Function at 0x1401575e0
Capabilities:
Get geographical location

Disassembly:
mov r11, rsp
push rbp
push rsi
push r14
lea rbp, [r11 - 0x3f8]
sub rsp, 0x4e0
mov rax, qword [0x1402bf040]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov r14, qword [rbp + 0x420]
mov rax, rcx
mov qword [r11 + 0x10], rbx
mov ebx, edx
mov qword [r11 - 0x20], rdi
mov rdi, r8
mov qword [r11 - 0x30], r13
mov qword [r11 - 0x38], r15
mov r15, r8
mov qword [rsp + 0x78], r8
xor r8d, r8d
test r15, r15
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x58], rcx
mov r13d, r8d
sete sil
mov qword [rbp - 0x80], r14
test byte [0x1402c5c60], 1
jne 0x14015773d
lock bts qword [0x1402c5c60], 0x1f
setb al
test al, al
jne 0x140157714
mov r9d, 4
lea r8, [rbp - 0x78]
mov edx, 0xe
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1401576a1
mov rax, qword [rbp - 0x78]
test ax, ax
je 0x1401576a1
cmp word [rbp - 0x76], r13w
jne 0x1401576a1
mov word [0x1402c0518], ax
mov r9d, 4
lea r8, [rbp - 0x78]
mov edx, 0xf
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1401576d6
mov rax, qword [rbp - 0x78]
test ax, ax
je 0x1401576d6
cmp word [rbp - 0x76], r13w
jne 0x1401576d6
mov word [0x1402c1118], ax
cmp word [0x1402c0518], 0x2e
nop
je 0x1401576f7
lea rdx, [0x1402386c8]
xor ecx, ecx
call fcn.1401f3378
mov qword [0x1402cdca8], rax
lea rcx, [0x1402c5c60]
nop
call sym.SystemInformer.exe_PhfSetEvent
mov r9, qword [rsp + 0x38]
xor r8d, r8d
mov rax, qword [rsp + 0x58]
jmp 0x14015773d
test byte [0x1402c5c60], 1
jne 0x14015773a
xor edx, edx
lea rcx, [0x1402c5c60]
call sym.SystemInformer.exe_PhfWaitForEvent
mov r9, qword [rsp + 0x38]
xor r8d, r8d
mov rax, qword [rsp + 0x58]
jmp 0x14015773d
mov rax, rcx
nop dword [rax]
test ebx, ebx
je 0x1401585a9
mov qword [rsp + 0x4d0], r12
lea r10, [0x140000000]
movaps xmmword [rsp + 0x4b0], xmm6
mov r11d, 0x30
movsd xmm6, qword [0x140290820]
movaps xmmword [rsp + 0x4a0], xmm7
movsd xmm7, qword [0x1402907d0]
mov byte [rsp + 0x30], sil
jmp 0x140157798
mov r9, qword [rsp + 0x38]
xor r8d, r8d
mov rdx, rax
mov qword [rbp - 0x78], rax
dec ebx
mov qword [rsp + 0x70], r13
mov rdi, rax
mov dword [rsp + 0x60], ebx
mov rbx, rax
mov r14d, r8d
mov r12d, dword [rdx]
add rax, 0x20
mov qword [rsp + 0x58], rax
mov eax, r12d
and eax, 0x3f
cmp eax, 0xc
ja case.default.0x1401577db
cdqe
mov ecx, dword [r10 + rax*4 + 0x158628]
add rcx, r10
jmp rcx
nop dword [rax]
test sil, sil
jne 0x14015780d
lea rax, [r13 + 2]
cmp r9, rax
jae 0x140157805
add r15, 2
mov byte [rsp + 0x30], 1
add r13, 2
jmp case.default.0x1401577db
movzx eax, word [rbx + 0x10]
mov word [r15], ax
add r15, 2
add r13, 2
jmp case.default.0x1401577db
test sil, sil
jne 0x140157851
mov r8, qword [rbx + 0x10]
lea rax, [r8 + r13]
cmp r9, rax
jae 0x140157845
mov rax, r8
mov byte [rsp + 0x30], 1
shr rax, 1
add r13, r8
lea r15, [r15 + rax*2]
jmp case.default.0x1401577db
mov rdx, qword [rbx + 0x18]
mov rcx, r15
call fcn.14020af00
mov rax, qword [rbx + 0x10]
shr rax, 1
add r13, qword [rbx + 0x10]
lea r15, [r15 + rax*2]
jmp case.default.0x1401577db
mov rdx, qword [rbx + 0x10]
xorps xmm1, xmm1
mov rdi, rdx
mov ecx, edx
and rdi, 0xfffffffffffffff1
and ecx, 0xf
je 0x140157897
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdi]
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
je 0x140157893
mov edi, ecx
shr rdi, 1
jmp 0x1401578d3
add rdi, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdi]
pmovmskb eax, xmm0
bsf ecx, eax
jne 0x1401578c5
nop word [rax + rax]
add rdi, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdi]
pmovmskb eax, xmm0
bsf ecx, eax
je 0x1401578b0
sub rdi, rdx
mov eax, ecx
sar rdi, 1
shr rax, 1
add rdi, rax
test sil, sil
jne 0x140157905
lea r8, [rdi + rdi]
lea rax, [r8 + r13]
cmp r9, rax
jae 0x1401578f8
mov byte [rsp + 0x30], 1
lea r15, [r15 + rdi*2]
lea r13, [r13 + rdi*2]
jmp case.default.0x1401577db
mov rcx, r15
call fcn.14020af00
lea r15, [r15 + rdi*2]
lea r13, [r13 + rdi*2]
jmp case.default.0x1401577db
cmp r12d, 3
jne 0x140157923
mov rbx, qword [rbx + 0x18]
mov rdi, qword [rdx + 0x10]
jmp 0x140157939
mov rbx, qword [rdx + 0x10]
mov rdi, 0xffffffffffffffff
nop
inc rdi
cmp byte [rbx + rdi], 0
jne 0x140157930
mov r8d, edi
lea rcx, [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeSize]
test eax, eax
js 0x140158185
test sil, sil
mov rsi, qword [rsp + 0x38]
jne 0x140157992
mov ecx, dword [rsp + 0x40]
lea rax, [rcx + r13]
cmp rsi, rax
jae 0x140157970
mov byte [rsp + 0x30], 1
jmp 0x140157996
lfence
mov edx, dword [rsp + 0x40]
mov r9, rbx
xor r8d, r8d
mov dword [rsp + 0x20], edi
mov rcx, r15
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
test eax, eax
js 0x14015818a
mov ecx, dword [rsp + 0x40]
mov rbx, qword [rbp - 0x78]
mov rax, rcx
shr rax, 1
add r13, rcx
lea r15, [r15 + rax*2]
jmp 0x14015805f
mov eax, dword [rbx + 0x10]
mov r14d, eax
mov r8d, eax
shr r14d, 0x1f
neg r8d
test eax, eax
cmovns r8d, eax
jmp 0x1401579c8
mov r8d, dword [rbx + 0x10]
mov r11d, 0xa
bt r12d, 8
jae 0x1401579e7
movzx ecx, byte ds:[rbx + 0xa]
lea eax, [rcx - 2]
cmp al, 0x43
ja 0x1401579e7
mov r11d, ecx
bt r12d, 0x1d
lea r10, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
lea rax, [0x14028b210]
cmovae r10, rax
lea r9, [rbp + 0x38e]
xor esi, esi
mov ebx, esi
test r8d, r8d
je 0x140157aa2
bt r12d, 0x10
jae 0x140157a80
mov edi, esi
nop dword [rax + rax]
xor edx, edx
mov eax, r8d
div r11d
inc ebx
inc edi
mov r8d, eax
movsx ecx, byte [rdx + r10]
mov word [r9], cx
sub r9, 2
cmp edi, 3
jne 0x140157a5c
test eax, eax
je 0x140157a64
movzx eax, word [0x1402c1118]
mov word [r9], ax
sub r9, 2
inc ebx
jmp 0x140157a19
nop dword [rax]
test eax, eax
jne 0x140157a20
mov eax, 1
mov edi, 0x30
test r14d, r14d
je 0x140157abe
mov esi, eax
jmp 0x140157ac6
xor edx, edx
mov eax, r8d
div r11d
inc ebx
mov r8d, eax
movsx ecx, byte [rdx + r10]
mov word [r9], cx
sub r9, 2
test eax, eax
jne 0x140157a80
nop
jmp 0x140157a64
mov edi, 0x30
lea r9, [rbp + 0x38c]
mov eax, 1
mov word [rbp + 0x38e], di
mov ebx, eax
jmp 0x140157a6e
bt r12d, 0x11
cmovb esi, eax
mov eax, r12d
and eax, 0x50000
cmp eax, 0x40000
jne 0x140157af6
mov rax, qword [rbp - 0x78]
movzx ecx, word [rax + 6]
lea eax, [rsi + rbx]
cmp eax, ecx
jae 0x140157af6
mov edx, ecx
or r14d, 4
sub edx, esi
sub edx, ebx
mov dword [rsp + 0x44], edx
add esi, edx
jmp 0x140157afa
mov edx, dword [rsp + 0x44]
cmp byte ds:[rsp + 0x30], 0
jne 0x140157b7e
lea eax, [rsi + rbx]
lea rax, [rax*2]
add rax, r13
cmp qword [rsp + 0x38], rax
jae 0x140157b2d
lea eax, [rsi + rbx]
mov byte [rsp + 0x30], 1
mov rbx, qword [rbp - 0x78]
lea r13, [r13 + rax*2]
jmp case.default.0x1401577db
test r14b, 1
je 0x140157b3b
mov word [r15], 0x2d
jmp 0x140157b48
bt r12d, 0x11
jae 0x140157b4c
mov word [r15], 0x2b
add r15, 2
test r14b, 4
je 0x140157b67
test rdx, rdx
je 0x140157b63
movzx eax, di
mov rcx, rdx
mov rdi, r15
rep stosw word [rdi], ax
lea r15, [r15 + rdx*2]
mov edi, ebx
lea rdx, [r9 + 2]
add rdi, rdi
mov rcx, r15
mov r8, rdi
call fcn.14020af00
add r15, rdi
lea eax, [rsi + rbx]
mov rbx, qword [rbp - 0x78]
lea r13, [r13 + rax*2]
jmp case.default.0x1401577db
mov rax, qword [rdi + 0x10]
mov r14, rax
mov rdi, rax
shr r14, 0x3f
neg rdi
cmovs rdi, rax
jmp 0x140157baa
mov rdi, qword [rbx + 0x10]
mov r10d, 0xa
bt r12d, 8
jae 0x140157bc7
movzx ecx, byte ds:[rbx + 0xa]
lea eax, [rcx - 2]
cmp al, 0x43
ja 0x140157bc7
mov r10d, ecx
bt r12d, 0x1d
lea r11, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
lea rax, [0x14028b210]
cmovae r11, rax
lea r9, [rbp + 0x38e]
xor esi, esi
mov ebx, esi
test rdi, rdi
je 0x140157c90
bt r12d, 0x10
jae 0x140157c62
mov r8d, esi
nop dword [rax]
xor edx, edx
mov rax, rdi
div r10
mov rax, rdi
inc ebx
mov rcx, rdx
inc r8d
xor edx, edx
div r10
mov rdi, rax
mov eax, ecx
movsx ecx, byte [rax + r11]
mov word [r9], cx
sub r9, 2
cmp r8d, 3
jne 0x140157c48
test rdi, rdi
je 0x140157c4d
movzx eax, word [0x1402c1118]
mov word [r9], ax
sub r9, 2
inc ebx
jmp 0x140157bf9
test rdi, rdi
jne 0x140157c00
mov eax, 1
mov edi, 0x30
test r14d, r14d
je 0x140157cac
mov esi, eax
jmp 0x140157cb4
xor edx, edx
mov rax, rdi
div r10
mov rax, rdi
inc ebx
mov rcx, rdx
xor edx, edx
div r10
mov rdi, rax
mov eax, ecx
movsx ecx, byte [rax + r11]
mov word [r9], cx
sub r9, 2
test rdi, rdi
jne 0x140157c62
jmp 0x140157c4d
mov edi, 0x30
lea r9, [rbp + 0x38c]
mov eax, 1
mov word [rbp + 0x38e], di
mov ebx, eax
jmp 0x140157c57
bt r12d, 0x11
cmovb esi, eax
mov eax, r12d
and eax, 0x50000
cmp eax, 0x40000
jne 0x140157ce8
mov rax, qword [rbp - 0x78]
movzx ecx, word [rax + 6]
lea eax, [rsi + rbx]
cmp eax, ecx
jae 0x140157ce8
mov edx, ecx
or r14d, 4
sub edx, esi
sub edx, ebx
mov dword [rsp + 0x48], edx
add esi, edx
jmp 0x140157cec
mov edx, dword [rsp + 0x48]
cmp byte [rsp + 0x30], 0
jne 0x140157b7e
lea eax, [rsi + rbx]
lea rax, [rax*2]
add rax, r13
cmp qword [rsp + 0x38], rax
jae 0x140157d25
lea eax, ds:[rsi + rbx]
mov byte [rsp + 0x30], 1
mov rbx, qword [rbp - 0x78]
lea r13, [r13 + rax*2]
jmp case.default.0x1401577db
test r14b, 1
je 0x140157d33
mov word [r15], 0x2d
jmp 0x140157d40
bt r12d, 0x11
jae 0x140157d44
mov word [r15], 0x2b
add r15, 2
test r14b, 4
je 0x140157d5f
test rdx, rdx
je 0x140157d5b
movzx eax, di
mov rcx, rdx
mov rdi, r15
rep stosw word [rdi], ax
lea r15, [r15 + rdx*2]
mov edi, ebx
lea rdx, [r9 + 2]
add rdi, rdi
mov rcx, r15
mov r8, rdi
call fcn.14020af00
lea eax, [rsi + rbx]
add r15, rdi
mov rbx, qword [rbp - 0x78]
lea r13, [r13 + rax*2]
jmp case.default.0x1401577db
test r12b, 0x40
je 0x140157da2
movzx r8d, word [rbx + 4]
mov eax, 0xa2
cmp r8d, eax
jbe 0x140157da8
mov r8d, eax
jmp 0x140157da8
mov r8d, 6
movsd xmm0, qword ds:[rdi + 0x10]
lea r9, [rbp - 0x6f]
mov edx, r12d
lea rbx, [rbp - 0x6f]
mov r14, rdi
call fcn.1401d4c40
test al, al
jne 0x140157dce
mov byte [rbp - 0x6f], al
jmp 0x140157e1e
mov rdx, qword [0x1402cdca8]
test rdx, rdx
je 0x140157e02
movzx eax, byte ds:[rbp - 0x6f]
test al, al
je 0x140157e02
lea rcx, [rbp - 0x6f]
cmp al, 0x2e
je 0x140157df9
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140157de8
jmp 0x140157e02
movzx eax, byte [0x1402c0518]
mov byte [rcx], al
bt r12d, 0x1d
jae 0x140157e1e
lea rcx, [rbp - 0x6f]
test rdx, rdx
je 0x140157e19
call fcn.1401f29a0
jmp 0x140157e1e
call fcn.1401f2940
mov r9d, dword [rdi]
bt r9d, 0xf
jae 0x140157ec4
movzx eax, byte ds:[rbp - 0x6f]
lea rcx, [rbp - 0x6f]
movzx r8d, byte [0x1402c0518]
test al, al
je 0x140157e54
cmp al, r8b
je 0x140157e54
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140157e44
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140157ec4
movzx edx, byte [rcx]
test dl, dl
je 0x140157e7f
movzx eax, dl
cmp dl, 0x65
je 0x140157e7f
cmp al, 0x45
je 0x140157e7f
movzx eax, byte [rcx + 1]
inc rcx
movzx edx, al
test al, al
jne 0x140157e68
movzx eax, byte [rcx - 1]
mov rdi, rcx
dec rcx
cmp al, 0x30
jne 0x140157e9b
nop dword [rax]
movzx eax, byte [rcx - 1]
dec rcx
cmp al, 0x30
je 0x140157e90
cmp al, r8b
lea rdx, [rcx - 1]
cmovne rdx, rcx
nop word [rax + rax]
movzx eax, byte ds:[rdi]
lea rdx, [rdx + 1]
mov byte [rdx], al
lea rdi, [rdi + 1]
test al, al
jne 0x140157eb0
lea rax, [rbp - 0x6f]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140157ed0
cmp byte ds:[rbp - 0x6f], 0x2d
jne 0x140157ef2
dec r8d
lea rbx, [rbp - 0x6e]
xor ecx, ecx
mov esi, 1
jmp 0x140157f06
mov ecx, 0
bt r9d, 0x11
mov esi, ecx
mov eax, 2
cmovb esi, eax
mov eax, r9d
and eax, 0x13000
cmp eax, 0x10000
jne 0x1401580b3
movzx eax, byte [rbx]
mov r9, rbx
sub al, 0x30
cmp al, 0xa
jae 0x140157f3e
nop word [rax + rax]
movzx eax, byte [r9 + 1]
inc r9
sub al, 0x30
cmp al, 0xa
jb 0x140157f30
mov r10d, r9d
sub r10d, ebx
lea edi, [r10 + 2]
je 0x140157f5c
mov eax, 0xaaaaaaab
mul edi
mov r11d, edx
shr r11d, 1
dec r11d
jmp 0x140157f5f
mov r11d, ecx
movzx r12d, byte [rsp + 0x30]
lea ecx, [r11 + r8]
add ecx, ecx
test r12b, r12b
jne 0x140157f94
test esi, esi
lea eax, [rcx + 2]
cmove eax, ecx
add rax, r13
cmp qword [rsp + 0x38], rax
jae 0x140157f94
mov r12b, 1
mov byte [rsp + 0x30], r12b
jmp 0x140158025
mov eax, 0xaaaaaaab
mov ecx, r10d
mul edi
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
test r12b, r12b
jne 0x140158025
test sil, 1
je 0x140157fb8
mov word [r15], 0x2d
jmp 0x140157fc4
test sil, 2
je 0x140157fc8
mov word [r15], 0x2b
add r15, 2
test r10d, r10d
je 0x140158025
mov r12d, 1
nop dword [rax]
nop word [rax + rax]
movsx eax, byte [rbx]
dec ecx
mov word [r15], ax
inc rbx
mov eax, edi
add r15, 2
dec edi
test eax, eax
jne 0x14015801b
test ecx, ecx
je 0x14015801f
movzx eax, word [0x1402c1118]
dec ecx
mov word [r15], ax
mov edi, r12d
movsx eax, byte [rbx]
mov word [r15 + 2], ax
add r15, 4
inc rbx
test ecx, ecx
jne 0x140157fe0
movzx r12d, byte [rsp + 0x30]
test esi, esi
je 0x14015802d
add r13, 2
lea eax, [r11 + r10]
lea r13, [r13 + rax*2]
test r12b, r12b
jne 0x140158057
sub r8d, r10d
mov rcx, r9
mov edi, r8d
mov r8, r15
mov edx, edi
call sym.SystemInformer.exe_PhZeroExtendToUtf16Buffer
lea r15, [r15 + rdi*2]
lea r13, [r13 + rdi*2]
mov rbx, r14
mov rsi, qword [rsp + 0x38]
mov ecx, dword [rbx]
mov r8, r13
sub r8, qword [rsp + 0x70]
test ecx, 0xc0000000
je 0x140158564
movzx ebx, word ds:[rbx + 6]
add rbx, rbx
cmp r8, rbx
jae 0x140158564
sub rbx, r8
cmp byte [rsp + 0x30], 0
jne 0x140158557
lea rax, ds:[rbx + r13]
cmp rsi, rax
jae 0x1401584fc
mov byte [rsp + 0x30], 1
jmp 0x140158557
test esi, esi
setne cl
mov rdx, rcx
bt r9d, 0x12
jae 0x1401580e9
movzx r9d, word [r14 + 6]
mov edi, r8d
lea rax, [rcx + rdi]
cmp rax, r9
jae 0x1401580e9
mov edx, r9d
or esi, 4
sub rdx, rdi
mov r9, rdx
sub r9, rcx
mov qword [rsp + 0x68], r9
jmp 0x1401580ee
mov r9, qword [rsp + 0x68]
movzx r12d, byte [rsp + 0x30]
test r12b, r12b
jne 0x140158170
mov eax, r8d
add rax, rdx
lea rax, [rax*2]
add rax, r13
cmp qword [rsp + 0x38], rax
jae 0x140158125
mov byte ds:[rsp + 0x30], 1
lea r13, [r13 + rdx*2]
jmp 0x140158057
test sil, 1
je 0x140158133
mov word [r15], 0x2d
jmp 0x14015813f
test sil, 2
je 0x140158143
mov word [r15], 0x2b
add r15, 2
test sil, 4
je 0x140158170
test r9, r9
je 0x14015815f
mov edi, 0x30
mov rcx, r9
movzx eax, di
mov rdi, r15
rep stosw word [rdi], ax
lea r15, [r15 + r9*2]
mov rcx, rbx
lea r13, [r13 + rdx*2]
jmp 0x140158041
lea r13, [r13 + rdx*2]
test r12b, r12b
jne 0x140158185
mov rcx, rbx
jmp 0x140158041
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rbp - 0x78]
jmp 0x14015805f
mov rdx, qword ds:[rbx + 0x10]
mov esi, r8d
xorps xmm0, xmm0
test rdx, rdx
js 0x1401581ac
cvtsi2sd xmm0, rdx
jmp 0x1401581c4
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2sd xmm0, rcx
addsd xmm0, xmm0
test rdx, rdx
jne 0x1401581fb
cmp byte [rsp + 0x30], dl
jne 0x1401581ee
lea rax, [r13 + 2]
cmp r9, rax
jae 0x1401581ea
add r15, 2
mov byte [rsp + 0x30], 1
add r13, 2
jmp case.default.0x1401577db
mov word [r15], r11w
add r15, 2
add r13, 2
jmp case.default.0x1401577db
bt r12d, 8
jae 0x140158208
movzx eax, byte [rbx + 0xa]
jmp 0x14015820e
mov eax, dword [0x1402c7300]
comisd xmm0, xmm6
jb 0x140158229
cmp esi, 7
jae 0x140158229
cmp esi, eax
jae 0x140158229
mulsd xmm0, xmm7
inc esi
comisd xmm0, xmm6
jae 0x140158214
test r12b, 0x40
je 0x140158235
movzx eax, word [rbx + 4]
jmp 0x14015823a
mov eax, 2
movzx r8d, ax
lea r9, [rbp - 0x6f]
mov eax, 0xa2
lea rbx, [rbp - 0x6f]
cmp r8d, eax
mov edx, 0x1804b
cmova r8d, eax
call fcn.1401d4c40
movzx r8d, word [0x1402c0518]
test al, al
jne 0x14015826f
xor dl, dl
mov byte [rbp - 0x6f], dl
jmp 0x1401582a9
cmp qword [0x1402cdca8], 0
movzx edx, byte [rbp - 0x6f]
je 0x1401582a9
nop dword [rax]
test dl, dl
je 0x1401582a9
lea rcx, [rbp - 0x6f]
movzx eax, dl
nop dword [rax + rax]
cmp al, 0x2e
je 0x1401582a2
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140158290
nop
jmp 0x1401582a9
mov byte [rcx], r8b
movzx edx, byte [rbp - 0x6f]
lea rcx, [rbp - 0x6f]
test dl, dl
je 0x1401582c4
movzx eax, dl
cmp al, r8b
je 0x1401582c4
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1401582b4
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140158335
movzx edx, byte [rcx]
test dl, dl
je 0x1401582f2
movzx eax, dl
cmp dl, 0x65
je 0x1401582f2
nop dword [rax]
cmp al, 0x45
je 0x1401582f2
movzx eax, byte [rcx + 1]
inc rcx
movzx edx, al
test al, al
jne 0x1401582d8
movzx eax, byte ds:[rcx - 1]
mov rdi, rcx
dec rcx
cmp al, 0x30
jne 0x14015830f
movzx eax, byte [rcx - 1]
dec rcx
cmp al, 0x30
je 0x140158304
cmp al, r8b
lea rdx, [rcx - 1]
cmovne rdx, rcx
nop word [rax + rax]
movzx eax, byte [rdi]
lea rdx, [rdx + 1]
mov byte [rdx], al
lea rdi, [rdi + 1]
test al, al
jne 0x140158320
movzx edx, byte [rbp - 0x6f]
lea rax, [rbp - 0x6f]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140158340
cmp dl, 0x2d
jne 0x14015835c
mov r14d, 1
lea rbx, [rbp - 0x6e]
dec r8d
movzx eax, byte [rbx]
mov r9, rbx
sub al, 0x30
cmp al, 0xa
jae 0x14015837e
nop dword [rax + rax]
movzx eax, byte [r9 + 1]
inc r9
sub al, 0x30
cmp al, 0xa
jb 0x140158370
mov r10d, r9d
sub r10d, ebx
lea edi, [r10 + 2]
je 0x14015839c
mov eax, 0xaaaaaaab
mul edi
mov r11d, edx
shr r11d, 1
dec r11d
jmp 0x1401583a1
xor eax, eax
mov r11d, eax
movzx r12d, byte [rsp + 0x30]
lea ecx, [r11 + r8]
add ecx, ecx
test r12b, r12b
jne 0x1401583d1
test r14d, r14d
lea eax, [rcx + 2]
cmove eax, ecx
add rax, r13
cmp qword [rsp + 0x38], rax
jae 0x1401583d1
mov r12b, 1
mov byte [rsp + 0x30], r12b
jmp 0x14015844a
mov eax, 0xaaaaaaab
mov ecx, r10d
mul edi
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
test r12b, r12b
jne 0x14015844a
test r14d, r14d
je 0x1401583f6
mov word [r15], 0x2d
add r15, 2
test r10d, r10d
je 0x14015844a
mov r12d, 1
movsx eax, byte [rbx]
dec ecx
mov word [r15], ax
inc rbx
mov eax, edi
add r15, 2
dec edi
test eax, eax
jne 0x14015843c
test ecx, ecx
je 0x140158444
movzx eax, word [0x1402c1118]
dec ecx
mov word [r15], ax
mov edi, r12d
movsx eax, byte [rbx]
mov word [r15 + 2], ax
add r15, 4
inc rbx
nop dword [rax]
test ecx, ecx
jne 0x140158401
movzx r12d, byte [rsp + 0x30]
test r14d, r14d
je 0x140158453
add r13, 2
lea eax, [r11 + r10]
lea rbx, [rax*2]
add rbx, r13
test r12b, r12b
jne 0x1401584cd
sub r8d, r10d
mov rcx, r9
mov edi, r8d
mov r8, r15
mov edx, edi
call sym.SystemInformer.exe_PhZeroExtendToUtf16Buffer
mov edx, esi
lea rbx, [rbx + rdi*2]
add rdx, rdx
lea r10, [0x140000000]
lea rcx, [rbx + 2]
lea r15, [r15 + rdi*2]
add rcx, qword [r10 + rdx*8 + 0x2c5c70]
cmp qword [rsp + 0x38], rcx
jae 0x1401584ae
mov byte [rsp + 0x30], 1
jmp 0x1401584d4
mov word [r15], 0x20
lea rcx, [r15 + 2]
mov r8, qword [r10 + rdx*8 + 0x2c5c70]
mov rdx, qword [r10 + rdx*8 + 0x2c5c78]
call fcn.14020af00
lea r10, [0x140000000]
lea r13, [rbx + 2]
mov eax, esi
mov rbx, qword [rbp - 0x78]
add rax, rax
mov rcx, qword [r10 + rax*8 + 0x2c5c70]
lea rax, [rcx + 2]
shr rax, 1
add r13, rcx
lea r15, [r15 + rax*2]
jmp case.default.0x1401577db
nop dword [rax]
test cl, cl
jns 0x14015850f
mov rax, qword [rbp - 0x78]
movzx r14d, word [rax + 8]
jmp 0x140158515
mov r14d, 0x20
mov rsi, rbx
shr rsi, 1
test ecx, ecx
jns 0x14015852a
nop
test rsi, rsi
je 0x140158557
mov rdi, r15
jmp 0x14015854d
lfence
mov rax, r8
mov rdi, r15
shr rax, 1
add rax, rax
sub rdi, rax
mov rdx, rdi
lea rcx, [rdi + rsi*2]
call fcn.14020af00
test rsi, rsi
je 0x140158557
mov rcx, rsi
movzx eax, r14w
rep stosw word [rdi], ax
mov rax, rbx
shr rax, 1
add r13, rbx
lea r15, [r15 + rax*2]
mov ebx, dword ds:[rsp + 0x60]
lea r10, [0x140000000]
movzx esi, byte [rsp + 0x30]
mov r11d, 0x30
mov rax, qword [rsp + 0x58]
test ebx, ebx
jne 0x140157790
movaps xmm7, xmmword [rsp + 0x4a0]
movaps xmm6, xmmword [rsp + 0x4b0]
mov r12, qword [rsp + 0x4d0]
mov rdi, qword [rsp + 0x78]
mov r14, qword [rbp - 0x80]
mov rbx, qword [rsp + 0x508]
lea rax, [r13 + 2]
mov r13, qword [rsp + 0x4c8]
mov rdx, qword [rsp + 0x38]
test sil, sil
jne 0x1401585cf
cmp rdx, rax
jae 0x14015861d
mov sil, 1
mov rcx, rax
test rdi, rdi
je 0x1401585e4
test rdx, rdx
je 0x1401585e4
xor eax, eax
mov word [rdi], ax
mov rax, rcx
mov r15, qword [rsp + 0x4c0]
mov rdi, qword [rsp + 0x4d8]
test r14, r14
je 0x1401585fc
mov qword [r14], rax
test sil, sil
sete al
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.1401e4a20
add rsp, 0x4e0
pop r14
pop rsi
pop rbp
ret
xor ecx, ecx
mov word [r15], cx
jmp 0x1401585e4