Function at 0x140034e40
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
push rbp
push rbx
push rdi
lea rbp, [r11 - 0x678]
sub rsp, 0x760
mov rax, qword [0x1402b5020]
xor rax, rsp
mov qword [rbp + 0x640], rax
mov rax, qword [rcx + 0x20]
xorps xmm0, xmm0
mov qword [r11 + 0x18], r12
mov rbx, rcx
mov rcx, qword [rcx]
xor r12d, r12d
mov qword [rbp + 0x510], r12
mov edx, 0x587
mov rdi, qword [rax + 0x20]
mov qword [r11 - 0x28], r15
mov qword [rbp - 0x58], r12
movups xmmword [rbp + 0x28], xmm0
movups xmmword [rbp + 0x38], xmm0
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 8]
xor r9d, r9d
xor r8d, r8d
mov qword [rbp - 0x60], rax
mov edx, 0x845c
mov r15, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword ds:[rbx + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1009
call qword [sym.imp.USER32.dll_SendMessageW]
mov r8, qword [rbx + 0x30]
test r8, r8
je 0x140034f02
mov rcx, qword [0x1402bfe50]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov qword [rbx + 0x30], r12
mov ecx, dword [0x1402b5e88]
mov edx, 0x30
mov qword [rsp + 0x788], rsi
lea eax, [rcx - 0x3e]
cmp eax, 1
ja 0x140034f79
mov rax, qword ds:[rbx + 0x20]
lea r9, [rbp - 0x50]
mov esi, dword [0x1402c2f94]
lea r8, [rbp - 8]
mov dword [rbp - 8], edx
xorps xmm0, xmm0
mov edx, 0x1fffff
mov qword [rbp - 0x48], r12
mov rcx, qword [rax + 0x20]
mov qword [rbp - 0x50], rcx
lea rcx, [rbp + 0x510]
mov qword [rbp], r12
mov dword [rbp + 0x10], r12d
mov qword [rbp + 8], r12
movdqu xmmword [rbp + 0x18], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x140034fe7
cmp esi, 5
jne 0x140034fe7
mov edx, 0x1fffff
jmp 0x140034fd7
cmp ecx, 0x64
jb 0x140034fe7
mov rax, qword ds:[rbx + 0x20]
lea r9, [rbp - 0x50]
mov esi, dword [0x1402c2f94]
lea r8, [rbp - 8]
mov dword [rbp - 8], edx
xorps xmm0, xmm0
mov edx, 0x3000
mov qword [rbp - 0x48], r12
mov rcx, qword [rax + 0x20]
mov qword [rbp - 0x50], rcx
lea rcx, [rbp + 0x510]
mov qword [rbp], r12
mov dword [rbp + 0x10], r12d
mov qword [rbp + 8], r12
movdqu xmmword [rbp + 0x18], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x140034fe7
cmp esi, 5
jne 0x140034fe7
mov edx, 0x3000
lea r8, [rbp - 0x50]
lea rcx, [rbp + 0x510]
call fcn.14016dca0
mov rcx, qword [rbp + 0x510]
test rcx, rcx
je 0x140034ffc
lea rdx, [rbp - 0x58]
call fcn.140165700
lea rax, str.EnableHeapReflection
mov qword [rbp - 0x40], 0x28
lea rcx, [rbp - 0x40]
mov qword [rbp - 0x38], rax
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x140035031
mov r8, rdi
lea rcx, [rbp + 0x28]
xor edx, edx
call fcn.14013c2e0
test eax, eax
cmovns rdi, qword [rbp + 0x38]
mov rax, qword [rbx + 0x20]
mov qword [rsp + 0x798], r13
mov qword [rsp + 0x758], r14
test dword [rax + 0xd0], 0x200
je 0x140035825
mov rcx, qword ds:[rbx]
xor r8d, r8d
lea edx, [r8 + 1]
call sym.SystemInformer.exe_PhUiConnectToPhSvcEx
test al, al
je 0x1400357ea
cmp qword [0x1402c4cf0], r12
jne 0x140035085
mov edi, 0xc0000037
jmp 0x140035758
xor edx, edx
lea rcx, [rbp + 0x520]
mov r8d, 0xb0
call fcn.1401dff50
mov rcx, qword [0x1402c4cf8]
mov dword [rbp + 0x548], 0x13
mov dword [rbp + 0x550], edi
test rcx, rcx
je 0x140035753
xor edx, edx
mov r8d, 0x1000
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
test rax, rax
je 0x140035753
sub eax, dword [0x1402c4cf8]
lea r8, [rbp + 0x520]
mov rcx, qword [0x1402c4cf0]
lea rdx, [rbp + 0x520]
mov dword [rbp + 0x558], eax
mov dword [rbp + 0x554], 0x1000
mov qword [rbp + 0x520], 0xb00088
call qword [sym.imp.ntdll.dll_NtRequestWaitReplyPort]
mov edi, dword ds:[rbp + 0x54c]
test eax, eax
cmovs edi, eax
cmp edi, 0x80000005
jne 0x140035192
mov rcx, qword [0x1402c4cf8]
test rcx, rcx
je 0x14003513f
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov edx, dword [rbp + 0x550]
lea r8, [rbp + 0x554]
xor ecx, ecx
call fcn.1400a09a0
mov rsi, rax
test rax, rax
je 0x140035753
mov rcx, qword [0x1402c4cf0]
lea r8, ds:[rbp + 0x520]
lea rdx, [rbp + 0x520]
mov qword [rbp + 0x520], 0xb00088
call qword [sym.imp.ntdll.dll_NtRequestWaitReplyPort]
mov edi, eax
test eax, eax
js 0x1400351aa
mov edi, dword [rbp + 0x54c]
test edi, edi
js 0x1400351aa
mov edx, dword ds:[rbp + 0x550]
mov rcx, rsi
call sym.SystemInformer.exe_PhCreateStringEx
mov r14, rax
jmp 0x1400351ae
mov r14, qword [rbp - 0x58]
mov rcx, qword [0x1402c4cf8]
mov qword [rsp + 0x38], r14
test rcx, rcx
je 0x1400351ca
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
call sym.SystemInformer.exe_PhUiDisconnectFromPhSvc
test edi, edi
jns 0x140035235
mov rsi, qword ds:[rbx]
mov eax, edi
cmp edi, 0xc0000022
je 0x14003520f
cmp eax, 0xc0000005
je 0x14003520f
mov ecx, eax
shr ecx, 0x10
and ecx, 0xfff
cmp ecx, 7
jne 0x140035204
movzx ecx, ax
jmp 0x14003521c
cmp ecx, 0xb
jne 0x140035760
jmp 0x14003521a
lfence
mov ecx, edi
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
mov ecx, eax
nop dword [rax]
test ecx, ecx
je 0x140035760
lfence
call sym.SystemInformer.exe_PhGetWin32Message
jmp 0x14003576a
mov rcx, qword [0x1402bfe50]
mov edx, 4
mov r8d, 0xb14
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor edx, edx
mov r8d, 0xb14
mov rcx, rax
mov rsi, rax
call fcn.1401dff50
mov r8, rsi
mov edx, 0xb14
mov rcx, r14
call sym.SystemInformer.exe_PhHexStringToBufferEx
test al, al
jne 0x140035290
mov rcx, qword [0x1402bfe50]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x140035cb7
mov qword ds:[rbx + 0x30], rsi
mov edx, r12d
mov eax, dword [rsi + 4]
mov qword [rbx + 0x28], rax
cmp dword [rsi], r12d
jbe 0x14003572d
cmp r15d, 1
lea r13, str.NT_Heap__Lookaside_
mov eax, 0xff
lea r15, str.NT_Heap
cmove eax, r12d
lea r12, str.NT_Heap__LFH_
mov dword [rsp + 0x34], eax
nop
mov eax, edx
lea ecx, [rdx + 1]
imul r14, rax, 0x1c
mov r8d, 0xa
mov dword [rsp + 0x30], ecx
add r14, 8
lea rdx, [rbp + 0x5d0]
add r14, rsi
call fcn.1401e4a70
mov rcx, qword [rbx + 8]
lea rax, [rbp + 0x5d0]
lea r9, [rbp + 0x70]
mov qword [rbp + 0x88], rax
xor r8d, r8d
mov dword [rbp + 0x70], 5
mov edx, 0x104d
mov qword [rbp + 0x74], 0x7fffffff
mov qword [rbp + 0x98], r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [r14 + 0x10]
lea rdx, [rbp + 0x5d4]
mov r8d, 0x10
mov dword [rbp + 0x5d0], 0x780030
mov rdi, rax
call fcn.1401e4a4c
mov rcx, qword [rbx + 8]
lea rax, [rbp + 0x5d0]
lea r9, [rbp + 0xf0]
mov qword [rbp + 0x108], rax
xor r8d, r8d
mov dword [rbp + 0xf0], 1
mov edx, 0x104c
mov dword [rbp + 0xf4], edi
mov dword [rbp + 0xf8], 1
call qword [sym.imp.USER32.dll_SendMessageW]
movzx ecx, byte [0x1402bcf8c]
mov edx, dword [r14 + 0x14]
movzx eax, byte [rsp + 0x34]
cmp dword [rbp - 0x60], 1
mov qword [rbp + 0xe0], rdx
cmove ecx, eax
mov dword [rbp + 0xd0], 0x10c
xor r8d, r8d
mov byte [rbp + 0xda], cl
lea rcx, [rbp + 0xd0]
lea edx, [r8 + 1]
call sym.SystemInformer.exe_PhFormat
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
lea r9, [rbp + 0x150]
mov dword [rbp + 0x150], 1
xor r8d, r8d
mov dword [rbp + 0x154], edi
mov edx, 0x104c
mov dword [rbp + 0x158], 2
mov rcx, qword [rax + 8]
mov qword [rbp + 0x168], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx ecx, byte [0x1402bcf8c]
mov edx, dword [r14 + 0x18]
movzx eax, byte [rsp + 0x34]
cmp dword [rbp - 0x60], 1
mov qword [rbp - 0x18], rdx
cmove ecx, eax
mov dword [rbp - 0x28], 0x10c
xor r8d, r8d
mov byte [rbp - 0x1e], cl
lea rcx, [rbp - 0x28]
lea edx, [r8 + 1]
call sym.SystemInformer.exe_PhFormat
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov dword [rbp + 0x1b0], 1
lea r9, [rbp + 0x1b0]
mov dword [rbp + 0x1b4], edi
xor r8d, r8d
mov dword [rbp + 0x1b8], 3
mov edx, 0x104c
mov rcx, qword [rax + 8]
mov qword [rbp + 0x1c8], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [r14 + 0xc]
lea rcx, [rbp + 0x48]
xor r8d, r8d
mov dword [rbp + 0x48], 0x10009
mov qword [rbp + 0x58], rax
lea edx, [r8 + 1]
call sym.SystemInformer.exe_PhFormat
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
lea r9, [rbp + 0x210]
mov dword [rbp + 0x210], 1
xor r8d, r8d
mov dword [rbp + 0x214], edi
mov edx, 0x104c
mov dword [rbp + 0x218], 4
mov rcx, qword [rax + 8]
mov qword [rbp + 0x228], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [r14]
and ecx, 0xffff0fff
call fcn.1400346e0
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
lea r9, [rbp + 0x270]
mov dword [rbp + 0x270], 1
xor r8d, r8d
mov dword [rbp + 0x274], edi
mov edx, 0x104c
mov dword [rbp + 0x278], 5
mov rcx, qword [rax + 8]
mov qword [rbp + 0x288], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [r14]
and ecx, 0xf000
call fcn.140034d80
mov rcx, qword [rbx + 8]
lea r9, [rbp + 0x2d0]
mov edx, 0x104c
mov dword [rbp + 0x2d0], 1
xor r8d, r8d
mov dword [rbp + 0x2d4], edi
mov dword [rbp + 0x2d8], 6
mov qword [rbp + 0x2e8], rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword ds:[r14 + 4]
cmp eax, 0xddeeddee
je 0x14003565f
cmp eax, 0xffeeffee
jne 0x140035715
movzx ecx, byte ds:[r14 + 8]
mov r10, qword [rbx + 8]
sub ecx, 1
je 0x140035632
xor r8d, r8d
mov edx, 0x104c
cmp ecx, 1
mov rcx, r10
je 0x140035605
mov dword ds:[rbp + 0x330], 1
lea r9, [rbp + 0x330]
mov dword [rbp + 0x334], edi
mov dword [rbp + 0x338], 7
mov qword [rbp + 0x348], r15
jmp 0x14003570f
mov dword [rbp + 0x390], 1
lea r9, [rbp + 0x390]
mov dword [rbp + 0x394], edi
mov dword [rbp + 0x398], 7
mov qword [rbp + 0x3a8], r12
jmp 0x14003570f
mov dword [rbp + 0x3f0], 1
lea r9, [rbp + 0x3f0]
mov dword [rbp + 0x3f4], edi
mov dword [rbp + 0x3f8], 7
mov qword [rbp + 0x408], r13
jmp 0x140035704
movzx ecx, byte [r14 + 8]
mov r10, qword [rbx + 8]
sub ecx, 1
je 0x1400356df
xor r8d, r8d
mov edx, 0x104c
cmp ecx, 1
mov rcx, r10
je 0x1400356ae
lea rax, str.Segment_Heap
mov dword [rbp + 0x450], 1
mov qword [rbp + 0x468], rax
lea r9, [rbp + 0x450]
mov dword [rbp + 0x454], edi
mov dword [rbp + 0x458], 7
jmp 0x14003570f
lea rax, str.Segment_Heap__LFH_
mov dword [rbp + 0x4b0], 1
mov qword [rbp + 0x4c8], rax
lea r9, [rbp + 0x4b0]
mov dword [rbp + 0x4b4], edi
mov dword [rbp + 0x4b8], 7
jmp 0x14003570f
lea rax, str.Segment_Heap__Lookaside_
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x58], rax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x48], 7
mov rcx, r10
mov edx, 0x104c
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword ds:[rsp + 0x30]
cmp edx, dword [rsi]
jb 0x1400352d0
mov r14, qword [rsp + 0x38]
lea rcx, ds:[r14 - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140035cb7
call fcn.14013d2a0
jmp 0x140035cb7
mov edi, 0xc0000229
call sym.SystemInformer.exe_PhUiDisconnectFromPhSvc
mov rsi, qword [rbx]
lfence
mov ecx, edi
call sym.SystemInformer.exe_PhGetNtMessage
lea r8, [0x140232c58]
mov rdi, rax
lea r9, str.Unable_to_query_heap_information.
mov rcx, rsi
test rax, rax
je 0x1400357d6
lfence
lfence
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.SystemInformer.exe_PhShowMessage2
lea rcx, ds:[rdi - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140035cb7
lfence
call fcn.14013d2a0
jmp 0x140035cb7
mov edx, 0x10
call sym.SystemInformer.exe_PhShowMessage
jmp 0x140035cb7
mov rcx, qword [rbx]
lea rax, str.The_32_bit_version_of_System_Informer_could_not_be_located.
lea r8, [0x140232c58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
lea r9, str.Unable_to_query_32bit_heap_information.
mov r8d, 0xfffe
mov edx, 0x20
call sym.SystemInformer.exe_PhShowMessage2
nop dword [rax]
jmp 0x140035cb7
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140164960
mov edi, eax
test eax, eax
jns 0x1400358ff
mov rsi, qword ds:[rbx]
cmp eax, 0xc0000022
je 0x140035873
cmp eax, 0xc0000005
je 0x140035873
mov ecx, eax
and ecx, 0xfff0000
cmp ecx, 0x70000
jne 0x140035863
movzx eax, di
jmp 0x14003587e
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x140035884
mov eax, edi
jmp 0x14003587e
lfence
mov ecx, edi
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
nop
test eax, eax
jne 0x140035890
lfence
mov ecx, edi
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x14003589a
lfence
mov ecx, eax
call sym.SystemInformer.exe_PhGetWin32Message
lea r8, [0x140232c58]
mov rdi, rax
lea r9, str.Unable_to_query_heap_information.
mov rcx, rsi
test rax, rax
je 0x1400357d6
lfence
lfence
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.SystemInformer.exe_PhShowMessage2
lea rcx, [rdi - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140035cb7
lfence
call fcn.14013d2a0
jmp 0x140035cb7
mov r14, qword [rsp + 0x38]
mov edx, r12d
mov qword [rbx + 0x30], r14
mov rax, qword [r14 + 8]
mov qword [rbx + 0x28], rax
cmp dword [r14], r12d
jbe 0x140035cb7
cmp r15d, 1
lea r13, str.NT_Heap__Lookaside_
mov eax, 0xff
lea r15, str.NT_Heap
cmove eax, r12d
lea r12, str.NT_Heap__LFH_
mov dword [rsp + 0x34], eax
nop dword [rax]
nop word [rax + rax]
mov eax, edx
lea ecx, [rdx + 1]
mov r8d, 0xa
mov dword [rsp + 0x30], ecx
lea rdx, [rbp + 0x5d0]
lea rsi, [rax*4 + 2]
add rsi, rax
lea rsi, [r14 + rsi*8]
call fcn.1401e4a70
mov rcx, qword [rbx + 8]
lea rax, [rbp + 0x5d0]
lea r9, [rbp + 0x70]
mov qword [rbp + 0x88], rax
xor r8d, r8d
mov dword [rbp + 0x70], 5
mov edx, 0x104d
mov qword [rbp + 0x74], 0x7fffffff
mov qword [rbp + 0x98], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsi + 0x10]
lea rdx, [rbp + 0x5d4]
mov r8d, 0x10
mov dword [rbp + 0x5d0], 0x780030
mov rdi, rax
call fcn.1401e4a4c
mov rcx, qword [rbx + 8]
lea rax, [rbp + 0x5d0]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x58], rax
xor r8d, r8d
mov dword [rsp + 0x40], 1
mov edx, 0x104c
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x48], 1
call qword [sym.imp.USER32.dll_SendMessageW]
movzx ecx, byte [0x1402bcf8c]
movzx eax, byte ds:[rsp + 0x34]
cmp dword [rbp - 0x60], 1
mov dword [rbp - 0x28], 0x10c
cmove ecx, eax
mov rax, qword [rsi + 0x18]
xor r8d, r8d
mov byte [rbp - 0x1e], cl
lea rcx, [rbp - 0x28]
mov qword [rbp - 0x18], rax
lea edx, [r8 + 1]
call sym.SystemInformer.exe_PhFormat
mov rcx, rax
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x48], 2
call sym.SystemInformer.exe_PhAutoDereferenceObject
lea r9, ds:[rsp + 0x40]
xor r8d, r8d
mov edx, 0x104c
mov rcx, qword [rax + 8]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx ecx, byte [0x1402bcf8c]
movzx eax, byte [rsp + 0x34]
cmp dword [rbp - 0x60], 1
mov dword [rbp - 0x28], 0x10c
cmove ecx, eax
mov rax, qword [rsi + 0x20]
xor r8d, r8d
mov byte [rbp - 0x1e], cl
lea rcx, [rbp - 0x28]
mov qword [rbp - 0x18], rax
lea edx, [r8 + 1]
call sym.SystemInformer.exe_PhFormat
mov rcx, rax
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x48], 3
call sym.SystemInformer.exe_PhAutoDereferenceObject
lea r9, [rsp + 0x40]
xor r8d, r8d
mov edx, 0x104c
mov rcx, qword [rax + 8]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [rsi + 0xc]
lea rcx, [rbp + 0x48]
xor r8d, r8d
mov dword [rbp + 0x48], 0x10009
mov qword [rbp + 0x58], rax
lea edx, [r8 + 1]
call sym.SystemInformer.exe_PhFormat
mov rcx, rax
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x48], 4
call sym.SystemInformer.exe_PhAutoDereferenceObject
lea r9, [rsp + 0x40]
xor r8d, r8d
mov edx, 0x104c
mov rcx, qword [rax + 8]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [rsi]
and ecx, 0xffff0fff
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x48], 5
call fcn.1400346e0
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
lea r9, [rsp + 0x40]
xor r8d, r8d
mov edx, 0x104c
mov rcx, qword [rax + 8]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [rsi]
and ecx, 0xf000
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x48], 6
call fcn.140034d80
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x40]
mov edx, 0x104c
mov qword [rsp + 0x58], rax
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword ds:[rsi + 4]
cmp eax, 0xddeeddee
je 0x140035c3a
cmp eax, 0xffeeffee
jne 0x140035caa
movzx edx, byte [rsi + 8]
lea r9, [rsp + 0x40]
mov rcx, qword [rbx + 8]
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x48], 7
sub edx, 1
je 0x140035c33
xor r8d, r8d
cmp edx, 1
mov edx, 0x104c
je 0x140035c2c
mov qword [rsp + 0x58], r15
jmp 0x140035ca4
mov qword [rsp + 0x58], r12
jmp 0x140035ca4
mov qword [rsp + 0x58], r13
jmp 0x140035c9c
movzx edx, byte ds:[rsi + 8]
lea r9, [rsp + 0x40]
mov rcx, qword [rbx + 8]
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x48], 7
sub edx, 1
je 0x140035c90
xor r8d, r8d
cmp edx, 1
mov edx, 0x104c
je 0x140035c82
lea rax, str.Segment_Heap
mov qword ds:[rsp + 0x58], rax
jmp 0x140035ca4
lea rax, str.Segment_Heap__LFH_
mov qword [rsp + 0x58], rax
jmp 0x140035ca4
lea rax, str.Segment_Heap__Lookaside_
mov qword [rsp + 0x58], rax
mov edx, 0x104c
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [rsp + 0x30]
cmp edx, dword [r14]
jb 0x140035950
mov rcx, qword [rbp + 0x30]
mov r15, qword [rsp + 0x750]
mov r14, qword [rsp + 0x758]
mov r13, qword [rsp + 0x798]
mov r12, qword [rsp + 0x790]
mov rsi, qword [rsp + 0x788]
test rcx, rcx
je 0x140035cee
call qword [sym.imp.ntdll.dll_NtClose]
mov rdi, qword [rbp + 0x28]
test rdi, rdi
je 0x140035d0f
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
mov rdi, qword [rbp - 0x58]
test rdi, rdi
je 0x140035d54
xor eax, eax
mov qword [rbp - 0x40], rdi
xor r9d, r9d
mov word [rbp - 0x33], ax
lea rdx, [rbp - 0x40]
mov byte [rbp - 0x31], al
mov dword [rbp - 0x38], 3
lea r8d, [rax + 0x18]
mov byte [rbp - 0x34], al
lea ecx, [rax + 0x2c]
mov qword [rbp - 0x30], rax
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll_NtPowerInformation]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rbx + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x844d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 8]
xor r9d, r9d
mov edx, 0x845c
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x640]
xor rcx, rsp
call fcn.1401dd6a0
add rsp, 0x760
pop rdi
pop rbx
pop rbp
ret