Function at 0x4d7300
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x4b4
mov eax, dword [0x5ac004]
xor eax, esp
mov dword [esp + 0x4b0], eax
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
push ebx
push esi
xor esi, esi
mov dword [esp + 0x64], edx
test eax, eax
mov dword [esp + 0x88], eax
push edi
mov edi, eax
mov dword [esp + 0x6c], ecx
sete bl
mov dword [esp + 0x34], edi
test byte [0x5b010c], 1
mov dword [esp + 0x30], esi
jne 0x4d7465
mov eax, 0x5b010c
lock bts dword ds:[eax], 0x1f
jb 0x4d7510
push 4
lea eax, [esp + 0xb4]
push eax
push 0xe
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea ecx, [ecx]
test eax, eax
je 0x4d73ad
mov ax, word [esp + 0xb0]
test ax, ax
je 0x4d73ad
movzx ecx, word [0x5b0114]
cmp word [esp + 0xb2], si
movzx eax, ax
cmove ecx, eax
mov word [0x5b0114], cx
push 4
lea eax, [esp + 0xb4]
push eax
push 0xf
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4d73f3
mov ax, word [esp + 0xb0]
test ax, ax
je 0x4d73f3
movzx ecx, word [0x5b0158]
cmp word [esp + 0xb2], si
movzx eax, ax
cmove ecx, eax
mov word [0x5b0158], cx
cmp word [0x5b0114], 0x2e
je 0x4d7411
push 0x54a060
push 0
call fcn.00527ece
add esp, 8
mov dword [0x5b3e58], eax
mov eax, 0x5b010c
lock bts dword [eax], 0
jb 0x4d7461
mov esi, dword [0x5b0110]
test esi, esi
je 0x4d7430
push 0
push esi
call dword [sym.imp.ntdll.dll_NtSetEvent]
mov eax, 0xfffffffe
mov ecx, 0x5b010c
lock xadd dword [ecx], eax
shr eax, 1
and eax, 0x7fff
sub eax, 1
jne 0x4d745f
test esi, esi
je 0x4d745f
push esi
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [0x5b0110], 0
xor esi, esi
mov edx, dword [esp + 0x68]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
test eax, eax
je 0x4d8496
fld qword [0x59f0f0]
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x7c], ecx
mov ecx, dword [esp + 0x6c]
fst qword [esp + 0xa0]
fld qword [0x59f080]
mov byte [esp + 0x2f], bl
mov bx, word [0x5b0158]
mov dword [esp + 0x84], ecx
mov ecx, dword [esp + 0x6c]
fst qword [esp + 0xa8]
mov dword [esp + 0x80], 1
mov dword [esp + 0x88], 3
mov word [esp + 0x42], bx
mov dword [esp + 0x70], ecx
mov ebx, edx
mov dword [esp + 0x74], esi
mov ecx, edx
mov dword [esp + 0x50], ebx
dec eax
mov dword [esp + 0x38], 0
add edx, 0x18
mov dword [esp + 0xb0], eax
mov dword [esp + 0x68], edx
mov edx, dword [ebx]
mov eax, edx
and eax, 0x3f
mov dword [esp + 0x48], edx
cmp eax, 0xc
ja case.default.0x4d7509
jmp dword [eax*4 + 0x4d84f4]
test byte [0x5b010c], 1
jne 0x4d7465
xor edx, edx
mov ecx, eax
call sym.ProcessHacker.exe_PhfWaitForEvent
jmp 0x4d7461
cmp byte [esp + 0x2f], 0
fstp st(1)
fstp st(0)
jne 0x4d755d
lea eax, [esi + 2]
cmp dword [ebp + 0x14], eax
jae 0x4d7556
add edi, 2
mov byte [esp + 0x2f], 1
add esi, 2
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], esi
jmp 0x4d839a
mov ax, word [ebx + 0x10]
mov word [edi], ax
add edi, 2
add esi, 2
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], esi
jmp 0x4d839a
cmp byte [esp + 0x2f], 0
fstp st(1)
fstp st(0)
jne 0x4d759a
mov ecx, dword [ebx + 0x10]
lea eax, [ecx + esi]
cmp dword [ebp + 0x14], eax
jae 0x4d758d
mov byte [esp + 0x2f], 1
jmp 0x4d759a
push ecx
push dword [ebx + 0x14]
push edi
call fcn.00521a30
add esp, 0xc
mov eax, dword [ebx + 0x10]
shr eax, 1
add esi, dword [ebx + 0x10]
mov dword [esp + 0x30], esi
lea edi, [edi + eax*2]
mov dword [esp + 0x34], edi
jmp 0x4d839a
push dword [ebx + 0x10]
fstp st(1)
fstp st(0)
call sym.ProcessHacker.exe_PhCountStringZ
cmp byte [esp + 0x2f], 0
mov ebx, dword [esp + 0x30]
lea esi, [eax + eax]
jne 0x4d75ec
lea eax, [esi + ebx]
cmp dword [ebp + 0x14], eax
jae 0x4d75db
mov byte [esp + 0x2f], 1
jmp 0x4d75ec
mov eax, dword [esp + 0x50]
push esi
push dword [eax + 0x10]
push edi
call fcn.00521a30
add esp, 0xc
mov eax, esi
shr eax, 1
add ebx, esi
mov dword [esp + 0x30], ebx
lea edi, [edi + eax*2]
mov ax, word [0x5b0158]
mov dword [esp + 0x34], edi
mov word [esp + 0x42], ax
mov esi, dword [esp + 0x30]
jmp 0x4d839a
fstp st(1)
fstp st(0)
cmp edx, 3
jne 0x4d7626
mov eax, dword [esp + 0x50]
mov ebx, dword [ebx + 0x14]
mov esi, dword [eax + 0x10]
jmp 0x4d7639
mov ebx, dword [ebx + 0x10]
mov esi, ebx
lea ecx, [esi + 1]
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x4d7630
sub esi, ecx
push esi
push ebx
lea eax, [esp + 0x80]
push eax
call dword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeSize]
test eax, eax
js 0x4d7f94
cmp byte [esp + 0x2f], 0
jne 0x4d7688
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x78]
add eax, ecx
cmp dword [ebp + 0x14], eax
jae 0x4d766e
mov byte [esp + 0x2f], 1
jmp 0x4d768c
push esi
push ebx
push 0
push ecx
push edi
lfence
call dword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
lea ecx, [ecx]
test eax, eax
js 0x4d7f94
mov ecx, dword [esp + 0x78]
mov esi, dword [esp + 0x30]
mov eax, ecx
shr eax, 1
add esi, ecx
mov dword [esp + 0x30], esi
lea edi, [edi + eax*2]
mov ax, word [0x5b0158]
mov dword [esp + 0x34], edi
mov word [esp + 0x42], ax
jmp 0x4d839a
mov eax, dword [ecx + 0x10]
mov ebx, eax
cdq
shr ebx, 0x1f
mov ecx, eax
xor ecx, edx
mov dword [esp + 0x38], ebx
mov ebx, dword [esp + 0x50]
sub ecx, edx
mov edx, dword [esp + 0x48]
jmp 0x4d76d1
mov ecx, dword [ebx + 0x10]
fstp st(1)
fstp st(0)
mov dword ds:[esp + 0x54], 0xa
test edx, 0x100
je 0x4d76fe
mov dl, byte [ebx + 0xa]
mov al, dl
sub al, 2
cmp al, 0x43
ja 0x4d76fa
movzx eax, dl
mov dword [esp + 0x54], eax
mov edx, dword [esp + 0x48]
test edx, 0x20000000
mov ebx, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
mov eax, str.0123456789abcdefghijklmnopqrstuvwxyz_________._:_________
cmovne eax, ebx
xor esi, esi
mov dword [esp + 0x60], eax
lea ebx, [esp + 0x4b6]
test ecx, ecx
je 0x4d77b0
test edx, 0x10000
je 0x4d7786
xor eax, eax
mov dword [esp + 0x44], eax
mov eax, ecx
xor edx, edx
div dword [esp + 0x54]
inc esi
mov ecx, eax
mov dword [esp + 0x3c], esi
mov eax, dword [esp + 0x60]
movsx ax, byte [eax + edx]
mov word [ebx], ax
sub ebx, 2
mov eax, dword [esp + 0x44]
inc eax
mov dword [esp + 0x44], eax
cmp eax, 3
jne 0x4d777f
test ecx, ecx
je 0x4d77d1
mov ax, word [esp + 0x42]
inc esi
mov word [ebx], ax
sub ebx, 2
xor eax, eax
mov dword [esp + 0x3c], esi
mov dword [esp + 0x44], eax
nop
test ecx, ecx
jne 0x4d7736
jmp 0x4d77d1
mov edi, dword [esp + 0x60]
lea ebx, [ebx]
mov eax, ecx
xor edx, edx
div dword [esp + 0x54]
inc esi
mov ecx, eax
movsx ax, byte [edi + edx]
mov word [ebx], ax
sub ebx, 2
test ecx, ecx
jne 0x4d7790
mov edi, dword [esp + 0x34]
jmp 0x4d77cd
mov eax, 0x30
mov dword [esp + 0x48], edx
mov word [esp + 0x4b6], ax
lea ebx, [esp + 0x4b4]
mov esi, 1
mov dword [esp + 0x3c], esi
mov edx, dword [esp + 0x38]
xor ecx, ecx
mov eax, dword [esp + 0x48]
test edx, edx
je 0x4d77e6
mov ecx, 1
jmp 0x4d77f3
test eax, 0x20000
cmovne ecx, dword [esp + 0x80]
and eax, 0x50000
mov dword [esp + 0x44], ecx
cmp eax, 0x40000
jne 0x4d782d
mov eax, dword [esp + 0x50]
movzx edx, word [eax + 6]
lea eax, [ecx + esi]
cmp eax, edx
jae 0x4d7829
or dword [esp + 0x38], 4
sub edx, ecx
sub edx, esi
add ecx, edx
mov dword [esp + 0x7c], edx
mov dword [esp + 0x44], ecx
mov edx, dword [esp + 0x38]
add ebx, 2
cmp byte [esp + 0x2f], 0
jne 0x4d78c1
lea eax, [ecx + esi]
mov ecx, dword [esp + 0x30]
lea eax, [ecx + eax*2]
cmp dword [ebp + 0x14], eax
jae 0x4d7865
mov eax, dword [esp + 0x3c]
mov esi, ecx
add eax, dword [esp + 0x44]
mov byte [esp + 0x2f], 1
lea esi, [esi + eax*2]
mov dword [esp + 0x30], esi
jmp 0x4d839a
test dl, 1
je 0x4d7871
mov eax, 0x2d
jmp 0x4d7880
test dword [esp + 0x48], 0x20000
je 0x4d788a
mov eax, 0x2b
mov word [edi], ax
add edi, 2
mov dword [esp + 0x34], edi
test dl, 4
je 0x4d78ae
mov edx, dword [esp + 0x7c]
test edx, edx
je 0x4d78ab
mov ecx, edx
mov eax, 0x300030
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x34]
lea edi, [edi + edx*2]
add esi, esi
push esi
push ebx
push edi
call fcn.00521a30
add esp, 0xc
add edi, esi
mov dword [esp + 0x34], edi
mov eax, dword [esp + 0x3c]
mov esi, dword [esp + 0x30]
add eax, dword [esp + 0x44]
lea esi, [esi + eax*2]
mov dword [esp + 0x30], esi
jmp 0x4d839a
mov eax, dword [ebx + 0x10]
fstp st(1)
mov ebx, dword [ebx + 0x14]
fstp st(0)
mov dword [esp + 0x58], eax
test ebx, ebx
jg 0x4d7915
jl 0x4d78f1
test eax, eax
jae 0x4d7915
neg eax
mov dword [esp + 0x58], eax
mov eax, 1
adc ebx, 0
mov dword [esp + 0x38], eax
neg ebx
jmp 0x4d7915
mov eax, dword [ebx + 0x10]
fstp st(1)
mov ebx, dword [ebx + 0x14]
fstp st(0)
mov dword [esp + 0x58], eax
mov dword [esp + 0x54], 0xa
mov dword [esp + 0x44], 0
test edx, 0x100
je 0x4d795c
mov eax, dword [esp + 0x50]
mov dword [esp + 0x54], 0xa
mov dword [esp + 0x44], 0
mov cl, byte [eax + 0xa]
mov al, cl
sub al, 2
cmp al, 0x43
ja 0x4d795c
movzx eax, cl
cdq
mov dword [esp + 0x44], edx
mov edx, dword [esp + 0x48]
mov dword [esp + 0x54], eax
test edx, 0x20000000
mov dword [esp + 0x3c], 0
mov edx, dword [esp + 0x58]
lea esi, [esp + 0x4b6]
mov eax, str.0123456789abcdefghijklmnopqrstuvwxyz_________._:_________
mov ecx, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
cmovne eax, ecx
mov dword [esp + 0x4c], eax
mov eax, edx
or eax, ebx
je 0x4d7a64
test dword [esp + 0x48], 0x10000
je 0x4d7a18
xor eax, eax
mov dword [esp + 0x60], eax
push ebx
push dword [esp + 0x48]
push dword [esp + 0x5c]
push ebx
push edx
call fcn.0053d900
mov dword [esp + 0x60], ebx
pop ebx
mov ebx, edx
mov dword [esp + 0x58], eax
mov edx, dword [esp + 0x4c]
movsx cx, byte [edx + ecx]
mov edx, dword [esp + 0x60]
inc edx
mov dword [esp + 0x60], edx
mov word [esi], cx
sub esi, 2
mov ecx, dword [esp + 0x3c]
inc ecx
mov dword [esp + 0x3c], ecx
cmp edx, 3
jne 0x4d7a07
or eax, ebx
je 0x4d7a5e
mov ax, word [esp + 0x42]
inc ecx
mov word [esi], ax
sub esi, 2
xor eax, eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x58]
or eax, ebx
mov edx, dword [esp + 0x58]
jne 0x4d79a4
mov eax, dword [esp + 0x48]
jmp 0x4d7a89
mov edi, dword [esp + 0x54]
lea esp, [esp]
push ebx
push dword [esp + 0x48]
push edi
push ebx
push edx
call fcn.0053d900
mov dword [esp + 0x68], ebx
pop ebx
mov dword [esp + 0x58], eax
mov ebx, edx
mov eax, dword [esp + 0x4c]
mov edx, dword [esp + 0x58]
movsx ax, byte [eax + ecx]
mov ecx, dword [esp + 0x3c]
inc ecx
mov dword [esp + 0x3c], ecx
mov word [esi], ax
mov eax, edx
sub esi, 2
or eax, ebx
jne 0x4d7a20
mov edi, dword [esp + 0x34]
mov eax, dword [esp + 0x48]
jmp 0x4d7a89
mov eax, 0x30
lea esi, [esp + 0x4b4]
mov word [esp + 0x4b6], ax
mov ecx, 1
mov eax, dword [esp + 0x48]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x48], eax
mov edx, dword [esp + 0x38]
xor ebx, ebx
test edx, edx
je 0x4d7a9a
mov ebx, 1
jmp 0x4d7aa7
test eax, 0x20000
cmovne ebx, dword [esp + 0x80]
and eax, 0x50000
cmp eax, 0x40000
jne 0x4d7ada
mov eax, dword ds:[esp + 0x50]
movzx edx, word [eax + 6]
lea eax, [ebx + ecx]
cmp eax, edx
jae 0x4d7ad6
or dword [esp + 0x38], 4
sub edx, ebx
sub edx, ecx
mov dword [esp + 0x84], edx
add ebx, edx
mov edx, dword [esp + 0x38]
add esi, 2
cmp byte [esp + 0x2f], 0
mov dword [esp + 0x4c], esi
mov esi, dword [esp + 0x30]
jne 0x4d7b7e
lea eax, [ebx + ecx]
lea eax, [esi + eax*2]
cmp dword [ebp + 0x14], eax
jae 0x4d7b0f
lea eax, [ebx + ecx]
mov byte [esp + 0x2f], 1
lea esi, [esi + eax*2]
mov dword [esp + 0x30], esi
jmp 0x4d839a
test dl, 1
je 0x4d7b1b
mov eax, 0x2d
jmp 0x4d7b2a
test dword [esp + 0x48], 0x20000
je 0x4d7b34
mov eax, 0x2b
mov word [edi], ax
add edi, 2
mov dword [esp + 0x34], edi
test dl, 4
je 0x4d7b5f
mov edx, dword [esp + 0x84]
test edx, edx
je 0x4d7b5c
mov ecx, edx
mov eax, 0x300030
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x34]
mov ecx, dword [esp + 0x3c]
lea edi, [edi + edx*2]
lea esi, [ecx + ecx]
push esi
push dword [esp + 0x50]
push edi
call fcn.00521a30
mov ecx, dword [esp + 0x48]
add esp, 0xc
add edi, esi
mov esi, dword [esp + 0x30]
mov dword [esp + 0x34], edi
lea eax, [ebx + ecx]
lea esi, [esi + eax*2]
mov dword [esp + 0x30], esi
jmp 0x4d839a
mov dword [esp + 0x38], 0
fstp st(1)
fstp st(0)
test dl, 0x40
je 0x4d7bb1
movzx edx, word [ebx + 4]
cmp edx, 0xa2
jbe 0x4d7bb6
mov edx, 0xa2
jmp 0x4d7bb6
mov edx, 6
fld qword [ebx + 0x10]
lea eax, [esp + 0xb9]
mov ebx, dword [esp + 0x48]
sub esp, 0x10
mov ecx, ebx
mov dword [esp + 0x68], eax
fstp qword [esp + 8]
push eax
call fcn.005146a0
test al, al
jne 0x4d7be4
mov byte [esp + 0xb9], al
jmp 0x4d7c48
mov edx, dword [0x5b3e58]
test edx, edx
je 0x4d7c19
mov al, byte ds:[esp + 0xb9]
lea ecx, [esp + 0xb9]
test al, al
je 0x4d7c19
cmp al, 0x2e
je 0x4d7c12
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x4d7c04
jmp 0x4d7c19
mov al, byte [0x5b0114]
mov byte [ecx], al
lea esp, [esp]
test ebx, 0x20000000
je 0x4d7c48
lea eax, [esp + 0xb9]
test edx, edx
je 0x4d7c3f
push edx
push eax
call fcn.00527475
add esp, 8
jmp 0x4d7c48
push eax
call fcn.00527419
add esp, 4
mov eax, dword [esp + 0x50]
mov esi, dword [eax]
test esi, 0x8000
je 0x4d7ccf
mov cl, byte [esp + 0xb9]
lea eax, [esp + 0xb9]
mov bh, byte [0x5b0114]
test cl, cl
je 0x4d7c84
mov dl, cl
mov cl, dl
cmp dl, bh
je 0x4d7c84
mov cl, byte [eax + 1]
inc eax
mov dl, cl
test cl, cl
jne 0x4d7c74
inc eax
test cl, cl
je 0x4d7ccf
mov cl, byte [eax]
test cl, cl
je 0x4d7ca4
nop
cmp cl, 0x65
je 0x4d7ca4
cmp cl, 0x45
je 0x4d7ca4
mov cl, byte ds:[eax + 1]
inc eax
test cl, cl
jne 0x4d7c90
mov bl, byte [eax - 1]
mov edx, eax
dec eax
cmp bl, 0x30
jne 0x4d7cb9
nop
mov bl, byte [eax - 1]
dec eax
cmp bl, 0x30
je 0x4d7cb0
cmp bl, bh
lea ecx, [eax - 1]
cmovne ecx, eax
mov al, byte [edx]
lea ecx, [ecx + 1]
mov byte [ecx], al
lea edx, [edx + 1]
test al, al
jne 0x4d7cc1
lea ebx, [esp + 0xb9]
lea ecx, [ebx + 1]
lea esp, [esp]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x4d7ce0
sub ebx, ecx
cmp byte [esp + 0xb9], 0x2d
mov dword [esp + 0x60], ebx
jne 0x4d7d12
mov edx, 1
lea ecx, [esp + 0xba]
dec ebx
mov dword [esp + 0x38], edx
mov dword [esp + 0x58], ecx
mov dword [esp + 0x60], ebx
jmp 0x4d7d2d
mov ecx, dword [esp + 0x58]
test esi, 0x20000
je 0x4d7d29
mov edx, 2
mov dword [esp + 0x38], edx
jmp 0x4d7d2d
mov edx, dword [esp + 0x38]
mov eax, esi
and eax, 0x13000
cmp eax, 0x10000
jne 0x4d7e9c
mov al, byte [ecx]
mov esi, ecx
sub al, 0x30
mov dword [esp + 0x4c], ecx
cmp al, 0xa
jae 0x4d7d5e
lea ecx, [ecx]
mov al, byte [esi + 1]
inc esi
sub al, 0x30
cmp al, 0xa
jb 0x4d7d50
mov dword [esp + 0x4c], esi
mov edx, esi
sub edx, ecx
mov dword [esp + 0x3c], edx
je 0x4d7d7d
lea ecx, [edx + 2]
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
mov edx, dword [esp + 0x3c]
shr eax, 1
dec eax
jmp 0x4d7d7f
xor eax, eax
lea ecx, [eax + ebx]
mov dword [esp + 0x44], eax
mov ax, word [0x5b0158]
add ecx, ecx
cmp byte [esp + 0x2f], 0
mov word [esp + 0x42], ax
jne 0x4d7dbf
cmp dword [esp + 0x38], 0
lea eax, [ecx + 2]
cmove eax, ecx
mov ecx, dword [esp + 0x30]
add eax, ecx
cmp dword [ebp + 0x14], eax
jae 0x4d7dbf
mov eax, dword [esp + 0x3c]
mov dl, 1
mov byte [esp + 0x2f], dl
jmp 0x4d7e4e
mov ecx, edx
lea eax, [edx + 2]
xor edx, edx
div dword [esp + 0x88]
cmp byte [esp + 0x2f], 0
jne 0x4d7e42
mov eax, dword ds:[esp + 0x38]
test al, 1
je 0x4d7deb
mov eax, 0x2d
jmp 0x4d7df4
test al, 2
je 0x4d7dfe
mov eax, 0x2b
mov word [edi], ax
add edi, 2
mov dword [esp + 0x34], edi
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4d7e46
mov ebx, dword [esp + 0x58]
mov si, word [esp + 0x42]
nop
movsx ax, byte [ebx]
lea ebx, [ebx + 1]
dec ecx
mov word [edi], ax
mov eax, edx
add edi, 2
dec edx
test eax, eax
jne 0x4d7e32
test ecx, ecx
je 0x4d7e36
mov word [edi], si
lea edx, [eax + 2]
add edi, 2
test ecx, ecx
jne 0x4d7e10
mov esi, dword [esp + 0x4c]
mov ebx, dword [esp + 0x60]
mov dword [esp + 0x34], edi
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x30]
mov dl, byte [esp + 0x2f]
cmp dword [esp + 0x38], 0
je 0x4d7e5c
add ecx, 2
mov dword [esp + 0x30], ecx
add eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x30]
sub ebx, dword [esp + 0x3c]
lea ecx, [ecx + eax*2]
mov dword [esp + 0x30], ecx
test dl, dl
jne 0x4d7608
push edi
push ebx
push esi
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
mov esi, dword [esp + 0x30]
lea ecx, [ebx + ebx]
mov eax, ecx
shr eax, 1
add esi, ecx
mov dword [esp + 0x30], esi
lea edi, [edi + eax*2]
mov dword [esp + 0x34], edi
jmp 0x4d839a
xor ecx, ecx
test edx, edx
setne cl
mov edx, ecx
test esi, 0x40000
je 0x4d7ece
mov eax, dword [esp + 0x50]
movzx esi, word [eax + 6]
lea eax, [ebx + ecx]
cmp eax, esi
jae 0x4d7ece
or dword [esp + 0x38], 4
mov eax, esi
sub eax, ecx
sub eax, ebx
mov dword [esp + 0x70], eax
lea edx, [ecx + eax]
mov cl, byte [esp + 0x2f]
mov esi, dword [esp + 0x30]
test cl, cl
jne 0x4d7f57
lea eax, [edx + ebx]
lea eax, [esi + eax*2]
cmp dword [ebp + 0x14], eax
jae 0x4d7f05
mov ax, word [0x5b0158]
lea esi, [esi + edx*2]
mov byte [esp + 0x2f], 1
mov dword [esp + 0x30], esi
mov word [esp + 0x42], ax
jmp 0x4d839a
mov eax, dword [esp + 0x38]
test al, 1
je 0x4d7f14
mov eax, 0x2d
jmp 0x4d7f1d
test al, 2
je 0x4d7f2b
mov eax, 0x2b
mov word [edi], ax
add edi, 2
mov eax, dword [esp + 0x38]
mov dword [esp + 0x34], edi
test al, 4
je 0x4d7f57
mov eax, dword [esp + 0x70]
test eax, eax
je 0x4d7f4f
mov ecx, eax
mov eax, 0x300030
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x34]
mov eax, dword [esp + 0x70]
lea edi, [edi + eax*2]
lea esi, [esi + edx*2]
jmp 0x4d7f64
lea esi, ds:[esi + edx*2]
mov dword [esp + 0x30], esi
test cl, cl
jne 0x4d7f98
mov eax, dword [esp + 0x58]
push edi
push ebx
push eax
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
lea ecx, [ebx + ebx]
mov eax, ecx
shr eax, 1
add esi, ecx
mov dword [esp + 0x30], esi
lea edi, [edi + eax*2]
mov ax, word [0x5b0158]
mov dword [esp + 0x34], edi
mov word [esp + 0x42], ax
jmp 0x4d839a
mov esi, dword [esp + 0x30]
mov ax, word [0x5b0158]
mov word [esp + 0x42], ax
jmp 0x4d839a
mov eax, dword [esp + 0x50]
xor ebx, ebx
mov dword [esp + 0x98], ebx
mov dword [esp + 0x54], ebx
mov esi, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
mov eax, edx
mov ecx, edx
mov dword [esp + 0x90], esi
and eax, 0x7fffffff
and ecx, 0x80000000
or esi, edx
mov dword [esp + 0x94], eax
fild qword [esp + 0x90]
mov dword [esp + 0x9c], ecx
fild qword [esp + 0x98]
fchs
faddp st(1)
jne 0x4d8048
fstp st(0)
mov esi, dword [esp + 0x30]
fstp st(1)
fstp st(0)
cmp byte [esp + 0x2f], bl
jne 0x4d8035
lea eax, [esi + 2]
cmp dword [ebp + 0x14], eax
jae 0x4d802d
add edi, 2
mov byte [esp + 0x2f], 1
add esi, 2
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], esi
jmp 0x4d839a
mov eax, 0x30
mov word [edi], ax
add edi, 2
add esi, 2
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], esi
jmp 0x4d839a
mov edx, dword [esp + 0x48]
mov esi, dword [esp + 0x50]
test edx, 0x100
je 0x4d805e
movzx ecx, byte [esi + 0xa]
jmp 0x4d8064
mov ecx, dword [0x5b0a08]
fcomi st(2)
jb 0x4d807c
cmp ebx, 7
jae 0x4d8078
cmp ebx, ecx
jae 0x4d8078
fmul st(1)
inc ebx
fcomi st(2)
jae 0x4d8068
mov dword [esp + 0x54], ebx
fstp st(2)
fstp st(0)
test dl, 0x40
je 0x4d808b
movzx eax, word [esi + 4]
jmp 0x4d8090
mov eax, 2
movzx edx, ax
mov ecx, 0x1804b
cmp edx, 0xa2
mov dword [esp + 0x44], 0
mov eax, 0xa2
cmova edx, eax
sub esp, 0x10
lea eax, [esp + 0xc9]
mov dword [esp + 0x70], eax
fstp qword [esp + 8]
push eax
call fcn.005146a0
test al, al
jne 0x4d8197
xor dh, dh
mov byte [esp + 0xb9], dh
mov bx, word [0x5b0114]
mov cl, dh
lea eax, [esp + 0xb9]
test cl, cl
je 0x4d8104
mov dl, cl
lea ecx, [ecx]
mov cl, dl
cmp dl, bl
je 0x4d8104
mov cl, byte ds:[eax + 1]
inc eax
mov dl, cl
test cl, cl
jne 0x4d80f0
inc eax
test cl, cl
je 0x4d815a
mov cl, byte [eax]
test cl, cl
je 0x4d8125
cmp cl, 0x65
je 0x4d8125
cmp cl, 0x45
je 0x4d8125
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4d8113
mov bl, byte [eax - 1]
mov edx, eax
dec eax
cmp bl, 0x30
jne 0x4d8139
mov bl, byte [eax - 1]
dec eax
cmp bl, 0x30
je 0x4d8130
cmp bl, byte [0x5b0114]
lea ecx, [eax - 1]
cmovne ecx, eax
mov al, byte [edx]
lea ecx, [ecx + 1]
mov byte [ecx], al
lea edx, [edx + 1]
test al, al
jne 0x4d8145
mov dh, byte [esp + 0xb9]
lea esi, [esp + 0xb9]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4d8164
sub esi, ecx
mov dword [esp + 0x4c], esi
cmp dh, 0x2d
jne 0x4d81e6
lea ecx, [esp + 0xba]
mov dword [esp + 0x44], 1
dec esi
mov dword [esp + 0x60], ecx
mov dword [esp + 0x4c], esi
jmp 0x4d81ea
cmp dword [0x5b3e58], 0
mov dh, byte [esp + 0xb9]
je 0x4d80d7
lea ecx, [esp + 0xb9]
test dh, dh
je 0x4d80d7
mov al, dh
lea esp, [esp]
cmp al, 0x2e
je 0x4d81d1
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x4d81c0
jmp 0x4d80d7
mov bx, word [0x5b0114]
mov byte [ecx], bl
mov dh, byte [esp + 0xb9]
jmp 0x4d80de
mov ecx, dword [esp + 0x60]
mov al, byte [ecx]
mov ebx, ecx
sub al, 0x30
mov dword [esp + 0x58], ecx
cmp al, 0xa
jae 0x4d8208
mov al, byte ds:[ebx + 1]
inc ebx
sub al, 0x30
cmp al, 0xa
jb 0x4d81f8
mov dword [esp + 0x58], ebx
mov edx, ebx
sub edx, ecx
mov dword [esp + 0x3c], edx
je 0x4d8227
lea ecx, [edx + 2]
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
mov edx, dword [esp + 0x3c]
shr eax, 1
dec eax
jmp 0x4d8229
xor eax, eax
lea ecx, [eax + esi]
mov dword [esp + 0x38], eax
mov ax, word [0x5b0158]
add ecx, ecx
cmp byte [esp + 0x2f], 0
mov word [esp + 0x42], ax
jne 0x4d8268
cmp dword [esp + 0x44], 0
lea eax, [ecx + 2]
cmove eax, ecx
mov ecx, dword [esp + 0x30]
add eax, ecx
cmp dword [ebp + 0x14], eax
jae 0x4d8268
mov eax, dword [esp + 0x3c]
mov byte [esp + 0x2f], 1
jmp 0x4d82e7
mov ecx, edx
lea eax, [edx + 2]
xor edx, edx
div dword [esp + 0x88]
cmp byte [esp + 0x2f], 0
jne 0x4d82df
cmp dword [esp + 0x44], 0
je 0x4d8298
mov eax, 0x2d
mov word [edi], ax
add edi, 2
mov eax, dword ds:[esp + 0x3c]
test eax, eax
je 0x4d82e3
mov esi, dword [esp + 0x60]
mov bx, word [esp + 0x42]
movsx ax, byte [esi]
lea esi, [esi + 1]
dec ecx
mov word [edi], ax
mov eax, edx
add edi, 2
dec edx
test eax, eax
jne 0x4d82d3
test ecx, ecx
je 0x4d82d7
mov word [edi], bx
lea edx, [eax + 2]
add edi, 2
test ecx, ecx
jne 0x4d82b1
mov esi, dword [esp + 0x4c]
mov ebx, dword [esp + 0x58]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x30]
cmp dword [esp + 0x44], 0
je 0x4d82f5
add ecx, 2
mov dword [esp + 0x30], ecx
add eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x30]
sub esi, dword [esp + 0x3c]
cmp byte [esp + 0x2f], 0
lea edx, [ecx + eax*2]
mov dword [esp + 0x60], edx
jne 0x4d8374
push edi
push esi
push ebx
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
mov edx, dword ds:[esp + 0x60]
lea ecx, [esi + esi]
mov esi, dword [esp + 0x54]
mov eax, ecx
shr eax, 1
add edx, ecx
mov dword [esp + 0x60], edx
lea edi, [edi + eax*2]
mov eax, dword [esi*8 + 0x5b0120]
add eax, 2
add eax, edx
cmp dword [ebp + 0x14], eax
jae 0x4d834c
mov byte [esp + 0x2f], 1
jmp 0x4d8378
mov eax, 0x20
mov word [edi], ax
lea eax, [edi + 2]
push dword [esi*8 + 0x5b0120]
push dword [esi*8 + 0x5b0124]
push eax
call fcn.00521a30
mov edx, dword [esp + 0x6c]
add esp, 0xc
jmp 0x4d8378
mov esi, dword [esp + 0x54]
mov ecx, dword [esi*8 + 0x5b0120]
lea eax, [ecx + 2]
shr eax, 1
lea esi, [ecx + 2]
add esi, edx
mov dword [esp + 0x30], esi
lea edi, [edi + eax*2]
mov dword [esp + 0x34], edi
jmp 0x4d839a
fstp st(1)
fstp st(0)
mov ebx, dword [esp + 0x50]
mov ecx, esi
sub ecx, dword [esp + 0x74]
mov edx, dword [ebx]
test edx, 0xc0000000
je 0x4d846a
movzx esi, word ds:[ebx + 6]
add esi, esi
cmp ecx, esi
jae 0x4d8466
sub esi, ecx
cmp byte [esp + 0x2f], 0
jne 0x4d8457
mov eax, dword ds:[esp + 0x30]
add eax, esi
cmp dword [ebp + 0x14], eax
jae 0x4d83ef
mov byte [esp + 0x2f], 1
jmp 0x4d8457
test dl, dl
jns 0x4d83f9
movzx eax, word [ebx + 8]
jmp 0x4d83fe
mov eax, 0x20
mov ebx, esi
mov dword [esp + 0x4c], eax
shr ebx, 1
test edx, edx
jns 0x4d8414
test ebx, ebx
je 0x4d8457
jmp 0x4d843e
mov eax, ecx
mov edx, edi
and eax, 0xfffffffe
sub edx, eax
push ecx
push edx
lfence
lea eax, [edx + ebx*2]
mov dword [esp + 0x7c], edx
push eax
call fcn.005214b0
add esp, 0xc
test ebx, ebx
je 0x4d8457
mov eax, dword [esp + 0x4c]
mov edi, dword [esp + 0x74]
movzx edx, ax
mov ecx, ebx
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x34]
mov eax, esi
shr eax, 1
add dword [esp + 0x30], esi
lea edi, [edi + eax*2]
mov dword [esp + 0x34], edi
mov esi, dword [esp + 0x30]
mov eax, dword [esp + 0xb0]
fld qword [esp + 0xa0]
fld qword [esp + 0xa8]
mov edx, dword [esp + 0x68]
test eax, eax
jne 0x4d74ce
mov bl, byte [esp + 0x2f]
fstp st(1)
mov ecx, dword [ebp + 0x14]
fstp st(0)
test bl, bl
jne 0x4d84aa
lea eax, ds:[esi + 2]
cmp ecx, eax
jae 0x4d84eb
mov bl, 1
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x4d84be
test ecx, ecx
je 0x4d84be
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [esp + 0x6c]
test ecx, ecx
je 0x4d84cb
lea eax, [esi + 2]
mov dword [ecx], eax
mov ecx, dword ds:[esp + 0x4bc]
test bl, bl
pop edi
pop esi
sete al
pop ebx
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret 0x14
xor eax, eax
mov word [edi], ax
jmp 0x4d84be