Function at 0x1400e9590
Capabilities:
Get geographical location

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x6b0]
sub rsp, 0x7b0
mov r14d, 0x1e
mov edi, edx
mov rdx, qword [0x140196800]
cmp r8, r14
mov rbx, rcx
cmovae r14, r8
mov qword [rsp + 0x58], r14
lea rcx, [r14 + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
xor r9d, r9d
mov qword [rsp + 0x50], rax
mov r15, rax
mov qword [rsp + 0x68], r9
mov r13d, r9d
mov qword [rax], r14
add rax, 0x10
mov qword [r15 + 8], rax
mov word [r14 + rax], r9w
test byte [0x14018e290], 1
mov rsi, qword [r15 + 8]
jne 0x1400e96df
lock bts qword [0x14018e290], 0x1f
jae 0x1400e9631
test byte [0x14018e290], 1
jne 0x1400e96df
xor edx, edx
lea rcx, [0x14018e290]
call sym.ProcessHacker.exe_PhfWaitForEvent
jmp 0x1400e96dc
mov r9d, 4
lea r8, [rsp + 0x78]
mov ecx, 0x400
lea edx, [r9 + 0xa]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1400e9671
mov rax, qword [rsp + 0x78]
test ax, ax
je 0x1400e9671
movzx edx, word [0x14018e218]
cmp word [rsp + 0x7a], r13w
cmove dx, ax
mov word [0x14018e218], dx
mov r9d, 4
lea r8, [rsp + 0x78]
mov ecx, 0x400
lea edx, [r9 + 0xb]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1400e96b1
mov rax, qword [rsp + 0x78]
test ax, ax
je 0x1400e96b1
movzx ecx, word [0x14018dfb4]
cmp word [rsp + 0x7a], r13w
cmove cx, ax
mov word [0x14018dfb4], cx
cmp word [0x14018e218], 0x2e
je 0x1400e96d0
lea rdx, [0x140162f16]
xor ecx, ecx
call fcn.140115fc8
mov qword [0x1401941c0], rax
lea rcx, [0x14018e290]
call sym.ProcessHacker.exe_PhfSetEvent
xor r9d, r9d
test edi, edi
je 0x1400ea944
mov qword [rsp + 0x7a8], r12
lea rcx, [0x140000000]
movaps xmmword [rsp + 0x790], xmm6
mov r10d, 2
movsd xmm6, qword [0x14016e6d0]
movaps xmmword [rsp + 0x780], xmm7
movsd xmm7, qword [0x14016e678]
movaps xmmword [rsp + 0x770], xmm8
movsd xmm8, qword [0x14016e710]
jmp 0x1400e9733
xor r9d, r9d
mov r8, rbx
mov qword [rsp + 0x60], rbx
dec edi
mov qword [rbp - 0x60], r13
mov rdx, rbx
mov dword [rbp + 0x6f8], edi
add rbx, 0x20
mov r12d, r9d
mov r11d, dword [r8]
mov eax, r11d
and eax, 0x3f
mov qword [rbp + 0x6f0], rbx
cmp eax, 0xc
ja case.default.0x1400e977d
cdqe
mov ecx, dword [rcx + rax*4 + 0xea96c]
lea rax, [0x140000000]
add rcx, rax
jmp rcx
lea rbx, [r13 + 2]
cmp r14, rbx
jae 0x1400e97fa
mov rdx, qword [0x140196800]
lea rax, [r14 + r14]
cmp rax, rbx
mov rsi, rbx
cmovae rsi, rax
mov qword [rsp + 0x58], rsi
lea rcx, [rsi + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
xor edx, edx
mov r8, r13
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], rsi
mov qword [rax + 8], rcx
mov word [rsi + rcx], dx
mov rdx, qword [r15 + 8]
mov rcx, qword [rax + 8]
call fcn.14010e700
lea rcx, [r15 - 0x10]
or edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x1400e97e5
call fcn.1400c8bc0
mov rax, qword [rdi + 8]
mov r8, qword [rsp + 0x60]
shr r13, 1
mov qword [rsp + 0x50], rdi
lea rsi, [rax + r13*2]
movzx eax, word [r8 + 0x10]
mov r13, rbx
mov word [rsi], ax
add rsi, 2
mov qword [rsp + 0x68], rbx
jmp case.default.0x1400e977d
mov r8, qword [r8 + 0x10]
lea rcx, [r8 + r13]
cmp r14, rcx
jae 0x1400e989b
mov rdx, qword [0x140196800]
lea rax, [r14 + r14]
cmp rax, rcx
mov rbx, rcx
cmovae rbx, rax
mov qword [rsp + 0x58], rbx
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
xor edx, edx
mov r8, r13
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rbx + rcx], dx
mov rdx, qword [r15 + 8]
mov rcx, qword [rax + 8]
call fcn.14010e700
lea rcx, [r15 - 0x10]
or edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x1400e987d
call fcn.1400c8bc0
mov rax, qword [rdi + 8]
mov rcx, r13
mov r11, qword [rsp + 0x60]
shr rcx, 1
mov qword [rsp + 0x50], rdi
mov r8, qword [r11 + 0x10]
lea rsi, [rax + rcx*2]
jmp 0x1400e989e
mov r11, rdx
mov rdx, qword [r11 + 0x18]
mov rcx, rsi
call fcn.14010e700
mov r8, qword [rsp + 0x60]
mov rax, qword [r8 + 0x10]
shr rax, 1
add r13, qword [r8 + 0x10]
lea rsi, [rsi + rax*2]
jmp 0x1400ea7d4
mov rcx, qword [r8 + 0x10]
call sym.ProcessHacker.exe_PhCountStringZ
mov r15, qword [rsp + 0x58]
lea rdi, [rax + rax]
lea r14, [rdi + r13]
cmp r15, r14
jae 0x1400e9951
mov rdx, qword [0x140196800]
lea rax, [r15 + r15]
cmp rax, r14
mov r15, r14
cmovae r15, rax
mov qword [rsp + 0x58], r15
lea rcx, [r15 + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rsi, qword [rsp + 0x50]
xor edx, edx
mov r8, r13
mov rbx, rax
lea rcx, [rax + 0x10]
mov qword [rax], r15
mov qword [rax + 8], rcx
mov word [r15 + rcx], dx
mov rdx, qword [rsi + 8]
mov rcx, qword [rax + 8]
call fcn.14010e700
lea rcx, [rsi - 0x10]
or edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x1400e9941
call fcn.1400c8bc0
mov rax, qword [rbx + 8]
shr r13, 1
mov qword [rsp + 0x50], rbx
lea rsi, [rax + r13*2]
mov r11, qword [rsp + 0x60]
mov r8, rdi
mov rcx, rsi
mov rdx, qword [r11 + 0x10]
call fcn.14010e700
shr rdi, 1
mov r13, r14
mov qword [rsp + 0x68], r14
lea rsi, [rsi + rdi*2]
mov r8, qword [rsp + 0x60]
jmp case.default.0x1400e977d
cmp r11d, 3
jne 0x1400e998e
mov rbx, qword [r8 + 0x18]
mov rdi, qword [r8 + 0x10]
jmp 0x1400e999f
mov rbx, qword [r8 + 0x10]
or rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], 0
jne 0x1400e9996
mov r8d, edi
lea rcx, [rbp + 0x708]
mov rdx, rbx
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeSize]
test eax, eax
js 0x1400e9974
mov edx, dword [rbp + 0x708]
lea rcx, [rdx + r13]
cmp r14, rcx
jae 0x1400e9a3c
mov rdx, qword [0x140196800]
lea rax, [r14 + r14]
cmp rax, rcx
mov r14, rcx
cmovae r14, rax
mov qword [rsp + 0x58], r14
lea rcx, [r14 + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
xor edx, edx
mov r8, r13
mov rsi, rax
lea rcx, [rax + 0x10]
mov qword [rax], r14
mov qword [rax + 8], rcx
mov word [r14 + rcx], dx
mov rdx, qword [r15 + 8]
mov rcx, qword [rax + 8]
call fcn.14010e700
lea rcx, [r15 - 0x10]
or edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x1400e9a23
call fcn.1400c8bc0
mov rax, qword [rsi + 8]
mov rcx, r13
mov edx, dword [rbp + 0x708]
shr rcx, 1
mov qword [rsp + 0x50], rsi
lea rsi, [rax + rcx*2]
mov r9, rbx
mov dword [rsp + 0x20], edi
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
test eax, eax
js 0x1400e9974
mov ecx, dword [rbp + 0x708]
mov eax, ecx
shr rax, 1
add r13, rcx
lea rsi, [rsi + rax*2]
jmp 0x1400ea7cf
mov eax, dword [r8 + 0x10]
mov r12d, eax
mov edi, eax
shr r12d, 0x1f
neg edi
test eax, eax
cmovns edi, eax
jmp 0x1400e9a88
mov edi, dword [r8 + 0x10]
mov r10d, 0xa
bt r11d, 8
jae 0x1400e9aa5
movzx ecx, byte [r8 + 0xa]
lea eax, [rcx - 2]
cmp al, 0x43
ja 0x1400e9aa5
movzx r10d, cl
bt r11d, 0x1d
lea r9, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
lea rax, str.0123456789abcdefghijklmnopqrstuvwxyz_________._:_________
cmovae r9, rax
lea rbx, [rbp + 0x3ae]
xor r15d, r15d
mov r14d, r15d
test edi, edi
je 0x1400e9b4e
bt r11d, 0x10
jae 0x1400e9b30
mov r8d, r15d
nop dword [rax + rax]
xor edx, edx
mov eax, edi
div r10d
inc r14d
inc r8d
mov edi, eax
movsx ecx, byte [rdx + r9]
mov word [rbx], cx
sub rbx, 2
cmp r8d, 3
jne 0x1400e9b19
test eax, eax
je 0x1400e9b1d
movzx eax, word [0x14018dfb4]
mov r8d, r15d
mov word [rbx], ax
sub rbx, 2
inc r14d
test edi, edi
jne 0x1400e9ae0
mov r8, qword [rsp + 0x60]
mov eax, 1
test r12d, r12d
je 0x1400e9b6b
mov ecx, eax
jmp 0x1400e9b76
xor edx, edx
mov eax, edi
div r10d
inc r14d
mov edi, eax
movsx ecx, byte [rdx + r9]
mov word [rbx], cx
sub rbx, 2
test eax, eax
jne 0x1400e9b30
jmp 0x1400e9b22
mov eax, 0x30
lea rbx, [rbp + 0x3ac]
mov word [rbp + 0x3ae], ax
mov eax, 1
mov r14d, eax
jmp 0x1400e9b27
bt r11d, 0x11
mov ecx, r15d
cmovb ecx, eax
and r11d, 0x50000
cmp r11d, 0x40000
jne 0x1400e9ba3
movzx edx, word [r8 + 6]
lea eax, [rcx + r14]
cmp eax, edx
jae 0x1400e9ba3
mov eax, edx
or r12d, 4
sub eax, ecx
sub eax, r14d
mov dword [rbp - 0x80], eax
add ecx, eax
lea eax, [rcx + r14]
lea r15, [rax*2]
mov rax, qword [rsp + 0x58]
add r15, r13
cmp rax, r15
jae 0x1400e9c2d
mov rdx, qword [0x140196800]
add rax, rax
cmp rax, r15
mov rsi, r15
cmovae rsi, rax
mov qword [rsp + 0x58], rsi
lea rcx, [rsi + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
xor edx, edx
mov r8, r13
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], rsi
mov qword [rax + 8], rcx
mov word [rsi + rcx], dx
mov rsi, qword [rsp + 0x50]
mov rcx, qword [rax + 8]
mov rdx, qword [rsi + 8]
call fcn.14010e700
lea rcx, [rsi - 0x10]
or edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x1400e9c1d
call fcn.1400c8bc0
mov rax, qword [rdi + 8]
shr r13, 1
mov qword [rsp + 0x50], rdi
lea rsi, [rax + r13*2]
test r12b, 1
je 0x1400e9c3a
mov eax, 0x2d
jmp 0x1400e9c4d
mov r11, qword [rsp + 0x60]
test dword [r11], 0x20000
je 0x1400e9c54
mov eax, 0x2b
mov word [rsi], ax
add rsi, 2
test r12b, 4
je 0x1400e9c77
mov edx, dword [rbp - 0x80]
test rdx, rdx
je 0x1400e9c73
mov eax, 0x30
mov rdi, rsi
movzx eax, ax
mov rcx, rdx
rep stosw word [rdi], ax
lea rsi, [rsi + rdx*2]
mov edi, r14d
lea rdx, [rbx + 2]
add rdi, rdi
mov rcx, rsi
mov r8, rdi
call fcn.14010e700
mov r8, qword [rsp + 0x60]
add rsi, rdi
mov r13, r15
mov qword [rsp + 0x68], r15
jmp case.default.0x1400e977d
mov rax, qword [rdx + 0x10]
mov r12, rax
cqo
mov rdi, rax
shr r12, 0x3f
xor rdi, rdx
sub rdi, rdx
jmp 0x1400e9cbd
mov rdi, qword [r8 + 0x10]
mov r9d, 0xa
bt r11d, 8
jae 0x1400e9cdb
movzx eax, byte [r8 + 0xa]
cmp al, 2
jb 0x1400e9cdb
cmp al, 0x45
ja 0x1400e9cdb
movzx r9d, al
bt r11d, 0x1d
lea r10, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
lea rax, str.0123456789abcdefghijklmnopqrstuvwxyz_________._:_________
cmovae r10, rax
lea rbx, [rbp + 0x3ae]
xor r15d, r15d
mov r14d, r15d
test rdi, rdi
je 0x1400e9d93
bt r11d, 0x10
jae 0x1400e9d70
mov r8d, r15d
xor edx, edx
mov rax, rdi
div r9
inc r14d
inc r8d
mov rdi, rax
mov eax, edx
movsx ecx, byte [rax + r10]
mov word [rbx], cx
sub rbx, 2
cmp r8d, 3
jne 0x1400e9d50
test rdi, rdi
je 0x1400e9d55
movzx eax, word [0x14018dfb4]
mov r8d, r15d
mov word [rbx], ax
sub rbx, 2
inc r14d
test rdi, rdi
jne 0x1400e9d12
mov r8, qword [rsp + 0x60]
mov eax, 1
test r12d, r12d
je 0x1400e9db0
mov ecx, eax
jmp 0x1400e9dbb
xor edx, edx
mov rax, rdi
div r9
inc r14d
mov rdi, rax
mov eax, edx
movsx ecx, byte [rax + r10]
mov word [rbx], cx
sub rbx, 2
test rdi, rdi
jne 0x1400e9d70
jmp 0x1400e9d5a
mov eax, 0x30
lea rbx, [rbp + 0x3ac]
mov word [rbp + 0x3ae], ax
mov eax, 1
mov r14d, eax
jmp 0x1400e9d5f
bt r11d, 0x11
mov ecx, r15d
cmovb ecx, eax
and r11d, 0x50000
cmp r11d, 0x40000
jne 0x1400e9de8
movzx edx, word [r8 + 6]
lea eax, [rcx + r14]
cmp eax, edx
jae 0x1400e9de8
mov eax, edx
or r12d, 4
sub eax, ecx
sub eax, r14d
mov dword [rbp - 0x7c], eax
add ecx, eax
lea eax, [rcx + r14]
lea r15, [rax*2]
mov rax, qword [rsp + 0x58]
add r15, r13
cmp rax, r15
jae 0x1400e9e72
mov rdx, qword [0x140196800]
add rax, rax
cmp rax, r15
mov rsi, r15
cmovae rsi, rax
mov qword [rsp + 0x58], rsi
lea rcx, [rsi + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
xor edx, edx
mov r8, r13
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], rsi
mov qword [rax + 8], rcx
mov word [rcx + rsi], dx
mov rsi, qword [rsp + 0x50]
mov rcx, qword [rax + 8]
mov rdx, qword [rsi + 8]
call fcn.14010e700
lea rcx, [rsi - 0x10]
or edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x1400e9e62
call fcn.1400c8bc0
mov rax, qword [rdi + 8]
shr r13, 1
mov qword [rsp + 0x50], rdi
lea rsi, [rax + r13*2]
test r12b, 1
je 0x1400e9e7f
mov eax, 0x2d
jmp 0x1400e9e92
mov r11, qword [rsp + 0x60]
test dword [r11], 0x20000
je 0x1400e9e99
mov eax, 0x2b
mov word [rsi], ax
add rsi, 2
test r12b, 4
je 0x1400e9c77
mov edx, dword [rbp - 0x7c]
jmp 0x1400e9c5d
test r11b, 0x40
je 0x1400e9ec3
movzx edx, word [r8 + 4]
mov eax, 0xa2
cmp edx, eax
jbe 0x1400e9ec8
mov edx, eax
jmp 0x1400e9ec8
mov edx, 6
bt r11d, 0xc
jae 0x1400e9ed6
mov eax, 0x65
jmp 0x1400e9ee8
bt r11d, 0xd
mov eax, 0x66
mov ecx, 0x61
cmovb eax, ecx
movsd xmm0, qword [r8 + 0x10]
lea ecx, [rax - 0x20]
bt r11d, 0x1d
movsd qword [rbp - 0x78], xmm0
mov r8d, 0x3ff
lea r15, [rbp - 0x4f]
cmovae ecx, eax
mov rax, qword [0x1401941c0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r9
lea r9, [rbp + 0x3b0]
mov dword [rsp + 0x30], edx
lea rdx, [rbp - 0x4f]
mov dword [rsp + 0x28], ecx
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x20], 0x15e
call fcn.1401177f8
mov r11, qword [rsp + 0x60]
movzx edx, byte [rbp - 0x4f]
mov r10d, dword [r11]
bt r10d, 0xf
jae 0x1400e9fe4
movzx r8d, byte [0x14018e218]
lea rcx, [rbp - 0x4f]
test dl, dl
je 0x1400e9f78
movzx eax, dl
cmp al, r8b
je 0x1400e9f78
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1400e9f68
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400e9fe4
movzx eax, byte [rcx]
test al, al
je 0x1400e9fa1
nop dword [rax]
sub al, 0x45
test al, 0xdf
je 0x1400e9fa1
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1400e9f90
movzx eax, byte [rcx - 1]
mov rdi, rcx
dec rcx
cmp al, 0x30
jne 0x1400e9fbb
nop
movzx eax, byte [rcx - 1]
dec rcx
cmp al, 0x30
je 0x1400e9fb0
cmp al, r8b
lea rdx, [rcx - 1]
cmovne rdx, rcx
nop word [rax + rax]
movzx eax, byte [rdi]
lea rdi, [rdi + 1]
inc rdx
mov byte [rdx], al
test al, al
jne 0x1400e9fd0
movzx edx, byte [rbp - 0x4f]
lea rax, [rbp - 0x4f]
or r14, 0xffffffffffffffff
nop dword [rax]
inc r14
cmp byte [rax + r14], 0
jne 0x1400e9ff0
cmp dl, 0x2d
jne 0x1400ea018
mov eax, 1
lea r15, [rbp - 0x4e]
dec r14d
mov dword [rbp + 0x700], eax
mov r9d, eax
xor ecx, ecx
jmp 0x1400ea035
mov ecx, 0
bt r10d, 0x11
mov r9d, ecx
mov eax, 2
cmovb r9d, eax
mov dword [rbp + 0x700], r9d
mov eax, r10d
and eax, 0x13000
cmp eax, 0x10000
jne 0x1400ea1f1
movzx eax, byte [r15]
mov rbx, r15
sub al, 0x30
cmp al, 0xa
jae 0x1400ea06d
nop word [rax + rax]
movzx eax, byte [rbx + 1]
inc rbx
sub al, 0x30
cmp al, 0xa
jb 0x1400ea060
mov r13d, ebx
sub r13d, r15d
mov dword [rsp + 0x70], r13d
lea edi, [r13 + 2]
je 0x1400ea090
mov eax, 0xaaaaaaab
mul edi
mov r12d, edx
shr r12d, 1
dec r12d
jmp 0x1400ea093
mov r12d, ecx
lea eax, [r12 + r14]
test r9d, r9d
lea ecx, [rax + rax]
lea eax, [rcx + 2]
cmove eax, ecx
mov rcx, qword [rsp + 0x68]
add rcx, rax
mov rax, qword [rsp + 0x58]
cmp rax, rcx
jae 0x1400ea142
add rax, rax
mov rdx, rcx
cmp rax, rcx
cmovae rdx, rax
mov qword [rsp + 0x58], rdx
lea rcx, [rdx + 0x12]
mov rdx, qword [0x140196800]
call sym.ProcessHacker.exe_PhCreateObject
mov r8, qword [rsp + 0x68]
mov rsi, rax
mov rax, qword [rsp + 0x58]
lea rcx, [rsi + 0x10]
xor edx, edx
mov qword [rsi + 8], rcx
mov qword [rsi], rax
mov word [rcx + rax], dx
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsi + 8]
mov rdx, qword [rdx + 8]
call fcn.14010e700
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff0
or edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x1400ea126
call fcn.1400c8bc0
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsi + 8]
mov r9d, dword [rbp + 0x700]
shr rcx, 1
mov qword [rsp + 0x50], rsi
lea rsi, [rax + rcx*2]
mov eax, 0xaaaaaaab
mov ecx, r13d
mul edi
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
test r9b, 1
je 0x1400ea160
mov eax, 0x2d
jmp 0x1400ea16b
test r9b, 2
je 0x1400ea172
mov eax, 0x2b
mov word [rsi], ax
add rsi, 2
test r13d, r13d
je 0x1400ea1b5
mov r13d, 2
nop dword [rax]
movsx eax, byte [r15]
lea r15, [r15 + 1]
mov word [rsi], ax
dec ecx
mov eax, edi
add rsi, r13
dec edi
test eax, eax
jne 0x1400ea1ac
test ecx, ecx
je 0x1400ea1b0
movzx eax, word [0x14018dfb4]
mov edi, r13d
mov word [rsi], ax
add rsi, r13
test ecx, ecx
jne 0x1400ea180
mov r13d, dword [rsp + 0x70]
sub r14d, r13d
mov r8, rsi
mov edx, r14d
mov rcx, rbx
mov edi, r14d
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
mov rax, qword [rsp + 0x68]
lea ecx, [r12 + r13]
cmp dword [rbp + 0x700], 0
lea rsi, [rsi + r14*2]
lea rdx, [rax + 2]
cmove rdx, rax
add rcx, rdi
lea r13, [rdx + rcx*2]
jmp 0x1400ea7cf
test r9d, r9d
mov rdx, rcx
setne dl
mov rcx, rdx
bt r10d, 0x12
jae 0x1400ea230
movzx r8d, word [r11 + 6]
mov edi, r14d
lea rax, [rdi + rdx]
cmp rax, r8
jae 0x1400ea230
or r9d, 4
mov ecx, r8d
sub rcx, rdi
mov dword [rbp + 0x700], r9d
mov rax, rcx
sub rax, rdx
mov qword [rbp - 0x70], rax
mov r12, qword [rsp + 0x58]
mov r14d, r14d
lea rax, [r14 + rcx]
lea rbx, [rax*2]
add rbx, r13
cmp r12, rbx
jae 0x1400ea2c7
mov rdx, qword [0x140196800]
lea rax, [r12 + r12]
cmp rax, rbx
mov r12, rbx
cmovae r12, rax
mov qword [rsp + 0x58], r12
lea rcx, [r12 + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rsi, qword [rsp + 0x50]
xor edx, edx
mov r8, r13
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], r12
mov qword [rax + 8], rcx
mov word [rcx + r12], dx
mov rdx, qword [rsi + 8]
mov rcx, qword [rax + 8]
call fcn.14010e700
lea rcx, [rsi - 0x10]
or edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x1400ea2b0
call fcn.1400c8bc0
mov rax, qword [rdi + 8]
mov r9d, dword [rbp + 0x700]
shr r13, 1
mov qword [rsp + 0x50], rdi
lea rsi, [rax + r13*2]
test r9b, 1
je 0x1400ea2d4
mov eax, 0x2d
jmp 0x1400ea2df
test r9b, 2
je 0x1400ea2e6
mov eax, 0x2b
mov word [rsi], ax
add rsi, 2
test r9b, 4
je 0x1400ea30a
mov rdx, qword [rbp - 0x70]
test rdx, rdx
je 0x1400ea306
mov eax, 0x30
mov rdi, rsi
movzx eax, ax
mov rcx, rdx
rep stosw word [rdi], ax
lea rsi, [rsi + rdx*2]
mov r8, rsi
mov rdx, r14
mov rcx, r15
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
mov r8, qword [rsp + 0x60]
lea rsi, [rsi + r14*2]
mov r13, rbx
mov qword [rsp + 0x68], rbx
jmp case.default.0x1400e977d
mov rax, qword [r8 + 0x10]
xorps xmm0, xmm0
mov r15d, r9d
cvtsi2sd xmm0, rax
test rax, rax
jns 0x1400ea347
addsd xmm0, xmm8
jne 0x1400ea3e6
lea rbx, [r13 + 2]
cmp r14, rbx
jae 0x1400ea3cd
mov rdx, qword [0x140196800]
lea rax, [r14 + r14]
cmp rax, rbx
mov rsi, rbx
cmovae rsi, rax
mov qword [rsp + 0x58], rsi
lea rcx, [rsi + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
xor edx, edx
mov r8, r13
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], rsi
mov qword [rax + 8], rcx
mov word [rsi + rcx], dx
mov rsi, qword [rsp + 0x50]
mov rcx, qword [rax + 8]
mov rdx, qword [rsi + 8]
call fcn.14010e700
lea rcx, [rsi - 0x10]
or edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x1400ea3b8
call fcn.1400c8bc0
mov rax, qword [rdi + 8]
mov r8, qword [rsp + 0x60]
shr r13, 1
mov qword [rsp + 0x50], rdi
lea rsi, [rax + r13*2]
mov eax, 0x30
mov qword [rsp + 0x68], rbx
mov word [rsi], ax
mov r13, rbx
add rsi, 2
jmp case.default.0x1400e977d
bt r11d, 8
jae 0x1400ea3f4
movzx eax, byte [r8 + 0xa]
jmp 0x1400ea3fa
mov eax, dword [0x140190e48]
comisd xmm0, xmm6
jb 0x1400ea418
cmp r15d, 7
jae 0x1400ea418
cmp r15d, eax
jae 0x1400ea418
mulsd xmm0, xmm7
inc r15d
comisd xmm0, xmm6
jae 0x1400ea400
test r11b, 0x40
je 0x1400ea425
movzx eax, word [r8 + 4]
jmp 0x1400ea428
mov eax, r10d
movzx ecx, ax
lea rdx, [rbp - 0x4f]
mov eax, 0xa2
mov dword [rbp + 0x700], r9d
cmp ecx, eax
movsd qword [rbp - 0x68], xmm0
mov r8d, 0x3ff
lea r12, [rbp - 0x4f]
cmova ecx, eax
mov rax, qword [0x1401941c0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r9
lea r9, [rbp + 0x510]
mov dword [rsp + 0x30], ecx
lea rcx, [rbp - 0x68]
mov dword [rsp + 0x28], 0x66
mov qword [rsp + 0x20], 0x15e
call fcn.1401177f8
movzx edx, byte [rbp - 0x4f]
lea rcx, [rbp - 0x4f]
movzx r8d, byte [0x14018e218]
test dl, dl
je 0x1400ea4b0
movzx eax, dl
nop dword [rax]
cmp al, r8b
je 0x1400ea4b0
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1400ea4a0
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400ea514
movzx eax, byte [rcx]
test al, al
je 0x1400ea4d2
sub al, 0x45
test al, 0xdf
je 0x1400ea4d2
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1400ea4c1
movzx eax, byte [rcx - 1]
mov rdi, rcx
dec rcx
cmp al, 0x30
jne 0x1400ea4eb
movzx eax, byte [rcx - 1]
dec rcx
cmp al, 0x30
je 0x1400ea4e0
cmp al, r8b
lea rdx, [rcx - 1]
cmovne rdx, rcx
nop word [rax + rax]
movzx eax, byte [rdi]
lea rdi, [rdi + 1]
inc rdx
mov byte [rdx], al
test al, al
jne 0x1400ea500
movzx edx, byte [rbp - 0x4f]
lea rax, [rbp - 0x4f]
or r14, 0xffffffffffffffff
nop dword [rax]
inc r14
cmp byte [rax + r14], 0
jne 0x1400ea520
cmp dl, 0x2d
jne 0x1400ea546
mov eax, 1
lea r12, [rbp - 0x4e]
mov r8d, eax
mov dword [rbp + 0x700], eax
dec r14d
jmp 0x1400ea54d
mov r8d, dword [rbp + 0x700]
movzx eax, byte [r12]
mov rbx, r12
sub al, 0x30
cmp al, 0xa
jae 0x1400ea56d
nop dword [rax + rax]
movzx eax, byte [rbx + 1]
inc rbx
sub al, 0x30
cmp al, 0xa
jb 0x1400ea560
mov r9d, ebx
sub r9d, r12d
mov dword [rsp + 0x70], r9d
lea edi, [r9 + 2]
je 0x1400ea590
mov eax, 0xaaaaaaab
mul edi
mov r13d, edx
shr r13d, 1
dec r13d
jmp 0x1400ea595
xor eax, eax
mov r13d, eax
lea eax, [r14 + r13]
test r8d, r8d
lea ecx, [rax + rax]
lea eax, [rcx + 2]
cmove eax, ecx
mov rcx, qword [rsp + 0x68]
add rcx, rax
mov rax, qword [rsp + 0x58]
cmp rax, rcx
jae 0x1400ea642
add rax, rax
mov rdx, rcx
cmp rax, rcx
cmovae rdx, rax
mov qword [rsp + 0x58], rdx
lea rcx, [rdx + 0x12]
mov rdx, qword [0x140196800]
call sym.ProcessHacker.exe_PhCreateObject
mov r8, qword [rsp + 0x68]
mov rsi, rax
mov rax, qword [rsp + 0x58]
lea rcx, [rsi + 0x10]
xor edx, edx
mov qword [rsi + 8], rcx
mov qword [rsi], rax
mov word [rcx + rax], dx
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsi + 8]
mov rdx, qword [rax + 8]
call fcn.14010e700
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff0
or edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x1400ea628
call fcn.1400c8bc0
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsi + 8]
mov r9d, dword [rsp + 0x70]
shr rcx, 1
mov qword [rsp + 0x50], rsi
lea rsi, [rax + rcx*2]
mov eax, 0xaaaaaaab
mov r8d, r9d
mul edi
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
cmp dword [rbp + 0x700], 0
je 0x1400ea668
mov eax, 0x2d
mov word [rsi], ax
add rsi, 2
test r9d, r9d
je 0x1400ea6ba
mov r9d, 2
nop dword [rax]
nop word [rax + rax]
movsx eax, byte [r12]
lea r12, [r12 + 1]
mov word [rsi], ax
dec r8d
mov eax, edi
add rsi, r9
dec edi
test eax, eax
jne 0x1400ea6b0
test r8d, r8d
je 0x1400ea6b5
movzx eax, word [0x14018dfb4]
mov edi, r9d
mov word [rsi], ax
add rsi, r9
test r8d, r8d
jne 0x1400ea680
mov r9d, dword [rsp + 0x70]
sub r14d, r9d
mov r8, rsi
mov edx, r14d
mov rcx, rbx
mov edi, r14d
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
mov rax, qword [rsp + 0x68]
lea rbx, [rsi + r14*2]
cmp dword [rbp + 0x700], 0
lea r12, [0x140000000]
mov ecx, dword [rsp + 0x70]
mov esi, r15d
mov r15, qword [rsp + 0x58]
lea rdx, [rax + 2]
cmove rdx, rax
add ecx, r13d
add rcx, rdi
add rsi, rsi
lea r14, [rdx + rcx*2]
mov rcx, qword [r12 + rsi*8 + 0x18e220]
lea rax, [r14 + 2]
add rax, rcx
cmp r15, rax
jae 0x1400ea794
mov rdx, qword [0x140196800]
lea rax, [r15 + r15]
lea r15, [rcx + 2]
add r15, r14
cmp rax, r15
cmovae r15, rax
mov qword [rsp + 0x58], r15
lea rcx, [r15 + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rbx, qword [rsp + 0x50]
mov rdi, rax
mov r8, r14
lea rcx, [rax + 0x10]
mov qword [rax], r15
mov qword [rax + 8], rcx
xor eax, eax
mov word [rcx + r15], ax
mov rdx, qword [rbx + 8]
mov rcx, qword [rdi + 8]
call fcn.14010e700
lea rcx, [rbx - 0x10]
or edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x1400ea781
call fcn.1400c8bc0
mov rax, qword [rdi + 8]
mov rcx, r14
shr rcx, 1
mov qword [rsp + 0x50], rdi
lea rbx, [rax + rcx*2]
mov eax, 0x20
lea rcx, [rbx + 2]
mov word [rbx], ax
mov r8, qword [r12 + rsi*8 + 0x18e220]
mov rdx, qword [r12 + rsi*8 + 0x18e228]
call fcn.14010e700
mov rcx, qword [r12 + rsi*8 + 0x18e220]
lea rax, [rcx + 2]
shr rax, 1
lea r13, [rcx + 2]
add r13, r14
lea rsi, [rbx + rax*2]
mov r8, qword [rsp + 0x60]
mov qword [rsp + 0x68], r13
mov eax, dword [r8]
mov r15, r13
sub r15, qword [rbp - 0x60]
test eax, 0xc0000000
je 0x1400ea8f7
movzx ebx, word [r8 + 6]
add rbx, rbx
cmp r15, rbx
jae 0x1400ea8f7
mov rcx, qword [rsp + 0x58]
sub rbx, r15
add r13, rbx
cmp rcx, r13
jae 0x1400ea88e
mov rdx, qword [0x140196800]
lea rax, [rcx + rcx]
cmp rax, r13
mov rsi, r13
cmovae rsi, rax
mov qword [rsp + 0x58], rsi
lea rcx, [rsi + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov r14, qword [rsp + 0x50]
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], rsi
mov qword [rax + 8], rcx
xor eax, eax
mov word [rcx + rsi], ax
mov rsi, qword [rsp + 0x68]
mov rdx, qword [r14 + 8]
mov r8, rsi
mov rcx, qword [rdi + 8]
call fcn.14010e700
lea rcx, [r14 - 0x10]
or edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x1400ea876
call fcn.1400c8bc0
mov rax, qword [rdi + 8]
mov r8, qword [rsp + 0x60]
shr rsi, 1
mov qword [rsp + 0x50], rdi
lea rsi, [rax + rsi*2]
mov eax, dword [r8]
test al, al
jns 0x1400ea899
movzx r12d, word [r8 + 8]
jmp 0x1400ea89f
mov r12d, 0x20
shr rbx, 1
test eax, eax
jns 0x1400ea8be
test rbx, rbx
je 0x1400ea8b8
movzx eax, r12w
mov rdi, rsi
mov rcx, rbx
rep stosw word [rdi], ax
lea r14, [rbx + rbx]
jmp 0x1400ea8ef
mov rax, r15
lea r14, [rbx + rbx]
shr rax, 1
mov rdi, rsi
add rax, rax
mov r8, r15
sub rdi, rax
mov rdx, rdi
lea rcx, [r14 + rdi]
call fcn.14010e700
test rbx, rbx
je 0x1400ea8ef
movzx eax, r12w
mov rcx, rbx
rep stosw word [rdi], ax
add rsi, r14
mov qword [rsp + 0x68], r13
mov edi, dword [rbp + 0x6f8]
lea rcx, [0x140000000]
mov r14, qword [rsp + 0x58]
mov r10d, 2
mov r15, qword [rsp + 0x50]
mov rbx, qword [rbp + 0x6f0]
test edi, edi
jne 0x1400e9730
movaps xmm8, xmmword [rsp + 0x770]
movaps xmm7, xmmword [rsp + 0x780]
movaps xmm6, xmmword [rsp + 0x790]
mov r12, qword [rsp + 0x7a8]
mov rcx, qword [r15 + 8]
mov qword [r15], r13
shr r13, 1
xor eax, eax
mov word [rcx + r13*2], ax
mov rax, r15
add rsp, 0x7b0
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret