Function at 0x7ff6cc7c9da0
Capabilities:
Get geographical location

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x6b0]
sub rsp, 0x7b0
mov rdi, qword [0x7ff6cc85e0c8]
mov eax, 0x1e
cmp r8, rax
mov r15, r8
mov ebx, edx
mov r14, rcx
cmovb r15, rax
mov rcx, rdi
mov qword [rsp + 0x58], r15
lea rdx, [r15 + 0x12]
call fcn.7ff6cc7ae820
lock inc dword [rdi + 4]
lea rdx, [rax + 0x10]
mov r10d, 1
mov dword [rax + 8], r10d
movzx ecx, byte [rdi + 2]
xor edi, edi
mov word [rax], cx
mov r13d, edi
lea rax, [rdx + 0x10]
mov qword [rdx], r15
mov qword [rdx + 8], rax
mov word [rax + r15], di
test byte [0x7ff6cc855f98], r10b
mov rsi, qword [rdx + 8]
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x68], rdi
jne 0x7ff6cc7c9f5f
lock bts qword [0x7ff6cc855f98], 0x1f
jae 0x7ff6cc7c9e5b
test byte [0x7ff6cc855f98], r10b
jne 0x7ff6cc7c9f5f
xor edx, edx
lea rcx, [0x7ff6cc855f98]
call sym.ProcessHacker.exe_PhfWaitForEvent
jmp 0x7ff6cc7c9f54
mov r9d, 4
lea r8, [rsp + 0x78]
mov ecx, 0x400
lea edx, [r9 + 0xa]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x7ff6cc7c9e9a
mov rax, qword [rsp + 0x78]
test ax, ax
je 0x7ff6cc7c9e9a
movzx edx, word [0x7ff6cc855f90]
cmp word [rsp + 0x7a], di
cmove dx, ax
mov word [0x7ff6cc855f90], dx
mov r9d, 4
lea r8, [rsp + 0x78]
mov ecx, 0x400
lea edx, [r9 + 0xb]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x7ff6cc7c9ed9
mov rax, qword [rsp + 0x78]
test ax, ax
je 0x7ff6cc7c9ed9
movzx ecx, word [0x7ff6cc855f18]
cmp word [rsp + 0x7a], di
cmove cx, ax
mov word [0x7ff6cc855f18], cx
cmp word [0x7ff6cc855f90], 0x2e
je 0x7ff6cc7c9ef8
lea rdx, [0x7ff6cc82e906]
xor ecx, ecx
call fcn.7ff6cc7eee88
mov qword [0x7ff6cc85bba8], rax
lock bts qword [0x7ff6cc855f98], 0
jb 0x7ff6cc7c9f54
mov rdi, qword [0x7ff6cc855fa0]
test rdi, rdi
je 0x7ff6cc7c9f1b
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtSetEvent]
mov rax, 0xfffffffffffffffe
lock xadd qword [0x7ff6cc855f98], rax
shr rax, 1
and eax, 0x7fff
cmp rax, 1
jne 0x7ff6cc7c9f52
test rdi, rdi
je 0x7ff6cc7c9f52
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
xor edi, edi
mov qword [0x7ff6cc855fa0], rdi
jmp 0x7ff6cc7c9f54
xor edi, edi
mov rdx, qword [rsp + 0x50]
mov r10d, 1
test ebx, ebx
je 0x7ff6cc7cb2fb
mov qword [rsp + 0x7a8], r12
lea r9, [0x7ff6cc700000]
movaps xmmword [rsp + 0x790], xmm6
mov edx, 2
movsd xmm6, qword [0x7ff6cc838558]
movaps xmmword [rsp + 0x780], xmm7
movsd xmm7, qword [0x7ff6cc838508]
movaps xmmword [rsp + 0x770], xmm8
movsd xmm8, qword [0x7ff6cc838598]
jmp 0x7ff6cc7c9fb2
xor edi, edi
mov r8, r14
mov qword [rsp + 0x60], r14
dec ebx
mov qword [rbp - 0x60], r13
add r14, 0x20
mov dword [rbp + 0x6f8], ebx
mov qword [rbp + 0x6f0], r14
mov r12d, edi
mov r11d, dword [r8]
mov eax, r11d
and eax, 0x3f
cmp eax, 0xc
ja case.default.0x7ff6cc7c9ff3
cdqe
mov ecx, dword [r9 + rax*4 + 0xcb324]
add rcx, r9
jmp rcx
lea rbx, [r13 + 2]
cmp r15, rbx
jae 0x7ff6cc7ca090
mov rdi, qword [0x7ff6cc85e0c8]
lea rax, [r15 + r15]
cmp rax, rbx
mov rsi, rax
mov rcx, rdi
cmovb rsi, rbx
mov qword [rsp + 0x58], rsi
lea rdx, [rsi + 0x12]
call fcn.7ff6cc7ae820
lock inc dword [rdi + 4]
mov ecx, 1
mov r8, r13
mov dword [rax + 8], ecx
movzx ecx, byte [rdi + 2]
lea rdi, [rax + 0x10]
mov word [rax], cx
lea rax, [rdi + 0x10]
mov qword [rdi + 8], rax
xor ecx, ecx
mov qword [rdi], rsi
mov word [rsi + rax], cx
mov rsi, qword [rsp + 0x50]
mov rcx, qword [rdi + 8]
mov rdx, qword [rsi + 8]
call fcn.7ff6cc7e3970
lea rcx, [rsi - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff6cc7ca07b
call fcn.7ff6cc7ae900
mov rax, qword [rdi + 8]
mov r8, qword [rsp + 0x60]
shr r13, 1
mov qword [rsp + 0x50], rdi
lea rsi, [rax + r13*2]
movzx eax, word [r8 + 0x10]
mov r13, rbx
mov word [rsi], ax
add rsi, 2
mov qword [rsp + 0x68], rbx
jmp case.default.0x7ff6cc7c9ff3
mov rcx, qword [r8 + 0x10]
lea rax, [rcx + r13]
cmp r15, rax
jae 0x7ff6cc7ca14c
mov rdi, qword [0x7ff6cc85e0c8]
lea rax, [rcx + r13]
add r15, r15
mov rcx, rdi
cmp r15, rax
cmovb r15, rax
mov qword [rsp + 0x58], r15
lea rdx, [r15 + 0x12]
call fcn.7ff6cc7ae820
lock inc dword [rdi + 4]
mov rsi, qword [rsp + 0x50]
mov ecx, 1
mov dword [rax + 8], ecx
mov r8, r13
movzx ecx, byte [rdi + 2]
lea rdi, [rax + 0x10]
mov word [rax], cx
lea rax, [rdi + 0x10]
mov qword [rdi + 8], rax
xor ecx, ecx
mov qword [rdi], r15
mov word [rax + r15], cx
mov rdx, qword [rsi + 8]
mov rcx, qword [rdi + 8]
call fcn.7ff6cc7e3970
lea rcx, [rsi - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff6cc7ca134
call fcn.7ff6cc7ae900
mov rax, qword [rdi + 8]
mov rcx, r13
mov r8, qword [rsp + 0x60]
shr rcx, 1
mov qword [rsp + 0x50], rdi
lea rsi, [rax + rcx*2]
mov r9, qword [rsp + 0x60]
mov rcx, rsi
mov r8, qword [r8 + 0x10]
mov rdx, qword [r9 + 0x18]
call fcn.7ff6cc7e3970
mov r8, qword [rsp + 0x60]
mov rax, qword [r8 + 0x10]
shr rax, 1
add r13, qword [r8 + 0x10]
lea rsi, [rsi + rax*2]
jmp 0x7ff6cc7cb181
mov rcx, qword [r8 + 0x10]
call sym.ProcessHacker.exe_PhCountStringZ
lea rbx, [rax + rax]
lea r14, [rbx + r13]
cmp r15, r14
jae 0x7ff6cc7ca21e
mov rdi, qword [0x7ff6cc85e0c8]
lea rax, [rbx + r13]
add r15, r15
mov rcx, rdi
cmp r15, rax
cmovb r15, rax
mov qword [rsp + 0x58], r15
lea rdx, [r15 + 0x12]
call fcn.7ff6cc7ae820
lock inc dword [rdi + 4]
mov rsi, qword [rsp + 0x50]
mov ecx, 1
mov dword [rax + 8], ecx
mov r8, r13
movzx ecx, byte [rdi + 2]
lea rdi, [rax + 0x10]
mov word [rax], cx
lea rax, [rdi + 0x10]
mov qword [rdi + 8], rax
xor ecx, ecx
mov qword [rdi], r15
mov word [r15 + rax], cx
mov rdx, qword [rsi + 8]
mov rcx, qword [rdi + 8]
call fcn.7ff6cc7e3970
lea rcx, [rsi - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff6cc7ca20e
call fcn.7ff6cc7ae900
mov rax, qword [rdi + 8]
shr r13, 1
mov qword [rsp + 0x50], rdi
lea rsi, [rax + r13*2]
mov r9, qword [rsp + 0x60]
mov r8, rbx
mov rcx, rsi
mov rdx, qword [r9 + 0x10]
call fcn.7ff6cc7e3970
shr rbx, 1
mov r13, r14
mov qword [rsp + 0x68], r14
lea rsi, [rsi + rbx*2]
mov r8, qword [rsp + 0x60]
jmp case.default.0x7ff6cc7c9ff3
cmp r11d, 3
jne 0x7ff6cc7ca25b
mov r14, qword [r8 + 0x18]
mov rbx, qword [r8 + 0x10]
jmp 0x7ff6cc7ca26d
mov r14, qword [r8 + 0x10]
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [r14 + rbx], 0
jne 0x7ff6cc7ca263
mov r8d, ebx
lea rcx, [rbp + 0x700]
mov rdx, r14
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeSize]
test eax, eax
js 0x7ff6cc7ca241
mov edx, dword [rbp + 0x700]
lea rax, [rdx + r13]
cmp r15, rax
jae 0x7ff6cc7ca32a
mov rdi, qword [0x7ff6cc85e0c8]
lea rax, [rdx + r13]
add r15, r15
mov rcx, rdi
cmp r15, rax
cmovb r15, rax
mov qword [rsp + 0x58], r15
lea rdx, [r15 + 0x12]
call fcn.7ff6cc7ae820
lock inc dword [rdi + 4]
mov rsi, qword [rsp + 0x50]
mov ecx, 1
mov dword [rax + 8], ecx
mov r8, r13
movzx ecx, byte [rdi + 2]
lea rdi, [rax + 0x10]
mov word [rax], cx
lea rax, [rdi + 0x10]
mov qword [rdi + 8], rax
xor ecx, ecx
mov qword [rdi], r15
mov word [r15 + rax], cx
mov rdx, qword [rsi + 8]
mov rcx, qword [rdi + 8]
call fcn.7ff6cc7e3970
lea rcx, [rsi - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff6cc7ca311
call fcn.7ff6cc7ae900
mov rax, qword [rdi + 8]
mov rcx, r13
mov edx, dword [rbp + 0x700]
shr rcx, 1
mov qword [rsp + 0x50], rdi
lea rsi, [rax + rcx*2]
mov r9, r14
mov dword [rsp + 0x20], ebx
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
test eax, eax
js 0x7ff6cc7ca241
mov ecx, dword [rbp + 0x700]
mov eax, ecx
shr rax, 1
add r13, rcx
lea rsi, [rsi + rax*2]
jmp 0x7ff6cc7cb17c
mov edi, dword [r8 + 0x10]
test edi, edi
jns 0x7ff6cc7ca36f
neg edi
mov r12d, r10d
jmp 0x7ff6cc7ca36f
mov edi, dword [r8 + 0x10]
mov r10d, 0xa
bt r11d, 8
jae 0x7ff6cc7ca38c
movzx ecx, byte [r8 + 0xa]
lea eax, [rcx - 2]
cmp al, 0x43
ja 0x7ff6cc7ca38c
movzx r10d, cl
mov eax, r11d
lea r9, [0x7ff6cc858710]
and eax, 0x20000000
lea rbx, [rbp + 0x3ae]
lea rax, [0x7ff6cc8586c0]
cmove r9, rax
xor r15d, r15d
mov r14d, r15d
test edi, edi
je 0x7ff6cc7ca430
bt r11d, 0x10
jae 0x7ff6cc7ca412
mov r8d, r15d
xor edx, edx
mov eax, edi
div r10d
inc r14d
inc r8d
mov edi, eax
movsx ecx, byte [rdx + r9]
mov word [rbx], cx
sub rbx, 2
cmp r8d, 3
jne 0x7ff6cc7ca3fa
test eax, eax
je 0x7ff6cc7ca3fe
movzx eax, word [0x7ff6cc855f18]
mov r8d, r15d
mov word [rbx], ax
sub rbx, 2
inc r14d
test edi, edi
jne 0x7ff6cc7ca3c1
mov r8, qword [rsp + 0x60]
mov edx, 1
test r12b, 1
je 0x7ff6cc7ca44d
mov ecx, edx
jmp 0x7ff6cc7ca45b
xor edx, edx
mov eax, edi
div r10d
inc r14d
mov edi, eax
movsx ecx, byte [rdx + r9]
mov word [rbx], cx
sub rbx, 2
test eax, eax
jne 0x7ff6cc7ca412
jmp 0x7ff6cc7ca403
mov eax, 0x30
lea rbx, [rbp + 0x3ac]
mov edx, 1
mov word [rbp + 0x3ae], ax
mov r14d, edx
jmp 0x7ff6cc7ca408
mov eax, r11d
mov ecx, r15d
and eax, 0x20000
cmovne ecx, edx
and r11d, 0x50000
cmp r11d, 0x40000
jne 0x7ff6cc7ca488
movzx edx, word [r8 + 6]
lea eax, [rcx + r14]
cmp eax, edx
jae 0x7ff6cc7ca488
mov eax, edx
or r12d, 4
sub eax, ecx
sub eax, r14d
mov dword [rbp - 0x80], eax
add ecx, eax
lea eax, [rcx + r14]
lea r15, [rax*2]
add r15, r13
cmp qword [rsp + 0x58], r15
jae 0x7ff6cc7ca537
mov rsi, qword [rsp + 0x58]
lea rax, [rax*2]
mov rdi, qword [0x7ff6cc85e0c8]
add rsi, rsi
add rax, r13
mov rcx, rdi
cmp rsi, rax
cmovb rsi, rax
mov qword [rsp + 0x58], rsi
lea rdx, [rsi + 0x12]
call fcn.7ff6cc7ae820
lock inc dword [rdi + 4]
mov ecx, 1
mov r8, r13
mov dword [rax + 8], ecx
movzx ecx, byte [rdi + 2]
lea rdi, [rax + 0x10]
mov word [rax], cx
lea rax, [rdi + 0x10]
mov qword [rdi + 8], rax
xor ecx, ecx
mov qword [rdi], rsi
mov word [rsi + rax], cx
mov rsi, qword [rsp + 0x50]
mov rcx, qword [rdi + 8]
mov rdx, qword [rsi + 8]
call fcn.7ff6cc7e3970
lea rcx, [rsi - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff6cc7ca527
call fcn.7ff6cc7ae900
mov rax, qword [rdi + 8]
shr r13, 1
mov qword [rsp + 0x50], rdi
lea rsi, [rax + r13*2]
test r12b, 1
je 0x7ff6cc7ca544
mov eax, 0x2d
jmp 0x7ff6cc7ca557
mov r9, qword [rsp + 0x60]
test dword [r9], 0x20000
je 0x7ff6cc7ca55e
mov eax, 0x2b
mov word [rsi], ax
add rsi, 2
test r12b, 4
je 0x7ff6cc7ca581
mov edx, dword [rbp - 0x80]
test rdx, rdx
je 0x7ff6cc7ca57d
mov eax, 0x30
mov rdi, rsi
movzx eax, ax
mov rcx, rdx
rep stosw word [rdi], ax
lea rsi, [rsi + rdx*2]
mov edi, r14d
lea rdx, [rbx + 2]
add rdi, rdi
mov rcx, rsi
mov r8, rdi
call fcn.7ff6cc7e3970
mov r8, qword [rsp + 0x60]
add rsi, rdi
mov r13, r15
mov qword [rsp + 0x68], r15
jmp case.default.0x7ff6cc7c9ff3
mov rdi, qword [r8 + 0x10]
test rdi, rdi
jns 0x7ff6cc7ca5c0
neg rdi
mov r12d, r10d
jmp 0x7ff6cc7ca5c0
mov rdi, qword [r8 + 0x10]
mov ecx, 0xa
bt r11d, 8
jae 0x7ff6cc7ca5db
movzx edx, byte [r8 + 0xa]
lea eax, [rdx - 2]
cmp al, 0x43
ja 0x7ff6cc7ca5db
movzx ecx, dl
mov eax, r11d
lea r9, [0x7ff6cc858710]
and eax, 0x20000000
lea rbx, [rbp + 0x3ae]
lea rax, [0x7ff6cc8586c0]
cmove r9, rax
xor r15d, r15d
mov r14d, r15d
test rdi, rdi
je 0x7ff6cc7ca6a3
bt r11d, 0x10
jae 0x7ff6cc7ca675
mov r8d, r15d
mov r10d, ecx
nop dword [rax + rax]
xor edx, edx
mov rax, rdi
div r10
inc r14d
inc r8d
mov rdi, rax
mov eax, edx
movsx ecx, byte [rax + r9]
mov word [rbx], cx
sub rbx, 2
cmp r8d, 3
jne 0x7ff6cc7ca65e
test rdi, rdi
je 0x7ff6cc7ca663
movzx eax, word [0x7ff6cc855f18]
mov r8d, r15d
mov word [rbx], ax
sub rbx, 2
inc r14d
test rdi, rdi
jne 0x7ff6cc7ca620
mov r8, qword [rsp + 0x60]
test r12b, 1
je 0x7ff6cc7ca6bb
mov ecx, 1
jmp 0x7ff6cc7ca6ce
mov r8d, ecx
nop dword [rax + rax]
xor edx, edx
mov rax, rdi
div r8
inc r14d
mov rdi, rax
mov eax, edx
movsx ecx, byte [rax + r9]
mov word [rbx], cx
sub rbx, 2
test rdi, rdi
jne 0x7ff6cc7ca680
jmp 0x7ff6cc7ca663
mov eax, 0x30
lea rbx, [rbp + 0x3ac]
mov word [rbp + 0x3ae], ax
mov r14d, r10d
jmp 0x7ff6cc7ca668
mov eax, r11d
mov ecx, r15d
and eax, 0x20000
mov eax, 1
cmovne ecx, eax
and r11d, 0x50000
cmp r11d, 0x40000
jne 0x7ff6cc7ca6fb
movzx edx, word [r8 + 6]
lea eax, [rcx + r14]
cmp eax, edx
jae 0x7ff6cc7ca6fb
mov eax, edx
or r12d, 4
sub eax, ecx
sub eax, r14d
mov dword [rbp - 0x7c], eax
add ecx, eax
lea eax, [rcx + r14]
lea r15, [rax*2]
add r15, r13
cmp qword [rsp + 0x58], r15
jae 0x7ff6cc7ca7aa
mov rsi, qword [rsp + 0x58]
lea rax, [rax*2]
mov rdi, qword [0x7ff6cc85e0c8]
add rsi, rsi
add rax, r13
mov rcx, rdi
cmp rsi, rax
cmovb rsi, rax
mov qword [rsp + 0x58], rsi
lea rdx, [rsi + 0x12]
call fcn.7ff6cc7ae820
lock inc dword [rdi + 4]
mov ecx, 1
mov r8, r13
mov dword [rax + 8], ecx
movzx ecx, byte [rdi + 2]
lea rdi, [rax + 0x10]
mov word [rax], cx
lea rax, [rdi + 0x10]
mov qword [rdi + 8], rax
xor ecx, ecx
mov qword [rdi], rsi
mov word [rsi + rax], cx
mov rsi, qword [rsp + 0x50]
mov rcx, qword [rdi + 8]
mov rdx, qword [rsi + 8]
call fcn.7ff6cc7e3970
lea rcx, [rsi - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff6cc7ca79a
call fcn.7ff6cc7ae900
mov rax, qword [rdi + 8]
shr r13, 1
mov qword [rsp + 0x50], rdi
lea rsi, [rax + r13*2]
test r12b, 1
je 0x7ff6cc7ca7b7
mov eax, 0x2d
jmp 0x7ff6cc7ca7ca
mov r9, qword [rsp + 0x60]
test dword [r9], 0x20000
je 0x7ff6cc7ca7d1
mov eax, 0x2b
mov word [rsi], ax
add rsi, 2
test r12b, 4
je 0x7ff6cc7ca581
mov edx, dword [rbp - 0x7c]
jmp 0x7ff6cc7ca567
test r11b, 0x40
je 0x7ff6cc7ca7fb
movzx edx, word [r8 + 4]
mov eax, 0xa2
cmp edx, eax
jbe 0x7ff6cc7ca800
mov edx, eax
jmp 0x7ff6cc7ca800
mov edx, 6
mov cl, 0x66
bt r11d, 0xc
jae 0x7ff6cc7ca80d
mov cl, 0x65
jmp 0x7ff6cc7ca820
mov eax, r11d
movzx ecx, cl
and eax, 0x2000
mov eax, 0x61
cmovne ecx, eax
movsd xmm0, qword [r8 + 0x10]
lea r12, [rbp - 0x4f]
shr r11d, 0x1d
and r11d, 1
movsd qword [rbp - 0x78], xmm0
movsx ecx, cl
test r11b, 1
je 0x7ff6cc7ca843
sub ecx, 0x20
mov rax, qword [0x7ff6cc85bba8]
lea r9, [rbp + 0x3b0]
mov qword [rsp + 0x40], rax
mov r8d, 0x3ff
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], edx
lea rdx, [rbp - 0x4f]
mov dword [rsp + 0x28], ecx
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x20], 0x15e
call fcn.7ff6cc7f0694
mov r9, qword [rsp + 0x60]
movzx edx, byte [rbp - 0x4f]
mov r8d, dword [r9]
bt r8d, 0xf
jae 0x7ff6cc7ca907
movzx edi, word [0x7ff6cc855f90]
lea rcx, [rbp - 0x4f]
test dl, dl
je 0x7ff6cc7ca8b4
movzx eax, dl
cmp al, dil
je 0x7ff6cc7ca8b4
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x7ff6cc7ca8a4
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x7ff6cc7ca905
movzx eax, byte [rcx]
test al, al
je 0x7ff6cc7ca8d6
sub al, 0x45
test al, 0xdf
je 0x7ff6cc7ca8d6
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x7ff6cc7ca8c5
mov rdx, rcx
dec rcx
cmp byte [rcx], 0x30
jne 0x7ff6cc7ca8e9
dec rcx
cmp byte [rcx], 0x30
je 0x7ff6cc7ca8e1
cmp byte [rcx], dil
jne 0x7ff6cc7ca8f1
dec rcx
movzx eax, byte [rdx]
lea rcx, [rcx + 1]
inc rdx
mov byte [rcx], al
test al, al
jne 0x7ff6cc7ca8f1
movzx edx, byte [rbp - 0x4f]
xor edi, edi
lea rax, [rbp - 0x4f]
or r14, 0xffffffffffffffff
nop
inc r14
cmp byte [rax + r14], 0
jne 0x7ff6cc7ca910
cmp dl, 0x2d
mov edx, 1
jne 0x7ff6cc7ca930
mov r15d, edx
lea r12, [rbp - 0x4e]
dec r14d
jmp 0x7ff6cc7ca944
mov eax, r8d
mov r15d, edi
and eax, 0x20000
mov eax, 2
cmovne r15d, eax
mov eax, r8d
and eax, 0x13000
cmp eax, 0x10000
jne 0x7ff6cc7cab2f
movzx eax, byte [r12]
mov rbx, r12
sub al, 0x30
cmp al, 0xa
jae 0x7ff6cc7ca97d
nop word [rax + rax]
movzx eax, byte [rbx + 1]
inc rbx
sub al, 0x30
cmp al, 0xa
jb 0x7ff6cc7ca970
mov r13d, ebx
sub r13d, r12d
je 0x7ff6cc7ca998
lea ecx, [r13 + 2]
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
shr eax, 1
dec eax
jmp 0x7ff6cc7ca99a
mov eax, edi
mov dword [rsp + 0x70], eax
mov r8d, r15d
add eax, r14d
add eax, eax
and r8d, 3
mov dword [rbp + 0x708], r8d
je 0x7ff6cc7ca9b6
add eax, 2
mov r9, qword [rsp + 0x68]
mov ecx, eax
add rax, r9
cmp qword [rsp + 0x58], rax
jae 0x7ff6cc7caa6a
mov rsi, qword [rsp + 0x58]
lea rax, [rcx + r9]
mov rdi, qword [0x7ff6cc85e0c8]
add rsi, rsi
cmp rsi, rax
mov rcx, rdi
cmovb rsi, rax
mov qword [rsp + 0x58], rsi
lea rdx, [rsi + 0x12]
call fcn.7ff6cc7ae820
lock inc dword [rdi + 4]
mov r8, qword [rsp + 0x68]
mov ecx, 1
mov dword [rax + 8], ecx
movzx ecx, byte [rdi + 2]
lea rdi, [rax + 0x10]
mov word [rax], cx
lea rax, [rdi + 0x10]
mov qword [rdi + 8], rax
xor ecx, ecx
mov qword [rdi], rsi
mov word [rax + rsi], cx
mov rsi, qword [rsp + 0x50]
mov rcx, qword [rdi + 8]
mov rdx, qword [rsi + 8]
call fcn.7ff6cc7e3970
lea rcx, [rsi - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff6cc7caa4b
call fcn.7ff6cc7ae900
mov r9, qword [rsp + 0x68]
mov rax, qword [rdi + 8]
mov rcx, r9
mov r8d, dword [rbp + 0x708]
shr rcx, 1
mov qword [rsp + 0x50], rdi
lea rsi, [rax + rcx*2]
lea edi, [r13 + 2]
mov eax, 0xaaaaaaab
mul edi
mov ecx, r13d
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
test r15b, 1
je 0x7ff6cc7caa8c
mov eax, 0x2d
jmp 0x7ff6cc7caa97
test r15b, 2
je 0x7ff6cc7caa9e
mov eax, 0x2b
mov word [rsi], ax
add rsi, 2
test r13d, r13d
je 0x7ff6cc7caae9
mov r8d, 2
nop dword [rax]
movsx eax, byte [r12]
lea r12, [r12 + 1]
mov word [rsi], ax
dec ecx
mov eax, edi
add rsi, r8
dec edi
test eax, eax
jne 0x7ff6cc7caade
test ecx, ecx
je 0x7ff6cc7caae2
movzx eax, word [0x7ff6cc855f18]
mov edi, r8d
mov word [rsi], ax
add rsi, r8
test ecx, ecx
jne 0x7ff6cc7caab0
mov r8d, dword [rbp + 0x708]
test r8d, r8d
je 0x7ff6cc7caaf7
add r9, 2
mov qword [rsp + 0x68], r9
sub r14d, r13d
mov r8, rsi
mov edx, r14d
mov rcx, rbx
mov edi, r14d
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
mov ecx, dword [rsp + 0x70]
lea rax, [r14 + r14]
add ecx, r13d
shr rax, 1
mov r13, qword [rsp + 0x68]
add rcx, rdi
lea rsi, [rsi + rax*2]
lea r13, [r13 + rcx*2]
jmp 0x7ff6cc7cb17c
movzx eax, r15b
mov rcx, rdi
and al, 3
cmovne rcx, rdx
bt r8d, 0x12
jae 0x7ff6cc7cab67
movzx edi, word [r9 + 6]
mov edx, r14d
lea rax, [rdx + rcx]
cmp rax, rdi
jae 0x7ff6cc7cab67
mov eax, edi
or r15d, 4
sub rax, rdx
sub rax, rcx
mov qword [rbp - 0x70], rax
add rcx, rax
mov ebx, r14d
lea rax, [rbx + rcx]
lea r14, [rax*2]
add r14, r13
cmp qword [rsp + 0x58], r14
jae 0x7ff6cc7cac19
mov rsi, qword [rsp + 0x58]
lea rax, [rax*2]
mov rdi, qword [0x7ff6cc85e0c8]
add rsi, rsi
add rax, r13
mov rcx, rdi
cmp rsi, rax
cmovb rsi, rax
mov qword [rsp + 0x58], rsi
lea rdx, [rsi + 0x12]
call fcn.7ff6cc7ae820
lock inc dword [rdi + 4]
mov ecx, 1
mov r8, r13
mov dword [rax + 8], ecx
movzx ecx, byte [rdi + 2]
lea rdi, [rax + 0x10]
mov word [rax], cx
lea rax, [rdi + 0x10]
mov qword [rdi + 8], rax
xor ecx, ecx
mov qword [rdi], rsi
mov word [rax + rsi], cx
mov rsi, qword [rsp + 0x50]
mov rcx, qword [rdi + 8]
mov rdx, qword [rsi + 8]
call fcn.7ff6cc7e3970
lea rcx, [rsi - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff6cc7cac09
call fcn.7ff6cc7ae900
mov rax, qword [rdi + 8]
shr r13, 1
mov qword [rsp + 0x50], rdi
lea rsi, [rax + r13*2]
test r15b, 1
je 0x7ff6cc7cac26
mov eax, 0x2d
jmp 0x7ff6cc7cac31
test r15b, 2
je 0x7ff6cc7cac38
mov eax, 0x2b
mov word [rsi], ax
add rsi, 2
test r15b, 4
je 0x7ff6cc7cac5c
mov rdx, qword [rbp - 0x70]
test rdx, rdx
je 0x7ff6cc7cac58
mov eax, 0x30
mov rdi, rsi
movzx eax, ax
mov rcx, rdx
rep stosw word [rdi], ax
lea rsi, [rsi + rdx*2]
mov r8, rsi
mov rdx, rbx
mov rcx, r12
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
mov r8, qword [rsp + 0x60]
lea rax, [rbx + rbx]
shr rax, 1
mov r13, r14
mov qword [rsp + 0x68], r14
lea rsi, [rsi + rax*2]
jmp case.default.0x7ff6cc7c9ff3
mov rax, qword [r8 + 0x10]
xorps xmm0, xmm0
mov r15d, edi
cvtsi2sd xmm0, rax
test rax, rax
jns 0x7ff6cc7caca0
addsd xmm0, xmm8
jne 0x7ff6cc7cad60
mov r14, qword [rsp + 0x58]
lea rbx, [r13 + 2]
cmp r14, rbx
jae 0x7ff6cc7cad47
mov rdi, qword [0x7ff6cc85e0c8]
lea rax, [r14 + r14]
cmp rax, rbx
mov r14, rax
mov rcx, rdi
cmovb r14, rbx
mov qword [rsp + 0x58], r14
lea rdx, [r14 + 0x12]
call fcn.7ff6cc7ae820
lock inc dword [rdi + 4]
mov rsi, qword [rsp + 0x50]
mov ecx, 1
mov dword [rax + 8], ecx
mov r8, r13
movzx ecx, byte [rdi + 2]
lea rdi, [rax + 0x10]
mov word [rax], cx
lea rax, [rdi + 0x10]
mov qword [rdi + 8], rax
xor ecx, ecx
mov qword [rdi], r14
mov word [rax + r14], cx
mov rdx, qword [rsi + 8]
mov rcx, qword [rdi + 8]
call fcn.7ff6cc7e3970
lea rcx, [rsi - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff6cc7cad32
call fcn.7ff6cc7ae900
mov rax, qword [rdi + 8]
mov r8, qword [rsp + 0x60]
shr r13, 1
mov qword [rsp + 0x50], rdi
lea rsi, [rax + r13*2]
mov eax, 0x30
mov qword [rsp + 0x68], rbx
mov word [rsi], ax
mov r13, rbx
add rsi, 2
jmp case.default.0x7ff6cc7c9ff3
bt r11d, 8
jae 0x7ff6cc7cad6e
movzx eax, byte [r8 + 0xa]
jmp 0x7ff6cc7cad74
mov eax, dword [0x7ff6cc858690]
comisd xmm0, xmm6
jb 0x7ff6cc7cad98
nop word [rax + rax]
cmp r15d, 7
jae 0x7ff6cc7cad98
cmp r15d, eax
jae 0x7ff6cc7cad98
mulsd xmm0, xmm7
inc r15d
comisd xmm0, xmm6
jae 0x7ff6cc7cad80
test r11b, 0x40
je 0x7ff6cc7cada5
movzx eax, word [r8 + 4]
jmp 0x7ff6cc7cada7
mov eax, edx
movzx ecx, ax
lea r9, [rbp + 0x510]
mov eax, 0xa2
movsd qword [rbp - 0x68], xmm0
cmp ecx, eax
mov dword [rbp + 0x708], edi
mov r8d, 0x3ff
lea rdx, [rbp - 0x4f]
cmova ecx, eax
lea r12, [rbp - 0x4f]
mov rax, qword [0x7ff6cc85bba8]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], ecx
lea rcx, [rbp - 0x68]
mov dword [rsp + 0x28], 0x66
mov qword [rsp + 0x20], 0x15e
call fcn.7ff6cc7f0694
movzx edx, byte [rbp - 0x4f]
lea rcx, [rbp - 0x4f]
movzx edi, word [0x7ff6cc855f90]
test dl, dl
je 0x7ff6cc7cae30
movzx eax, dl
nop dword [rax]
cmp al, dil
je 0x7ff6cc7cae30
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x7ff6cc7cae20
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x7ff6cc7cae84
movzx eax, byte [rcx]
test al, al
je 0x7ff6cc7cae52
sub al, 0x45
test al, 0xdf
je 0x7ff6cc7cae52
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x7ff6cc7cae41
mov rdx, rcx
dec rcx
cmp byte [rcx], 0x30
jne 0x7ff6cc7cae68
nop dword [rax]
dec rcx
cmp byte [rcx], 0x30
je 0x7ff6cc7cae60
cmp byte [rcx], dil
jne 0x7ff6cc7cae70
dec rcx
movzx eax, byte [rdx]
lea rcx, [rcx + 1]
inc rdx
mov byte [rcx], al
test al, al
jne 0x7ff6cc7cae70
movzx edx, byte [rbp - 0x4f]
lea rax, [rbp - 0x4f]
or r14, 0xffffffffffffffff
nop dword [rax]
inc r14
cmp byte [rax + r14], 0
jne 0x7ff6cc7cae90
cmp dl, 0x2d
jne 0x7ff6cc7caeb6
mov eax, 1
lea r12, [rbp - 0x4e]
mov r9d, eax
mov dword [rbp + 0x708], eax
dec r14d
jmp 0x7ff6cc7caebd
mov r9d, dword [rbp + 0x708]
movzx eax, byte [r12]
mov rbx, r12
sub al, 0x30
cmp al, 0xa
jae 0x7ff6cc7caedd
nop dword [rax + rax]
movzx eax, byte [rbx + 1]
inc rbx
sub al, 0x30
cmp al, 0xa
jb 0x7ff6cc7caed0
mov r13d, ebx
sub r13d, r12d
je 0x7ff6cc7caef8
lea ecx, [r13 + 2]
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
shr eax, 1
dec eax
jmp 0x7ff6cc7caefa
xor eax, eax
mov dword [rsp + 0x74], eax
mov r8d, r9d
add eax, r14d
add eax, eax
and r8d, 3
mov dword [rsp + 0x70], r8d
je 0x7ff6cc7caf14
add eax, 2
mov r10, qword [rsp + 0x68]
mov ecx, eax
add rax, r10
cmp qword [rsp + 0x58], rax
jae 0x7ff6cc7cafcd
mov rsi, qword [rsp + 0x58]
lea rax, [rcx + r10]
mov rdi, qword [0x7ff6cc85e0c8]
add rsi, rsi
cmp rsi, rax
mov rcx, rdi
cmovb rsi, rax
mov qword [rsp + 0x58], rsi
lea rdx, [rsi + 0x12]
call fcn.7ff6cc7ae820
lock inc dword [rdi + 4]
mov r8, qword [rsp + 0x68]
mov ecx, 1
mov dword [rax + 8], ecx
movzx ecx, byte [rdi + 2]
lea rdi, [rax + 0x10]
mov word [rax], cx
lea rax, [rdi + 0x10]
mov qword [rdi + 8], rax
xor ecx, ecx
mov qword [rdi], rsi
mov word [rax + rsi], cx
mov rsi, qword [rsp + 0x50]
mov rcx, qword [rdi + 8]
mov rdx, qword [rsi + 8]
call fcn.7ff6cc7e3970
lea rcx, [rsi - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff6cc7cafa9
call fcn.7ff6cc7ae900
mov r10, qword [rsp + 0x68]
mov rax, qword [rdi + 8]
mov rcx, r10
mov r8d, dword [rsp + 0x70]
mov r9d, dword [rbp + 0x708]
shr rcx, 1
mov qword [rsp + 0x50], rdi
lea rsi, [rax + rcx*2]
lea edi, [r13 + 2]
mov eax, 0xaaaaaaab
mul edi
mov ecx, r13d
shr edx, 1
lea eax, [rdx + rdx*2]
sub edi, eax
test r9b, 1
je 0x7ff6cc7cafef
mov eax, 0x2d
jmp 0x7ff6cc7caffa
test r9b, 2
je 0x7ff6cc7cb001
mov eax, 0x2b
mov word [rsi], ax
add rsi, 2
test r13d, r13d
je 0x7ff6cc7cb047
mov r8d, 2
nop dword [rax]
movsx eax, byte [r12]
lea r12, [r12 + 1]
mov word [rsi], ax
dec ecx
mov eax, edi
add rsi, r8
dec edi
test eax, eax
jne 0x7ff6cc7cb03e
test ecx, ecx
je 0x7ff6cc7cb042
movzx eax, word [0x7ff6cc855f18]
mov edi, r8d
mov word [rsi], ax
add rsi, r8
test ecx, ecx
jne 0x7ff6cc7cb010
mov r8d, dword [rsp + 0x70]
test r8d, r8d
je 0x7ff6cc7cb055
add r10, 2
mov qword [rsp + 0x68], r10
sub r14d, r13d
mov r8, rsi
mov edx, r14d
mov rcx, rbx
mov edi, r14d
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
mov ecx, dword [rsp + 0x74]
lea rax, [r14 + r14]
shr rax, 1
lea r12, [0x7ff6cc700000]
add ecx, r13d
add rcx, rdi
lea rbx, [rsi + rax*2]
mov rax, qword [rsp + 0x68]
mov esi, r15d
mov r15, qword [rsp + 0x58]
add rsi, rsi
lea r14, [rax + rcx*2]
lea rax, [r14 + 2]
mov rcx, qword [r12 + rsi*8 + 0x155f20]
add rax, rcx
cmp r15, rax
jae 0x7ff6cc7cb141
mov rdi, qword [0x7ff6cc85e0c8]
lea rax, [rcx + 2]
add rax, r14
add r15, r15
cmp r15, rax
mov rcx, rdi
cmovb r15, rax
mov qword [rsp + 0x58], r15
lea rdx, [r15 + 0x12]
call fcn.7ff6cc7ae820
lock inc dword [rdi + 4]
mov rbx, qword [rsp + 0x50]
mov ecx, 1
mov dword [rax + 8], ecx
mov r8, r14
movzx ecx, byte [rdi + 2]
lea rdi, [rax + 0x10]
mov word [rax], cx
lea rax, [rdi + 0x10]
mov qword [rdi + 8], rax
xor ecx, ecx
mov qword [rdi], r15
mov word [r15 + rax], cx
mov rdx, qword [rbx + 8]
mov rcx, qword [rdi + 8]
call fcn.7ff6cc7e3970
lea rcx, [rbx - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff6cc7cb12e
call fcn.7ff6cc7ae900
mov rax, qword [rdi + 8]
mov rcx, r14
shr rcx, 1
mov qword [rsp + 0x50], rdi
lea rbx, [rax + rcx*2]
mov eax, 0x20
lea rcx, [rbx + 2]
mov word [rbx], ax
mov r8, qword [r12 + rsi*8 + 0x155f20]
mov rdx, qword [r12 + rsi*8 + 0x155f28]
call fcn.7ff6cc7e3970
mov rcx, qword [r12 + rsi*8 + 0x155f20]
lea rax, [rcx + 2]
shr rax, 1
lea r13, [rcx + 2]
add r13, r14
lea rsi, [rbx + rax*2]
mov r8, qword [rsp + 0x60]
mov qword [rsp + 0x68], r13
mov r14, r13
sub r14, qword [rbp - 0x60]
test dword [r8], 0xc0000000
je 0x7ff6cc7cb2ab
movzx ebx, word [r8 + 6]
add rbx, rbx
cmp r14, rbx
jae 0x7ff6cc7cb2ab
mov rax, qword [rsp + 0x58]
sub rbx, r14
lea r12, [rbx + r13]
cmp rax, r12
jae 0x7ff6cc7cb24d
mov rdi, qword [0x7ff6cc85e0c8]
add rax, rax
cmp rax, r12
mov rsi, rax
mov rcx, rdi
cmovb rsi, r12
mov qword [rsp + 0x58], rsi
lea rdx, [rsi + 0x12]
call fcn.7ff6cc7ae820
lock inc dword [rdi + 4]
mov ecx, 1
mov r8, r13
mov dword [rax + 8], ecx
movzx ecx, byte [rdi + 2]
lea rdi, [rax + 0x10]
mov word [rax], cx
lea rax, [rdi + 0x10]
mov qword [rdi + 8], rax
xor ecx, ecx
mov qword [rdi], rsi
mov word [rsi + rax], cx
mov rsi, qword [rsp + 0x50]
mov rcx, qword [rdi + 8]
mov rdx, qword [rsi + 8]
call fcn.7ff6cc7e3970
lea rcx, [rsi - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff6cc7cb238
call fcn.7ff6cc7ae900
mov rax, qword [rdi + 8]
mov r8, qword [rsp + 0x60]
shr r13, 1
mov qword [rsp + 0x50], rdi
lea rsi, [rax + r13*2]
mov eax, dword [r8]
test al, al
jns 0x7ff6cc7cb25b
movzx r15d, word [r8 + 8]
jmp 0x7ff6cc7cb261
mov r15d, 0x20
test eax, eax
jns 0x7ff6cc7cb26f
shr rbx, 1
je 0x7ff6cc7cb29f
mov rdi, rsi
jmp 0x7ff6cc7cb295
mov rax, r14
shr rbx, 1
shr rax, 1
mov rdi, rsi
add rax, rax
mov r8, r14
sub rdi, rax
mov rdx, rdi
lea rcx, [rdi + rbx*2]
call fcn.7ff6cc7e3970
test rbx, rbx
je 0x7ff6cc7cb29f
mov rcx, rbx
movzx eax, r15w
rep stosw word [rdi], ax
lea rsi, [rsi + rbx*2]
mov qword [rsp + 0x68], r12
mov r13, r12
mov ebx, dword [rbp + 0x6f8]
lea r9, [0x7ff6cc700000]
mov r15, qword [rsp + 0x58]
mov edx, 2
mov r14, qword [rbp + 0x6f0]
lea r10d, [rdx - 1]
test ebx, ebx
jne 0x7ff6cc7c9fb0
mov rdx, qword [rsp + 0x50]
movaps xmm8, xmmword [rsp + 0x770]
movaps xmm7, xmmword [rsp + 0x780]
movaps xmm6, xmmword [rsp + 0x790]
mov r12, qword [rsp + 0x7a8]
mov rcx, qword [rdx + 8]
mov qword [rdx], r13
shr r13, 1
xor eax, eax
mov word [rcx + r13*2], ax
mov rax, rdx
add rsp, 0x7b0
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret