r12b
jne case.default.0x140158106
mov rcx, rbx
jmp 0x14015894f
mov rdx, qword [r10 + 0x10]
mov esi, r8d
xorps xmm0, xmm0
test rdx, rdx
js 0x140158ddc
cvtsi2sd xmm0, rdx
jmp 0x140158df4
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2sd xmm0, rcx
addsd xmm0, xmm0
test rdx, rdx
jne 0x140158e35
cmp byte [rsp + 0x30], dl
jne 0x140158e23
lea rax, [r13 + 2]
cmp rbx, rax
jae 0x140158e1f
mov rsi, qword [rsp + 0x38]
add r14, 2
add r13, 2
mov byte [rsp + 0x30], 1
jmp 0x140159123
mov word [r14], r11w
mov rsi, qword [rsp + 0x38]
add r14, 2
add r13, 2
jmp 0x140159123
bt r12d, 8
jae 0x140158e43
movzx eax, byte [r10 + 0xa]
jmp 0x140158e49
mov eax, dword [0x1402c8240]
comisd xmm0, xmm6
jb 0x140158e65
nop
cmp esi, 7
jae 0x140158e65
cmp esi, eax
jae 0x140158e65
mulsd xmm0, xmm7
inc esi
comisd xmm0, xmm6
jae 0x140158e50
test r12b, 0x40
je 0x140158e72
movzx eax, word [r10 + 4]
jmp 0x140158e77
mov eax, 2
movzx r8d, ax
lea r9, [rbp - 0x5f]
mov eax, 0xa2
lea rbx, [rbp - 0x5f]
cmp r8d, eax
mov edx, 0x1804c
cmova r8d, eax
call fcn.1401d5c00
movzx r8d, word [0x1402c1518]
test al, al
jne 0x140158eac
xor dl, dl
mov byte [rbp - 0x5f], dl
jmp 0x140158edd
cmp qword [0x1402cebd8], 0
movzx edx, byte [rbp - 0x5f]
je 0x140158edd
test dl, dl
je 0x140158edd
lea rcx, [rbp - 0x5f]
movzx eax, dl
cmp al, 0x2e
je 0x140158ed6
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140158ec5
jmp 0x140158edd
mov byte [rcx], r8b
movzx edx, byte [rbp - 0x5f]
lea rcx, [rbp - 0x5f]
test dl, dl
je 0x140158ef8
movzx eax, dl
cmp al, r8b
je 0x140158ef8
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140158ee8
movzx eax, byte ds:[rcx]
inc rcx
test al, al
je 0x140158f68
movzx edx, byte [rcx]
test dl, dl
je 0x140158f27
movzx eax, dl
nop
cmp dl, 0x65
je 0x140158f27
cmp al, 0x45
je 0x140158f27
movzx eax, byte [rcx + 1]
inc rcx
movzx edx, al
test al, al
jne 0x140158f10
movzx eax, byte [rcx - 1]
mov rdi, rcx
dec rcx
cmp al, 0x30
jne 0x140158f44
movzx eax, byte ds:[rcx - 1]
dec rcx
cmp al, 0x30
je 0x140158f35
cmp al, r8b
lea rdx, [rcx - 1]
cmovne rdx, rcx
nop
movzx eax, byte ds:[rdi]
lea rdx, [rdx + 1]
mov byte [rdx], al
lea rdi, [rdi + 1]
test al, al
jne 0x140158f50
movzx edx, byte [rbp - 0x5f]
lea rax, [rbp - 0x5f]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140158f73
nop dword [rax]
cmp dl, 0x2d
jne 0x140158f92
mov r15d, 1
lea rbx, [rbp - 0x5e]
dec r8d
movzx eax, byte [rbx]
mov r9, rbx
sub al, 0x30
cmp al, 0xa
jae 0x140158fae
nop
movzx eax, byte [r9 + 1]
inc r9
sub al, 0x30
cmp al, 0xa
jb 0x140158fa0
mov r10d, r9d
sub r10d, ebx
lea edi, [r10 + 2]
je 0x140158fcc
mov eax, 0xaaaaaaab
mul edi
mov r11d, edx
shr r11d, 1
dec r11d
jmp 0x140158fd1
xor eax, eax
mov r11d, eax
movzx r12d, byte ds:[rsp + 0x30]
lea ecx, [r11 + r8]
add ecx, ecx
test r12b, r12b
jne 0x140159002
test r15d, r15d
lea eax, [rcx + 2]
cmove eax, ecx
add rax, r13
cmp qword [rsp + 0x38], rax
jae 0x140159002
mov r12b, 1
mov byte [rsp + 0x30], r12b
jmp 0x140159077
mov eax, 0xaaaaaaab
mov ecx, r10d
mul edi
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
