Function at 0x4bbd80
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5e4
push ebx
push esi
push edi
push dword [0x54b7b4]
mov edi, 0x26
cmp dword [ebp + 0x10], edi
cmovae edi, dword [ebp + 0x10]
mov dword [esp + 0x1c], edi
lea eax, [edi + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov ecx, eax
xor edx, edx
lea eax, [ecx + 8]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov dword [ecx + 4], eax
mov dword [ecx], edi
mov word [eax + edi], dx
test byte [0x547e54], 1
mov ebx, dword [ecx + 4]
mov dword [esp + 0x28], ebx
jne 0x4bbee0
mov esi, 0x547e54
lock bts dword [esi], 0x1f
jae 0x4bbdff
test byte [0x547e54], 1
jne 0x4bbee0
mov ecx, esi
call sym.ProcessHacker.exe_PhfWaitForEvent
jmp 0x4bbede
push 4
lea eax, [esp + 0x64]
push eax
push 0xe
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4bbe3b
mov ax, word [esp + 0x60]
test ax, ax
je 0x4bbe3b
movzx ecx, word [0x547e5c]
cmp word [esp + 0x62], 0
movzx eax, ax
cmove ecx, eax
mov word [0x547e5c], cx
push 4
lea eax, [esp + 0x64]
push eax
push 0xf
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4bbe77
mov ax, word [esp + 0x60]
test ax, ax
je 0x4bbe77
movzx ecx, word [0x547e98]
cmp word [esp + 0x62], 0
movzx eax, ax
cmove ecx, eax
mov word [0x547e98], cx
cmp word [0x547e5c], 0x2e
je 0x4bbe95
push 0x52cd46
push 0
call fcn.004e3f89
add esp, 8
mov dword [0x54b460], eax
lock bts dword [esi], 0
jb 0x4bbede
mov esi, dword [0x547e58]
test esi, esi
je 0x4bbeaf
push 0
push esi
call dword [sym.imp.ntdll.dll_NtSetEvent]
mov eax, 0xfffffffe
mov ecx, 0x547e54
lock xadd dword [ecx], eax
shr eax, 1
and eax, 0x7fff
sub eax, 1
jne 0x4bbede
test esi, esi
je 0x4bbede
push esi
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [0x547e58], 0
xor edx, edx
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4bd029
fld qword [0x538050]
fld qword [0x537fe0]
mov dword [esp + 0x5c], 3
mov ecx, dword [ebp + 8]
dec eax
mov dword [ebp + 0xc], eax
mov eax, ecx
mov esi, eax
mov dword [esp + 0x50], edx
add eax, 0x18
mov dword [esp + 0x2c], esi
mov dword [ebp + 8], eax
mov dword [esp + 0x20], 0
mov eax, dword [esi]
mov dword [esp + 0x3c], eax
and eax, 0x3f
cmp eax, 0xc
ja case.default.0x4bbf32
jmp dword [eax*4 + 0x4bd044]
mov eax, dword [esp + 0x18]
lea edi, [edx + 2]
fstp st(1)
fstp st(0)
cmp eax, edi
jae 0x4bbfb2
push dword [0x54b7b4]
add eax, eax
mov ebx, edi
cmp eax, edi
cmovae ebx, eax
mov dword [esp + 0x1c], ebx
lea eax, [ebx + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov esi, eax
xor ecx, ecx
lea eax, [esi + 8]
mov dword [esi + 4], eax
mov dword [esi], ebx
mov word [eax + ebx], cx
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
push ebx
push dword [eax + 4]
push dword [esi + 4]
call fcn.004dd620
mov ecx, dword [esp + 0x20]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4bbfa2
call fcn.004a2a20
mov eax, dword [esi + 4]
shr ebx, 1
mov dword [esp + 0x14], esi
mov esi, dword [esp + 0x2c]
lea ebx, [eax + ebx*2]
mov ax, word [esi + 0x10]
mov edx, edi
mov word [ebx], ax
add ebx, 2
mov dword [esp + 0x28], ebx
mov dword [esp + 0x10], edx
jmp 0x4bcecc
mov eax, dword [esi + 0x10]
fstp st(1)
fstp st(0)
lea ecx, [eax + edx]
cmp edi, ecx
jae 0x4bc045
push dword [0x54b7b4]
lea eax, [edi + edi]
mov ebx, ecx
cmp eax, ecx
cmovae ebx, eax
mov dword [esp + 0x1c], ebx
lea eax, [ebx + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov edi, dword [esp + 0x14]
mov esi, eax
lea eax, [esi + 8]
xor ecx, ecx
mov dword [esi], ebx
mov dword [esi + 4], eax
mov word [eax + ebx], cx
mov ebx, dword [esp + 0x10]
push ebx
push dword [edi + 4]
push dword [esi + 4]
call fcn.004dd620
add esp, 0xc
lea ecx, [edi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4bc030
call fcn.004a2a20
mov eax, dword [esi + 4]
mov ecx, ebx
mov dword [esp + 0x14], esi
mov esi, dword [esp + 0x2c]
shr ecx, 1
lea ebx, [eax + ecx*2]
mov eax, dword [esi + 0x10]
push eax
push dword [esi + 0x14]
push ebx
call fcn.004dd620
mov eax, dword [esi + 0x10]
add esp, 0xc
mov edx, dword [esp + 0x10]
shr eax, 1
add edx, dword [esi + 0x10]
mov dword [esp + 0x10], edx
lea ebx, [ebx + eax*2]
mov dword [esp + 0x28], ebx
jmp 0x4bcecc
push dword [esi + 0x10]
fstp st(1)
fstp st(0)
call sym.ProcessHacker.exe_PhCountStringZ
mov ecx, dword [esp + 0x10]
lea esi, [eax + eax]
add ecx, esi
mov dword [esp + 0x1c], ecx
cmp edi, ecx
jae 0x4bc0f2
push dword [0x54b7b4]
lea eax, [edi + edi]
mov ebx, ecx
cmp eax, ecx
cmovae ebx, eax
mov dword [esp + 0x1c], ebx
lea eax, [ebx + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov edi, eax
xor ecx, ecx
lea eax, [edi + 8]
mov dword [edi + 4], eax
mov dword [edi], ebx
mov word [ebx + eax], cx
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
push ebx
push dword [eax + 4]
push dword [edi + 4]
call fcn.004dd620
mov ecx, dword [esp + 0x20]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4bc0e6
call fcn.004a2a20
mov eax, dword [edi + 4]
shr ebx, 1
mov dword [esp + 0x14], edi
lea ebx, [eax + ebx*2]
mov ecx, dword [esp + 0x2c]
push esi
push dword [ecx + 0x10]
push ebx
call fcn.004dd620
mov edx, dword [esp + 0x28]
add esp, 0xc
shr esi, 1
mov dword [esp + 0x10], edx
lea ebx, [ebx + esi*2]
mov dword [esp + 0x28], ebx
jmp 0x4bcecc
cmp dword [esp + 0x3c], 3
fstp st(1)
fstp st(0)
jne 0x4bc130
mov ecx, dword [esi + 0x14]
mov esi, dword [esi + 0x10]
mov dword [esp + 0x30], ecx
jmp 0x4bc149
mov ecx, dword [esi + 0x10]
mov esi, ecx
mov dword [esp + 0x30], ecx
lea edx, [esi + 1]
lea esp, [esp]
mov al, byte [esi]
inc esi
test al, al
jne 0x4bc140
sub esi, edx
push esi
push ecx
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeSize]
test eax, eax
js 0x4bcad6
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x54]
add ecx, eax
cmp edi, ecx
jae 0x4bc1dd
push dword [0x54b7b4]
lea eax, [edi + edi]
mov ebx, ecx
cmp eax, ecx
cmovae ebx, eax
mov dword [esp + 0x1c], ebx
lea eax, [ebx + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov edi, eax
xor ecx, ecx
lea eax, [edi + 8]
mov dword [edi + 4], eax
mov dword [edi], ebx
mov word [ebx + eax], cx
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
push ebx
push dword [eax + 4]
push dword [edi + 4]
call fcn.004dd620
mov ecx, dword [esp + 0x20]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4bc1c7
call fcn.004a2a20
mov eax, dword [edi + 4]
mov ecx, ebx
shr ecx, 1
mov dword [esp + 0x14], edi
lea ebx, [eax + ecx*2]
mov eax, dword [esp + 0x54]
mov dword [esp + 0x28], ebx
push esi
push dword [esp + 0x34]
push 0
push eax
push ebx
call dword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
test eax, eax
js 0x4bcad6
mov eax, dword [esp + 0x54]
mov edx, dword [esp + 0x10]
shr eax, 1
add edx, dword [esp + 0x54]
mov dword [esp + 0x10], edx
lea ebx, [ebx + eax*2]
mov dword [esp + 0x28], ebx
jmp 0x4bcecc
mov eax, dword [ecx + 0x10]
mov ecx, eax
shr ecx, 0x1f
mov dword [esp + 0x20], ecx
