Function at 0x14000d3f0
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rbx
push r13
lea rbp, [rax - 0x6d8]
sub rsp, 0x7c0
mov qword [rax - 0x20], rsi
xor esi, esi
mov qword [rax - 0x28], rdi
mov r13d, esi
mov qword [rax - 0x30], r12
mov r12, r8
mov qword [rax - 0x38], r14
mov r14d, edx
mov qword [rax - 0x40], r15
mov rax, rcx
xor cl, cl
mov r15, r8
test r12, r12
movzx ebx, cl
mov r8d, 1
cmove ebx, r8d
test byte [0x140152c10], r8b
mov dword [rsp + 0x50], ebx
jne 0x14000d58c
lock bts qword [0x140152c10], 0x1f
jae 0x14000d485
test byte [0x140152c10], r8b
jne 0x14000d58c
xor edx, edx
lea rcx, [0x140152c10]
call sym.ProcessHacker.exe_PhfWaitForEvent
jmp 0x14000d578
mov r9d, 4
lea r8, [rsp + 0x78]
mov ecx, 0x400
lea edx, [r9 + 0xa]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14000d4c4
mov rax, qword [rsp + 0x78]
test ax, ax
je 0x14000d4c4
movzx edx, word [0x140152b5c]
cmp word [rsp + 0x7a], si
cmove dx, ax
mov word [0x140152b5c], dx
mov r9d, 4
lea r8, [rsp + 0x78]
mov ecx, 0x400
lea edx, [r9 + 0xb]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14000d503
mov rax, qword [rsp + 0x78]
test ax, ax
je 0x14000d503
movzx ecx, word [0x140152b3c]
cmp word [rsp + 0x7a], si
cmove cx, ax
mov word [0x140152b3c], cx
cmp word [0x140152b5c], 0x2e
je 0x14000d522
lea rdx, [0x1401223ca]
xor ecx, ecx
call fcn.1400e77c4
mov qword [0x140159a48], rax
lock bts qword [0x140152c10], 0
jb 0x14000d578
mov rdi, qword [0x140152c18]
test rdi, rdi
je 0x14000d545
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtSetEvent]
mov rax, 0xfffffffffffffffe
lock xadd qword [0x140152c10], rax
shr rax, 1
and eax, 0x7fff
cmp rax, 1
jne 0x14000d578
test rdi, rdi
je 0x14000d578
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
mov qword [0x140152c18], rsi
mov r9, qword [rbp + 0x6f8]
mov r8d, 1
mov rax, qword [rbp + 0x6e0]
test r14d, r14d
je 0x14000e2e0
movaps xmmword [rsp + 0x780], xmm6
lea r10, [0x140000000]
movsd xmm6, qword [0x1401377f0]
mov edx, 2
movaps xmmword [rsp + 0x770], xmm7
movsd xmm7, qword [0x1401377a0]
movaps xmmword [rsp + 0x760], xmm8
movsd xmm8, qword [0x140137830]
jmp 0x14000d5e7
mov r9, qword [rbp + 0x6f8]
mov r11, rax
mov qword [rsp + 0x58], rax
add rax, 0x20
mov qword [rsp + 0x60], r13
dec r14d
mov qword [rbp + 0x6e0], rax
mov dword [rbp + 0x6e8], r14d
mov rdi, r13
mov r15d, dword [r11]
mov r14d, esi
mov eax, r15d
and eax, 0x3f
cmp eax, 0xc
ja case.default.0x14000d62e
cdqe
mov ecx, dword [r10 + rax*4 + 0xe358]
add rcx, r10
jmp rcx
test bl, bl
jne 0x14000d659
lea rax, [r13 + 2]
cmp r9, rax
jae 0x14000d64f
add r12, 2
mov byte [rsp + 0x50], 1
add r13, 2
jmp case.default.0x14000d62e
movzx eax, word [r11 + 0x10]
mov word [r12], ax
add r12, 2
add r13, 2
jmp case.default.0x14000d62e
test bl, bl
jne 0x14000d69f
mov r8, qword [r11 + 0x10]
lea rax, [r8 + r13]
cmp r9, rax
jae 0x14000d68e
mov rax, r8
mov byte [rsp + 0x50], 1
shr rax, 1
add r13, r8
lea r12, [r12 + rax*2]
jmp case.default.0x14000d62e
mov rdx, qword [r11 + 0x18]
mov rcx, r12
call fcn.1400e19b0
mov r11, qword [rsp + 0x58]
mov rax, qword [r11 + 0x10]
shr rax, 1
add r13, qword [r11 + 0x10]
lea r12, [r12 + rax*2]
jmp case.default.0x14000d62e
mov rcx, qword [r11 + 0x10]
call sym.ProcessHacker.exe_PhCountStringZ
mov rdi, rax
test bl, bl
jne 0x14000d6fc
lea r8, [rax + rax]
lea rcx, [r8 + r13]
cmp qword [rbp + 0x6f8], rcx
jae 0x14000d6eb
lea rcx, [rax + rax]
mov byte [rsp + 0x50], 1
mov rax, rcx
shr rax, 1
add r13, rcx
jmp 0x14000e1e5
mov rax, qword [rsp + 0x58]
mov rcx, r12
mov rdx, qword [rax + 0x10]
call fcn.1400e19b0
lea rcx, [rdi + rdi]
mov rax, rcx
shr rax, 1
add r13, rcx
jmp 0x14000e1e5
cmp r15d, 3
jne 0x14000d71e
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x10]
jmp 0x14000d72f
mov rbx, qword [r11 + 0x10]
or rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], 0
jne 0x14000d726
mov r8d, edi
lea rcx, [rsp + 0x68]
mov rdx, rbx
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeSize]
test eax, eax
js 0x14000e1e9
cmp byte [rsp + 0x50], 0
jne 0x14000d78f
mov ecx, dword [rsp + 0x68]
lea rax, [rcx + r13]
cmp qword [rbp + 0x6f8], rax
jae 0x14000d772
mov eax, ecx
mov byte [rsp + 0x50], 1
shr rax, 1
add r13, rcx
jmp 0x14000e1e5
mov edx, ecx
mov dword [rsp + 0x20], edi
mov rcx, r12
mov r9, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
test eax, eax
js 0x14000e1e9
mov ecx, dword [rsp + 0x68]
mov eax, ecx
shr rax, 1
add r13, rcx
jmp 0x14000e1e5
mov edi, dword [r11 + 0x10]
test edi, edi
jns 0x14000d7b3
neg edi
mov r14d, r8d
jmp 0x14000d7b3
mov edi, dword [r11 + 0x10]
mov r11d, 0xa
bt r15d, 8
jae 0x14000d7d4
mov rax, qword [rsp + 0x58]
movzx ecx, byte [rax + 0xa]
lea eax, [rcx - 2]
cmp al, 0x43
ja 0x14000d7d4
movzx r11d, cl
mov eax, r15d
lea r10, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
and eax, 0x20000000
lea r9, [rbp + 0x39e]
lea rax, str.0123456789abcdefghijklmnopqrstuvwxyz_________._:_________
mov ebx, esi
cmove r10, rax
test edi, edi
je 0x14000d87e
bt r15d, 0x10
jae 0x14000d860
mov r8d, esi
nop dword [rax]
xor edx, edx
mov eax, edi
div r11d
inc ebx
inc r8d
mov edi, eax
movsx ecx, byte [rdx + r10]
mov word [r9], cx
sub r9, 2
cmp r8d, 3
jne 0x14000d849
test eax, eax
je 0x14000d84d
movzx eax, word [0x140152b3c]
mov r8d, esi
mov word [r9], ax
sub r9, 2
inc ebx
test edi, edi
jne 0x14000d810
mov r10d, 0x30
test r14b, 1
je 0x14000d898
mov esi, 1
jmp 0x14000d8a8
xor edx, edx
mov eax, edi
div r11d
inc ebx
mov edi, eax
movsx ecx, byte [rdx + r10]
mov word [r9], cx
sub r9, 2
test eax, eax
jne 0x14000d860
jmp 0x14000d84d
mov r10d, 0x30
lea r9, [rbp + 0x39c]
mov word [rbp + 0x39e], r10w
mov ebx, r8d
jmp 0x14000d853
mov eax, r15d
mov edi, 1
and eax, 0x20000
cmovne esi, edi
mov eax, r15d
and eax, 0x50000
cmp eax, 0x40000
jne 0x14000d8d9
mov rax, qword [rsp + 0x58]
movzx ecx, word [rax + 6]
lea eax, [rsi + rbx]
cmp eax, ecx
jae 0x14000d8d9
mov edx, ecx
or r14d, 4
sub edx, esi
sub edx, ebx
mov dword [rsp + 0x6c], edx
add esi, edx
jmp 0x14000d8dd
mov edx, dword [rsp + 0x6c]
cmp byte [rsp + 0x50], 0
jne 0x14000d962
lea eax, [rsi + rbx]
lea rax, [rax*2]
add rax, r13
cmp qword [rbp + 0x6f8], rax
jae 0x14000d90d
lea eax, [rsi + rbx]
mov byte [rsp + 0x50], 1
lea r13, [r13 + rax*2]
jmp 0x14000e1e9
test r14b, 1
je 0x14000d91a
mov eax, 0x2d
jmp 0x14000d926
bt r15d, 0x11
jae 0x14000d92f
mov eax, 0x2b
mov word [r12], ax
add r12, 2
test r14b, 4
je 0x14000d94b
test rdx, rdx
je 0x14000d947
movzx eax, r10w
mov rdi, r12
mov rcx, rdx
rep stosw word [rdi], ax
lea r12, [r12 + rdx*2]
mov edi, ebx
lea rdx, [r9 + 2]
add rdi, rdi
mov rcx, r12
mov r8, rdi
call fcn.1400e19b0
add r12, rdi
lea eax, [rsi + rbx]
lea r13, [r13 + rax*2]
jmp 0x14000e1e9
mov rdi, qword [r11 + 0x10]
test rdi, rdi
jns 0x14000d984
neg rdi
mov r14d, r8d
jmp 0x14000d984
mov rdi, qword [r11 + 0x10]
mov edx, 0xa
bt r15d, 8
jae 0x14000d99f
movzx ecx, byte [r11 + 0xa]
lea eax, [rcx - 2]
cmp al, 0x43
ja 0x14000d99f
movzx edx, cl
mov eax, r15d
lea r10, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
and eax, 0x20000000
lea r9, [rbp + 0x39e]
lea rax, str.0123456789abcdefghijklmnopqrstuvwxyz_________._:_________
mov ebx, esi
cmove r10, rax
test rdi, rdi
je 0x14000da63
bt r15d, 0x10
jae 0x14000da3c
mov r8d, esi
mov r11d, edx
nop dword [rax + rax]
xor edx, edx
mov rax, rdi
div r11
inc ebx
inc r8d
mov rdi, rax
mov eax, edx
movsx ecx, byte [rax + r10]
mov word [r9], cx
sub r9, 2
cmp r8d, 3
jne 0x14000da1e
test rdi, rdi
je 0x14000da23
movzx eax, word [0x140152b3c]
mov r8d, esi
mov word [r9], ax
sub r9, 2
inc ebx
test rdi, rdi
jne 0x14000d9e0
mov r11, qword [rsp + 0x58]
mov edi, 0x30
lea r8d, [rdi - 0x2f]
test r14b, 1
je 0x14000da7b
mov esi, r8d
jmp 0x14000da87
mov r8d, edx
nop
xor edx, edx
mov rax, rdi
div r8
inc ebx
mov rdi, rax
mov eax, edx
movsx ecx, byte [rax + r10]
mov word [r9], cx
sub r9, 2
test rdi, rdi
jne 0x14000da40
jmp 0x14000da28
mov edi, 0x30
lea r9, [rbp + 0x39c]
mov word [rbp + 0x39e], di
mov ebx, r8d
jmp 0x14000da31
mov eax, r15d
and eax, 0x20000
cmovne esi, r8d
mov eax, r15d
and eax, 0x50000
cmp eax, 0x40000
jne 0x14000dab4
movzx ecx, word [r11 + 6]
lea eax, [rsi + rbx]
cmp eax, ecx
jae 0x14000dab4
mov edx, ecx
or r14d, 4
sub edx, esi
sub edx, ebx
mov dword [rsp + 0x70], edx
add esi, edx
jmp 0x14000dab8
mov edx, dword [rsp + 0x70]
cmp byte [rsp + 0x50], 0
jne 0x14000d962
lea eax, [rsi + rbx]
lea rax, [rax*2]
add rax, r13
cmp qword [rbp + 0x6f8], rax
jae 0x14000daec
lea eax, [rsi + rbx]
mov byte [rsp + 0x50], 1
lea r13, [r13 + rax*2]
jmp 0x14000e1e9
test r14b, 1
je 0x14000daf9
mov eax, 0x2d
jmp 0x14000db05
bt r15d, 0x11
jae 0x14000db0e
mov eax, 0x2b
mov word [r12], ax
add r12, 2
test r14b, 4
je 0x14000d94b
test rdx, rdx
je 0x14000d947
movzx eax, di
jmp 0x14000d93e
test r15b, 0x40
je 0x14000db41
movzx edi, word [r11 + 4]
mov eax, 0xa2
cmp edi, eax
jbe 0x14000db46
mov edi, eax
jmp 0x14000db46
mov edi, 6
mov cl, 0x66
bt r15d, 0xc
jae 0x14000db53
mov cl, 0x65
jmp 0x14000db66
mov eax, r15d
movzx ecx, cl
and eax, 0x2000
mov eax, 0x61
cmovne ecx, eax
movsd xmm0, qword [r11 + 0x10]
lea r14, [rbp - 0x5f]
movsd qword [rbp - 0x70], xmm0
movsx edx, cl
bt r15d, 0x1d
jae 0x14000db82
sub edx, 0x20
mov rax, qword [0x140159a48]
lea r9, [rbp + 0x3a0]
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x70]
mov qword [rsp + 0x38], rsi
mov r8d, 0x3ff
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edx
lea rdx, [rbp - 0x5f]
mov qword [rsp + 0x20], 0x15e
call fcn.1400e8fd0
mov r11, qword [rsp + 0x58]
movzx edx, byte [rbp - 0x5f]
mov r9d, dword [r11]
bt r9d, 0xf
jae 0x14000dc44
movzx edi, word [0x140152b5c]
lea rcx, [rbp - 0x5f]
test dl, dl
je 0x14000dbf3
movzx eax, dl
cmp al, dil
je 0x14000dbf3
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x14000dbe3
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x14000dc44
movzx eax, byte [rcx]
test al, al
je 0x14000dc15
sub al, 0x45
test al, 0xdf
je 0x14000dc15
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x14000dc04
mov rdx, rcx
dec rcx
cmp byte [rcx], 0x30
jne 0x14000dc28
dec rcx
cmp byte [rcx], 0x30
je 0x14000dc20
cmp byte [rcx], dil
jne 0x14000dc30
dec rcx
movzx eax, byte [rdx]
lea rcx, [rcx + 1]
inc rdx
mov byte [rcx], al
test al, al
jne 0x14000dc30
movzx edx, byte [rbp - 0x5f]
lea rax, [rbp - 0x5f]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000dc50
mov edi, 1
cmp dl, 0x2d
jne 0x14000dc70
mov r10d, edi
lea r14, [rbp - 0x5e]
dec r8d
jmp 0x14000dc84
mov eax, r9d
mov r10d, esi
and eax, 0x20000
mov eax, 2
cmovne r10d, eax
mov eax, r9d
and eax, 0x13000
cmp eax, 0x10000
jne 0x14000ddd7
movzx eax, byte [r14]
mov r9, r14
sub al, 0x30
cmp al, 0xa
jae 0x14000dcbe
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r9 + 1]
inc r9
sub al, 0x30
cmp al, 0xa
jb 0x14000dcb0
mov r11d, r9d
sub r11d, r14d
je 0x14000dcd9
lea ecx, [r11 + 2]
mov eax, 0xaaaaaaab
mul ecx
mov ebx, edx
shr ebx, 1
dec ebx
jmp 0x14000dcdb
mov ebx, esi
lea eax, [rbx + r8]
mov esi, r10d
add eax, eax
and esi, 3
je 0x14000dcec
add eax, 2
mov r15d, dword [rsp + 0x50]
test r15b, r15b
jne 0x14000dd0d
add rax, r13
movzx r15d, r15b
cmp qword [rbp + 0x6f8], rax
cmovb r15d, edi
mov dword [rsp + 0x50], r15d
lea edi, [r11 + 2]
mov eax, 0xaaaaaaab
mul edi
mov ecx, r11d
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
test r15b, r15b
jne 0x14000dd98
test r10b, 1
je 0x14000dd34
mov eax, 0x2d
jmp 0x14000dd3f
test r10b, 2
je 0x14000dd48
mov eax, 0x2b
mov word [r12], ax
add r12, 2
test r11d, r11d
je 0x14000dd98
mov r15d, 2
nop dword [rax]
nop word [rax + rax]
movsx eax, byte [r14]
dec ecx
mov word [r12], ax
inc r14
mov eax, edi
add r12, r15
dec edi
test eax, eax
jne 0x14000dd8f
test ecx, ecx
je 0x14000dd93
movzx eax, word [0x140152b3c]
mov edi, r15d
mov word [r12], ax
add r12, r15
test ecx, ecx
jne 0x14000dd60
mov r15d, dword [rsp + 0x50]
test esi, esi
je 0x14000dda0
add r13, 2
sub r8d, r11d
lea eax, [rbx + r11]
lea r13, [r13 + rax*2]
test r15b, r15b
jne 0x14000e1e9
mov edi, r8d
mov rcx, r9
mov edx, edi
mov r8, r12
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
lea rcx, [rdi + rdi]
mov rax, rcx
shr rax, 1
add r13, rcx
jmp 0x14000e1e5
movzx eax, r10b
mov rdx, rsi
and al, 3
cmovne rdx, rdi
bt r9d, 0x12
jae 0x14000de12
movzx edi, word [r11 + 6]
mov ecx, r8d
lea rax, [rcx + rdx]
cmp rax, rdi
jae 0x14000de12
mov r9d, edi
or r10d, 4
sub r9, rcx
sub r9, rdx
mov qword [rbp - 0x78], r9
add rdx, r9
jmp 0x14000de16
mov r9, qword [rbp - 0x78]
test bl, bl
jne 0x14000de7d
mov eax, r8d
add rax, rdx
lea rax, [rax*2]
add rax, r13
cmp qword [rbp + 0x6f8], rax
jae 0x14000de3c
mov bl, 1
mov dword [rsp + 0x50], ebx
jmp 0x14000de7d
test r10b, 1
je 0x14000de49
mov eax, 0x2d
jmp 0x14000de54
test r10b, 2
je 0x14000de5d
mov eax, 0x2b
mov word [r12], ax
add r12, 2
test r10b, 4
je 0x14000de7d
test r9, r9
je 0x14000de79
mov eax, 0x30
mov rdi, r12
movzx eax, ax
mov rcx, r9
rep stosw word [rdi], ax
lea r12, [r12 + r9*2]
lea r13, [r13 + rdx*2]
test bl, bl
jne 0x14000e1ee
mov edi, r8d
mov rcx, r14
mov edx, edi
mov r8, r12
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
lea rcx, [rdi + rdi]
mov rax, rcx
shr rax, 1
add r13, rcx
jmp 0x14000e1e5
mov rax, qword [r11 + 0x10]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
test rax, rax
jns 0x14000dec2
addsd xmm0, xmm8
jne 0x14000defa
test bl, bl
jne 0x14000deed
lea rax, [r13 + 2]
cmp r9, rax
jae 0x14000dee3
add r12, 2
mov byte [rsp + 0x50], 1
add r13, 2
jmp case.default.0x14000d62e
mov eax, 0x30
mov word [r12], ax
add r12, 2
add r13, 2
jmp case.default.0x14000d62e
bt r15d, 8
jae 0x14000df08
movzx eax, byte [r11 + 0xa]
jmp 0x14000df0e
mov eax, dword [0x140158728]
comisd xmm0, xmm6
jb 0x14000df29
cmp esi, 7
jae 0x14000df29
cmp esi, eax
jae 0x14000df29
mulsd xmm0, xmm7
inc esi
comisd xmm0, xmm6
jae 0x14000df14
test r15b, 0x40
je 0x14000df36
movzx eax, word [r11 + 4]
jmp 0x14000df38
mov eax, edx
movzx ecx, ax
lea r9, [rbp + 0x500]
mov eax, 0xa2
movsd qword [rbp - 0x68], xmm0
xor ebx, ebx
lea rdx, [rbp - 0x5f]
cmp ecx, eax
lea r14, [rbp - 0x5f]
mov r8d, 0x3ff
mov r15d, ebx
cmova ecx, eax
mov rax, qword [0x140159a48]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ecx
lea rcx, [rbp - 0x68]
mov dword [rsp + 0x28], 0x66
mov qword [rsp + 0x20], 0x15e
call fcn.1400e8fd0
movzx edx, byte [rbp - 0x5f]
lea rcx, [rbp - 0x5f]
movzx edi, word [0x140152b5c]
test dl, dl
je 0x14000dfc0
movzx eax, dl
nop dword [rax]
cmp al, dil
je 0x14000dfc0
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x14000dfb0
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x14000e014
movzx eax, byte [rcx]
test al, al
je 0x14000dfe2
sub al, 0x45
test al, 0xdf
je 0x14000dfe2
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x14000dfd1
mov rdx, rcx
dec rcx
cmp byte [rcx], 0x30
jne 0x14000dff8
nop dword [rax]
dec rcx
cmp byte [rcx], 0x30
je 0x14000dff0
cmp byte [rcx], dil
jne 0x14000e000
dec rcx
movzx eax, byte [rdx]
lea rcx, [rcx + 1]
inc rdx
mov byte [rcx], al
test al, al
jne 0x14000e000
movzx edx, byte [rbp - 0x5f]
lea rax, [rbp - 0x5f]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], bl
jne 0x14000e020
mov edi, 1
cmp dl, 0x2d
jne 0x14000e03d
mov r15d, edi
lea r14, [rbp - 0x5e]
dec r8d
movzx eax, byte [r14]
mov r9, r14
sub al, 0x30
cmp al, 0xa
jae 0x14000e05e
nop word [rax + rax]
movzx eax, byte [r9 + 1]
inc r9
sub al, 0x30
cmp al, 0xa
jb 0x14000e050
mov r10d, r9d
sub r10d, r14d
je 0x14000e07c
lea ecx, [r10 + 2]
mov eax, 0xaaaaaaab
mul ecx
mov r11d, edx
shr r11d, 1
dec r11d
jmp 0x14000e07f
mov r11d, ebx
lea eax, [r11 + r8]
mov ebx, r15d
add eax, eax
and ebx, 3
mov dword [rbp - 0x80], ebx
je 0x14000e093
add eax, 2
mov ecx, dword [rsp + 0x50]
test cl, cl
jne 0x14000e0af
add rax, r13
movzx ecx, cl
cmp qword [rbp + 0x6f8], rax
cmovb ecx, edi
mov byte [rsp + 0x50], cl
lea edi, [r10 + 2]
mov eax, 0xaaaaaaab
mul edi
mov ecx, r10d
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
cmp byte [rsp + 0x50], 0
jne 0x14000e135
test r15b, 1
je 0x14000e0d8
mov eax, 0x2d
jmp 0x14000e0e3
test r15b, 2
je 0x14000e0ec
mov eax, 0x2b
mov word [r12], ax
add r12, 2
test r10d, r10d
je 0x14000e135
mov ebx, 2
nop word [rax + rax]
movsx eax, byte [r14]
dec ecx
mov word [r12], ax
inc r14
mov eax, edi
add r12, rbx
dec edi
test eax, eax
jne 0x14000e12e
test ecx, ecx
je 0x14000e132
movzx eax, word [0x140152b3c]
mov edi, ebx
mov word [r12], ax
add r12, rbx
test ecx, ecx
jne 0x14000e100
mov ebx, dword [rbp - 0x80]
test ebx, ebx
je 0x14000e13d
add r13, 2
lea eax, [r11 + r10]
sub r8d, r10d
lea rbx, [rax*2]
add rbx, r13
cmp byte [rsp + 0x50], 0
jne 0x14000e1c3
mov edi, r8d
mov rcx, r9
mov edx, edi
mov r8, r12
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
lea rcx, [rdi + rdi]
mov edx, esi
add rbx, rcx
lea r10, [0x140000000]
mov rax, rcx
add rdx, rdx
shr rax, 1
lea rcx, [rbx + 2]
add rcx, qword [r10 + rdx*8 + 0x152ba0]
lea r12, [r12 + rax*2]
cmp qword [rbp + 0x6f8], rcx
jae 0x14000e19f
mov byte [rsp + 0x50], 1
jmp 0x14000e1ca
mov eax, 0x20
lea rcx, [r12 + 2]
mov word [r12], ax
mov r8, qword [r10 + rdx*8 + 0x152ba0]
mov rdx, qword [r10 + rdx*8 + 0x152ba8]
call fcn.1400e19b0
lea r10, [0x140000000]
mov eax, esi
add rax, rax
mov rcx, qword [r10 + rax*8 + 0x152ba0]
lea rax, [rcx + 2]
shr rax, 1
lea r13, [rcx + 2]
add r13, rbx
lea r12, [r12 + rax*2]
mov r11, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov ecx, dword [r11]
mov r8, r13
sub r8, rdi
test ecx, 0xc0000000
je 0x14000e292
movzx ebx, word [r11 + 6]
add rbx, rbx
cmp r8, rbx
jae 0x14000e292
sub rbx, r8
cmp byte [rsp + 0x50], 0
jne 0x14000e285
lea rax, [rbx + r13]
cmp qword [rbp + 0x6f8], rax
jae 0x14000e233
mov byte [rsp + 0x50], 1
jmp 0x14000e285
test cl, cl
jns 0x14000e23e
movzx r14d, word [r11 + 8]
jmp 0x14000e244
mov r14d, 0x20
test ecx, ecx
jns 0x14000e255
mov rcx, rbx
shr rcx, 1
je 0x14000e285
mov rdi, r12
jmp 0x14000e27e
mov rax, r8
mov rdi, r12
shr rax, 1
mov rsi, rbx
add rax, rax
shr rsi, 1
sub rdi, rax
mov rdx, rdi
lea rcx, [rdi + rsi*2]
call fcn.1400e19b0
test rsi, rsi
je 0x14000e285
mov rcx, rsi
movzx eax, r14w
rep stosw word [rdi], ax
mov rax, rbx
shr rax, 1
add r13, rbx
lea r12, [r12 + rax*2]
mov r14d, dword [rbp + 0x6e8]
lea r10, [0x140000000]
mov ebx, dword [rsp + 0x50]
mov esi, 0
mov rax, qword [rbp + 0x6e0]
lea edx, [rsi + 2]
lea r8d, [rsi + 1]
test r14d, r14d
jne 0x14000d5e0
mov r15, qword [rbp + 0x6f0]
movaps xmm8, xmmword [rsp + 0x760]
movaps xmm7, xmmword [rsp + 0x770]
movaps xmm6, xmmword [rsp + 0x780]
mov r14, qword [rsp + 0x7a0]
mov rdi, qword [rsp + 0x7b0]
mov rcx, qword [rbp + 0x6f8]
test bl, bl
jne 0x14000e306
lea rax, [r13 + 2]
cmp rcx, rax
jae 0x14000e350
mov bl, 1
test r15, r15
je 0x14000e314
test rcx, rcx
je 0x14000e314
mov word [r15], si
mov rdx, qword [rbp + 0x700]
mov r15, qword [rsp + 0x798]
mov r12, qword [rsp + 0x7a8]
mov rsi, qword [rsp + 0x7b8]
test rdx, rdx
je 0x14000e33f
lea rcx, [r13 + 2]
mov qword [rdx], rcx
test bl, bl
sete al
add rsp, 0x7c0
pop r13
pop rbx
pop rbp
ret
mov word [r12], si
jmp 0x14000e314