test r12b, r12b
jne 0x140159077
test r15d, r15d
je 0x140159027
mov word [r14], 0x2d
add r14, 2
test r10d, r10d
je 0x140159077
mov r12d, 1
movsx eax, byte [rbx]
dec ecx
mov word [r14], ax
inc rbx
mov eax, edi
add r14, 2
dec edi
test eax, eax
jne 0x14015906d
test ecx, ecx
je 0x140159071
movzx eax, word [0x1402c2118]
dec ecx
mov word [r14], ax
mov edi, r12d
movsx eax, byte [rbx]
mov word [r14 + 2], ax
add r14, 4
inc rbx
test ecx, ecx
jne 0x140159032
movzx r12d, byte [rsp + 0x30]
test r15d, r15d
je 0x140159080
add r13, 2
lea eax, [r11 + r10]
lea rbx, [rax*2]
add rbx, r13
test r12b, r12b
jne 0x1401590f4
sub r8d, r10d
mov rcx, r9
mov edi, r8d
mov r8, r14
mov edx, edi
call sym.SystemInformer.exe_PhZeroExtendToUtf16Buffer
mov edx, esi
lea rbx, [rbx + rdi*2]
add rdx, rdx
lea r9, [0x140000000]
lea rcx, [rbx + 2]
lea r14, [r14 + rdi*2]
add rcx, qword [r9 + rdx*8 + 0x2c6bb0]
cmp qword [rsp + 0x38], rcx
jae 0x1401590d5
mov byte [rsp + 0x30], 1
jmp 0x1401590fb
mov word [r14], 0x20
lea rcx, [r14 + 2]
mov r8, qword [r9 + rdx*8 + 0x2c6bb0]
mov rdx, qword [r9 + rdx*8 + 0x2c6bb8]
call fcn.14020be40
lea r9, [0x140000000]
mov eax, esi
add rax, rax
mov rcx, qword [r9 + rax*8 + 0x2c6bb0]
lea rax, [rcx + 2]
shr rax, 1
lea r13, [rcx + 2]
add r13, rbx
lea r14, [r14 + rax*2]
mov rsi, qword [rsp + 0x38]
mov r10, qword [rbp - 0x70]
mov ecx, dword [r10]
mov r8, r13
sub r8, qword [rsp + 0x78]
test ecx, 0xc0000000
je 0x1401591c8
movzx ebx, word [r10 + 6]
add rbx, rbx
cmp r8, rbx
jae 0x1401591c8
sub rbx, r8
cmp byte [rsp + 0x30], 0
jne 0x1401591bb
lea rax, [rbx + r13]
cmp rsi, rax
jae 0x140159165
mov byte [rsp + 0x30], 1
jmp 0x1401591bb
test cl, cl
jns 0x140159170
movzx r15d, word [r10 + 8]
jmp 0x140159176
mov r15d, 0x20
mov rsi, rbx
shr rsi, 1
test ecx, ecx
jns 0x14015918e
test rsi, rsi
je 0x1401591bb
mov rdi, r14
jmp 0x1401591b1
lfence
mov rax, r8
mov rdi, r14
shr rax, 1
add rax, rax
sub rdi, rax
mov rdx, rdi
lea rcx, [rdi + rsi*2]
call fcn.14020be40
test rsi, rsi
je 0x1401591bb
mov rcx, rsi
movzx eax, r15w
rep stosw word [rdi], ax
mov rax, rbx
shr rax, 1
add r13, rbx
lea r14, [r14 + rax*2]
mov r15d, dword [rsp + 0x60]
lea r9, [0x140000000]
movzx esi, byte [rsp + 0x30]
mov r11d, 0x30
mov rbx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x58]
test r15d, r15d
jne 0x1401580c0
movaps xmm7, xmmword [rsp + 0x4b0]
movaps xmm6, xmmword [rsp + 0x4c0]
mov rdi, qword [rbp - 0x80]
mov r12, qword [rbp - 0x78]
mov r15, qword ss:[rsp + 0x4d0]
lea rax, [r13 + 2]
mov r13, qword [rsp + 0x4e0]
test sil, sil
jne 0x14015922d
cmp rbx, rax
jae 0x140159284
mov sil, 1
mov rcx, rax
test rdi, rdi
je 0x140159242
test rbx, rbx
je 0x140159242
xor eax, eax
mov word [rdi], ax
mov rax, rcx
mov r14, qword [rsp + 0x4d8]
mov rdi, qword [rsp + 0x4e8]
mov rbx, qword [rsp + 0x518]
test r12, r12
je 0x140159263
mov qword [r12], rax
test sil, sil
sete al
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.1401e5e20
add rsp, 0x4f0
pop r12
pop rsi
pop rbp
ret
xor ecx, ecx
mov word [r14], cx
jmp 0x140159242