Function at 0x140178b60
Capabilities:
Get geographical location

Disassembly:
mov r11, rsp
push rbp
push rsi
push r13
push r14
lea rbp, [r11 - 0x3f8]
sub rsp, 0x4d8
mov rax, qword [0x1402b5020]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov r14, qword [rbp + 0x420]
mov r10, r9
mov qword [r11 + 0x10], rbx
mov rax, rcx
mov qword [r11 - 0x28], rdi
mov ebx, edx
mov qword [r11 - 0x38], r15
mov rdi, r8
mov r15, r8
mov qword [rsp + 0x78], r8
xor r8d, r8d
mov qword [rsp + 0x38], r9
test r15, r15
mov qword [rsp + 0x60], rcx
mov qword [rbp - 0x80], r14
mov r13d, r8d
sete sil
test byte [0x1402bc100], 1
jne 0x140178ca6
lock bts qword [0x1402bc100], 0x1f
jb 0x140178c82
lea r9d, [r8 + 4]
mov ecx, 0x400
lea r8, [rbp - 0x78]
lea edx, [r13 + 0xe]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
nop dword [rax]
test eax, eax
je 0x140178c1b
mov rax, qword [rbp - 0x78]
test ax, ax
je 0x140178c1b
cmp word [rbp - 0x76], r13w
jne 0x140178c1b
mov word [0x1402b64a8], ax
mov r9d, 4
lea r8, [rbp - 0x78]
mov ecx, 0x400
lea edx, [r9 + 0xb]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x140178c53
mov rax, qword ds:[rbp - 0x78]
test ax, ax
je 0x140178c53
cmp word [rbp - 0x76], r13w
jne 0x140178c53
mov word [0x1402b75d4], ax
cmp word [0x1402b64a8], 0x2e
je 0x140178c72
lea rdx, [0x140231658]
xor ecx, ecx
call fcn.1401ecd88
mov qword [0x1402c3450], rax
lea rcx, [0x1402bc100]
call sym.SystemInformer.exe_PhfSetEvent
nop
jmp 0x140178c99
test byte [0x1402bc100], 1
jne 0x140178ca6
xor edx, edx
lea rcx, [0x1402bc100]
call sym.SystemInformer.exe_PhfWaitForEvent
mov rax, qword [rsp + 0x60]
xor r8d, r8d
mov r10, qword [rsp + 0x38]
test ebx, ebx
je 0x140179b49
mov qword [rsp + 0x4c8], r12
lea rcx, [0x140000000]
movaps xmmword [rsp + 0x4b0], xmm6
mov r11d, 1
movsd xmm6, qword [0x140288b30]
movaps xmmword [rsp + 0x4a0], xmm7
movsd xmm7, qword [0x140288ad8]
mov byte [rsp + 0x30], sil
jmp 0x140178cf8
mov r10, qword [rsp + 0x38]
xor r8d, r8d
mov rdx, rax
mov qword [rsp + 0x40], rax
mov rdi, rax
mov r9, rax
add rax, 0x20
dec ebx
mov qword [rsp + 0x60], rax
mov r14d, r8d
mov r12d, dword [rdx]
mov eax, r12d
and eax, 0x3f
mov dword [rsp + 0x68], ebx
mov rbx, r13
mov qword [rbp - 0x78], rbx
cmp eax, 0xc
ja case.default.0x140178d44
cdqe
mov ecx, dword [rcx + rax*4 + 0x179bc0]
lea rax, [0x140000000]
add rcx, rax
jmp rcx
test sil, sil
jne 0x140178d6f
lea rax, [r13 + 2]
cmp r10, rax
jae 0x140178d66
add r15, 2
mov byte [rsp + 0x30], 1
add r13, 2
jmp case.default.0x140178d44
movzx eax, word [r9 + 0x10]
mov word [r15], ax
add r15, 2
add r13, 2
jmp case.default.0x140178d44
nop dword [rax]
test sil, sil
jne 0x140178db8
mov r8, qword [r9 + 0x10]
lea rax, [r8 + r13]
cmp r10, rax
jae 0x140178da9
mov rax, r8
mov byte [rsp + 0x30], 1
shr rax, 1
add r13, r8
lea r15, [r15 + rax*2]
jmp case.default.0x140178d44
mov rdx, qword [r9 + 0x18]
mov rcx, r15
call fcn.1401e3aa0
mov r9, rdi
mov rax, qword [r9 + 0x10]
shr rax, 1
add r13, qword [r9 + 0x10]
lea r15, [r15 + rax*2]
jmp case.default.0x140178d44
mov r9, qword ds:[r9 + 0x10]
xorps xmm1, xmm1
mov rdx, r9
mov ecx, r9d
and rdx, 0xfffffffffffffff1
and ecx, 0xf
je 0x140178e02
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
je 0x140178dfe
mov edx, ecx
shr rdx, 1
jmp 0x140178e43
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
jne 0x140178e35
nop dword [rax]
nop word [rax + rax]
add rdx, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
je 0x140178e20
sub rdx, r9
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
lea rdi, [rdx + rdx]
test sil, sil
jne 0x140178e6a
lea rax, [rdi + r13]
cmp r10, rax
jae 0x140178e5c
mov byte [rsp + 0x30], 1
jmp 0x140178e6a
mov r8, rdi
mov rdx, r9
mov rcx, r15
call fcn.1401e3aa0
mov r9, qword ds:[rsp + 0x40]
mov rax, rdi
shr rax, 1
add r13, rdi
lea r15, [r15 + rax*2]
jmp case.default.0x140178d44
cmp r12d, 3
jne 0x140178e95
mov rbx, qword [r9 + 0x18]
mov rdi, qword [rdx + 0x10]
jmp 0x140178ea9
mov rbx, qword [rdx + 0x10]
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], 0
jne 0x140178ea0
mov r8d, edi
lea rcx, [rsp + 0x48]
mov rdx, rbx
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeSize]
nop word [rax + rax]
test eax, eax
js 0x1401796f7
test sil, sil
mov rsi, qword [rsp + 0x38]
jne 0x140178f0e
mov ecx, dword [rsp + 0x48]
lea rax, [rcx + r13]
cmp rsi, rax
jae 0x140178ee6
mov byte [rsp + 0x30], 1
jmp 0x140178f12
lfence
mov edx, dword [rsp + 0x48]
mov r9, rbx
xor r8d, r8d
mov dword [rsp + 0x20], edi
mov rcx, r15
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
test eax, eax
js 0x1401796fc
mov ecx, dword [rsp + 0x48]
mov r9, qword [rsp + 0x40]
mov rax, rcx
mov rbx, qword [rbp - 0x78]
shr rax, 1
add r13, rcx
lea r15, [r15 + rax*2]
jmp 0x1401795cf
mov eax, dword [r9 + 0x10]
mov r14d, eax
mov r8d, eax
shr r14d, 0x1f
neg r8d
test eax, eax
cmovns r8d, eax
jmp 0x140178f4a
mov r8d, dword [r9 + 0x10]
mov r11d, 0xa
bt r12d, 8
jae 0x140178f67
movzx ecx, byte ds:[r9 + 0xa]
lea eax, [rcx - 2]
cmp al, 0x43
ja 0x140178f67
mov r11d, ecx
bt r12d, 0x1d
lea r10, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
lea rax, [0x140283520]
cmovae r10, rax
lea r9, [rbp + 0x38e]
xor esi, esi
mov ebx, esi
test r8d, r8d
je 0x140179022
bt r12d, 0x10
jae 0x140179000
mov edi, esi
nop dword [rax + rax]
xor edx, edx
mov eax, r8d
div r11d
inc ebx
inc edi
mov r8d, eax
movsx ecx, byte [rdx + r10]
mov word [r9], cx
sub r9, 2
cmp edi, 3
jne 0x140178fdc
test eax, eax
je 0x140178fe4
movzx eax, word [0x1402b75d4]
mov word [r9], ax
sub r9, 2
inc ebx
jmp 0x140178f99
nop dword [rax]
test eax, eax
jne 0x140178fa0
mov eax, 1
lea edi, [rax + 0x2f]
test r14d, r14d
je 0x14017903e
mov esi, eax
jmp 0x140179046
xor edx, edx
mov eax, r8d
div r11d
inc ebx
mov r8d, eax
movsx ecx, byte [rdx + r10]
mov word [r9], cx
sub r9, 2
test eax, eax
jne 0x140179000
nop
jmp 0x140178fe4
mov edi, 0x30
lea r9, [rbp + 0x38c]
mov eax, 1
mov word [rbp + 0x38e], di
mov ebx, eax
jmp 0x140178fec
bt r12d, 0x11
cmovb esi, eax
mov eax, r12d
and eax, 0x50000
cmp eax, 0x40000
jne 0x140179077
mov rax, qword [rsp + 0x40]
movzx ecx, word [rax + 6]
lea eax, [rsi + rbx]
cmp eax, ecx
jae 0x140179077
mov edx, ecx
or r14d, 4
sub edx, esi
sub edx, ebx
mov dword [rsp + 0x4c], edx
add esi, edx
jmp 0x14017907b
mov edx, dword [rsp + 0x4c]
cmp byte [rsp + 0x30], 0
jne 0x1401790ff
lea eax, [rsi + rbx]
lea rax, [rax*2]
add rax, r13
cmp qword [rsp + 0x38], rax
jae 0x1401790ae
mov r9, qword [rsp + 0x40]
lea eax, [rsi + rbx]
lea r13, [r13 + rax*2]
mov byte [rsp + 0x30], 1
jmp 0x1401795c6
test r14b, 1
je 0x1401790bc
mov word [r15], 0x2d
jmp 0x1401790c9
bt r12d, 0x11
jae 0x1401790cd
mov word [r15], 0x2b
add r15, 2
test r14b, 4
je 0x1401790e8
test rdx, rdx
je 0x1401790e4
movzx eax, di
mov rcx, rdx
mov rdi, r15
rep stosw word [rdi], ax
lea r15, [r15 + rdx*2]
mov edi, ebx
lea rdx, [r9 + 2]
add rdi, rdi
mov rcx, r15
mov r8, rdi
call fcn.1401e3aa0
add r15, rdi
mov r9, qword [rsp + 0x40]
lea eax, [rsi + rbx]
lea r13, [r13 + rax*2]
jmp 0x1401795c6
mov rax, qword [rdi + 0x10]
mov r14, rax
cqo
mov r8, rax
shr r14, 0x3f
xor r8, rdx
sub r8, rdx
jmp 0x14017912d
mov r8, qword [r9 + 0x10]
mov edx, 0xa
bt r12d, 8
jae 0x140179147
movzx ecx, byte [r9 + 0xa]
lea eax, [rcx - 2]
cmp al, 0x43
ja 0x140179147
mov edx, ecx
bt r12d, 0x1d
lea r10, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
lea rax, [0x140283520]
cmovae r10, rax
lea r9, [rbp + 0x38e]
xor esi, esi
mov ebx, esi
test r8, r8
je 0x140179207
mov r11d, edx
bt r12d, 0x10
jae 0x1401791e0
mov edi, esi
nop
xor edx, edx
mov rax, r8
div r11
inc ebx
inc edi
mov r8, rax
mov eax, edx
movsx ecx, byte [rax + r10]
mov word [r9], cx
sub r9, 2
cmp edi, 3
jne 0x1401791bd
test r8, r8
je 0x1401791c5
movzx eax, word [0x1402b75d4]
mov word [r9], ax
sub r9, 2
inc ebx
jmp 0x14017917c
nop dword [rax]
test r8, r8
jne 0x140179180
mov edi, 0x30
lea r11d, [rdi - 0x2f]
test r14d, r14d
je 0x14017921f
mov esi, r11d
jmp 0x140179228
xor edx, edx
mov rax, r8
div r11
inc ebx
mov r8, rax
mov eax, edx
movsx ecx, byte [rax + r10]
mov word [r9], cx
sub r9, 2
test r8, r8
jne 0x1401791e0
jmp 0x1401791c5
mov edi, 0x30
lea r9, [rbp + 0x38c]
mov word [rbp + 0x38e], di
mov ebx, r11d
jmp 0x1401791ce
bt r12d, 0x11
cmovb esi, r11d
mov eax, r12d
and eax, 0x50000
cmp eax, 0x40000
jne 0x140179259
mov rax, qword [rsp + 0x40]
movzx ecx, word [rax + 6]
lea eax, [rsi + rbx]
cmp eax, ecx
jae 0x140179259
mov edx, ecx
or r14d, 4
sub edx, esi
sub edx, ebx
mov dword [rsp + 0x50], edx
add esi, edx
jmp 0x14017925d
mov edx, dword [rsp + 0x50]
cmp byte [rsp + 0x30], 0
jne 0x1401790ff
lea eax, [rsi + rbx]
lea rax, [rax*2]
add rax, r13
cmp qword [rsp + 0x38], rax
jae 0x140179294
mov r9, qword [rsp + 0x40]
lea eax, [rsi + rbx]
lea r13, [r13 + rax*2]
mov byte [rsp + 0x30], 1
jmp 0x1401795c6
test r14b, 1
je 0x1401792a2
mov word [r15], 0x2d
jmp 0x1401792af
bt r12d, 0x11
jae 0x1401792b3
mov word [r15], 0x2b
add r15, 2
test r14b, 4
je 0x1401792ce
test rdx, rdx
je 0x1401792ca
movzx eax, di
mov rcx, rdx
mov rdi, r15
rep stosw word [rdi], ax
lea r15, [r15 + rdx*2]
mov edi, ebx
lea rdx, [r9 + 2]
add rdi, rdi
mov rcx, r15
mov r8, rdi
call fcn.1401e3aa0
mov r9, qword [rsp + 0x40]
lea eax, [rsi + rbx]
add r15, rdi
lea r13, [r13 + rax*2]
jmp 0x1401795c6
nop word [rax + rax]
test r12b, 0x40
je 0x14017931a
movzx r8d, word [r9 + 4]
mov eax, 0xa2
cmp r8d, eax
jbe 0x140179320
mov r8d, eax
jmp 0x140179320
mov r8d, 6
movsd xmm0, qword [rdi + 0x10]
lea r9, [rbp - 0x6f]
mov edx, r12d
lea rbx, [rbp - 0x6f]
mov r14, rdi
call fcn.1401cdb80
test al, al
jne 0x140179342
mov byte ds:[rbp - 0x6f], al
jmp 0x140179397
mov rdx, qword [0x1402c3450]
test rdx, rdx
je 0x14017937a
movzx eax, byte [rbp - 0x6f]
test al, al
je 0x14017937a
lea rcx, [rbp - 0x6f]
nop word [rax + rax]
cmp al, 0x2e
je 0x140179371
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140179360
jmp 0x14017937a
movzx eax, byte [0x1402b64a8]
mov byte [rcx], al
bt r12d, 0x1d
jae 0x140179397
lea rcx, [rbp - 0x6f]
test rdx, rdx
je 0x140179392
call fcn.1401ec3b0
jmp 0x140179397
call fcn.1401ec350
mov r9d, dword ds:[r14]
bt r9d, 0xf
jae 0x140179444
movzx ecx, byte [rbp - 0x6f]
lea rax, [rbp - 0x6f]
movzx r8d, byte [0x1402b64a8]
test cl, cl
je 0x1401793d6
movzx edx, cl
nop dword [rax]
movzx ecx, dl
cmp dl, r8b
je 0x1401793d6
movzx ecx, byte [rax + 1]
inc rax
movzx edx, cl
test cl, cl
jne 0x1401793c0
inc rax
test cl, cl
je 0x140179444
movzx ecx, byte [rax]
test cl, cl
je 0x1401793f7
sub cl, 0x45
test cl, 0xdf
je 0x1401793f7
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
jne 0x1401793e4
movzx edi, byte [rax - 1]
mov rdx, rax
dec rax
cmp dil, 0x30
jne 0x14017941d
nop word [rax + rax]
movzx edi, byte [rax - 1]
dec rax
cmp dil, 0x30
je 0x140179410
cmp dil, r8b
lea rcx, [rax - 1]
cmovne rcx, rax
nop dword [rax + rax]
movzx eax, byte ds:[rdx]
lea rcx, [rcx + 1]
mov byte [rcx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140179430
lea rax, [rbp - 0x6f]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140179450
cmp byte [rbp - 0x6f], 0x2d
mov edx, 2
jne 0x140179473
dec r8d
lea esi, [rdx - 1]
xor ecx, ecx
lea rbx, [rbp - 0x6e]
jmp 0x140179482
mov ecx, 0
bt r9d, 0x11
mov esi, ecx
cmovb esi, edx
mov eax, r9d
and eax, 0x13000
cmp eax, 0x10000
jne 0x140179625
movzx eax, byte ds:[rbx]
mov r9, rbx
sub al, 0x30
cmp al, 0xa
jae 0x1401794be
mov qword [rsp + 0x58], rbx
nop dword [rax]
movzx eax, byte [r9 + 1]
inc r9
sub al, 0x30
cmp al, 0xa
jb 0x1401794b0
mov r10d, r9d
sub r10d, ebx
je 0x1401794dc
lea edi, [r10 + 2]
mov eax, 0xaaaaaaab
mul edi
mov r11d, edx
shr r11d, 1
dec r11d
jmp 0x1401794e1
mov r11d, ecx
mov edi, edx
movzx r12d, byte [rsp + 0x30]
lea ecx, [r11 + r8]
add ecx, ecx
test r12b, r12b
jne 0x140179514
test esi, esi
lea eax, [rcx + 2]
cmove eax, ecx
add rax, r13
cmp qword [rsp + 0x38], rax
jae 0x140179514
mov r12b, 1
mov byte [rsp + 0x30], r12b
jmp 0x140179591
mov eax, 0xaaaaaaab
mov ecx, r10d
mul edi
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
test r12b, r12b
jne 0x140179591
test sil, 1
je 0x140179538
mov word [r15], 0x2d
jmp 0x140179544
test sil, 2
je 0x140179548
mov word [r15], 0x2b
add r15, 2
test r10d, r10d
je 0x140179591
nop dword [rax]
movsx eax, byte [rbx]
dec ecx
mov word [r15], ax
inc rbx
mov eax, edi
add r15, 2
dec edi
test eax, eax
jne 0x14017958d
test ecx, ecx
je 0x140179591
movzx eax, word [0x1402b75d4]
dec ecx
mov word [r15], ax
mov edi, 1
movsx eax, byte [rbx]
mov word [r15 + 2], ax
add r15, 4
inc rbx
test ecx, ecx
jne 0x140179550
test esi, esi
je 0x140179599
add r13, 2
lea eax, [r11 + r10]
lea r13, [r13 + rax*2]
test r12b, r12b
jne 0x1401795c3
sub r8d, r10d
mov rcx, r9
mov edi, r8d
mov r8, r15
mov edx, edi
call sym.SystemInformer.exe_PhZeroExtendToUtf16Buffer
lea r15, [r15 + rdi*2]
lea r13, [r13 + rdi*2]
mov r9, r14
mov rbx, qword [rbp - 0x78]
mov rsi, qword [rsp + 0x38]
mov ecx, dword ds:[r9]
mov r8, r13
sub r8, rbx
test ecx, 0xc0000000
je 0x140179b04
movzx ebx, word [r9 + 6]
add rbx, rbx
cmp r8, rbx
jae 0x140179b04
sub rbx, r8
cmp byte [rsp + 0x30], 0
jne 0x140179af7
lea rax, [rbx + r13]
cmp rsi, rax
jae 0x140179a9f
mov byte ds:[rsp + 0x30], 1
jmp 0x140179af7
test esi, esi
setne cl
mov rdx, rcx
bt r9d, 0x12
jae 0x14017965b
movzx r9d, word [r14 + 6]
mov edi, r8d
lea rax, [rcx + rdi]
cmp rax, r9
jae 0x14017965b
mov edx, r9d
or esi, 4
sub rdx, rdi
mov r9, rdx
sub r9, rcx
mov qword [rsp + 0x70], r9
jmp 0x140179660
mov r9, qword [rsp + 0x70]
movzx r12d, byte [rsp + 0x30]
test r12b, r12b
jne 0x1401796e5
mov eax, r8d
add rax, rdx
lea rax, [rax*2]
add rax, r13
cmp qword [rsp + 0x38], rax
jae 0x140179696
mov byte [rsp + 0x30], 1
lea r13, [r13 + rdx*2]
jmp 0x1401795c3
test sil, 1
je 0x1401796a4
mov word [r15], 0x2d
jmp 0x1401796b0
test sil, 2
je 0x1401796b4
mov word [r15], 0x2b
add r15, 2
test sil, 4
je 0x1401796e5
test r9, r9
je 0x1401796d0
mov eax, 0x30
mov rdi, r15
movzx eax, ax
mov rcx, r9
rep stosw word [rdi], ax
lea r15, ds:[r15 + r9*2]
mov rcx, rbx
lea r13, [r13 + rdx*2]
jmp 0x1401795ad
lea r13, [r13 + rdx*2]
test r12b, r12b
jne 0x1401796f7
mov rcx, rbx
jmp 0x1401795ad
mov rsi, qword [rsp + 0x38]
mov r9, qword [rsp + 0x40]
mov rbx, qword [rbp - 0x78]
jmp 0x1401795cf
mov rdx, qword [r9 + 0x10]
mov esi, r8d
xorps xmm0, xmm0
test rdx, rdx
js 0x140179722
cvtsi2sd xmm0, rdx
jmp 0x14017973a
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2sd xmm0, rcx
addsd xmm0, xmm0
test rdx, rdx
jne 0x140179778
nop
cmp byte [rsp + 0x30], dl
jne 0x14017976b
lea rax, [r13 + 2]
cmp r10, rax
jae 0x140179765
add r15, 2
mov byte [rsp + 0x30], 1
add r13, 2
jmp case.default.0x140178d44
mov word [r15], 0x30
add r15, 2
add r13, 2
jmp case.default.0x140178d44
bt r12d, 8
jae 0x140179786
movzx eax, byte [r9 + 0xa]
jmp 0x14017978c
mov eax, dword [0x1402bcf8c]
comisd xmm0, xmm6
jb 0x1401797a7
cmp esi, 7
jae 0x1401797a7
cmp esi, eax
jae 0x1401797a7
mulsd xmm0, xmm7
inc esi
comisd xmm0, xmm6
jae 0x140179792
test r12b, 0x40
mov r12d, 2
je 0x1401797ba
movzx eax, word [r9 + 4]
jmp 0x1401797bd
mov eax, r12d
movzx r8d, ax
lea r9, [rbp - 0x6f]
mov eax, 0xa2
lea rbx, [rbp - 0x6f]
cmp r8d, eax
mov edx, 0x1804b
cmova r8d, eax
call fcn.1401cdb80
movzx r8d, word [0x1402b64a8]
test al, al
jne 0x1401797f4
xor dil, dil
mov byte [rbp - 0x6f], dil
jmp 0x140179829
cmp qword [0x1402c3450], 0
movzx edi, byte [rbp - 0x6f]
je 0x140179829
test dil, dil
je 0x140179829
lea rcx, [rbp - 0x6f]
movzx eax, dil
nop
cmp al, 0x2e
je 0x140179822
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140179810
nop
jmp 0x140179829
mov byte [rcx], r8b
movzx edi, byte [rbp - 0x6f]
lea rax, [rbp - 0x6f]
movzx ecx, dil
test dil, dil
je 0x140179856
movzx edx, cl
nop dword [rax]
movzx ecx, dl
cmp dl, r8b
je 0x140179856
movzx ecx, byte [rax + 1]
inc rax
movzx edx, cl
test cl, cl
jne 0x140179840
inc rax
test cl, cl
je 0x1401798c8
movzx ecx, byte [rax]
test cl, cl
je 0x140179877
sub cl, 0x45
test cl, 0xdf
je 0x140179877
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
jne 0x140179864
movzx edi, byte [rax - 1]
mov rdx, rax
dec rax
cmp dil, 0x30
jne 0x14017989d
nop word [rax + rax]
movzx edi, byte [rax - 1]
dec rax
cmp dil, 0x30
je 0x140179890
cmp dil, r8b
lea rcx, [rax - 1]
cmovne rcx, rax
nop dword [rax + rax]
movzx eax, byte ds:[rdx]
lea rcx, [rcx + 1]
mov byte [rcx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1401798b0
movzx edi, byte [rbp - 0x6f]
lea rax, [rbp - 0x6f]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1401798d3
nop dword [rax]
cmp dil, 0x2d
jne 0x1401798f3
mov r14d, 1
lea rbx, [rbp - 0x6e]
dec r8d
movzx eax, byte [rbx]
mov r9, rbx
sub al, 0x30
cmp al, 0xa
jae 0x14017991e
mov qword [rsp + 0x58], rbx
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r9 + 1]
inc r9
sub al, 0x30
cmp al, 0xa
jb 0x140179910
mov r10d, r9d
sub r10d, ebx
je 0x14017993c
lea edi, [r10 + 2]
mov eax, 0xaaaaaaab
mul edi
mov r11d, edx
shr r11d, 1
dec r11d
jmp 0x140179942
xor r11d, r11d
mov edi, r12d
movzx r12d, byte [rsp + 0x30]
lea ecx, [r11 + r8]
add ecx, ecx
test r12b, r12b
jne 0x140179971
test r14d, r14d
lea eax, [rcx + 2]
cmove eax, ecx
add rax, r13
cmp qword [rsp + 0x38], rax
jae 0x140179971
mov r12b, 1
mov byte [rsp + 0x30], r12b
jmp 0x1401799e4
mov eax, 0xaaaaaaab
mov ecx, r10d
mul edi
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
test r12b, r12b
jne 0x1401799e4
test r14d, r14d
je 0x140179996
mov word [r15], 0x2d
add r15, 2
test r10d, r10d
je 0x1401799e4
nop dword [rax + rax]
movsx eax, byte [rbx]
dec ecx
mov word [r15], ax
inc rbx
mov eax, edi
add r15, 2
dec edi
test eax, eax
jne 0x1401799dd
test ecx, ecx
je 0x1401799e4
movzx eax, word [0x1402b75d4]
dec ecx
mov word [r15], ax
mov edi, 1
movsx eax, byte [rbx]
mov word [r15 + 2], ax
add r15, 4
inc rbx
nop dword [rax]
test ecx, ecx
jne 0x1401799a0
test r14d, r14d
je 0x1401799ed
add r13, 2
lea eax, ds:[r11 + r10]
lea rbx, [rax*2]
add rbx, r13
test r12b, r12b
jne 0x140179a6f
sub r8d, r10d
mov rcx, r9
mov edi, r8d
mov r8, r15
mov edx, edi
call sym.SystemInformer.exe_PhZeroExtendToUtf16Buffer
mov edx, esi
lea rbx, [rbx + rdi*2]
add rdx, rdx
lea r15, [r15 + rdi*2]
mov edi, esi
lea rcx, [rbx + 2]
lea rsi, [0x140000000]
add rcx, qword [rsi + rdx*8 + 0x2bc110]
cmp qword [rsp + 0x38], rcx
jae 0x140179a4e
mov byte [rsp + 0x30], 1
jmp 0x140179a78
mov word [r15], 0x20
lea rcx, [r15 + 2]
mov r8, qword [rsi + rdx*8 + 0x2bc110]
mov rdx, qword [rsi + rdx*8 + 0x2bc118]
call fcn.1401e3aa0
jmp 0x140179a78
mov edi, esi
lea rsi, [0x140000000]
mov r9, qword [rsp + 0x40]
lea r13, [rbx + 2]
add rdi, rdi
mov rcx, qword [rsi + rdi*8 + 0x2bc110]
lea rax, [rcx + 2]
shr rax, 1
add r13, rcx
lea r15, [r15 + rax*2]
jmp 0x1401795c6
nop
test cl, cl
jns 0x140179aab
movzx r14d, word [r9 + 8]
jmp 0x140179ab1
mov r14d, 0x20
mov rsi, rbx
shr rsi, 1
test ecx, ecx
jns 0x140179aca
nop dword [rax + rax]
test rsi, rsi
je 0x140179af7
mov rdi, r15
jmp 0x140179aed
lfence
mov rax, r8
mov rdi, r15
shr rax, 1
add rax, rax
sub rdi, rax
mov rdx, rdi
lea rcx, [rdi + rsi*2]
call fcn.1401e3aa0
test rsi, rsi
je 0x140179af7
mov rcx, rsi
movzx eax, r14w
rep stosw word [rdi], ax
mov rax, rbx
shr rax, 1
add r13, rbx
lea r15, [r15 + rax*2]
mov ebx, dword ds:[rsp + 0x68]
lea rcx, [0x140000000]
movzx esi, byte [rsp + 0x30]
mov r11d, 1
mov rax, qword [rsp + 0x60]
test ebx, ebx
jne 0x140178cf0
movaps xmm7, xmmword [rsp + 0x4a0]
movaps xmm6, xmmword [rsp + 0x4b0]
mov r12, qword [rsp + 0x4c8]
mov rdi, qword [rsp + 0x78]
mov r14, qword [rbp - 0x80]
mov rbx, qword [rsp + 0x508]
mov rcx, qword [rsp + 0x38]
test sil, sil
jne 0x140179b68
lea rax, ds:[r13 + 2]
cmp rcx, rax
jae 0x140179bb6
mov sil, 1
test rdi, rdi
je 0x140179b77
test rcx, rcx
je 0x140179b77
xor eax, eax
mov word [rdi], ax
mov r15, qword [rsp + 0x4c0]
mov rdi, qword [rsp + 0x4d0]
test r14, r14
je 0x140179b93
lea rax, [r13 + 2]
mov qword [r14], rax
test sil, sil
sete al
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.1401dd6a0
add rsp, 0x4d8
pop r14
pop r13
pop rsi
pop rbp
ret
xor eax, eax
mov word [r15], ax
jmp 0x140179b77