Function at 0x140037200
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
push rbp
push rbx
push rdi
lea rbp, [r11 - 0x148]
sub rsp, 0x230
mov rax, qword [0x1402bf040]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov rax, qword [rcx + 0x20]
xorps xmm0, xmm0
mov qword [r11 + 0x18], r12
mov rbx, rcx
mov rcx, qword [rcx]
xor r12d, r12d
mov qword [rbp - 0x18], r12
mov edx, 0x587
mov rdi, qword [rax + 0x20]
mov qword [r11 - 0x28], r15
mov qword [rbp - 0x40], r12
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 8]
xor r9d, r9d
xor r8d, r8d
mov qword [rbp - 0x48], rax
mov edx, 0x845c
mov r15, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword ds:[rbx + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1009
call qword [sym.imp.USER32.dll_SendMessageW]
mov r8, qword [rbx + 0x30]
test r8, r8
je 0x1400372c2
mov rcx, qword [0x1402caad0]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov qword [rbx + 0x30], r12
mov ecx, dword [0x1402bff40]
mov edx, 0x30
mov qword [rsp + 0x258], rsi
lea eax, [rcx - 0x3e]
cmp eax, 1
ja 0x14003733a
mov rax, qword [rbx + 0x20]
lea r9, [rbp - 0x60]
mov esi, dword [0x1402cddb8]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], edx
xorps xmm0, xmm0
mov edx, 0x1fffff
mov qword [rbp - 0x58], r12
mov rcx, qword [rax + 0x20]
mov qword [rbp - 0x60], rcx
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x58], r12d
mov qword [rsp + 0x50], r12
movdqu xmmword [rsp + 0x60], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x1400373a7
cmp esi, 5
jne 0x1400373a7
mov edx, 0x1fffff
jmp 0x14003739a
cmp ecx, 0x64
jb 0x1400373a7
mov rax, qword [rbx + 0x20]
lea r9, [rbp - 0x60]
mov esi, dword [0x1402cddb8]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], edx
xorps xmm0, xmm0
mov edx, 0x3000
mov qword [rbp - 0x58], r12
mov rcx, qword [rax + 0x20]
mov qword [rbp - 0x60], rcx
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x58], r12d
mov qword [rsp + 0x50], r12
movdqu xmmword [rsp + 0x60], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x1400373a7
cmp esi, 5
jne 0x1400373a7
mov edx, 0x3000
lea r8, [rbp - 0x60]
lea rcx, [rbp - 0x18]
call fcn.140176ee0
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400373b9
lea rdx, [rbp - 0x40]
call fcn.14016d6c0
lea rax, str.EnableHeapReflection
mov qword [rbp - 0x60], 0x28
lea rcx, [rbp - 0x60]
mov qword [rbp - 0x58], rax
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x1400373ee
mov r8, rdi
lea rcx, [rbp - 0x38]
xor edx, edx
call fcn.140140cc0
test eax, eax
cmovns rdi, qword [rbp - 0x28]
mov rax, qword [rbx + 0x20]
mov qword [rsp + 0x268], r13
mov qword [rsp + 0x228], r14
test dword [rax + 0xd8], 0x200
je 0x140037ac5
mov rcx, qword ds:[rbx]
xor r8d, r8d
mov edx, 1
call sym.SystemInformer.exe_PhUiConnectToPhSvcEx
test al, al
je 0x140037a8a
cmp qword [0x1402cfa10], r12
jne 0x140037445
mov edi, 0xc0000037
jmp 0x1400379fc
xor edx, edx
lea rcx, [rbp - 0x10]
mov r8d, 0xb0
call fcn.14020a280
mov rcx, qword [0x1402cfa18]
mov dword [rbp + 0x18], 0x13
mov dword [rbp + 0x20], edi
test rcx, rcx
je 0x1400379f7
mov edx, 8
mov r8d, 0x1000
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
test rax, rax
je 0x1400379f7
sub eax, dword [0x1402cfa18]
lea r8, [rbp - 0x10]
mov rcx, qword [0x1402cfa10]
lea rdx, [rbp - 0x10]
mov dword [rbp + 0x28], eax
mov dword [rbp + 0x24], 0x1000
mov qword [rbp - 0x10], 0xb00088
call qword [sym.imp.ntdll.dll_NtRequestWaitReplyPort]
mov edi, dword [rbp + 0x1c]
