Function at 0x14006a7a0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x1402b5020]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov r14, 0xffffffffffffffff
movzx ebx, r8b
mov dword [rbp], r14d
mov rsi, rdx
mov rdi, rcx
call sym.SystemInformer.exe_PhCreateEMenu
mov rcx, qword [0x1402bfe50]
lea edx, [r14 + 5]
lea r8d, [r14 + 0x49]
mov r12, rax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor r13d, r13d
lea rcx, str.Combine_memory_pages
mov r8d, 0xffffffff
mov rdx, rax
mov qword [rax + 0x18], r13
mov qword [rax + 0x28], r13
mov qword [rax + 0x30], r13
mov qword [rax + 0x38], r13
mov qword [rax + 0x40], r13
mov qword [rax + 8], rcx
mov rcx, r12
mov dword [rax], r13d
mov dword [rax + 4], 0x9d67
mov qword [rax + 0x10], r13
mov qword [rax + 0x20], r13
call sym.SystemInformer.exe_PhInsertEMenuItem
mov rcx, qword [0x1402bfe50]
lea edx, [r14 + 5]
lea r8d, [r14 + 0x49]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lea rcx, str.Empty_compression_cache
mov r8d, 0xffffffff
mov rdx, rax
mov qword [rax + 0x18], r13
mov qword [rax + 0x28], r13
mov qword [rax + 0x30], r13
mov qword [rax + 0x38], r13
mov qword [rax + 0x40], r13
mov qword [rax + 8], rcx
mov rcx, r12
mov dword [rax], r13d
mov dword [rax + 4], 0x9d66
mov qword [rax + 0x10], r13
mov qword [rax + 0x20], r13
call sym.SystemInformer.exe_PhInsertEMenuItem
mov rcx, qword [0x1402bfe50]
lea edx, [r14 + 5]
lea r8d, [r14 + 0x49]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lea rcx, str.Empty_system_file_cache
mov r8d, 0xffffffff
mov rdx, rax
mov qword [rax + 0x18], r13
mov qword [rax + 0x28], r13
mov qword [rax + 0x30], r13
mov qword [rax + 0x38], r13
mov qword [rax + 0x40], r13
mov qword [rax + 8], rcx
mov rcx, r12
mov dword [rax], r13d
mov dword [rax + 4], 0x9d68
mov qword [rax + 0x10], r13
mov qword [rax + 0x20], r13
call sym.SystemInformer.exe_PhInsertEMenuItem
mov rcx, qword [0x1402bfe50]
lea edx, [r14 + 5]
lea r8d, [r14 + 0x49]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lea rcx, str.Empty_registry_cache
mov r8d, 0xffffffff
mov qword [rax + 0x18], r13
mov qword [rax + 0x28], r13
mov qword [rax + 0x30], r13
mov qword [rax + 0x38], r13
mov qword [rax + 0x40], r13
mov dword [rax], r13d
mov dword [rax + 4], 0x9d3e
mov qword [rax + 8], rcx
mov qword [rax + 0x10], r13
mov qword [rax + 0x20], r13
mov rdx, rax
mov rcx, r12
call sym.SystemInformer.exe_PhInsertEMenuItem
mov rcx, qword [0x1402bfe50]
lea edx, [r14 + 5]
lea r8d, [r14 + 0x49]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lea rcx, str.Empty_working_sets
mov r8d, 0xffffffff
mov rdx, rax
mov qword [rax + 0x18], r13
mov qword [rax + 0x28], r13
mov qword [rax + 0x30], r13
mov qword [rax + 0x38], r13
mov qword [rax + 0x40], r13
mov qword [rax + 8], rcx
mov rcx, r12
mov dword [rax], r13d
mov dword [rax + 4], 0x9d3a
mov qword [rax + 0x10], r13
mov qword [rax + 0x20], r13
call sym.SystemInformer.exe_PhInsertEMenuItem
mov rcx, qword [0x1402bfe50]
lea edx, [r14 + 5]
lea r8d, [r14 + 0x49]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lea rcx, str.Empty_modified_page_list
mov r8d, 0xffffffff
mov rdx, rax
mov qword [rax + 0x18], r13
mov qword [rax + 0x28], r13
mov qword [rax + 0x30], r13
mov qword [rax + 0x38], r13
mov qword [rax + 0x40], r13
mov qword [rax + 8], rcx
mov rcx, r12
mov dword [rax], r13d
mov dword [rax + 4], 0x9d3b
mov qword [rax + 0x10], r13
mov qword [rax + 0x20], r13
call sym.SystemInformer.exe_PhInsertEMenuItem
mov rcx, qword [0x1402bfe50]
lea edx, [r14 + 5]
lea r8d, [r14 + 0x49]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lea rcx, str.Empty_standby_list
mov r8d, 0xffffffff
mov rdx, rax
mov qword [rax + 0x18], r13
mov qword [rax + 0x28], r13
mov qword [rax + 0x30], r13
mov qword [rax + 0x38], r13
mov qword [rax + 0x40], r13
mov qword [rax + 8], rcx
mov rcx, r12
mov dword [rax], r13d
mov dword [rax + 4], 0x9d3c
mov qword [rax + 0x10], r13
mov qword [rax + 0x20], r13
call sym.SystemInformer.exe_PhInsertEMenuItem
mov rcx, qword [0x1402bfe50]
lea edx, [r14 + 5]
lea r8d, [r14 + 0x49]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lea rcx, str.Empty_priority_0_standby_list
mov r8d, 0xffffffff
mov rdx, rax
mov qword [rax + 0x18], r13
mov qword [rax + 0x28], r13
mov qword [rax + 0x30], r13
mov qword [rax + 0x38], r13
mov qword [rax + 0x40], r13
mov qword [rax + 8], rcx
mov rcx, r12
mov dword [rax], r13d
mov dword [rax + 4], 0x9d3d
mov qword [rax + 0x10], r13
mov qword [rax + 0x20], r13
call sym.SystemInformer.exe_PhInsertEMenuItem
lea rdx, [rbp - 0x70]
mov rcx, rsi
test bl, bl
je 0x14006aacb
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp - 0x6c]
lea r9d, [r14 + 0xa]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp - 0x70]
jmp 0x14006aaf8
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rbp - 0x64]
lea rdx, [rbp - 0x78]
mov rcx, rsi
mov dword [rbp - 0x74], eax
mov dword [rbp - 0x78], r13d
call qword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [rbp - 0x74]
mov r9d, 5
mov dword [rsp + 0x28], eax
mov eax, dword [rbp - 0x78]
mov r8d, 2
mov dword [rsp + 0x20], eax
mov rdx, rdi
mov rcx, r12
call sym.SystemInformer.exe_PhShowEMenu
lea rsi, [0x140232c58]
test rax, rax
je case.0x14006ab47.40255
mov eax, dword [rax + 4]
add eax, 0xffff62c6
cmp eax, 0x2e
ja case.0x14006ab47.40255
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x6b4b4]
mov ecx, dword [rdx + rax*4 + 0x6b490]
add rcx, rdx
jmp rcx
mov dword [rbp], 2
jmp 0x14006b259
mov eax, 3
mov dword [rbp], eax
jmp 0x14006b259
mov dword [rbp], 4
jmp 0x14006b259
mov dword [rbp], 5
jmp 0x14006b259
xor eax, eax
mov dword [rsp + 0x28], 0x8000
xorps xmm0, xmm0
mov qword [rbp - 0x50], rax
xor r9d, r9d
mov dword [rsp + 0x20], r13d
mov edx, 0x7f02
xor ecx, ecx
lea r8d, [rax + 2]
movups xmmword [rbp - 0x60], xmm0
call qword [sym.imp.USER32.dll_LoadImageW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov r8d, 0x18
lea rdx, [rbp - 0x60]
lea ecx, [r8 + 0x6a]
call qword [sym.imp.ntdll.dll_NtSetSystemInformation]
xor r9d, r9d
mov dword [rsp + 0x28], 0x8000
mov edx, 0x7f00
mov dword [rsp + 0x20], r13d
xor ecx, ecx
mov ebx, eax
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_LoadImageW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
test ebx, ebx
js 0x14006ac45
mov rcx, qword [rbp - 0x58]
xor r8d, r8d
movzx eax, byte [0x1402bcf8c]
shl rcx, 0xc
mov qword [rbp + 0x18], rcx
lea rcx, [rbp + 8]
lea edx, [r8 + 1]
mov dword [rbp + 8], 0x10c
mov byte [rbp + 0x12], al
call sym.SystemInformer.exe_PhFormat
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov rcx, qword ds:[rbp - 0x58]
lea r9, str.Memory_pages_combined
mov qword [rsp + 0x30], rcx
jmp 0x14006b163
cmp ebx, 0xc0000022
je 0x14006ac7e
cmp ebx, 0xc0000005
je 0x14006ac7e
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x14006ac6c
movzx eax, bx
jmp 0x14006ac89
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x14006ac8d
mov eax, ebx
jmp 0x14006ac89
lfence
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x14006aca5
lfence
mov ecx, ebx
call sym.SystemInformer.exe_PhGetNtMessage
lea r9, str.Unable_to_combine_memory_pages
nop
jmp 0x14006b1f9
lfence
mov ecx, eax
call sym.SystemInformer.exe_PhGetWin32Message
lea r9, str.Unable_to_combine_memory_pages
jmp 0x14006b1f9
mov r8, rsi
mov edx, 0x10
call sym.SystemInformer.exe_PhShowMessage
jmp case.0x14006ab47.40255
cmp dword [0x1402c2f94], 5
jge 0x14006ad05
lea rax, str.Emptying_the_compression_store_requires_a_connection_to_the_kernel_driver.
mov edx, 0xfffd
lea r9, str._s_r_n_r_nSystem_Informer_is_not_connected_to_the_kernel_driver_or_lacks_the_required_state_necessary_for_this_feature._Make_sure_that_the__Enable_kernel_mode_driver__option_is_enabled_and_that_System_Informer_is_running_with_administrator_privileges.
mov qword [rsp + 0x20], rax
lea r8, str.Kernel_driver_not_connected
mov rcx, rdi
call fcn.14004f280
nop dword [rax]
jmp case.0x14006ab47.40255
xor r9d, r9d
mov dword [rsp + 0x28], 0x8000
mov edx, 0x7f02
mov qword [rsp + 0x280], r15
xor ecx, ecx
mov dword [rsp + 0x20], r13d
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_LoadImageW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
lea rcx, [0x1402c3430]
nop
call qword [sym.imp.ntdll.dll_RtlInterlockedPopEntrySList]
mov r15, rax
test rax, rax
je 0x14006ad57
lock dec dword [0x1402c3440]
jmp 0x14006ad77
mov r8, qword [0x1402c3448]
mov edx, 4
mov rcx, qword [0x1402bfe50]
add r8, 0x10
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r15, rax
lea rcx, [r15 + 0x12]
xor edx, edx
mov r8d, 0x15a
call fcn.1401dff50
mov ecx, 0x7ffe0018
mov dword [r15 + 0x10], 0x15c0003
mov dword [r15 + 0x14], 0x13
mov edx, 0x7ffe0014
lea r8d, [rcx + 4]
nop word [rax + rax]
mov eax, dword ds:[rcx]
mov dword [r15 + 0x1c], eax
mov eax, dword [rdx]
mov dword [r15 + 0x18], eax
mov eax, dword [r8]
cmp dword [r15 + 0x1c], eax
jne 0x14006adb0
lea rcx, [r15 + 0x10]
mov dword [r15 + 0x24], r13d
mov qword [r15 + 0x28], r13
mov dword [r15 + 0x30], r13d
call fcn.14018ea80
mov esi, eax
test eax, eax
js 0x14006adeb
lfence
mov esi, dword [r15 + 0x20]
mov eax, dword [0x1402c3444]
cmp dword [0x1402c3440], eax
jae 0x14006ae12
mov rdx, r15
lea rcx, [0x1402c3430]
call qword [sym.imp.ntdll.dll_RtlInterlockedPushEntrySList]
lock inc dword [0x1402c3440]
jmp 0x14006ae26
mov rcx, qword [0x1402bfe50]
mov r8, r15
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor r9d, r9d
mov dword [rsp + 0x28], 0x8000
mov edx, 0x7f00
mov dword [rsp + 0x20], r13d
xor ecx, ecx
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_LoadImageW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov r15, qword ss:[rsp + 0x280]
nop
test esi, esi
jns 0x14006b248
cmp esi, 0xc0000022
je 0x14006ae9e
cmp esi, 0xc0000005
je 0x14006ae9e
mov eax, esi
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x14006ae8c
movzx eax, si
jmp 0x14006aea9
mov eax, esi
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x14006aead
mov eax, esi
jmp 0x14006aea9
lfence
mov ecx, esi
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x14006aeca
lfence
mov ecx, esi
call sym.SystemInformer.exe_PhGetNtMessage
lea r9, str.Unable_to_empty_compression_stores
lea rsi, [0x140232c58]
jmp 0x14006b1f9
lfence
mov ecx, eax
call sym.SystemInformer.exe_PhGetWin32Message
lea r9, str.Unable_to_empty_compression_stores
lea rsi, [0x140232c58]
jmp 0x14006b1f9
xor r9d, r9d
mov dword [rsp + 0x28], 0x8000
mov edx, 0x7f02
mov dword [rsp + 0x20], r13d
xor ecx, ecx
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_LoadImageW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
xor r8d, r8d
xor edx, edx
mov ecx, 0x9b
call qword [sym.imp.ntdll.dll_NtSetSystemInformation]
xor r9d, r9d
mov dword [rsp + 0x28], 0x8000
mov edx, 0x7f00
mov dword [rsp + 0x20], r13d
xor ecx, ecx
mov ebx, eax
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_LoadImageW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
test ebx, ebx
js 0x14006af8a
lea rax, [0x140231658]
mov edx, 0x20
mov qword [rsp + 0x28], rax
lea r9, str.Registry_cache_flushed
mov r8d, 0xfffd
mov qword [rsp + 0x20], rax
mov rcx, rdi
call sym.SystemInformer.exe_PhShowMessage2
jmp case.0x14006ab47.40255
cmp ebx, 0xc0000022
je 0x14006afbf
cmp ebx, 0xc0000005
je 0x14006afbf
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x14006afad
movzx eax, bx
jmp 0x14006afca
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x14006afce
mov eax, ebx
jmp 0x14006afca
lfence
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x14006afe5
lfence
mov ecx, ebx
call sym.SystemInformer.exe_PhGetNtMessage
lea r9, str.Unable_to_flush_registry_cache.
nop
jmp 0x14006b1f9
lfence
mov ecx, eax
call sym.SystemInformer.exe_PhGetWin32Message
lea r9, str.Unable_to_flush_registry_cache.
jmp 0x14006b1f9
xorps xmm0, xmm0
lea r8, [rsp + 0x48]
mov edx, 0x20
mov rcx, r14
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
test eax, eax
js 0x14006b073
mov rcx, qword [rsp + 0x48]
lea r8, [rbp + 8]
mov qword [rsp + 0x40], 5
xor r9d, r9d
mov rax, qword [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x28], r13
mov qword [rbp + 0xc], rax
mov dword [rbp + 8], 1
mov dword [rbp + 0x14], 2
mov qword [rsp + 0x20], r13
call qword [sym.imp.ntdll.dll_NtAdjustPrivilegesToken]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_NtClose]
xor r9d, r9d
lea rdx, [rbp - 0x40]
lea r8d, [r9 + 0x40]
lea ecx, [r9 + 0x51]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
xor r9d, r9d
mov dword [rsp + 0x28], 0x8000
mov edx, 0x7f02
mov dword [rsp + 0x20], r13d
xor ecx, ecx
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_LoadImageW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov r8d, 0x40
mov qword [rbp + 0x30], r13
lea rdx, [rbp + 0x30]
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], r13
mov qword [rbp + 0x58], r13
lea ecx, [r8 + 0x11]
mov qword [rbp + 0x60], r13
mov qword [rbp + 0x68], r13
mov qword [rbp + 0x48], r14
mov qword [rbp + 0x50], r14
call qword [sym.imp.ntdll.dll_NtSetSystemInformation]
xor r9d, r9d
mov dword [rsp + 0x28], 0x8000
mov edx, 0x7f00
mov dword [rsp + 0x20], r13d
xor ecx, ecx
mov ebx, eax
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_LoadImageW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
test ebx, ebx
js 0x14006b190
movzx eax, byte [0x1402bcf8c]
lea rcx, [rsp + 0x50]
xor r8d, r8d
mov byte [rsp + 0x5a], al
mov rax, qword [rbp - 0x40]
mov dword [rsp + 0x50], 0x10c
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
call sym.SystemInformer.exe_PhFormat
mov rbx, qword [rbp - 0x40]
mov rcx, rax
shr rbx, 0xc
call sym.SystemInformer.exe_PhAutoDereferenceObject
lea r9, str.System_file_cache_flushed
mov qword [rsp + 0x30], rbx
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov r8d, 0xfffd
lea rax, str._s___llu_pages_
mov rcx, rdi
mov qword [rsp + 0x20], rax
call sym.SystemInformer.exe_PhShowMessage2
jmp case.0x14006ab47.40255
cmp ebx, 0xc0000022
je 0x14006b1cd
nop dword [rax + rax]
cmp ebx, 0xc0000005
je 0x14006b1cd
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x14006b1bb
movzx eax, bx
jmp 0x14006b1d8
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x14006b1dc
mov eax, ebx
jmp 0x14006b1d8
lfence
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x14006b1e8
lfence
mov ecx, ebx
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x14006b1f2
lfence
mov ecx, eax
call sym.SystemInformer.exe_PhGetWin32Message
lea r9, str.Unable_to_empty_system_file_cache.
mov rbx, rax
mov rcx, rdi
test rax, rax
je 0x14006acbb
lfence
lfence
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov r8d, 0xfffe
mov qword [rsp + 0x20], rsi
call sym.SystemInformer.exe_PhShowMessage2
lea rcx, [rbx - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne case.0x14006ab47.40255
lfence
call fcn.14013d2a0
jmp case.0x14006ab47.40255
lea rsi, [0x140232c58]
cmp dword [rbp], 0xffffffff
je 0x14006b465
xor r9d, r9d
mov dword [rsp + 0x28], 0x8000
mov edx, 0x7f02
mov dword [rsp + 0x20], r13d
xor ecx, ecx
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_LoadImageW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov r8d, 4
lea rdx, [rbp]
lea ecx, [r8 + 0x4c]
call qword [sym.imp.ntdll.dll_NtSetSystemInformation]
xor r9d, r9d
mov dword [rsp + 0x28], 0x8000
mov edx, 0x7f00
mov dword [rsp + 0x20], r13d
xor ecx, ecx
mov ebx, eax
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_LoadImageW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
cmp ebx, 0xc0000061
jne 0x14006b3a5
lea rcx, [rsp + 0x70]
call sym.SystemInformer.exe_PhGetOwnTokenAttributes
test byte [rax + 8], 1
jne 0x14006b3bd
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call sym.SystemInformer.exe_PhUiConnectToPhSvcEx
test al, al
je 0x14006b465
xor r9d, r9d
mov dword [rsp + 0x28], 0x8000
mov edx, 0x7f02
mov dword [rsp + 0x20], r13d
xor ecx, ecx
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_LoadImageW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov rcx, qword [0x1402c4cf0]
test rcx, rcx
jne 0x14006b339
mov ebx, 0xc0000037
jmp 0x14006b371
mov eax, dword ds:[rbp]
lea r8, [rbp + 0x70]
lea rdx, [rbp + 0x70]
mov dword [rbp + 0xa0], eax
mov dword [rbp + 0x98], 0xd
mov qword [rbp + 0x70], 0xb00088
call qword [sym.imp.ntdll.dll_NtRequestWaitReplyPort]
mov ebx, dword [rbp + 0x9c]
test eax, eax
cmovs ebx, eax
xor r9d, r9d
mov dword [rsp + 0x28], 0x8000
mov edx, 0x7f00
mov dword [rsp + 0x20], r13d
xor ecx, ecx
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_LoadImageW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
nop dword [rax + rax]
call sym.SystemInformer.exe_PhUiDisconnectFromPhSvc
mov eax, ebx
test ebx, ebx
jns 0x14006b465
cmp eax, 0xc0000022
je 0x14006b3e2
cmp eax, 0xc0000005
je 0x14006b3e2
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x14006b3d0
movzx eax, bx
jmp 0x14006b3ed
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x14006b3f1
mov eax, ebx
jmp 0x14006b3ed
lfence
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x14006b3fd
lfence
mov ecx, ebx
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x14006b407
lfence
mov ecx, eax
call sym.SystemInformer.exe_PhGetWin32Message
lea r9, str.Unable_to_execute_the_memory_list_command
mov rbx, rax
mov rcx, rdi
test rax, rax
je 0x14006b457
lfence
lfence
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov r8d, 0xfffe
mov qword [rsp + 0x20], rsi
call sym.SystemInformer.exe_PhShowMessage2
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x14006b465
lfence
call fcn.14013d2a0
jmp 0x14006b465
mov r8, rsi
mov edx, 0x10
call sym.SystemInformer.exe_PhShowMessage
mov rcx, r12
call sym.SystemInformer.exe_PhDestroyEMenu
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.1401dd6a0
add rsp, 0x230
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret