Function at 0x4d5f60
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x4b4
mov eax, dword [0x5ac004]
xor eax, esp
mov dword [esp + 0x4b0], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ebx
push esi
mov esi, 0x26
mov dword [esp + 0x78], ecx
cmp eax, esi
push edi
push dword [0x5b1d70]
cmovae esi, eax
mov dword [esp + 0x34], esi
lea eax, [esi + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov ecx, eax
mov dword [esp + 0x40], esi
lea eax, [ecx + 8]
mov dword [esp + 0x34], ecx
xor edx, edx
xor edi, edi
mov dword [esp + 0x2c], edi
mov dword [ecx + 4], eax
mov dword [ecx], esi
mov word [eax + esi], dx
test byte [0x5b010c], 1
mov ebx, dword [ecx + 4]
mov dword [esp + 0x48], ebx
jne 0x4d60df
mov eax, 0x5b010c
lock bts dword [eax], 0x1f
jb 0x4d6170
push 4
lea eax, [esp + 0xb4]
push eax
push 0xe
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov edi, edi
test eax, eax
je 0x4d602d
mov ax, word [esp + 0xb0]
test ax, ax
je 0x4d602d
movzx ecx, word [0x5b0114]
cmp word [esp + 0xb2], di
movzx eax, ax
cmove ecx, eax
mov word [0x5b0114], cx
push 4
lea eax, [esp + 0xb4]
push eax
push 0xf
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4d6073
mov ax, word [esp + 0xb0]
test ax, ax
je 0x4d6073
movzx ecx, word [0x5b0158]
cmp word [esp + 0xb2], di
movzx eax, ax
cmove ecx, eax
mov word [0x5b0158], cx
cmp word [0x5b0114], 0x2e
je 0x4d6091
push 0x54a060
push 0
call fcn.00527ece
add esp, 8
mov dword [0x5b3e58], eax
mov eax, 0x5b010c
lock bts dword [eax], 0
jb 0x4d60df
mov esi, dword [0x5b0110]
test esi, esi
je 0x4d60b0
push 0
push esi
call dword [sym.imp.ntdll.dll_NtSetEvent]
mov eax, 0xfffffffe
mov ecx, 0x5b010c
lock xadd dword [ecx], eax
shr eax, 1
and eax, 0x7fff
sub eax, 1
jne 0x4d60db
test esi, esi
je 0x4d60db
push esi
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [0x5b0110], edi
mov esi, dword [esp + 0x30]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4d729b
fld qword [0x59f0f0]
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x80], ecx
mov ecx, dword [esp + 0x74]
fst qword [esp + 0xa0]
fld qword [0x59f080]
mov dword [esp + 0x84], ecx
mov ecx, dword [esp + 0x74]
fst qword [esp + 0xa8]
mov dword [esp + 0x8c], 3
mov dword [esp + 0x88], ecx
mov edx, dword ds:[esp + 0x7c]
dec eax
mov dword [esp + 0x74], eax
mov ecx, edx
mov eax, edx
mov dword [esp + 0x70], edi
add edx, 0x18
mov dword [esp + 0x38], eax
mov dword [esp + 0x7c], edx
mov dword [esp + 0x3c], 0
mov edx, dword [eax]
mov eax, edx
and eax, 0x3f
mov dword [esp + 0x64], edx
cmp eax, 0xc
ja case.default.0x4d6169
jmp dword [eax*4 + 0x4d72c8]
test byte [0x5b010c], 1
jne 0x4d60df
xor edx, edx
mov ecx, eax
call sym.ProcessHacker.exe_PhfWaitForEvent
jmp 0x4d60df
lea esi, [edi + 2]
fstp st(1)
fstp st(0)
cmp dword [esp + 0x30], esi
jae 0x4d61bc
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x40]
push 2
push edi
call fcn.004d5ee0
mov dword [esp + 0x34], eax
shr edi, 1
mov eax, dword [eax + 4]
lea ebx, [eax + edi*2]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x30], eax
mov ecx, dword [esp + 0x38]
mov edi, esi
mov dword [esp + 0x2c], edi
mov ax, word [ecx + 0x10]
mov word [ebx], ax
add ebx, 2
mov dword [esp + 0x48], ebx
jmp 0x4d7101
mov ecx, dword [esp + 0x38]
fstp st(1)
fstp st(0)
mov ecx, dword [ecx + 0x10]
lea eax, [ecx + edi]
cmp esi, eax
jae 0x4d6219
push ecx
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0x44]
push edi
call fcn.004d5ee0
mov esi, dword [esp + 0x38]
mov ecx, edi
mov dword [esp + 0x34], eax
shr ecx, 1
mov eax, dword [eax + 4]
lea ebx, [eax + ecx*2]
mov eax, dword [esp + 0x40]
mov ecx, dword [esi + 0x10]
mov dword [esp + 0x30], eax
jmp 0x4d621d
mov esi, dword [esp + 0x38]
push ecx
push dword [esi + 0x14]
push ebx
call fcn.00521a30
mov eax, dword ds:[esi + 0x10]
add esp, 0xc
shr eax, 1
add edi, dword [esi + 0x10]
mov dword [esp + 0x2c], edi
lea ebx, [ebx + eax*2]
mov dword [esp + 0x48], ebx
jmp 0x4d7101
mov ecx, dword [esp + 0x38]
fstp st(1)
fstp st(0)
push dword [ecx + 0x10]
call sym.ProcessHacker.exe_PhCountStringZ
lea esi, ds:[eax + eax]
add edi, esi
cmp dword [esp + 0x30], edi
jae 0x4d6290
mov ebx, dword [esp + 0x2c]
lea edx, [esp + 0x40]
mov ecx, dword [esp + 0x34]
push esi
push ebx
lfence
call fcn.004d5ee0
mov dword [esp + 0x34], eax
shr ebx, 1
mov eax, dword [eax + 4]
lea ebx, [eax + ebx*2]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x38]
push esi
push dword [eax + 0x10]
push ebx
call fcn.00521a30
add esp, 0xc
mov dword [esp + 0x2c], edi
shr esi, 1
lea ebx, [ebx + esi*2]
mov dword [esp + 0x48], ebx
jmp 0x4d7101
mov eax, dword ds:[esp + 0x38]
fstp st(1)
fstp st(0)
cmp edx, 3
jne 0x4d62cd
mov edi, dword [eax + 0x14]
mov esi, dword [eax + 0x10]
jmp 0x4d62de
mov edi, dword [eax + 0x10]
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4d62d5
sub esi, ecx
push esi
push edi
lea eax, [esp + 0x80]
push eax
call dword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeSize]
test eax, eax
js 0x4d6d3d
mov edx, dword [esp + 0x2c]
lfence
mov ecx, dword [esp + 0x78]
lea eax, [ecx + edx]
cmp dword [esp + 0x30], eax
jae 0x4d6339
push ecx
mov ecx, dword [esp + 0x38]
push edx
lea edx, [esp + 0x48]
call fcn.004d5ee0
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x34], eax
shr ecx, 1
mov eax, dword [eax + 4]
lea ebx, [eax + ecx*2]
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x48], ebx
mov dword [esp + 0x30], eax
push esi
push edi
push 0
push ecx
push ebx
call dword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
test eax, eax
js 0x4d6d3d
mov eax, dword [esp + 0x78]
mov edi, dword [esp + 0x2c]
shr eax, 1
add edi, dword [esp + 0x78]
mov dword [esp + 0x2c], edi
lea ebx, [ebx + eax*2]
mov dword [esp + 0x48], ebx
jmp 0x4d7101
mov eax, dword [ecx + 0x10]
mov ecx, eax
shr ecx, 0x1f
cdq
mov dword [esp + 0x3c], ecx
mov ecx, eax
mov eax, dword [esp + 0x38]
xor ecx, edx
sub ecx, edx
mov edx, dword [esp + 0x64]
jmp 0x4d6390
mov eax, dword [esp + 0x38]
mov ecx, dword [eax + 0x10]
fstp st(1)
fstp st(0)
mov dword ds:[esp + 0x4c], 0xa
test edx, 0x100
je 0x4d63ba
mov al, byte [eax + 0xa]
cmp al, 2
jb 0x4d63ba
cmp al, 0x45
ja 0x4d63ba
movzx eax, al
mov dword [esp + 0x4c], eax
test edx, 0x20000000
lea edi, [esp + 0x4b6]
mov esi, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
mov eax, str.0123456789abcdefghijklmnopqrstuvwxyz_________._:_________
cmovne eax, esi
xor esi, esi
mov dword [esp + 0x58], eax
test ecx, ecx
je 0x4d6472
test edx, 0x10000
je 0x4d644e
xor eax, eax
mov dword [esp + 0x50], eax
mov eax, ecx
xor edx, edx
div dword [esp + 0x4c]
inc esi
mov ecx, eax
mov eax, dword [esp + 0x58]
movsx ax, byte [eax + edx]
mov word [edi], ax
sub edi, 2
mov eax, dword [esp + 0x50]
inc eax
mov dword [esp + 0x50], eax
cmp eax, 3
jne 0x4d6437
mov edi, edi
test ecx, ecx
je 0x4d643b
mov ax, word [0x5b0158]
inc esi
mov word [edi], ax
sub edi, 2
xor eax, eax
mov dword [esp + 0x50], eax
test ecx, ecx
jne 0x4d63f6
mov edx, dword [esp + 0x64]
xor ecx, ecx
cmp dword [esp + 0x3c], ecx
je 0x4d648b
mov ecx, 1
jmp 0x4d6499
mov ebx, dword [esp + 0x58]
mov eax, ecx
xor edx, edx
div dword [esp + 0x4c]
inc esi
mov ecx, eax
movsx ax, byte [ebx + edx]
mov word [edi], ax
sub edi, 2
test ecx, ecx
jne 0x4d6452
mov ebx, dword [esp + 0x48]
jmp 0x4d643b
mov eax, 0x30
lea edi, [esp + 0x4b4]
mov word [esp + 0x4b6], ax
lea esi, [eax - 0x2f]
jmp 0x4d643f
test edx, 0x20000
mov eax, 1
cmovne ecx, eax
and edx, 0x50000
cmp edx, 0x40000
jne 0x4d64cb
mov eax, dword [esp + 0x38]
movzx edx, word [eax + 6]
lea eax, [ecx + esi]
cmp eax, edx
jae 0x4d64cb
or dword [esp + 0x3c], 4
mov eax, edx
sub eax, ecx
sub eax, esi
mov dword [esp + 0x80], eax
add ecx, eax
lea eax, [ecx + esi]
add edi, 2
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x44], edi
lea ecx, [ecx + eax*2]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x58], ecx
cmp eax, ecx
jae 0x4d6564
add eax, eax
mov edx, ecx
cmp eax, ecx
lfence
push dword [0x5b1d70]
cmovae edx, eax
mov dword [esp + 0x34], edx
lea eax, [edx + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
push dword [esp + 0x2c]
mov ebx, eax
xor edx, edx
mov eax, dword [esp + 0x34]
lea ecx, [ebx + 8]
mov dword [ebx], eax
mov dword [ebx + 4], ecx
mov word [ecx + eax], dx
mov eax, dword [esp + 0x38]
push dword [eax + 4]
push dword [ebx + 4]
call fcn.00521a30
mov ecx, dword [esp + 0x40]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4d654c
call fcn.004b3960
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x40], eax
mov eax, dword [ebx + 4]
shr ecx, 1
mov dword [esp + 0x34], ebx
lea ebx, [eax + ecx*2]
mov eax, dword [esp + 0x3c]
test al, 1
je 0x4d6573
mov ecx, 0x2d
jmp 0x4d6584
mov ecx, dword [esp + 0x38]
test dword [ecx], 0x20000
je 0x4d658a
mov ecx, 0x2b
mov word [ebx], cx
add ebx, 2
test al, 4
je 0x4d65b2
mov edx, dword [esp + 0x80]
test edx, edx
je 0x4d65af
mov ecx, edx
mov eax, 0x300030
shr ecx, 1
mov edi, ebx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x44]
lea ebx, [ebx + edx*2]
add esi, esi
push esi
push edi
push ebx
call fcn.00521a30
mov edi, dword [esp + 0x64]
add esp, 0xc
add ebx, esi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x48], ebx
jmp 0x4d7101
mov eax, dword [esp + 0x38]
fstp st(1)
fstp st(0)
mov esi, dword [eax + 0x14]
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x50], ecx
test esi, esi
jg 0x4d6611
jl 0x4d65ee
test ecx, ecx
jae 0x4d6611
neg ecx
mov dword [esp + 0x3c], 1
adc esi, 0
neg esi
jmp 0x4d660d
mov eax, dword [esp + 0x38]
fstp st(1)
fstp st(0)
mov ecx, dword [eax + 0x10]
mov esi, dword [eax + 0x14]
mov dword [esp + 0x50], ecx
mov dword [esp + 0x4c], 0xa
mov dword [esp + 0x68], 0
test edx, 0x100
je 0x4d6668
mov al, byte ds:[eax + 0xa]
mov dword [esp + 0x4c], 0xa
mov dword [esp + 0x68], 0
cmp al, 2
jb 0x4d6668
mov dword [esp + 0x4c], 0xa
mov dword [esp + 0x68], 0
cmp al, 0x45
ja 0x4d6668
movzx eax, al
cdq
mov dword [esp + 0x68], edx
mov edx, dword [esp + 0x64]
mov dword [esp + 0x4c], eax
test edx, 0x20000000
mov dword [esp + 0x6c], 0
mov edi, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
mov eax, str.0123456789abcdefghijklmnopqrstuvwxyz_________._:_________
cmovne eax, edi
lea edi, [esp + 0x4b6]
mov dword [esp + 0x44], eax
mov eax, ecx
or eax, esi
je 0x4d676e
mov ebx, dword ds:[esp + 0x50]
test edx, 0x10000
je 0x4d6735
xor eax, eax
mov dword [esp + 0x58], eax
push ebx
push dword [esp + 0x6c]
push dword [esp + 0x54]
push esi
push ebx
call fcn.0053d900
mov dword [esp + 0x58], ebx
pop ebx
mov ebx, eax
mov esi, edx
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x6c]
inc edx
mov dword [esp + 0x6c], edx
movsx cx, byte [eax + ecx]
mov word [edi], cx
sub edi, 2
mov ecx, dword [esp + 0x58]
inc ecx
mov dword [esp + 0x58], ecx
cmp ecx, 3
jne 0x4d6711
mov eax, ebx
or eax, esi
je 0x4d6717
mov ax, word [0x5b0158]
inc edx
mov word [edi], ax
sub edi, 2
xor eax, eax
mov dword [esp + 0x6c], edx
mov dword [esp + 0x58], eax
mov eax, ebx
or eax, esi
jne 0x4d66b2
mov ebx, dword [esp + 0x48]
mov eax, dword [esp + 0x64]
xor ecx, ecx
cmp dword [esp + 0x3c], ecx
je 0x4d678d
mov ecx, 1
jmp 0x4d679a
push ebx
push dword [esp + 0x6c]
push dword [esp + 0x54]
push esi
push ebx
call fcn.0053d900
mov dword [esp + 0x60], ebx
pop ebx
mov ebx, eax
mov esi, edx
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x6c]
inc edx
mov dword [esp + 0x6c], edx
movsx ax, byte [eax + ecx]
mov word [edi], ax
mov eax, ebx
sub edi, 2
or eax, esi
jne 0x4d6735
jmp 0x4d6717
mov eax, 0x30
lea edi, [esp + 0x4b4]
mov edx, 1
mov word [esp + 0x4b6], ax
mov dword [esp + 0x6c], edx
jmp 0x4d671b
test eax, 0x20000
mov esi, 1
cmovne ecx, esi
and eax, 0x50000
cmp eax, 0x40000
jne 0x4d67ca
mov eax, dword [esp + 0x38]
movzx esi, word [eax + 6]
lea eax, [ecx + edx]
cmp eax, esi
jae 0x4d67ca
or dword [esp + 0x3c], 4
mov eax, esi
sub eax, ecx
sub eax, edx
mov dword [esp + 0x84], eax
add ecx, eax
lea eax, [ecx + edx]
add edi, 2
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x44], edi
lea ecx, [ecx + eax*2]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x58], ecx
cmp eax, ecx
jae 0x4d6860
add eax, eax
mov ebx, ecx
cmp eax, ecx
lfence
push dword [0x5b1d70]
cmovae ebx, eax
mov dword [esp + 0x34], ebx
lea eax, [ebx + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov esi, eax
xor eax, eax
lea ecx, [esi + 8]
mov dword [esi], ebx
mov dword [esi + 4], ecx
mov word [ecx + ebx], ax
mov eax, dword [esp + 0x34]
mov ebx, dword [esp + 0x2c]
push ebx
push dword [eax + 4]
push dword [esi + 4]
call fcn.00521a30
mov ecx, dword [esp + 0x40]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4d6848
call fcn.004b3960
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x6c]
mov dword [esp + 0x40], eax
mov eax, dword [esi + 4]
shr ebx, 1
mov dword [esp + 0x34], esi
lea ebx, [eax + ebx*2]
mov eax, dword [esp + 0x3c]
test al, 1
je 0x4d686f
mov ecx, 0x2d
jmp 0x4d6880
mov ecx, dword [esp + 0x38]
test dword [ecx], 0x20000
je 0x4d6886
mov ecx, 0x2b
mov word [ebx], cx
add ebx, 2
test al, 4
je 0x4d68ae
mov esi, dword [esp + 0x84]
test esi, esi
je 0x4d68ab
mov ecx, esi
mov eax, 0x300030
shr ecx, 1
mov edi, ebx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x44]
lea ebx, [ebx + esi*2]
lea esi, [edx + edx]
push esi
push edi
push ebx
call fcn.00521a30
mov edi, dword [esp + 0x64]
add esp, 0xc
add ebx, esi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x48], ebx
jmp 0x4d7101
mov eax, dword ds:[esp + 0x38]
fstp st(1)
mov dword [esp + 0x3c], 0
fstp st(0)
test dl, 0x40
je 0x4d68f8
movzx edx, word [eax + 4]
cmp edx, 0xa2
jbe 0x4d68fd
mov edx, 0xa2
jmp 0x4d68fd
mov edx, 6
fld qword ds:[eax + 0x10]
lea edi, [esp + 0xb9]
mov esi, dword [esp + 0x64]
sub esp, 0x10
mov eax, edi
mov dword [esp + 0x60], edi
mov ecx, esi
fstp qword [esp + 8]
push eax
call fcn.005146a0
test al, al
jne 0x4d6935
mov byte [esp + 0xb9], al
jmp 0x4d6993
mov edx, dword [0x5b3e58]
test edx, edx
je 0x4d6966
mov al, byte [esp + 0xb9]
lea ecx, [esp + 0xb9]
test al, al
je 0x4d6966
cmp al, 0x2e
je 0x4d695f
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x4d6951
jmp 0x4d6966
mov al, byte [0x5b0114]
mov byte [ecx], al
test esi, 0x20000000
je 0x4d6993
lea eax, [esp + 0xb9]
test edx, edx
je 0x4d698a
push edx
push eax
call fcn.00527475
add esp, 8
jmp 0x4d6993
push eax
call fcn.00527419
add esp, 4
mov eax, dword ds:[esp + 0x38]
mov edi, dword [eax]
test edi, 0x8000
je 0x4d6a1e
mov al, byte [esp + 0xb9]
lea ecx, [esp + 0xb9]
mov ah, byte [0x5b0114]
test al, al
je 0x4d69d0
cmp al, ah
je 0x4d69d0
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x4d69c4
mov al, byte [ecx]
inc ecx
test al, al
je 0x4d6a1e
mov al, byte [ecx]
test al, al
je 0x4d69f0
lea ecx, [ecx]
cmp al, 0x65
je 0x4d69f0
cmp al, 0x45
je 0x4d69f0
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x4d69e0
mov al, byte [ecx - 1]
mov esi, ecx
dec ecx
cmp al, 0x30
jne 0x4d6a08
lea ebx, [ebx]
mov al, byte [ecx - 1]
dec ecx
cmp al, 0x30
je 0x4d6a00
cmp al, ah
lea edx, [ecx - 1]
cmovne edx, ecx
mov al, byte [esi]
lea edx, [edx + 1]
mov byte [edx], al
lea esi, [esi + 1]
test al, al
jne 0x4d6a10
lea esi, [esp + 0xb9]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4d6a28
sub esi, ecx
cmp byte [esp + 0xb9], 0x2d
mov dword [esp + 0x44], esi
jne 0x4d6a56
lea ecx, [esp + 0xba]
dec esi
mov edx, 1
mov dword [esp + 0x50], ecx
mov dword [esp + 0x44], esi
jmp 0x4d6a6c
mov edx, dword [esp + 0x3c]
test edi, 0x20000
mov ecx, dword [esp + 0x50]
mov eax, 2
cmovne edx, eax
mov eax, edi
mov dword [esp + 0x3c], edx
and eax, 0x13000
cmp eax, 0x10000
jne 0x4d6c0f
mov al, byte [ecx]
mov edi, ecx
sub al, 0x30
cmp al, 0xa
jae 0x4d6a9f
mov al, byte [edi + 1]
inc edi
sub al, 0x30
cmp al, 0xa
jb 0x4d6a95
mov eax, edi
sub eax, ecx
mov dword [esp + 0x58], eax
je 0x4d6aba
lea ecx, [eax + 2]
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
shr eax, 1
dec eax
jmp 0x4d6abc
xor eax, eax
lea ecx, ds:[eax + esi]
mov dword [esp + 0x4c], eax
add ecx, ecx
cmp dword [esp + 0x3c], 0
lea eax, [ecx + 2]
cmove eax, ecx
mov ecx, dword [esp + 0x2c]
add ecx, eax
mov eax, dword [esp + 0x30]
cmp eax, ecx
jae 0x4d6b60
add eax, eax
mov edx, ecx
cmp eax, ecx
lfence
push dword [0x5b1d70]
cmovae edx, eax
mov dword [esp + 0x34], edx
lea eax, [edx + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
push dword [esp + 0x2c]
mov ebx, eax
xor edx, edx
mov eax, dword [esp + 0x34]
lea ecx, [ebx + 8]
mov dword [ebx], eax
mov dword [ebx + 4], ecx
mov word [eax + ecx], dx
mov eax, dword [esp + 0x38]
push dword [eax + 4]
push dword [ebx + 4]
call fcn.00521a30
mov ecx, dword [esp + 0x40]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4d6b48
call fcn.004b3960
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x40], eax
mov eax, dword [ebx + 4]
shr ecx, 1
mov dword [esp + 0x34], ebx
lea ebx, [eax + ecx*2]
mov eax, dword [esp + 0x58]
xor edx, edx
mov ecx, eax
add eax, 2
div dword [esp + 0x8c]
mov eax, dword [esp + 0x3c]
test al, 1
je 0x4d6b82
mov eax, 0x2d
jmp 0x4d6b8b
test al, 2
je 0x4d6b91
mov eax, 0x2b
mov word [ebx], ax
add ebx, 2
mov eax, dword [esp + 0x58]
test eax, eax
je 0x4d6bd6
mov esi, dword [esp + 0x50]
lea ecx, [ecx]
movsx ax, byte [esi]
lea esi, [esi + 1]
dec ecx
mov word [ebx], ax
mov eax, edx
add ebx, 2
dec edx
test eax, eax
jne 0x4d6bca
test ecx, ecx
je 0x4d6bce
mov ax, word [0x5b0158]
mov edx, 2
mov word [ebx], ax
add ebx, 2
test ecx, ecx
jne 0x4d6ba0
mov esi, dword [esp + 0x44]
mov eax, dword [esp + 0x58]
cmp dword [esp + 0x3c], 0
mov edx, ebx
je 0x4d6be4
add dword [esp + 0x2c], 2
mov ecx, esi
sub ecx, eax
mov eax, dword [esp + 0x4c]
add eax, esi
mov esi, dword [esp + 0x2c]
push edx
push ecx
lea ebx, [ebx + ecx*2]
lea esi, [esi + eax*2]
mov dword [esp + 0x50], ebx
push edi
mov dword [esp + 0x38], esi
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
mov edi, esi
jmp 0x4d7101
xor ecx, ecx
test edx, edx
setne cl
mov edx, ecx
test edi, 0x40000
je 0x4d6c4c
mov eax, dword [esp + 0x38]
movzx edi, word [eax + 6]
lea eax, [ecx + esi]
cmp eax, edi
jae 0x4d6c4c
or dword [esp + 0x3c], 4
mov eax, edi
sub eax, ecx
sub eax, esi
mov dword [esp + 0x88], eax
lea edx, [ecx + eax]
mov ecx, dword ds:[esp + 0x2c]
lea eax, [edx + esi]
lea ecx, [ecx + eax*2]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x44], ecx
cmp eax, ecx
jae 0x4d6cdc
add eax, eax
mov ebx, ecx
cmp eax, ecx
lfence
push dword [0x5b1d70]
cmovae ebx, eax
mov dword [esp + 0x34], ebx
lea eax, [ebx + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov edi, eax
xor eax, eax
lea ecx, [edi + 8]
mov dword [edi], ebx
mov dword [edi + 4], ecx
mov word [ebx + ecx], ax
mov eax, dword [esp + 0x34]
mov ebx, dword [esp + 0x2c]
push ebx
push dword [eax + 4]
push dword [edi + 4]
call fcn.00521a30
mov ecx, dword ds:[esp + 0x40]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4d6cc8
call fcn.004b3960
mov eax, dword [esp + 0x30]
mov dword [esp + 0x40], eax
mov eax, dword [edi + 4]
shr ebx, 1
mov dword [esp + 0x34], edi
lea ebx, [eax + ebx*2]
mov eax, dword [esp + 0x3c]
test al, 1
je 0x4d6ceb
mov ecx, 0x2d
jmp 0x4d6cf4
test al, 2
je 0x4d6cfa
mov ecx, 0x2b
mov word [ebx], cx
add ebx, 2
test al, 4
je 0x4d6d1e
mov edx, dword [esp + 0x88]
test edx, edx
je 0x4d6d1b
mov ecx, edx
mov eax, 0x300030
shr ecx, 1
mov edi, ebx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
lea ebx, [ebx + edx*2]
mov eax, dword [esp + 0x44]
mov edx, ebx
mov edi, dword [esp + 0x50]
lea ebx, [ebx + esi*2]
push edx
mov ecx, esi
mov dword [esp + 0x30], eax
push ecx
push edi
mov dword [esp + 0x54], ebx
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
mov edi, dword [esp + 0x2c]
jmp 0x4d7101
mov eax, dword [esp + 0x38]
xor edi, edi
mov dword [esp + 0x98], edi
mov dword [esp + 0x68], edi
mov esi, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
mov eax, edx
mov ecx, edx
mov dword [esp + 0x90], esi
and eax, 0x7fffffff
and ecx, 0x80000000
or esi, edx
mov dword [esp + 0x94], eax
fild qword [esp + 0x90]
mov dword [esp + 0x9c], ecx
fild qword [esp + 0x98]
fchs
faddp st(1)
jne 0x4d6dec
mov edi, dword [esp + 0x2c]
fstp st(0)
fstp st(1)
fstp st(0)
lea esi, [edi + 2]
cmp dword [esp + 0x30], esi
jae 0x4d6dd2
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x40]
push 2
push edi
call fcn.004d5ee0
mov dword [esp + 0x34], eax
shr edi, 1
mov eax, dword [eax + 4]
lea ebx, [eax + edi*2]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x30], eax
mov eax, 0x30
mov edi, esi
mov word [ebx], ax
add ebx, 2
mov dword [esp + 0x48], ebx
mov dword [esp + 0x2c], edi
jmp 0x4d7101
mov edx, dword [esp + 0x64]
mov esi, dword [esp + 0x38]
test edx, 0x100
je 0x4d6e02
movzx ecx, byte [esi + 0xa]
jmp 0x4d6e08
mov ecx, dword [0x5b0a08]
fcomi st(2)
jb 0x4d6e20
cmp edi, 7
jae 0x4d6e1c
cmp edi, ecx
jae 0x4d6e1c
fmul st(1)
inc edi
fcomi st(2)
jae 0x4d6e0c
mov dword [esp + 0x68], edi
fstp st(2)
fstp st(0)
test dl, 0x40
je 0x4d6e2f
movzx eax, word [esi + 4]
jmp 0x4d6e34
mov eax, 2
movzx edx, ax
lea esi, [esp + 0xb9]
cmp edx, 0xa2
mov dword [esp + 0x50], 0
mov eax, 0xa2
mov dword [esp + 0x44], esi
cmova edx, eax
mov ecx, 0x1804b
sub esp, 0x10
mov eax, esi
fstp qword [esp + 8]
push eax
call fcn.005146a0
test al, al
jne 0x4d6e7b
xor dl, dl
mov byte [esp + 0xb9], dl
jmp 0x4d6eb5
cmp dword [0x5b3e58], 0
mov dl, byte [esp + 0xb9]
je 0x4d6eb5
lea ecx, [esp + 0xb9]
test dl, dl
je 0x4d6eb5
mov al, dl
cmp al, 0x2e
je 0x4d6ea6
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x4d6e98
jmp 0x4d6eb5
mov ax, word [0x5b0114]
mov byte [ecx], al
mov dl, byte [esp + 0xb9]
lea ecx, ds:[esp + 0xb9]
test dl, dl
je 0x4d6ed6
mov al, dl
cmp al, byte [0x5b0114]
je 0x4d6ed6
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x4d6ec6
mov al, byte ds:[ecx]
inc ecx
test al, al
je 0x4d6f3d
mov al, byte [ecx]
test al, al
je 0x4d6f04
mov edi, edi
cmp al, 0x65
je 0x4d6f04
cmp al, 0x45
je 0x4d6f04
mov al, byte ds:[ecx + 1]
inc ecx
test al, al
jne 0x4d6ef0
mov al, byte [ecx - 1]
mov esi, ecx
dec ecx
cmp al, 0x30
jne 0x4d6f18
mov edi, edi
mov al, byte [ecx - 1]
dec ecx
cmp al, 0x30
je 0x4d6f10
cmp al, byte [0x5b0114]
lea edx, [ecx - 1]
cmovne edx, ecx
mov al, byte [esi]
lea edx, [edx + 1]
mov byte [edx], al
lea esi, [esi + 1]
test al, al
jne 0x4d6f24
mov dl, byte [esp + 0xb9]
mov esi, dword [esp + 0x44]
lea edi, [esp + 0xb9]
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x4d6f47
sub edi, ecx
cmp dl, 0x2d
jne 0x4d6f65
mov dword [esp + 0x50], 1
lea esi, [esp + 0xba]
dec edi
mov al, byte [esi]
mov ecx, esi
sub al, 0x30
mov dword [esp + 0x44], esi
cmp al, 0xa
jae 0x4d6f81
mov al, byte [ecx + 1]
inc ecx
sub al, 0x30
cmp al, 0xa
jb 0x4d6f73
mov dword [esp + 0x44], ecx
mov eax, ecx
sub eax, esi
mov dword [esp + 0x58], eax
je 0x4d6f9c
lea ecx, [eax + 2]
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
shr eax, 1
dec eax
jmp 0x4d6f9e
xor eax, eax
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x4c], eax
add eax, edi
add eax, eax
cmp dword [esp + 0x50], 0
lea ecx, [eax + 2]
cmove ecx, eax
lea eax, [ecx + edx]
cmp dword [esp + 0x30], eax
jae 0x4d6fe8
push ecx
mov ecx, dword [esp + 0x38]
push edx
lea edx, [esp + 0x48]
lfence
call fcn.004d5ee0
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x34], eax
shr ecx, 1
mov eax, dword [eax + 4]
lea ebx, [eax + ecx*2]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x30], eax
mov eax, dword ds:[esp + 0x58]
xor edx, edx
mov ecx, eax
add eax, 2
div dword [esp + 0x8c]
cmp dword [esp + 0x50], 0
je 0x4d700d
mov eax, 0x2d
mov word [ebx], ax
add ebx, 2
mov eax, dword [esp + 0x58]
test eax, eax
je 0x4d7048
movsx ax, byte [esi]
lea esi, [esi + 1]
dec ecx
mov word [ebx], ax
mov eax, edx
add ebx, 2
dec edx
test eax, eax
jne 0x4d703f
test ecx, ecx
je 0x4d7044
mov ax, word [0x5b0158]
mov edx, 2
mov word [ebx], ax
add ebx, 2
nop
test ecx, ecx
jne 0x4d7015
mov eax, dword [esp + 0x58]
cmp dword [esp + 0x50], 0
je 0x4d7054
add dword [esp + 0x2c], 2
mov esi, edi
push ebx
sub esi, eax
push esi
push dword [esp + 0x4c]
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
mov eax, dword [esp + 0x4c]
lea ebx, [ebx + esi*2]
mov ecx, dword [esp + 0x2c]
add eax, edi
mov esi, dword [esp + 0x68]
lea edi, [ecx + eax*2]
mov eax, dword [esi*8 + 0x5b0120]
add eax, 2
add eax, edi
cmp dword [esp + 0x30], eax
jae 0x4d70bd
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x40]
lfence
mov eax, dword [esi*8 + 0x5b0120]
add eax, 2
push eax
push edi
call fcn.004d5ee0
mov dword [esp + 0x34], eax
mov ecx, edi
shr ecx, 1
mov eax, dword [eax + 4]
lea ebx, [eax + ecx*2]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x30], eax
mov eax, 0x20
mov word [ebx], ax
lea eax, [ebx + 2]
push dword [esi*8 + 0x5b0120]
push dword [esi*8 + 0x5b0124]
push eax
call fcn.00521a30
mov ecx, dword [esi*8 + 0x5b0120]
add edi, 2
add esp, 0xc
lea eax, [ecx + 2]
shr eax, 1
add edi, ecx
mov dword [esp + 0x2c], edi
lea ebx, [ebx + eax*2]
mov dword [esp + 0x48], ebx
jmp 0x4d7101
fstp st(1)
fstp st(0)
mov ecx, dword [esp + 0x38]
sub edi, dword [esp + 0x70]
mov eax, dword [ecx]
test eax, 0xc0000000
je 0x4d7275
movzx esi, word ds:[ecx + 6]
add esi, esi
cmp edi, esi
jae 0x4d7275
mov ecx, dword ds:[esp + 0x2c]
sub esi, edi
mov edx, dword [esp + 0x30]
add ecx, esi
mov dword [esp + 0x50], ecx
cmp edx, ecx
jae 0x4d71c9
lea eax, [edx + edx]
mov edx, ecx
cmp eax, ecx
lfence
push dword [0x5b1d70]
cmovae edx, eax
mov dword [esp + 0x34], edx
lea eax, [edx + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
push dword [esp + 0x2c]
mov ebx, eax
xor edx, edx
mov eax, dword [esp + 0x34]
lea ecx, [ebx + 8]
mov dword [ebx], eax
mov dword [ebx + 4], ecx
mov word [eax + ecx], dx
mov eax, dword [esp + 0x38]
push dword [eax + 4]
push dword [ebx + 4]
call fcn.00521a30
mov ecx, dword [esp + 0x40]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4d71a9
call fcn.004b3960
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x40], eax
mov eax, dword [ebx + 4]
shr ecx, 1
mov dword [esp + 0x34], ebx
lea ebx, [eax + ecx*2]
mov ecx, dword [esp + 0x38]
mov eax, dword [ecx]
jmp 0x4d71cd
mov ecx, dword [esp + 0x38]
test al, al
jns 0x4d71d7
movzx edx, word [ecx + 8]
jmp 0x4d71dc
mov edx, 0x20
shr esi, 1
mov dword [esp + 0x44], edx
test eax, eax
jns 0x4d7218
test esi, esi
je 0x4d7203
mov eax, edx
mov ecx, esi
movzx edx, ax
mov edi, ebx
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x50]
add esi, esi
add ebx, esi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x48], ebx
jmp 0x4d7279
mov eax, edi
mov ecx, ebx
and eax, 0xfffffffe
sub ecx, eax
lea eax, [esi + esi]
push edi
mov dword [esp + 0x5c], eax
add eax, ecx
push ecx
push eax
lfence
mov dword [esp + 0x7c], ecx
call fcn.005214b0
add esp, 0xc
test esi, esi
je 0x4d7261
mov eax, dword [esp + 0x44]
mov ecx, esi
mov edi, dword [esp + 0x70]
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov esi, dword [esp + 0x58]
add ebx, esi
mov edi, dword [esp + 0x50]
mov dword [esp + 0x48], ebx
mov dword [esp + 0x2c], edi
jmp 0x4d7279
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0x74]
fld qword [esp + 0xa0]
fld qword [esp + 0xa8]
mov esi, dword [esp + 0x30]
test eax, eax
jne 0x4d6130
fstp st(1)
fstp st(0)
mov ecx, dword [esp + 0x34]
xor edx, edx
mov eax, dword [ecx + 4]
mov dword [ecx], edi
shr edi, 1
mov word [eax + edi*2], dx
mov eax, ecx
mov ecx, dword [esp + 0x4bc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret 0xc