test eax, eax
cmovs edi, eax
cmp edi, 0x80000005
jne 0x14003752e
mov rcx, qword [0x1402cfa18]
test rcx, rcx
je 0x1400374e6
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov edx, dword [rbp + 0x20]
lea r8, [rbp + 0x24]
xor ecx, ecx
call fcn.1400a3240
mov rsi, rax
test rax, rax
je 0x1400379f7
mov rcx, qword [0x1402cfa10]
lea r8, [rbp - 0x10]
lea rdx, [rbp - 0x10]
mov qword [rbp - 0x10], 0xb00088
call qword [sym.imp.ntdll.dll_NtRequestWaitReplyPort]
mov edi, dword [rbp + 0x1c]
test eax, eax
cmovs edi, eax
test edi, edi
js 0x140037542
mov edx, dword [rbp + 0x20]
mov rcx, rsi
call sym.SystemInformer.exe_PhCreateStringEx
mov r14, rax
jmp 0x140037546
mov r14, qword [rbp - 0x60]
mov rcx, qword [0x1402cfa18]
test rcx, rcx
je 0x14003755d
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax]
call sym.SystemInformer.exe_PhUiDisconnectFromPhSvc
test edi, edi
jns 0x1400375bf
mov rsi, qword [rbx]
mov eax, edi
cmp edi, 0xc0000022
je 0x14003759d
cmp eax, 0xc0000005
je 0x14003759d
mov ecx, eax
shr ecx, 0x10
and ecx, 0xfff
cmp ecx, 7
jne 0x140037592
movzx ecx, ax
jmp 0x1400375aa
cmp ecx, 0xb
jne 0x140037a08
jmp 0x1400375a8
lfence
mov ecx, edi
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
mov ecx, eax
test ecx, ecx
je 0x140037a08
lfence
call sym.SystemInformer.exe_PhGetWin32Message
jmp 0x140037a12
mov rcx, qword [0x1402caad0]
mov edx, 4
mov r8d, 0xb14
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor edx, edx
mov r8d, 0xb14
mov rcx, rax
mov rsi, rax
call fcn.14020a280
mov r8, rsi
mov edx, 0xb14
mov rcx, r14
call sym.SystemInformer.exe_PhHexStringToBufferEx
test al, al
jne 0x140037615
mov rcx, qword [0x1402caad0]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x140037f89
mov qword [rbx + 0x30], rsi
mov edx, r12d
mov eax, dword [rsi + 4]
mov qword [rbx + 0x28], rax
cmp dword [rsi], r12d
jbe 0x1400379d6
cmp r15d, 1
mov qword [rbp - 0x60], r14
mov eax, 0xff
lea r15, str.NT_Heap
cmove eax, r12d
lea r13, str.NT_Heap__Lookaside_
mov dword [rsp + 0x34], eax
lea r12, str.NT_Heap__LFH_
nop word [rax + rax]
mov eax, edx
lea ecx, [rdx + 1]
imul r14, rax, 0x1c
mov r8d, 0xa
mov dword [rsp + 0x30], ecx
add r14, 8
lea rdx, [rbp + 0xa0]
add r14, rsi
call fcn.1401eac80
mov rcx, qword [rbx + 8]
lea rax, [rbp + 0xa0]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x58], rax
xor r8d, r8d
mov dword [rsp + 0x40], 5
mov edx, 0x104d
mov qword [rsp + 0x44], 0x7fffffff
mov qword [rsp + 0x68], r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword ds:[r14 + 0x10]
lea rdx, [rbp + 0xa4]
mov r8d, 0x10
mov dword [rbp + 0xa0], 0x780030
mov rdi, rax
call fcn.1401eac5c
mov rcx, qword [rbx + 8]
lea rax, [rbp + 0xa0]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x58], rax
xor r8d, r8d
mov dword [rsp + 0x40], 1
mov edx, 0x104c
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x48], 1
call qword [sym.imp.USER32.dll_SendMessageW]
movzx ecx, byte [0x1402c72e0]
mov edx, dword [r14 + 0x14]
movzx eax, byte [rsp + 0x34]
cmp dword [rbp - 0x48], 1
mov qword [rsp + 0x50], rdx
mov edx, 1
cmove ecx, eax
mov dword [rsp + 0x40], 0x10c
mov byte [rsp + 0x4a], cl
xor r8d, r8d
lea rcx, [rsp + 0x40]
call sym.SystemInformer.exe_PhFormat
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 1
xor r8d, r8d
mov dword [rsp + 0x44], edi
mov edx, 0x104c
mov dword [rsp + 0x48], 2
mov rcx, qword [rax + 8]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx ecx, byte [0x1402c72e0]
mov edx, dword [r14 + 0x18]
movzx eax, byte [rsp + 0x34]
cmp dword [rbp - 0x48], 1
mov qword [rsp + 0x50], rdx
mov edx, 1
cmove ecx, eax
mov dword [rsp + 0x40], 0x10c
mov byte [rsp + 0x4a], cl
xor r8d, r8d
lea rcx, [rsp + 0x40]
call sym.SystemInformer.exe_PhFormat
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov dword [rsp + 0x40], 1
lea r9, [rsp + 0x40]
mov dword [rsp + 0x44], edi
xor r8d, r8d
mov dword [rsp + 0x48], 3
mov edx, 0x104c
mov rcx, qword [rax + 8]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [r14 + 0xc]
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x50], rax
mov edx, 1
mov dword [rsp + 0x40], 0x10009
call sym.SystemInformer.exe_PhFormat
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 1
xor r8d, r8d
mov dword [rsp + 0x44], edi
mov edx, 0x104c
mov dword [rsp + 0x48], 4
mov rcx, qword [rax + 8]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [r14]
and ecx, 0xffff0fff
call fcn.140036aa0
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 1
xor r8d, r8d
mov dword [rsp + 0x44], edi
mov edx, 0x104c
mov dword [rsp + 0x48], 5
mov rcx, qword [rax + 8]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [r14]
and ecx, 0xf000
call fcn.140037140
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x40]
mov edx, 0x104c
mov dword [rsp + 0x40], 1
xor r8d, r8d
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x48], 6
mov qword [rsp + 0x58], rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [r14 + 4]
cmp eax, 0xddeeddee
je 0x140037957
nop word [rax + rax]
cmp eax, 0xffeeffee
jne 0x1400379c6
movzx ecx, byte [r14 + 8]
lea r9, [rsp + 0x40]
mov r10, qword [rbx + 8]
mov edx, 0x104c
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x48], 7
sub ecx, 1
je 0x140037950
xor r8d, r8d
cmp ecx, 1
mov rcx, r10
je 0x140037949
mov qword [rsp + 0x58], r15
jmp 0x1400379be
mov qword [rsp + 0x58], r12
jmp 0x1400379be
mov qword [rsp + 0x58], r13
jmp 0x1400379b8
movzx ecx, byte ds:[r14 + 8]
lea r9, [rsp + 0x40]
mov r10, qword [rbx + 8]
mov edx, 0x104c
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x48], 7
sub ecx, 1
je 0x1400379ac
xor r8d, r8d
cmp ecx, 1
mov rcx, r10
je 0x14003799e
lea rax, str.Segment_Heap
mov qword [rsp + 0x58], rax
jmp 0x1400379be
lea rax, str.Segment_Heap__LFH_
mov qword [rsp + 0x58], rax
jmp 0x1400379be
lea rax, str.Segment_Heap__Lookaside_
mov qword [rsp + 0x58], rax
mov rcx, r10
xor r8d, r8d
nop
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [rsp + 0x30]
cmp edx, dword [rsi]
jb 0x140037660
mov r14, qword [rbp - 0x60]
lea rcx, [r14 - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140037f89
call fcn.140141ca0
jmp 0x140037f89
mov edi, 0xc0000229
nop dword [rax]
call sym.SystemInformer.exe_PhUiDisconnectFromPhSvc
mov rsi, qword [rbx]
lfence
mov ecx, edi
call sym.SystemInformer.exe_PhGetNtMessage
lea r8, [0x14023a10c]
mov rdi, rax
lea r9, str.Unable_to_query_heap_information.
mov rcx, rsi
test rax, rax
je 0x140037a76
lfence
lfence
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.SystemInformer.exe_PhShowMessage2
lea rcx, ds:[rdi - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140037f89
lfence
call fcn.140141ca0
jmp 0x140037f89
mov edx, 0x10
call sym.SystemInformer.exe_PhShowMessage
jmp 0x140037f89
mov rcx, qword [rbx]
lea rax, str.The_32_bit_version_of_System_Informer_could_not_be_located.
lea r8, [0x14023a10c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
lea r9, str.Unable_to_query_32bit_heap_information.
