Function at 0x50e8a0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x4b4
mov eax, dword [0x62f040]
xor eax, esp
mov dword [esp + 0x4b0], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
push ebx
mov dword [esp + 0x84], eax
mov ebx, ecx
xor eax, eax
mov dword [esp + 0x80], ecx
test ecx, ecx
mov dword [esp + 0x44], ebx
push esi
sete cl
mov dword [esp + 0x38], eax
test byte [0x632ce4], 1
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x6c], edi
mov byte [esp + 0x3b], cl
jne 0x50e9c1
mov esi, 0x632ce4
lock bts dword [esi], 0x1f
setb al
test al, al
jne 0x50e9a9
push 4
lea eax, [esp + 0xb4]
push eax
push 0xe
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x50e948
mov ax, word [esp + 0xb0]
test ax, ax
je 0x50e948
cmp word [esp + 0xb2], 0
jne 0x50e948
mov word [0x63049c], ax
push 4
lea eax, [esp + 0xb4]
push eax
push 0xf
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
nop
test eax, eax
je 0x50e982
mov ax, word [esp + 0xb0]
test ax, ax
je 0x50e982
cmp word [esp + 0xb2], 0
jne 0x50e982
mov word [0x630698], ax
cmp word [0x63049c], 0x2e
je 0x50e9a0
push 0x5ccc90
push 0
call fcn.0058b5ab
add esp, 8
mov dword [0x637c20], eax
mov ecx, esi
call sym.SystemInformer.exe_PhfEndInitOnce
jmp 0x50e9bb
test byte [0x632ce4], 1
jne 0x50e9bf
xor edx, edx
mov ecx, esi
call sym.SystemInformer.exe_PhfWaitForEvent
mov cl, byte [esp + 0x3b]
xor eax, eax
cmp dword [ebp + 0xc], 0
mov esi, dword [ebp + 0x14]
je 0x50fcd3
fld qword [0x61ec00]
fst qword [esp + 0xa0]
fld qword [0x61eb90]
mov byte [esp + 0x3b], cl
mov ecx, dword [ebp + 0xc]
fst qword [esp + 0xa8]
mov dword [esp + 0x70], 3
dec ecx
mov dword [esp + 0xb0], eax
mov eax, dword [edi]
mov edx, edi
mov dword [ebp + 0xc], ecx
mov ecx, dword [esp + 0x6c]
add dword [esp + 0x6c], 0x18
mov dword [esp + 0x5c], eax
and eax, 0x3f
mov dword [esp + 0x68], edi
mov dword [esp + 0x40], 0
cmp eax, 0xd
ja case.default.0x50ea2b
jmp dword [eax*4 + 0x50fd34]
cmp byte ds:[esp + 0x3b], 0
fstp st(1)
fstp st(0)
jne 0x50f91b
mov eax, dword [esp + 0x3c]
add eax, 2
cmp esi, eax
jae 0x50ea6d
mov eax, dword [esp + 0x3c]
add ebx, 2
add eax, 2
mov byte [esp + 0x3b], 1
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x3c], eax
jmp 0x50fbe1
mov ax, word [edi + 0x10]
jmp 0x50f918
cmp byte ds:[esp + 0x3b], 0
fstp st(1)
fstp st(0)
jne 0x50eabb
mov eax, dword [esp + 0x3c]
mov ecx, dword [edi + 0x10]
add eax, ecx
cmp esi, eax
jae 0x50eaae
mov eax, ecx
mov byte [esp + 0x3b], 1
shr eax, 1
lea ebx, [ebx + eax*2]
mov eax, dword [esp + 0x3c]
add eax, ecx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x3c], eax
jmp 0x50fbe1
push ecx
push dword [edi + 0x14]
push ebx
call fcn.00582850
add esp, 0xc
mov eax, dword [edi + 0x10]
shr eax, 1
lea ebx, [ebx + eax*2]
mov eax, dword [esp + 0x3c]
add eax, dword [edi + 0x10]
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x3c], eax
jmp 0x50fbe1
push dword ds:[edi + 0x10]
fstp st(1)
fstp st(0)
call sym.SystemInformer.exe_PhCountStringZ
cmp byte [esp + 0x3b], 0
mov esi, eax
jne 0x50eb21
mov ecx, dword [esp + 0x3c]
lea edx, [esi + esi]
add ecx, edx
cmp dword [ebp + 0x14], ecx
jae 0x50eb14
lea ebx, [ebx + esi*2]
mov byte [esp + 0x3b], 1
lea eax, [esi + esi]
mov dword [esp + 0x4c], ebx
add dword [esp + 0x3c], eax
jmp 0x50fbdd
push edx
push dword [edi + 0x10]
push ebx
call fcn.00582850
add esp, 0xc
lea ebx, [ebx + esi*2]
lea eax, [esi + esi]
mov dword [esp + 0x4c], ebx
add dword [esp + 0x3c], eax
jmp 0x50fbdd
cmp dword [esp + 0x5c], 3
fstp st(1)
fstp st(0)
jne 0x50eb47
mov edi, dword [edi + 0x14]
mov esi, dword [ecx + 0x10]
jmp 0x50eb59
mov edi, dword [ecx + 0x10]
mov esi, edi
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x50eb50
sub esi, ecx
push esi
push edi
lea eax, [esp + 0x7c]
push eax
call dword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeSize]
test eax, eax
js 0x50fbdd
cmp byte [esp + 0x3b], 0
jne 0x50ebbc
mov eax, dword ds:[esp + 0x3c]
mov ecx, dword [esp + 0x74]
add eax, ecx
cmp dword [ebp + 0x14], eax
jae 0x50eba5
mov eax, ecx
mov byte [esp + 0x3b], 1
shr eax, 1
lea ebx, [ebx + eax*2]
mov eax, dword [esp + 0x3c]
add eax, ecx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x3c], eax
jmp 0x50fbe1
push esi
push edi
push 0
push ecx
push ebx
lfence
call dword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
test eax, eax
js 0x50fbdd
mov ecx, dword [esp + 0x74]
mov eax, ecx
shr eax, 1
lea ebx, [ebx + eax*2]
mov eax, dword [esp + 0x3c]
add eax, ecx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x3c], eax
jmp 0x50fbe1
mov eax, dword [edx + 0x10]
mov ecx, eax
cdq
mov esi, eax
shr ecx, 0x1f
xor esi, edx
mov dword [esp + 0x40], ecx
sub esi, edx
jmp 0x50ebf2
mov esi, dword [edi + 0x10]
fstp st(1)
fstp st(0)
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x54], 0xa
test edx, 0x100
je 0x50ec1c
mov cl, byte [edi + 0xa]
mov al, cl
sub al, 2
cmp al, 0x43
ja 0x50ec1c
movzx eax, cl
mov dword [esp + 0x54], eax
test edx, 0x20000000
mov ecx, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
mov eax, 0x619b10
cmovne eax, ecx
xor edi, edi
mov dword [esp + 0x60], eax
lea ecx, [esp + 0x4b6]
test esi, esi
je 0x50ecea
test edx, 0x10000
je 0x50ecc6
xor eax, eax
mov dword [esp + 0x58], eax
mov eax, esi
xor edx, edx
div dword [esp + 0x54]
inc edi
mov esi, eax
mov dword [esp + 0x44], edi
mov eax, dword [esp + 0x60]
movsx ax, byte [eax + edx]
mov word [ecx], ax
sub ecx, 2
mov eax, dword [esp + 0x58]
inc eax
mov dword [esp + 0x58], eax
cmp eax, 3
jne 0x50ecbf
test esi, esi
je 0x50ed07
movzx eax, word [0x630698]
xor edx, edx
mov word [ecx], ax
mov eax, esi
div dword [esp + 0x54]
mov dword [esp + 0x58], 1
mov esi, eax
mov eax, dword [esp + 0x60]
movsx eax, byte [eax + edx]
mov word [ecx - 2], ax
add ecx, 0xfffffffc
add edi, 2
mov dword [esp + 0x44], edi
nop
test esi, esi
jne 0x50ec56
jmp 0x50ed07
mov ebx, eax
mov eax, esi
xor edx, edx
div dword [esp + 0x54]
inc edi
mov esi, eax
movsx ax, byte [ebx + edx]
mov word [ecx], ax
sub ecx, 2
test esi, esi
jne 0x50ecc8
mov ebx, dword [esp + 0x4c]
jmp 0x50ed03
mov eax, 0x30
lea ecx, [esp + 0x4b4]
mov word [esp + 0x4b6], ax
mov edi, 1
mov dword [esp + 0x44], edi
mov esi, dword [esp + 0x5c]
xor edx, edx
cmp dword [esp + 0x40], edx
je 0x50ed1a
mov edx, 1
jmp 0x50ed28
test esi, 0x20000
mov eax, 1
cmovne edx, eax
mov eax, esi
mov dword [esp + 0x54], edx
and eax, 0x50000
cmp eax, 0x40000
jne 0x50ed63
mov eax, dword [esp + 0x68]
movzx esi, word [eax + 6]
lea eax, [edx + edi]
cmp eax, esi
jae 0x50ed5f
or dword [esp + 0x40], 4
sub esi, edx
sub esi, edi
add edx, esi
mov dword [esp + 0x80], esi
mov dword [esp + 0x54], edx
mov esi, dword [esp + 0x5c]
add ecx, 2
cmp byte [esp + 0x3b], 0
mov dword [esp + 0x50], ecx
jne 0x50ee00
lea eax, ds:[edx + edi]
mov edx, dword [esp + 0x3c]
lea eax, [edx + eax*2]
cmp dword [ebp + 0x14], eax
jae 0x50ed9e
mov eax, dword [esp + 0x54]
mov ecx, edx
add eax, edi
mov byte [esp + 0x3b], 1
lea ecx, [ecx + eax*2]
mov dword [esp + 0x3c], ecx
jmp 0x50fbdd
mov eax, dword [esp + 0x40]
test al, 1
je 0x50edad
mov edx, 0x2d
jmp 0x50edba
test esi, 0x20000
je 0x50edc0
mov edx, 0x2b
mov word [ebx], dx
add ebx, 2
test al, 4
je 0x50edec
mov edx, dword [esp + 0x80]
test edx, edx
je 0x50ede9
mov ecx, edx
mov eax, 0x300030
shr ecx, 1
mov edi, ebx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov ecx, dword [esp + 0x50]
mov edi, dword [esp + 0x44]
lea ebx, [ebx + edx*2]
lea esi, [edi + edi]
push esi
push ecx
push ebx
call fcn.00582850
add esp, 0xc
add ebx, esi
mov dword [esp + 0x4c], ebx
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x3c]
add eax, edi
lea ecx, [ecx + eax*2]
mov dword [esp + 0x3c], ecx
jmp 0x50fbdd
mov eax, dword [edi + 0x14]
fstp st(1)
mov esi, dword [edi + 0x10]
fstp st(0)
mov dword [esp + 0x64], esi
mov dword [esp + 0x58], eax
test eax, eax
jg 0x50ee55
jl 0x50ee32
test esi, esi
jae 0x50ee55
neg esi
mov dword [esp + 0x40], 1
adc eax, 0
neg eax
jmp 0x50ee4d
mov esi, dword [edi + 0x10]
fstp st(1)
mov eax, dword [edi + 0x14]
fstp st(0)
mov dword [esp + 0x58], eax
mov dword [esp + 0x64], esi
mov edi, dword [esp + 0x5c]
mov dword [esp + 0x54], 0xa
mov dword [esp + 0x44], 0
test edi, 0x100
je 0x50ee9c
mov eax, dword [esp + 0x68]
mov dword [esp + 0x54], 0xa
mov dword [esp + 0x44], 0
mov cl, byte [eax + 0xa]
mov al, cl
sub al, 2
cmp al, 0x43
ja 0x50ee9c
movzx eax, cl
cdq
mov dword [esp + 0x54], eax
mov dword [esp + 0x44], edx
mov edx, dword [esp + 0x58]
test edi, 0x20000000
mov eax, 0x619b10
lea edi, [esp + 0x4b6]
mov ecx, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
cmovne eax, ecx
mov dword [esp + 0x50], eax
xor eax, eax
mov dword [esp + 0x60], eax
mov eax, esi
or eax, edx
je 0x50efcb
test dword [esp + 0x5c], 0x10000
je 0x50ef70
xor eax, eax
mov dword [esp + 0x48], eax
push dword [esp + 0x44]
push dword [esp + 0x58]
push edx
push esi
call fcn.005a0b40
push dword [esp + 0x44]
mov esi, eax
mov eax, dword [esp + 0x5c]
push dword [esp + 0x58]
push eax
mov eax, dword [esp + 0x70]
push eax
call fcn.005a0ad0
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x58], edx
movsx cx, byte [eax + esi]
mov eax, dword [esp + 0x48]
mov esi, dword [esp + 0x64]
inc eax
mov word [edi], cx
sub edi, 2
mov ecx, dword [esp + 0x60]
inc ecx
mov dword [esp + 0x60], ecx
cmp eax, 3
jne 0x50ef59
mov eax, esi
or eax, edx
je 0x50efe8
mov ax, word [0x630698]
mov word [edi], ax
sub edi, 2
inc ecx
mov dword [esp + 0x60], ecx
jmp 0x50eedc
mov dword [esp + 0x48], eax
mov eax, esi
or eax, edx
mov dword [esp + 0x60], ecx
jne 0x50eee2
jmp 0x50efe8
mov ebx, dword [esp + 0x54]
push dword ds:[esp + 0x44]
push ebx
push edx
push esi
call fcn.005a0b40
push dword [esp + 0x44]
mov esi, eax
mov eax, dword [esp + 0x5c]
push ebx
push eax
mov eax, dword [esp + 0x70]
push eax
call fcn.005a0ad0
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x64], eax
inc ecx
mov eax, dword [esp + 0x50]
mov dword [esp + 0x58], edx
mov dword [esp + 0x60], ecx
movsx ax, byte [eax + esi]
mov esi, dword [esp + 0x64]
mov word [edi], ax
mov eax, esi
sub edi, 2
or eax, edx
jne 0x50ef74
mov ebx, dword [esp + 0x4c]
jmp 0x50efe8
mov eax, 0x30
lea edi, [esp + 0x4b4]
mov ecx, 1
mov word [esp + 0x4b6], ax
mov dword [esp + 0x60], ecx
mov esi, dword [esp + 0x5c]
xor edx, edx
cmp dword [esp + 0x40], edx
je 0x50effb
mov edx, 1
jmp 0x50f009
test esi, 0x20000
mov eax, 1
cmovne edx, eax
mov eax, esi
mov dword [esp + 0x48], edx
and eax, 0x50000
cmp eax, 0x40000
jne 0x50f044
mov eax, dword [esp + 0x68]
movzx esi, word [eax + 6]
lea eax, [edx + ecx]
cmp eax, esi
jae 0x50f040
or dword [esp + 0x40], 4
sub esi, edx
sub esi, ecx
add edx, esi
mov dword [esp + 0x84], esi
mov dword [esp + 0x48], edx
mov esi, dword [esp + 0x5c]
add edi, 2
cmp byte [esp + 0x3b], 0
mov dword [esp + 0x50], edi
jne 0x50f0e7
lea eax, [edx + ecx]
mov edx, dword [esp + 0x3c]
lea eax, [edx + eax*2]
cmp dword [ebp + 0x14], eax
jae 0x50f085
mov eax, dword ds:[esp + 0x60]
mov ecx, edx
add eax, dword [esp + 0x48]
mov byte [esp + 0x3b], 1
lea ecx, [ecx + eax*2]
mov dword [esp + 0x3c], ecx
jmp 0x50fbdd
mov eax, dword [esp + 0x40]
test al, 1
je 0x50f094
mov edx, 0x2d
jmp 0x50f0a1
test esi, 0x20000
je 0x50f0a7
mov edx, 0x2b
mov word [ebx], dx
add ebx, 2
test al, 4
je 0x50f0d3
mov edx, dword [esp + 0x84]
test edx, edx
je 0x50f0d0
mov ecx, edx
mov eax, 0x300030
shr ecx, 1
mov edi, ebx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x50]
mov ecx, dword [esp + 0x60]
lea ebx, [ebx + edx*2]
lea esi, [ecx + ecx]
push esi
push edi
push ebx
call fcn.00582850
add esp, 0xc
add ebx, esi
mov dword [esp + 0x4c], ebx
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x3c]
add eax, dword [esp + 0x48]
lea ecx, [ecx + eax*2]
mov dword [esp + 0x3c], ecx
jmp 0x50fbdd
mov ecx, dword [esp + 0x5c]
fstp st(1)
mov dword [esp + 0x40], 0
fstp st(0)
test cl, 0x40
je 0x50f12f
movzx edx, word ds:[edi + 4]
cmp edx, 0xa2
jbe 0x50f134
mov edx, 0xa2
jmp 0x50f134
mov edx, 6
fld dword [edi + 0x10]
lea eax, [esp + 0xb9]
sub esp, 8
mov dword [esp + 0x50], eax
fstp dword [esp + 0x58]
fld dword [esp + 0x58]
push eax
push ecx
fstp dword [esp]
call fcn.00572660
test al, al
jne 0x50f167
mov byte [esp + 0xb9], al
jmp 0x50f1c8
mov edx, dword [0x637c20]
test edx, edx
je 0x50f199
mov al, byte ds:[esp + 0xb9]
lea ecx, [esp + 0xb9]
test al, al
je 0x50f199
cmp al, 0x2e
je 0x50f192
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x50f184
jmp 0x50f199
mov al, byte [0x63049c]
mov byte [ecx], al
test dword [esp + 0x5c], 0x20000000
je 0x50f1c8
lea eax, [esp + 0xb9]
test edx, edx
je 0x50f1ba
push edx
push eax
call fcn.0058ad56
add esp, 8
jmp 0x50f1c8
push eax
call fcn.0058acfa
add esp, 4
mov edi, dword [edi]
test edi, 0x8000
je 0x50f24e
mov al, byte [esp + 0xb9]
lea ecx, [esp + 0xb9]
mov ah, byte [0x63049c]
test al, al
je 0x50f1fc
mov edi, edi
cmp al, ah
je 0x50f1fc
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x50f1f0
mov al, byte ds:[ecx]
inc ecx
test al, al
je 0x50f24e
mov dl, byte [ecx]
test dl, dl
je 0x50f224
mov al, dl
lea esp, [esp]
cmp dl, 0x65
je 0x50f224
cmp al, 0x45
je 0x50f224
mov al, byte ds:[ecx + 1]
inc ecx
mov dl, al
test al, al
jne 0x50f210
mov al, byte [ecx - 1]
mov esi, ecx
dec ecx
cmp al, 0x30
jne 0x50f238
mov edi, edi
mov al, byte [ecx - 1]
dec ecx
cmp al, 0x30
je 0x50f230
cmp al, ah
lea edx, [ecx - 1]
cmovne edx, ecx
mov al, byte [esi]
lea edx, [edx + 1]
mov byte [edx], al
lea esi, [esi + 1]
test al, al
jne 0x50f240
lea esi, [esp + 0xb9]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x50f258
sub esi, ecx
cmp byte [esp + 0xb9], 0x2d
mov dword [esp + 0x50], esi
jne 0x50f289
lea edx, [esp + 0xba]
mov dword [esp + 0x40], 1
dec esi
mov dword [esp + 0x48], edx
mov dword [esp + 0x50], esi
jmp 0x50f2a3
mov ecx, dword [esp + 0x40]
test edi, 0x20000
mov edx, dword [esp + 0x48]
mov eax, 2
cmovne ecx, eax
mov dword [esp + 0x40], ecx
mov eax, edi
and eax, 0x13000
cmp eax, 0x10000
jne 0x50f405
mov al, byte [edx]
mov edi, edx
sub al, 0x30
cmp al, 0xa
jae 0x50f2ca
nop
mov al, byte [edi + 1]
inc edi
sub al, 0x30
cmp al, 0xa
jb 0x50f2c0
mov eax, edi
sub eax, edx
mov dword [esp + 0x44], eax
lea edx, [eax + 2]
mov dword [esp + 0x58], edx
je 0x50f2ed
mov eax, 0xaaaaaaab
mul edx
mov eax, edx
mov edx, dword [esp + 0x58]
shr eax, 1
dec eax
jmp 0x50f2ef
xor eax, eax
lea ecx, [eax + esi]
mov dword [esp + 0x54], eax
add ecx, ecx
cmp byte [esp + 0x3b], 0
jne 0x50f325
cmp dword [esp + 0x40], 0
lea eax, [ecx + 2]
cmove eax, ecx
mov ecx, dword [esp + 0x3c]
add eax, ecx
cmp dword [ebp + 0x14], eax
jae 0x50f325
mov eax, dword ds:[esp + 0x44]
mov dl, 1
mov byte [esp + 0x3b], dl
jmp 0x50f3bb
mov ecx, dword [esp + 0x44]
mov eax, edx
xor edx, edx
div dword [esp + 0x70]
cmp byte [esp + 0x3b], 0
jne 0x50f3af
mov eax, dword [esp + 0x40]
test al, 1
je 0x50f34b
mov eax, 0x2d
jmp 0x50f354
test al, 2
je 0x50f35e
mov eax, 0x2b
mov word [ebx], ax
add ebx, 2
mov dword [esp + 0x4c], ebx
mov eax, dword [esp + 0x44]
test eax, eax
je 0x50f3b3
mov esi, dword [esp + 0x48]
lea ebx, [ebx]
movsx ax, byte ds:[esi]
dec ecx
inc esi
mov word [ebx], ax
mov eax, edx
add ebx, 2
dec edx
test eax, eax
jne 0x50f3a3
test ecx, ecx
je 0x50f3a7
movzx eax, word [0x630698]
dec ecx
mov word [ebx], ax
mov edx, 1
movsx eax, byte [esi]
mov word [ebx + 2], ax
add ebx, 4
inc esi
test ecx, ecx
jne 0x50f370
mov esi, dword [esp + 0x50]
mov dword [esp + 0x4c], ebx
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x3c]
mov dl, byte [esp + 0x3b]
cmp dword [esp + 0x40], 0
je 0x50f3c9
add ecx, 2
mov dword [esp + 0x3c], ecx
add eax, dword ds:[esp + 0x54]
mov ecx, dword [esp + 0x3c]
sub esi, dword [esp + 0x44]
lea ecx, [ecx + eax*2]
mov dword [esp + 0x3c], ecx
test dl, dl
jne 0x50fbdd
push ebx
push esi
push edi
call sym.SystemInformer.exe_PhZeroExtendToUtf16Buffer
lea ebx, ds:[ebx + esi*2]
lea eax, [esi + esi]
mov dword [esp + 0x4c], ebx
add dword [esp + 0x3c], eax
jmp 0x50fbdd
mov eax, dword ds:[esp + 0x68]
xor ecx, ecx
cmp dword [esp + 0x40], ecx
setne cl
test dword [eax], 0x40000
mov edi, ecx
mov dword [esp + 0x48], edi
je 0x50f44f
movzx eax, word [eax + 6]
mov dword [esp + 0x50], eax
lea eax, [ecx + esi]
mov dword [esp + 0x48], edi
cmp eax, dword [esp + 0x50]
jae 0x50f44f
mov eax, dword [esp + 0x50]
or dword [esp + 0x40], 4
sub eax, ecx
sub eax, esi
mov dword [esp + 0x78], eax
lea edi, [ecx + eax]
mov dword [esp + 0x48], edi
cmp byte [esp + 0x3b], 0
jne 0x50f4dc
mov ecx, dword [esp + 0x3c]
lea eax, [edi + esi]
lea eax, [ecx + eax*2]
cmp dword [ebp + 0x14], eax
jae 0x50f47c
mov eax, ecx
mov byte [esp + 0x3b], 1
lea eax, [eax + edi*2]
mov dword [esp + 0x3c], eax
jmp 0x50fbe1
mov eax, dword [esp + 0x40]
test al, 1
je 0x50f48b
mov ecx, 0x2d
jmp 0x50f494
test al, 2
je 0x50f49e
mov ecx, 0x2b
mov word [ebx], cx
add ebx, 2
mov dword [esp + 0x4c], ebx
mov edi, edi
test al, 4
je 0x50f4dc
mov eax, dword [esp + 0x78]
test eax, eax
je 0x50f4c6
mov ecx, eax
mov edi, ebx
shr ecx, 1
mov eax, 0x300030
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x48]
mov eax, dword [esp + 0x78]
lea ebx, [ebx + eax*2]
mov eax, dword [esp + 0x3c]
push ebx
push esi
push edx
lea eax, [eax + edi*2]
mov dword [esp + 0x48], eax
jmp 0x50f3eb
cmp byte [esp + 0x3b], 0
mov eax, dword [esp + 0x3c]
lea eax, [eax + edi*2]
mov dword [esp + 0x3c], eax
jne 0x50fbe1
push ebx
push esi
push edx
jmp 0x50f3eb
mov ecx, dword [esp + 0x5c]
fstp st(1)
mov dword [esp + 0x40], 0
fstp st(0)
test cl, 0x40
je 0x50f522
movzx edx, word [edi + 4]
cmp edx, 0xa2
jbe 0x50f527
mov edx, 0xa2
jmp 0x50f527
mov edx, 6
fld qword ds:[edi + 0x10]
lea eax, [esp + 0xb9]
sub esp, 0x10
mov dword [esp + 0x58], eax
fstp qword [esp + 8]
push eax
call fcn.00572900
test al, al
jne 0x50f555
mov byte [esp + 0xb9], al
jmp 0x50f5b3
mov edx, dword [0x637c20]
test edx, edx
je 0x50f586
mov al, byte [esp + 0xb9]
lea ecx, [esp + 0xb9]
test al, al
je 0x50f586
cmp al, 0x2e
je 0x50f57f
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x50f571
jmp 0x50f586
mov al, byte [0x63049c]
mov byte [ecx], al
test dword [esp + 0x5c], 0x20000000
je 0x50f5b3
lea eax, [esp + 0xb9]
test edx, edx
je 0x50f5aa
push edx
push eax
call fcn.0058ad56
add esp, 8
jmp 0x50f5b3
push eax
call fcn.0058acfa
add esp, 4
mov edi, dword ds:[edi]
test edi, 0x8000
je 0x50f644
mov al, byte [esp + 0xb9]
lea ecx, [esp + 0xb9]
mov ah, byte [0x63049c]
test al, al
je 0x50f5f0
cmp al, ah
je 0x50f5f0
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x50f5e4
mov al, byte [ecx]
inc ecx
test al, al
je 0x50f644
mov dl, byte ds:[ecx]
test dl, dl
je 0x50f619
mov al, dl
cmp dl, 0x65
je 0x50f619
cmp al, 0x45
je 0x50f619
mov al, byte [ecx + 1]
inc ecx
mov dl, al
test al, al
jne 0x50f606
mov al, byte ds:[ecx - 1]
mov esi, ecx
dec ecx
cmp al, 0x30
jne 0x50f62c
mov al, byte [ecx - 1]
dec ecx
cmp al, 0x30
je 0x50f624
cmp al, ah
lea edx, [ecx - 1]
cmovne edx, ecx
mov al, byte ds:[esi]
lea edx, [edx + 1]
mov byte [edx], al
lea esi, [esi + 1]
test al, al
jne 0x50f634
lea esi, [esp + 0xb9]
lea ecx, [esi + 1]
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x50f650
sub esi, ecx
cmp byte [esp + 0xb9], 0x2d
mov dword [esp + 0x50], esi
jne 0x50f682
lea edx, ds:[esp + 0xba]
mov dword [esp + 0x40], 1
dec esi
mov dword [esp + 0x48], edx
mov dword [esp + 0x50], esi
jmp 0x50f69c
mov ecx, dword [esp + 0x40]
test edi, 0x20000
mov edx, dword [esp + 0x48]
mov eax, 2
cmovne ecx, eax
mov dword [esp + 0x40], ecx
mov eax, edi
and eax, 0x13000
cmp eax, 0x10000
jne 0x50f7b0
mov al, byte [edx]
mov edi, edx
sub al, 0x30
cmp al, 0xa
jae 0x50f6c4
mov al, byte ds:[edi + 1]
inc edi
sub al, 0x30
cmp al, 0xa
jb 0x50f6b8
mov eax, edi
sub eax, edx
mov dword [esp + 0x44], eax
lea edx, [eax + 2]
mov dword [esp + 0x58], edx
je 0x50f6e7
mov eax, 0xaaaaaaab
mul edx
mov eax, edx
mov edx, dword [esp + 0x58]
shr eax, 1
dec eax
jmp 0x50f6e9
xor eax, eax
lea ecx, [eax + esi]
mov dword [esp + 0x54], eax
add ecx, ecx
cmp byte [esp + 0x3b], 0
jne 0x50f71e
cmp dword [esp + 0x40], 0
lea eax, [ecx + 2]
cmove eax, ecx
mov ecx, dword [esp + 0x3c]
add eax, ecx
cmp dword [ebp + 0x14], eax
jae 0x50f71e
mov eax, dword [esp + 0x44]
mov dl, 1
mov byte [esp + 0x3b], dl
jmp 0x50f3bb
mov ecx, dword [esp + 0x44]
mov eax, edx
xor edx, edx
div dword [esp + 0x70]
cmp byte [esp + 0x3b], 0
jne 0x50f3af
mov eax, dword [esp + 0x40]
test al, 1
je 0x50f744
mov eax, 0x2d
jmp 0x50f74d
test al, 2
je 0x50f757
mov eax, 0x2b
mov word [ebx], ax
add ebx, 2
mov dword [esp + 0x4c], ebx
mov eax, dword ds:[esp + 0x44]
test eax, eax
je 0x50f3b3
mov esi, dword [esp + 0x48]
lea esp, [esp]
movsx ax, byte ds:[esi]
dec ecx
inc esi
mov word [ebx], ax
mov eax, edx
add ebx, 2
dec edx
test eax, eax
jne 0x50f7a7
test ecx, ecx
je 0x50f3a7
movzx eax, word [0x630698]
dec ecx
mov word [ebx], ax
mov edx, 1
movsx eax, byte [esi]
mov word [ebx + 2], ax
add ebx, 4
inc esi
test ecx, ecx
jne 0x50f770
jmp 0x50f3a7
mov eax, dword [esp + 0x68]
xor ecx, ecx
cmp dword [esp + 0x40], ecx
setne cl
test dword [eax], 0x40000
mov edi, ecx
mov dword [esp + 0x48], edi
je 0x50f7fe
movzx eax, word ds:[eax + 6]
mov dword [esp + 0x50], eax
lea eax, [ecx + esi]
mov dword [esp + 0x48], edi
cmp eax, dword [esp + 0x50]
jae 0x50f7fe
mov eax, dword [esp + 0x50]
or dword [esp + 0x40], 4
sub eax, ecx
sub eax, esi
mov dword [esp + 0x7c], eax
lea edi, [ecx + eax]
mov dword [esp + 0x48], edi
cmp byte [esp + 0x3b], 0
jne 0x50f4dc
mov ecx, dword [esp + 0x3c]
lea eax, [edi + esi]
lea eax, [ecx + eax*2]
cmp dword [ebp + 0x14], eax
jae 0x50f82b
mov eax, ecx
mov byte [esp + 0x3b], 1
lea eax, [eax + edi*2]
mov dword [esp + 0x3c], eax
jmp 0x50fbe1
mov eax, dword [esp + 0x40]
test al, 1
je 0x50f83a
mov ecx, 0x2d
jmp 0x50f843
test al, 2
je 0x50f84d
mov ecx, 0x2b
mov word [ebx], cx
add ebx, 2
mov dword [esp + 0x4c], ebx
test al, 4
je 0x50f4dc
mov eax, dword [esp + 0x7c]
test eax, eax
je 0x50f877
mov ecx, eax
mov edi, ebx
shr ecx, 1
mov eax, 0x300030
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x48]
mov eax, dword [esp + 0x7c]
lea ebx, [ebx + eax*2]
mov eax, dword [esp + 0x3c]
push ebx
push esi
push edx
lea eax, [eax + edi*2]
mov dword [esp + 0x48], eax
jmp 0x50f3eb
mov eax, dword [esp + 0x68]
xor edi, edi
mov dword [esp + 0x98], edi
mov esi, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
mov eax, edx
mov ecx, edx
mov dword [esp + 0x90], esi
and eax, 0x7fffffff
and ecx, 0x80000000
or esi, edx
mov dword [esp + 0x94], eax
fild qword [esp + 0x90]
mov dword [esp + 0x9c], ecx
fild qword [esp + 0x98]
fchs
faddp st(1)
jne 0x50f932
cmp byte [esp + 0x3b], 0
fstp st(0)
fstp st(1)
fstp st(0)
jne 0x50f91b
mov eax, dword [esp + 0x3c]
add eax, 2
cmp dword [ebp + 0x14], eax
jae 0x50f913
mov eax, dword [esp + 0x3c]
add ebx, 2
add eax, 2
mov byte [esp + 0x3b], 1
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x3c], eax
jmp 0x50fbe1
mov eax, 0x30
mov word [ebx], ax
mov eax, dword [esp + 0x3c]
add ebx, 2
add eax, 2
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x3c], eax
jmp 0x50fbe1
mov edx, dword ds:[esp + 0x5c]
mov esi, dword [esp + 0x68]
test edx, 0x100
je 0x50f94e
movzx ecx, byte [esi + 0xa]
jmp 0x50f954
mov ecx, dword [0x633948]
fcomi st(2)
jb 0x50f96b
cmp edi, 7
jae 0x50f96b
lea ecx, [ecx]
cmp edi, ecx
jae 0x50f96b
fmul st(1)
inc edi
fcomi st(2)
jae 0x50f958
fstp st(2)
fstp st(0)
test dl, 0x40
je 0x50f97a
movzx eax, word [esi + 4]
jmp 0x50f97f
mov eax, 2
movzx edx, ax
lea esi, [esp + 0xb9]
cmp edx, 0xa2
mov dword [esp + 0x54], 0
mov eax, 0xa2
mov ecx, 0x1804c
cmova edx, eax
sub esp, 0x10
mov eax, esi
fstp qword [esp + 8]
push eax
call fcn.00572900
test al, al
jne 0x50f9c5
mov byte ds:[esp + 0xb9], al
jmp 0x50f9f9
cmp dword [0x637c20], 0
je 0x50f9f9
mov al, byte ds:[esp + 0xb9]
lea ecx, [esp + 0xb9]
test al, al
je 0x50f9f9
cmp al, 0x2e
je 0x50f9f2
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x50f9e4
jmp 0x50f9f9
mov al, byte [0x63049c]
mov byte [ecx], al
lea ecx, [esp + 0xb9]
call fcn.0050cfa0
lea ecx, [esp + 0xb9]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x50fa10
sub ecx, edx
cmp byte [esp + 0xb9], 0x2d
mov dword [esp + 0x58], ecx
jne 0x50fa3b
dec ecx
mov dword [esp + 0x54], 1
lea esi, [esp + 0xba]
mov dword [esp + 0x58], ecx
mov al, byte [esi]
mov edx, esi
sub al, 0x30
mov dword [esp + 0x60], esi
cmp al, 0xa
jae 0x50fa5e
lea esp, [esp]
mov al, byte [edx + 1]
inc edx
sub al, 0x30
cmp al, 0xa
jb 0x50fa50
mov dword [esp + 0x60], edx
sub edx, esi
mov dword [esp + 0x44], edx
lea edx, [edx + 2]
mov dword [esp + 0x50], edx
je 0x50fa7b
mov eax, 0xaaaaaaab
mul edx
mov eax, edx
shr eax, 1
dec eax
jmp 0x50fa81
xor eax, eax
mov dword [esp + 0x50], edx
lea edx, [eax + ecx]
mov dword [esp + 0x48], eax
add edx, edx
cmp byte [esp + 0x3b], 0
jne 0x50fab1
cmp dword [esp + 0x54], 0
lea eax, [edx + 2]
cmove eax, edx
mov edx, dword [esp + 0x3c]
add eax, edx
cmp dword [ebp + 0x14], eax
jae 0x50fab1
mov byte [esp + 0x3b], 1
jmp 0x50fb26
mov eax, dword [esp + 0x50]
xor edx, edx
div dword [esp + 0x70]
cmp byte [esp + 0x3b], 0
mov ecx, dword [esp + 0x44]
jne 0x50fb1e
cmp dword [esp + 0x54], 0
je 0x50fadc
mov eax, 0x2d
mov word [ebx], ax
add ebx, 2
mov eax, dword [esp + 0x44]
test eax, eax
je 0x50fb8f
movsx ax, byte [esi]
dec ecx
inc esi
mov word [ebx], ax
mov eax, edx
add ebx, 2
dec edx
test eax, eax
jne 0x50fb1a
test ecx, ecx
je 0x50fb1e
movzx eax, word [0x630698]
dec ecx
mov word [ebx], ax
mov edx, 1
movsx eax, byte [esi]
mov word [ebx + 2], ax
add ebx, 4
inc esi
test ecx, ecx
jne 0x50fae8
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x58]
mov eax, dword [esp + 0x44]
cmp dword [esp + 0x54], 0
je 0x50fb38
add edx, 2
mov dword [esp + 0x3c], edx
add eax, dword [esp + 0x48]
mov edx, dword [esp + 0x3c]
sub ecx, dword [esp + 0x44]
cmp byte [esp + 0x3b], 0
mov dword [esp + 0x58], ecx
lea esi, [edx + eax*2]
jne 0x50fbbb
push ebx
push ecx
push dword [esp + 0x68]
call sym.SystemInformer.exe_PhZeroExtendToUtf16Buffer
mov ecx, dword ds:[esp + 0x58]
mov eax, dword [edi*8 + 0x632cf0]
add eax, 2
lea esi, [esi + ecx*2]
add eax, esi
lea ebx, [ebx + ecx*2]
cmp dword [ebp + 0x14], eax
jae 0x50fb99
mov byte [esp + 0x3b], 1
jmp 0x50fbbb
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x3c]
jmp 0x50fb2a
mov eax, 0x20
mov word [ebx], ax
lea eax, [ebx + 2]
push dword [edi*8 + 0x632cf0]
push dword [edi*8 + 0x632cf4]
push eax
call fcn.00582850
add esp, 0xc
mov ecx, dword [edi*8 + 0x632cf0]
lea eax, [ecx + 2]
shr eax, 1
lea ebx, [ebx + eax*2]
lea eax, [ecx + 2]
mov dword [esp + 0x4c], ebx
add eax, esi
mov dword [esp + 0x3c], eax
jmp 0x50fbe1
fstp st(1)
fstp st(0)
mov eax, dword [esp + 0x3c]
mov edi, dword [esp + 0x68]
mov ecx, eax
sub ecx, dword [esp + 0xb0]
mov edx, dword [edi]
test edx, 0xc0000000
je 0x50fcaf
movzx esi, word [edi + 6]
add esi, esi
cmp ecx, esi
jae 0x50fcaf
sub esi, ecx
cmp byte [esp + 0x3b], 0
jne 0x50fc9a
add eax, esi
cmp dword [ebp + 0x14], eax
jae 0x50fc28
mov byte [esp + 0x3b], 1
jmp 0x50fc9a
test dl, dl
jns 0x50fc32
movzx eax, word [edi + 8]
jmp 0x50fc37
mov eax, 0x20
mov edi, esi
mov dword [esp + 0x50], eax
shr edi, 1
test edx, edx
jns 0x50fc55
test edi, edi
je 0x50fc9a
mov ecx, edi
mov edi, ebx
jmp 0x50fc87
mov eax, ecx
mov edx, ebx
and eax, 0xfffffffe
sub edx, eax
push ecx
push edx
lfence
lea eax, [edx + edi*2]
mov dword [esp + 0xb8], edx
push eax
call fcn.00582850
add esp, 0xc
test edi, edi
je 0x50fc9a
mov eax, dword [esp + 0x50]
mov ecx, edi
mov edi, dword [esp + 0xb0]
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov eax, esi
shr eax, 1
lea ebx, [ebx + eax*2]
mov eax, dword [esp + 0x3c]
add eax, esi
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x3c], eax
mov ecx, dword [ebp + 0xc]
fld qword [esp + 0xa0]
fld qword [esp + 0xa8]
mov esi, dword [ebp + 0x14]
mov edi, dword [esp + 0x6c]
test ecx, ecx
jne 0x50e9f7
fstp st(1)
fstp st(0)
mov dl, byte [esp + 0x3b]
add eax, 2
test dl, dl
jne 0x50fcea
mov edi, edi
cmp esi, eax
jae 0x50fd2b
mov dl, 1
mov edi, dword [esp + 0x88]
mov ecx, eax
test edi, edi
je 0x50fd02
test esi, esi
je 0x50fd02
xor eax, eax
mov word [edi], ax
mov eax, ecx
mov ecx, dword [esp + 0x8c]
test ecx, ecx
je 0x50fd0f
mov dword [ecx], eax
mov ecx, dword [esp + 0x4bc]
test dl, dl
pop edi
pop esi
sete al
pop ebx
xor ecx, esp
call fcn.0058078f
mov esp, ebp
pop ebp
ret 0x14
xor ecx, ecx
mov word [ebx], cx
jmp 0x50fd02