Function at 0x1400cb360
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rbx
push r13
lea rbp, [rax - 0x6d8]
sub rsp, 0x7c0
mov qword [rax - 0x20], rsi
xor esi, esi
mov qword [rax - 0x28], rdi
mov r13d, esi
mov qword [rax - 0x30], r12
mov r12, r8
mov qword [rax - 0x38], r14
mov r14d, edx
mov qword [rax - 0x40], r15
mov rax, rcx
xor cl, cl
mov r15, r8
test r12, r12
movzx ebx, cl
mov r8d, 1
cmove ebx, r8d
test byte [0x140155f98], r8b
mov dword [rsp + 0x50], ebx
jne 0x1400cb4fc
lock bts qword [0x140155f98], 0x1f
jae 0x1400cb3f5
test byte [0x140155f98], r8b
jne 0x1400cb4fc
xor edx, edx
lea rcx, [0x140155f98]
call sym.ProcessHacker.exe_PhfWaitForEvent
jmp 0x1400cb4e8
mov r9d, 4
lea r8, [rsp + 0x78]
mov ecx, 0x400
lea edx, [r9 + 0xa]
call qword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
test eax, eax
je 0x1400cb434
mov rax, qword [rsp + 0x78]
test ax, ax
je 0x1400cb434
movzx edx, word [0x140155f90]
cmp word [rsp + 0x7a], si
cmove dx, ax
mov word [0x140155f90], dx
mov r9d, 4
lea r8, [rsp + 0x78]
mov ecx, 0x400
lea edx, [r9 + 0xb]
call qword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
test eax, eax
je 0x1400cb473
mov rax, qword [rsp + 0x78]
test ax, ax
je 0x1400cb473
movzx ecx, word [0x140155f18]
cmp word [rsp + 0x7a], si
cmove cx, ax
mov word [0x140155f18], cx
cmp word [0x140155f90], 0x2e
je 0x1400cb492
lea rdx, [0x14012e906]
xor ecx, ecx
call fcn.1400eee88
mov qword [0x14015bba8], rax
lock bts qword [0x140155f98], 0
jb 0x1400cb4e8
mov rdi, qword [0x140155fa0]
test rdi, rdi
je 0x1400cb4b5
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtSetEvent]
mov rax, 0xfffffffffffffffe
lock xadd qword [0x140155f98], rax
shr rax, 1
and eax, 0x7fff
cmp rax, 1
jne 0x1400cb4e8
test rdi, rdi
je 0x1400cb4e8
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
mov qword [0x140155fa0], rsi
mov r9, qword [rbp + 0x6f8]
mov r8d, 1
mov rax, qword [rbp + 0x6e0]
test r14d, r14d
je 0x1400cc250
movaps xmmword [rsp + 0x780], xmm6
lea r10, [0x140000000]
movsd xmm6, qword [0x140138558]
mov edx, 2
movaps xmmword [rsp + 0x770], xmm7
movsd xmm7, qword [0x140138508]
movaps xmmword [rsp + 0x760], xmm8
movsd xmm8, qword [0x140138598]
jmp 0x1400cb557
mov r9, qword [rbp + 0x6f8]
mov r11, rax
mov qword [rsp + 0x58], rax
add rax, 0x20
mov qword [rsp + 0x60], r13
dec r14d
mov qword [rbp + 0x6e0], rax
mov dword [rbp + 0x6e8], r14d
mov rdi, r13
mov r15d, dword [r11]
mov r14d, esi
mov eax, r15d
and eax, 0x3f
cmp eax, 0xc
ja case.default.0x1400cb59e
cdqe
mov ecx, dword [r10 + rax*4 + 0xcc2c8]
add rcx, r10
jmp rcx
test bl, bl
jne 0x1400cb5c9
lea rax, [r13 + 2]
cmp r9, rax
jae 0x1400cb5bf
add r12, 2
mov byte [rsp + 0x50], 1
add r13, 2
jmp case.default.0x1400cb59e
movzx eax, word [r11 + 0x10]
mov word [r12], ax
add r12, 2
add r13, 2
jmp case.default.0x1400cb59e
test bl, bl
jne 0x1400cb60f
mov r8, qword [r11 + 0x10]
lea rax, [r8 + r13]
cmp r9, rax
jae 0x1400cb5fe
mov rax, r8
mov byte [rsp + 0x50], 1
shr rax, 1
add r13, r8
lea r12, [r12 + rax*2]
jmp case.default.0x1400cb59e
mov rdx, qword [r11 + 0x18]
mov rcx, r12
call fcn.1400e3970
mov r11, qword [rsp + 0x58]
mov rax, qword [r11 + 0x10]
shr rax, 1
add r13, qword [r11 + 0x10]
lea r12, [r12 + rax*2]
jmp case.default.0x1400cb59e
mov rcx, qword [r11 + 0x10]
call sym.ProcessHacker.exe_PhCountStringZ
mov rdi, rax
test bl, bl
jne 0x1400cb66c
lea r8, [rax + rax]
lea rcx, [r8 + r13]
cmp qword [rbp + 0x6f8], rcx
jae 0x1400cb65b
lea rcx, [rax + rax]
mov byte [rsp + 0x50], 1
mov rax, rcx
shr rax, 1
add r13, rcx
jmp 0x1400cc155
mov rax, qword [rsp + 0x58]
mov rcx, r12
mov rdx, qword [rax + 0x10]
call fcn.1400e3970
lea rcx, [rdi + rdi]
mov rax, rcx
shr rax, 1
add r13, rcx
jmp 0x1400cc155
cmp r15d, 3
jne 0x1400cb68e
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x10]
jmp 0x1400cb69f
mov rbx, qword [r11 + 0x10]
or rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], 0
jne 0x1400cb696
mov r8d, edi
lea rcx, [rsp + 0x68]
mov rdx, rbx
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeSize]
test eax, eax
js 0x1400cc159
cmp byte [rsp + 0x50], 0
jne 0x1400cb6ff
mov ecx, dword [rsp + 0x68]
lea rax, [rcx + r13]
cmp qword [rbp + 0x6f8], rax
jae 0x1400cb6e2
mov eax, ecx
mov byte [rsp + 0x50], 1
shr rax, 1
add r13, rcx
jmp 0x1400cc155
mov edx, ecx
mov dword [rsp + 0x20], edi
mov rcx, r12
mov r9, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
test eax, eax
js 0x1400cc159
mov ecx, dword [rsp + 0x68]
mov eax, ecx
shr rax, 1
add r13, rcx
jmp 0x1400cc155
mov edi, dword [r11 + 0x10]
test edi, edi
jns 0x1400cb723
neg edi
mov r14d, r8d
jmp 0x1400cb723
mov edi, dword [r11 + 0x10]
mov r11d, 0xa
bt r15d, 8
jae 0x1400cb744
mov rax, qword [rsp + 0x58]
movzx ecx, byte [rax + 0xa]
lea eax, [rcx - 2]
cmp al, 0x43
ja 0x1400cb744
movzx r11d, cl
mov eax, r15d
lea r10, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
and eax, 0x20000000
lea r9, [rbp + 0x39e]
lea rax, str.0123456789abcdefghijklmnopqrstuvwxyz_________._:_________
mov ebx, esi
cmove r10, rax
test edi, edi
je 0x1400cb7ee
bt r15d, 0x10
jae 0x1400cb7d0
mov r8d, esi
nop dword [rax]
xor edx, edx
mov eax, edi
div r11d
inc ebx
inc r8d
mov edi, eax
movsx ecx, byte [rdx + r10]
mov word [r9], cx
sub r9, 2
cmp r8d, 3
jne 0x1400cb7b9
test eax, eax
je 0x1400cb7bd
movzx eax, word [0x140155f18]
mov r8d, esi
mov word [r9], ax
sub r9, 2
inc ebx
test edi, edi
jne 0x1400cb780
mov r10d, 0x30
test r14b, 1
je 0x1400cb808
mov esi, 1
jmp 0x1400cb818
xor edx, edx
mov eax, edi
div r11d
inc ebx
mov edi, eax
movsx ecx, byte [rdx + r10]
mov word [r9], cx
sub r9, 2
test eax, eax
jne 0x1400cb7d0
jmp 0x1400cb7bd
mov r10d, 0x30
lea r9, [rbp + 0x39c]
mov word [rbp + 0x39e], r10w
mov ebx, r8d
jmp 0x1400cb7c3
mov eax, r15d
mov edi, 1
and eax, 0x20000
cmovne esi, edi
mov eax, r15d
and eax, 0x50000
cmp eax, 0x40000
jne 0x1400cb849
mov rax, qword [rsp + 0x58]
movzx ecx, word [rax + 6]
lea eax, [rsi + rbx]
cmp eax, ecx
jae 0x1400cb849
mov edx, ecx
or r14d, 4
sub edx, esi
sub edx, ebx
mov dword [rsp + 0x6c], edx
add esi, edx
jmp 0x1400cb84d
mov edx, dword [rsp + 0x6c]
cmp byte [rsp + 0x50], 0
jne 0x1400cb8d2
lea eax, [rsi + rbx]
lea rax, [rax*2]
add rax, r13
cmp qword [rbp + 0x6f8], rax
jae 0x1400cb87d
lea eax, [rsi + rbx]
mov byte [rsp + 0x50], 1
lea r13, [r13 + rax*2]
jmp 0x1400cc159
test r14b, 1
je 0x1400cb88a
mov eax, 0x2d
jmp 0x1400cb896
bt r15d, 0x11
jae 0x1400cb89f
mov eax, 0x2b
mov word [r12], ax
add r12, 2
test r14b, 4
je 0x1400cb8bb
test rdx, rdx
je 0x1400cb8b7
movzx eax, r10w
mov rdi, r12
mov rcx, rdx
rep stosw word [rdi], ax
lea r12, [r12 + rdx*2]
mov edi, ebx
lea rdx, [r9 + 2]
add rdi, rdi
mov rcx, r12
mov r8, rdi
call fcn.1400e3970
add r12, rdi
lea eax, [rsi + rbx]
lea r13, [r13 + rax*2]
jmp 0x1400cc159
mov rdi, qword [r11 + 0x10]
test rdi, rdi
jns 0x1400cb8f4
neg rdi
mov r14d, r8d
jmp 0x1400cb8f4
mov rdi, qword [r11 + 0x10]
mov edx, 0xa
bt r15d, 8
jae 0x1400cb90f
movzx ecx, byte [r11 + 0xa]
lea eax, [rcx - 2]
cmp al, 0x43
ja 0x1400cb90f
movzx edx, cl
mov eax, r15d
lea r10, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
and eax, 0x20000000
lea r9, [rbp + 0x39e]
lea rax, str.0123456789abcdefghijklmnopqrstuvwxyz_________._:_________
mov ebx, esi
cmove r10, rax
test rdi, rdi
je 0x1400cb9d3
bt r15d, 0x10
jae 0x1400cb9ac
mov r8d, esi
mov r11d, edx
nop dword [rax + rax]
xor edx, edx
mov rax, rdi
div r11
inc ebx
inc r8d
mov rdi, rax
mov eax, edx
movsx ecx, byte [rax + r10]
mov word [r9], cx
sub r9, 2
cmp r8d, 3
jne 0x1400cb98e
test rdi, rdi
je 0x1400cb993
movzx eax, word [0x140155f18]
mov r8d, esi
mov word [r9], ax
sub r9, 2
inc ebx
test rdi, rdi
jne 0x1400cb950
mov r11, qword [rsp + 0x58]
mov edi, 0x30
lea r8d, [rdi - 0x2f]
test r14b, 1
je 0x1400cb9eb
mov esi, r8d
jmp 0x1400cb9f7
mov r8d, edx
nop
xor edx, edx
mov rax, rdi
div r8
inc ebx
mov rdi, rax
mov eax, edx
movsx ecx, byte [rax + r10]
mov word [r9], cx
sub r9, 2
test rdi, rdi
jne 0x1400cb9b0
jmp 0x1400cb998
mov edi, 0x30
lea r9, [rbp + 0x39c]
mov word [rbp + 0x39e], di
mov ebx, r8d
jmp 0x1400cb9a1
mov eax, r15d
and eax, 0x20000
cmovne esi, r8d
mov eax, r15d
and eax, 0x50000
cmp eax, 0x40000
jne 0x1400cba24