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
jmp 0x4bc22a
mov ecx, dword [esi + 0x10]
fstp st(1)
fstp st(0)
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x24], 0xa
test edx, 0x100
je 0x4bc254
mov al, byte [esi + 0xa]
cmp al, 2
jb 0x4bc254
cmp al, 0x45
ja 0x4bc254
movzx eax, al
mov dword [esp + 0x24], eax
test edx, 0x20000000
lea edi, [esp + 0x48e]
mov esi, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
mov eax, str.0123456789abcdefghijklmnopqrstuvwxyz_________._:_________
cmovne eax, esi
xor esi, esi
mov dword [esp + 0x30], eax
test ecx, ecx
je 0x4bc308
test edx, 0x10000
je 0x4bc2e6
xor eax, eax
mov dword [esp + 0x48], eax
lea ebx, [ebx]
mov eax, ecx
xor edx, edx
div dword [esp + 0x24]
inc esi
mov ecx, eax
mov eax, dword [esp + 0x30]
movsx ax, byte [eax + edx]
mov word [edi], ax
sub edi, 2
mov eax, dword [esp + 0x48]
inc eax
mov dword [esp + 0x48], eax
cmp eax, 3
jne 0x4bc2cf
test ecx, ecx
je 0x4bc2d3
mov ax, word [0x547e98]
inc esi
mov word [edi], ax
sub edi, 2
xor eax, eax
mov dword [esp + 0x48], eax
test ecx, ecx
jne 0x4bc290
mov edx, dword [esp + 0x3c]
xor ecx, ecx
cmp dword [esp + 0x20], ecx
je 0x4bc321
mov ecx, 1
jmp 0x4bc32f
mov ebx, eax
mov eax, ecx
xor edx, edx
div dword [esp + 0x24]
inc esi
mov ecx, eax
movsx ax, byte [ebx + edx]
mov word [edi], ax
sub edi, 2
test ecx, ecx
jne 0x4bc2e8
mov ebx, dword [esp + 0x28]
jmp 0x4bc2d3
mov eax, 0x30
lea edi, [esp + 0x48c]
mov word [esp + 0x48e], ax
lea esi, [eax - 0x2f]
jmp 0x4bc2d7
test edx, 0x20000
mov eax, 1
cmovne ecx, eax
and edx, 0x50000
cmp edx, 0x40000
jne 0x4bc35d
mov eax, dword [esp + 0x2c]
movzx edx, word [eax + 6]
lea eax, [ecx + esi]
cmp eax, edx
jae 0x4bc35d
or dword [esp + 0x20], 4
mov eax, edx
sub eax, ecx
sub eax, esi
mov dword [esp + 0x68], eax
add ecx, eax
lea eax, [ecx + esi]
add edi, 2
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], edi
lea ecx, [ecx + eax*2]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x30], ecx
cmp eax, ecx
jae 0x4bc3e7
push dword [0x54b7b4]
add eax, eax
mov edx, ecx
cmp eax, ecx
cmovae edx, eax
mov dword [esp + 0x1c], edx
lea eax, [edx + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov edx, dword [esp + 0x18]
mov ebx, eax
push dword [esp + 0x10]
lea eax, [ebx + 8]
xor ecx, ecx
mov dword [ebx + 4], eax
mov dword [ebx], edx
mov word [edx + eax], cx
mov eax, dword [esp + 0x18]
push dword [eax + 4]
push dword [ebx + 4]
call fcn.004dd620
mov ecx, dword [esp + 0x20]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4bc3d7
call fcn.004a2a20
mov ecx, dword [esp + 0x10]
mov eax, dword [ebx + 4]
shr ecx, 1
mov dword [esp + 0x14], ebx
lea ebx, [eax + ecx*2]
mov eax, dword [esp + 0x20]
test al, 1
je 0x4bc3f6
mov ecx, 0x2d
jmp 0x4bc407
mov ecx, dword [esp + 0x2c]
test dword [ecx], 0x20000
je 0x4bc40d
mov ecx, 0x2b
mov word [ebx], cx
add ebx, 2
test al, 4
je 0x4bc432
mov edx, dword [esp + 0x68]
test edx, edx
je 0x4bc42f
mov ecx, edx
mov eax, 0x300030
shr ecx, 1
mov edi, ebx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x1c]
lea ebx, [ebx + edx*2]
add esi, esi
push esi
push edi
push ebx
call fcn.004dd620
mov edx, dword [esp + 0x3c]
add esp, 0xc
add ebx, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x28], ebx
jmp 0x4bcecc
mov ecx, dword [esi + 0x10]
fstp st(1)
mov esi, dword [esi + 0x14]
fstp st(0)
mov dword [esp + 0x48], ecx
test esi, esi
jg 0x4bc489
jl 0x4bc46a
test ecx, ecx
jae 0x4bc489
neg ecx
mov dword [esp + 0x20], 1
adc esi, 0
neg esi
jmp 0x4bc485
mov ecx, dword [esi + 0x10]
fstp st(1)
mov esi, dword [esi + 0x14]
fstp st(0)
mov dword [esp + 0x48], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x24], 0xa
mov dword [esp + 0x44], 0
test edx, 0x100
je 0x4bc4e4
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x24], 0xa
mov dword [esp + 0x44], 0
mov al, byte [eax + 0xa]
cmp al, 2
jb 0x4bc4e4
mov dword [esp + 0x24], 0xa
mov dword [esp + 0x44], 0
cmp al, 0x45
ja 0x4bc4e4
movzx eax, al
cdq
mov dword [esp + 0x44], edx
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x24], eax
test edx, 0x20000000
mov dword [esp + 0x40], 0
mov edi, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
mov eax, str.0123456789abcdefghijklmnopqrstuvwxyz_________._:_________
cmovne eax, edi
lea edi, [esp + 0x48e]
mov dword [esp + 0x1c], eax
mov eax, ecx
or eax, esi
je 0x4bc5e9
mov ebx, dword [esp + 0x48]
test edx, 0x10000
je 0x4bc5b0
xor eax, eax
mov dword [esp + 0x30], eax
lea ebx, [ebx]
push ebx
push dword [esp + 0x48]
push dword [esp + 0x2c]
push esi
push ebx
call fcn.004f8700
mov dword [esp + 0x50], ebx
pop ebx
mov ebx, eax
mov esi, edx
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x40]
inc edx
mov dword [esp + 0x40], edx
movsx ax, byte [eax + ecx]
mov ecx, dword [esp + 0x30]
inc ecx
mov dword [esp + 0x30], ecx
mov word [edi], ax
sub edi, 2
cmp ecx, 3
jne 0x4bc58c
mov eax, ebx
or eax, esi
je 0x4bc592
mov ax, word [0x547e98]
inc edx
mov word [edi], ax
sub edi, 2
xor eax, eax
mov dword [esp + 0x40], edx
mov dword [esp + 0x30], eax
mov eax, ebx
or eax, esi
jne 0x4bc530
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x3c]
xor ecx, ecx
cmp dword [esp + 0x20], ecx
je 0x4bc608
mov ecx, 1
jmp 0x4bc615
push ebx
push dword [esp + 0x48]
push dword [esp + 0x2c]
push esi
push ebx
call fcn.004f8700
mov dword [esp + 0x38], ebx
pop ebx
mov ebx, eax
mov esi, edx
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x40]
inc edx
mov dword [esp + 0x40], edx
movsx ax, byte [eax + ecx]
mov word [edi], ax
mov eax, ebx
sub edi, 2
or eax, esi
jne 0x4bc5b0
jmp 0x4bc592
mov eax, 0x30
lea edi, [esp + 0x48c]
mov edx, 1
mov word [esp + 0x48e], ax
mov dword [esp + 0x40], edx
jmp 0x4bc596
test eax, 0x20000
mov esi, 1
cmovne ecx, esi
and eax, 0x50000
cmp eax, 0x40000
jne 0x4bc641
mov eax, dword [esp + 0x2c]
movzx esi, word [eax + 6]
lea eax, [ecx + edx]
cmp eax, esi
jae 0x4bc641
or dword [esp + 0x20], 4
mov eax, esi
sub eax, ecx
sub eax, edx
mov dword [esp + 0x6c], eax
add ecx, eax
lea eax, [ecx + edx]
add edi, 2
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], edi
lea ecx, [ecx + eax*2]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x30], ecx
cmp eax, ecx
jae 0x4bc6c8
push dword [0x54b7b4]
add eax, eax
mov ebx, ecx
cmp eax, ecx
cmovae ebx, eax
mov dword [esp + 0x1c], ebx
lea eax, [ebx + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov esi, eax
xor ecx, ecx
lea eax, [esi + 8]
mov dword [esi + 4], eax
mov dword [esi], ebx
mov word [ebx + eax], cx
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
push ebx
push dword [eax + 4]
push dword [esi + 4]
call fcn.004dd620
mov ecx, dword [esp + 0x20]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4bc6b8
call fcn.004a2a20
mov eax, dword [esi + 4]
mov edx, dword [esp + 0x40]
shr ebx, 1
mov dword [esp + 0x14], esi
lea ebx, [eax + ebx*2]
mov eax, dword [esp + 0x20]
test al, 1
je 0x4bc6d7
mov ecx, 0x2d
jmp 0x4bc6e8
mov ecx, dword [esp + 0x2c]
test dword [ecx], 0x20000
je 0x4bc6ee
mov ecx, 0x2b
mov word [ebx], cx
add ebx, 2
test al, 4
je 0x4bc713
mov esi, dword [esp + 0x6c]
test esi, esi
je 0x4bc710
mov ecx, esi
mov eax, 0x300030
shr ecx, 1
mov edi, ebx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x1c]
lea ebx, [ebx + esi*2]
lea esi, [edx + edx]
push esi
push edi
push ebx
call fcn.004dd620
mov edx, dword [esp + 0x3c]
add esp, 0xc
add ebx, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x28], ebx
jmp 0x4bcecc
mov edx, dword [esp + 0x3c]
fstp st(1)
mov dword [esp + 0x20], 0
fstp st(0)
test dl, 0x40
je 0x4bc75b
movzx eax, word [esi + 4]
cmp eax, 0xa2
jbe 0x4bc760
mov eax, 0xa2
jmp 0x4bc760
mov eax, 6
test edx, 0x1000
je 0x4bc76f
mov ecx, 0x65
jmp 0x4bc782
test edx, 0x2000
mov ecx, 0x66
mov edi, 0x61
cmovne ecx, edi
push dword [0x54b460]
fld qword [esi + 0x10]
lea edi, [esp + 0x95]
push 0
push 0
push eax
test edx, 0x20000000
mov dword [esp + 0x34], edi
lea eax, [ecx - 0x20]
cmove eax, ecx
push eax
push 0x15e
lea eax, [esp + 0x4a8]
push eax
push 0x3ff
mov eax, edi
push eax
lea eax, [esp + 0xa4]
push eax
fstp qword [esp + 0xa8]
call fcn.004e5643
mov edx, dword [esi]
add esp, 0x28
test edx, 0x8000
je 0x4bc7e7
mov ecx, edi
call fcn.004bbcf0
mov edx, dword [esi]
lea esi, [esp + 0x91]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4bc7f1
sub esi, ecx
cmp byte [esp + 0x91], 0x2d
mov dword [esp + 0x1c], esi
jne 0x4bc823
mov edi, 1
lea ecx, [esp + 0x92]
dec esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], esi
jmp 0x4bc840
test edx, 0x20000
je 0x4bc83a
mov ecx, dword [esp + 0x24]
mov edi, 2
mov dword [esp + 0x20], edi
jmp 0x4bc840
mov ecx, edi
mov edi, dword [esp + 0x20]
mov eax, edx
and eax, 0x13000
cmp eax, 0x10000
jne 0x4bc9c6
mov al, byte [ecx]
mov edi, ecx
sub al, 0x30
cmp al, 0xa
jae 0x4bc86a
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
sub al, 0x30
cmp al, 0xa
jb 0x4bc860
mov eax, edi
sub eax, ecx
mov dword [esp + 0x30], eax
je 0x4bc885
lea ecx, [eax + 2]
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
shr eax, 1
dec eax
jmp 0x4bc887
xor eax, eax
lea ecx, [eax + esi]
mov dword [esp + 0x48], eax
add ecx, ecx
cmp dword [esp + 0x20], 0
lea eax, [ecx + 2]
cmove eax, ecx
mov ecx, dword [esp + 0x10]
add ecx, eax
mov eax, dword [esp + 0x18]
cmp eax, ecx
jae 0x4bc916
push dword [0x54b7b4]
add eax, eax
mov edx, ecx
cmp eax, ecx
cmovae edx, eax
mov dword [esp + 0x1c], edx
lea eax, [edx + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov edx, dword [esp + 0x18]
mov ebx, eax
push dword [esp + 0x10]
lea eax, [ebx + 8]
xor ecx, ecx
mov dword [ebx + 4], eax
mov dword [ebx], edx
mov word [edx + eax], cx
mov eax, dword [esp + 0x18]
push dword [eax + 4]
push dword [ebx + 4]
call fcn.004dd620
mov ecx, dword [esp + 0x20]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4bc906
call fcn.004a2a20
mov ecx, dword [esp + 0x10]
mov eax, dword [ebx + 4]
shr ecx, 1
mov dword [esp + 0x14], ebx
lea ebx, [eax + ecx*2]
mov eax, dword [esp + 0x30]
xor edx, edx
mov ecx, eax
add eax, 2
div dword [esp + 0x5c]
mov eax, dword [esp + 0x20]
test al, 1
je 0x4bc934
mov eax, 0x2d
jmp 0x4bc93d
test al, 2
je 0x4bc943
mov eax, 0x2b
mov word [ebx], ax
add ebx, 2
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4bc986
mov esi, dword [esp + 0x24]
nop
movsx ax, byte [esi]
lea esi, [esi + 1]
dec ecx
mov word [ebx], ax
mov eax, edx
add ebx, 2
dec edx
test eax, eax
jne 0x4bc97a
test ecx, ecx
je 0x4bc97e
mov ax, word [0x547e98]
mov edx, 2
mov word [ebx], ax
add ebx, 2
test ecx, ecx
jne 0x4bc950
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x30]
mov edx, esi
mov dword [esp + 0x1c], ebx
sub edx, eax
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x20], 0
lea ecx, [eax + 2]
cmove ecx, eax
lea ebx, [ebx + edx*2]
mov eax, dword [esp + 0x48]
add eax, esi
mov dword [esp + 0x28], ebx
lea eax, [ecx + eax*2]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
push eax
push edx
push edi
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
mov edx, dword [esp + 0x10]
jmp 0x4bcecc
xor ecx, ecx
test edi, edi
setne cl
mov edi, ecx
test edx, 0x40000
je 0x4bc9f8
mov eax, dword [esp + 0x2c]
movzx edx, word [eax + 6]
lea eax, [ecx + esi]
cmp eax, edx
jae 0x4bc9f8
or dword [esp + 0x20], 4
mov eax, edx
sub eax, ecx
sub eax, esi
mov dword [esp + 0x58], eax
lea edi, [ecx + eax]
mov ecx, dword [esp + 0x10]
lea eax, [edi + esi]
lea edx, [ecx + eax*2]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], edx
cmp eax, edx
jae 0x4bca78
push dword [0x54b7b4]
add eax, eax
mov ebx, edx
cmp eax, edx
cmovae ebx, eax
mov dword [esp + 0x1c], ebx
lea eax, [ebx + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov edi, eax
xor ecx, ecx
lea eax, [edi + 8]
mov dword [edi + 4], eax
mov dword [edi], ebx
mov word [ebx + eax], cx
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
push ebx
push dword [eax + 4]
push dword [edi + 4]
call fcn.004dd620
mov ecx, dword [esp + 0x20]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4bca68
call fcn.004a2a20
mov eax, dword [edi + 4]
mov edx, dword [esp + 0x1c]
shr ebx, 1
mov dword [esp + 0x14], edi
lea ebx, [eax + ebx*2]
mov eax, dword [esp + 0x20]
test al, 1
je 0x4bca87
mov ecx, 0x2d
jmp 0x4bca90
test al, 2
je 0x4bca96
mov ecx, 0x2b
mov word [ebx], cx
add ebx, 2
test al, 4
je 0x4bcabb
mov eax, dword [esp + 0x58]
test eax, eax
je 0x4bcab8
mov ecx, eax
mov edi, ebx
shr ecx, 1
mov eax, 0x300030
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov eax, dword [esp + 0x58]
lea ebx, [ebx + eax*2]
mov edi, dword [esp + 0x24]
mov eax, ebx
mov dword [esp + 0x10], edx
lea ebx, [ebx + esi*2]
push eax
mov edx, esi
mov dword [esp + 0x2c], ebx
push edx
push edi
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
mov edx, dword [esp + 0x10]
jmp 0x4bcecc
mov eax, dword [esp + 0x2c]
xor edi, edi
mov esi, dword [esi + 0x10]
mov dword [esp + 0x70], esi
mov dword [esp + 0x78], edi
mov edx, dword [eax + 0x14]
mov eax, edx
mov ecx, edx
and eax, 0x7fffffff
and ecx, 0x80000000
mov dword [esp + 0x74], eax
or esi, edx
mov dword [esp + 0x7c], ecx
fild qword [esp + 0x70]
fild qword [esp + 0x78]
fchs
faddp st(1)
jne 0x4bcbb3
mov edi, dword [esp + 0x10]
fstp st(0)
mov eax, dword [esp + 0x18]
add edi, 2
fstp st(1)
fstp st(0)
cmp eax, edi
jae 0x4bcb99
push dword [0x54b7b4]
add eax, eax
mov ebx, edi
cmp eax, edi
cmovae ebx, eax
mov dword [esp + 0x1c], ebx
lea eax, [ebx + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov esi, eax
xor ecx, ecx
lea eax, [esi + 8]
mov dword [esi + 4], eax
mov dword [esi], ebx
mov word [eax + ebx], cx
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
push ebx
push dword [eax + 4]
push dword [esi + 4]
call fcn.004dd620
mov ecx, dword [esp + 0x20]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4bcb8d
call fcn.004a2a20
mov eax, dword [esi + 4]
shr ebx, 1
mov dword [esp + 0x14], esi
lea ebx, [eax + ebx*2]
mov eax, 0x30
mov edx, edi
mov word [ebx], ax
add ebx, 2
mov dword [esp + 0x28], ebx
mov dword [esp + 0x10], edx
jmp 0x4bcecc
mov edx, dword [esp + 0x3c]
mov esi, dword [esp + 0x2c]
test edx, 0x100
je 0x4bcbc9
movzx ecx, byte [esi + 0xa]
jmp 0x4bcbcf
mov ecx, dword [0x5484ac]
fcomi st(2)
jb 0x4bcbe3
cmp edi, 7
jae 0x4bcbe3
cmp edi, ecx
jae 0x4bcbe3
fmul st(1)
inc edi
fcomi st(2)
jae 0x4bcbd3
fstp st(2)
fstp st(0)
test dl, 0x40
je 0x4bcbf2
movzx eax, word [esi + 4]
jmp 0x4bcbf7
mov eax, 2
push dword [0x54b460]
movzx eax, ax
mov ecx, 0xa2
push 0
cmp eax, 0xa2
mov dword [esp + 0x50], 0
push 0
cmova eax, ecx
lea ecx, [esp + 0x9d]
push eax
push 0x66
push 0x15e
lea eax, [esp + 0x4a8]
mov dword [esp + 0x48], ecx
push eax
mov eax, ecx
push 0x3ff
push eax
lea eax, [esp + 0xac]
push eax
fstp qword [esp + 0xb0]
call fcn.004e5643
add esp, 0x28
lea ecx, [esp + 0x91]
call fcn.004bbcf0
lea esi, [esp + 0x91]
lea ecx, [esi + 1]
lea esp, [esp]
mov al, byte [esi]
inc esi
test al, al
jne 0x4bcc70
sub esi, ecx
cmp byte [esp + 0x91], 0x2d
mov dword [esp + 0x44], esi
jne 0x4bcca1
lea edx, [esp + 0x92]
mov dword [esp + 0x48], 1
dec esi
mov dword [esp + 0x30], edx
mov dword [esp + 0x44], esi
jmp 0x4bcca5
mov edx, dword [esp + 0x30]
mov al, byte [edx]
mov ecx, edx
sub al, 0x30
mov dword [esp + 0x1c], edx
cmp al, 0xa
jae 0x4bccc1
mov al, byte [ecx + 1]
inc ecx
sub al, 0x30
cmp al, 0xa
jb 0x4bccb3
mov dword [esp + 0x1c], ecx
mov eax, ecx
sub eax, edx
mov dword [esp + 0x24], eax
je 0x4bccdc
lea ecx, [eax + 2]
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
shr eax, 1
dec eax
jmp 0x4bccde
xor eax, eax
lea ecx, [eax + esi]
mov dword [esp + 0x40], eax
add ecx, ecx
cmp dword [esp + 0x48], 0
lea eax, [ecx + 2]
cmove eax, ecx
mov ecx, dword [esp + 0x10]
add ecx, eax
mov eax, dword [esp + 0x18]
cmp eax, ecx
jae 0x4bcd6d
push dword [0x54b7b4]
add eax, eax
mov edx, ecx
cmp eax, ecx
cmovae edx, eax
mov dword [esp + 0x1c], edx
lea eax, [edx + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov ecx, dword [esp + 0x18]
mov ebx, eax
push dword [esp + 0x10]
lea eax, [ebx + 8]
xor edx, edx
mov dword [ebx + 4], eax
mov dword [ebx], ecx
mov word [eax + ecx], dx
mov eax, dword [esp + 0x18]
push dword [eax + 4]
push dword [ebx + 4]
call fcn.004dd620
mov ecx, dword [esp + 0x20]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4bcd5d
call fcn.004a2a20
mov ecx, dword [esp + 0x10]
mov eax, dword [ebx + 4]
shr ecx, 1
mov dword [esp + 0x14], ebx
lea ebx, [eax + ecx*2]
mov eax, dword [esp + 0x24]
xor edx, edx
mov ecx, eax
add eax, 2
div dword [esp + 0x5c]
cmp dword [esp + 0x48], 0
je 0x4bcd8e
mov eax, 0x2d
mov word [ebx], ax
add ebx, 2
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4bcdd6
mov esi, dword [esp + 0x30]
lea ebx, [ebx]
movsx ax, byte [esi]
lea esi, [esi + 1]
dec ecx
mov word [ebx], ax
mov eax, edx
add ebx, 2
dec edx
test eax, eax
jne 0x4bcdca
test ecx, ecx
je 0x4bcdce
mov ax, word [0x547e98]
mov edx, 2
mov word [ebx], ax
add ebx, 2
test ecx, ecx
jne 0x4bcda0
mov esi, dword [esp + 0x44]
mov eax, dword [esp + 0x24]
push ebx
sub esi, eax
push esi
push dword [esp + 0x24]
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
mov eax, dword [esp + 0x10]
lea esi, [ebx + esi*2]
cmp dword [esp + 0x48], 0
mov edx, dword [esp + 0x18]
lea ecx, [eax + 2]
cmove ecx, eax
mov eax, dword [esp + 0x44]
add eax, dword [esp + 0x40]
lea ebx, [ecx + eax*2]
mov ecx, dword [edi*8 + 0x547e60]
lea eax, [ebx + 2]
mov dword [esp + 0x1c], ebx
add eax, ecx
cmp edx, eax
jae 0x4bce84
push dword [0x54b7b4]
add ecx, 2
lea eax, [edx + edx]
add ecx, ebx
cmp eax, ecx
cmovae ecx, eax
mov dword [esp + 0x1c], ecx
lea eax, [ecx + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov ecx, dword [esp + 0x18]
mov esi, eax
lea eax, [esi + 8]
xor edx, edx
push ebx
mov dword [esi + 4], eax
mov dword [esi], ecx
mov word [eax + ecx], dx
mov eax, dword [esp + 0x18]
push dword [eax + 4]
push dword [esi + 4]
call fcn.004dd620
mov ecx, dword [esp + 0x20]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4bce76
call fcn.004a2a20
mov eax, dword [esi + 4]
mov ecx, ebx
shr ecx, 1
mov dword [esp + 0x14], esi
lea esi, [eax + ecx*2]
mov eax, 0x20
mov word [esi], ax
lea eax, [esi + 2]
push dword [edi*8 + 0x547e60]
push dword [edi*8 + 0x547e64]
push eax
call fcn.004dd620
mov ecx, dword [edi*8 + 0x547e60]
add esp, 0xc
mov edx, dword [esp + 0x1c]
add edx, 2
lea eax, [ecx + 2]
shr eax, 1
add edx, ecx
mov dword [esp + 0x10], edx
lea ebx, [esi + eax*2]
mov dword [esp + 0x28], ebx
jmp 0x4bcecc
fstp st(1)
fstp st(0)
mov ecx, dword [esp + 0x2c]
mov edi, edx
sub edi, dword [esp + 0x50]
mov eax, dword [ecx]
test eax, 0xc0000000
je 0x4bd00a
movzx esi, word [ecx + 6]
add esi, esi
cmp edi, esi
jae 0x4bd00a
sub esi, edi
lea ecx, [esi + edx]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x48], ecx
cmp edx, ecx
jae 0x4bcf78
push dword [0x54b7b4]
lea eax, [edx + edx]
mov edx, ecx
cmp eax, ecx
cmovae edx, eax
mov dword [esp + 0x1c], edx
lea eax, [edx + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov ecx, dword [esp + 0x18]
mov ebx, eax
push dword [esp + 0x10]
lea eax, [ebx + 8]
xor edx, edx
mov dword [ebx + 4], eax
mov dword [ebx], ecx
mov word [ecx + eax], dx
mov eax, dword [esp + 0x18]
push dword [eax + 4]
push dword [ebx + 4]
call fcn.004dd620
mov ecx, dword [esp + 0x20]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4bcf60
call fcn.004a2a20
mov ecx, dword [esp + 0x10]
mov eax, dword [ebx + 4]
shr ecx, 1
mov dword [esp + 0x14], ebx
lea ebx, [eax + ecx*2]
mov ecx, dword [esp + 0x2c]
mov eax, dword [ecx]
jmp 0x4bcf7c
mov ecx, dword [esp + 0x2c]
test al, al
jns 0x4bcf86
movzx edx, word [ecx + 8]
jmp 0x4bcf8b
mov edx, 0x20
shr esi, 1
mov dword [esp + 0x1c], edx
test eax, eax
jns 0x4bcfb6
test esi, esi
je 0x4bcfb2
mov eax, edx
mov ecx, esi
movzx edx, ax
mov edi, ebx
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
add esi, esi
jmp 0x4bcffc
mov eax, edi
mov ecx, ebx
and eax, 0xfffffffe
sub ecx, eax
lea eax, [esi + esi]
push edi
mov dword [esp + 0x34], eax
add eax, ecx
push ecx
push eax
mov dword [esp + 0x5c], ecx
call fcn.004ddca0
add esp, 0xc
test esi, esi
je 0x4bcff8
mov eax, dword [esp + 0x1c]
mov ecx, esi
mov edi, dword [esp + 0x50]
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov esi, dword [esp + 0x30]
mov edx, dword [esp + 0x48]
add ebx, esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x10], edx
mov eax, dword [ebp + 0xc]
fld qword [0x538050]
fld qword [0x537fe0]
mov edi, dword [esp + 0x18]
test eax, eax
jne 0x4bbeff
fstp st(1)
fstp st(0)
mov eax, dword [esp + 0x14]
pop edi
mov ecx, dword [eax + 4]
mov dword [eax], edx
shr edx, 1
xor esi, esi
mov word [ecx + edx*2], si
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc