Function at 0x1400caac0
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rbx
push r13
lea rbp, [rax - 0x6d8]
sub rsp, 0x7c0
mov qword [rax - 0x20], rsi
xor esi, esi
mov qword [rax - 0x28], rdi
mov r13d, esi
mov qword [rax - 0x30], r12
mov r12, r8
mov qword [rax - 0x38], r14
mov r14d, edx
mov qword [rax - 0x40], r15
mov rax, rcx
xor cl, cl
mov r15, r8
test r12, r12
movzx ebx, cl
mov r8d, 1
cmove ebx, r8d
test byte [0x140157108], r8b
mov dword [rsp + 0x50], ebx
jne 0x1400cac5c
lock bts qword [0x140157108], 0x1f
jae 0x1400cab55
test byte [0x140157108], r8b
jne 0x1400cac5c
xor edx, edx
lea rcx, [0x140157108]
call sym.ProcessHacker.exe_PhfWaitForEvent
jmp 0x1400cac48
mov r9d, 4
lea r8, [rsp + 0x78]
mov ecx, 0x400
lea edx, [r9 + 0xa]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1400cab94
mov rax, qword [rsp + 0x78]
test ax, ax
je 0x1400cab94
movzx edx, word [0x140157100]
cmp word [rsp + 0x7a], si
cmove dx, ax
mov word [0x140157100], dx
mov r9d, 4
lea r8, [rsp + 0x78]
mov ecx, 0x400
lea edx, [r9 + 0xb]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1400cabd3
mov rax, qword [rsp + 0x78]
test ax, ax
je 0x1400cabd3
movzx ecx, word [0x140157088]
cmp word [rsp + 0x7a], si
cmove cx, ax
mov word [0x140157088], cx
cmp word [0x140157100], 0x2e
je 0x1400cabf2
lea rdx, [0x14012ea26]
xor ecx, ecx
call fcn.1400ee6e8
mov qword [0x14015ccd8], rax
lock bts qword [0x140157108], 0
jb 0x1400cac48
mov rdi, qword [0x140157110]
test rdi, rdi
je 0x1400cac15
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtSetEvent]
mov rax, 0xfffffffffffffffe
lock xadd qword [0x140157108], rax
shr rax, 1
and eax, 0x7fff
cmp rax, 1
jne 0x1400cac48
test rdi, rdi
je 0x1400cac48
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
mov qword [0x140157110], rsi
mov r9, qword [rbp + 0x6f8]
mov r8d, 1
mov rax, qword [rbp + 0x6e0]
test r14d, r14d
je 0x1400cb9b0
movaps xmmword [rsp + 0x780], xmm6
lea r10, [0x140000000]
movsd xmm6, qword [0x140139190]
mov edx, 2
movaps xmmword [rsp + 0x770], xmm7
movsd xmm7, qword [0x140139140]
movaps xmmword [rsp + 0x760], xmm8
movsd xmm8, qword [0x1401391d0]
jmp 0x1400cacb7
mov r9, qword [rbp + 0x6f8]
mov r11, rax
mov qword [rsp + 0x58], rax
add rax, 0x20
mov qword [rsp + 0x60], r13
dec r14d
mov qword [rbp + 0x6e0], rax
mov dword [rbp + 0x6e8], r14d
mov rdi, r13
mov r15d, dword [r11]
mov r14d, esi
mov eax, r15d
and eax, 0x3f
cmp eax, 0xc
ja case.default.0x1400cacfe
cdqe
mov ecx, dword [r10 + rax*4 + 0xcba28]
add rcx, r10
jmp rcx
test bl, bl
jne 0x1400cad29
lea rax, [r13 + 2]
cmp r9, rax
jae 0x1400cad1f
add r12, 2
mov byte [rsp + 0x50], 1
add r13, 2
jmp case.default.0x1400cacfe
movzx eax, word [r11 + 0x10]
mov word [r12], ax
add r12, 2
add r13, 2
jmp case.default.0x1400cacfe
test bl, bl
jne 0x1400cad6f
mov r8, qword [r11 + 0x10]
lea rax, [r8 + r13]
cmp r9, rax
jae 0x1400cad5e
mov rax, r8
mov byte [rsp + 0x50], 1
shr rax, 1
add r13, r8
lea r12, [r12 + rax*2]
jmp case.default.0x1400cacfe
mov rdx, qword [r11 + 0x18]
mov rcx, r12
call fcn.1400e31d0
mov r11, qword [rsp + 0x58]
mov rax, qword [r11 + 0x10]
shr rax, 1
add r13, qword [r11 + 0x10]
lea r12, [r12 + rax*2]
jmp case.default.0x1400cacfe
mov rcx, qword [r11 + 0x10]
call sym.ProcessHacker.exe_PhCountStringZ
mov rdi, rax
test bl, bl
jne 0x1400cadcc
lea r8, [rax + rax]
lea rcx, [r8 + r13]
cmp qword [rbp + 0x6f8], rcx
jae 0x1400cadbb
lea rcx, [rax + rax]
mov byte [rsp + 0x50], 1
mov rax, rcx
shr rax, 1
add r13, rcx
jmp 0x1400cb8b5
mov rax, qword [rsp + 0x58]
mov rcx, r12
mov rdx, qword [rax + 0x10]
call fcn.1400e31d0
lea rcx, [rdi + rdi]
mov rax, rcx
shr rax, 1
add r13, rcx
jmp 0x1400cb8b5
cmp r15d, 3
jne 0x1400cadee
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x10]
jmp 0x1400cadff
mov rbx, qword [r11 + 0x10]
or rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], 0
jne 0x1400cadf6
mov r8d, edi
lea rcx, [rsp + 0x68]
mov rdx, rbx
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeSize]
test eax, eax
js 0x1400cb8b9
cmp byte [rsp + 0x50], 0
jne 0x1400cae5f
mov ecx, dword [rsp + 0x68]
lea rax, [rcx + r13]
cmp qword [rbp + 0x6f8], rax
jae 0x1400cae42
mov eax, ecx
mov byte [rsp + 0x50], 1
shr rax, 1
add r13, rcx
jmp 0x1400cb8b5
mov edx, ecx
mov dword [rsp + 0x20], edi
mov rcx, r12
mov r9, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
test eax, eax
js 0x1400cb8b9
mov ecx, dword [rsp + 0x68]
mov eax, ecx
shr rax, 1
add r13, rcx
jmp 0x1400cb8b5
mov edi, dword [r11 + 0x10]
test edi, edi
jns 0x1400cae83
neg edi
mov r14d, r8d
jmp 0x1400cae83
mov edi, dword [r11 + 0x10]
mov r11d, 0xa
bt r15d, 8
jae 0x1400caea4
mov rax, qword [rsp + 0x58]
movzx ecx, byte [rax + 0xa]
lea eax, [rcx - 2]
cmp al, 0x43
ja 0x1400caea4
movzx r11d, cl
mov eax, r15d
lea r10, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
and eax, 0x20000000
lea r9, [rbp + 0x39e]
lea rax, str.0123456789abcdefghijklmnopqrstuvwxyz_________._:_________
mov ebx, esi
cmove r10, rax
test edi, edi
je 0x1400caf4e
bt r15d, 0x10
jae 0x1400caf30
mov r8d, esi
nop dword [rax]
xor edx, edx
mov eax, edi
div r11d
inc ebx
inc r8d
mov edi, eax
movsx ecx, byte [rdx + r10]
mov word [r9], cx
sub r9, 2
cmp r8d, 3
jne 0x1400caf19
test eax, eax
je 0x1400caf1d
movzx eax, word [0x140157088]
mov r8d, esi
mov word [r9], ax
sub r9, 2
inc ebx
test edi, edi
jne 0x1400caee0
mov r10d, 0x30
test r14b, 1
je 0x1400caf68
mov esi, 1
jmp 0x1400caf78
xor edx, edx
mov eax, edi
div r11d
inc ebx
mov edi, eax
movsx ecx, byte [rdx + r10]
mov word [r9], cx
sub r9, 2
test eax, eax
jne 0x1400caf30
jmp 0x1400caf1d
mov r10d, 0x30
lea r9, [rbp + 0x39c]
mov word [rbp + 0x39e], r10w
mov ebx, r8d
jmp 0x1400caf23
mov eax, r15d
mov edi, 1
and eax, 0x20000
cmovne esi, edi
mov eax, r15d
and eax, 0x50000
cmp eax, 0x40000
jne 0x1400cafa9
mov rax, qword [rsp + 0x58]
movzx ecx, word [rax + 6]
lea eax, [rsi + rbx]
cmp eax, ecx
jae 0x1400cafa9
mov edx, ecx
or r14d, 4
sub edx, esi
sub edx, ebx
mov dword [rsp + 0x6c], edx
add esi, edx
jmp 0x1400cafad
mov edx, dword [rsp + 0x6c]
cmp byte [rsp + 0x50], 0
jne 0x1400cb032
lea eax, [rsi + rbx]
lea rax, [rax*2]
add rax, r13
cmp qword [rbp + 0x6f8], rax
jae 0x1400cafdd
lea eax, [rsi + rbx]
mov byte [rsp + 0x50], 1
lea r13, [r13 + rax*2]
jmp 0x1400cb8b9
test r14b, 1
je 0x1400cafea
mov eax, 0x2d
jmp 0x1400caff6
bt r15d, 0x11
jae 0x1400cafff
mov eax, 0x2b
mov word [r12], ax
add r12, 2
test r14b, 4
je 0x1400cb01b
test rdx, rdx
je 0x1400cb017
movzx eax, r10w
mov rdi, r12
mov rcx, rdx
rep stosw word [rdi], ax
lea r12, [r12 + rdx*2]
mov edi, ebx
lea rdx, [r9 + 2]
add rdi, rdi
mov rcx, r12
mov r8, rdi
call fcn.1400e31d0
add r12, rdi
lea eax, [rsi + rbx]
lea r13, [r13 + rax*2]
jmp 0x1400cb8b9
mov rdi, qword [r11 + 0x10]
test rdi, rdi
jns 0x1400cb054
neg rdi
mov r14d, r8d
jmp 0x1400cb054
mov rdi, qword [r11 + 0x10]
mov edx, 0xa
bt r15d, 8
jae 0x1400cb06f
movzx ecx, byte [r11 + 0xa]
lea eax, [rcx - 2]
cmp al, 0x43
ja 0x1400cb06f
movzx edx, cl
mov eax, r15d
lea r10, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
and eax, 0x20000000
lea r9, [rbp + 0x39e]
lea rax, str.0123456789abcdefghijklmnopqrstuvwxyz_________._:_________
mov ebx, esi
cmove r10, rax
test rdi, rdi
je 0x1400cb133
bt r15d, 0x10
jae 0x1400cb10c
mov r8d, esi
mov r11d, edx
nop dword [rax + rax]
xor edx, edx
mov rax, rdi
div r11
inc ebx
inc r8d
mov rdi, rax
mov eax, edx
movsx ecx, byte [rax + r10]
mov word [r9], cx
sub r9, 2
cmp r8d, 3
jne 0x1400cb0ee
test rdi, rdi
je 0x1400cb0f3
movzx eax, word [0x140157088]
mov r8d, esi
mov word [r9], ax
sub r9, 2
inc ebx
test rdi, rdi
jne 0x1400cb0b0
mov r11, qword [rsp + 0x58]
mov edi, 0x30
lea r8d, [rdi - 0x2f]
test r14b, 1
je 0x1400cb14b
mov esi, r8d
jmp 0x1400cb157
mov r8d, edx
nop
xor edx, edx
mov rax, rdi
div r8
inc ebx
mov rdi, rax
mov eax, edx
movsx ecx, byte [rax + r10]
mov word [r9], cx
sub r9, 2
test rdi, rdi
jne 0x1400cb110
jmp 0x1400cb0f8
mov edi, 0x30
lea r9, [rbp + 0x39c]
mov word [rbp + 0x39e], di
mov ebx, r8d
jmp 0x1400cb101
mov eax, r15d
and eax, 0x20000
cmovne esi, r8d
mov eax, r15d
and eax, 0x50000
cmp eax, 0x40000
jne 0x1400cb184
movzx ecx, word [r11 + 6]
lea eax, [rsi + rbx]
cmp eax, ecx
jae 0x1400cb184
mov edx, ecx
or r14d, 4
sub edx, esi
sub edx, ebx
mov dword [rsp + 0x70], edx
add esi, edx
jmp 0x1400cb188
mov edx, dword [rsp + 0x70]
cmp byte [rsp + 0x50], 0
jne 0x1400cb032
lea eax, [rsi + rbx]
lea rax, [rax*2]
add rax, r13
cmp qword [rbp + 0x6f8], rax
jae 0x1400cb1bc
lea eax, [rsi + rbx]
mov byte [rsp + 0x50], 1
lea r13, [r13 + rax*2]
jmp 0x1400cb8b9
test r14b, 1
je 0x1400cb1c9
mov eax, 0x2d
jmp 0x1400cb1d5
bt r15d, 0x11
jae 0x1400cb1de
mov eax, 0x2b
mov word [r12], ax
add r12, 2
test r14b, 4
je 0x1400cb01b
test rdx, rdx
je 0x1400cb017
movzx eax, di
jmp 0x1400cb00e
test r15b, 0x40
je 0x1400cb211
movzx edi, word [r11 + 4]
mov eax, 0xa2
cmp edi, eax
jbe 0x1400cb216
mov edi, eax
jmp 0x1400cb216
mov edi, 6
mov cl, 0x66
bt r15d, 0xc
jae 0x1400cb223
mov cl, 0x65
jmp 0x1400cb236
mov eax, r15d
movzx ecx, cl
and eax, 0x2000
mov eax, 0x61
cmovne ecx, eax
movsd xmm0, qword [r11 + 0x10]
lea r14, [rbp - 0x5f]
movsd qword [rbp - 0x70], xmm0
movsx edx, cl
bt r15d, 0x1d
jae 0x1400cb252
sub edx, 0x20
mov rax, qword [0x14015ccd8]
lea r9, [rbp + 0x3a0]
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x70]
mov qword [rsp + 0x38], rsi
mov r8d, 0x3ff
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edx
lea rdx, [rbp - 0x5f]
mov qword [rsp + 0x20], 0x15e
call fcn.1400efef4
mov r11, qword [rsp + 0x58]
movzx edx, byte [rbp - 0x5f]
mov r9d, dword [r11]
bt r9d, 0xf
jae 0x1400cb314
movzx edi, word [0x140157100]
lea rcx, [rbp - 0x5f]
test dl, dl
je 0x1400cb2c3
movzx eax, dl
cmp al, dil
je 0x1400cb2c3
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1400cb2b3
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400cb314
movzx eax, byte [rcx]
test al, al
je 0x1400cb2e5
sub al, 0x45
test al, 0xdf
je 0x1400cb2e5
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1400cb2d4
mov rdx, rcx
dec rcx
cmp byte [rcx], 0x30
jne 0x1400cb2f8
dec rcx
cmp byte [rcx], 0x30
je 0x1400cb2f0
cmp byte [rcx], dil
jne 0x1400cb300
dec rcx
movzx eax, byte [rdx]
lea rcx, [rcx + 1]
inc rdx
mov byte [rcx], al
test al, al
jne 0x1400cb300
movzx edx, byte [rbp - 0x5f]
lea rax, [rbp - 0x5f]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400cb320
mov edi, 1
cmp dl, 0x2d
jne 0x1400cb340
mov r10d, edi
lea r14, [rbp - 0x5e]
dec r8d
jmp 0x1400cb354
mov eax, r9d
mov r10d, esi
and eax, 0x20000
mov eax, 2
cmovne r10d, eax
mov eax, r9d
and eax, 0x13000
cmp eax, 0x10000
jne 0x1400cb4a7
movzx eax, byte [r14]
mov r9, r14
sub al, 0x30
cmp al, 0xa
jae 0x1400cb38e
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r9 + 1]
inc r9
sub al, 0x30
cmp al, 0xa
jb 0x1400cb380
mov r11d, r9d
sub r11d, r14d
je 0x1400cb3a9
lea ecx, [r11 + 2]
mov eax, 0xaaaaaaab
mul ecx
mov ebx, edx
shr ebx, 1
dec ebx
jmp 0x1400cb3ab
mov ebx, esi
lea eax, [rbx + r8]
mov esi, r10d
add eax, eax
and esi, 3
je 0x1400cb3bc
add eax, 2
mov r15d, dword [rsp + 0x50]
test r15b, r15b
jne 0x1400cb3dd
add rax, r13
movzx r15d, r15b
cmp qword [rbp + 0x6f8], rax
cmovb r15d, edi
mov dword [rsp + 0x50], r15d
lea edi, [r11 + 2]
mov eax, 0xaaaaaaab
mul edi
mov ecx, r11d
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
test r15b, r15b
jne 0x1400cb468
test r10b, 1
je 0x1400cb404
mov eax, 0x2d
jmp 0x1400cb40f
test r10b, 2
je 0x1400cb418
mov eax, 0x2b
mov word [r12], ax
add r12, 2
test r11d, r11d
je 0x1400cb468
mov r15d, 2
nop dword [rax]
nop word [rax + rax]
movsx eax, byte [r14]
dec ecx
mov word [r12], ax
inc r14
mov eax, edi
add r12, r15
dec edi
test eax, eax
jne 0x1400cb45f
test ecx, ecx
je 0x1400cb463
movzx eax, word [0x140157088]
mov edi, r15d
mov word [r12], ax
add r12, r15
test ecx, ecx
jne 0x1400cb430
mov r15d, dword [rsp + 0x50]
test esi, esi
je 0x1400cb470
add r13, 2
sub r8d, r11d
lea eax, [rbx + r11]
lea r13, [r13 + rax*2]
test r15b, r15b
jne 0x1400cb8b9
mov edi, r8d
mov rcx, r9
mov edx, edi
mov r8, r12
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
lea rcx, [rdi + rdi]
mov rax, rcx
shr rax, 1
add r13, rcx
jmp 0x1400cb8b5
movzx eax, r10b
mov rdx, rsi
and al, 3
cmovne rdx, rdi
bt r9d, 0x12
jae 0x1400cb4e2
movzx edi, word [r11 + 6]
mov ecx, r8d
lea rax, [rcx + rdx]
cmp rax, rdi
jae 0x1400cb4e2
mov r9d, edi
or r10d, 4
sub r9, rcx
sub r9, rdx
mov qword [rbp - 0x78], r9
add rdx, r9
jmp 0x1400cb4e6
mov r9, qword [rbp - 0x78]
test bl, bl
jne 0x1400cb54d
mov eax, r8d
add rax, rdx
lea rax, [rax*2]
add rax, r13
cmp qword [rbp + 0x6f8], rax
jae 0x1400cb50c
mov bl, 1
mov dword [rsp + 0x50], ebx
jmp 0x1400cb54d
test r10b, 1
je 0x1400cb519
mov eax, 0x2d
jmp 0x1400cb524
test r10b, 2
je 0x1400cb52d
mov eax, 0x2b
mov word [r12], ax
add r12, 2
test r10b, 4
je 0x1400cb54d
test r9, r9
je 0x1400cb549
mov eax, 0x30
mov rdi, r12
movzx eax, ax
mov rcx, r9
rep stosw word [rdi], ax
lea r12, [r12 + r9*2]
lea r13, [r13 + rdx*2]
test bl, bl
jne 0x1400cb8be
mov edi, r8d
mov rcx, r14
mov edx, edi
mov r8, r12
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
lea rcx, [rdi + rdi]
mov rax, rcx
shr rax, 1
add r13, rcx
jmp 0x1400cb8b5
mov rax, qword [r11 + 0x10]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
test rax, rax
jns 0x1400cb592
addsd xmm0, xmm8
jne 0x1400cb5ca
test bl, bl
jne 0x1400cb5bd
lea rax, [r13 + 2]
cmp r9, rax
jae 0x1400cb5b3
add r12, 2
mov byte [rsp + 0x50], 1
add r13, 2
jmp case.default.0x1400cacfe
mov eax, 0x30
mov word [r12], ax
add r12, 2
add r13, 2
jmp case.default.0x1400cacfe
bt r15d, 8
jae 0x1400cb5d8
movzx eax, byte [r11 + 0xa]
jmp 0x1400cb5de
mov eax, dword [0x140159800]
comisd xmm0, xmm6
jb 0x1400cb5f9
cmp esi, 7
jae 0x1400cb5f9
cmp esi, eax
jae 0x1400cb5f9
mulsd xmm0, xmm7
inc esi
comisd xmm0, xmm6
jae 0x1400cb5e4
test r15b, 0x40
je 0x1400cb606
movzx eax, word [r11 + 4]
jmp 0x1400cb608
mov eax, edx
movzx ecx, ax
lea r9, [rbp + 0x500]
mov eax, 0xa2
movsd qword [rbp - 0x68], xmm0
xor ebx, ebx
lea rdx, [rbp - 0x5f]
cmp ecx, eax
lea r14, [rbp - 0x5f]
mov r8d, 0x3ff
mov r15d, ebx
cmova ecx, eax
mov rax, qword [0x14015ccd8]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ecx
lea rcx, [rbp - 0x68]
mov dword [rsp + 0x28], 0x66
mov qword [rsp + 0x20], 0x15e
call fcn.1400efef4
movzx edx, byte [rbp - 0x5f]
lea rcx, [rbp - 0x5f]
movzx edi, word [0x140157100]
test dl, dl
je 0x1400cb690
movzx eax, dl
nop dword [rax]
cmp al, dil
je 0x1400cb690
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1400cb680
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400cb6e4
movzx eax, byte [rcx]
test al, al
je 0x1400cb6b2
sub al, 0x45
test al, 0xdf
je 0x1400cb6b2
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1400cb6a1
mov rdx, rcx
dec rcx
cmp byte [rcx], 0x30
jne 0x1400cb6c8
nop dword [rax]
dec rcx
cmp byte [rcx], 0x30
je 0x1400cb6c0
cmp byte [rcx], dil
jne 0x1400cb6d0
dec rcx
movzx eax, byte [rdx]
lea rcx, [rcx + 1]
inc rdx
mov byte [rcx], al
test al, al
jne 0x1400cb6d0
movzx edx, byte [rbp - 0x5f]
lea rax, [rbp - 0x5f]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], bl
jne 0x1400cb6f0
mov edi, 1
cmp dl, 0x2d
jne 0x1400cb70d
mov r15d, edi
lea r14, [rbp - 0x5e]
dec r8d
movzx eax, byte [r14]
mov r9, r14
sub al, 0x30
cmp al, 0xa
jae 0x1400cb72e
nop word [rax + rax]
movzx eax, byte [r9 + 1]
inc r9
sub al, 0x30
cmp al, 0xa
jb 0x1400cb720
mov r10d, r9d
sub r10d, r14d
je 0x1400cb74c
lea ecx, [r10 + 2]
mov eax, 0xaaaaaaab
mul ecx
mov r11d, edx
shr r11d, 1
dec r11d
jmp 0x1400cb74f
mov r11d, ebx
lea eax, [r11 + r8]
mov ebx, r15d
add eax, eax
and ebx, 3
mov dword [rbp - 0x80], ebx
je 0x1400cb763
add eax, 2
mov ecx, dword [rsp + 0x50]
test cl, cl
jne 0x1400cb77f
add rax, r13
movzx ecx, cl
cmp qword [rbp + 0x6f8], rax
cmovb ecx, edi
mov byte [rsp + 0x50], cl
lea edi, [r10 + 2]
mov eax, 0xaaaaaaab
mul edi
mov ecx, r10d
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
cmp byte [rsp + 0x50], 0
jne 0x1400cb805
test r15b, 1
je 0x1400cb7a8
mov eax, 0x2d
jmp 0x1400cb7b3
test r15b, 2
je 0x1400cb7bc
mov eax, 0x2b
mov word [r12], ax
add r12, 2
test r10d, r10d
je 0x1400cb805
mov ebx, 2
nop word [rax + rax]
movsx eax, byte [r14]
dec ecx
mov word [r12], ax
inc r14
mov eax, edi
add r12, rbx
dec edi
test eax, eax
jne 0x1400cb7fe
test ecx, ecx
je 0x1400cb802
movzx eax, word [0x140157088]
mov edi, ebx
mov word [r12], ax
add r12, rbx
test ecx, ecx
jne 0x1400cb7d0
mov ebx, dword [rbp - 0x80]
test ebx, ebx
je 0x1400cb80d
add r13, 2
lea eax, [r11 + r10]
sub r8d, r10d
lea rbx, [rax*2]
add rbx, r13
cmp byte [rsp + 0x50], 0
jne 0x1400cb893
mov edi, r8d
mov rcx, r9
mov edx, edi
mov r8, r12
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
lea rcx, [rdi + rdi]
mov edx, esi
add rbx, rcx
lea r10, [0x140000000]
mov rax, rcx
add rdx, rdx
shr rax, 1
lea rcx, [rbx + 2]
add rcx, qword [r10 + rdx*8 + 0x157090]
lea r12, [r12 + rax*2]
cmp qword [rbp + 0x6f8], rcx
jae 0x1400cb86f
mov byte [rsp + 0x50], 1
jmp 0x1400cb89a
mov eax, 0x20
lea rcx, [r12 + 2]
mov word [r12], ax
mov r8, qword [r10 + rdx*8 + 0x157090]
mov rdx, qword [r10 + rdx*8 + 0x157098]
call fcn.1400e31d0
lea r10, [0x140000000]
mov eax, esi
add rax, rax
mov rcx, qword [r10 + rax*8 + 0x157090]
lea rax, [rcx + 2]
shr rax, 1
lea r13, [rcx + 2]
add r13, rbx
lea r12, [r12 + rax*2]
mov r11, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov ecx, dword [r11]
mov r8, r13
sub r8, rdi
test ecx, 0xc0000000
je 0x1400cb962
movzx ebx, word [r11 + 6]
add rbx, rbx
cmp r8, rbx
jae 0x1400cb962
sub rbx, r8
cmp byte [rsp + 0x50], 0
jne 0x1400cb955
lea rax, [rbx + r13]
cmp qword [rbp + 0x6f8], rax
jae 0x1400cb903
mov byte [rsp + 0x50], 1
jmp 0x1400cb955
test cl, cl
jns 0x1400cb90e
movzx r14d, word [r11 + 8]
jmp 0x1400cb914
mov r14d, 0x20
test ecx, ecx
jns 0x1400cb925
mov rcx, rbx
shr rcx, 1
je 0x1400cb955
mov rdi, r12
jmp 0x1400cb94e
mov rax, r8
mov rdi, r12
shr rax, 1
mov rsi, rbx
add rax, rax
shr rsi, 1
sub rdi, rax
mov rdx, rdi
lea rcx, [rdi + rsi*2]
call fcn.1400e31d0
test rsi, rsi
je 0x1400cb955
mov rcx, rsi
movzx eax, r14w
rep stosw word [rdi], ax
mov rax, rbx
shr rax, 1
add r13, rbx
lea r12, [r12 + rax*2]
mov r14d, dword [rbp + 0x6e8]
lea r10, [0x140000000]
mov ebx, dword [rsp + 0x50]
mov esi, 0
mov rax, qword [rbp + 0x6e0]
lea edx, [rsi + 2]
lea r8d, [rsi + 1]
test r14d, r14d
jne 0x1400cacb0
mov r15, qword [rbp + 0x6f0]
movaps xmm8, xmmword [rsp + 0x760]
movaps xmm7, xmmword [rsp + 0x770]
movaps xmm6, xmmword [rsp + 0x780]
mov r14, qword [rsp + 0x7a0]
mov rdi, qword [rsp + 0x7b0]
mov rcx, qword [rbp + 0x6f8]
test bl, bl
jne 0x1400cb9d6
lea rax, [r13 + 2]
cmp rcx, rax
jae 0x1400cba20
mov bl, 1
test r15, r15
je 0x1400cb9e4
test rcx, rcx
je 0x1400cb9e4
mov word [r15], si
mov rdx, qword [rbp + 0x700]
mov r15, qword [rsp + 0x798]
mov r12, qword [rsp + 0x7a8]
mov rsi, qword [rsp + 0x7b8]
test rdx, rdx
je 0x1400cba0f
lea rcx, [r13 + 2]
mov qword [rdx], rcx
test bl, bl
sete al
add rsp, 0x7c0
pop r13
pop rbx
pop rbp
ret
mov word [r12], si
jmp 0x1400cb9e4