Function at 0x140155ee0
Capabilities:
Get geographical location

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r15
lea rbp, [rsp - 0x3c8]
sub rsp, 0x4c8
mov rax, qword [0x1402bf040]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov ebx, 0x1e
mov edi, edx
mov rdx, qword [0x1402ca978]
cmp r8, rbx
mov r12, rcx
cmovae rbx, r8
mov qword [rsp + 0x38], rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor ecx, ecx
mov qword [rsp + 0x30], rax
mov r11, rax
mov qword [rsp + 0x40], rcx
mov r15d, ecx
mov qword [rax], rbx
add rax, 0x10
mov qword [r11 + 8], rax
mov word [rax + rbx], cx
test byte [0x1402c5c40], 1
mov rsi, qword [r11 + 8]
jne 0x140156037
lock bts qword [0x1402c5c40], 0x1f
setb al
test al, al
jne 0x14015601b
mov r9d, 4
lea r8, [rbp - 0x78]
mov edx, 0xe
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x140155fb3
mov rax, qword ds:[rbp - 0x78]
test ax, ax
je 0x140155fb3
cmp word [rbp - 0x76], r15w
jne 0x140155fb3
mov word [0x1402c0518], ax
mov r9d, 4
lea r8, [rbp - 0x78]
mov edx, 0xf
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x140155fee
mov rax, qword [rbp - 0x78]
test ax, ax
je 0x140155fee
nop word [rax + rax]
cmp word [rbp - 0x76], r15w
jne 0x140155fee
mov word [0x1402c1118], ax
cmp word [0x1402c0518], 0x2e
je 0x14015600d
lea rdx, [0x1402386c8]
xor ecx, ecx
call fcn.1401f2ab8
mov qword [0x1402cdc88], rax
lea rcx, [0x1402c5c40]
call sym.SystemInformer.exe_PhfSetEvent
jmp 0x140156032
test byte [0x1402c5c40], 1
jne 0x140156037
xor edx, edx
lea rcx, [0x1402c5c40]
call sym.SystemInformer.exe_PhfWaitForEvent
mov r11, qword [rsp + 0x30]
test edi, edi
je 0x14015736f
mov qword [rsp + 0x508], r13
lea r8, [0x140000000]
mov qword [rsp + 0x4c0], r14
mov edx, 1
movaps xmmword [rsp + 0x4b0], xmm6
mov r9d, 0xa2
movsd xmm6, qword [0x1402907d0]
mov r10d, 2
movaps xmmword [rsp + 0x4a0], xmm7
movsd xmm7, qword [0x140290780]
nop word [rax + rax]
mov r14, r12
mov qword [rsp + 0x58], r12
add r12, 0x20
mov qword [rsp + 0x78], r15
dec edi
mov qword [rbp - 0x80], r12
xor r11d, r11d
mov dword [rsp + 0x6c], edi
mov r13d, dword [r14]
mov r12d, r11d
mov eax, r13d
and eax, 0x3f
cmp eax, 0xc
ja case.default.0x1401560d6
cdqe
mov ecx, dword [r8 + rax*4 + 0x1573a4]
add rcx, r8
jmp rcx
mov r8, qword [rsp + 0x38]
lea rbx, [r15 + 2]
cmp r8, rbx
jae 0x14015615a
mov rdx, qword [0x1402ca978]
lea rax, [r8 + r8]
cmp rax, rbx
mov rsi, rbx
cmovae rsi, rax
mov qword [rsp + 0x38], rsi
lea rcx, [rsi + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor edx, edx
mov r8, r15
mov rdi, rax
mov qword [rax], rsi
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rsi + rcx], dx
mov rsi, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [rsi + 8]
call fcn.14020a640
lea rcx, [rsi - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14015614a
call fcn.140141ca0
mov rax, qword [rdi + 8]
shr r15, 1
mov qword [rsp + 0x30], rdi
lea rsi, [rax + r15*2]
movzx eax, word [r14 + 0x10]
mov r15, rbx
mov word [rsi], ax
add rsi, 2
mov qword [rsp + 0x40], rbx
jmp case.default.0x1401560d6
mov rcx, qword [r14 + 0x10]
add rcx, r15
cmp rbx, rcx
jae 0x1401561fd
mov rdx, qword [0x1402ca978]
lea rax, ds:[rbx + rbx]
cmp rax, rcx
mov rbx, rcx
cmovae rbx, rax
mov qword [rsp + 0x38], rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor edx, edx
mov r8, r15
mov rdi, rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rbx], dx
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
call fcn.14020a640
lea rcx, ds:[rbx - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x1401561ea
call fcn.140141ca0
mov rax, qword [rdi + 8]
mov rcx, r15
shr rcx, 1
mov qword [rsp + 0x30], rdi
lea rsi, [rax + rcx*2]
mov r8, qword [r14 + 0x10]
mov rcx, rsi
mov rdx, qword [r14 + 0x18]
call fcn.14020a640
mov rax, qword ds:[r14 + 0x10]
shr rax, 1
add r15, qword [r14 + 0x10]
lea rsi, [rsi + rax*2]
jmp 0x1401571e7
mov rdi, qword [r14 + 0x10]
xorps xmm1, xmm1
mov rdx, rdi
mov ecx, edi
and rdx, 0xfffffffffffffff1
and ecx, 0xf
je 0x14015625c
movdqu xmm0, xmmword [rdx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
mov dword [rsp + 0x48], ecx
je 0x140156258
mov edx, ecx
shr rdx, 1
jmp 0x140156299
add rdx, 0x10
movdqu xmm0, xmmword [rdx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x48], ecx
jne 0x14015628b
movdqu xmm0, xmmword [rdx + 0x10]
add rdx, 0x10
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x48], ecx
je 0x140156271
sub rdx, rdi
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
lea rdi, [rdx + rdx]
lea r14, [rdi + r15]
cmp rbx, r14
jae 0x14015631a
mov rdx, qword [0x1402ca978]
lea rax, [rbx + rbx]
cmp rax, r14
mov rsi, r14
cmovae rsi, rax
mov qword [rsp + 0x38], rsi
lea rcx, [rsi + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor edx, edx
mov r8, r15
mov rbx, rax
mov qword [rax], rsi
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rsi + rcx], dx
mov rsi, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [rsi + 8]
call fcn.14020a640
lea rcx, [rsi - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14015630a
call fcn.140141ca0
mov rax, qword [rbx + 8]
shr r15, 1
mov qword [rsp + 0x30], rbx
lea rsi, [rax + r15*2]
mov r13, qword [rsp + 0x58]
mov r8, rdi
mov rcx, rsi
mov rdx, qword [r13 + 0x10]
call fcn.14020a640
shr rdi, 1
mov r15, r14
mov qword [rsp + 0x40], r14
mov r14, r13
lea rsi, [rsi + rdi*2]
jmp case.default.0x1401560d6
cmp r13d, 3
jne 0x140156355
mov rbx, qword [r14 + 0x18]
mov rdi, qword [r14 + 0x10]
jmp 0x140156369
mov rbx, qword [r14 + 0x10]
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], r11b
jne 0x140156360
mov r8d, edi
lea rcx, [rsp + 0x60]
mov rdx, rbx
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeSize]
nop word [rax + rax]
test eax, eax
js case.default.0x1401560d6
lfence
mov edx, dword [rsp + 0x60]
mov r8, qword [rsp + 0x38]
lea rcx, [r15 + rdx]
cmp r8, rcx
jae 0x140156428
mov rdx, qword [0x1402ca978]
lea rax, [r8 + r8]
cmp rax, rcx
mov r12, rcx
cmovae r12, rax
mov qword [rsp + 0x38], r12
lea rcx, [r12 + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor edx, edx
mov r8, r15
mov rsi, rax
mov qword [rax], r12
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + r12], dx
mov r12, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [r12 + 8]
call fcn.14020a640
lea rcx, [r12 - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140156411
call fcn.140141ca0
mov rax, qword [rsi + 8]
mov rcx, r15
mov edx, dword [rsp + 0x60]
shr rcx, 1
mov qword [rsp + 0x30], rsi
lea rsi, [rax + rcx*2]
mov r9, rbx
mov dword [rsp + 0x20], edi
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
nop dword [rax + rax]
test eax, eax
js case.default.0x1401560d6
mov ecx, dword [rsp + 0x60]
mov eax, ecx
shr rax, 1
lea rsi, [rsi + rax*2]
jmp 0x1401571e4
mov eax, dword [r14 + 0x10]
mov r12d, eax
mov r8d, eax
shr r12d, 0x1f
neg r8d
test eax, eax
cmovns r8d, eax
jmp 0x140156477
mov r8d, dword [r14 + 0x10]
mov r10d, 0xa
bt r13d, 8
jae 0x140156494
movzx eax, byte [r14 + 0xa]
cmp al, 2
jb 0x140156494
cmp al, 0x45
ja 0x140156494
mov r10d, eax
bt r13d, 0x1d
lea r9, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
lea rax, [0x14028b1d0]
mov r14d, r11d
cmovae r9, rax
lea rbx, [rbp + 0x38e]
test r8d, r8d
je 0x140156542
bt r13d, 0x10
jae 0x140156520
mov edi, r11d
nop dword [rax + rax]
xor edx, edx
mov eax, r8d
div r10d
inc r14d
inc edi
mov r8d, eax
movsx ecx, byte [rdx + r9]
mov word [rbx], cx
sub rbx, 2
cmp edi, 3
jne 0x140156508
test eax, eax
je 0x14015650c
movzx eax, word [0x1402c1118]
mov word [rbx], ax
sub rbx, 2
inc r14d
jmp 0x1401564c5
test eax, eax
jne 0x1401564d0
mov edx, 1
test r12d, r12d
je 0x14015655a
mov ecx, edx
jmp 0x140156565
xor edx, edx
mov eax, r8d
div r10d
inc r14d
mov r8d, eax
movsx ecx, byte [rdx + r9]
mov word [rbx], cx
sub rbx, 2
test eax, eax
jne 0x140156520
nop
jmp 0x14015650c
mov eax, 0x30
lea rbx, [rbp + 0x38c]
mov word [rbp + 0x38e], ax
mov r14d, edx
jmp 0x140156511
bt r13d, 0x11
mov ecx, r11d
cmovb ecx, edx
and r13d, 0x50000
cmp r13d, 0x40000
mov r13, qword [rsp + 0x58]
jne 0x140156598
movzx edx, word [r13 + 6]
lea eax, [rcx + r14]
cmp eax, edx
jae 0x140156598
mov eax, edx
or r12d, 4
sub eax, ecx
sub eax, r14d
mov dword [rsp + 0x64], eax
add ecx, eax
mov r8, qword [rsp + 0x38]
lea eax, [rcx + r14]
lea r15, [r15 + rax*2]
cmp r8, r15
jae 0x14015662c
mov rdx, qword [0x1402ca978]
lea rax, [r8 + r8]
cmp rax, r15
mov rsi, r15
cmovae rsi, rax
mov qword [rsp + 0x38], rsi
lea rcx, [rsi + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor edx, edx
mov rdi, rax
mov qword [rax], rsi
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rsi], dx
mov rdx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rcx, qword [rax + 8]
mov r8, rsi
mov rdx, qword [rdx + 8]
call fcn.14020a640
mov rcx, qword [rsp + 0x30]
mov edx, 0xffffffff
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14015661c
call fcn.140141ca0
mov rax, qword [rdi + 8]
shr rsi, 1
mov qword [rsp + 0x30], rdi
lea rsi, [rax + rsi*2]
test r12b, 1
je 0x140156639
mov word [rsi], 0x2d
jmp 0x140156648
test dword [r13], 0x20000
je 0x14015664c
mov word [rsi], 0x2b
add rsi, 2
test r12b, 4
je 0x140156670
mov edx, dword [rsp + 0x64]
test rdx, rdx
je 0x14015666c
mov eax, 0x30
mov rdi, rsi
movzx eax, ax
mov rcx, rdx
rep stosw word [rdi], ax
lea rsi, [rsi + rdx*2]
mov edi, r14d
lea rdx, [rbx + 2]
add rdi, rdi
mov rcx, rsi
mov r8, rdi
call fcn.14020a640
mov r14, qword [rsp + 0x58]
add rsi, rdi
jmp 0x1401571e7
mov ecx, 0x10
mov rax, r14
mov rax, qword [rax + rcx]
mov r12, rax
mov rdi, rax
shr r12, 0x3f
neg rdi
cmovs rdi, rax
jmp 0x1401566b5
mov rdi, qword [r14 + 0x10]
mov r9d, 0xa
bt r13d, 8
jae 0x1401566d2
movzx eax, byte [r14 + 0xa]
cmp al, 2
jb 0x1401566d2
cmp al, 0x45
ja 0x1401566d2
mov r9d, eax
bt r13d, 0x1d
lea r10, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
lea rax, [0x14028b1d0]
mov r14d, r11d
cmovae r10, rax
lea rbx, [rbp + 0x38e]
test rdi, rdi
je 0x1401567ae
bt r13d, 0x10
jae 0x140156780
mov r8d, r11d
nop word [rax + rax]
xor edx, edx
mov rax, rdi
div r9
mov rax, rdi
inc r14d
mov rcx, rdx
inc r8d
xor edx, edx
div r9
mov rdi, rax
mov eax, ecx
movsx ecx, byte [rax + r10]
mov word [rbx], cx
sub rbx, 2
cmp r8d, 3
jne 0x14015675e
test rdi, rdi
je 0x140156765
movzx eax, word [0x1402c1118]
mov word [rbx], ax
sub rbx, 2
inc r14d
jmp 0x140156703
nop
test rdi, rdi
jne 0x140156710
mov edx, 1
test r12d, r12d
je 0x1401567c6
mov ecx, edx
jmp 0x1401567d1
xor edx, edx
mov rax, rdi
div r9
mov rax, rdi
inc r14d
mov rcx, rdx
xor edx, edx
div r9
mov rdi, rax
mov eax, ecx
movsx ecx, byte [rax + r10]
mov word [rbx], cx
sub rbx, 2
test rdi, rdi
jne 0x140156780
jmp 0x140156765
mov eax, 0x30
lea rbx, [rbp + 0x38c]
mov word [rbp + 0x38e], ax
mov r14d, edx
jmp 0x14015676a
bt r13d, 0x11
mov ecx, r11d
cmovb ecx, edx
and r13d, 0x50000
cmp r13d, 0x40000
mov r13, qword [rsp + 0x58]
jne 0x140156804
movzx edx, word [r13 + 6]
lea eax, [rcx + r14]
cmp eax, edx
jae 0x140156804
mov eax, edx
or r12d, 4
sub eax, ecx
sub eax, r14d
mov dword [rsp + 0x68], eax
add ecx, eax
mov r8, qword [rsp + 0x38]
lea eax, [rcx + r14]
lea r15, [r15 + rax*2]
cmp r8, r15
jae 0x140156895
mov rdx, qword [0x1402ca978]
lea rax, [r8 + r8]
cmp rax, r15
mov rsi, r15
cmovae rsi, rax
mov qword [rsp + 0x38], rsi
lea rcx, [rsi + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov rdi, rax
xor edx, edx
mov qword [rax], rsi
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x30]
mov word [rcx + rsi], dx
mov rsi, qword [rsp + 0x40]
mov rcx, qword [rdi + 8]
mov r8, rsi
mov rdx, qword [rax + 8]
call fcn.14020a640
mov rcx, qword [rsp + 0x30]
mov edx, 0xffffffff
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140156885
nop
call fcn.140141ca0
mov rax, qword [rdi + 8]
shr rsi, 1
mov qword [rsp + 0x30], rdi
lea rsi, [rax + rsi*2]
test r12b, 1
je 0x1401568a2
mov word [rsi], 0x2d
jmp 0x1401568b1
test dword [r13], 0x20000
je 0x1401568b5
mov word [rsi], 0x2b
add rsi, 2
test r12b, 4
je 0x140156670
mov edx, dword [rsp + 0x68]
jmp 0x140156656
test r13b, 0x40
je 0x1401568dd
movzx r8d, word [r14 + 4]
cmp r8d, r9d
jbe 0x1401568e3
mov r8d, r9d
jmp 0x1401568e3
mov r8d, 6
movsd xmm0, qword [r14 + 0x10]
lea r9, [rbp - 0x6f]
mov edx, r13d
lea r15, [rbp - 0x6f]
call fcn.1401d4380
test al, al
jne 0x140156903
mov byte [rbp - 0x6f], r12b
jmp 0x140156957
mov rdx, qword [0x1402cdc88]
test rdx, rdx
je 0x14015693a
movzx eax, byte [rbp - 0x6f]
lea rcx, [rbp - 0x6f]
test al, al
je 0x14015693a
nop dword [rax + rax]
cmp al, 0x2e
je 0x140156931
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140156920
jmp 0x14015693a
movzx eax, byte [0x1402c0518]
mov byte [rcx], al
bt r13d, 0x1d
jae 0x140156957
lea rcx, [rbp - 0x6f]
test rdx, rdx
je 0x140156952
call fcn.1401f20e0
jmp 0x140156957
call fcn.1401f2080
mov r9d, dword ds:[r14]
bt r9d, 0xf
jae 0x1401569f1
movzx eax, byte [rbp - 0x6f]
lea rcx, [rbp - 0x6f]
movzx r8d, byte [0x1402c0518]
test al, al
je 0x140156990
nop word [rax + rax]
cmp al, r8b
je 0x140156990
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140156980
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1401569f1
movzx eax, byte ds:[rcx]
test al, al
je 0x1401569b5
sub al, 0x45
test al, 0xdf
je 0x1401569b5
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1401569a4
movzx eax, byte ds:[rcx - 1]
mov rdi, rcx
dec rcx
cmp al, 0x30
jne 0x1401569cf
movzx eax, byte [rcx - 1]
dec rcx
cmp al, 0x30
je 0x1401569c4
cmp al, r8b
lea rdx, [rcx - 1]
cmovne rdx, rcx
nop word [rax + rax]
movzx eax, byte [rdi]
lea rdx, [rdx + 1]
mov byte [rdx], al
lea rdi, [rdi + 1]
test al, al
jne 0x1401569e0
lea rax, [rbp - 0x6f]
mov r14, 0xffffffffffffffff
nop dword [rax]
inc r14
cmp byte [rax + r14], r12b
jne 0x140156a00
cmp byte [rbp - 0x6f], 0x2d
jne 0x140156a22
dec r14d
lea r15, [rbp - 0x6e]
xor ecx, ecx
mov r12d, 1
jmp 0x140156a33
bt r9d, 0x11
mov eax, 2
mov rcx, r12
cmovb r12d, eax
mov eax, r9d
and eax, 0x13000
cmp eax, 0x10000
jne 0x140156bee
movzx eax, byte [r15]
mov rbx, r15
sub al, 0x30
mov qword [rsp + 0x50], r15
cmp al, 0xa
jae 0x140156a6d
nop dword [rax]
movzx eax, byte [rbx + 1]
inc rbx
sub al, 0x30
cmp al, 0xa
jb 0x140156a60
mov r13d, ebx
sub r13d, r15d
lea edi, [r13 + 2]
je 0x140156a88
mov eax, 0xaaaaaaab
mul edi
mov eax, edx
shr eax, 1
dec eax
jmp 0x140156a8a
mov eax, ecx
mov r8, qword [rsp + 0x38]
lea ecx, [rax + r14]
add ecx, ecx
mov dword [rsp + 0x48], eax
test r12d, r12d
lea eax, [rcx + 2]
cmove eax, ecx
mov rcx, qword [rsp + 0x40]
add rcx, rax
cmp r8, rcx
jae 0x140156b3a
lea rax, [r8 + r8]
mov rdx, rcx
cmp rax, rcx
cmovae rdx, rax
mov qword [rsp + 0x38], rdx
lea rcx, [rdx + 0x12]
mov rdx, qword [0x1402ca978]
call sym.SystemInformer.exe_PhCreateObject
mov r8, qword [rsp + 0x38]
mov rsi, rax
xor edx, edx
mov qword [rax], r8
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x30]
mov word [rcx + r8], dx
mov r8, qword [rsp + 0x40]
mov rcx, qword [rsi + 8]
mov rdx, qword [rax + 8]
call fcn.14020a640
mov rcx, qword [rsp + 0x30]
mov edx, 0xffffffff
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140156b25
nop
call fcn.140141ca0
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsi + 8]
shr rcx, 1
mov qword [rsp + 0x30], rsi
lea rsi, [rax + rcx*2]
mov eax, 0xaaaaaaab
mov ecx, r13d
mul edi
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
test r12b, 1
je 0x140156b58
mov word [rsi], 0x2d
jmp 0x140156b63
test r12b, 2
je 0x140156b67
mov word [rsi], 0x2b
add rsi, 2
test r13d, r13d
je 0x140156bb0
nop dword [rax]
movsx eax, byte [r15]
dec ecx
mov word [rsi], ax
inc r15
mov eax, edi
add rsi, 2
dec edi
test eax, eax
jne 0x140156bac
test ecx, ecx
je 0x140156bb0
movzx eax, word [0x1402c1118]
dec ecx
mov word [rsi], ax
mov edi, 1
movsx eax, byte [r15]
mov word [rsi + 2], ax
add rsi, 4
inc r15
test ecx, ecx
jne 0x140156b70
mov r15, qword [rsp + 0x40]
test r12d, r12d
je 0x140156bbe
add r15, 2
sub r14d, r13d
mov r8, rsi
mov edx, r14d
mov rcx, rbx
mov edi, r14d
call sym.SystemInformer.exe_PhZeroExtendToUtf16Buffer
mov ecx, dword [rsp + 0x48]
lea rsi, [rsi + r14*2]
mov r14, qword [rsp + 0x58]
add ecx, r13d
add rcx, rdi
lea r15, [r15 + rcx*2]
jmp 0x1401571e7
test r12d, r12d
mov rdx, rcx
setne dl
mov rcx, rdx
bt r9d, 0x12
jae 0x140156c2d
mov r13, qword [rsp + 0x58]
mov edi, r14d
movzx r8d, word [r13 + 6]
lea rax, [rdi + rdx]
cmp rax, r8
jae 0x140156c2d
mov ecx, r8d
or r12d, 4
sub rcx, rdi
mov rax, rcx
sub rax, rdx
mov qword [rsp + 0x70], rax
mov r13, qword [rsp + 0x40]
mov r8, qword [rsp + 0x38]
mov r14d, r14d
lea rax, [r14 + rcx]
lea rbx, [rax*2]
add rbx, r13
cmp r8, rbx
jae 0x140156cc2
mov rdx, qword [0x1402ca978]
lea rax, [r8 + r8]
cmp rax, rbx
mov rsi, rbx
cmovae rsi, rax
mov qword [rsp + 0x38], rsi
lea rcx, [rsi + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor edx, edx
mov r8, r13
mov rdi, rax
mov qword [rax], rsi
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rsi], dx
mov rsi, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [rsi + 8]
call fcn.14020a640
lea rcx, [rsi - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140156cb2
call fcn.140141ca0
mov rax, qword [rdi + 8]
shr r13, 1
mov qword [rsp + 0x30], rdi
lea rsi, [rax + r13*2]
test r12b, 1
je 0x140156ccf
mov word [rsi], 0x2d
jmp 0x140156cda
test r12b, 2
je 0x140156cde
mov word [rsi], 0x2b
add rsi, 2
nop
test r12b, 4
je 0x140156d05
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x140156d01
mov eax, 0x30
mov rdi, rsi
movzx eax, ax
mov rcx, rdx
rep stosw word [rdi], ax
lea rsi, [rsi + rdx*2]
mov r8, rsi
mov rdx, r14
mov rcx, r15
call sym.SystemInformer.exe_PhZeroExtendToUtf16Buffer
lea rsi, [rsi + r14*2]
mov qword [rsp + 0x40], rbx
mov r14, qword [rsp + 0x58]
mov r15, rbx
jmp case.default.0x1401560d6
mov rdx, qword [r14 + 0x10]
xorps xmm0, xmm0
test rdx, rdx
js 0x140156d3c
cvtsi2sd xmm0, rdx
jmp 0x140156d54
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2sd xmm0, rcx
addsd xmm0, xmm0
test rdx, rdx
jne 0x140156df5
mov r8, qword [rsp + 0x38]
lea rbx, [r15 + 2]
cmp r8, rbx
jae 0x140156ddf
mov rdx, qword [0x1402ca978]
lea rax, [r8 + r8]
cmp rax, rbx
mov rsi, rbx
cmovae rsi, rax
mov qword [rsp + 0x38], rsi
lea rcx, [rsi + 0x12]
call sym.SystemInformer.exe_PhCreateObject
xor edx, edx
mov r8, r15
mov rdi, rax
mov qword [rax], rsi
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rsi + rcx], dx
mov rsi, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
mov rdx, qword [rsi + 8]
call fcn.14020a640
lea rcx, [rsi - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140156dcf
call fcn.140141ca0
mov rax, qword [rdi + 8]
shr r15, 1
mov qword [rsp + 0x30], rdi
lea rsi, [rax + r15*2]
mov word [rsi], 0x30
mov r15, rbx
add rsi, 2
mov qword [rsp + 0x40], rbx
jmp case.default.0x1401560d6
bt r13d, 8
jae 0x140156e03
movzx eax, byte [r14 + 0xa]
jmp 0x140156e09
mov eax, dword [0x1402c72e0]
comisd xmm0, xmm6
jb 0x140156e28
nop
cmp r12d, 7
jae 0x140156e28
cmp r12d, eax
jae 0x140156e28
mulsd xmm0, xmm7
inc r12d
comisd xmm0, xmm6
jae 0x140156e10
test r13b, 0x40
je 0x140156e35
movzx eax, word [r14 + 4]
jmp 0x140156e38
mov eax, r10d
movzx r8d, ax
lea r14, [rbp - 0x6f]
cmp r8d, r9d
mov dword [rsp + 0x48], r11d
mov edx, 0x1804b
cmova r8d, r9d
lea r9, [rbp - 0x6f]
call fcn.1401d4380
movzx r8d, word [0x1402c0518]
test al, al
jne 0x140156e6d
xor dl, dl
mov byte [rbp - 0x6f], dl
jmp 0x140156e9f
cmp qword [0x1402cdc88], 0
movzx edx, byte [rbp - 0x6f]
je 0x140156e9f
lea rcx, ds:[rbp - 0x6f]
test dl, dl
je 0x140156e9f
movzx eax, dl
cmp al, 0x2e
je 0x140156e98
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140156e87
jmp 0x140156e9f
mov byte [rcx], r8b
movzx edx, byte [rbp - 0x6f]
lea rcx, [rbp - 0x6f]
test dl, dl
je 0x140156ec4
movzx eax, dl
nop word [rax + rax]
cmp al, r8b
je 0x140156ec4
movzx eax, byte ds:[rcx + 1]
inc rcx
test al, al
jne 0x140156eb0
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140156f28
movzx eax, byte [rcx]
test al, al
je 0x140156ee6
sub al, 0x45
test al, 0xdf
je 0x140156ee6
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140156ed5
movzx eax, byte [rcx - 1]
mov rdi, rcx
dec rcx
cmp al, 0x30
jne 0x140156eff
movzx eax, byte [rcx - 1]
dec rcx
cmp al, 0x30
je 0x140156ef4
cmp al, r8b
lea rdx, [rcx - 1]
cmovne rdx, rcx
nop word [rax + rax]
movzx eax, byte ds:[rdi]
lea rdx, [rdx + 1]
mov byte [rdx], al
lea rdi, [rdi + 1]
test al, al
jne 0x140156f10
movzx edx, byte [rbp - 0x6f]
lea rax, [rbp - 0x6f]
mov r15, 0xffffffffffffffff
inc r15
cmp byte [rax + r15], 0
jne 0x140156f33
nop dword [rax]
cmp dl, 0x2d
jne 0x140156f59
mov r9d, 1
lea r14, [rbp - 0x6e]
mov dword [rsp + 0x48], r9d
dec r15d
jmp 0x140156f5e
mov r9d, dword [rsp + 0x48]
movzx eax, byte [r14]
mov rbx, r14
sub al, 0x30
mov qword [rsp + 0x50], r14
cmp al, 0xa
jae 0x140156f7d
movzx eax, byte [rbx + 1]
inc rbx
sub al, 0x30
cmp al, 0xa
jb 0x140156f70
mov r8d, ebx
sub r8d, r14d
mov dword [rsp + 0x50], r8d
lea edi, [r8 + 2]
je 0x140156fa2
mov eax, 0xaaaaaaab
mul edi
mov r13d, edx
shr r13d, 1
dec r13d
jmp 0x140156fa7
xor eax, eax
mov r13d, eax
mov r10, qword [rsp + 0x40]
lea ecx, [r15 + r13]
add ecx, ecx
test r9d, r9d
lea eax, [rcx + 2]
cmove eax, ecx
mov ecx, eax
mov rax, qword [rsp + 0x38]
add rcx, r10
cmp rax, rcx
jae 0x140157067
add rax, rax
mov rdx, rcx
cmp rax, rcx
cmovae rdx, rax
mov qword [rsp + 0x38], rdx
lea rcx, [rdx + 0x12]
mov rdx, qword [0x1402ca978]
call sym.SystemInformer.exe_PhCreateObject
mov r8, qword ds:[rsp + 0x40]
mov rsi, rax
mov rax, qword [rsp + 0x38]
lea rcx, [rsi + 0x10]
xor edx, edx
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov word [rax + rcx], dx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsi + 8]
mov rdx, qword [rax + 8]
call fcn.14020a640
mov rcx, qword [rsp + 0x30]
mov edx, 0xffffffff
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140157045
nop dword [rax]
call fcn.140141ca0
mov r10, qword [rsp + 0x40]
mov rax, qword [rsi + 8]
mov rcx, r10
mov r8d, dword [rsp + 0x50]
mov r9d, dword [rsp + 0x48]
shr rcx, 1
mov qword [rsp + 0x30], rsi
lea rsi, [rax + rcx*2]
mov eax, 0xaaaaaaab
mov ecx, r8d
mul edi
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
test r9d, r9d
je 0x140157086
mov word [rsi], 0x2d
add rsi, 2
test r8d, r8d
je 0x1401570d0
nop dword [rax + rax]
movsx eax, byte [r14]
dec ecx
mov word [rsi], ax
inc r14
mov eax, edi
add rsi, 2
dec edi
test eax, eax
jne 0x1401570cc
test ecx, ecx
je 0x1401570d0
movzx eax, word [0x1402c1118]
dec ecx
mov word [rsi], ax
mov edi, 1
movsx eax, byte [r14]
mov word [rsi + 2], ax
add rsi, 4
inc r14
test ecx, ecx
jne 0x140157090
test r9d, r9d
je 0x1401570de
add r10, 2
mov qword [rsp + 0x40], r10
sub r15d, r8d
mov rcx, rbx
mov edx, r15d
mov r8, rsi
mov edi, r15d
call sym.SystemInformer.exe_PhZeroExtendToUtf16Buffer
mov ecx, dword [rsp + 0x50]
lea rbx, [rsi + r15*2]
mov rax, qword [rsp + 0x40]
lea r15, [0x140000000]
mov r8, qword [rsp + 0x38]
add ecx, r13d
add rcx, rdi
mov esi, r12d
add rsi, rsi
lea r14, [rax + rcx*2]
mov rcx, qword [r15 + rsi*8 + 0x2c5c50]
lea rax, [r14 + 2]
add rax, rcx
cmp r8, rax
jae 0x1401571aa
mov rdx, qword [0x1402ca978]
lea rbx, [rcx + 2]
lea rax, [r8 + r8]
add rbx, r14
cmp rax, rbx
cmovae rbx, rax
mov qword [rsp + 0x38], rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov rdi, rax
mov r8, r14
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
xor eax, eax
mov word [rbx + rcx], ax
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rdi + 8]
mov rdx, qword [rbx + 8]
call fcn.14020a640
lea rcx, [rbx - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140157197
call fcn.140141ca0
mov rax, qword [rdi + 8]
mov rcx, r14
shr rcx, 1
mov qword [rsp + 0x30], rdi
lea rbx, [rax + rcx*2]
mov word [rbx], 0x20
lea rcx, [rbx + 2]
mov r8, qword [r15 + rsi*8 + 0x2c5c50]
mov rdx, qword [r15 + rsi*8 + 0x2c5c58]
call fcn.14020a640
mov rcx, qword [r15 + rsi*8 + 0x2c5c50]
lea r15, [r14 + 2]
mov r14, qword [rsp + 0x58]
lea rax, [rcx + 2]
shr rax, 1
lea rsi, [rbx + rax*2]
add r15, rcx
mov qword [rsp + 0x40], r15
mov rdi, r15
sub rdi, qword [rsp + 0x78]
test dword [r14], 0xc0000000
je 0x14015731d
movzx ebx, word [r14 + 6]
add rbx, rbx
cmp rdi, rbx
jae 0x14015731d
mov r12, qword [rsp + 0x38]
sub rbx, rdi
lea r13, [rbx + r15]
cmp r12, r13
jae 0x1401572a0
mov rdx, qword [0x1402ca978]
lea rax, [r12 + r12]
cmp rax, r13
mov r12, r13
cmovae r12, rax
mov qword [rsp + 0x38], r12
lea rcx, [r12 + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov rsi, rax
mov r8, r15
mov qword [rax], r12
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
xor eax, eax
mov word [r12 + rcx], ax
mov r12, qword [rsp + 0x30]
mov rcx, qword [rsi + 8]
mov rdx, qword [r12 + 8]
call fcn.14020a640
lea rcx, [r12 - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140157290
call fcn.140141ca0
mov rax, qword [rsi + 8]
shr r15, 1
mov qword [rsp + 0x30], rsi
lea rsi, [rax + r15*2]
mov eax, dword [r14]
test al, al
jns 0x1401572ae
movzx r12d, word [r14 + 8]
jmp 0x1401572b4
mov r12d, 0x20
shr rbx, 1
test eax, eax
jns 0x1401572d8
nop dword [rax + rax]
test rbx, rbx
je 0x1401572d2
movzx eax, r12w
mov rdi, rsi
mov rcx, rbx
rep stosw word [rdi], ax
lea r14, [rbx + rbx]
jmp 0x140157312
lfence
mov rax, rdi
lea r14, [rbx + rbx]
shr rax, 1
mov r15, rsi
add rax, rax
mov r8, rdi
sub r15, rax
mov rdx, r15
lea rcx, [r15 + r14]
call fcn.14020a640
nop dword [rax]
test rbx, rbx
je 0x140157312
movzx eax, r12w
mov rdi, r15
mov rcx, rbx
rep stosw word [rdi], ax
add rsi, r14
mov qword [rsp + 0x40], r13
mov r15, r13
mov edi, dword [rsp + 0x6c]
lea r8, [0x140000000]
mov rbx, qword [rsp + 0x38]
mov edx, 1
mov r12, qword [rbp - 0x80]
mov r9d, 0xa2
mov r10d, 2
test edi, edi
jne 0x140156090
movaps xmm7, xmmword [rsp + 0x4a0]
movaps xmm6, xmmword [rsp + 0x4b0]
mov r14, qword [rsp + 0x4c0]
mov r13, qword [rsp + 0x508]
mov r11, qword [rsp + 0x30]
mov rcx, qword [r11 + 8]
mov qword [r11], r15
shr r15, 1
xor eax, eax
mov word [rcx + r15*2], ax
mov rax, r11
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.1401e4160
add rsp, 0x4c8
pop r15
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret