Function at 0x1401776a0
Capabilities:
Get geographical location

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r15
lea rbp, [rsp - 0x3d8]
sub rsp, 0x4d8
mov rax, qword [0x1402b5020]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov edi, 0x1e
mov esi, edx
mov rdx, qword [0x1402bfcf8]
cmp r8, rdi
mov r12, rcx
cmovae rdi, r8
mov qword [rsp + 0x38], rdi
lea rcx, [rdi + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor ecx, ecx
mov qword [rsp + 0x30], rax
mov r11, rax
mov qword [rsp + 0x40], rcx
mov r15d, ecx
mov qword [rax], rdi
add rax, 0x10
mov qword [r11 + 8], rax
mov word [rdi + rax], cx
test byte [0x1402bc100], 1
mov rbx, qword [r11 + 8]
jne 0x1401777eb
lock bts qword [0x1402bc100], 0x1f
jb 0x1401777cf
lea r9d, [rcx + 4]
lea edx, [rcx + 0xe]
mov ecx, 0x400
lea r8, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14017776e
mov rax, qword [rbp - 0x70]
test ax, ax
je 0x14017776e
nop dword [rax]
cmp word [rbp - 0x6e], r15w
jne 0x14017776e
mov word [0x1402b64a8], ax
mov r9d, 4
lea r8, [rbp - 0x70]
mov ecx, 0x400
lea edx, [r9 + 0xb]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1401777a2
mov rax, qword [rbp - 0x70]
test ax, ax
je 0x1401777a2
cmp word [rbp - 0x6e], r15w
jne 0x1401777a2
mov word [0x1402b75d4], ax
cmp word [0x1402b64a8], 0x2e
je 0x1401777c1
lea rdx, [0x140231658]
xor ecx, ecx
call fcn.1401ecd88
mov qword [0x1402c3450], rax
lea rcx, [0x1402bc100]
call sym.SystemInformer.exe_PhfSetEvent
jmp 0x1401777e6
test byte [0x1402bc100], 1
jne 0x1401777eb
xor edx, edx
lea rcx, [0x1402bc100]
call sym.SystemInformer.exe_PhfWaitForEvent
mov r11, qword [rsp + 0x30]
test esi, esi
je 0x140178aed
mov qword [rsp + 0x518], r13
lea r8, [0x140000000]
mov qword [rsp + 0x4d0], r14
mov r10d, 1
movaps xmmword [rsp + 0x4c0], xmm6
mov r9d, 0xa2
movsd xmm6, qword [0x140288b30]
movaps xmmword [rsp + 0x4b0], xmm7
movsd xmm7, qword [0x140288ad8]
nop word [rax + rax]
mov r14, r12
mov qword [rsp + 0x58], r12
mov rdx, r12
mov qword [rbp - 0x80], r15
add r12, 0x20
dec esi
xor r11d, r11d
mov qword [rbp - 0x78], r12
mov r13d, dword [r14]
mov r12d, r11d
mov eax, r13d
mov dword [rsp + 0x70], esi
and eax, 0x3f
cmp eax, 0xc
ja case.default.0x140177882
cdqe
mov ecx, dword [r8 + rax*4 + 0x178b24]
add rcx, r8
jmp rcx
lea rsi, [r15 + 2]
cmp rdi, rsi
jae 0x140177901
mov rdx, qword [0x1402bfcf8]
lea rax, [rdi + rdi]
cmp rax, rsi
mov rbx, rsi
cmovae rbx, rax
mov qword [rsp + 0x38], rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor edx, edx
mov r8, r15
mov rdi, rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rbx], dx
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
call fcn.1401e3aa0
lea rcx, [rbx - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x1401778f1
call fcn.14013d2a0
mov rax, qword [rdi + 8]
shr r15, 1
mov qword [rsp + 0x30], rdi
lea rbx, [rax + r15*2]
movzx eax, word [r14 + 0x10]
mov r15, rsi
mov word [rbx], ax
add rbx, 2
mov qword [rsp + 0x40], rsi
jmp case.default.0x140177882
mov rcx, qword [r14 + 0x10]
add rcx, r15
cmp rdi, rcx
jae 0x1401779a1
mov rdx, qword [0x1402bfcf8]
lea rax, [rdi + rdi]
cmp rax, rcx
mov rbx, rcx
cmovae rbx, rax
mov qword [rsp + 0x38], rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor edx, edx
mov r8, r15
mov rdi, rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rbx], dx
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
call fcn.1401e3aa0
lea rcx, [rbx - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14017798e
call fcn.14013d2a0
mov rax, qword [rdi + 8]
mov rcx, r15
shr rcx, 1
mov qword [rsp + 0x30], rdi
lea rbx, [rax + rcx*2]
mov r8, qword [r14 + 0x10]
mov rcx, rbx
mov rdx, qword [r14 + 0x18]
call fcn.1401e3aa0
mov rax, qword ds:[r14 + 0x10]
shr rax, 1
add r15, qword [r14 + 0x10]
jmp 0x140178963
mov rdi, qword [r14 + 0x10]
xorps xmm1, xmm1
mov rdx, rdi
mov ecx, edi
and rdx, 0xfffffffffffffff1
and ecx, 0xf
je 0x1401779fc
movdqu xmm0, xmmword [rdx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
mov dword [rsp + 0x64], ecx
je 0x1401779f8
mov edx, ecx
shr rdx, 1
jmp 0x140177a39
add rdx, 0x10
movdqu xmm0, xmmword [rdx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x64], ecx
jne 0x140177a2b
movdqu xmm0, xmmword [rdx + 0x10]
add rdx, 0x10
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x64], ecx
je 0x140177a11
sub rdx, rdi
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
mov r8, qword [rsp + 0x38]
lea rdi, [rdx + rdx]
lea rsi, [rdi + r15]
cmp r8, rsi
jae 0x140177ac7
mov rdx, qword [0x1402bfcf8]
lea rax, [r8 + r8]
cmp rax, rsi
mov r12, rsi
cmovae r12, rax
mov qword [rsp + 0x38], r12
lea rcx, [r12 + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor edx, edx
mov r8, r15
mov rbx, rax
mov qword [rax], r12
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [r12 + rcx], dx
mov r12, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [r12 + 8]
call fcn.1401e3aa0
lea rcx, [r12 - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140177ab7
call fcn.14013d2a0
mov rax, qword [rbx + 8]
shr r15, 1
mov qword [rsp + 0x30], rbx
lea rbx, [rax + r15*2]
mov rdx, qword [r14 + 0x10]
mov r8, rdi
mov rcx, rbx
call fcn.1401e3aa0
shr rdi, 1
mov r15, rsi
mov qword [rsp + 0x40], rsi
lea rbx, [rbx + rdi*2]
jmp case.default.0x140177882
cmp r13d, 3
jne 0x140177afa
mov rsi, qword [r14 + 0x18]
mov rdi, qword [r14 + 0x10]
jmp 0x140177b0e
mov rsi, qword [r14 + 0x10]
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rsi + rdi], r11b
jne 0x140177b05
mov r8d, edi
lea rcx, [rsp + 0x60]
mov rdx, rsi
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeSize]
nop
test eax, eax
js case.default.0x140177882
lfence
mov edx, dword [rsp + 0x60]
mov r8, qword [rsp + 0x38]
lea rcx, [r15 + rdx]
cmp r8, rcx
jae 0x140177bc8
mov rdx, qword [0x1402bfcf8]
lea rax, [r8 + r8]
cmp rax, rcx
mov r12, rcx
cmovae r12, rax
mov qword [rsp + 0x38], r12
lea rcx, [r12 + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor edx, edx
mov r8, r15
mov rbx, rax
mov qword [rax], r12
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [r12 + rcx], dx
mov r12, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [r12 + 8]
call fcn.1401e3aa0
lea rcx, [r12 - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140177bb1
call fcn.14013d2a0
mov rax, qword [rbx + 8]
mov rcx, r15
mov edx, dword [rsp + 0x60]
shr rcx, 1
mov qword [rsp + 0x30], rbx
lea rbx, [rax + rcx*2]
mov r9, rsi
mov dword [rsp + 0x20], edi
