Function at 0x1401560e0
Capabilities:
Get geographical location

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r15
lea rbp, [rsp - 0x3c8]
sub rsp, 0x4c8
mov rax, qword [0x1402bf040]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov ebx, 0x1e
mov edi, edx
mov rdx, qword [0x1402ca998]
cmp r8, rbx
mov r12, rcx
cmovae rbx, r8
mov qword [rsp + 0x38], rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor ecx, ecx
mov qword [rsp + 0x30], rax
mov r11, rax
mov qword [rsp + 0x40], rcx
mov r15d, ecx
mov qword [rax], rbx
add rax, 0x10
mov qword [r11 + 8], rax
mov word [rax + rbx], cx
test byte [0x1402c5c60], 1
mov rsi, qword [r11 + 8]
jne 0x140156237
lock bts qword [0x1402c5c60], 0x1f
setb al
test al, al
jne 0x14015621b
mov r9d, 4
lea r8, [rbp - 0x78]
mov edx, 0xe
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1401561b3
mov rax, qword ds:[rbp - 0x78]
test ax, ax
je 0x1401561b3
cmp word [rbp - 0x76], r15w
jne 0x1401561b3
mov word [0x1402c0518], ax
mov r9d, 4
lea r8, [rbp - 0x78]
mov edx, 0xf
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1401561ee
mov rax, qword [rbp - 0x78]
test ax, ax
je 0x1401561ee
nop word [rax + rax]
cmp word [rbp - 0x76], r15w
jne 0x1401561ee
mov word [0x1402c1118], ax
cmp word [0x1402c0518], 0x2e
je 0x14015620d
lea rdx, [0x1402386c8]
xor ecx, ecx
call fcn.1401f3378
mov qword [0x1402cdca8], rax
lea rcx, [0x1402c5c60]
call sym.SystemInformer.exe_PhfSetEvent
jmp 0x140156232
test byte [0x1402c5c60], 1
jne 0x140156237
xor edx, edx
lea rcx, [0x1402c5c60]
call sym.SystemInformer.exe_PhfWaitForEvent
mov r11, qword [rsp + 0x30]
test edi, edi
je 0x14015756f
mov qword [rsp + 0x508], r13
lea r8, [0x140000000]
mov qword [rsp + 0x4c0], r14
mov edx, 1
movaps xmmword [rsp + 0x4b0], xmm6
mov r9d, 0xa2
movsd xmm6, qword [0x140290820]
mov r10d, 2
movaps xmmword [rsp + 0x4a0], xmm7
movsd xmm7, qword [0x1402907d0]
nop word [rax + rax]
mov r14, r12
mov qword [rsp + 0x58], r12
add r12, 0x20
mov qword [rsp + 0x78], r15
dec edi
mov qword [rbp - 0x80], r12
xor r11d, r11d
mov dword [rsp + 0x6c], edi
mov r13d, dword [r14]
mov r12d, r11d
mov eax, r13d
and eax, 0x3f
cmp eax, 0xc
ja case.default.0x1401562d6
cdqe
mov ecx, dword [r8 + rax*4 + 0x1575a4]
add rcx, r8
jmp rcx
mov r8, qword [rsp + 0x38]
lea rbx, [r15 + 2]
cmp r8, rbx
jae 0x14015635a
mov rdx, qword [0x1402ca998]
lea rax, [r8 + r8]
cmp rax, rbx
mov rsi, rbx
cmovae rsi, rax
mov qword [rsp + 0x38], rsi
lea rcx, [rsi + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor edx, edx
mov r8, r15
mov rdi, rax
mov qword [rax], rsi
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rsi + rcx], dx
mov rsi, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [rsi + 8]
call fcn.14020af00
lea rcx, [rsi - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14015634a
call fcn.140141ea0
mov rax, qword [rdi + 8]
shr r15, 1
mov qword [rsp + 0x30], rdi
lea rsi, [rax + r15*2]
movzx eax, word [r14 + 0x10]
mov r15, rbx
mov word [rsi], ax
add rsi, 2
mov qword [rsp + 0x40], rbx
jmp case.default.0x1401562d6
mov rcx, qword [r14 + 0x10]
add rcx, r15
cmp rbx, rcx
jae 0x1401563fd
mov rdx, qword [0x1402ca998]
lea rax, ds:[rbx + rbx]
cmp rax, rcx
mov rbx, rcx
cmovae rbx, rax
mov qword [rsp + 0x38], rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor edx, edx
mov r8, r15
mov rdi, rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rbx], dx
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
call fcn.14020af00
lea rcx, ds:[rbx - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x1401563ea
call fcn.140141ea0
mov rax, qword [rdi + 8]
mov rcx, r15
shr rcx, 1
mov qword [rsp + 0x30], rdi
lea rsi, [rax + rcx*2]
mov r8, qword [r14 + 0x10]
mov rcx, rsi
mov rdx, qword [r14 + 0x18]
call fcn.14020af00
mov rax, qword ds:[r14 + 0x10]
shr rax, 1
add r15, qword [r14 + 0x10]
lea rsi, [rsi + rax*2]
jmp 0x1401573e7
mov rdi, qword [r14 + 0x10]
xorps xmm1, xmm1
mov rdx, rdi
mov ecx, edi
and rdx, 0xfffffffffffffff1
and ecx, 0xf
je 0x14015645c
movdqu xmm0, xmmword [rdx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
mov dword [rsp + 0x48], ecx
je 0x140156458
mov edx, ecx
shr rdx, 1
jmp 0x140156499
add rdx, 0x10
movdqu xmm0, xmmword [rdx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x48], ecx
jne 0x14015648b
movdqu xmm0, xmmword [rdx + 0x10]
add rdx, 0x10
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x48], ecx
je 0x140156471
sub rdx, rdi
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
lea rdi, [rdx + rdx]
lea r14, [rdi + r15]
cmp rbx, r14
jae 0x14015651a
mov rdx, qword [0x1402ca998]
lea rax, [rbx + rbx]
cmp rax, r14
mov rsi, r14
cmovae rsi, rax
mov qword [rsp + 0x38], rsi
lea rcx, [rsi + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor edx, edx
mov r8, r15
mov rbx, rax
mov qword [rax], rsi
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rsi + rcx], dx
mov rsi, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [rsi + 8]
call fcn.14020af00
lea rcx, [rsi - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14015650a
call fcn.140141ea0
mov rax, qword [rbx + 8]
shr r15, 1
mov qword [rsp + 0x30], rbx
lea rsi, [rax + r15*2]
mov r13, qword [rsp + 0x58]
mov r8, rdi
mov rcx, rsi
mov rdx, qword [r13 + 0x10]
call fcn.14020af00
shr rdi, 1
mov r15, r14
mov qword [rsp + 0x40], r14
mov r14, r13
lea rsi, [rsi + rdi*2]
jmp case.default.0x1401562d6
cmp r13d, 3
jne 0x140156555
mov rbx, qword [r14 + 0x18]
mov rdi, qword [r14 + 0x10]
jmp 0x140156569
mov rbx, qword [r14 + 0x10]
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], r11b
jne 0x140156560
mov r8d, edi
lea rcx, [rsp + 0x60]
mov rdx, rbx
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeSize]
nop word [rax + rax]
test eax, eax
js case.default.0x1401562d6
lfence
mov edx, dword [rsp + 0x60]
mov r8, qword [rsp + 0x38]
lea rcx, [r15 + rdx]
cmp r8, rcx
jae 0x140156628
mov rdx, qword [0x1402ca998]
lea rax, [r8 + r8]
cmp rax, rcx
mov r12, rcx
cmovae r12, rax
mov qword [rsp + 0x38], r12
lea rcx, [r12 + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor edx, edx
mov r8, r15
mov rsi, rax
mov qword [rax], r12
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + r12], dx
mov r12, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [r12 + 8]
call fcn.14020af00
lea rcx, [r12 - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140156611
call fcn.140141ea0
mov rax, qword [rsi + 8]
mov rcx, r15
mov edx, dword [rsp + 0x60]
shr rcx, 1
mov qword [rsp + 0x30], rsi
lea rsi, [rax + rcx*2]
mov r9, rbx
mov dword [rsp + 0x20], edi
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
nop dword [rax + rax]
test eax, eax
js case.default.0x1401562d6
mov ecx, dword [rsp + 0x60]
mov eax, ecx
shr rax, 1
lea rsi, [rsi + rax*2]
jmp 0x1401573e4
mov eax, dword [r14 + 0x10]
mov r12d, eax
mov r8d, eax
shr r12d, 0x1f
neg r8d
test eax, eax
cmovns r8d, eax
jmp 0x140156677
mov r8d, dword [r14 + 0x10]
mov r10d, 0xa
bt r13d, 8
jae 0x140156694
movzx eax, byte [r14 + 0xa]
cmp al, 2
jb 0x140156694
cmp al, 0x45
ja 0x140156694
mov r10d, eax
bt r13d, 0x1d
lea r9, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
lea rax, [0x14028b210]
mov r14d, r11d
cmovae r9, rax
lea rbx, [rbp + 0x38e]
test r8d, r8d
je 0x140156742
bt r13d, 0x10
jae 0x140156720
mov edi, r11d
nop dword [rax + rax]
xor edx, edx
mov eax, r8d
div r10d
inc r14d
inc edi
mov r8d, eax
movsx ecx, byte [rdx + r9]
mov word [rbx], cx
sub rbx, 2
cmp edi, 3
jne 0x140156708
test eax, eax
je 0x14015670c
movzx eax, word [0x1402c1118]
mov word [rbx], ax
sub rbx, 2
inc r14d
jmp 0x1401566c5
test eax, eax
jne 0x1401566d0
mov edx, 1
test r12d, r12d
je 0x14015675a
mov ecx, edx
jmp 0x140156765
xor edx, edx
mov eax, r8d
div r10d
inc r14d
mov r8d, eax
movsx ecx, byte [rdx + r9]
mov word [rbx], cx
sub rbx, 2
test eax, eax
jne 0x140156720
nop
jmp 0x14015670c
mov eax, 0x30
lea rbx, [rbp + 0x38c]
mov word [rbp + 0x38e], ax
mov r14d, edx
jmp 0x140156711
bt r13d, 0x11
mov ecx, r11d
cmovb ecx, edx
and r13d, 0x50000
cmp r13d, 0x40000
mov r13, qword [rsp + 0x58]
jne 0x140156798
movzx edx, word [r13 + 6]
lea eax, [rcx + r14]
cmp eax, edx
jae 0x140156798
mov eax, edx
or r12d, 4
sub eax, ecx
sub eax, r14d
mov dword [rsp + 0x64], eax
add ecx, eax
mov r8, qword [rsp + 0x38]
lea eax, [rcx + r14]
lea r15, [r15 + rax*2]
cmp r8, r15
jae 0x14015682c
mov rdx, qword [0x1402ca998]
lea rax, [r8 + r8]
cmp rax, r15
mov rsi, r15
cmovae rsi, rax
mov qword [rsp + 0x38], rsi
lea rcx, [rsi + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor edx, edx
mov rdi, rax
mov qword [rax], rsi
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rsi], dx
mov rdx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rcx, qword [rax + 8]
mov r8, rsi
mov rdx, qword [rdx + 8]
call fcn.14020af00
mov rcx, qword [rsp + 0x30]
mov edx, 0xffffffff
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14015681c
call fcn.140141ea0
mov rax, qword [rdi + 8]
shr rsi, 1
mov qword [rsp + 0x30], rdi
lea rsi, [rax + rsi*2]
test r12b, 1
je 0x140156839
mov word [rsi], 0x2d
jmp 0x140156848
test dword [r13], 0x20000
je 0x14015684c
mov word [rsi], 0x2b
add rsi, 2
test r12b, 4
je 0x140156870
mov edx, dword [rsp + 0x64]
test rdx, rdx
je 0x14015686c
mov eax, 0x30
mov rdi, rsi
movzx eax, ax
mov rcx, rdx
rep stosw word [rdi], ax
lea rsi, [rsi + rdx*2]
mov edi, r14d
lea rdx, [rbx + 2]
add rdi, rdi
mov rcx, rsi
mov r8, rdi
call fcn.14020af00
mov r14, qword [rsp + 0x58]
add rsi, rdi
jmp 0x1401573e7
mov ecx, 0x10
mov rax, r14
mov rax, qword [rax + rcx]
mov r12, rax
mov rdi, rax
shr r12, 0x3f
neg rdi
cmovs rdi, rax
jmp 0x1401568b5
mov rdi, qword [r14 + 0x10]
mov r9d, 0xa
bt r13d, 8
jae 0x1401568d2
movzx eax, byte [r14 + 0xa]
cmp al, 2
jb 0x1401568d2
cmp al, 0x45
ja 0x1401568d2
mov r9d, eax
bt r13d, 0x1d
lea r10, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
lea rax, [0x14028b210]
mov r14d, r11d
cmovae r10, rax
lea rbx, [rbp + 0x38e]
test rdi, rdi
je 0x1401569ae
bt r13d, 0x10
jae 0x140156980
mov r8d, r11d
nop word [rax + rax]
xor edx, edx
mov rax, rdi
div r9
mov rax, rdi
inc r14d
mov rcx, rdx
inc r8d
xor edx, edx
div r9
mov rdi, rax
mov eax, ecx
movsx ecx, byte [rax + r10]
mov word [rbx], cx
sub rbx, 2
cmp r8d, 3
jne 0x14015695e
test rdi, rdi
je 0x140156965
movzx eax, word [0x1402c1118]
mov word [rbx], ax
sub rbx, 2
inc r14d
jmp 0x140156903
nop
test rdi, rdi
jne 0x140156910
mov edx, 1
test r12d, r12d
je 0x1401569c6
mov ecx, edx
jmp 0x1401569d1
xor edx, edx
mov rax, rdi
div r9
mov rax, rdi
inc r14d
mov rcx, rdx
xor edx, edx
div r9
mov rdi, rax
mov eax, ecx
movsx ecx, byte [rax + r10]
mov word [rbx], cx
sub rbx, 2
test rdi, rdi
jne 0x140156980
jmp 0x140156965
mov eax, 0x30
lea rbx, [rbp + 0x38c]
mov word [rbp + 0x38e], ax
mov r14d, edx
jmp 0x14015696a
bt r13d, 0x11
mov ecx, r11d
cmovb ecx, edx
and r13d, 0x50000
cmp r13d, 0x40000
mov r13, qword [rsp + 0x58]
jne 0x140156a04
movzx edx, word [r13 + 6]
lea eax, [rcx + r14]
cmp eax, edx
jae 0x140156a04
mov eax, edx
or r12d, 4
sub eax, ecx
sub eax, r14d
mov dword [rsp + 0x68], eax
add ecx, eax
mov r8, qword [rsp + 0x38]
lea eax, [rcx + r14]
lea r15, [r15 + rax*2]
cmp r8, r15
jae 0x140156a95
mov rdx, qword [0x1402ca998]
lea rax, [r8 + r8]
cmp rax, r15
mov rsi, r15
cmovae rsi, rax
mov qword [rsp + 0x38], rsi
lea rcx, [rsi + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov rdi, rax
xor edx, edx
mov qword [rax], rsi
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x30]
mov word [rcx + rsi], dx
mov rsi, qword [rsp + 0x40]
mov rcx, qword [rdi + 8]
mov r8, rsi
mov rdx, qword [rax + 8]
call fcn.14020af00
mov rcx, qword [rsp + 0x30]
mov edx, 0xffffffff
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140156a85
nop
call fcn.140141ea0
mov rax, qword [rdi + 8]
shr rsi, 1
mov qword [rsp + 0x30], rdi
lea rsi, [rax + rsi*2]
test r12b, 1
je 0x140156aa2
mov word [rsi], 0x2d
jmp 0x140156ab1
test dword [r13], 0x20000
je 0x140156ab5
mov word [rsi], 0x2b
add rsi, 2
test r12b, 4
je 0x140156870
mov edx, dword [rsp + 0x68]
jmp 0x140156856
test r13b, 0x40
je 0x140156add
movzx r8d, word [r14 + 4]
cmp r8d, r9d
jbe 0x140156ae3
mov r8d, r9d
jmp 0x140156ae3
mov r8d, 6
movsd xmm0, qword [r14 + 0x10]
lea r9, [rbp - 0x6f]
mov edx, r13d
lea r15, [rbp - 0x6f]
call fcn.1401d4c40
test al, al
jne 0x140156b03
mov byte [rbp - 0x6f], r12b
jmp 0x140156b57
mov rdx, qword [0x1402cdca8]
test rdx, rdx
je 0x140156b3a
movzx eax, byte [rbp - 0x6f]
lea rcx, [rbp - 0x6f]
test al, al
je 0x140156b3a
nop dword [rax + rax]
cmp al, 0x2e
je 0x140156b31
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140156b20
jmp 0x140156b3a
movzx eax, byte [0x1402c0518]
mov byte [rcx], al
bt r13d, 0x1d
jae 0x140156b57
lea rcx, [rbp - 0x6f]
test rdx, rdx
je 0x140156b52
call fcn.1401f29a0
jmp 0x140156b57
call fcn.1401f2940
mov r9d, dword ds:[r14]
bt r9d, 0xf
jae 0x140156bf1
movzx eax, byte [rbp - 0x6f]
lea rcx, [rbp - 0x6f]
movzx r8d, byte [0x1402c0518]
test al, al
je 0x140156b90
nop word [rax + rax]
cmp al, r8b
je 0x140156b90
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140156b80
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140156bf1
movzx eax, byte ds:[rcx]
test al, al
je 0x140156bb5
sub al, 0x45
test al, 0xdf
je 0x140156bb5
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140156ba4
movzx eax, byte ds:[rcx - 1]
mov rdi, rcx
dec rcx
cmp al, 0x30
jne 0x140156bcf
movzx eax, byte [rcx - 1]
dec rcx
cmp al, 0x30
je 0x140156bc4
cmp al, r8b
lea rdx, [rcx - 1]
cmovne rdx, rcx
nop word [rax + rax]
movzx eax, byte [rdi]
lea rdx, [rdx + 1]
mov byte [rdx], al
lea rdi, [rdi + 1]
test al, al
jne 0x140156be0
lea rax, [rbp - 0x6f]
mov r14, 0xffffffffffffffff
nop dword [rax]
inc r14
cmp byte [rax + r14], r12b
jne 0x140156c00
cmp byte [rbp - 0x6f], 0x2d
jne 0x140156c22
dec r14d
lea r15, [rbp - 0x6e]
xor ecx, ecx
mov r12d, 1
jmp 0x140156c33
bt r9d, 0x11
mov eax, 2
mov rcx, r12
cmovb r12d, eax
mov eax, r9d
and eax, 0x13000
cmp eax, 0x10000
jne 0x140156dee
movzx eax, byte [r15]
mov rbx, r15
sub al, 0x30
mov qword [rsp + 0x50], r15
cmp al, 0xa
jae 0x140156c6d
nop dword [rax]
movzx eax, byte [rbx + 1]
inc rbx
sub al, 0x30
cmp al, 0xa
jb 0x140156c60
mov r13d, ebx
sub r13d, r15d
lea edi, [r13 + 2]
je 0x140156c88
mov eax, 0xaaaaaaab
mul edi
mov eax, edx
shr eax, 1
dec eax
jmp 0x140156c8a
mov eax, ecx
mov r8, qword [rsp + 0x38]
lea ecx, [rax + r14]
add ecx, ecx
mov dword [rsp + 0x48], eax
test r12d, r12d
lea eax, [rcx + 2]
cmove eax, ecx
mov rcx, qword [rsp + 0x40]
add rcx, rax
cmp r8, rcx
jae 0x140156d3a
lea rax, [r8 + r8]
mov rdx, rcx
cmp rax, rcx
cmovae rdx, rax
mov qword [rsp + 0x38], rdx
lea rcx, [rdx + 0x12]
mov rdx, qword [0x1402ca998]
call sym.SystemInformer.exe_PhCreateObject
mov r8, qword [rsp + 0x38]
mov rsi, rax
xor edx, edx
mov qword [rax], r8
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x30]
mov word [rcx + r8], dx
mov r8, qword [rsp + 0x40]
mov rcx, qword [rsi + 8]
mov rdx, qword [rax + 8]
call fcn.14020af00
mov rcx, qword [rsp + 0x30]
mov edx, 0xffffffff
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140156d25
nop
call fcn.140141ea0
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsi + 8]
shr rcx, 1
mov qword [rsp + 0x30], rsi
lea rsi, [rax + rcx*2]
mov eax, 0xaaaaaaab
mov ecx, r13d
mul edi
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
test r12b, 1
je 0x140156d58
mov word [rsi], 0x2d
jmp 0x140156d63
test r12b, 2
je 0x140156d67
mov word [rsi], 0x2b
add rsi, 2
test r13d, r13d
je 0x140156db0
nop dword [rax]
movsx eax, byte [r15]
dec ecx
mov word [rsi], ax
inc r15
mov eax, edi
add rsi, 2
dec edi
test eax, eax
jne 0x140156dac
test ecx, ecx
je 0x140156db0
movzx eax, word [0x1402c1118]
dec ecx
mov word [rsi], ax
mov edi, 1
movsx eax, byte [r15]
mov word [rsi + 2], ax
add rsi, 4
inc r15
test ecx, ecx
jne 0x140156d70
mov r15, qword [rsp + 0x40]
test r12d, r12d
je 0x140156dbe
add r15, 2
sub r14d, r13d
mov r8, rsi
mov edx, r14d
mov rcx, rbx
mov edi, r14d
call sym.SystemInformer.exe_PhZeroExtendToUtf16Buffer
mov ecx, dword [rsp + 0x48]
lea rsi, [rsi + r14*2]
mov r14, qword [rsp + 0x58]
add ecx, r13d
add rcx, rdi
lea r15, [r15 + rcx*2]
jmp 0x1401573e7
test r12d, r12d
mov rdx, rcx
setne dl
mov rcx, rdx
bt r9d, 0x12
jae 0x140156e2d
mov r13, qword [rsp + 0x58]
mov edi, r14d
movzx r8d, word [r13 + 6]
lea rax, [rdi + rdx]
cmp rax, r8
jae 0x140156e2d
mov ecx, r8d
or r12d, 4
sub rcx, rdi
mov rax, rcx
sub rax, rdx
mov qword [rsp + 0x70], rax
mov r13, qword [rsp + 0x40]
mov r8, qword [rsp + 0x38]
mov r14d, r14d
lea rax, [r14 + rcx]
lea rbx, [rax*2]
add rbx, r13
cmp r8, rbx
jae 0x140156ec2
mov rdx, qword [0x1402ca998]
lea rax, [r8 + r8]
cmp rax, rbx
mov rsi, rbx
cmovae rsi, rax
mov qword [rsp + 0x38], rsi
lea rcx, [rsi + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor edx, edx
mov r8, r13
mov rdi, rax
mov qword [rax], rsi
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rsi], dx
mov rsi, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [rsi + 8]
call fcn.14020af00
lea rcx, [rsi - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140156eb2
call fcn.140141ea0
mov rax, qword [rdi + 8]
shr r13, 1
mov qword [rsp + 0x30], rdi
lea rsi, [rax + r13*2]
test r12b, 1
je 0x140156ecf
mov word [rsi], 0x2d
jmp 0x140156eda
test r12b, 2
je 0x140156ede
mov word [rsi], 0x2b
add rsi, 2
nop
test r12b, 4
je 0x140156f05
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x140156f01
mov eax, 0x30
mov rdi, rsi
movzx eax, ax
mov rcx, rdx
rep stosw word [rdi], ax
lea rsi, [rsi + rdx*2]
mov r8, rsi
mov rdx, r14
mov rcx, r15
call sym.SystemInformer.exe_PhZeroExtendToUtf16Buffer
lea rsi, [rsi + r14*2]
mov qword [rsp + 0x40], rbx
mov r14, qword [rsp + 0x58]
mov r15, rbx
jmp case.default.0x1401562d6
mov rdx, qword [r14 + 0x10]
xorps xmm0, xmm0
test rdx, rdx
js 0x140156f3c
cvtsi2sd xmm0, rdx
jmp 0x140156f54
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2sd xmm0, rcx
addsd xmm0, xmm0
test rdx, rdx
jne 0x140156ff5
mov r8, qword [rsp + 0x38]
lea rbx, [r15 + 2]
cmp r8, rbx
jae 0x140156fdf
mov rdx, qword [0x1402ca998]
lea rax, [r8 + r8]
cmp rax, rbx
mov rsi, rbx
cmovae rsi, rax
mov qword [rsp + 0x38], rsi
lea rcx, [rsi + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor edx, edx
mov r8, r15
mov rdi, rax
mov qword [rax], rsi
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rsi + rcx], dx
mov rsi, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [rsi + 8]
call fcn.14020af00
lea rcx, [rsi - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140156fcf
call fcn.140141ea0
mov rax, qword [rdi + 8]
shr r15, 1
mov qword [rsp + 0x30], rdi
lea rsi, [rax + r15*2]
mov word [rsi], 0x30
mov r15, rbx
add rsi, 2
mov qword [rsp + 0x40], rbx
jmp case.default.0x1401562d6
bt r13d, 8
jae 0x140157003
movzx eax, byte [r14 + 0xa]
jmp 0x140157009
mov eax, dword [0x1402c7300]
comisd xmm0, xmm6
jb 0x140157028
nop
cmp r12d, 7
jae 0x140157028
cmp r12d, eax
jae 0x140157028
mulsd xmm0, xmm7
inc r12d
comisd xmm0, xmm6
jae 0x140157010
test r13b, 0x40
je 0x140157035
movzx eax, word [r14 + 4]
jmp 0x140157038
mov eax, r10d
movzx r8d, ax
lea r14, [rbp - 0x6f]
cmp r8d, r9d
mov dword [rsp + 0x48], r11d
mov edx, 0x1804b
cmova r8d, r9d
lea r9, [rbp - 0x6f]
call fcn.1401d4c40
movzx r8d, word [0x1402c0518]
test al, al
jne 0x14015706d
xor dl, dl
mov byte [rbp - 0x6f], dl
jmp 0x14015709f
cmp qword [0x1402cdca8], 0
movzx edx, byte [rbp - 0x6f]
je 0x14015709f
lea rcx, ds:[rbp - 0x6f]
test dl, dl
je 0x14015709f
movzx eax, dl
cmp al, 0x2e
je 0x140157098
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140157087
jmp 0x14015709f
mov byte [rcx], r8b
movzx edx, byte [rbp - 0x6f]
lea rcx, [rbp - 0x6f]
test dl, dl
je 0x1401570c4
movzx eax, dl
nop word [rax + rax]
cmp al, r8b
je 0x1401570c4
movzx eax, byte ds:[rcx + 1]
inc rcx
test al, al
jne 0x1401570b0
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140157128
movzx eax, byte [rcx]
test al, al
je 0x1401570e6
sub al, 0x45
test al, 0xdf
je 0x1401570e6
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1401570d5
movzx eax, byte [rcx - 1]
mov rdi, rcx
dec rcx
cmp al, 0x30
jne 0x1401570ff
movzx eax, byte [rcx - 1]
dec rcx
cmp al, 0x30
je 0x1401570f4
cmp al, r8b
lea rdx, [rcx - 1]
cmovne rdx, rcx
nop word [rax + rax]
movzx eax, byte ds:[rdi]
lea rdx, [rdx + 1]
mov byte [rdx], al
lea rdi, [rdi + 1]
test al, al
jne 0x140157110
movzx edx, byte [rbp - 0x6f]
lea rax, [rbp - 0x6f]
mov r15, 0xffffffffffffffff
inc r15
cmp byte [rax + r15], 0
jne 0x140157133
nop dword [rax]
cmp dl, 0x2d
jne 0x140157159
mov r9d, 1
lea r14, [rbp - 0x6e]
mov dword [rsp + 0x48], r9d
dec r15d
jmp 0x14015715e
mov r9d, dword [rsp + 0x48]
movzx eax, byte [r14]
mov rbx, r14
sub al, 0x30
mov qword [rsp + 0x50], r14
cmp al, 0xa
jae 0x14015717d
movzx eax, byte [rbx + 1]
inc rbx
sub al, 0x30
cmp al, 0xa
jb 0x140157170
mov r8d, ebx
sub r8d, r14d
mov dword [rsp + 0x50], r8d
lea edi, [r8 + 2]
je 0x1401571a2
mov eax, 0xaaaaaaab
mul edi
mov r13d, edx
shr r13d, 1
dec r13d
jmp 0x1401571a7
xor eax, eax
mov r13d, eax
mov r10, qword [rsp + 0x40]
lea ecx, [r15 + r13]
add ecx, ecx
test r9d, r9d
lea eax, [rcx + 2]
cmove eax, ecx
mov ecx, eax
mov rax, qword [rsp + 0x38]
add rcx, r10
cmp rax, rcx
jae 0x140157267
add rax, rax
mov rdx, rcx
cmp rax, rcx
cmovae rdx, rax
mov qword [rsp + 0x38], rdx
lea rcx, [rdx + 0x12]
mov rdx, qword [0x1402ca998]
call sym.SystemInformer.exe_PhCreateObject
mov r8, qword ds:[rsp + 0x40]
mov rsi, rax
mov rax, qword [rsp + 0x38]
lea rcx, [rsi + 0x10]
xor edx, edx
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov word [rax + rcx], dx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsi + 8]
mov rdx, qword [rax + 8]
call fcn.14020af00
mov rcx, qword [rsp + 0x30]
mov edx, 0xffffffff
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140157245
nop dword [rax]
call fcn.140141ea0
mov r10, qword [rsp + 0x40]
mov rax, qword [rsi + 8]
mov rcx, r10
mov r8d, dword [rsp + 0x50]
mov r9d, dword [rsp + 0x48]
shr rcx, 1
mov qword [rsp + 0x30], rsi
lea rsi, [rax + rcx*2]
mov eax, 0xaaaaaaab
mov ecx, r8d
mul edi
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
test r9d, r9d
je 0x140157286
mov word [rsi], 0x2d
add rsi, 2
test r8d, r8d
je 0x1401572d0
nop dword [rax + rax]
movsx eax, byte [r14]
dec ecx
mov word [rsi], ax
inc r14
mov eax, edi
add rsi, 2
dec edi
test eax, eax
jne 0x1401572cc
test ecx, ecx
je 0x1401572d0
movzx eax, word [0x1402c1118]
dec ecx
mov word [rsi], ax
mov edi, 1
movsx eax, byte [r14]
mov word [rsi + 2], ax
add rsi, 4
inc r14
test ecx, ecx
jne 0x140157290
test r9d, r9d
je 0x1401572de
add r10, 2
mov qword [rsp + 0x40], r10
sub r15d, r8d
mov rcx, rbx
mov edx, r15d
mov r8, rsi
mov edi, r15d
call sym.SystemInformer.exe_PhZeroExtendToUtf16Buffer
mov ecx, dword [rsp + 0x50]
lea rbx, [rsi + r15*2]
mov rax, qword [rsp + 0x40]
lea r15, [0x140000000]
mov r8, qword [rsp + 0x38]
add ecx, r13d
add rcx, rdi
mov esi, r12d
add rsi, rsi
lea r14, [rax + rcx*2]
mov rcx, qword [r15 + rsi*8 + 0x2c5c70]
lea rax, [r14 + 2]
add rax, rcx
cmp r8, rax
jae 0x1401573aa
mov rdx, qword [0x1402ca998]
lea rbx, [rcx + 2]
lea rax, [r8 + r8]
add rbx, r14
cmp rax, rbx
cmovae rbx, rax
mov qword [rsp + 0x38], rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov rdi, rax
mov r8, r14
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
xor eax, eax
mov word [rbx + rcx], ax
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rdi + 8]
mov rdx, qword [rbx + 8]
call fcn.14020af00
lea rcx, [rbx - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140157397
call fcn.140141ea0
mov rax, qword [rdi + 8]
mov rcx, r14
shr rcx, 1
mov qword [rsp + 0x30], rdi
lea rbx, [rax + rcx*2]
mov word [rbx], 0x20
lea rcx, [rbx + 2]
mov r8, qword [r15 + rsi*8 + 0x2c5c70]
mov rdx, qword [r15 + rsi*8 + 0x2c5c78]
call fcn.14020af00
mov rcx, qword [r15 + rsi*8 + 0x2c5c70]
lea r15, [r14 + 2]
mov r14, qword [rsp + 0x58]
lea rax, [rcx + 2]
shr rax, 1
lea rsi, [rbx + rax*2]
add r15, rcx
mov qword [rsp + 0x40], r15
mov rdi, r15
sub rdi, qword [rsp + 0x78]
test dword [r14], 0xc0000000
je 0x14015751d
movzx ebx, word [r14 + 6]
add rbx, rbx
cmp rdi, rbx
jae 0x14015751d
mov r12, qword [rsp + 0x38]
sub rbx, rdi
lea r13, [rbx + r15]
cmp r12, r13
jae 0x1401574a0
mov rdx, qword [0x1402ca998]
lea rax, [r12 + r12]
cmp rax, r13
mov r12, r13
cmovae r12, rax
mov qword [rsp + 0x38], r12
lea rcx, [r12 + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov rsi, rax
mov r8, r15
mov qword [rax], r12
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
xor eax, eax
mov word [r12 + rcx], ax
mov r12, qword [rsp + 0x30]
mov rcx, qword [rsi + 8]
mov rdx, qword [r12 + 8]
call fcn.14020af00
lea rcx, [r12 - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140157490
call fcn.140141ea0
mov rax, qword [rsi + 8]
shr r15, 1
mov qword [rsp + 0x30], rsi
lea rsi, [rax + r15*2]
mov eax, dword [r14]
test al, al
jns 0x1401574ae
movzx r12d, word [r14 + 8]
jmp 0x1401574b4
mov r12d, 0x20
shr rbx, 1
test eax, eax
jns 0x1401574d8
nop dword [rax + rax]
test rbx, rbx
je 0x1401574d2
movzx eax, r12w
mov rdi, rsi
mov rcx, rbx
rep stosw word [rdi], ax
lea r14, [rbx + rbx]
jmp 0x140157512
lfence
mov rax, rdi
lea r14, [rbx + rbx]
shr rax, 1
mov r15, rsi
add rax, rax
mov r8, rdi
sub r15, rax
mov rdx, r15
lea rcx, [r15 + r14]
call fcn.14020af00
nop dword [rax]
test rbx, rbx
je 0x140157512
movzx eax, r12w
mov rdi, r15
mov rcx, rbx
rep stosw word [rdi], ax
add rsi, r14
mov qword [rsp + 0x40], r13
mov r15, r13
mov edi, dword [rsp + 0x6c]
lea r8, [0x140000000]
mov rbx, qword [rsp + 0x38]
mov edx, 1
mov r12, qword [rbp - 0x80]
mov r9d, 0xa2
mov r10d, 2
test edi, edi
jne 0x140156290
movaps xmm7, xmmword [rsp + 0x4a0]
movaps xmm6, xmmword [rsp + 0x4b0]
mov r14, qword [rsp + 0x4c0]
mov r13, qword [rsp + 0x508]
mov r11, qword [rsp + 0x30]
mov rcx, qword [r11 + 8]
mov qword [r11], r15
shr r15, 1
xor eax, eax
mov word [rcx + r15*2], ax
mov rax, r11
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.1401e4a20
add rsp, 0x4c8
pop r15
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret