Function at 0x1401573e0
Capabilities:
Get geographical location

Disassembly:
mov r11, rsp
push rbp
push rsi
push r14
lea rbp, [r11 - 0x3f8]
sub rsp, 0x4e0
mov rax, qword [0x1402bf040]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov r14, qword [rbp + 0x420]
mov rax, rcx
mov qword [r11 + 0x10], rbx
mov ebx, edx
mov qword [r11 - 0x20], rdi
mov rdi, r8
mov qword [r11 - 0x30], r13
mov qword [r11 - 0x38], r15
mov r15, r8
mov qword [rsp + 0x78], r8
xor r8d, r8d
test r15, r15
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x58], rcx
mov r13d, r8d
sete sil
mov qword [rbp - 0x80], r14
test byte [0x1402c5c40], 1
jne 0x14015753d
lock bts qword [0x1402c5c40], 0x1f
setb al
test al, al
jne 0x140157514
mov r9d, 4
lea r8, [rbp - 0x78]
mov edx, 0xe
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1401574a1
mov rax, qword [rbp - 0x78]
test ax, ax
je 0x1401574a1
cmp word [rbp - 0x76], r13w
jne 0x1401574a1
mov word [0x1402c0518], ax
mov r9d, 4
lea r8, [rbp - 0x78]
mov edx, 0xf
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1401574d6
mov rax, qword [rbp - 0x78]
test ax, ax
je 0x1401574d6
cmp word [rbp - 0x76], r13w
jne 0x1401574d6
mov word [0x1402c1118], ax
cmp word [0x1402c0518], 0x2e
nop
je 0x1401574f7
lea rdx, [0x1402386c8]
xor ecx, ecx
call fcn.1401f2ab8
mov qword [0x1402cdc88], rax
lea rcx, [0x1402c5c40]
nop
call sym.SystemInformer.exe_PhfSetEvent
mov r9, qword [rsp + 0x38]
xor r8d, r8d
mov rax, qword [rsp + 0x58]
jmp 0x14015753d
test byte [0x1402c5c40], 1
jne 0x14015753a
xor edx, edx
lea rcx, [0x1402c5c40]
call sym.SystemInformer.exe_PhfWaitForEvent
mov r9, qword [rsp + 0x38]
xor r8d, r8d
mov rax, qword [rsp + 0x58]
jmp 0x14015753d
mov rax, rcx
nop dword [rax]
test ebx, ebx
je 0x1401583a9
mov qword [rsp + 0x4d0], r12
lea r10, [0x140000000]
movaps xmmword [rsp + 0x4b0], xmm6
mov r11d, 0x30
movsd xmm6, qword [0x1402907d0]
movaps xmmword [rsp + 0x4a0], xmm7
movsd xmm7, qword [0x140290780]
mov byte [rsp + 0x30], sil
jmp 0x140157598
mov r9, qword [rsp + 0x38]
xor r8d, r8d
mov rdx, rax
mov qword [rbp - 0x78], rax
dec ebx
mov qword [rsp + 0x70], r13
mov rdi, rax
mov dword [rsp + 0x60], ebx
mov rbx, rax
mov r14d, r8d
mov r12d, dword [rdx]
add rax, 0x20
mov qword [rsp + 0x58], rax
mov eax, r12d
and eax, 0x3f
cmp eax, 0xc
ja case.default.0x1401575db
cdqe
mov ecx, dword [r10 + rax*4 + 0x158428]
add rcx, r10
jmp rcx
nop dword [rax]
test sil, sil
jne 0x14015760d
lea rax, [r13 + 2]
cmp r9, rax
jae 0x140157605
add r15, 2
mov byte [rsp + 0x30], 1
add r13, 2
jmp case.default.0x1401575db
movzx eax, word [rbx + 0x10]
mov word [r15], ax
add r15, 2
add r13, 2
jmp case.default.0x1401575db
test sil, sil
jne 0x140157651
mov r8, qword [rbx + 0x10]
lea rax, [r8 + r13]
cmp r9, rax
jae 0x140157645
mov rax, r8
mov byte [rsp + 0x30], 1
shr rax, 1
add r13, r8
lea r15, [r15 + rax*2]
jmp case.default.0x1401575db
mov rdx, qword [rbx + 0x18]
mov rcx, r15
call fcn.14020a640
mov rax, qword [rbx + 0x10]
shr rax, 1
add r13, qword [rbx + 0x10]
lea r15, [r15 + rax*2]
jmp case.default.0x1401575db
mov rdx, qword [rbx + 0x10]
xorps xmm1, xmm1
mov rdi, rdx
mov ecx, edx
and rdi, 0xfffffffffffffff1
and ecx, 0xf
je 0x140157697
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdi]
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
je 0x140157693
mov edi, ecx
shr rdi, 1
jmp 0x1401576d3
add rdi, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdi]
pmovmskb eax, xmm0
bsf ecx, eax
jne 0x1401576c5
nop word [rax + rax]
add rdi, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdi]
pmovmskb eax, xmm0
bsf ecx, eax
je 0x1401576b0
sub rdi, rdx
mov eax, ecx
sar rdi, 1
shr rax, 1
add rdi, rax
test sil, sil
jne 0x140157705
lea r8, [rdi + rdi]
lea rax, [r8 + r13]
cmp r9, rax
jae 0x1401576f8
mov byte [rsp + 0x30], 1
lea r15, [r15 + rdi*2]
lea r13, [r13 + rdi*2]
jmp case.default.0x1401575db
mov rcx, r15
call fcn.14020a640
lea r15, [r15 + rdi*2]
lea r13, [r13 + rdi*2]
jmp case.default.0x1401575db
cmp r12d, 3
jne 0x140157723
mov rbx, qword [rbx + 0x18]
mov rdi, qword [rdx + 0x10]
jmp 0x140157739
mov rbx, qword [rdx + 0x10]
mov rdi, 0xffffffffffffffff
nop
inc rdi
cmp byte [rbx + rdi], 0
jne 0x140157730
mov r8d, edi
lea rcx, [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeSize]
test eax, eax
js 0x140157f85
test sil, sil
mov rsi, qword [rsp + 0x38]
jne 0x140157792
mov ecx, dword [rsp + 0x40]
lea rax, [rcx + r13]
cmp rsi, rax
jae 0x140157770
mov byte [rsp + 0x30], 1
jmp 0x140157796
lfence
mov edx, dword [rsp + 0x40]
mov r9, rbx
xor r8d, r8d
mov dword [rsp + 0x20], edi
mov rcx, r15
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
test eax, eax
js 0x140157f8a
mov ecx, dword [rsp + 0x40]
mov rbx, qword [rbp - 0x78]
mov rax, rcx
shr rax, 1
add r13, rcx
lea r15, [r15 + rax*2]
jmp 0x140157e5f
mov eax, dword [rbx + 0x10]
mov r14d, eax
mov r8d, eax
shr r14d, 0x1f
neg r8d
test eax, eax
cmovns r8d, eax
jmp 0x1401577c8
mov r8d, dword [rbx + 0x10]
mov r11d, 0xa
bt r12d, 8
jae 0x1401577e7
movzx ecx, byte ds:[rbx + 0xa]
lea eax, [rcx - 2]
cmp al, 0x43
ja 0x1401577e7
mov r11d, ecx
bt r12d, 0x1d
lea r10, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
lea rax, [0x14028b1d0]
cmovae r10, rax
lea r9, [rbp + 0x38e]
xor esi, esi
mov ebx, esi
test r8d, r8d
je 0x1401578a2
bt r12d, 0x10
jae 0x140157880
mov edi, esi
nop dword [rax + rax]
xor edx, edx
mov eax, r8d
div r11d
inc ebx
inc edi
mov r8d, eax
movsx ecx, byte [rdx + r10]
mov word [r9], cx
sub r9, 2
cmp edi, 3
jne 0x14015785c
test eax, eax
je 0x140157864
movzx eax, word [0x1402c1118]
mov word [r9], ax
sub r9, 2
inc ebx
jmp 0x140157819
nop dword [rax]
test eax, eax
jne 0x140157820
mov eax, 1
mov edi, 0x30
test r14d, r14d
je 0x1401578be
mov esi, eax
jmp 0x1401578c6
xor edx, edx
mov eax, r8d
div r11d
inc ebx
mov r8d, eax
movsx ecx, byte [rdx + r10]
mov word [r9], cx
sub r9, 2
test eax, eax
jne 0x140157880
nop
jmp 0x140157864
mov edi, 0x30
lea r9, [rbp + 0x38c]
mov eax, 1
mov word [rbp + 0x38e], di
mov ebx, eax
jmp 0x14015786e
bt r12d, 0x11
cmovb esi, eax
mov eax, r12d
and eax, 0x50000
cmp eax, 0x40000
jne 0x1401578f6
mov rax, qword [rbp - 0x78]
movzx ecx, word [rax + 6]
lea eax, [rsi + rbx]
cmp eax, ecx
jae 0x1401578f6
mov edx, ecx
or r14d, 4
sub edx, esi
sub edx, ebx
mov dword [rsp + 0x44], edx
add esi, edx
jmp 0x1401578fa
mov edx, dword [rsp + 0x44]
cmp byte ds:[rsp + 0x30], 0
jne 0x14015797e
lea eax, [rsi + rbx]
lea rax, [rax*2]
add rax, r13
cmp qword [rsp + 0x38], rax
jae 0x14015792d
lea eax, [rsi + rbx]
mov byte [rsp + 0x30], 1
mov rbx, qword [rbp - 0x78]
lea r13, [r13 + rax*2]
jmp case.default.0x1401575db
test r14b, 1
je 0x14015793b
mov word [r15], 0x2d
jmp 0x140157948
bt r12d, 0x11
jae 0x14015794c
mov word [r15], 0x2b
add r15, 2
test r14b, 4
je 0x140157967
test rdx, rdx
je 0x140157963
movzx eax, di
mov rcx, rdx
mov rdi, r15
rep stosw word [rdi], ax
lea r15, [r15 + rdx*2]
mov edi, ebx
lea rdx, [r9 + 2]
add rdi, rdi
mov rcx, r15
mov r8, rdi
call fcn.14020a640
add r15, rdi
lea eax, [rsi + rbx]
mov rbx, qword [rbp - 0x78]
lea r13, [r13 + rax*2]
jmp case.default.0x1401575db
mov rax, qword [rdi + 0x10]
mov r14, rax
mov rdi, rax
shr r14, 0x3f
neg rdi
cmovs rdi, rax
jmp 0x1401579aa
mov rdi, qword [rbx + 0x10]
mov r10d, 0xa
bt r12d, 8
jae 0x1401579c7
movzx ecx, byte ds:[rbx + 0xa]
lea eax, [rcx - 2]
cmp al, 0x43
ja 0x1401579c7
mov r10d, ecx
bt r12d, 0x1d
lea r11, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
lea rax, [0x14028b1d0]
cmovae r11, rax
lea r9, [rbp + 0x38e]
xor esi, esi
mov ebx, esi
test rdi, rdi
je 0x140157a90
bt r12d, 0x10
jae 0x140157a62
mov r8d, esi
nop dword [rax]
xor edx, edx
mov rax, rdi
div r10
mov rax, rdi
inc ebx
mov rcx, rdx
inc r8d
xor edx, edx
div r10
mov rdi, rax
mov eax, ecx
movsx ecx, byte [rax + r11]
mov word [r9], cx
sub r9, 2
cmp r8d, 3
jne 0x140157a48
test rdi, rdi
je 0x140157a4d
movzx eax, word [0x1402c1118]
mov word [r9], ax
sub r9, 2
inc ebx
jmp 0x1401579f9
test rdi, rdi
jne 0x140157a00
mov eax, 1
mov edi, 0x30
test r14d, r14d
je 0x140157aac
mov esi, eax
jmp 0x140157ab4
xor edx, edx
mov rax, rdi
div r10
mov rax, rdi
inc ebx
mov rcx, rdx
xor edx, edx
div r10
mov rdi, rax
mov eax, ecx
movsx ecx, byte [rax + r11]
mov word [r9], cx
sub r9, 2
test rdi, rdi
jne 0x140157a62
jmp 0x140157a4d
mov edi, 0x30
lea r9, [rbp + 0x38c]
mov eax, 1
mov word [rbp + 0x38e], di
mov ebx, eax
jmp 0x140157a57
bt r12d, 0x11
cmovb esi, eax
mov eax, r12d
and eax, 0x50000
cmp eax, 0x40000
jne 0x140157ae8
mov rax, qword [rbp - 0x78]
movzx ecx, word [rax + 6]
lea eax, [rsi + rbx]
cmp eax, ecx
jae 0x140157ae8
mov edx, ecx
or r14d, 4
sub edx, esi
sub edx, ebx
mov dword [rsp + 0x48], edx
add esi, edx
jmp 0x140157aec
mov edx, dword [rsp + 0x48]
cmp byte [rsp + 0x30], 0
jne 0x14015797e
lea eax, [rsi + rbx]
lea rax, [rax*2]
add rax, r13
cmp qword [rsp + 0x38], rax
jae 0x140157b25
lea eax, ds:[rsi + rbx]
mov byte [rsp + 0x30], 1
mov rbx, qword [rbp - 0x78]
lea r13, [r13 + rax*2]
jmp case.default.0x1401575db
test r14b, 1
je 0x140157b33
mov word [r15], 0x2d
jmp 0x140157b40
bt r12d, 0x11
jae 0x140157b44
mov word [r15], 0x2b
add r15, 2
test r14b, 4
je 0x140157b5f
test rdx, rdx
je 0x140157b5b
movzx eax, di
mov rcx, rdx
mov rdi, r15
rep stosw word [rdi], ax
lea r15, [r15 + rdx*2]
mov edi, ebx
lea rdx, [r9 + 2]
add rdi, rdi
mov rcx, r15
mov r8, rdi
call fcn.14020a640
lea eax, [rsi + rbx]
add r15, rdi
mov rbx, qword [rbp - 0x78]
lea r13, [r13 + rax*2]
jmp case.default.0x1401575db
test r12b, 0x40
je 0x140157ba2
movzx r8d, word [rbx + 4]
mov eax, 0xa2
cmp r8d, eax
jbe 0x140157ba8
mov r8d, eax
jmp 0x140157ba8
mov r8d, 6
movsd xmm0, qword ds:[rdi + 0x10]
lea r9, [rbp - 0x6f]
mov edx, r12d
lea rbx, [rbp - 0x6f]
mov r14, rdi
call fcn.1401d4380
test al, al
jne 0x140157bce
mov byte [rbp - 0x6f], al
jmp 0x140157c1e
mov rdx, qword [0x1402cdc88]
test rdx, rdx
je 0x140157c02
movzx eax, byte ds:[rbp - 0x6f]
test al, al
je 0x140157c02
lea rcx, [rbp - 0x6f]
cmp al, 0x2e
je 0x140157bf9
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140157be8
jmp 0x140157c02
movzx eax, byte [0x1402c0518]
mov byte [rcx], al
bt r12d, 0x1d
jae 0x140157c1e
lea rcx, [rbp - 0x6f]
test rdx, rdx
je 0x140157c19
call fcn.1401f20e0
jmp 0x140157c1e
call fcn.1401f2080
mov r9d, dword [rdi]
bt r9d, 0xf
jae 0x140157cc4
movzx eax, byte ds:[rbp - 0x6f]
lea rcx, [rbp - 0x6f]
movzx r8d, byte [0x1402c0518]
test al, al
je 0x140157c54
cmp al, r8b
je 0x140157c54
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140157c44
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140157cc4
movzx edx, byte [rcx]
test dl, dl
je 0x140157c7f
movzx eax, dl
cmp dl, 0x65
je 0x140157c7f
cmp al, 0x45
je 0x140157c7f
movzx eax, byte [rcx + 1]
inc rcx
movzx edx, al
test al, al
jne 0x140157c68
movzx eax, byte [rcx - 1]
mov rdi, rcx
dec rcx
cmp al, 0x30
jne 0x140157c9b
nop dword [rax]
movzx eax, byte [rcx - 1]
dec rcx
cmp al, 0x30
je 0x140157c90
cmp al, r8b
lea rdx, [rcx - 1]
cmovne rdx, rcx
nop word [rax + rax]
movzx eax, byte ds:[rdi]
lea rdx, [rdx + 1]
mov byte [rdx], al
lea rdi, [rdi + 1]
test al, al
jne 0x140157cb0
lea rax, [rbp - 0x6f]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140157cd0
cmp byte ds:[rbp - 0x6f], 0x2d
jne 0x140157cf2
dec r8d
lea rbx, [rbp - 0x6e]
xor ecx, ecx
mov esi, 1
jmp 0x140157d06
mov ecx, 0
bt r9d, 0x11
mov esi, ecx
mov eax, 2
cmovb esi, eax
mov eax, r9d
and eax, 0x13000
cmp eax, 0x10000
jne 0x140157eb3
movzx eax, byte [rbx]
mov r9, rbx
sub al, 0x30
cmp al, 0xa
jae 0x140157d3e
nop word [rax + rax]
movzx eax, byte [r9 + 1]
inc r9
sub al, 0x30
cmp al, 0xa
jb 0x140157d30
mov r10d, r9d
sub r10d, ebx
lea edi, [r10 + 2]
je 0x140157d5c
mov eax, 0xaaaaaaab
mul edi
mov r11d, edx
shr r11d, 1
dec r11d
jmp 0x140157d5f
mov r11d, ecx
movzx r12d, byte [rsp + 0x30]
lea ecx, [r11 + r8]
add ecx, ecx
test r12b, r12b
jne 0x140157d94
test esi, esi
lea eax, [rcx + 2]
cmove eax, ecx
add rax, r13
cmp qword [rsp + 0x38], rax
jae 0x140157d94
mov r12b, 1
mov byte [rsp + 0x30], r12b
jmp 0x140157e25
mov eax, 0xaaaaaaab
mov ecx, r10d
mul edi
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
test r12b, r12b
jne 0x140157e25
test sil, 1
je 0x140157db8
mov word [r15], 0x2d
jmp 0x140157dc4
test sil, 2
je 0x140157dc8
mov word [r15], 0x2b
add r15, 2
test r10d, r10d
je 0x140157e25
mov r12d, 1
nop dword [rax]
nop word [rax + rax]
movsx eax, byte [rbx]
dec ecx
mov word [r15], ax
inc rbx
mov eax, edi
add r15, 2
dec edi
test eax, eax
jne 0x140157e1b
test ecx, ecx
je 0x140157e1f
movzx eax, word [0x1402c1118]
dec ecx
mov word [r15], ax
mov edi, r12d
movsx eax, byte [rbx]
mov word [r15 + 2], ax
add r15, 4
inc rbx
test ecx, ecx
jne 0x140157de0
movzx r12d, byte [rsp + 0x30]
test esi, esi
je 0x140157e2d
add r13, 2
lea eax, [r11 + r10]
lea r13, [r13 + rax*2]
test r12b, r12b
jne 0x140157e57
sub r8d, r10d
mov rcx, r9
mov edi, r8d
mov r8, r15
mov edx, edi
call sym.SystemInformer.exe_PhZeroExtendToUtf16Buffer
lea r15, [r15 + rdi*2]
lea r13, [r13 + rdi*2]
mov rbx, r14
mov rsi, qword [rsp + 0x38]
mov ecx, dword [rbx]
mov r8, r13
sub r8, qword [rsp + 0x70]
test ecx, 0xc0000000
je 0x140158364
movzx ebx, word ds:[rbx + 6]
add rbx, rbx
cmp r8, rbx
jae 0x140158364
sub rbx, r8
cmp byte [rsp + 0x30], 0
jne 0x140158357
lea rax, ds:[rbx + r13]
cmp rsi, rax
jae 0x1401582fc
mov byte [rsp + 0x30], 1
jmp 0x140158357
test esi, esi
setne cl
mov rdx, rcx
bt r9d, 0x12
jae 0x140157ee9
movzx r9d, word [r14 + 6]
mov edi, r8d
lea rax, [rcx + rdi]
cmp rax, r9
jae 0x140157ee9
mov edx, r9d
or esi, 4
sub rdx, rdi
mov r9, rdx
sub r9, rcx
mov qword [rsp + 0x68], r9
jmp 0x140157eee
mov r9, qword [rsp + 0x68]
movzx r12d, byte [rsp + 0x30]
test r12b, r12b
jne 0x140157f70
mov eax, r8d
add rax, rdx
lea rax, [rax*2]
add rax, r13
cmp qword [rsp + 0x38], rax
jae 0x140157f25
mov byte ds:[rsp + 0x30], 1
lea r13, [r13 + rdx*2]
jmp 0x140157e57
test sil, 1
je 0x140157f33
mov word [r15], 0x2d
jmp 0x140157f3f
test sil, 2
je 0x140157f43
mov word [r15], 0x2b
add r15, 2
test sil, 4
je 0x140157f70
test r9, r9
je 0x140157f5f
mov edi, 0x30
mov rcx, r9
movzx eax, di
mov rdi, r15
rep stosw word [rdi], ax
lea r15, [r15 + r9*2]
mov rcx, rbx
lea r13, [r13 + rdx*2]
jmp 0x140157e41
lea r13, [r13 + rdx*2]
test r12b, r12b
jne 0x140157f85
mov rcx, rbx
jmp 0x140157e41
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rbp - 0x78]
jmp 0x140157e5f
mov rdx, qword ds:[rbx + 0x10]
mov esi, r8d
xorps xmm0, xmm0
test rdx, rdx
js 0x140157fac
cvtsi2sd xmm0, rdx
jmp 0x140157fc4
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2sd xmm0, rcx
addsd xmm0, xmm0
test rdx, rdx
jne 0x140157ffb
cmp byte [rsp + 0x30], dl
jne 0x140157fee
lea rax, [r13 + 2]
cmp r9, rax
jae 0x140157fea
add r15, 2
mov byte [rsp + 0x30], 1
add r13, 2
jmp case.default.0x1401575db
mov word [r15], r11w
add r15, 2
add r13, 2
jmp case.default.0x1401575db
bt r12d, 8
jae 0x140158008
movzx eax, byte [rbx + 0xa]
jmp 0x14015800e
mov eax, dword [0x1402c72e0]
comisd xmm0, xmm6
jb 0x140158029
cmp esi, 7
jae 0x140158029
cmp esi, eax
jae 0x140158029
mulsd xmm0, xmm7
inc esi
comisd xmm0, xmm6
jae 0x140158014
test r12b, 0x40
je 0x140158035
movzx eax, word [rbx + 4]
jmp 0x14015803a
mov eax, 2
movzx r8d, ax
lea r9, [rbp - 0x6f]
mov eax, 0xa2
lea rbx, [rbp - 0x6f]
cmp r8d, eax
mov edx, 0x1804b
cmova r8d, eax
call fcn.1401d4380
movzx r8d, word [0x1402c0518]
test al, al
jne 0x14015806f
xor dl, dl
mov byte [rbp - 0x6f], dl
jmp 0x1401580a9
cmp qword [0x1402cdc88], 0
movzx edx, byte [rbp - 0x6f]
je 0x1401580a9
nop dword [rax]
test dl, dl
je 0x1401580a9
lea rcx, [rbp - 0x6f]
movzx eax, dl
nop dword [rax + rax]
cmp al, 0x2e
je 0x1401580a2
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140158090
nop
jmp 0x1401580a9
mov byte [rcx], r8b
movzx edx, byte [rbp - 0x6f]
lea rcx, [rbp - 0x6f]
test dl, dl
je 0x1401580c4
movzx eax, dl
cmp al, r8b
je 0x1401580c4
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1401580b4
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140158135
movzx edx, byte [rcx]
test dl, dl
je 0x1401580f2
movzx eax, dl
cmp dl, 0x65
je 0x1401580f2
nop dword [rax]
cmp al, 0x45
je 0x1401580f2
movzx eax, byte [rcx + 1]
inc rcx
movzx edx, al
test al, al
jne 0x1401580d8
movzx eax, byte ds:[rcx - 1]
mov rdi, rcx
dec rcx
cmp al, 0x30
jne 0x14015810f
movzx eax, byte [rcx - 1]
dec rcx
cmp al, 0x30
je 0x140158104
cmp al, r8b
lea rdx, [rcx - 1]
cmovne rdx, rcx
nop word [rax + rax]
movzx eax, byte [rdi]
lea rdx, [rdx + 1]
mov byte [rdx], al
lea rdi, [rdi + 1]
test al, al
jne 0x140158120
movzx edx, byte [rbp - 0x6f]
lea rax, [rbp - 0x6f]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140158140
cmp dl, 0x2d
jne 0x14015815c
mov r14d, 1
lea rbx, [rbp - 0x6e]
dec r8d
movzx eax, byte [rbx]
mov r9, rbx
sub al, 0x30
cmp al, 0xa
jae 0x14015817e
nop dword [rax + rax]
movzx eax, byte [r9 + 1]
inc r9
sub al, 0x30
cmp al, 0xa
jb 0x140158170
mov r10d, r9d
sub r10d, ebx
lea edi, [r10 + 2]
je 0x14015819c
mov eax, 0xaaaaaaab
mul edi
mov r11d, edx
shr r11d, 1
dec r11d
jmp 0x1401581a1
xor eax, eax
mov r11d, eax
movzx r12d, byte [rsp + 0x30]
lea ecx, [r11 + r8]
add ecx, ecx
test r12b, r12b
jne 0x1401581d1
test r14d, r14d
lea eax, [rcx + 2]
cmove eax, ecx
add rax, r13
cmp qword [rsp + 0x38], rax
jae 0x1401581d1
mov r12b, 1
mov byte [rsp + 0x30], r12b
jmp 0x14015824a
mov eax, 0xaaaaaaab
mov ecx, r10d
mul edi
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
test r12b, r12b
jne 0x14015824a
test r14d, r14d
je 0x1401581f6
mov word [r15], 0x2d
add r15, 2
test r10d, r10d
je 0x14015824a
mov r12d, 1
movsx eax, byte [rbx]
dec ecx
mov word [r15], ax
inc rbx
mov eax, edi
add r15, 2
dec edi
test eax, eax
jne 0x14015823c
test ecx, ecx
je 0x140158244
movzx eax, word [0x1402c1118]
dec ecx
mov word [r15], ax
mov edi, r12d
movsx eax, byte [rbx]
mov word [r15 + 2], ax
add r15, 4
inc rbx
nop dword [rax]
test ecx, ecx
jne 0x140158201
movzx r12d, byte [rsp + 0x30]
test r14d, r14d
je 0x140158253
add r13, 2
lea eax, [r11 + r10]
lea rbx, [rax*2]
add rbx, r13
test r12b, r12b
jne 0x1401582cd
sub r8d, r10d
mov rcx, r9
mov edi, r8d
mov r8, r15
mov edx, edi
call sym.SystemInformer.exe_PhZeroExtendToUtf16Buffer
mov edx, esi
lea rbx, [rbx + rdi*2]
add rdx, rdx
lea r10, [0x140000000]
lea rcx, [rbx + 2]
lea r15, [r15 + rdi*2]
add rcx, qword [r10 + rdx*8 + 0x2c5c50]
cmp qword [rsp + 0x38], rcx
jae 0x1401582ae
mov byte [rsp + 0x30], 1
jmp 0x1401582d4
mov word [r15], 0x20
lea rcx, [r15 + 2]
mov r8, qword [r10 + rdx*8 + 0x2c5c50]
mov rdx, qword [r10 + rdx*8 + 0x2c5c58]
call fcn.14020a640
lea r10, [0x140000000]
lea r13, [rbx + 2]
mov eax, esi
mov rbx, qword [rbp - 0x78]
add rax, rax
mov rcx, qword [r10 + rax*8 + 0x2c5c50]
lea rax, [rcx + 2]
shr rax, 1
add r13, rcx
lea r15, [r15 + rax*2]
jmp case.default.0x1401575db
nop dword [rax]
test cl, cl
jns 0x14015830f
mov rax, qword [rbp - 0x78]
movzx r14d, word [rax + 8]
jmp 0x140158315
mov r14d, 0x20
mov rsi, rbx
shr rsi, 1
test ecx, ecx
jns 0x14015832a
nop
test rsi, rsi
je 0x140158357
mov rdi, r15
jmp 0x14015834d
lfence
mov rax, r8
mov rdi, r15
shr rax, 1
add rax, rax
sub rdi, rax
mov rdx, rdi
lea rcx, [rdi + rsi*2]
call fcn.14020a640
test rsi, rsi
je 0x140158357
mov rcx, rsi
movzx eax, r14w
rep stosw word [rdi], ax
mov rax, rbx
shr rax, 1
add r13, rbx
lea r15, [r15 + rax*2]
mov ebx, dword ds:[rsp + 0x60]
lea r10, [0x140000000]
movzx esi, byte [rsp + 0x30]
mov r11d, 0x30
mov rax, qword [rsp + 0x58]
test ebx, ebx
jne 0x140157590
movaps xmm7, xmmword [rsp + 0x4a0]
movaps xmm6, xmmword [rsp + 0x4b0]
mov r12, qword [rsp + 0x4d0]
mov rdi, qword [rsp + 0x78]
mov r14, qword [rbp - 0x80]
mov rbx, qword [rsp + 0x508]
lea rax, [r13 + 2]
mov r13, qword [rsp + 0x4c8]
mov rdx, qword [rsp + 0x38]
test sil, sil
jne 0x1401583cf
cmp rdx, rax
jae 0x14015841d
mov sil, 1
mov rcx, rax
test rdi, rdi
je 0x1401583e4
test rdx, rdx
je 0x1401583e4
xor eax, eax
mov word [rdi], ax
mov rax, rcx
mov r15, qword [rsp + 0x4c0]
mov rdi, qword [rsp + 0x4d8]
test r14, r14
je 0x1401583fc
mov qword [r14], rax
test sil, sil
sete al
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.1401e4160
add rsp, 0x4e0
pop r14
pop rsi
pop rbp
ret
xor ecx, ecx
mov word [r15], cx
jmp 0x1401583e4