Function at 0x4e7900
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x4b4
mov eax, dword [0x5c7004]
xor eax, esp
mov dword [esp + 0x4b0], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
push ebx
push esi
xor esi, esi
mov dword [esp + 0x70], eax
mov eax, dword [ebp + 0x10]
test eax, eax
push edi
mov edi, eax
mov dword [esp + 0x8c], eax
sete bl
mov dword [esp + 0x68], ecx
test byte [0x5cb8b0], 1
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], esi
jne 0x4e7a61
mov eax, 0x5cb8b0
lock bts dword ds:[eax], 0x1f
jb 0x4e7b10
push 4
lea eax, [esp + 0xb4]
push eax
push 0xe
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea ecx, [ecx]
test eax, eax
je 0x4e79ad
mov ax, word [esp + 0xb0]
test ax, ax
je 0x4e79ad
movzx ecx, word [0x5cb8b8]
cmp word [esp + 0xb2], si
movzx eax, ax
cmove ecx, eax
mov word [0x5cb8b8], cx
push 4
lea eax, [esp + 0xb4]
push eax
push 0xf
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4e79f3
mov ax, word [esp + 0xb0]
test ax, ax
je 0x4e79f3
movzx ecx, word [0x5cb8f8]
cmp word [esp + 0xb2], si
movzx eax, ax
cmove ecx, eax
mov word [0x5cb8f8], cx
cmp word [0x5cb8b8], 0x2e
je 0x4e7a11
push 0x5621e4
push 0
call fcn.0053fcde
add esp, 8
mov dword [0x5cf33c], eax
mov eax, 0x5cb8b0
lock bts dword [eax], 0
jb 0x4e7a61
mov esi, dword [0x5cb8b4]
test esi, esi
je 0x4e7a30
push 0
push esi
call dword [sym.imp.ntdll.dll_NtSetEvent]
mov eax, 0xfffffffe
mov ecx, 0x5cb8b0
lock xadd dword [ecx], eax
shr eax, 1
and eax, 0x7fff
sub eax, 1
jne 0x4e7a5f
test esi, esi
je 0x4e7a5f
push esi
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [0x5cb8b4], 0
xor esi, esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
test eax, eax
je 0x4e8ab3
fld qword [0x5b96e0]
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x7c], ecx
mov ecx, dword [esp + 0x68]
fst qword [esp + 0xa0]
fld qword [0x5b9670]
mov byte [esp + 0x2f], bl
mov bx, word [0x5cb8f8]
mov dword [esp + 0x84], ecx
mov ecx, dword [esp + 0x68]
fst qword [esp + 0xa8]
mov dword [esp + 0x80], 1
mov dword [esp + 0x88], 3
mov word [esp + 0x42], bx
mov dword [esp + 0x6c], ecx
mov ebx, dword ds:[esp + 0x74]
dec eax
mov dword [esp + 0xb0], eax
mov edx, ebx
mov eax, ebx
mov dword [esp + 0x70], esi
mov ecx, ebx
mov dword [esp + 0x44], eax
add ebx, 0x18
mov dword [esp + 0x38], 0
mov dword [esp + 0x74], ebx
mov ebx, dword [eax]
mov eax, ebx
and eax, 0x3f
mov dword [esp + 0x4c], ebx
cmp eax, 0xc
ja case.default.0x4e7b09
jmp dword [eax*4 + 0x4e8b04]
test byte [0x5cb8b0], 1
jne 0x4e7a61
xor edx, edx
mov ecx, eax
call sym.ProcessHacker.exe_PhfWaitForEvent
jmp 0x4e7a61
cmp byte [esp + 0x2f], 0
fstp st(1)
fstp st(0)
jne 0x4e7b61
lea eax, [esi + 2]
cmp dword [ebp + 0x14], eax
jae 0x4e7b56
add edi, 2
mov byte [esp + 0x2f], 1
add esi, 2
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], esi
jmp 0x4e89ba
mov eax, dword [esp + 0x44]
mov ax, word [eax + 0x10]
mov word [edi], ax
add edi, 2
add esi, 2
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], esi
jmp 0x4e89ba
cmp byte [esp + 0x2f], 0
fstp st(1)
mov ebx, dword [esp + 0x44]
fstp st(0)
jne 0x4e7ba2
mov ecx, dword [ebx + 0x10]
lea eax, [ecx + esi]
cmp dword [ebp + 0x14], eax
jae 0x4e7b95
mov byte [esp + 0x2f], 1
jmp 0x4e7ba2
push ecx
push dword [ebx + 0x14]
push edi
call fcn.00537fe0
add esp, 0xc
mov eax, dword [ebx + 0x10]
shr eax, 1
add esi, dword [ebx + 0x10]
mov dword [esp + 0x30], esi
lea edi, [edi + eax*2]
mov dword [esp + 0x34], edi
jmp 0x4e89ba
mov eax, dword [esp + 0x44]
fstp st(1)
fstp st(0)
push dword [eax + 0x10]
call sym.ProcessHacker.exe_PhCountStringZ
cmp byte [esp + 0x2f], 0
mov ebx, dword [esp + 0x30]
lea esi, [eax + eax]
jne 0x4e7bfd
lea eax, ds:[esi + ebx]
cmp dword [ebp + 0x14], eax
jae 0x4e7bec
mov byte [esp + 0x2f], 1
jmp 0x4e7bfd
mov eax, dword [esp + 0x44]
push esi
push dword [eax + 0x10]
push edi
call fcn.00537fe0
add esp, 0xc
mov eax, esi
shr eax, 1
add ebx, esi
mov dword [esp + 0x30], ebx
lea edi, [edi + eax*2]
mov ax, word [0x5cb8f8]
mov dword [esp + 0x34], edi
mov word [esp + 0x42], ax
mov esi, dword ds:[esp + 0x30]
jmp 0x4e89ba
fstp st(1)
fstp st(0)
cmp ebx, 3
jne 0x4e7c3a
mov eax, dword [esp + 0x44]
mov esi, dword [ecx + 0x10]
mov ebx, dword [eax + 0x14]
jmp 0x4e7c4b
mov ebx, dword [ecx + 0x10]
mov esi, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4e7c42
sub esi, ecx
push esi
push ebx
lea eax, [esp + 0x80]
push eax
call dword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeSize]
jmp 0x4e7c60
test eax, eax
js 0x4e85b4
cmp byte [esp + 0x2f], 0
jne 0x4e7c9c
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x78]
add eax, ecx
cmp dword [ebp + 0x14], eax
jae 0x4e7c85
mov byte [esp + 0x2f], 1
jmp 0x4e7ca0
push esi
push ebx
push 0
push ecx
push edi
lfence
call dword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
test eax, eax
js 0x4e85b4
mov ecx, dword [esp + 0x78]
mov esi, dword [esp + 0x30]
mov eax, ecx
shr eax, 1
add esi, ecx
mov dword [esp + 0x30], esi
lea edi, [edi + eax*2]
mov ax, word [0x5cb8f8]
mov dword [esp + 0x34], edi
mov word [esp + 0x42], ax
jmp 0x4e89ba
mov eax, dword [edx + 0x10]
mov ebx, eax
cdq
shr ebx, 0x1f
mov ecx, eax
mov eax, dword [esp + 0x44]
xor ecx, edx
mov dword [esp + 0x38], ebx
sub ecx, edx
mov ebx, dword [esp + 0x4c]
jmp 0x4e7ce9
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x10]
fstp st(1)
fstp st(0)
mov dword [esp + 0x54], 0xa
test ebx, 0x100
je 0x4e7d0f
mov dl, byte [eax + 0xa]
mov al, dl
sub al, 2
cmp al, 0x43
ja 0x4e7d0f
movzx eax, dl
mov dword [esp + 0x54], eax
test ebx, 0x20000000
mov eax, str.0123456789abcdefghijklmnopqrstuvwxyz_________._:_________
mov edx, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
lea ebx, [esp + 0x4b6]
cmovne eax, edx
xor esi, esi
mov dword [esp + 0x60], eax
test ecx, ecx
je 0x4e7dc8
test dword ds:[esp + 0x4c], 0x10000
je 0x4e7d98
xor eax, eax
mov dword [esp + 0x48], eax
mov eax, ecx
xor edx, edx
div dword [esp + 0x54]
inc esi
mov ecx, eax
mov dword [esp + 0x3c], esi
mov eax, dword [esp + 0x60]
movsx ax, byte [eax + edx]
mov word [ebx], ax
sub ebx, 2
mov eax, dword [esp + 0x48]
inc eax
mov dword [esp + 0x48], eax
cmp eax, 3
jne 0x4e7d8e
test ecx, ecx
je 0x4e7dc2
mov ax, word [esp + 0x42]
inc esi
mov word [ebx], ax
sub ebx, 2
xor eax, eax
mov dword [esp + 0x3c], esi
mov dword [esp + 0x48], eax
test ecx, ecx
jne 0x4e7d48
mov eax, dword [esp + 0x4c]
jmp 0x4e7ded
mov edi, dword [esp + 0x60]
lea esp, [esp]
mov eax, ecx
xor edx, edx
div dword [esp + 0x54]
inc esi
mov ecx, eax
movsx ax, byte [edi + edx]
mov word [ebx], ax
sub ebx, 2
test ecx, ecx
jne 0x4e7da0
mov edi, dword [esp + 0x34]
mov dword [esp + 0x3c], esi
mov eax, dword [esp + 0x4c]
jmp 0x4e7ded
mov eax, 0x30
lea ebx, [esp + 0x4b4]
mov word [esp + 0x4b6], ax
mov esi, 1
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x4c], eax
mov edx, dword [esp + 0x38]
xor ecx, ecx
test edx, edx
je 0x4e7dfe
mov ecx, 1
jmp 0x4e7e0b
test eax, 0x20000
cmovne ecx, dword [esp + 0x80]
and eax, 0x50000
mov dword [esp + 0x48], ecx
cmp eax, 0x40000
jne 0x4e7e41
mov eax, dword [esp + 0x44]
movzx edx, word [eax + 6]
lea eax, [ecx + esi]
cmp eax, edx
jae 0x4e7e3d
or dword [esp + 0x38], 4
sub edx, ecx
sub edx, esi
add ecx, edx
mov dword [esp + 0x7c], edx
mov dword [esp + 0x48], ecx
mov edx, dword [esp + 0x38]
add ebx, 2
cmp byte [esp + 0x2f], 0
jne 0x4e7ed7
lea eax, [ecx + esi]
mov ecx, dword [esp + 0x30]
lea eax, [ecx + eax*2]
cmp dword [ebp + 0x14], eax
jae 0x4e7e79
mov eax, dword [esp + 0x3c]
mov esi, ecx
add eax, dword [esp + 0x48]
mov byte [esp + 0x2f], 1
lea esi, [esi + eax*2]
mov dword [esp + 0x30], esi
jmp 0x4e89ba
test dl, 1
je 0x4e7e85
mov eax, 0x2d
jmp 0x4e7e94
test dword [esp + 0x4c], 0x20000
je 0x4e7e9e
mov eax, 0x2b
mov word [edi], ax
add edi, 2
mov dword [esp + 0x34], edi
mov edi, edi
test dl, 4
je 0x4e7ec4
mov edx, dword [esp + 0x7c]
test edx, edx
je 0x4e7ec1
mov ecx, edx
mov eax, 0x300030
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x34]
lea edi, [edi + edx*2]
add esi, esi
push esi
push ebx
push edi
call fcn.00537fe0
add esp, 0xc
add edi, esi
mov dword [esp + 0x34], edi
mov eax, dword [esp + 0x3c]
mov esi, dword [esp + 0x30]
add eax, dword [esp + 0x48]
lea esi, [esi + eax*2]
mov dword [esp + 0x30], esi
jmp 0x4e89ba
mov ecx, dword [esp + 0x44]
fstp st(1)
fstp st(0)
mov ebx, dword [ecx + 0x14]
mov eax, dword [ecx + 0x10]
mov dword [esp + 0x58], eax
test ebx, ebx
jg 0x4e7f34
jl 0x4e7f0b
test eax, eax
jae 0x4e7f34
neg eax
mov dword [esp + 0x58], eax
mov eax, 1
adc ebx, 0
mov dword [esp + 0x38], eax
neg ebx
jmp 0x4e7f34
mov ecx, dword [esp + 0x44]
fstp st(1)
fstp st(0)
mov eax, dword [ecx + 0x10]
mov ebx, dword [ecx + 0x14]
mov dword [esp + 0x58], eax
mov esi, dword [esp + 0x4c]
mov dword [esp + 0x54], 0xa
mov dword [esp + 0x48], 0
test esi, 0x100
je 0x4e7f77
mov cl, byte [ecx + 0xa]
mov al, cl
mov dword [esp + 0x54], 0xa
sub al, 2
mov dword [esp + 0x48], 0
cmp al, 0x43
ja 0x4e7f77
movzx eax, cl
cdq
mov dword [esp + 0x54], eax
mov dword [esp + 0x48], edx
mov edx, dword [esp + 0x58]
test esi, 0x20000000
mov eax, str.0123456789abcdefghijklmnopqrstuvwxyz_________._:_________
mov dword [esp + 0x3c], 0
mov ecx, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
lea esi, [esp + 0x4b6]
cmovne eax, ecx
mov dword [esp + 0x50], eax
mov eax, edx
or eax, ebx
je 0x4e807d
test dword [esp + 0x4c], 0x10000
je 0x4e8031
xor eax, eax
mov dword [esp + 0x60], eax
nop
push ebx
push dword [esp + 0x4c]
push dword [esp + 0x5c]
push ebx
push edx
call fcn.005550e0
mov dword ds:[esp + 0x60], ebx
pop ebx
nop
mov ebx, edx
mov dword [esp + 0x58], eax
mov edx, dword [esp + 0x50]
movsx cx, byte [edx + ecx]
mov edx, dword [esp + 0x60]
inc edx
mov dword [esp + 0x60], edx
mov word [esi], cx
sub esi, 2
mov ecx, dword [esp + 0x3c]
inc ecx
mov dword [esp + 0x3c], ecx
cmp edx, 3
jne 0x4e8023
or eax, ebx
je 0x4e8077
mov ax, word [esp + 0x42]
inc ecx
mov word [esi], ax
sub esi, 2
xor eax, eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x58]
or eax, ebx
mov edx, dword [esp + 0x58]
jne 0x4e7fc0
mov eax, dword [esp + 0x4c]
jmp 0x4e80a2
mov edi, dword [esp + 0x54]
push ebx
push dword [esp + 0x4c]
push edi
push ebx
push edx
call fcn.005550e0
mov dword [esp + 0x68], ebx
pop ebx
nop
mov dword [esp + 0x58], eax
mov ebx, edx
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x58]
movsx ax, byte [eax + ecx]
mov ecx, dword [esp + 0x3c]
inc ecx
mov dword [esp + 0x3c], ecx
mov word [esi], ax
mov eax, edx
sub esi, 2
or eax, ebx
jne 0x4e8035
mov edi, dword [esp + 0x34]
mov eax, dword [esp + 0x4c]
jmp 0x4e80a2
mov eax, 0x30
lea esi, [esp + 0x4b4]
mov word [esp + 0x4b6], ax
mov ecx, 1
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x4c], eax
mov edx, dword [esp + 0x38]
xor ebx, ebx
test edx, edx
je 0x4e80b3
mov ebx, 1
jmp 0x4e80c0
test eax, 0x20000
cmovne ebx, dword [esp + 0x80]
and eax, 0x50000
cmp eax, 0x40000
jne 0x4e80f1
mov eax, dword [esp + 0x44]
movzx edx, word [eax + 6]
lea eax, [ebx + ecx]
cmp eax, edx
jae 0x4e80ed
or dword [esp + 0x38], 4
sub edx, ebx
sub edx, ecx
mov dword [esp + 0x84], edx
add ebx, edx
mov edx, dword [esp + 0x38]
add esi, 2
cmp byte [esp + 0x2f], 0
mov dword [esp + 0x50], esi
mov esi, dword [esp + 0x30]
jne 0x4e8196
lea eax, [ebx + ecx]
lea eax, [esi + eax*2]
cmp dword [ebp + 0x14], eax
jae 0x4e8126
lea eax, [ebx + ecx]
mov byte [esp + 0x2f], 1
lea esi, [esi + eax*2]
mov dword [esp + 0x30], esi
jmp 0x4e89ba
test dl, 1
je 0x4e8132
mov eax, 0x2d
jmp 0x4e8141
test dword [esp + 0x4c], 0x20000
je 0x4e814b
mov eax, 0x2b
mov word [edi], ax
add edi, 2
mov dword [esp + 0x34], edi
test dl, 4
je 0x4e8176
mov edx, dword [esp + 0x84]
test edx, edx
je 0x4e8173
mov ecx, edx
mov eax, 0x300030
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x34]
mov ecx, dword [esp + 0x3c]
lea edi, [edi + edx*2]
lea esi, ds:[ecx + ecx]
push esi
push dword [esp + 0x54]
push edi
call fcn.00537fe0
mov ecx, dword [esp + 0x48]
add esp, 0xc
add edi, esi
mov esi, dword [esp + 0x30]
mov dword [esp + 0x34], edi
lea eax, [ebx + ecx]
lea esi, [esi + eax*2]
mov dword [esp + 0x30], esi
jmp 0x4e89ba
mov esi, dword [esp + 0x44]
fstp st(1)
mov dword [esp + 0x38], 0
fstp st(0)
test bl, 0x40
je 0x4e81cf
movzx edx, word ds:[esi + 4]
cmp edx, 0xa2
jbe 0x4e81d4
mov edx, 0xa2
jmp 0x4e81d4
mov edx, 6
fld qword [esi + 0x10]
lea eax, [esp + 0xb9]
sub esp, 0x10
mov dword [esp + 0x68], eax
mov ecx, ebx
fstp qword [esp + 8]
push eax
call fcn.00527ba0
test al, al
jne 0x4e81fe
mov byte [esp + 0xb9], al
jmp 0x4e825d
mov edx, dword [0x5cf33c]
test edx, edx
je 0x4e8235
mov al, byte [esp + 0xb9]
lea ecx, [esp + 0xb9]
test al, al
je 0x4e8235
lea ebx, [ebx]
cmp al, 0x2e
je 0x4e822e
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x4e8220
jmp 0x4e8235
mov al, byte [0x5cb8b8]
mov byte [ecx], al
test ebx, 0x20000000
je 0x4e825d
lea eax, [esp + 0xb9]
test edx, edx
je 0x4e8254
push edx
push eax
call fcn.0053f477
add esp, 8
jmp 0x4e825d
push eax
call fcn.0053f41b
add esp, 4
mov esi, dword ds:[esi]
test esi, 0x8000
je 0x4e82e4
mov cl, byte [esp + 0xb9]
lea eax, [esp + 0xb9]
mov bh, byte [0x5cb8b8]
test cl, cl
je 0x4e8296
mov dl, cl
mov cl, dl
cmp dl, bh
je 0x4e8296
mov cl, byte [eax + 1]
inc eax
mov dl, cl
test cl, cl
jne 0x4e8286
inc eax
test cl, cl
je 0x4e82e4
mov cl, byte ds:[eax]
test cl, cl
je 0x4e82b6
cmp cl, 0x65
je 0x4e82b6
cmp cl, 0x45
je 0x4e82b6
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4e82a4
mov bl, byte ds:[eax - 1]
mov edx, eax
dec eax
cmp bl, 0x30
jne 0x4e82ce
mov bl, byte [eax - 1]
dec eax
cmp bl, 0x30
je 0x4e82c5
cmp bl, bh
lea ecx, [eax - 1]
cmovne ecx, eax
mov al, byte [edx]
lea ecx, [ecx + 1]
mov byte [ecx], al
lea edx, [edx + 1]
test al, al
jne 0x4e82d6
lea ebx, [esp + 0xb9]
lea ecx, [ebx + 1]
mov edi, edi
mov al, byte [ebx]
inc ebx
test al, al
jne 0x4e82f0
sub ebx, ecx
cmp byte [esp + 0xb9], 0x2d
mov dword [esp + 0x60], ebx
jne 0x4e8322
mov edx, 1
lea ecx, [esp + 0xba]
dec ebx
mov dword [esp + 0x38], edx
mov dword [esp + 0x58], ecx
mov dword [esp + 0x60], ebx
jmp 0x4e833d
mov ecx, dword [esp + 0x58]
test esi, 0x20000
je 0x4e8339
mov edx, 2
mov dword [esp + 0x38], edx
jmp 0x4e833d
mov edx, dword [esp + 0x38]
mov eax, esi
and eax, 0x13000
cmp eax, 0x10000
jne 0x4e84b0
mov al, byte [ecx]
mov esi, ecx
sub al, 0x30
mov dword [esp + 0x50], ecx
cmp al, 0xa
jae 0x4e836e
lea ecx, [ecx]
mov al, byte [esi + 1]
inc esi
sub al, 0x30
cmp al, 0xa
jb 0x4e8360
mov dword [esp + 0x50], esi
mov edx, esi
sub edx, ecx
mov dword [esp + 0x3c], edx
je 0x4e838d
lea ecx, [edx + 2]
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
mov edx, dword [esp + 0x3c]
shr eax, 1
dec eax
jmp 0x4e838f
xor eax, eax
lea ecx, [eax + ebx]
mov dword [esp + 0x48], eax
mov ax, word [0x5cb8f8]
add ecx, ecx
cmp byte [esp + 0x2f], 0
mov word [esp + 0x42], ax
jne 0x4e83d4
cmp dword ds:[esp + 0x38], 0
lea eax, [ecx + 2]
cmove eax, ecx
mov ecx, dword [esp + 0x30]
add eax, ecx
cmp dword [ebp + 0x14], eax
jae 0x4e83d4
mov eax, dword [esp + 0x3c]
mov dl, 1
mov byte [esp + 0x2f], dl
jmp 0x4e8462
mov ecx, edx
lea eax, [edx + 2]
xor edx, edx
div dword [esp + 0x88]
cmp byte [esp + 0x2f], 0
jne 0x4e8456
mov eax, dword [esp + 0x38]
test al, 1
je 0x4e83fc
mov eax, 0x2d
jmp 0x4e8409
lea esp, [esp]
test al, 2
je 0x4e8413
mov eax, 0x2b
mov word [edi], ax
add edi, 2
mov dword [esp + 0x34], edi
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4e845a
mov ebx, dword [esp + 0x58]
mov si, word [esp + 0x42]
movsx ax, byte [ebx]
lea ebx, [ebx + 1]
dec ecx
mov word [edi], ax
mov eax, edx
add edi, 2
dec edx
test eax, eax
jne 0x4e8446
test ecx, ecx
je 0x4e844a
mov word [edi], si
lea edx, [eax + 2]
add edi, 2
test ecx, ecx
jne 0x4e8424
mov esi, dword [esp + 0x50]
mov ebx, dword [esp + 0x60]
mov dword [esp + 0x34], edi
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x30]
mov dl, byte [esp + 0x2f]
cmp dword [esp + 0x38], 0
je 0x4e8470
add ecx, 2
mov dword [esp + 0x30], ecx
add eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x30]
sub ebx, dword [esp + 0x3c]
lea ecx, [ecx + eax*2]
mov dword [esp + 0x30], ecx
test dl, dl
jne 0x4e7c19
push edi
push ebx
push esi
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
mov esi, dword [esp + 0x30]
lea ecx, [ebx + ebx]
mov eax, ecx
shr eax, 1
add esi, ecx
mov dword [esp + 0x30], esi
lea edi, [edi + eax*2]
mov dword [esp + 0x34], edi
jmp 0x4e89ba
xor ecx, ecx
test edx, edx
setne cl
mov edx, ecx
test esi, 0x40000
je 0x4e84e9
mov eax, dword [esp + 0x44]
movzx esi, word [eax + 6]
lea eax, [ebx + ecx]
cmp eax, esi
jae 0x4e84e9
or dword [esp + 0x38], 4
mov eax, esi
sub eax, ecx
sub eax, ebx
mov dword [esp + 0x6c], eax
lea edx, [ecx + eax]
mov cl, byte [esp + 0x2f]
mov esi, dword [esp + 0x30]
test cl, cl
jne 0x4e8577
lea eax, ds:[edx + ebx]
lea eax, [esi + eax*2]
cmp dword [ebp + 0x14], eax
jae 0x4e8525
mov ax, word [0x5cb8f8]
lea esi, ds:[esi + edx*2]
mov byte [esp + 0x2f], 1
mov dword [esp + 0x30], esi
mov word [esp + 0x42], ax
jmp 0x4e89ba
mov eax, dword [esp + 0x38]
test al, 1
je 0x4e8534
mov eax, 0x2d
jmp 0x4e853d
test al, 2
je 0x4e854b
mov eax, 0x2b
mov word [edi], ax
add edi, 2
mov eax, dword [esp + 0x38]
mov dword [esp + 0x34], edi
test al, 4
je 0x4e8577
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x4e856f
mov ecx, eax
mov eax, 0x300030
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x34]
mov eax, dword [esp + 0x6c]
lea edi, [edi + eax*2]
lea esi, [esi + edx*2]
jmp 0x4e8584
lea esi, ds:[esi + edx*2]
mov dword [esp + 0x30], esi
test cl, cl
jne 0x4e85b8
mov eax, dword [esp + 0x58]
push edi
push ebx
push eax
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
lea ecx, [ebx + ebx]
mov eax, ecx
shr eax, 1
add esi, ecx
mov dword [esp + 0x30], esi
lea edi, [edi + eax*2]
mov ax, word [0x5cb8f8]
mov dword [esp + 0x34], edi
mov word [esp + 0x42], ax
jmp 0x4e89ba
mov esi, dword [esp + 0x30]
mov ax, word [0x5cb8f8]
mov word [esp + 0x42], ax
jmp 0x4e89ba
mov eax, dword [esp + 0x44]
xor ebx, ebx
mov dword [esp + 0x98], ebx
mov dword [esp + 0x54], ebx
mov esi, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
mov eax, edx
mov ecx, edx
mov dword [esp + 0x90], esi
and eax, 0x7fffffff
and ecx, 0x80000000
or esi, edx
mov dword [esp + 0x94], eax
fild qword [esp + 0x90]
mov dword [esp + 0x9c], ecx
fild qword [esp + 0x98]
fchs
faddp st(1)
jne 0x4e8665
fstp st(0)
mov esi, dword [esp + 0x30]
fstp st(1)
fstp st(0)
cmp byte [esp + 0x2f], bl
jne 0x4e8651
lea eax, [esi + 2]
cmp dword [ebp + 0x14], eax
jae 0x4e8649
add edi, 2
mov byte [esp + 0x2f], 1
add esi, 2
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], esi
jmp 0x4e89ba
mov eax, 0x30
mov word [edi], ax
add edi, 2
add esi, 2
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], esi
jmp 0x4e89ba
mov edx, dword [esp + 0x4c]
mov esi, dword [esp + 0x44]
test edx, 0x100
je 0x4e867b
movzx ecx, byte [esi + 0xa]
jmp 0x4e8681
mov ecx, dword [0x5cc1a4]
fcomi st(2)
jb 0x4e8699
cmp ebx, 7
jae 0x4e8695
cmp ebx, ecx
jae 0x4e8695
fmul st(1)
inc ebx
fcomi st(2)
jae 0x4e8685
mov dword [esp + 0x54], ebx
fstp st(2)
fstp st(0)
test dl, 0x40
je 0x4e86ab
movzx eax, word [esi + 4]
jmp 0x4e86b0
mov eax, 2
movzx edx, ax
mov ecx, 0x1804b
cmp edx, 0xa2
mov dword [esp + 0x48], 0
mov eax, 0xa2
cmova edx, eax
sub esp, 0x10
lea eax, [esp + 0xc9]
mov dword [esp + 0x70], eax
fstp qword [esp + 8]
push eax
call fcn.00527ba0
test al, al
jne 0x4e87b7
xor dh, dh
mov byte [esp + 0xb9], dh
mov bx, word [0x5cb8b8]
mov cl, dh
lea eax, [esp + 0xb9]
test cl, cl
je 0x4e8724
mov dl, cl
lea ecx, [ecx]
mov cl, dl
cmp dl, bl
je 0x4e8724
mov cl, byte ds:[eax + 1]
inc eax
mov dl, cl
test cl, cl
jne 0x4e8710
inc eax
test cl, cl
je 0x4e877a
mov cl, byte [eax]
test cl, cl
je 0x4e8745
cmp cl, 0x65
je 0x4e8745
cmp cl, 0x45
je 0x4e8745
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4e8733
mov bl, byte [eax - 1]
mov edx, eax
dec eax
cmp bl, 0x30
jne 0x4e8759
mov bl, byte [eax - 1]
dec eax
cmp bl, 0x30
je 0x4e8750
cmp bl, byte [0x5cb8b8]
lea ecx, [eax - 1]
cmovne ecx, eax
mov al, byte [edx]
lea ecx, [ecx + 1]
mov byte [ecx], al
lea edx, [edx + 1]
test al, al
jne 0x4e8765
mov dh, byte [esp + 0xb9]
lea esi, [esp + 0xb9]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4e8784
sub esi, ecx
mov dword [esp + 0x50], esi
cmp dh, 0x2d
jne 0x4e8806
lea ecx, [esp + 0xba]
mov dword [esp + 0x48], 1
dec esi
mov dword [esp + 0x60], ecx
mov dword [esp + 0x50], esi
jmp 0x4e880a
cmp dword [0x5cf33c], 0
mov dh, byte [esp + 0xb9]
je 0x4e86f7
lea ecx, [esp + 0xb9]
test dh, dh
je 0x4e86f7
mov al, dh
lea esp, [esp]
cmp al, 0x2e
je 0x4e87f1
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x4e87e0
jmp 0x4e86f7
mov bx, word [0x5cb8b8]
mov byte [ecx], bl
mov dh, byte [esp + 0xb9]
jmp 0x4e86fe
mov ecx, dword [esp + 0x60]
mov al, byte [ecx]
mov ebx, ecx
sub al, 0x30
mov dword [esp + 0x58], ecx
cmp al, 0xa
jae 0x4e8828
mov al, byte ds:[ebx + 1]
inc ebx
sub al, 0x30
cmp al, 0xa
jb 0x4e8818
mov dword [esp + 0x58], ebx
mov edx, ebx
sub edx, ecx
mov dword [esp + 0x3c], edx
je 0x4e8847
lea ecx, [edx + 2]
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
mov edx, dword [esp + 0x3c]
shr eax, 1
dec eax
jmp 0x4e8849
xor eax, eax
lea ecx, [eax + esi]
mov dword [esp + 0x38], eax
mov ax, word [0x5cb8f8]
add ecx, ecx
cmp byte [esp + 0x2f], 0
mov word [esp + 0x42], ax
jne 0x4e8888
cmp dword [esp + 0x48], 0
lea eax, [ecx + 2]
cmove eax, ecx
mov ecx, dword [esp + 0x30]
add eax, ecx
cmp dword [ebp + 0x14], eax
jae 0x4e8888
mov eax, dword [esp + 0x3c]
mov byte [esp + 0x2f], 1
jmp 0x4e8906
mov ecx, edx
lea eax, [edx + 2]
xor edx, edx
div dword [esp + 0x88]
cmp byte [esp + 0x2f], 0
jne 0x4e88fe
cmp dword [esp + 0x48], 0
je 0x4e88b8
mov eax, 0x2d
mov word [edi], ax
add edi, 2
mov eax, dword ds:[esp + 0x3c]
test eax, eax
je 0x4e8902
mov esi, dword [esp + 0x60]
mov bx, word [esp + 0x42]
lea ecx, [ecx]
movsx ax, byte [esi]
lea esi, [esi + 1]
dec ecx
mov word [edi], ax
mov eax, edx
add edi, 2
dec edx
test eax, eax
jne 0x4e88f2
test ecx, ecx
je 0x4e88f6
mov word [edi], bx
lea edx, [eax + 2]
add edi, 2
test ecx, ecx
jne 0x4e88d0
mov esi, dword [esp + 0x50]
mov ebx, dword [esp + 0x58]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x30]
cmp dword [esp + 0x48], 0
je 0x4e8914
add ecx, 2
mov dword [esp + 0x30], ecx
add eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x30]
sub esi, dword [esp + 0x3c]
cmp byte [esp + 0x2f], 0
lea edx, [ecx + eax*2]
mov dword [esp + 0x60], edx
jne 0x4e8994
push edi
push esi
push ebx
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
mov edx, dword ds:[esp + 0x60]
lea ecx, [esi + esi]
mov esi, dword [esp + 0x54]
mov eax, ecx
shr eax, 1
add edx, ecx
mov dword [esp + 0x60], edx
lea edi, [edi + eax*2]
mov eax, dword [esi*8 + 0x5cb8c0]
add eax, 2
add eax, edx
cmp dword [ebp + 0x14], eax
jae 0x4e896c
mov byte [esp + 0x2f], 1
jmp 0x4e8998
mov eax, 0x20
mov word [edi], ax
lea eax, [edi + 2]
push dword [esi*8 + 0x5cb8c0]
push dword [esi*8 + 0x5cb8c4]
push eax
call fcn.00537fe0
mov edx, dword [esp + 0x6c]
add esp, 0xc
jmp 0x4e8998
mov esi, dword [esp + 0x54]
mov ecx, dword [esi*8 + 0x5cb8c0]
lea eax, [ecx + 2]
shr eax, 1
lea esi, [ecx + 2]
add esi, edx
mov dword [esp + 0x30], esi
lea edi, [edi + eax*2]
mov dword [esp + 0x34], edi
jmp 0x4e89ba
fstp st(1)
fstp st(0)
mov ebx, dword [esp + 0x44]
mov ecx, esi
sub ecx, dword [esp + 0x70]
mov edx, dword [ebx]
test edx, 0xc0000000
je 0x4e8a86
movzx esi, word ds:[ebx + 6]
add esi, esi
cmp ecx, esi
jae 0x4e8a82
sub esi, ecx
cmp byte [esp + 0x2f], 0
jne 0x4e8a73
mov eax, dword ds:[esp + 0x30]
add eax, esi
cmp dword [ebp + 0x14], eax
jae 0x4e8a0f
mov byte [esp + 0x2f], 1
jmp 0x4e8a73
test dl, dl
jns 0x4e8a19
movzx eax, word [ebx + 8]
jmp 0x4e8a1e
mov eax, 0x20
mov ebx, esi
mov dword [esp + 0x50], eax
shr ebx, 1
test edx, edx
jns 0x4e8a30
test ebx, ebx
je 0x4e8a73
jmp 0x4e8a5a
mov eax, ecx
mov edx, edi
and eax, 0xfffffffe
sub edx, eax
push ecx
push edx
lfence
lea eax, [edx + ebx*2]
mov dword [esp + 0x78], edx
push eax
call fcn.00537fe0
add esp, 0xc
test ebx, ebx
je 0x4e8a73
mov eax, dword [esp + 0x50]
mov edi, dword [esp + 0x70]
movzx edx, ax
mov ecx, ebx
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x34]
mov eax, esi
shr eax, 1
add dword [esp + 0x30], esi
lea edi, [edi + eax*2]
mov dword [esp + 0x34], edi
mov esi, dword [esp + 0x30]
mov eax, dword ds:[esp + 0xb0]
fld qword [esp + 0xa0]
fld qword [esp + 0xa8]
test eax, eax
jne 0x4e7aca
mov bl, byte [esp + 0x2f]
fstp st(1)
mov ecx, dword [ebp + 0x14]
fstp st(0)
test bl, bl
jne 0x4e8ac0
lea eax, [esi + 2]
cmp ecx, eax
jae 0x4e8afd
mov bl, 1
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x4e8ad4
test ecx, ecx
je 0x4e8ad4
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [esp + 0x68]
test ecx, ecx
je 0x4e8ae1
lea eax, [esi + 2]
mov dword [ecx], eax
mov ecx, dword [esp + 0x4bc]
test bl, bl
pop edi
pop esi
sete al
pop ebx
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret 0x14
xor eax, eax
mov word [edi], ax
jmp 0x4e8ad4