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
nop dword [rax + rax]
test eax, eax
js case.default.0x140177882
mov ecx, dword [rsp + 0x60]
mov eax, ecx
shr rax, 1
add r15, rcx
jmp 0x140178963
mov eax, dword [r14 + 0x10]
mov r12d, eax
mov r8d, eax
shr r12d, 0x1f
neg r8d
test eax, eax
cmovns r8d, eax
jmp 0x140177c16
mov r8d, dword [r14 + 0x10]
mov r10d, 0xa
bt r13d, 8
jae 0x140177c33
movzx eax, byte [r14 + 0xa]
cmp al, 2
jb 0x140177c33
cmp al, 0x45
ja 0x140177c33
mov r10d, eax
bt r13d, 0x1d
lea r9, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
lea rax, [0x140283520]
mov r14d, r11d
cmovae r9, rax
lea rsi, [rbp + 0x39e]
test r8d, r8d
je 0x140177ce2
bt r13d, 0x10
jae 0x140177cc0
mov edi, r11d
nop word [rax + rax]
xor edx, edx
mov eax, r8d
div r10d
inc r14d
inc edi
mov r8d, eax
movsx ecx, byte [rdx + r9]
mov word [rsi], cx
sub rsi, 2
cmp edi, 3
jne 0x140177ca8
test eax, eax
je 0x140177cac
movzx eax, word [0x1402b75d4]
mov word [rsi], ax
sub rsi, 2
inc r14d
jmp 0x140177c64
test eax, eax
jne 0x140177c70
mov rdi, qword [rsp + 0x38]
mov eax, 1
test r12d, r12d
je 0x140177cff
mov ecx, eax
jmp 0x140177d0a
xor edx, edx
mov eax, r8d
div r10d
inc r14d
mov r8d, eax
movsx ecx, byte [rdx + r9]
mov word [rsi], cx
sub rsi, 2
test eax, eax
jne 0x140177cc0
nop
jmp 0x140177cb1
mov eax, 0x30
lea rsi, [rbp + 0x39c]
mov word [rbp + 0x39e], ax
mov eax, 1
mov r14d, eax
jmp 0x140177cb6
bt r13d, 0x11
mov ecx, r11d
cmovb ecx, eax
mov eax, r13d
and eax, 0x50000
cmp eax, 0x40000
jne 0x140177d3b
mov rax, qword [rsp + 0x58]
movzx edx, word [rax + 6]
lea eax, [rcx + r14]
cmp eax, edx
jae 0x140177d3b
mov eax, edx
or r12d, 4
sub eax, ecx
sub eax, r14d
mov dword [rsp + 0x68], eax
add ecx, eax
lea eax, [rcx + r14]
lea r15, [r15 + rax*2]
cmp rdi, r15
jae 0x140177dcd
mov rdx, qword [0x1402bfcf8]
lea rax, [rdi + rdi]
cmp rax, r15
mov rbx, r15
cmovae rbx, rax
mov qword [rsp + 0x38], rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov r13, qword [rsp + 0x30]
xor edx, edx
mov rdi, rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rbx], dx
mov rbx, qword [rsp + 0x40]
mov rdx, qword [r13 + 8]
mov r8, rbx
mov rcx, qword [rax + 8]
call fcn.1401e3aa0
lea rcx, [r13 - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140177db5
call fcn.14013d2a0
mov rax, qword [rdi + 8]
shr rbx, 1
mov qword [rsp + 0x30], rdi
lea rbx, [rax + rbx*2]
mov rax, qword [rsp + 0x58]
mov r13d, dword [rax]
test r12b, 1
je 0x140177dda
mov word [rbx], 0x2d
jmp 0x140177de7
bt r13d, 0x11
jae 0x140177deb
mov word [rbx], 0x2b
add rbx, 2
test r12b, 4
je 0x140177e0f
mov edx, dword [rsp + 0x68]
test rdx, rdx
je 0x140177e0b
mov eax, 0x30
mov rdi, rbx
movzx eax, ax
mov rcx, rdx
rep stosw word [rdi], ax
lea rbx, [rbx + rdx*2]
mov edi, r14d
lea rdx, [rsi + 2]
add rdi, rdi
mov rcx, rbx
mov r8, rdi
call fcn.1401e3aa0
mov r14, qword [rsp + 0x58]
add rbx, rdi
jmp 0x140178967
mov eax, 0x10
mov rax, qword [rax + rdx]
mov r12, rax
cqo
mov r8, rax
shr r12, 0x3f
xor r8, rdx
sub r8, rdx
jmp 0x140177e53
mov r8, qword [r14 + 0x10]
mov ecx, 0xa
bt r13d, 8
jae 0x140177e6e
movzx eax, byte [r14 + 0xa]
cmp al, 2
jb 0x140177e6e
cmp al, 0x45
ja 0x140177e6e
mov ecx, eax
bt r13d, 0x1d
lea r9, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
lea rax, [0x140283520]
mov r14d, r11d
cmovae r9, rax
lea rsi, [rbp + 0x39e]
test r8, r8
je 0x140177f33
bt r13d, 0x10
jae 0x140177f0a
mov r10d, ecx
mov edi, r11d
nop word [rax + rax]
xor edx, edx
mov rax, r8
div r10
inc r14d
inc edi
mov r8, rax
mov eax, edx
movsx ecx, byte [rax + r9]
mov word [rsi], cx
sub rsi, 2
cmp edi, 3
jne 0x140177eeb
test r8, r8
je 0x140177ef0
movzx eax, word [0x1402b75d4]
mov word [rsi], ax
sub rsi, 2
inc r14d
jmp 0x140177ea2
test r8, r8
jne 0x140177eb0
mov r10d, 1
mov rdi, qword [rsp + 0x38]
nop dword [rax + rax]
test r12d, r12d
je 0x140177f4b
mov ecx, r10d
jmp 0x140177f57
mov edi, ecx
nop dword [rax]
xor edx, edx
mov rax, r8
div rdi
inc r14d
mov r8, rax
mov eax, edx
movsx ecx, byte [rax + r9]
mov word [rsi], cx
sub rsi, 2
test r8, r8
jne 0x140177f10
jmp 0x140177ef6
mov eax, 0x30
lea rsi, [rbp + 0x39c]
mov word [rbp + 0x39e], ax
mov r14d, r10d
jmp 0x140177efb
bt r13d, 0x11
mov ecx, r11d
cmovb ecx, r10d
mov eax, r13d
and eax, 0x50000
cmp eax, 0x40000
jne 0x140177f89
mov rax, qword [rsp + 0x58]
movzx edx, word [rax + 6]
lea eax, [rcx + r14]
cmp eax, edx
jae 0x140177f89
mov eax, edx
or r12d, 4
sub eax, ecx
sub eax, r14d
mov dword [rsp + 0x6c], eax
add ecx, eax
lea eax, [rcx + r14]
lea r15, [r15 + rax*2]
cmp rdi, r15
jae 0x14017801d
mov rdx, qword [0x1402bfcf8]
lea rax, [rdi + rdi]
cmp rax, r15
mov rbx, r15
cmovae rbx, rax
mov qword [rsp + 0x38], rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov r13, qword [rsp + 0x30]
xor edx, edx
mov rdi, rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rbx], dx
mov rbx, qword [rsp + 0x40]
mov rdx, qword [r13 + 8]
mov r8, rbx
mov rcx, qword [rax + 8]
call fcn.1401e3aa0
lea rcx, [r13 - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140178005
nop
call fcn.14013d2a0
mov rax, qword [rdi + 8]
shr rbx, 1
mov qword [rsp + 0x30], rdi
lea rbx, [rax + rbx*2]
mov rax, qword [rsp + 0x58]
mov r13d, dword [rax]
nop dword [rax]
test r12b, 1
je 0x14017802d
mov word [rbx], 0x2d
jmp 0x140178039
bt r13d, 0x11
jae 0x14017803d
mov word [rbx], 0x2b
add rbx, 2
nop dword [rax]
test r12b, 4
je 0x140177e0f
mov edx, dword [rsp + 0x6c]
jmp 0x140177df5
test r13b, 0x40
je 0x14017806a
movzx r8d, word ds:[r14 + 4]
cmp r8d, r9d
jbe 0x140178070
mov r8d, r9d
jmp 0x140178070
mov r8d, 6
movsd xmm0, qword [r14 + 0x10]
lea r9, [rbp - 0x5f]
mov edx, r13d
lea r15, [rbp - 0x5f]
call fcn.1401cdb80
test al, al
jne 0x140178090
mov byte [rbp - 0x5f], r12b
jmp 0x1401780de
mov rdx, qword [0x1402c3450]
test rdx, rdx
je 0x1401780c2
movzx eax, byte [rbp - 0x5f]
lea rcx, [rbp - 0x5f]
test al, al
je 0x1401780c2
cmp al, 0x2e
je 0x1401780b9
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1401780a8
jmp 0x1401780c2
movzx eax, byte [0x1402b64a8]
mov byte [rcx], al
bt r13d, 0x1d
jae 0x1401780de
lea rcx, [rbp - 0x5f]
test rdx, rdx
je 0x1401780d9
call fcn.1401ec3b0
jmp 0x1401780de
call fcn.1401ec350
mov r9d, dword [r14]
bt r9d, 0xf
jae 0x140178171
movzx eax, byte ds:[rbp - 0x5f]
lea rcx, [rbp - 0x5f]
movzx r8d, byte [0x1402b64a8]
test al, al
je 0x140178114
cmp al, r8b
je 0x140178114
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140178104
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140178171
movzx eax, byte [rcx]
test al, al
je 0x140178136
sub al, 0x45
test al, 0xdf
je 0x140178136
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140178125
movzx eax, byte [rcx - 1]
mov rdi, rcx
dec rcx
cmp al, 0x30
jne 0x14017814f
movzx eax, byte [rcx - 1]
dec rcx
cmp al, 0x30
je 0x140178144
cmp al, r8b
lea rdx, [rcx - 1]
cmovne rdx, rcx
nop word [rax + rax]
movzx eax, byte [rdi]
lea rdx, [rdx + 1]
mov byte [rdx], al
lea rdi, [rdi + 1]
test al, al
jne 0x140178160
lea rax, [rbp - 0x5f]
mov r14, 0xffffffffffffffff
nop dword [rax]
inc r14
cmp byte [rax + r14], r12b
jne 0x140178180
cmp byte [rbp - 0x5f], 0x2d
jne 0x1401781a2
dec r14d
lea r15, [rbp - 0x5e]
xor ecx, ecx
mov r12d, 1
jmp 0x1401781b3
bt r9d, 0x11
mov eax, 2
mov rcx, r12
cmovb r12d, eax
mov eax, r9d
and eax, 0x13000
cmp eax, 0x10000
jne 0x14017836e
movzx eax, byte [r15]
mov rsi, r15
sub al, 0x30
mov qword [rsp + 0x48], r15
cmp al, 0xa
jae 0x1401781ed
nop dword [rax]
movzx eax, byte [rsi + 1]
inc rsi
sub al, 0x30
cmp al, 0xa
jb 0x1401781e0
mov r13d, esi
sub r13d, r15d
lea edi, [r13 + 2]
je 0x140178208
mov eax, 0xaaaaaaab
mul edi
mov eax, edx
shr eax, 1
dec eax
jmp 0x14017820a
mov eax, ecx
mov r8, qword [rsp + 0x38]
lea ecx, [rax + r14]
add ecx, ecx
mov dword [rsp + 0x50], eax
test r12d, r12d
lea eax, [rcx + 2]
cmove eax, ecx
mov rcx, qword [rsp + 0x40]
add rcx, rax
cmp r8, rcx
jae 0x1401782ba
lea rax, [r8 + r8]
mov rdx, rcx
cmp rax, rcx
cmovae rdx, rax
mov qword [rsp + 0x38], rdx
lea rcx, [rdx + 0x12]
mov rdx, qword [0x1402bfcf8]
call sym.SystemInformer.exe_PhCreateObject
mov r8, qword [rsp + 0x38]
xor edx, edx
mov rbx, rax
mov qword [rax], r8
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + r8], dx
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
mov rcx, qword [rax + 8]
mov rdx, qword [rdx + 8]
call fcn.1401e3aa0
mov rcx, qword [rsp + 0x30]
mov edx, 0xffffffff
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x1401782a5
nop
call fcn.14013d2a0
mov rcx, qword [rsp + 0x40]
mov rax, qword [rbx + 8]
shr rcx, 1
mov qword [rsp + 0x30], rbx
lea rbx, [rax + rcx*2]
mov eax, 0xaaaaaaab
mov ecx, r13d
mul edi
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
test r12b, 1
je 0x1401782d8
mov word [rbx], 0x2d
jmp 0x1401782e3
test r12b, 2
je 0x1401782e7
mov word [rbx], 0x2b
add rbx, 2
test r13d, r13d
je 0x140178330
nop dword [rax]
movsx eax, byte [r15]
dec ecx
mov word [rbx], ax
inc r15
mov eax, edi
add rbx, 2
dec edi
test eax, eax
jne 0x14017832c
test ecx, ecx
je 0x140178330
movzx eax, word [0x1402b75d4]
dec ecx
mov word [rbx], ax
mov edi, 1
movsx eax, byte [r15]
mov word [rbx + 2], ax
add rbx, 4
inc r15
test ecx, ecx
jne 0x1401782f0
mov r15, qword [rsp + 0x40]
test r12d, r12d
je 0x14017833e
add r15, 2
sub r14d, r13d
mov r8, rbx
mov edx, r14d
mov rcx, rsi
mov edi, r14d
call sym.SystemInformer.exe_PhZeroExtendToUtf16Buffer
mov ecx, dword [rsp + 0x50]
lea rbx, [rbx + r14*2]
mov r14, qword [rsp + 0x58]
add ecx, r13d
add rcx, rdi
lea r15, [r15 + rcx*2]
jmp 0x140178967
test r12d, r12d
mov rdx, rcx
setne dl
mov rcx, rdx
bt r9d, 0x12
jae 0x1401783ad
mov rax, qword [rsp + 0x58]
mov edi, r14d
movzx r8d, word [rax + 6]
lea rax, [rdi + rdx]
cmp rax, r8
jae 0x1401783ad
mov ecx, r8d
or r12d, 4
sub rcx, rdi
mov rax, rcx
sub rax, rdx
mov qword [rsp + 0x78], rax
mov r13, qword [rsp + 0x40]
mov r8, qword [rsp + 0x38]
mov r14d, r14d
lea rax, [r14 + rcx]
lea rsi, [rax*2]
add rsi, r13
cmp r8, rsi
jae 0x140178442
mov rdx, qword [0x1402bfcf8]
lea rax, [r8 + r8]
cmp rax, rsi
mov rbx, rsi
cmovae rbx, rax
mov qword [rsp + 0x38], rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor edx, edx
mov r8, r13
mov rdi, rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rbx], dx
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
call fcn.1401e3aa0
lea rcx, [rbx - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140178432
call fcn.14013d2a0
mov rax, qword [rdi + 8]
shr r13, 1
mov qword [rsp + 0x30], rdi
lea rbx, [rax + r13*2]
test r12b, 1
je 0x14017844f
mov word [rbx], 0x2d
jmp 0x14017845a
test r12b, 2
je 0x14017845e
mov word [rbx], 0x2b
add rbx, 2
nop
test r12b, 4
je 0x140178485
mov rdx, qword [rsp + 0x78]
test rdx, rdx
je 0x140178481
mov eax, 0x30
mov rdi, rbx
movzx eax, ax
mov rcx, rdx
rep stosw word [rdi], ax
lea rbx, [rbx + rdx*2]
mov r8, rbx
mov rdx, r14
mov rcx, r15
call sym.SystemInformer.exe_PhZeroExtendToUtf16Buffer
lea rbx, [rbx + r14*2]
mov qword [rsp + 0x40], rsi
mov r14, qword [rsp + 0x58]
mov r15, rsi
jmp case.default.0x140177882
mov rdx, qword [r14 + 0x10]
xorps xmm0, xmm0
test rdx, rdx
js 0x1401784bc
cvtsi2sd xmm0, rdx
jmp 0x1401784d4
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2sd xmm0, rcx
addsd xmm0, xmm0
test rdx, rdx
jne 0x140178570
lea rsi, [r15 + 2]
cmp rdi, rsi
jae 0x14017855a
mov rdx, qword [0x1402bfcf8]
lea rax, [rdi + rdi]
cmp rax, rsi
mov rbx, rsi
cmovae rbx, rax
mov qword [rsp + 0x38], rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor edx, edx
mov r8, r15
mov rdi, rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rbx], dx
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
call fcn.1401e3aa0
lea rcx, [rbx - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14017854a
call fcn.14013d2a0
mov rax, qword [rdi + 8]
shr r15, 1
mov qword [rsp + 0x30], rdi
lea rbx, [rax + r15*2]
mov word [rbx], 0x30
mov r15, rsi
add rbx, 2
mov qword [rsp + 0x40], rsi
jmp case.default.0x140177882
bt r13d, 8
jae 0x14017857e
movzx eax, byte [r14 + 0xa]
jmp 0x140178584
mov eax, dword [0x1402bcf8c]
comisd xmm0, xmm6
jb 0x1401785a8
nop word [rax + rax]
cmp r12d, 7
jae 0x1401785a8
cmp r12d, eax
jae 0x1401785a8
mulsd xmm0, xmm7
inc r12d
comisd xmm0, xmm6
jae 0x140178590
test r13b, 0x40
je 0x1401785b5
movzx eax, word [r14 + 4]
jmp 0x1401785ba
mov eax, 2
movzx r8d, ax
lea r14, [rbp - 0x5f]
cmp r8d, r9d
mov dword [rsp + 0x50], r11d
mov edx, 0x1804b
cmova r8d, r9d
lea r9, [rbp - 0x5f]
call fcn.1401cdb80
movzx r8d, word [0x1402b64a8]
test al, al
jne 0x1401785ef
xor dl, dl
mov byte [rbp - 0x5f], dl
jmp 0x140178620
cmp qword [0x1402c3450], 0
movzx edx, byte [rbp - 0x5f]
je 0x140178620
lea rcx, [rbp - 0x5f]
test dl, dl
je 0x140178620
movzx eax, dl
cmp al, 0x2e
je 0x140178619
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140178608
jmp 0x140178620
mov byte [rcx], r8b
movzx edx, byte [rbp - 0x5f]
lea rcx, [rbp - 0x5f]
test dl, dl
je 0x140178644
movzx eax, dl
nop dword [rax + rax]
cmp al, r8b
je 0x140178644
movzx eax, byte ds:[rcx + 1]
inc rcx
test al, al
jne 0x140178630
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1401786a8
movzx eax, byte [rcx]
test al, al
je 0x140178666
sub al, 0x45
test al, 0xdf
je 0x140178666
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140178655
movzx eax, byte [rcx - 1]
mov rdi, rcx
dec rcx
cmp al, 0x30
jne 0x14017867f
movzx eax, byte [rcx - 1]
dec rcx
cmp al, 0x30
je 0x140178674
cmp al, r8b
lea rdx, [rcx - 1]
cmovne rdx, rcx
nop word [rax + rax]
movzx eax, byte ds:[rdi]
lea rdx, [rdx + 1]
mov byte [rdx], al
lea rdi, [rdi + 1]
test al, al
jne 0x140178690
movzx edx, byte [rbp - 0x5f]
lea rax, [rbp - 0x5f]
mov r15, 0xffffffffffffffff
inc r15
cmp byte [rax + r15], 0
jne 0x1401786b3
nop dword [rax]
cmp dl, 0x2d
jne 0x1401786dd
movzx edx, byte [rbp - 0x5e]
lea r14, [rbp - 0x5e]
mov r9d, 1
dec r15d
mov dword [rsp + 0x50], r9d
jmp 0x1401786e2
mov r9d, dword [rsp + 0x50]
sub dl, 0x30
mov qword [rsp + 0x48], r14
mov rsi, r14
cmp dl, 0xa
jae 0x1401786ff
movzx eax, byte [rsi + 1]
inc rsi
sub al, 0x30
cmp al, 0xa
jb 0x1401786f2
mov r8d, esi
sub r8d, r14d
mov dword [rsp + 0x48], r8d
lea edi, [r8 + 2]
je 0x140178722
mov eax, 0xaaaaaaab
mul edi
mov r13d, edx
shr r13d, 1
dec r13d
jmp 0x140178727
xor eax, eax
mov r13d, eax
mov r10, qword [rsp + 0x40]
lea ecx, [r15 + r13]
add ecx, ecx
test r9d, r9d
lea eax, [rcx + 2]
cmove eax, ecx
mov ecx, eax
mov rax, qword [rsp + 0x38]
add rcx, r10
cmp rax, rcx
jae 0x1401787e7
add rax, rax
mov rdx, rcx
cmp rax, rcx
cmovae rdx, rax
mov qword [rsp + 0x38], rdx
lea rcx, [rdx + 0x12]
mov rdx, qword [0x1402bfcf8]
call sym.SystemInformer.exe_PhCreateObject
mov r8, qword ds:[rsp + 0x40]
mov rbx, rax
mov rax, qword [rsp + 0x38]
lea rcx, [rbx + 0x10]
xor edx, edx
mov qword [rbx], rax
mov qword [rbx + 8], rcx
mov word [rax + rcx], dx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rbx + 8]
mov rdx, qword [rax + 8]
call fcn.1401e3aa0
mov rcx, qword [rsp + 0x30]
mov edx, 0xffffffff
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x1401787c5
nop dword [rax]
call fcn.14013d2a0
mov r10, qword [rsp + 0x40]
mov rax, qword [rbx + 8]
mov rcx, r10
mov r8d, dword [rsp + 0x48]
mov r9d, dword [rsp + 0x50]
shr rcx, 1
mov qword [rsp + 0x30], rbx
lea rbx, [rax + rcx*2]
mov eax, 0xaaaaaaab
mov ecx, r8d
mul edi
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
test r9d, r9d
je 0x140178806
mov word [rbx], 0x2d
add rbx, 2
test r8d, r8d
je 0x140178850
nop dword [rax + rax]
movsx eax, byte [r14]
dec ecx
mov word [rbx], ax
inc r14
mov eax, edi
add rbx, 2
dec edi
test eax, eax
jne 0x14017884c
test ecx, ecx
je 0x140178850
movzx eax, word [0x1402b75d4]
dec ecx
mov word [rbx], ax
mov edi, 1
movsx eax, byte [r14]
mov word [rbx + 2], ax
add rbx, 4
inc r14
test ecx, ecx
jne 0x140178810
test r9d, r9d
je 0x14017885e
add r10, 2
mov qword [rsp + 0x40], r10
sub r15d, r8d
mov rcx, rsi
mov edx, r15d
mov r8, rbx
mov edi, r15d
call sym.SystemInformer.exe_PhZeroExtendToUtf16Buffer
mov ecx, dword [rsp + 0x48]
lea rbx, [rbx + r15*2]
mov rax, qword [rsp + 0x40]
lea r15, [0x140000000]
mov r8, qword [rsp + 0x38]
add ecx, r13d
add rcx, rdi
mov r14d, r12d
add r14, r14
lea rsi, [rax + rcx*2]
mov rcx, qword [r15 + r14*8 + 0x2bc110]
lea rax, [rsi + 2]
add rax, rcx
cmp r8, rax
jae 0x14017892a
mov rdx, qword [0x1402bfcf8]
lea rbx, [rcx + 2]
lea rax, [r8 + r8]
add rbx, rsi
cmp rax, rbx
cmovae rbx, rax
mov qword [rsp + 0x38], rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov rdi, rax
mov r8, rsi
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
xor eax, eax
mov word [rbx + rcx], ax
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rdi + 8]
mov rdx, qword [rbx + 8]
call fcn.1401e3aa0
lea rcx, [rbx - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140178917
call fcn.14013d2a0
mov rax, qword [rdi + 8]
mov rcx, rsi
shr rcx, 1
mov qword [rsp + 0x30], rdi
lea rbx, [rax + rcx*2]
mov word [rbx], 0x20
lea rcx, [rbx + 2]
mov r8, qword [r15 + r14*8 + 0x2bc110]
mov rdx, qword [r15 + r14*8 + 0x2bc118]
call fcn.1401e3aa0
mov rcx, qword [r15 + r14*8 + 0x2bc110]
mov r14, qword [rsp + 0x58]
lea rax, [rcx + 2]
shr rax, 1
lea r15, [rcx + 2]
add r15, rsi
lea rbx, [rbx + rax*2]
mov qword [rsp + 0x40], r15
mov rdi, r15
sub rdi, qword [rbp - 0x80]
test dword [r14], 0xc0000000
je 0x140178a9d
movzx esi, word [r14 + 6]
add rsi, rsi
cmp rdi, rsi
jae 0x140178a9d
mov r12, qword [rsp + 0x38]
sub rsi, rdi
lea r13, [rsi + r15]
cmp r12, r13
jae 0x140178a20
mov rdx, qword [0x1402bfcf8]
lea rax, [r12 + r12]
cmp rax, r13
mov r12, r13
cmovae r12, rax
mov qword [rsp + 0x38], r12
lea rcx, [r12 + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov rbx, rax
mov r8, r15
mov qword [rax], r12
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
xor eax, eax
mov word [r12 + rcx], ax
mov r12, qword [rsp + 0x30]
mov rcx, qword [rbx + 8]
mov rdx, qword [r12 + 8]
call fcn.1401e3aa0
lea rcx, [r12 - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140178a10
call fcn.14013d2a0
mov rax, qword [rbx + 8]
shr r15, 1
mov qword [rsp + 0x30], rbx
lea rbx, [rax + r15*2]
mov eax, dword [r14]
test al, al
jns 0x140178a2e
movzx r12d, word [r14 + 8]
jmp 0x140178a34
mov r12d, 0x20
shr rsi, 1
test eax, eax
jns 0x140178a58
nop dword [rax + rax]
test rsi, rsi
je 0x140178a52
movzx eax, r12w
mov rdi, rbx
mov rcx, rsi
rep stosw word [rdi], ax
lea r14, [rsi + rsi]
jmp 0x140178a92
lfence
mov rax, rdi
lea r14, [rsi + rsi]
shr rax, 1
mov r15, rbx
add rax, rax
mov r8, rdi
sub r15, rax
mov rdx, r15
lea rcx, [r15 + r14]
call fcn.1401e3aa0
nop dword [rax]
test rsi, rsi
je 0x140178a92
movzx eax, r12w
mov rdi, r15
mov rcx, rsi
rep stosw word [rdi], ax
add rbx, r14
mov qword [rsp + 0x40], r13
mov r15, r13
mov esi, dword ds:[rsp + 0x70]
lea r8, [0x140000000]
mov rdi, qword [rsp + 0x38]
mov r10d, 1
mov r12, qword [rbp - 0x78]
mov r9d, 0xa2
test esi, esi
jne 0x140177840
movaps xmm7, xmmword [rsp + 0x4b0]
movaps xmm6, xmmword [rsp + 0x4c0]
mov r14, qword [rsp + 0x4d0]
mov r13, qword [rsp + 0x518]
mov r11, qword [rsp + 0x30]
mov rcx, qword [r11 + 8]
mov qword [r11], r15
shr r15, 1
xor eax, eax
mov word [rcx + r15*2], ax
mov rax, r11
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.1401dd6a0
add rsp, 0x4d8
pop r15
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret