Function at 0x4e6560
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x4b4
mov eax, dword [0x5c7004]
xor eax, esp
mov dword [esp + 0x4b0], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ebx
push esi
mov esi, 0x26
mov dword [esp + 0x78], ecx
cmp eax, esi
push edi
push dword [0x5cd4f8]
cmovae esi, eax
mov dword [esp + 0x34], esi
lea eax, [esi + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov ecx, eax
mov dword [esp + 0x40], esi
lea eax, [ecx + 8]
mov dword [esp + 0x34], ecx
xor edx, edx
xor edi, edi
mov dword [esp + 0x2c], edi
mov dword [ecx + 4], eax
mov dword [ecx], esi
mov word [eax + esi], dx
test byte [0x5cb8b0], 1
mov ebx, dword [ecx + 4]
mov dword [esp + 0x48], ebx
jne 0x4e66df
mov eax, 0x5cb8b0
lock bts dword [eax], 0x1f
jb 0x4e6770
push 4
lea eax, [esp + 0xb4]
push eax
push 0xe
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov edi, edi
test eax, eax
je 0x4e662d
mov ax, word [esp + 0xb0]
test ax, ax
je 0x4e662d
movzx ecx, word [0x5cb8b8]
cmp word [esp + 0xb2], di
movzx eax, ax
cmove ecx, eax
mov word [0x5cb8b8], cx
push 4
lea eax, [esp + 0xb4]
push eax
push 0xf
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4e6673
mov ax, word [esp + 0xb0]
test ax, ax
je 0x4e6673
movzx ecx, word [0x5cb8f8]
cmp word [esp + 0xb2], di
movzx eax, ax
cmove ecx, eax
mov word [0x5cb8f8], cx
cmp word [0x5cb8b8], 0x2e
je 0x4e6691
push 0x5621e4
push 0
call fcn.0053fcde
add esp, 8
mov dword [0x5cf33c], eax
mov eax, 0x5cb8b0
lock bts dword [eax], 0
jb 0x4e66df
mov esi, dword [0x5cb8b4]
test esi, esi
je 0x4e66b0
push 0
push esi
call dword [sym.imp.ntdll.dll_NtSetEvent]
mov eax, 0xfffffffe
mov ecx, 0x5cb8b0
lock xadd dword [ecx], eax
shr eax, 1
and eax, 0x7fff
sub eax, 1
jne 0x4e66db
test esi, esi
je 0x4e66db
push esi
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [0x5cb8b4], edi
mov esi, dword [esp + 0x30]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4e789b
fld qword [0x5b96e0]
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x80], ecx
mov ecx, dword [esp + 0x74]
fst qword [esp + 0xa0]
fld qword [0x5b9670]
mov dword [esp + 0x84], ecx
mov ecx, dword [esp + 0x74]
fst qword [esp + 0xa8]
mov dword [esp + 0x8c], 3
mov dword [esp + 0x88], ecx
mov edx, dword ds:[esp + 0x7c]
dec eax
mov dword [esp + 0x74], eax
mov ecx, edx
mov eax, edx
mov dword [esp + 0x70], edi
add edx, 0x18
mov dword [esp + 0x38], eax
mov dword [esp + 0x7c], edx
mov dword [esp + 0x3c], 0
mov edx, dword [eax]
mov eax, edx
and eax, 0x3f
mov dword [esp + 0x64], edx
cmp eax, 0xc
ja case.default.0x4e6769
jmp dword [eax*4 + 0x4e78c8]
test byte [0x5cb8b0], 1
jne 0x4e66df
xor edx, edx
mov ecx, eax
call sym.ProcessHacker.exe_PhfWaitForEvent
jmp 0x4e66df
lea esi, [edi + 2]
fstp st(1)
fstp st(0)
cmp dword [esp + 0x30], esi
jae 0x4e67bc
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x40]
push 2
push edi
call fcn.004e64e0
mov dword [esp + 0x34], eax
shr edi, 1
mov eax, dword [eax + 4]
lea ebx, [eax + edi*2]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x30], eax
mov ecx, dword [esp + 0x38]
mov edi, esi
mov dword [esp + 0x2c], edi
mov ax, word [ecx + 0x10]
mov word [ebx], ax
add ebx, 2
mov dword [esp + 0x48], ebx
jmp 0x4e7701
mov ecx, dword [esp + 0x38]
fstp st(1)
fstp st(0)
mov ecx, dword [ecx + 0x10]
lea eax, [ecx + edi]
cmp esi, eax
jae 0x4e6819
push ecx
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0x44]
push edi
call fcn.004e64e0
mov esi, dword [esp + 0x38]
mov ecx, edi
mov dword [esp + 0x34], eax
shr ecx, 1
mov eax, dword [eax + 4]
lea ebx, [eax + ecx*2]
mov eax, dword [esp + 0x40]
mov ecx, dword [esi + 0x10]
mov dword [esp + 0x30], eax
jmp 0x4e681d
mov esi, dword [esp + 0x38]
push ecx
push dword [esi + 0x14]
push ebx
call fcn.00537fe0
mov eax, dword ds:[esi + 0x10]
add esp, 0xc
shr eax, 1
add edi, dword [esi + 0x10]
mov dword [esp + 0x2c], edi
lea ebx, [ebx + eax*2]
mov dword [esp + 0x48], ebx
jmp 0x4e7701
mov ecx, dword [esp + 0x38]
fstp st(1)
fstp st(0)
push dword [ecx + 0x10]
call sym.ProcessHacker.exe_PhCountStringZ
lea esi, ds:[eax + eax]
add edi, esi
cmp dword [esp + 0x30], edi
jae 0x4e6890
mov ebx, dword [esp + 0x2c]
lea edx, [esp + 0x40]
mov ecx, dword [esp + 0x34]
push esi
push ebx
lfence
call fcn.004e64e0
mov dword [esp + 0x34], eax
shr ebx, 1
mov eax, dword [eax + 4]
lea ebx, [eax + ebx*2]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x38]
push esi
push dword [eax + 0x10]
push ebx
call fcn.00537fe0
add esp, 0xc
mov dword [esp + 0x2c], edi
shr esi, 1
lea ebx, [ebx + esi*2]
mov dword [esp + 0x48], ebx
jmp 0x4e7701
mov eax, dword ds:[esp + 0x38]
fstp st(1)
fstp st(0)
cmp edx, 3
jne 0x4e68cd
mov edi, dword [eax + 0x14]
mov esi, dword [eax + 0x10]
jmp 0x4e68de
mov edi, dword [eax + 0x10]
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4e68d5
sub esi, ecx
push esi
push edi
lea eax, [esp + 0x80]
push eax
call dword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeSize]
test eax, eax
js 0x4e733d
mov edx, dword [esp + 0x2c]
lfence
mov ecx, dword [esp + 0x78]
lea eax, [ecx + edx]
cmp dword [esp + 0x30], eax
jae 0x4e6939
push ecx
mov ecx, dword [esp + 0x38]
push edx
lea edx, [esp + 0x48]
call fcn.004e64e0
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x34], eax
shr ecx, 1
mov eax, dword [eax + 4]
lea ebx, [eax + ecx*2]
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x48], ebx
mov dword [esp + 0x30], eax
push esi
push edi
push 0
push ecx
push ebx
call dword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
test eax, eax
js 0x4e733d
mov eax, dword [esp + 0x78]
mov edi, dword [esp + 0x2c]
shr eax, 1
add edi, dword [esp + 0x78]
mov dword [esp + 0x2c], edi
lea ebx, [ebx + eax*2]
mov dword [esp + 0x48], ebx
jmp 0x4e7701
mov eax, dword [ecx + 0x10]
mov ecx, eax
shr ecx, 0x1f
cdq
mov dword [esp + 0x3c], ecx
mov ecx, eax
mov eax, dword [esp + 0x38]
xor ecx, edx
sub ecx, edx
mov edx, dword [esp + 0x64]
jmp 0x4e6990
mov eax, dword [esp + 0x38]
mov ecx, dword [eax + 0x10]
fstp st(1)
fstp st(0)
mov dword ds:[esp + 0x4c], 0xa
test edx, 0x100
je 0x4e69ba
mov al, byte [eax + 0xa]
cmp al, 2
jb 0x4e69ba
cmp al, 0x45
ja 0x4e69ba
movzx eax, al
mov dword [esp + 0x4c], eax
test edx, 0x20000000
lea edi, [esp + 0x4b6]
mov esi, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
mov eax, str.0123456789abcdefghijklmnopqrstuvwxyz_________._:_________
cmovne eax, esi
xor esi, esi
mov dword [esp + 0x58], eax
test ecx, ecx
je 0x4e6a72
test edx, 0x10000
je 0x4e6a4e
xor eax, eax
mov dword [esp + 0x50], eax
mov eax, ecx
xor edx, edx
div dword [esp + 0x4c]
inc esi
mov ecx, eax
mov eax, dword [esp + 0x58]
movsx ax, byte [eax + edx]
mov word [edi], ax
sub edi, 2
mov eax, dword [esp + 0x50]
inc eax
mov dword [esp + 0x50], eax
cmp eax, 3
jne 0x4e6a37
mov edi, edi
test ecx, ecx
je 0x4e6a3b
mov ax, word [0x5cb8f8]
inc esi
mov word [edi], ax
sub edi, 2
xor eax, eax
mov dword [esp + 0x50], eax
test ecx, ecx
jne 0x4e69f6
mov edx, dword [esp + 0x64]
xor ecx, ecx
cmp dword [esp + 0x3c], ecx
je 0x4e6a8b
mov ecx, 1
jmp 0x4e6a99
mov ebx, dword [esp + 0x58]
mov eax, ecx
xor edx, edx
div dword [esp + 0x4c]
inc esi
mov ecx, eax
movsx ax, byte [ebx + edx]
mov word [edi], ax
sub edi, 2
test ecx, ecx
jne 0x4e6a52
mov ebx, dword [esp + 0x48]
jmp 0x4e6a3b
mov eax, 0x30
lea edi, [esp + 0x4b4]
mov word [esp + 0x4b6], ax
lea esi, [eax - 0x2f]
jmp 0x4e6a3f
test edx, 0x20000
mov eax, 1
cmovne ecx, eax
and edx, 0x50000
cmp edx, 0x40000
jne 0x4e6acb
mov eax, dword [esp + 0x38]
movzx edx, word [eax + 6]
lea eax, [ecx + esi]
cmp eax, edx
jae 0x4e6acb
or dword [esp + 0x3c], 4
mov eax, edx
sub eax, ecx
sub eax, esi
mov dword [esp + 0x80], eax
add ecx, eax
lea eax, [ecx + esi]
add edi, 2
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x44], edi
lea ecx, [ecx + eax*2]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x58], ecx
cmp eax, ecx
jae 0x4e6b64
add eax, eax
mov edx, ecx
cmp eax, ecx
lfence
push dword [0x5cd4f8]
cmovae edx, eax
mov dword [esp + 0x34], edx
lea eax, [edx + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
push dword [esp + 0x2c]
mov ebx, eax
xor edx, edx
mov eax, dword [esp + 0x34]
lea ecx, [ebx + 8]
mov dword [ebx], eax
mov dword [ebx + 4], ecx
mov word [ecx + eax], dx
mov eax, dword [esp + 0x38]
push dword [eax + 4]
push dword [ebx + 4]
call fcn.00537fe0
mov ecx, dword [esp + 0x40]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4e6b4c
call fcn.004c1f60
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x40], eax
mov eax, dword [ebx + 4]
shr ecx, 1
mov dword [esp + 0x34], ebx
lea ebx, [eax + ecx*2]
mov eax, dword [esp + 0x3c]
test al, 1
je 0x4e6b73
mov ecx, 0x2d
jmp 0x4e6b84
mov ecx, dword [esp + 0x38]
test dword [ecx], 0x20000
je 0x4e6b8a
mov ecx, 0x2b
mov word [ebx], cx
add ebx, 2
test al, 4
je 0x4e6bb2
mov edx, dword [esp + 0x80]
test edx, edx
je 0x4e6baf
mov ecx, edx
mov eax, 0x300030
shr ecx, 1
mov edi, ebx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x44]
lea ebx, [ebx + edx*2]
add esi, esi
push esi
push edi
push ebx
call fcn.00537fe0
mov edi, dword [esp + 0x64]
add esp, 0xc
add ebx, esi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x48], ebx
jmp 0x4e7701
mov eax, dword [esp + 0x38]
fstp st(1)
fstp st(0)
mov esi, dword [eax + 0x14]
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x50], ecx
test esi, esi
jg 0x4e6c11
jl 0x4e6bee
test ecx, ecx
jae 0x4e6c11
neg ecx
mov dword [esp + 0x3c], 1
adc esi, 0
neg esi
jmp 0x4e6c0d
mov eax, dword [esp + 0x38]
fstp st(1)
fstp st(0)
mov ecx, dword [eax + 0x10]
mov esi, dword [eax + 0x14]
mov dword [esp + 0x50], ecx
mov dword [esp + 0x4c], 0xa
mov dword [esp + 0x68], 0
test edx, 0x100
je 0x4e6c68
mov al, byte ds:[eax + 0xa]
mov dword [esp + 0x4c], 0xa
mov dword [esp + 0x68], 0
cmp al, 2
jb 0x4e6c68
mov dword [esp + 0x4c], 0xa
mov dword [esp + 0x68], 0
cmp al, 0x45
ja 0x4e6c68
movzx eax, al
cdq
mov dword [esp + 0x68], edx
mov edx, dword [esp + 0x64]
mov dword [esp + 0x4c], eax
test edx, 0x20000000
mov dword [esp + 0x6c], 0
mov edi, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
mov eax, str.0123456789abcdefghijklmnopqrstuvwxyz_________._:_________
cmovne eax, edi
lea edi, [esp + 0x4b6]
mov dword [esp + 0x44], eax
mov eax, ecx
or eax, esi
je 0x4e6d70
mov ebx, dword ds:[esp + 0x50]
test edx, 0x10000
je 0x4e6d36
xor eax, eax
mov dword [esp + 0x58], eax
push ebx
push dword [esp + 0x6c]
push dword [esp + 0x54]
push esi
push ebx
call fcn.005550e0
mov dword [esp + 0x58], ebx
pop ebx
nop
mov ebx, eax
mov esi, edx
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x6c]
inc edx
mov dword [esp + 0x6c], edx
movsx cx, byte [eax + ecx]
mov word [edi], cx
sub edi, 2
mov ecx, dword [esp + 0x58]
inc ecx
mov dword [esp + 0x58], ecx
cmp ecx, 3
jne 0x4e6d12
mov eax, ebx
or eax, esi
je 0x4e6d18
mov ax, word [0x5cb8f8]
inc edx
mov word [edi], ax
sub edi, 2
xor eax, eax
mov dword [esp + 0x6c], edx
mov dword [esp + 0x58], eax
mov eax, ebx
or eax, esi
jne 0x4e6cb2
mov ebx, dword [esp + 0x48]
mov eax, dword [esp + 0x64]
xor ecx, ecx
cmp dword [esp + 0x3c], ecx
je 0x4e6d8f
mov ecx, 1
jmp 0x4e6d9c
push ebx
push dword [esp + 0x6c]
push dword [esp + 0x54]
push esi
push ebx
call fcn.005550e0
mov dword [esp + 0x60], ebx
pop ebx
nop
mov ebx, eax
mov esi, edx
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x6c]
inc edx
mov dword [esp + 0x6c], edx
movsx ax, byte [eax + ecx]
mov word [edi], ax
mov eax, ebx
sub edi, 2
or eax, esi
jne 0x4e6d36
jmp 0x4e6d18
mov eax, 0x30
lea edi, [esp + 0x4b4]
mov edx, 1
mov word [esp + 0x4b6], ax
mov dword [esp + 0x6c], edx
jmp 0x4e6d1c
test eax, 0x20000
mov esi, 1
cmovne ecx, esi
and eax, 0x50000
cmp eax, 0x40000
jne 0x4e6dcb
mov eax, dword [esp + 0x38]
movzx esi, word [eax + 6]
lea eax, [ecx + edx]
cmp eax, esi
jae 0x4e6dcb
or dword [esp + 0x3c], 4
mov eax, esi
sub eax, ecx
sub eax, edx
mov dword [esp + 0x84], eax
add ecx, eax
lea eax, [ecx + edx]
add edi, 2
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x44], edi
lea ecx, [ecx + eax*2]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x58], ecx
cmp eax, ecx
jae 0x4e6e61
add eax, eax
mov ebx, ecx
cmp eax, ecx
lfence
push dword [0x5cd4f8]
cmovae ebx, eax
mov dword [esp + 0x34], ebx
lea eax, [ebx + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov esi, eax
xor eax, eax
lea ecx, [esi + 8]
mov dword [esi], ebx
mov dword [esi + 4], ecx
mov word [ecx + ebx], ax
mov eax, dword [esp + 0x34]
mov ebx, dword [esp + 0x2c]
push ebx
push dword [eax + 4]
push dword [esi + 4]
call fcn.00537fe0
mov ecx, dword [esp + 0x40]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4e6e49
call fcn.004c1f60
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x6c]
mov dword [esp + 0x40], eax
mov eax, dword [esi + 4]
shr ebx, 1
mov dword [esp + 0x34], esi
lea ebx, [eax + ebx*2]
mov eax, dword [esp + 0x3c]
test al, 1
je 0x4e6e70
mov ecx, 0x2d
jmp 0x4e6e81
mov ecx, dword [esp + 0x38]
test dword [ecx], 0x20000
je 0x4e6e87
mov ecx, 0x2b
mov word [ebx], cx
add ebx, 2
test al, 4
je 0x4e6eaf
mov esi, dword [esp + 0x84]
test esi, esi
je 0x4e6eac
mov ecx, esi
mov eax, 0x300030
shr ecx, 1
mov edi, ebx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x44]
lea ebx, [ebx + esi*2]
lea esi, [edx + edx]
push esi
push edi
push ebx
call fcn.00537fe0
mov edi, dword [esp + 0x64]
add esp, 0xc
add ebx, esi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x48], ebx
jmp 0x4e7701
mov eax, dword [esp + 0x38]
fstp st(1)
mov dword [esp + 0x3c], 0
fstp st(0)
test dl, 0x40
je 0x4e6ef8
movzx edx, word [eax + 4]
cmp edx, 0xa2
jbe 0x4e6efd
mov edx, 0xa2
jmp 0x4e6efd
mov edx, 6
fld qword ds:[eax + 0x10]
lea edi, [esp + 0xb9]
mov esi, dword [esp + 0x64]
sub esp, 0x10
mov eax, edi
mov dword [esp + 0x60], edi
mov ecx, esi
fstp qword [esp + 8]
push eax
call fcn.00527ba0
test al, al
jne 0x4e6f35
mov byte [esp + 0xb9], al
jmp 0x4e6f93
mov edx, dword [0x5cf33c]
test edx, edx
je 0x4e6f66
mov al, byte [esp + 0xb9]
lea ecx, [esp + 0xb9]
test al, al
je 0x4e6f66
cmp al, 0x2e
je 0x4e6f5f
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x4e6f51
jmp 0x4e6f66
mov al, byte [0x5cb8b8]
mov byte [ecx], al
test esi, 0x20000000
je 0x4e6f93
lea eax, [esp + 0xb9]
test edx, edx
je 0x4e6f8a
push edx
push eax
call fcn.0053f477
add esp, 8
jmp 0x4e6f93
push eax
call fcn.0053f41b
add esp, 4
mov eax, dword ds:[esp + 0x38]
mov edi, dword [eax]
test edi, 0x8000
je 0x4e701e
mov al, byte [esp + 0xb9]
lea ecx, [esp + 0xb9]
mov ah, byte [0x5cb8b8]
test al, al
je 0x4e6fd0
cmp al, ah
je 0x4e6fd0
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x4e6fc4
mov al, byte [ecx]
inc ecx
test al, al
je 0x4e701e
mov al, byte [ecx]
test al, al
je 0x4e6ff0
lea ecx, [ecx]
cmp al, 0x65
je 0x4e6ff0
cmp al, 0x45
je 0x4e6ff0
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x4e6fe0
mov al, byte [ecx - 1]
mov esi, ecx
dec ecx
cmp al, 0x30
jne 0x4e7008
lea ebx, [ebx]
mov al, byte [ecx - 1]
dec ecx
cmp al, 0x30
je 0x4e7000
cmp al, ah
lea edx, [ecx - 1]
cmovne edx, ecx
mov al, byte [esi]
lea edx, [edx + 1]
mov byte [edx], al
lea esi, [esi + 1]
test al, al
jne 0x4e7010
lea esi, [esp + 0xb9]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4e7028
sub esi, ecx
cmp byte [esp + 0xb9], 0x2d
mov dword [esp + 0x44], esi
jne 0x4e7056
lea ecx, [esp + 0xba]
dec esi
mov edx, 1
mov dword [esp + 0x50], ecx
mov dword [esp + 0x44], esi
jmp 0x4e706c
mov edx, dword [esp + 0x3c]
test edi, 0x20000
mov ecx, dword [esp + 0x50]
mov eax, 2
cmovne edx, eax
mov eax, edi
mov dword [esp + 0x3c], edx
and eax, 0x13000
cmp eax, 0x10000
jne 0x4e720f
mov al, byte [ecx]
mov edi, ecx
sub al, 0x30
cmp al, 0xa
jae 0x4e709f
mov al, byte [edi + 1]
inc edi
sub al, 0x30
cmp al, 0xa
jb 0x4e7095
mov eax, edi
sub eax, ecx
mov dword [esp + 0x58], eax
je 0x4e70ba
lea ecx, [eax + 2]
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
shr eax, 1
dec eax
jmp 0x4e70bc
xor eax, eax
lea ecx, ds:[eax + esi]
mov dword [esp + 0x4c], eax
add ecx, ecx
cmp dword [esp + 0x3c], 0
lea eax, [ecx + 2]
cmove eax, ecx
mov ecx, dword [esp + 0x2c]
add ecx, eax
mov eax, dword [esp + 0x30]
cmp eax, ecx
jae 0x4e7160
add eax, eax
mov edx, ecx
cmp eax, ecx
lfence
push dword [0x5cd4f8]
cmovae edx, eax
mov dword [esp + 0x34], edx
lea eax, [edx + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
push dword [esp + 0x2c]
mov ebx, eax
xor edx, edx
mov eax, dword [esp + 0x34]
lea ecx, [ebx + 8]
mov dword [ebx], eax
mov dword [ebx + 4], ecx
mov word [eax + ecx], dx
mov eax, dword [esp + 0x38]
push dword [eax + 4]
push dword [ebx + 4]
call fcn.00537fe0
mov ecx, dword [esp + 0x40]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4e7148
call fcn.004c1f60
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x40], eax
mov eax, dword [ebx + 4]
shr ecx, 1
mov dword [esp + 0x34], ebx
lea ebx, [eax + ecx*2]
mov eax, dword [esp + 0x58]
xor edx, edx
mov ecx, eax
add eax, 2
div dword [esp + 0x8c]
mov eax, dword [esp + 0x3c]
test al, 1
je 0x4e7182
mov eax, 0x2d
jmp 0x4e718b
test al, 2
je 0x4e7191
mov eax, 0x2b
mov word [ebx], ax
add ebx, 2
mov eax, dword [esp + 0x58]
test eax, eax
je 0x4e71d6
mov esi, dword [esp + 0x50]
lea ecx, [ecx]
movsx ax, byte [esi]
lea esi, [esi + 1]
dec ecx
mov word [ebx], ax
mov eax, edx
add ebx, 2
dec edx
test eax, eax
jne 0x4e71ca
test ecx, ecx
je 0x4e71ce
mov ax, word [0x5cb8f8]
mov edx, 2
mov word [ebx], ax
add ebx, 2
test ecx, ecx
jne 0x4e71a0
mov esi, dword [esp + 0x44]
mov eax, dword [esp + 0x58]
cmp dword [esp + 0x3c], 0
mov edx, ebx
je 0x4e71e4
add dword [esp + 0x2c], 2
mov ecx, esi
sub ecx, eax
mov eax, dword [esp + 0x4c]
add eax, esi
mov esi, dword [esp + 0x2c]
push edx
push ecx
lea ebx, [ebx + ecx*2]
lea esi, [esi + eax*2]
mov dword [esp + 0x50], ebx
push edi
mov dword [esp + 0x38], esi
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
mov edi, esi
jmp 0x4e7701
xor ecx, ecx
test edx, edx
setne cl
mov edx, ecx
test edi, 0x40000
je 0x4e724c
mov eax, dword [esp + 0x38]
movzx edi, word [eax + 6]
lea eax, [ecx + esi]
cmp eax, edi
jae 0x4e724c
or dword [esp + 0x3c], 4
mov eax, edi
sub eax, ecx
sub eax, esi
mov dword [esp + 0x88], eax
lea edx, [ecx + eax]
mov ecx, dword ds:[esp + 0x2c]
lea eax, [edx + esi]
lea ecx, [ecx + eax*2]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x44], ecx
cmp eax, ecx
jae 0x4e72dc
add eax, eax
mov ebx, ecx
cmp eax, ecx
lfence
push dword [0x5cd4f8]
cmovae ebx, eax
mov dword [esp + 0x34], ebx
lea eax, [ebx + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov edi, eax
xor eax, eax
lea ecx, [edi + 8]
mov dword [edi], ebx
mov dword [edi + 4], ecx
mov word [ebx + ecx], ax
mov eax, dword [esp + 0x34]
mov ebx, dword [esp + 0x2c]
push ebx
push dword [eax + 4]
push dword [edi + 4]
call fcn.00537fe0
mov ecx, dword ds:[esp + 0x40]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4e72c8
call fcn.004c1f60
mov eax, dword [esp + 0x30]
mov dword [esp + 0x40], eax
mov eax, dword [edi + 4]
shr ebx, 1
mov dword [esp + 0x34], edi
lea ebx, [eax + ebx*2]
mov eax, dword [esp + 0x3c]
test al, 1
je 0x4e72eb
mov ecx, 0x2d
jmp 0x4e72f4
test al, 2
je 0x4e72fa
mov ecx, 0x2b
mov word [ebx], cx
add ebx, 2
test al, 4
je 0x4e731e
mov edx, dword [esp + 0x88]
test edx, edx
je 0x4e731b
mov ecx, edx
mov eax, 0x300030
shr ecx, 1
mov edi, ebx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
lea ebx, [ebx + edx*2]
mov eax, dword [esp + 0x44]
mov edx, ebx
mov edi, dword [esp + 0x50]
lea ebx, [ebx + esi*2]
push edx
mov ecx, esi
mov dword [esp + 0x30], eax
push ecx
push edi
mov dword [esp + 0x54], ebx
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
mov edi, dword [esp + 0x2c]
jmp 0x4e7701
mov eax, dword [esp + 0x38]
xor edi, edi
mov dword [esp + 0x98], edi
mov dword [esp + 0x68], edi
mov esi, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
mov eax, edx
mov ecx, edx
mov dword [esp + 0x90], esi
and eax, 0x7fffffff
and ecx, 0x80000000
or esi, edx
mov dword [esp + 0x94], eax
fild qword [esp + 0x90]
mov dword [esp + 0x9c], ecx
fild qword [esp + 0x98]
fchs
faddp st(1)
jne 0x4e73ec
mov edi, dword [esp + 0x2c]
fstp st(0)
fstp st(1)
fstp st(0)
lea esi, [edi + 2]
cmp dword [esp + 0x30], esi
jae 0x4e73d2
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x40]
push 2
push edi
call fcn.004e64e0
mov dword [esp + 0x34], eax
shr edi, 1
mov eax, dword [eax + 4]
lea ebx, [eax + edi*2]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x30], eax
mov eax, 0x30
mov edi, esi
mov word [ebx], ax
add ebx, 2
mov dword [esp + 0x48], ebx
mov dword [esp + 0x2c], edi
jmp 0x4e7701
mov edx, dword [esp + 0x64]
mov esi, dword [esp + 0x38]
test edx, 0x100
je 0x4e7402
movzx ecx, byte [esi + 0xa]
jmp 0x4e7408
mov ecx, dword [0x5cc1a4]
fcomi st(2)
jb 0x4e7420
cmp edi, 7
jae 0x4e741c
cmp edi, ecx
jae 0x4e741c
fmul st(1)
inc edi
fcomi st(2)
jae 0x4e740c
mov dword [esp + 0x68], edi
fstp st(2)
fstp st(0)
test dl, 0x40
je 0x4e742f
movzx eax, word [esi + 4]
jmp 0x4e7434
mov eax, 2
movzx edx, ax
lea esi, [esp + 0xb9]
cmp edx, 0xa2
mov dword [esp + 0x50], 0
mov eax, 0xa2
mov dword [esp + 0x44], esi
cmova edx, eax
mov ecx, 0x1804b
sub esp, 0x10
mov eax, esi
fstp qword [esp + 8]
push eax
call fcn.00527ba0
test al, al
jne 0x4e747b
xor dl, dl
mov byte [esp + 0xb9], dl
jmp 0x4e74b5
cmp dword [0x5cf33c], 0
mov dl, byte [esp + 0xb9]
je 0x4e74b5
lea ecx, [esp + 0xb9]
test dl, dl
je 0x4e74b5
mov al, dl
cmp al, 0x2e
je 0x4e74a6
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x4e7498
jmp 0x4e74b5
mov ax, word [0x5cb8b8]
mov byte [ecx], al
mov dl, byte [esp + 0xb9]
lea ecx, ds:[esp + 0xb9]
test dl, dl
je 0x4e74d6
mov al, dl
cmp al, byte [0x5cb8b8]
je 0x4e74d6
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x4e74c6
mov al, byte ds:[ecx]
inc ecx
test al, al
je 0x4e753d
mov al, byte [ecx]
test al, al
je 0x4e7504
mov edi, edi
cmp al, 0x65
je 0x4e7504
cmp al, 0x45
je 0x4e7504
mov al, byte ds:[ecx + 1]
inc ecx
test al, al
jne 0x4e74f0
mov al, byte [ecx - 1]
mov esi, ecx
dec ecx
cmp al, 0x30
jne 0x4e7518
mov edi, edi
mov al, byte [ecx - 1]
dec ecx
cmp al, 0x30
je 0x4e7510
cmp al, byte [0x5cb8b8]
lea edx, [ecx - 1]
cmovne edx, ecx
mov al, byte [esi]
lea edx, [edx + 1]
mov byte [edx], al
lea esi, [esi + 1]
test al, al
jne 0x4e7524
mov dl, byte [esp + 0xb9]
mov esi, dword [esp + 0x44]
lea edi, [esp + 0xb9]
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x4e7547
sub edi, ecx
cmp dl, 0x2d
jne 0x4e7565
mov dword [esp + 0x50], 1
lea esi, [esp + 0xba]
dec edi
mov al, byte [esi]
mov ecx, esi
sub al, 0x30
mov dword [esp + 0x44], esi
cmp al, 0xa
jae 0x4e7581
mov al, byte [ecx + 1]
inc ecx
sub al, 0x30
cmp al, 0xa
jb 0x4e7573
mov dword [esp + 0x44], ecx
mov eax, ecx
sub eax, esi
mov dword [esp + 0x58], eax
je 0x4e759c
lea ecx, [eax + 2]
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
shr eax, 1
dec eax
jmp 0x4e759e
xor eax, eax
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x4c], eax
add eax, edi
add eax, eax
cmp dword [esp + 0x50], 0
lea ecx, [eax + 2]
cmove ecx, eax
lea eax, [ecx + edx]
cmp dword [esp + 0x30], eax
jae 0x4e75e8
push ecx
mov ecx, dword [esp + 0x38]
push edx
lea edx, [esp + 0x48]
lfence
call fcn.004e64e0
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x34], eax
shr ecx, 1
mov eax, dword [eax + 4]
lea ebx, [eax + ecx*2]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x30], eax
mov eax, dword ds:[esp + 0x58]
xor edx, edx
mov ecx, eax
add eax, 2
div dword [esp + 0x8c]
cmp dword [esp + 0x50], 0
je 0x4e760d
mov eax, 0x2d
mov word [ebx], ax
add ebx, 2
mov eax, dword [esp + 0x58]
test eax, eax
je 0x4e7648
movsx ax, byte [esi]
lea esi, [esi + 1]
dec ecx
mov word [ebx], ax
mov eax, edx
add ebx, 2
dec edx
test eax, eax
jne 0x4e763f
test ecx, ecx
je 0x4e7644
mov ax, word [0x5cb8f8]
mov edx, 2
mov word [ebx], ax
add ebx, 2
nop
test ecx, ecx
jne 0x4e7615
mov eax, dword [esp + 0x58]
cmp dword [esp + 0x50], 0
je 0x4e7654
add dword [esp + 0x2c], 2
mov esi, edi
push ebx
sub esi, eax
push esi
push dword [esp + 0x4c]
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
mov eax, dword [esp + 0x4c]
lea ebx, [ebx + esi*2]
mov ecx, dword [esp + 0x2c]
add eax, edi
mov esi, dword [esp + 0x68]
lea edi, [ecx + eax*2]
mov eax, dword [esi*8 + 0x5cb8c0]
add eax, 2
add eax, edi
cmp dword [esp + 0x30], eax
jae 0x4e76bd
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x40]
lfence
mov eax, dword [esi*8 + 0x5cb8c0]
add eax, 2
push eax
push edi
call fcn.004e64e0
mov dword [esp + 0x34], eax
mov ecx, edi
shr ecx, 1
mov eax, dword [eax + 4]
lea ebx, [eax + ecx*2]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x30], eax
mov eax, 0x20
mov word [ebx], ax
lea eax, [ebx + 2]
push dword [esi*8 + 0x5cb8c0]
push dword [esi*8 + 0x5cb8c4]
push eax
call fcn.00537fe0
mov ecx, dword [esi*8 + 0x5cb8c0]
add edi, 2
add esp, 0xc
lea eax, [ecx + 2]
shr eax, 1
add edi, ecx
mov dword [esp + 0x2c], edi
lea ebx, [ebx + eax*2]
mov dword [esp + 0x48], ebx
jmp 0x4e7701
fstp st(1)
fstp st(0)
mov ecx, dword [esp + 0x38]
sub edi, dword [esp + 0x70]
mov eax, dword [ecx]
test eax, 0xc0000000
je 0x4e7875
movzx esi, word ds:[ecx + 6]
add esi, esi
cmp edi, esi
jae 0x4e7875
mov ecx, dword ds:[esp + 0x2c]
sub esi, edi
mov edx, dword [esp + 0x30]
add ecx, esi
mov dword [esp + 0x50], ecx
cmp edx, ecx
jae 0x4e77c9
lea eax, [edx + edx]
mov edx, ecx
cmp eax, ecx
lfence
push dword [0x5cd4f8]
cmovae edx, eax
mov dword [esp + 0x34], edx
lea eax, [edx + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
push dword [esp + 0x2c]
mov ebx, eax
xor edx, edx
mov eax, dword [esp + 0x34]
lea ecx, [ebx + 8]
mov dword [ebx], eax
mov dword [ebx + 4], ecx
mov word [eax + ecx], dx
mov eax, dword [esp + 0x38]
push dword [eax + 4]
push dword [ebx + 4]
call fcn.00537fe0
mov ecx, dword [esp + 0x40]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4e77a9
call fcn.004c1f60
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x40], eax
mov eax, dword [ebx + 4]
shr ecx, 1
mov dword [esp + 0x34], ebx
lea ebx, [eax + ecx*2]
mov ecx, dword [esp + 0x38]
mov eax, dword [ecx]
jmp 0x4e77cd
mov ecx, dword [esp + 0x38]
test al, al
jns 0x4e77d7
movzx edx, word [ecx + 8]
jmp 0x4e77dc
mov edx, 0x20
shr esi, 1
mov dword [esp + 0x44], edx
test eax, eax
jns 0x4e7818
test esi, esi
je 0x4e7803
mov eax, edx
mov ecx, esi
movzx edx, ax
mov edi, ebx
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x50]
add esi, esi
add ebx, esi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x48], ebx
jmp 0x4e7879
mov eax, edi
mov ecx, ebx
and eax, 0xfffffffe
sub ecx, eax
lea eax, [esi + esi]
push edi
mov dword [esp + 0x5c], eax
add eax, ecx
push ecx
push eax
lfence
mov dword [esp + 0x7c], ecx
call fcn.00537fe0
add esp, 0xc
test esi, esi
je 0x4e7861
mov eax, dword [esp + 0x44]
mov ecx, esi
mov edi, dword [esp + 0x70]
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov esi, dword [esp + 0x58]
add ebx, esi
mov edi, dword [esp + 0x50]
mov dword [esp + 0x48], ebx
mov dword [esp + 0x2c], edi
jmp 0x4e7879
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0x74]
fld qword [esp + 0xa0]
fld qword [esp + 0xa8]
mov esi, dword [esp + 0x30]
test eax, eax
jne 0x4e6730
fstp st(1)
fstp st(0)
mov ecx, dword [esp + 0x34]
xor edx, edx
mov eax, dword [ecx + 4]
mov dword [ecx], edi
shr edi, 1
mov word [eax + edi*2], dx
mov eax, ecx
mov ecx, dword [esp + 0x4bc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret 0xc