movzx ecx, word [r11 + 6]
lea eax, [rsi + rbx]
cmp eax, ecx
jae 0x1400cba24
mov edx, ecx
or r14d, 4
sub edx, esi
sub edx, ebx
mov dword [rsp + 0x70], edx
add esi, edx
jmp 0x1400cba28
mov edx, dword [rsp + 0x70]
cmp byte [rsp + 0x50], 0
jne 0x1400cb8d2
lea eax, [rsi + rbx]
lea rax, [rax*2]
add rax, r13
cmp qword [rbp + 0x6f8], rax
jae 0x1400cba5c
lea eax, [rsi + rbx]
mov byte [rsp + 0x50], 1
lea r13, [r13 + rax*2]
jmp 0x1400cc159
test r14b, 1
je 0x1400cba69
mov eax, 0x2d
jmp 0x1400cba75
bt r15d, 0x11
jae 0x1400cba7e
mov eax, 0x2b
mov word [r12], ax
add r12, 2
test r14b, 4
je 0x1400cb8bb
test rdx, rdx
je 0x1400cb8b7
movzx eax, di
jmp 0x1400cb8ae
test r15b, 0x40
je 0x1400cbab1
movzx edi, word [r11 + 4]
mov eax, 0xa2
cmp edi, eax
jbe 0x1400cbab6
mov edi, eax
jmp 0x1400cbab6
mov edi, 6
mov cl, 0x66
bt r15d, 0xc
jae 0x1400cbac3
mov cl, 0x65
jmp 0x1400cbad6
mov eax, r15d
movzx ecx, cl
and eax, 0x2000
mov eax, 0x61
cmovne ecx, eax
movsd xmm0, qword [r11 + 0x10]
lea r14, [rbp - 0x5f]
movsd qword [rbp - 0x70], xmm0
movsx edx, cl
bt r15d, 0x1d
jae 0x1400cbaf2
sub edx, 0x20
mov rax, qword [0x14015bba8]
lea r9, [rbp + 0x3a0]
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x70]
mov qword [rsp + 0x38], rsi
mov r8d, 0x3ff
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edx
lea rdx, [rbp - 0x5f]
mov qword [rsp + 0x20], 0x15e
call fcn.1400f0694
mov r11, qword [rsp + 0x58]
movzx edx, byte [rbp - 0x5f]
mov r9d, dword [r11]
bt r9d, 0xf
jae 0x1400cbbb4
movzx edi, word [0x140155f90]
lea rcx, [rbp - 0x5f]
test dl, dl
je 0x1400cbb63
movzx eax, dl
cmp al, dil
je 0x1400cbb63
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1400cbb53
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400cbbb4
movzx eax, byte [rcx]
test al, al
je 0x1400cbb85
sub al, 0x45
test al, 0xdf
je 0x1400cbb85
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1400cbb74
mov rdx, rcx
dec rcx
cmp byte [rcx], 0x30
jne 0x1400cbb98
dec rcx
cmp byte [rcx], 0x30
je 0x1400cbb90
cmp byte [rcx], dil
jne 0x1400cbba0
dec rcx
movzx eax, byte [rdx]
lea rcx, [rcx + 1]
inc rdx
mov byte [rcx], al
test al, al
jne 0x1400cbba0
movzx edx, byte [rbp - 0x5f]
lea rax, [rbp - 0x5f]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400cbbc0
mov edi, 1
cmp dl, 0x2d
jne 0x1400cbbe0
mov r10d, edi
lea r14, [rbp - 0x5e]
dec r8d
jmp 0x1400cbbf4
mov eax, r9d
mov r10d, esi
and eax, 0x20000
mov eax, 2
cmovne r10d, eax
mov eax, r9d
and eax, 0x13000
cmp eax, 0x10000
jne 0x1400cbd47
movzx eax, byte [r14]
mov r9, r14
sub al, 0x30
cmp al, 0xa
jae 0x1400cbc2e
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r9 + 1]
inc r9
sub al, 0x30
cmp al, 0xa
jb 0x1400cbc20
mov r11d, r9d
sub r11d, r14d
je 0x1400cbc49
lea ecx, [r11 + 2]
mov eax, 0xaaaaaaab
mul ecx
mov ebx, edx
shr ebx, 1
dec ebx
jmp 0x1400cbc4b
mov ebx, esi
lea eax, [rbx + r8]
mov esi, r10d
add eax, eax
and esi, 3
je 0x1400cbc5c
add eax, 2
mov r15d, dword [rsp + 0x50]
test r15b, r15b
jne 0x1400cbc7d
add rax, r13
movzx r15d, r15b
cmp qword [rbp + 0x6f8], rax
cmovb r15d, edi
mov dword [rsp + 0x50], r15d
lea edi, [r11 + 2]
mov eax, 0xaaaaaaab
mul edi
mov ecx, r11d
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
test r15b, r15b
jne 0x1400cbd08
test r10b, 1
je 0x1400cbca4
mov eax, 0x2d
jmp 0x1400cbcaf
test r10b, 2
je 0x1400cbcb8
mov eax, 0x2b
mov word [r12], ax
add r12, 2
test r11d, r11d
je 0x1400cbd08
mov r15d, 2
nop dword [rax]
nop word [rax + rax]
movsx eax, byte [r14]
dec ecx
mov word [r12], ax
inc r14
mov eax, edi
add r12, r15
dec edi
test eax, eax
jne 0x1400cbcff
test ecx, ecx
je 0x1400cbd03
movzx eax, word [0x140155f18]
mov edi, r15d
mov word [r12], ax
add r12, r15
test ecx, ecx
jne 0x1400cbcd0
mov r15d, dword [rsp + 0x50]
test esi, esi
je 0x1400cbd10
add r13, 2
sub r8d, r11d
lea eax, [rbx + r11]
lea r13, [r13 + rax*2]
test r15b, r15b
jne 0x1400cc159
mov edi, r8d
mov rcx, r9
mov edx, edi
mov r8, r12
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
lea rcx, [rdi + rdi]
mov rax, rcx
shr rax, 1
add r13, rcx
jmp 0x1400cc155
movzx eax, r10b
mov rdx, rsi
and al, 3
cmovne rdx, rdi
bt r9d, 0x12
jae 0x1400cbd82
movzx edi, word [r11 + 6]
mov ecx, r8d
lea rax, [rcx + rdx]
cmp rax, rdi
jae 0x1400cbd82
mov r9d, edi
or r10d, 4
sub r9, rcx
sub r9, rdx
mov qword [rbp - 0x78], r9
add rdx, r9
jmp 0x1400cbd86
mov r9, qword [rbp - 0x78]
test bl, bl
jne 0x1400cbded
mov eax, r8d
add rax, rdx
lea rax, [rax*2]
add rax, r13
cmp qword [rbp + 0x6f8], rax
jae 0x1400cbdac
mov bl, 1
mov dword [rsp + 0x50], ebx
jmp 0x1400cbded
test r10b, 1
je 0x1400cbdb9
mov eax, 0x2d
jmp 0x1400cbdc4
test r10b, 2
je 0x1400cbdcd
mov eax, 0x2b
mov word [r12], ax
add r12, 2
test r10b, 4
je 0x1400cbded
test r9, r9
je 0x1400cbde9
mov eax, 0x30
mov rdi, r12
movzx eax, ax
mov rcx, r9
rep stosw word [rdi], ax
lea r12, [r12 + r9*2]
lea r13, [r13 + rdx*2]
test bl, bl
jne 0x1400cc15e
mov edi, r8d
mov rcx, r14
mov edx, edi
mov r8, r12
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
lea rcx, [rdi + rdi]
mov rax, rcx
shr rax, 1
add r13, rcx
jmp 0x1400cc155
mov rax, qword [r11 + 0x10]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
test rax, rax
jns 0x1400cbe32
addsd xmm0, xmm8
jne 0x1400cbe6a
test bl, bl
jne 0x1400cbe5d
lea rax, [r13 + 2]
cmp r9, rax
jae 0x1400cbe53
add r12, 2
mov byte [rsp + 0x50], 1
add r13, 2
jmp case.default.0x1400cb59e
mov eax, 0x30
mov word [r12], ax
add r12, 2
add r13, 2
jmp case.default.0x1400cb59e
bt r15d, 8
jae 0x1400cbe78
movzx eax, byte [r11 + 0xa]
jmp 0x1400cbe7e
mov eax, dword [0x140158690]
comisd xmm0, xmm6
jb 0x1400cbe99
cmp esi, 7
jae 0x1400cbe99
cmp esi, eax
jae 0x1400cbe99
mulsd xmm0, xmm7
inc esi
comisd xmm0, xmm6
jae 0x1400cbe84
test r15b, 0x40
je 0x1400cbea6
movzx eax, word [r11 + 4]
jmp 0x1400cbea8
mov eax, edx
movzx ecx, ax
lea r9, [rbp + 0x500]
mov eax, 0xa2
movsd qword [rbp - 0x68], xmm0
xor ebx, ebx
lea rdx, [rbp - 0x5f]
cmp ecx, eax
lea r14, [rbp - 0x5f]
mov r8d, 0x3ff
mov r15d, ebx
cmova ecx, eax
mov rax, qword [0x14015bba8]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ecx
lea rcx, [rbp - 0x68]
mov dword [rsp + 0x28], 0x66
mov qword [rsp + 0x20], 0x15e
call fcn.1400f0694
movzx edx, byte [rbp - 0x5f]
lea rcx, [rbp - 0x5f]
movzx edi, word [0x140155f90]
test dl, dl
je 0x1400cbf30
movzx eax, dl
nop dword [rax]
cmp al, dil
je 0x1400cbf30
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1400cbf20
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400cbf84
movzx eax, byte [rcx]
test al, al
je 0x1400cbf52
sub al, 0x45
test al, 0xdf
je 0x1400cbf52
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1400cbf41
mov rdx, rcx
dec rcx
cmp byte [rcx], 0x30
jne 0x1400cbf68
nop dword [rax]
dec rcx
cmp byte [rcx], 0x30
je 0x1400cbf60
cmp byte [rcx], dil
jne 0x1400cbf70
dec rcx
movzx eax, byte [rdx]
lea rcx, [rcx + 1]
inc rdx
mov byte [rcx], al
test al, al
jne 0x1400cbf70
movzx edx, byte [rbp - 0x5f]
lea rax, [rbp - 0x5f]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], bl
jne 0x1400cbf90
mov edi, 1
cmp dl, 0x2d
jne 0x1400cbfad
mov r15d, edi
lea r14, [rbp - 0x5e]
dec r8d
movzx eax, byte [r14]
mov r9, r14
sub al, 0x30
cmp al, 0xa
jae 0x1400cbfce
nop word [rax + rax]
movzx eax, byte [r9 + 1]
inc r9
sub al, 0x30
cmp al, 0xa
jb 0x1400cbfc0
mov r10d, r9d
sub r10d, r14d
je 0x1400cbfec
lea ecx, [r10 + 2]
mov eax, 0xaaaaaaab
mul ecx
mov r11d, edx
shr r11d, 1
dec r11d
jmp 0x1400cbfef
mov r11d, ebx
lea eax, [r11 + r8]
mov ebx, r15d
add eax, eax
and ebx, 3
mov dword [rbp - 0x80], ebx
je 0x1400cc003
add eax, 2
mov ecx, dword [rsp + 0x50]
test cl, cl
jne 0x1400cc01f
add rax, r13
movzx ecx, cl
cmp qword [rbp + 0x6f8], rax
cmovb ecx, edi
mov byte [rsp + 0x50], cl
lea edi, [r10 + 2]
mov eax, 0xaaaaaaab
mul edi
mov ecx, r10d
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
cmp byte [rsp + 0x50], 0
jne 0x1400cc0a5
test r15b, 1
je 0x1400cc048
mov eax, 0x2d
jmp 0x1400cc053
test r15b, 2
je 0x1400cc05c
mov eax, 0x2b
mov word [r12], ax
add r12, 2
test r10d, r10d
je 0x1400cc0a5
mov ebx, 2
nop word [rax + rax]
movsx eax, byte [r14]
dec ecx
mov word [r12], ax
inc r14
mov eax, edi
add r12, rbx
dec edi
test eax, eax
jne 0x1400cc09e
test ecx, ecx
je 0x1400cc0a2
movzx eax, word [0x140155f18]
mov edi, ebx
mov word [r12], ax
add r12, rbx
test ecx, ecx
jne 0x1400cc070
mov ebx, dword [rbp - 0x80]
test ebx, ebx
je 0x1400cc0ad
add r13, 2
lea eax, [r11 + r10]
sub r8d, r10d
lea rbx, [rax*2]
add rbx, r13
cmp byte [rsp + 0x50], 0
jne 0x1400cc133
mov edi, r8d
mov rcx, r9
mov edx, edi
mov r8, r12
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
lea rcx, [rdi + rdi]
mov edx, esi
add rbx, rcx
lea r10, [0x140000000]
mov rax, rcx
add rdx, rdx
shr rax, 1
lea rcx, [rbx + 2]
add rcx, qword [r10 + rdx*8 + 0x155f20]
lea r12, [r12 + rax*2]
cmp qword [rbp + 0x6f8], rcx
jae 0x1400cc10f
mov byte [rsp + 0x50], 1
jmp 0x1400cc13a
mov eax, 0x20
lea rcx, [r12 + 2]
mov word [r12], ax
mov r8, qword [r10 + rdx*8 + 0x155f20]
mov rdx, qword [r10 + rdx*8 + 0x155f28]
call fcn.1400e3970
lea r10, [0x140000000]
mov eax, esi
add rax, rax
mov rcx, qword [r10 + rax*8 + 0x155f20]
lea rax, [rcx + 2]
shr rax, 1
lea r13, [rcx + 2]
add r13, rbx
lea r12, [r12 + rax*2]
mov r11, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov ecx, dword [r11]
mov r8, r13
sub r8, rdi
test ecx, 0xc0000000
je 0x1400cc202
movzx ebx, word [r11 + 6]
add rbx, rbx
cmp r8, rbx
jae 0x1400cc202
sub rbx, r8
cmp byte [rsp + 0x50], 0
jne 0x1400cc1f5
lea rax, [rbx + r13]
cmp qword [rbp + 0x6f8], rax
jae 0x1400cc1a3
mov byte [rsp + 0x50], 1
jmp 0x1400cc1f5
test cl, cl
jns 0x1400cc1ae
movzx r14d, word [r11 + 8]
jmp 0x1400cc1b4
mov r14d, 0x20
test ecx, ecx
jns 0x1400cc1c5
mov rcx, rbx
shr rcx, 1
je 0x1400cc1f5
mov rdi, r12
jmp 0x1400cc1ee
mov rax, r8
mov rdi, r12
shr rax, 1
mov rsi, rbx
add rax, rax
shr rsi, 1
sub rdi, rax
mov rdx, rdi
lea rcx, [rdi + rsi*2]
call fcn.1400e3970
test rsi, rsi
je 0x1400cc1f5
mov rcx, rsi
movzx eax, r14w
rep stosw word [rdi], ax
mov rax, rbx
shr rax, 1
add r13, rbx
lea r12, [r12 + rax*2]
mov r14d, dword [rbp + 0x6e8]
lea r10, [0x140000000]
mov ebx, dword [rsp + 0x50]
mov esi, 0
mov rax, qword [rbp + 0x6e0]
lea edx, [rsi + 2]
lea r8d, [rsi + 1]
test r14d, r14d
jne 0x1400cb550
mov r15, qword [rbp + 0x6f0]
movaps xmm8, xmmword [rsp + 0x760]
movaps xmm7, xmmword [rsp + 0x770]
movaps xmm6, xmmword [rsp + 0x780]
mov r14, qword [rsp + 0x7a0]
mov rdi, qword [rsp + 0x7b0]
mov rcx, qword [rbp + 0x6f8]
test bl, bl
jne 0x1400cc276
lea rax, [r13 + 2]
cmp rcx, rax
jae 0x1400cc2c0
mov bl, 1
test r15, r15
je 0x1400cc284
test rcx, rcx
je 0x1400cc284
mov word [r15], si
mov rdx, qword [rbp + 0x700]
mov r15, qword [rsp + 0x798]
mov r12, qword [rsp + 0x7a8]
mov rsi, qword [rsp + 0x7b8]
test rdx, rdx
je 0x1400cc2af
lea rcx, [r13 + 2]
mov qword [rdx], rcx
test bl, bl
sete al
add rsp, 0x7c0
pop r13
pop rbx
pop rbp
ret
mov word [r12], si
jmp 0x1400cc284