Function at 0x140037120
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
push rbp
push rbx
push rdi
lea rbp, [r11 - 0x148]
sub rsp, 0x230
mov rax, qword [0x1402c0040]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov rax, qword [rcx + 0x20]
xorps xmm0, xmm0
mov qword [r11 + 0x18], r12
mov rbx, rcx
mov rcx, qword [rcx]
xor r12d, r12d
mov qword [rbp - 0x18], r12
mov edx, 0x587
mov rdi, qword [rax + 0x20]
mov qword [r11 - 0x28], r15
mov qword [rbp - 0x40], r12
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 8]
xor r9d, r9d
xor r8d, r8d
mov qword [rbp - 0x48], rax
mov edx, 0x845c
mov r15, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword ds:[rbx + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1009
call qword [sym.imp.USER32.dll_SendMessageW]
mov r8, qword [rbx + 0x30]
test r8, r8
je 0x1400371e2
mov rcx, qword [0x1402cba10]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov qword [rbx + 0x30], r12
mov ecx, dword [0x1402c0f40]
mov edx, 0x30
mov qword [rsp + 0x258], rsi
lea eax, [rcx - 0x3e]
cmp eax, 1
ja 0x14003725a
mov rax, qword [rbx + 0x20]
lea r9, [rbp - 0x60]
mov esi, dword [0x1402ced08]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], edx
xorps xmm0, xmm0
mov edx, 0x1fffff
mov qword [rbp - 0x58], r12
mov rcx, qword [rax + 0x20]
mov qword [rbp - 0x60], rcx
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x58], r12d
mov qword [rsp + 0x50], r12
movdqu xmmword [rsp + 0x60], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x1400372c7
cmp esi, 5
jne 0x1400372c7
mov edx, 0x1fffff
jmp 0x1400372ba
cmp ecx, 0x64
jb 0x1400372c7
mov rax, qword [rbx + 0x20]
lea r9, [rbp - 0x60]
mov esi, dword [0x1402ced08]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], edx
xorps xmm0, xmm0
mov edx, 0x3000
mov qword [rbp - 0x58], r12
mov rcx, qword [rax + 0x20]
mov qword [rbp - 0x60], rcx
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x58], r12d
mov qword [rsp + 0x50], r12
movdqu xmmword [rsp + 0x60], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x1400372c7
cmp esi, 5
jne 0x1400372c7
mov edx, 0x3000
lea r8, [rbp - 0x60]
lea rcx, [rbp - 0x18]
call fcn.1401783e0
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400372d9
lea rdx, [rbp - 0x40]
call fcn.14016eb20
lea rax, str.EnableHeapReflection
mov qword [rbp - 0x60], 0x28
lea rcx, [rbp - 0x60]
mov qword [rbp - 0x58], rax
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x14003730e
mov r8, rdi
lea rcx, [rbp - 0x38]
xor edx, edx
call fcn.140141220
test eax, eax
cmovns rdi, qword [rbp - 0x28]
mov rax, qword [rbx + 0x20]
mov qword [rsp + 0x268], r13
mov qword [rsp + 0x228], r14
test dword [rax + 0xd8], 0x200
je 0x1400379e5
mov rcx, qword ds:[rbx]
xor r8d, r8d
mov edx, 1
call sym.SystemInformer.exe_PhUiConnectToPhSvcEx
test al, al
je 0x1400379aa
cmp qword [0x1402d0970], r12
jne 0x140037365
mov edi, 0xc0000037
jmp 0x14003791c
xor edx, edx
lea rcx, [rbp - 0x10]
mov r8d, 0xb0
call fcn.14020ba80
mov rcx, qword [0x1402d0978]
mov dword [rbp + 0x18], 0x13
mov dword [rbp + 0x20], edi
test rcx, rcx
je 0x140037917
mov edx, 8
mov r8d, 0x1000
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
test rax, rax
je 0x140037917
sub eax, dword [0x1402d0978]
lea r8, [rbp - 0x10]
mov rcx, qword [0x1402d0970]
lea rdx, [rbp - 0x10]
mov dword [rbp + 0x28], eax
mov dword [rbp + 0x24], 0x1000
mov qword [rbp - 0x10], 0xb00088
call qword [sym.imp.ntdll.dll_NtRequestWaitReplyPort]
mov edi, dword [rbp + 0x1c]
test eax, eax
cmovs edi, eax
cmp edi, 0x80000005
jne 0x14003744e
mov rcx, qword [0x1402d0978]
test rcx, rcx
je 0x140037406
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov edx, dword [rbp + 0x20]
lea r8, [rbp + 0x24]
xor ecx, ecx
call fcn.1400a30a0
mov rsi, rax
test rax, rax
je 0x140037917
mov rcx, qword [0x1402d0970]
lea r8, [rbp - 0x10]
lea rdx, [rbp - 0x10]
mov qword [rbp - 0x10], 0xb00088
call qword [sym.imp.ntdll.dll_NtRequestWaitReplyPort]
mov edi, dword [rbp + 0x1c]
test eax, eax
cmovs edi, eax
test edi, edi
js 0x140037462
mov edx, dword [rbp + 0x20]
mov rcx, rsi
call sym.SystemInformer.exe_PhCreateStringEx
mov r14, rax
jmp 0x140037466
mov r14, qword [rbp - 0x60]
mov rcx, qword [0x1402d0978]
test rcx, rcx
je 0x14003747d
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax]
call sym.SystemInformer.exe_PhUiDisconnectFromPhSvc
test edi, edi
jns 0x1400374df
mov rsi, qword [rbx]
mov eax, edi
cmp edi, 0xc0000022
je 0x1400374bd
cmp eax, 0xc0000005
je 0x1400374bd
mov ecx, eax
shr ecx, 0x10
and ecx, 0xfff
cmp ecx, 7
jne 0x1400374b2
movzx ecx, ax
jmp 0x1400374ca
cmp ecx, 0xb
jne 0x140037928
jmp 0x1400374c8
lfence
mov ecx, edi
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
mov ecx, eax
test ecx, ecx
je 0x140037928
lfence
call sym.SystemInformer.exe_PhGetWin32Message
jmp 0x140037932
mov rcx, qword [0x1402cba10]
mov edx, 4
mov r8d, 0xb14
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor edx, edx
mov r8d, 0xb14
mov rcx, rax
mov rsi, rax
call fcn.14020ba80
mov r8, rsi
mov edx, 0xb14
mov rcx, r14
call sym.SystemInformer.exe_PhHexStringToBufferEx
test al, al
jne 0x140037535
mov rcx, qword [0x1402cba10]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x140037ea9
mov qword [rbx + 0x30], rsi
mov edx, r12d
mov eax, dword [rsi + 4]
mov qword [rbx + 0x28], rax
cmp dword [rsi], r12d
jbe 0x1400378f6
cmp r15d, 1
mov qword [rbp - 0x60], r14
mov eax, 0xff
lea r15, str.NT_Heap
cmove eax, r12d
lea r13, str.NT_Heap__Lookaside_
mov dword [rsp + 0x34], eax
lea r12, str.NT_Heap__LFH_
nop word [rax + rax]
mov eax, edx
lea ecx, [rdx + 1]
imul r14, rax, 0x1c
mov r8d, 0xa
mov dword [rsp + 0x30], ecx
add r14, 8
lea rdx, [rbp + 0xa0]
add r14, rsi
call fcn.1401ec730
mov rcx, qword [rbx + 8]
lea rax, [rbp + 0xa0]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x58], rax
xor r8d, r8d
mov dword [rsp + 0x40], 5
mov edx, 0x104d
mov qword [rsp + 0x44], 0x7fffffff
mov qword [rsp + 0x68], r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword ds:[r14 + 0x10]
lea rdx, [rbp + 0xa4]
mov r8d, 0x10
mov dword [rbp + 0xa0], 0x780030
mov rdi, rax
call fcn.1401ec70c
mov rcx, qword [rbx + 8]
lea rax, [rbp + 0xa0]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x58], rax
xor r8d, r8d
mov dword [rsp + 0x40], 1
mov edx, 0x104c
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x48], 1
call qword [sym.imp.USER32.dll_SendMessageW]
movzx ecx, byte [0x1402c8240]
mov edx, dword [r14 + 0x14]
movzx eax, byte [rsp + 0x34]
cmp dword [rbp - 0x48], 1
mov qword [rsp + 0x50], rdx
mov edx, 1
cmove ecx, eax
mov dword [rsp + 0x40], 0x10d
mov byte [rsp + 0x4a], cl
xor r8d, r8d
lea rcx, [rsp + 0x40]
call sym.SystemInformer.exe_PhFormat
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 1
xor r8d, r8d
mov dword [rsp + 0x44], edi
mov edx, 0x104c
mov dword [rsp + 0x48], 2
mov rcx, qword [rax + 8]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx ecx, byte [0x1402c8240]
mov edx, dword [r14 + 0x18]
movzx eax, byte [rsp + 0x34]
cmp dword [rbp - 0x48], 1
mov qword [rsp + 0x50], rdx
mov edx, 1
cmove ecx, eax
mov dword [rsp + 0x40], 0x10d
mov byte [rsp + 0x4a], cl
xor r8d, r8d
lea rcx, [rsp + 0x40]
call sym.SystemInformer.exe_PhFormat
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov dword [rsp + 0x40], 1
lea r9, [rsp + 0x40]
mov dword [rsp + 0x44], edi
xor r8d, r8d
mov dword [rsp + 0x48], 3
mov edx, 0x104c
mov rcx, qword [rax + 8]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [r14 + 0xc]
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x50], rax
mov edx, 1
mov dword [rsp + 0x40], 0x10009
call sym.SystemInformer.exe_PhFormat
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 1
xor r8d, r8d
mov dword [rsp + 0x44], edi
mov edx, 0x104c
mov dword [rsp + 0x48], 4
mov rcx, qword [rax + 8]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [r14]
and ecx, 0xffff0fff
call fcn.1400369c0
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 1
xor r8d, r8d
mov dword [rsp + 0x44], edi
mov edx, 0x104c
mov dword [rsp + 0x48], 5
mov rcx, qword [rax + 8]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [r14]
and ecx, 0xf000
call fcn.140037060
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x40]
mov edx, 0x104c
mov dword [rsp + 0x40], 1
xor r8d, r8d
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x48], 6
mov qword [rsp + 0x58], rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [r14 + 4]
cmp eax, 0xddeeddee
je 0x140037877
nop word [rax + rax]
cmp eax, 0xffeeffee
jne 0x1400378e6
movzx ecx, byte [r14 + 8]
lea r9, [rsp + 0x40]
mov r10, qword [rbx + 8]
mov edx, 0x104c
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x48], 7
sub ecx, 1
je 0x140037870
xor r8d, r8d
cmp ecx, 1
mov rcx, r10
je 0x140037869
mov qword [rsp + 0x58], r15
jmp 0x1400378de
mov qword [rsp + 0x58], r12
jmp 0x1400378de
mov qword [rsp + 0x58], r13
jmp 0x1400378d8
movzx ecx, byte ds:[r14 + 8]
lea r9, [rsp + 0x40]
mov r10, qword [rbx + 8]
mov edx, 0x104c
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x48], 7
sub ecx, 1
je 0x1400378cc
xor r8d, r8d
cmp ecx, 1
mov rcx, r10
je 0x1400378be
lea rax, str.Segment_Heap
mov qword [rsp + 0x58], rax
jmp 0x1400378de
lea rax, str.Segment_Heap__LFH_
mov qword [rsp + 0x58], rax
jmp 0x1400378de
lea rax, str.Segment_Heap__Lookaside_
mov qword [rsp + 0x58], rax
mov rcx, r10
xor r8d, r8d
nop
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [rsp + 0x30]
cmp edx, dword [rsi]
jb 0x140037580
mov r14, qword [rbp - 0x60]
lea rcx, [r14 - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140037ea9
call fcn.140142200
jmp 0x140037ea9
mov edi, 0xc0000229
nop dword [rax]
call sym.SystemInformer.exe_PhUiDisconnectFromPhSvc
mov rsi, qword [rbx]
lfence
mov ecx, edi
call sym.SystemInformer.exe_PhGetNtMessage
lea r8, [0x14023b2dc]
mov rdi, rax
lea r9, str.Unable_to_query_heap_information.
mov rcx, rsi
test rax, rax
je 0x140037996
lfence
lfence
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.SystemInformer.exe_PhShowMessage2
lea rcx, ds:[rdi - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140037ea9
lfence
call fcn.140142200
jmp 0x140037ea9
mov edx, 0x10
call sym.SystemInformer.exe_PhShowMessage
jmp 0x140037ea9
mov rcx, qword [rbx]
lea rax, str.The_32_bit_version_of_System_Informer_could_not_be_located.
lea r8, [0x14023b2dc]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
lea r9, str.Unable_to_query_32bit_heap_information.
mov r8d, 0xfffe
mov edx, 0x20
call sym.SystemInformer.exe_PhShowMessage2
nop dword [rax]
jmp 0x140037ea9
lea rdx, [rbp - 0x60]
mov rcx, rdi
call fcn.14016dd40
mov edi, eax
test eax, eax
jns 0x140037abf
mov rsi, qword ds:[rbx]
cmp eax, 0xc0000022
je 0x140037a33
cmp eax, 0xc0000005
je 0x140037a33
mov ecx, eax
and ecx, 0xfff0000
cmp ecx, 0x70000
jne 0x140037a23
movzx eax, di
jmp 0x140037a3e
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x140037a44
mov eax, edi
jmp 0x140037a3e
lfence
mov ecx, edi
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
nop
test eax, eax
jne 0x140037a50
lfence
mov ecx, edi
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x140037a5a
lfence
mov ecx, eax
call sym.SystemInformer.exe_PhGetWin32Message
lea r8, [0x14023b2dc]
mov rdi, rax
lea r9, str.Unable_to_query_heap_information.
mov rcx, rsi
test rax, rax
je 0x140037996
lfence
lfence
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.SystemInformer.exe_PhShowMessage2
lea rcx, [rdi - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140037ea9
lfence
call fcn.140142200
jmp 0x140037ea9
mov r14, qword [rbp - 0x60]
mov edx, r12d
mov qword [rbx + 0x30], r14
mov rax, qword [r14 + 8]
mov qword [rbx + 0x28], rax
cmp dword [r14], r12d
jbe 0x140037ea9
cmp r15d, 1
lea r13, str.NT_Heap__Lookaside_
mov eax, 0xff
lea r15, str.NT_Heap
cmove eax, r12d
lea r12, str.NT_Heap__LFH_
mov dword [rsp + 0x34], eax
mov eax, edx
lea ecx, [rdx + 1]
mov r8d, 0xa
mov dword [rsp + 0x30], ecx
lea rdx, [rbp - 0x10]
lea rsi, [rax*4 + 2]
add rsi, rax
lea rsi, [r14 + rsi*8]
call fcn.1401ec730
mov rcx, qword [rbx + 8]
lea rax, [rbp - 0x10]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x58], rax
xor r8d, r8d
mov dword [rsp + 0x40], 5
mov edx, 0x104d
mov qword [rsp + 0x44], 0x7fffffff
mov qword [rsp + 0x68], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsi + 0x10]
lea rdx, [rbp - 0xc]
mov r8d, 0x10
mov dword [rbp - 0x10], 0x780030
mov rdi, rax
call fcn.1401ec70c
mov rcx, qword [rbx + 8]
lea rax, [rbp - 0x10]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x58], rax
xor r8d, r8d
mov dword [rsp + 0x40], 1
mov edx, 0x104c
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x48], 1
call qword [sym.imp.USER32.dll_SendMessageW]
movzx ecx, byte [0x1402c8240]
mov edx, 1
movzx eax, byte [rsp + 0x34]
cmp dword [rbp - 0x48], 1
mov dword [rsp + 0x40], 0x10d
cmove ecx, eax
mov rax, qword [rsi + 0x18]
mov byte [rsp + 0x4a], cl
xor r8d, r8d
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x50], rax
call sym.SystemInformer.exe_PhFormat
mov rcx, rax
mov dword [rbp + 0xa0], 1
mov dword [rbp + 0xa4], edi
mov dword [rbp + 0xa8], 2
call sym.SystemInformer.exe_PhAutoDereferenceObject
lea r9, [rbp + 0xa0]
xor r8d, r8d
mov edx, 0x104c
mov rcx, qword [rax + 8]
mov qword [rbp + 0xb8], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx ecx, byte [0x1402c8240]
mov edx, 1
movzx eax, byte [rsp + 0x34]
cmp dword [rbp - 0x48], 1
mov dword [rsp + 0x40], 0x10d
cmove ecx, eax
mov rax, qword [rsi + 0x20]
mov byte [rsp + 0x4a], cl
xor r8d, r8d
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x50], rax
call sym.SystemInformer.exe_PhFormat
mov rcx, rax
mov dword [rbp + 0xa0], 1
mov dword [rbp + 0xa4], edi
mov dword [rbp + 0xa8], 3
call sym.SystemInformer.exe_PhAutoDereferenceObject
lea r9, [rbp + 0xa0]
xor r8d, r8d
mov edx, 0x104c
mov rcx, qword [rax + 8]
mov qword [rbp + 0xb8], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [rsi + 0xc]
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x50], rax
mov edx, 1
mov dword [rsp + 0x40], 0x10009
call sym.SystemInformer.exe_PhFormat
mov rcx, rax
mov dword [rbp + 0xa0], 1
mov dword [rbp + 0xa4], edi
mov dword [rbp + 0xa8], 4
call sym.SystemInformer.exe_PhAutoDereferenceObject
lea r9, [rbp + 0xa0]
xor r8d, r8d
mov edx, 0x104c
mov rcx, qword [rax + 8]
mov qword [rbp + 0xb8], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [rsi]
and ecx, 0xffff0fff
mov dword [rbp + 0xa0], 1
mov dword [rbp + 0xa4], edi
mov dword [rbp + 0xa8], 5
call fcn.1400369c0
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
lea r9, [rbp + 0xa0]
xor r8d, r8d
mov edx, 0x104c
mov rcx, qword [rax + 8]
mov qword [rbp + 0xb8], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [rsi]
and ecx, 0xf000
mov dword [rbp + 0xa0], 1
mov dword [rbp + 0xa4], edi
mov dword [rbp + 0xa8], 6
call fcn.140037060
mov rcx, qword [rbx + 8]
lea r9, [rbp + 0xa0]
mov edx, 0x104c
mov qword [rbp + 0xb8], rax
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [rsi + 4]
cmp eax, 0xddeeddee
je 0x140037e24
nop dword [rax + rax]
cmp eax, 0xffeeffee
jne 0x140037e9b
movzx edx, byte [rsi + 8]
lea r9, [rbp + 0xa0]
mov rcx, qword [rbx + 8]
mov dword [rbp + 0xa0], 1
mov dword [rbp + 0xa4], edi
mov dword [rbp + 0xa8], 7
sub edx, 1
je 0x140037e1b
xor r8d, r8d
cmp edx, 1
mov edx, 0x104c
je 0x140037e12
mov qword [rbp + 0xb8], r15
jmp 0x140037e95
mov qword [rbp + 0xb8], r12
jmp 0x140037e95
mov qword [rbp + 0xb8], r13
jmp 0x140037e8d
movzx edx, byte [rsi + 8]
lea r9, [rbp + 0xa0]
mov rcx, qword [rbx + 8]
mov dword [rbp + 0xa0], 1
mov dword [rbp + 0xa4], edi
mov dword [rbp + 0xa8], 7
sub edx, 1
je 0x140037e7f
xor r8d, r8d
cmp edx, 1
mov edx, 0x104c
je 0x140037e6f
lea rax, str.Segment_Heap
mov qword [rbp + 0xb8], rax
jmp 0x140037e95
lea rax, str.Segment_Heap__LFH_
mov qword [rbp + 0xb8], rax
jmp 0x140037e95
lea rax, str.Segment_Heap__Lookaside_
mov qword [rbp + 0xb8], rax
mov edx, 0x104c
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword ds:[rsp + 0x30]
cmp edx, dword [r14]
jb 0x140037b01
mov rcx, qword [rbp - 0x30]
mov r15, qword [rsp + 0x220]
mov r14, qword [rsp + 0x228]
mov r13, qword [rsp + 0x268]
mov r12, qword [rsp + 0x260]
mov rsi, qword [rsp + 0x258]
test rcx, rcx
je 0x140037ee6
nop word [rax + rax]
call qword [sym.imp.ntdll.dll_NtClose]
mov rdi, qword [rbp - 0x38]
test rdi, rdi
je 0x140037f06
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
mov rdi, qword [rbp - 0x40]
test rdi, rdi
je 0x140037f4f
xor eax, eax
mov qword [rbp - 0x60], rdi
xor r9d, r9d
mov word [rbp - 0x53], ax
mov r8d, 0x18
mov byte [rbp - 0x51], al
lea rdx, [rbp - 0x60]
mov byte [rbp - 0x54], al
mov ecx, 0x2c
mov qword [rbp - 0x50], rax
mov dword [rsp + 0x20], eax
mov dword [rbp - 0x58], 3
call qword [sym.imp.ntdll.dll_NtPowerInformation]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword ds:[rbx + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x844d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 8]
xor r9d, r9d
mov edx, 0x845c
mov r8d, 1
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.1401e5e20
add rsp, 0x230
pop rdi
pop rbx
pop rbp
ret