mov r8d, 0xfffe
mov edx, 0x20
call sym.SystemInformer.exe_PhShowMessage2
nop dword [rax]
jmp 0x140037f89
lea rdx, [rbp - 0x60]
mov rcx, rdi
call fcn.14016c8e0
mov edi, eax
test eax, eax
jns 0x140037b9f
mov rsi, qword ds:[rbx]
cmp eax, 0xc0000022
je 0x140037b13
cmp eax, 0xc0000005
je 0x140037b13
mov ecx, eax
and ecx, 0xfff0000
cmp ecx, 0x70000
jne 0x140037b03
movzx eax, di
jmp 0x140037b1e
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x140037b24
mov eax, edi
jmp 0x140037b1e
lfence
mov ecx, edi
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
nop
test eax, eax
jne 0x140037b30
lfence
mov ecx, edi
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x140037b3a
lfence
mov ecx, eax
call sym.SystemInformer.exe_PhGetWin32Message
lea r8, [0x14023a10c]
mov rdi, rax
lea r9, str.Unable_to_query_heap_information.
mov rcx, rsi
test rax, rax
je 0x140037a76
lfence
lfence
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.SystemInformer.exe_PhShowMessage2
lea rcx, [rdi - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140037f89
lfence
call fcn.140141ca0
jmp 0x140037f89
mov r14, qword [rbp - 0x60]
mov edx, r12d
mov qword [rbx + 0x30], r14
mov rax, qword [r14 + 8]
mov qword [rbx + 0x28], rax
cmp dword [r14], r12d
jbe 0x140037f89
cmp r15d, 1
lea r13, str.NT_Heap__Lookaside_
mov eax, 0xff
lea r15, str.NT_Heap
cmove eax, r12d
lea r12, str.NT_Heap__LFH_
mov dword [rsp + 0x34], eax
mov eax, edx
lea ecx, [rdx + 1]
mov r8d, 0xa
mov dword [rsp + 0x30], ecx
lea rdx, [rbp - 0x10]
lea rsi, [rax*4 + 2]
add rsi, rax
lea rsi, [r14 + rsi*8]
call fcn.1401eac80
mov rcx, qword [rbx + 8]
lea rax, [rbp - 0x10]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x58], rax
xor r8d, r8d
mov dword [rsp + 0x40], 5
mov edx, 0x104d
mov qword [rsp + 0x44], 0x7fffffff
mov qword [rsp + 0x68], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsi + 0x10]
lea rdx, [rbp - 0xc]
mov r8d, 0x10
mov dword [rbp - 0x10], 0x780030
mov rdi, rax
call fcn.1401eac5c
mov rcx, qword [rbx + 8]
lea rax, [rbp - 0x10]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x58], rax
xor r8d, r8d
mov dword [rsp + 0x40], 1
mov edx, 0x104c
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x48], 1
call qword [sym.imp.USER32.dll_SendMessageW]
movzx ecx, byte [0x1402c72e0]
mov edx, 1
movzx eax, byte [rsp + 0x34]
cmp dword [rbp - 0x48], 1
mov dword [rsp + 0x40], 0x10c
cmove ecx, eax
mov rax, qword [rsi + 0x18]
mov byte [rsp + 0x4a], cl
xor r8d, r8d
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x50], rax
call sym.SystemInformer.exe_PhFormat
mov rcx, rax
mov dword [rbp + 0xa0], 1
mov dword [rbp + 0xa4], edi
mov dword [rbp + 0xa8], 2
call sym.SystemInformer.exe_PhAutoDereferenceObject
lea r9, [rbp + 0xa0]
xor r8d, r8d
mov edx, 0x104c
mov rcx, qword [rax + 8]
mov qword [rbp + 0xb8], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx ecx, byte [0x1402c72e0]
mov edx, 1
movzx eax, byte [rsp + 0x34]
cmp dword [rbp - 0x48], 1
mov dword [rsp + 0x40], 0x10c
cmove ecx, eax
mov rax, qword [rsi + 0x20]
mov byte [rsp + 0x4a], cl
xor r8d, r8d
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x50], rax
call sym.SystemInformer.exe_PhFormat
mov rcx, rax
mov dword [rbp + 0xa0], 1
mov dword [rbp + 0xa4], edi
mov dword [rbp + 0xa8], 3
call sym.SystemInformer.exe_PhAutoDereferenceObject
lea r9, [rbp + 0xa0]
xor r8d, r8d
mov edx, 0x104c
mov rcx, qword [rax + 8]
mov qword [rbp + 0xb8], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [rsi + 0xc]
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x50], rax
mov edx, 1
mov dword [rsp + 0x40], 0x10009
call sym.SystemInformer.exe_PhFormat
mov rcx, rax
mov dword [rbp + 0xa0], 1
mov dword [rbp + 0xa4], edi
mov dword [rbp + 0xa8], 4
call sym.SystemInformer.exe_PhAutoDereferenceObject
lea r9, [rbp + 0xa0]
xor r8d, r8d
mov edx, 0x104c
mov rcx, qword [rax + 8]
mov qword [rbp + 0xb8], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [rsi]
and ecx, 0xffff0fff
mov dword [rbp + 0xa0], 1
mov dword [rbp + 0xa4], edi
mov dword [rbp + 0xa8], 5
call fcn.140036aa0
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
lea r9, [rbp + 0xa0]
xor r8d, r8d
mov edx, 0x104c
mov rcx, qword [rax + 8]
mov qword [rbp + 0xb8], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [rsi]
and ecx, 0xf000
mov dword [rbp + 0xa0], 1
mov dword [rbp + 0xa4], edi
mov dword [rbp + 0xa8], 6
call fcn.140037140
mov rcx, qword [rbx + 8]
lea r9, [rbp + 0xa0]
mov edx, 0x104c
mov qword [rbp + 0xb8], rax
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [rsi + 4]
cmp eax, 0xddeeddee
je 0x140037f04
nop dword [rax + rax]
cmp eax, 0xffeeffee
jne 0x140037f7b
movzx edx, byte [rsi + 8]
lea r9, [rbp + 0xa0]
mov rcx, qword [rbx + 8]
mov dword [rbp + 0xa0], 1
mov dword [rbp + 0xa4], edi
mov dword [rbp + 0xa8], 7
sub edx, 1
je 0x140037efb
xor r8d, r8d
cmp edx, 1
mov edx, 0x104c
je 0x140037ef2
mov qword [rbp + 0xb8], r15
jmp 0x140037f75
mov qword [rbp + 0xb8], r12
jmp 0x140037f75
mov qword [rbp + 0xb8], r13
jmp 0x140037f6d
movzx edx, byte [rsi + 8]
lea r9, [rbp + 0xa0]
mov rcx, qword [rbx + 8]
mov dword [rbp + 0xa0], 1
mov dword [rbp + 0xa4], edi
mov dword [rbp + 0xa8], 7
sub edx, 1
je 0x140037f5f
xor r8d, r8d
cmp edx, 1
mov edx, 0x104c
je 0x140037f4f
lea rax, str.Segment_Heap
mov qword [rbp + 0xb8], rax
jmp 0x140037f75
lea rax, str.Segment_Heap__LFH_
mov qword [rbp + 0xb8], rax
jmp 0x140037f75
lea rax, str.Segment_Heap__Lookaside_
mov qword [rbp + 0xb8], rax
mov edx, 0x104c
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword ds:[rsp + 0x30]
cmp edx, dword [r14]
jb 0x140037be1
mov rcx, qword [rbp - 0x30]
mov r15, qword [rsp + 0x220]
mov r14, qword [rsp + 0x228]
mov r13, qword [rsp + 0x268]
mov r12, qword [rsp + 0x260]
mov rsi, qword [rsp + 0x258]
test rcx, rcx
je 0x140037fc6
nop word [rax + rax]
call qword [sym.imp.ntdll.dll_NtClose]
mov rdi, qword [rbp - 0x38]
test rdi, rdi
je 0x140037fe6
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
mov rdi, qword [rbp - 0x40]
test rdi, rdi
je 0x14003802f
xor eax, eax
mov qword [rbp - 0x60], rdi
xor r9d, r9d
mov word [rbp - 0x53], ax
mov r8d, 0x18
mov byte [rbp - 0x51], al
lea rdx, [rbp - 0x60]
mov byte [rbp - 0x54], al
mov ecx, 0x2c
mov qword [rbp - 0x50], rax
mov dword [rsp + 0x20], eax
mov dword [rbp - 0x58], 3
call qword [sym.imp.ntdll.dll_NtPowerInformation]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword ds:[rbx + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x844d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 8]
xor r9d, r9d
mov edx, 0x845c
mov r8d, 1
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.1401e4160
add rsp, 0x230
pop rdi
pop rbx
pop rbp
ret