Function at 0x14012bb00
Capabilities:
Get geographical location

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x3c8]
sub rsp, 0x4c8
mov rax, qword [0x140237008]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov esi, 0x1e
mov edi, edx
mov rdx, qword [0x1402418e8]
cmp r8, rsi
mov rbx, rcx
cmovae rsi, r8
mov qword [rsp + 0x48], rsi
lea rcx, [rsi + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov r8, rax
mov qword [rsp + 0x40], r9
mov r15d, r9d
mov qword [rax], rsi
add rax, 0x10
mov qword [r8 + 8], rax
mov word [rsi + rax], r9w
test byte [0x14023e830], 1
mov r14, qword [r8 + 8]
jne 0x14012bc5a
lock bts qword [0x14023e830], 0x1f
jb 0x14012bc3b
lea r9d, [r15 + 4]
mov ecx, 0x400
lea r8, [rbp - 0x78]
lea edx, [r15 + 0xe]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14012bbd1
mov rax, qword [rbp - 0x78]
test ax, ax
je 0x14012bbd1
movzx edx, word [0x14023e638]
cmp word [rbp - 0x76], r15w
cmove dx, ax
mov word [0x14023e638], dx
mov r9d, 4
lea r8, [rbp - 0x78]
mov ecx, 0x400
lea edx, [r9 + 0xb]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14012bc0e
mov rax, qword [rbp - 0x78]
test ax, ax
je 0x14012bc0e
movzx edx, word [0x14023e8b0]
cmp word [rbp - 0x76], r15w
cmove dx, ax
mov word [0x14023e8b0], dx
cmp word [0x14023e638], 0x2e
je 0x14012bc2d
lea rdx, [0x1401b790c]
xor ecx, ecx
call fcn.140191588
mov qword [0x140244e00], rax
lea rcx, [0x14023e830]
call sym.ProcessHacker.exe_PhfSetEvent
jmp 0x14012bc52
test byte [0x14023e830], 1
jne 0x14012bc5a
xor edx, edx
lea rcx, [0x14023e830]
call sym.ProcessHacker.exe_PhfWaitForEvent
mov r8, qword [rsp + 0x30]
xor r9d, r9d
nop word [rax + rax]
test edi, edi
je 0x14012cf4d
mov qword [rsp + 0x508], r12
lea r10, [0x140000000]
mov qword [rsp + 0x4c0], r13
mov r8d, 2
movaps xmmword [rsp + 0x4b0], xmm6
movsd xmm6, qword [0x140211988]
movaps xmmword [rsp + 0x4a0], xmm7
movsd xmm7, qword [0x140211930]
jmp 0x14012bcb3
xor r9d, r9d
mov r11, rbx
mov qword [rsp + 0x50], rbx
dec edi
mov qword [rsp + 0x78], r15
mov rdx, rbx
mov dword [rsp + 0x6c], edi
add rbx, 0x20
mov r12d, r9d
mov r13d, dword [r11]
mov eax, r13d
and eax, 0x3f
mov qword [rbp - 0x80], rbx
cmp eax, 0xc
ja case.default.0x14012bcf6
cdqe
mov ecx, dword [r10 + rax*4 + 0x12cf84]
add rcx, r10
jmp rcx
lea rbx, ds:[r15 + 2]
cmp rsi, rbx
jae 0x14012bd7f
mov rdx, qword [0x1402418e8]
lea rax, [rsi + rsi]
cmp rax, rbx
mov rsi, rbx
cmovae rsi, rax
mov qword [rsp + 0x48], rsi
lea rcx, [rsi + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rdi, rax
mov r8, r15
lea rcx, [rax + 0x10]
mov qword [rax], rsi
mov qword [rax + 8], rcx
xor eax, eax
mov word [rsi + rcx], ax
mov rsi, qword [rsp + 0x30]
mov rcx, qword [rdi + 8]
mov rdx, qword [rsi + 8]
call fcn.140188690
lea rcx, ds:[rsi - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14012bd6a
call fcn.1400fbcc0
mov rax, qword [rdi + 8]
mov r11, qword [rsp + 0x50]
shr r15, 1
mov qword [rsp + 0x30], rdi
lea r14, [rax + r15*2]
movzx eax, word [r11 + 0x10]
mov r15, rbx
mov word [r14], ax
add r14, 2
mov qword [rsp + 0x40], rbx
jmp case.default.0x14012bcf6
mov r8, qword [r11 + 0x10]
lea rcx, [r8 + r15]
cmp rsi, rcx
jae 0x14012be2a
mov rdx, qword [0x1402418e8]
lea rax, [rsi + rsi]
cmp rax, rcx
mov rbx, rcx
cmovae rbx, rax
mov qword [rsp + 0x48], rbx
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rdi, rax
mov r8, r15
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
xor eax, eax
mov word [rbx + rcx], ax
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rdi + 8]
mov rdx, qword [rbx + 8]
call fcn.140188690
lea rcx, [rbx - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14012be0e
call fcn.1400fbcc0
mov rax, qword [rdi + 8]
mov rcx, r15
mov r11, qword [rsp + 0x50]
shr rcx, 1
mov qword [rsp + 0x30], rdi
mov r8, qword [r11 + 0x10]
lea r14, [rax + rcx*2]
mov rdx, qword [r11 + 0x18]
mov rcx, r14
call fcn.140188690
mov r11, qword [rsp + 0x50]
mov rax, qword [r11 + 0x10]
shr rax, 1
add r15, qword [r11 + 0x10]
lea r14, [r14 + rax*2]
jmp 0x14012cdc4
mov rcx, qword [r11 + 0x10]
call sym.ProcessHacker.exe_PhCountStringZ
mov rdx, qword [rsp + 0x48]
lea rdi, [rax + rax]
lea rsi, [rdi + r15]
cmp rdx, rsi
jae 0x14012bee2
lfence
lea rax, [rdx + rdx]
mov r14, rsi
mov rdx, qword [0x1402418e8]
cmp rax, rsi
cmovae r14, rax
mov qword [rsp + 0x48], r14
lea rcx, [r14 + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov r13, qword [rsp + 0x30]
mov rbx, rax
mov r8, r15
lea rcx, [rax + 0x10]
mov qword [rax], r14
mov qword [rax + 8], rcx
xor eax, eax
mov word [r14 + rcx], ax
mov rdx, qword [r13 + 8]
mov rcx, qword [rbx + 8]
call fcn.140188690
lea rcx, [r13 - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14012bed2
call fcn.1400fbcc0
mov rax, qword [rbx + 8]
shr r15, 1
mov qword [rsp + 0x30], rbx
lea r14, [rax + r15*2]
mov r10, qword [rsp + 0x50]
mov r8, rdi
mov rcx, r14
mov rdx, qword [r10 + 0x10]
call fcn.140188690
shr rdi, 1
mov r15, rsi
mov qword [rsp + 0x40], rsi
lea r14, [r14 + rdi*2]
mov r11, qword [rsp + 0x50]
jmp case.default.0x14012bcf6
cmp r13d, 3
jne 0x14012bf1f
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x10]
jmp 0x14012bf39
mov rbx, qword [r11 + 0x10]
mov rdi, 0xffffffffffffffff
nop word [rax + rax]
inc rdi
cmp byte [rbx + rdi], 0
jne 0x14012bf30
mov r8d, edi
lea rcx, [rsp + 0x60]
mov rdx, rbx
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeSize]
test eax, eax
js 0x14012bf05
lfence
mov edx, dword [rsp + 0x60]
lea rcx, [r15 + rdx]
cmp rsi, rcx
jae 0x14012bfe5
mov rdx, qword [0x1402418e8]
lea rax, [rsi + rsi]
cmp rax, rcx
mov r14, rcx
cmovae r14, rax
mov qword [rsp + 0x48], r14
lea rcx, [r14 + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov r13, qword [rsp + 0x30]
mov rsi, rax
mov r8, r15
lea rcx, [rax + 0x10]
mov qword [rax], r14
mov qword [rax + 8], rcx
xor eax, eax
mov word [r14 + rcx], ax
mov rdx, qword [r13 + 8]
mov rcx, qword [rsi + 8]
call fcn.140188690
lea rcx, [r13 - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14012bfce
call fcn.1400fbcc0
mov rax, qword [rsi + 8]
mov rcx, r15
mov edx, dword [rsp + 0x60]
shr rcx, 1
mov qword [rsp + 0x30], rsi
lea r14, [rax + rcx*2]
mov r9, rbx
mov dword [rsp + 0x20], edi
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
nop dword [rax + rax]
test eax, eax
js 0x14012bf05
mov ecx, dword [rsp + 0x60]
mov eax, ecx
shr rax, 1
add r15, rcx
lea r14, [r14 + rax*2]
jmp 0x14012cdbf
mov eax, dword [r11 + 0x10]
mov r12d, eax
mov edi, eax
shr r12d, 0x1f
neg edi
test eax, eax
cmovns edi, eax
jmp 0x14012c037
mov edi, dword [r11 + 0x10]
mov r10d, 0xa
bt r13d, 8
jae 0x14012c053
movzx ecx, byte [r11 + 0xa]
lea eax, [rcx - 2]
cmp al, 0x43
ja 0x14012c053
mov r10d, ecx
bt r13d, 0x1d
lea rax, str.0123456789abcdefghijklmnopqrstuvwxyz_________._:_________
lea r9, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
cmovae r9, rax
lea rbx, [rbp + 0x38e]
xor eax, eax
mov esi, eax
test edi, edi
je 0x14012c0fe
bt r13d, 0x10
jae 0x14012c0d3
mov r8d, eax
nop word [rax + rax]
xor edx, edx
mov eax, edi
div r10d
inc esi
inc r8d
mov edi, eax
movsx ecx, byte [rdx + r9]
mov word [rbx], cx
sub rbx, 2
cmp r8d, 3
jne 0x14012c0cb
test eax, eax
je 0x14012c0ee
movzx eax, word [0x14023e8b0]
inc esi
mov word [rbx], ax
sub rbx, 2
xor eax, eax
mov r8d, eax
jmp 0x14012c0cd
xor eax, eax
test edi, edi
jne 0x14012c090
jmp 0x14012c0f0
xor edx, edx
mov eax, edi
div r10d
inc esi
mov edi, eax
movsx ecx, byte [rdx + r9]
mov word [rbx], cx
sub rbx, 2
test eax, eax
jne 0x14012c0d3
xor eax, eax
mov edx, 1
test r12d, r12d
je 0x14012c11a
mov ecx, edx
jmp 0x14012c124
mov ecx, 0x30
lea rbx, [rbp + 0x38c]
mov edx, 1
mov word [rbp + 0x38e], cx
mov esi, edx
jmp 0x14012c0f5
bt r13d, 0x11
mov ecx, eax
cmovb ecx, edx
and r13d, 0x50000
cmp r13d, 0x40000
jne 0x14012c154
movzx edx, word ds:[r11 + 6]
lea eax, [rcx + rsi]
cmp eax, edx
jae 0x14012c154
mov eax, edx
or r12d, 4
sub eax, ecx
sub eax, esi
mov dword [rsp + 0x64], eax
add ecx, eax
mov rdx, qword [rsp + 0x48]
lea eax, [rcx + rsi]
lea r15, [r15 + rax*2]
cmp rdx, r15
jae 0x14012c1eb
lfence
lea rax, [rdx + rdx]
mov r14, r15
mov rdx, qword [0x1402418e8]
cmp rax, r15
cmovae r14, rax
mov qword [rsp + 0x48], r14
lea rcx, [r14 + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov r13, qword [rsp + 0x30]
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], r14
mov qword [rax + 8], rcx
xor eax, eax
mov word [r14 + rcx], ax
mov r14, qword [rsp + 0x40]
mov rdx, qword [r13 + 8]
mov r8, r14
mov rcx, qword [rdi + 8]
call fcn.140188690
lea rcx, [r13 - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14012c1d6
call fcn.1400fbcc0
mov rax, qword [rdi + 8]
mov r11, qword [rsp + 0x50]
shr r14, 1
mov qword [rsp + 0x30], rdi
lea r14, [rax + r14*2]
test r12b, 1
je 0x14012c1f8
mov eax, 0x2d
jmp 0x14012c207
test dword ds:[r11], 0x20000
je 0x14012c20f
mov eax, 0x2b
mov word [r14], ax
add r14, 2
test r12b, 4
je 0x14012c233
mov edx, dword [rsp + 0x64]
test rdx, rdx
je 0x14012c22f
mov eax, 0x30
mov rdi, r14
movzx eax, ax
mov rcx, rdx
rep stosw word [rdi], ax
lea r14, [r14 + rdx*2]
mov edi, esi
lea rdx, [rbx + 2]
add rdi, rdi
mov rcx, r14
mov r8, rdi
call fcn.140188690
add r14, rdi
jmp 0x14012cdbf
mov rax, qword [rdx + 0x10]
mov r12, rax
cqo
mov rdi, rax
shr r12, 0x3f
xor rdi, rdx
sub rdi, rdx
jmp 0x14012c26b
mov rdi, qword [r11 + 0x10]
mov r9d, 0xa
bt r13d, 8
jae 0x14012c28b
movzx eax, byte ds:[r11 + 0xa]
cmp al, 2
jb 0x14012c28b
cmp al, 0x45
ja 0x14012c28b
mov r9d, eax
bt r13d, 0x1d
lea rax, str.0123456789abcdefghijklmnopqrstuvwxyz_________._:_________
lea r10, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
cmovae r10, rax
lea rbx, [rbp + 0x38e]
xor eax, eax
mov esi, eax
test rdi, rdi
je 0x14012c342
bt r13d, 0x10
jae 0x14012c310
mov r8d, eax
xor edx, edx
mov rax, rdi
div r9
inc esi
inc r8d
mov rdi, rax
mov eax, edx
movsx ecx, byte [rax + r10]
mov word [rbx], cx
sub rbx, 2
cmp r8d, 3
jne 0x14012c302
test rdi, rdi
je 0x14012c330
movzx eax, word [0x14023e8b0]
inc esi
mov word [rbx], ax
sub rbx, 2
xor eax, eax
mov r8d, eax
jmp 0x14012c304
xor eax, eax
test rdi, rdi
jne 0x14012c2c0
jmp 0x14012c332
xor edx, edx
mov rax, rdi
div r9
inc esi
mov rdi, rax
mov eax, edx
movsx ecx, byte [rax + r10]
mov word [rbx], cx
sub rbx, 2
test rdi, rdi
jne 0x14012c310
xor eax, eax
mov edx, 1
test r12d, r12d
je 0x14012c35e
mov ecx, edx
jmp 0x14012c368
mov ecx, 0x30
lea rbx, [rbp + 0x38c]
mov edx, 1
mov word [rbp + 0x38e], cx
mov esi, edx
jmp 0x14012c337
bt r13d, 0x11
mov ecx, eax
cmovb ecx, edx
and r13d, 0x50000
cmp r13d, 0x40000
jne 0x14012c394
movzx edx, word [r11 + 6]
lea eax, [rcx + rsi]
cmp eax, edx
jae 0x14012c394
mov eax, edx
or r12d, 4
sub eax, ecx
sub eax, esi
mov dword [rsp + 0x68], eax
add ecx, eax
mov rdx, qword [rsp + 0x48]
lea eax, [rcx + rsi]
lea r15, [r15 + rax*2]
cmp rdx, r15
jae 0x14012c42b
lfence
lea rax, [rdx + rdx]
mov r14, r15
mov rdx, qword [0x1402418e8]
cmp rax, r15
cmovae r14, rax
mov qword [rsp + 0x48], r14
lea rcx, [r14 + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov r13, qword [rsp + 0x30]
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], r14
mov qword [rax + 8], rcx
xor eax, eax
mov word [r14 + rcx], ax
mov r14, qword [rsp + 0x40]
mov rdx, qword [r13 + 8]
mov r8, r14
mov rcx, qword [rdi + 8]
call fcn.140188690
lea rcx, [r13 - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14012c416
call fcn.1400fbcc0
mov rax, qword [rdi + 8]
mov r11, qword [rsp + 0x50]
shr r14, 1
mov qword [rsp + 0x30], rdi
lea r14, [rax + r14*2]
test r12b, 1
je 0x14012c438
mov eax, 0x2d
jmp 0x14012c447
test dword ds:[r11], 0x20000
je 0x14012c44f
mov eax, 0x2b
mov word [r14], ax
add r14, 2
test r12b, 4
je 0x14012c233
mov edx, dword ds:[rsp + 0x68]
jmp 0x14012c219
test r13b, 0x40
je 0x14012c47f
movzx r8d, word [r11 + 4]
mov eax, 0xa2
cmp r8d, eax
jbe 0x14012c485
mov r8d, eax
jmp 0x14012c485
mov r8d, 6
movsd xmm0, qword ds:[r11 + 0x10]
lea rcx, [rbp - 0x6f]
lea r9, [rbp - 0x6f]
mov qword [rsp + 0x58], rcx
mov edx, r13d
call fcn.140175aa0
test al, al
jne 0x14012c4ae
mov byte [rbp - 0x6f], al
jmp 0x14012c4fc
mov rdx, qword [0x140244e00]
test rdx, rdx
je 0x14012c4e0
movzx eax, byte [rbp - 0x6f]
lea rcx, [rbp - 0x6f]
test al, al
je 0x14012c4e0
cmp al, 0x2e
je 0x14012c4d7
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x14012c4c6
jmp 0x14012c4e0
movzx eax, byte [0x14023e638]
mov byte [rcx], al
bt r13d, 0x1d
jae 0x14012c4fc
lea rcx, [rbp - 0x6f]
test rdx, rdx
je 0x14012c4f7
call fcn.140190bbc
jmp 0x14012c4fc
call fcn.140190b5c
mov r10, qword [rsp + 0x50]
mov r9d, dword [r10]
bt r9d, 0xf
jae 0x14012c591
movzx eax, byte ds:[rbp - 0x6f]
lea rcx, [rbp - 0x6f]
movzx r8d, byte [0x14023e638]
test al, al
je 0x14012c534
cmp al, r8b
je 0x14012c534
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x14012c524
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x14012c591
movzx eax, byte [rcx]
test al, al
je 0x14012c556
sub al, 0x45
test al, 0xdf
je 0x14012c556
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x14012c545
movzx eax, byte [rcx - 1]
mov rdi, rcx
dec rcx
cmp al, 0x30
jne 0x14012c56f
movzx eax, byte [rcx - 1]
dec rcx
cmp al, 0x30
je 0x14012c564
cmp al, r8b
lea rdx, [rcx - 1]
cmovne rdx, rcx
nop word [rax + rax]
movzx eax, byte [rdi]
lea rdx, [rdx + 1]
mov byte [rdx], al
lea rdi, [rdi + 1]
test al, al
jne 0x14012c580
lea rax, [rbp - 0x6f]
mov rsi, 0xffffffffffffffff
nop dword [rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x14012c5a0
cmp byte [rbp - 0x6f], 0x2d
jne 0x14012c5c4
lea r8, [rbp - 0x6e]
dec esi
mov qword [rsp + 0x58], r8
xor ecx, ecx
mov r13d, 1
jmp 0x14012c5df
mov r8, qword [rsp + 0x58]
mov ecx, 0
bt r9d, 0x11
mov r13d, ecx
mov eax, 2
cmovb r13d, eax
mov eax, r9d
and eax, 0x13000
cmp eax, 0x10000
jne 0x14012c7a5
movzx eax, byte [r8]
mov rbx, r8
sub al, 0x30
cmp al, 0xa
jae 0x14012c60d
nop
movzx eax, byte [rbx + 1]
inc rbx
sub al, 0x30
cmp al, 0xa
jb 0x14012c600
mov r15d, ebx
sub r15d, r8d
mov dword [rsp + 0x38], r15d
je 0x14012c630
lea ecx, [r15 + 2]
mov eax, 0xaaaaaaab
mul ecx
mov r12d, edx
shr r12d, 1
dec r12d
jmp 0x14012c633
mov r12d, ecx
mov r9, qword [rsp + 0x40]
lea eax, [r12 + rsi]
mov rdx, qword [rsp + 0x48]
lea ecx, [rax + rax]
lea eax, [rcx + 2]
test r13d, r13d
cmove eax, ecx
mov ecx, eax
add rcx, r9
cmp rdx, rcx
jae 0x14012c6e7
lfence
lea rax, [rdx + rdx]
mov r14, rcx
mov rdx, qword [0x1402418e8]
cmp rax, rcx
cmovae r14, rax
mov qword [rsp + 0x48], r14
lea rcx, [r14 + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov r8, qword [rsp + 0x40]
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], r14
mov qword [rax + 8], rcx
xor eax, eax
mov word [r14 + rcx], ax
mov r14, qword [rsp + 0x30]
mov rcx, qword [rdi + 8]
mov rdx, qword [r14 + 8]
call fcn.140188690
lea rcx, ds:[r14 - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14012c6ca
call fcn.1400fbcc0
mov r9, qword [rsp + 0x40]
mov rax, qword [rdi + 8]
mov rcx, r9
mov r8, qword [rsp + 0x58]
shr rcx, 1
mov qword [rsp + 0x30], rdi
lea r14, [rax + rcx*2]
lea edi, ds:[r15 + 2]
mov eax, 0xaaaaaaab
mul edi
mov ecx, r15d
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
test r13b, 1
je 0x14012c70d
mov eax, 0x2d
jmp 0x14012c718
test r13b, 2
je 0x14012c720
mov eax, 0x2b
mov word [r14], ax
add r14, 2
test r15d, r15d
je 0x14012c769
mov r15d, 2
nop dword [rax + rax]
movsx eax, byte [r8]
lea r8, [r8 + 1]
mov word [r14], ax
dec ecx
mov eax, edi
add r14, r15
dec edi
test eax, eax
jne 0x14012c75e
test ecx, ecx
je 0x14012c764
movzx eax, word [0x14023e8b0]
mov edi, r15d
mov word [r14], ax
add r14, r15
nop
test ecx, ecx
jne 0x14012c730
mov r15d, dword [rsp + 0x38]
test r13d, r13d
je 0x14012c777
add r9, 2
mov qword [rsp + 0x40], r9
sub esi, r15d
mov r8, r14
mov edx, esi
mov rcx, rbx
mov edi, esi
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
lea ecx, ds:[r12 + r15]
mov r15, qword [rsp + 0x40]
add rcx, rdi
lea r14, [r14 + rsi*2]
lea r15, [r15 + rcx*2]
jmp 0x14012cdbf
test r13d, r13d
mov rdx, rcx
setne dl
mov rcx, rdx
bt r9d, 0x12
jae 0x14012c7df
movzx r8d, word [r10 + 6]
mov edi, esi
lea rax, [rdi + rdx]
cmp rax, r8
jae 0x14012c7df
mov ecx, r8d
or r13d, 4
sub rcx, rdi
mov r12, rcx
sub r12, rdx
mov qword [rsp + 0x70], r12
jmp 0x14012c7e4
mov r12, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x48]
mov ebx, esi
lea rax, [rbx + rcx]
lea rsi, [r15 + rax*2]
cmp rdx, rsi
jae 0x14012c875
lfence
lea rax, [rdx + rdx]
mov r14, rsi
mov rdx, qword [0x1402418e8]
cmp rax, rsi
cmovae r14, rax
mov qword [rsp + 0x48], r14
lea rcx, [r14 + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rdi, rax
mov r8, r15
lea rcx, [rax + 0x10]
mov qword [rax], r14
mov qword [rax + 8], rcx
xor eax, eax
mov word [rcx + r14], ax
mov r14, qword [rsp + 0x30]
mov rcx, qword [rdi + 8]
mov rdx, qword [r14 + 8]
call fcn.140188690
lea rcx, [r14 - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14012c865
nop dword [rax + rax]
call fcn.1400fbcc0
mov rax, qword [rdi + 8]
shr r15, 1
mov qword [rsp + 0x30], rdi
lea r14, [rax + r15*2]
test r13b, 1
je 0x14012c882
mov eax, 0x2d
jmp 0x14012c88d
test r13b, 2
je 0x14012c895
mov eax, 0x2b
mov word [r14], ax
add r14, 2
test r13b, 4
je 0x14012c8ba
nop dword [rax + rax]
test r12, r12
je 0x14012c8b6
mov eax, 0x30
mov rdi, r14
movzx eax, ax
mov rcx, r12
rep stosw word [rdi], ax
lea r14, [r14 + r12*2]
mov rcx, qword [rsp + 0x58]
mov r8, r14
mov rdx, rbx
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
mov r11, qword ds:[rsp + 0x50]
lea r14, [r14 + rbx*2]
mov r15, rsi
mov qword [rsp + 0x40], rsi
jmp case.default.0x14012bcf6
mov rdx, qword [r11 + 0x10]
mov r15d, r9d
xorps xmm0, xmm0
test rdx, rdx
js 0x14012c8fb
cvtsi2sd xmm0, rdx
jmp 0x14012c913
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2sd xmm0, rcx
addsd xmm0, xmm0
test rdx, rdx
jne 0x14012c9cc
mov rsi, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
lea rbx, [rsi + 2]
cmp rdx, rbx
jae 0x14012c9b2
lea rax, [rdx + rdx]
mov r14, rbx
mov rdx, qword [0x1402418e8]
cmp rax, rbx
cmovae r14, rax
mov qword [rsp + 0x48], r14
lea rcx, [r14 + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rdi, rax
mov r8, rsi
lea rcx, [rax + 0x10]
mov qword [rax], r14
mov qword [rax + 8], rcx
xor eax, eax
mov word [rcx + r14], ax
mov r14, qword [rsp + 0x30]
mov rcx, qword [rdi + 8]
mov rdx, qword [r14 + 8]
call fcn.140188690
lea rcx, [r14 - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14012c99d
call fcn.1400fbcc0
mov rax, qword [rdi + 8]
mov r11, qword [rsp + 0x50]
shr rsi, 1
mov qword [rsp + 0x30], rdi
lea r14, [rax + rsi*2]
mov eax, 0x30
mov qword [rsp + 0x40], rbx
mov word [r14], ax
mov r15, rbx
add r14, 2
jmp case.default.0x14012bcf6
bt r13d, 8
jae 0x14012c9da
movzx eax, byte [r11 + 0xa]
jmp 0x14012c9e0
mov eax, dword [0x14023f728]
comisd xmm0, xmm6
jb 0x14012c9fe
cmp r15d, 7
jae 0x14012c9fe
cmp r15d, eax
jae 0x14012c9fe
mulsd xmm0, xmm7
inc r15d
comisd xmm0, xmm6
jae 0x14012c9e6
nop
test r13b, 0x40
je 0x14012ca0d
movzx eax, word [r11 + 4]
jmp 0x14012ca10
mov eax, r8d
movzx r8d, ax
mov edi, r9d
mov eax, 0xa2
mov dword [rsp + 0x38], r9d
cmp r8d, eax
lea r9, [rbp - 0x6f]
mov edx, 0x1804b
cmova r8d, eax
lea rax, [rbp - 0x6f]
mov qword [rsp + 0x58], rax
call fcn.140175aa0
movzx r8d, word [0x14023e638]
test al, al
jne 0x14012ca52
xor dl, dl
mov byte [rbp - 0x6f], dl
jmp 0x14012ca89
cmp qword [0x140244e00], 0
movzx edx, byte ds:[rbp - 0x6f]
je 0x14012ca89
lea rcx, [rbp - 0x6f]
test dl, dl
je 0x14012ca89
movzx eax, dl
nop dword [rax]
cmp al, 0x2e
je 0x14012ca82
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x14012ca70
nop
jmp 0x14012ca89
mov byte [rcx], r8b
movzx edx, byte [rbp - 0x6f]
lea rcx, [rbp - 0x6f]
test dl, dl
je 0x14012caa4
movzx eax, dl
cmp al, r8b
je 0x14012caa4
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x14012ca94
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x14012cb0b
movzx eax, byte [rcx]
test al, al
je 0x14012cac6
sub al, 0x45
test al, 0xdf
je 0x14012cac6
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x14012cab5
movzx eax, byte [rcx - 1]
mov rdi, rcx
dec rcx
cmp al, 0x30
jne 0x14012cadf
movzx eax, byte [rcx - 1]
dec rcx
cmp al, 0x30
je 0x14012cad4
cmp al, r8b
lea rdx, [rcx - 1]
cmovne rdx, rcx
nop word [rax + rax]
movzx eax, byte ds:[rdi]
lea rdx, [rdx + 1]
mov byte [rdx], al
lea rdi, [rdi + 1]
test al, al
jne 0x14012caf0
movzx edx, byte [rbp - 0x6f]
mov edi, r12d
lea rax, [rbp - 0x6f]
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [rax + rsi], 0
jne 0x14012cb16
nop
cmp dl, 0x2d
jne 0x14012cb3d
mov eax, 1
lea r8, [rbp - 0x6e]
mov edi, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x58], r8
dec esi
jmp 0x14012cb42
mov r8, qword [rsp + 0x58]
movzx eax, byte [r8]
mov rbx, r8
sub al, 0x30
cmp al, 0xa
jae 0x14012cb5d
nop
movzx eax, byte [rbx + 1]
inc rbx
sub al, 0x30
cmp al, 0xa
jb 0x14012cb50
mov r13d, ebx
sub r13d, r8d
je 0x14012cb7b
lea ecx, [r13 + 2]
mov eax, 0xaaaaaaab
mul ecx
mov r12d, edx
shr r12d, 1
dec r12d
jmp 0x14012cb80
xor eax, eax
mov r12d, eax
mov r9, qword ds:[rsp + 0x40]
lea eax, [r12 + rsi]
lea ecx, [rax + rax]
test edi, edi
lea eax, [rcx + 2]
cmove eax, ecx
mov ecx, eax
mov rax, qword [rsp + 0x48]
add rcx, r9
cmp rax, rcx
jae 0x14012cc2f
lfence
mov rdx, qword [0x1402418e8]
add rax, rax
cmp rax, rcx
mov r14, rcx
cmovae r14, rax
mov qword [rsp + 0x48], r14
lea rcx, [r14 + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov r8, qword [rsp + 0x40]
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], r14
mov qword [rax + 8], rcx
xor eax, eax
mov word [rcx + r14], ax
mov r14, qword [rsp + 0x30]
mov rcx, qword [rdi + 8]
mov rdx, qword [r14 + 8]
call fcn.140188690
lea rcx, [r14 - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14012cc12
call fcn.1400fbcc0
mov r9, qword [rsp + 0x40]
mov rax, qword [rdi + 8]
mov rcx, r9
mov r8, qword [rsp + 0x58]
shr rcx, 1
mov qword [rsp + 0x30], rdi
lea r14, [rax + rcx*2]
lea edi, [r13 + 2]
mov eax, 0xaaaaaaab
mul edi
mov ecx, r13d
shr edx, 1
lea eax, [rdx + rdx*2]
mov edx, dword [rsp + 0x38]
sub edi, eax
test edx, edx
je 0x14012cc59
mov eax, 0x2d
mov word [r14], ax
add r14, 2
test r13d, r13d
je 0x14012cca8
mov edx, 2
nop dword [rax]
nop word [rax + rax]
movsx eax, byte [r8]
lea r8, [r8 + 1]
mov word [r14], ax
dec ecx
mov eax, edi
add r14, rdx
dec edi
test eax, eax
jne 0x14012cc9d
test ecx, ecx
je 0x14012cca4
movzx eax, word [0x14023e8b0]
mov edi, edx
mov word [r14], ax
add r14, rdx
nop dword [rax]
test ecx, ecx
jne 0x14012cc70
mov edx, dword [rsp + 0x38]
test edx, edx
je 0x14012ccb5
add r9, 2
mov qword [rsp + 0x40], r9
sub esi, r13d
mov r8, r14
mov edx, esi
mov rcx, rbx
mov edi, esi
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
mov rax, qword ds:[rsp + 0x40]
lea rbx, [r14 + rsi*2]
mov rdx, qword [rsp + 0x48]
lea ecx, [r12 + r13]
add rcx, rdi
mov r14d, r15d
add r14, r14
lea r15, [0x140000000]
lea rsi, [rax + rcx*2]
mov rcx, qword [r15 + r14*8 + 0x23e840]
lea rax, [rsi + 2]
add rax, rcx
cmp rdx, rax
jae 0x14012cd83
lfence
lea rax, [rdx + rdx]
mov rdx, qword [0x1402418e8]
lea rbx, [rcx + 2]
add rbx, rsi
cmp rax, rbx
cmovae rbx, rax
mov qword [rsp + 0x48], rbx
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rdi, rax
mov r8, rsi
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
xor eax, eax
mov word [rcx + rbx], ax
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rdi + 8]
mov rdx, qword [rbx + 8]
call fcn.140188690
lea rcx, [rbx - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14012cd70
call fcn.1400fbcc0
mov rax, qword [rdi + 8]
mov rcx, rsi
shr rcx, 1
mov qword [rsp + 0x30], rdi
lea rbx, [rax + rcx*2]
mov eax, 0x20
lea rcx, [rbx + 2]
mov word [rbx], ax
mov r8, qword [r15 + r14*8 + 0x23e840]
mov rdx, qword [r15 + r14*8 + 0x23e848]
call fcn.140188690
mov rcx, qword [r15 + r14*8 + 0x23e840]
lea rax, [rcx + 2]
shr rax, 1
lea r15, [rcx + 2]
add r15, rsi
lea r14, [rbx + rax*2]
mov r11, qword [rsp + 0x50]
mov qword [rsp + 0x40], r15
mov eax, dword [r11]
mov rdi, r15
sub rdi, qword [rsp + 0x78]
test eax, 0xc0000000
je 0x14012cf02
movzx ebx, word [r11 + 6]
add rbx, rbx
cmp rdi, rbx
jae 0x14012cf02
mov r12, qword ds:[rsp + 0x48]
sub rbx, rdi
lea r13, [rbx + r15]
cmp r12, r13
jae 0x14012ce8a
lfence
mov rdx, qword [0x1402418e8]
lea rax, [r12 + r12]
cmp rax, r13
mov r12, r13
cmovae r12, rax
mov qword [rsp + 0x48], r12
lea rcx, [r12 + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov r14, qword [rsp + 0x30]
mov rsi, rax
mov r8, r15
lea rcx, [rax + 0x10]
mov qword [rax], r12
mov qword [rax + 8], rcx
xor eax, eax
mov word [rcx + r12], ax
mov rdx, qword [r14 + 8]
mov rcx, qword [rsi + 8]
call fcn.140188690
lea rcx, [r14 - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14012ce72
call fcn.1400fbcc0
mov rax, qword [rsi + 8]
mov r11, qword [rsp + 0x50]
shr r15, 1
mov qword [rsp + 0x30], rsi
lea r14, [rax + r15*2]
mov eax, dword [r11]
test al, al
jns 0x14012ce95
movzx r12d, word [r11 + 8]
jmp 0x14012ce9b
mov r12d, 0x20
shr rbx, 1
test eax, eax
jns 0x14012cebc
test rbx, rbx
je 0x14012ceb6
movzx eax, r12w
mov rdi, r14
mov rcx, rbx
rep stosw word [rdi], ax
lea rsi, [rbx + rbx]
jmp 0x14012cef7
lfence
mov rax, rdi
lea rsi, [rbx + rbx]
shr rax, 1
mov r15, r14
add rax, rax
mov r8, rdi
sub r15, rax
mov rdx, r15
lea rcx, [rsi + r15]
call fcn.140188690
test rbx, rbx
je 0x14012cef7
movzx eax, r12w
mov rdi, r15
mov rcx, rbx
rep stosw word [rdi], ax
add r14, rsi
mov qword [rsp + 0x40], r13
mov r15, r13
mov edi, dword ds:[rsp + 0x6c]
lea r10, [0x140000000]
mov rsi, qword [rsp + 0x48]
mov r8d, 2
mov rbx, qword [rbp - 0x80]
test edi, edi
jne 0x14012bcb0
mov r8, qword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x4a0]
movaps xmm6, xmmword [rsp + 0x4b0]
mov r13, qword [rsp + 0x4c0]
mov r12, qword [rsp + 0x508]
mov rcx, qword [r8 + 8]
mov qword [r8], r15
shr r15, 1
xor eax, eax
mov word [rcx + r15*2], ax
mov rax, r8
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.1401848a0
add rsp, 0x4c8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret