Function at 0x140037ac0
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
push rbp
push rbx
push rdi
lea rbp, [r11 - 0x148]
sub rsp, 0x230
mov rax, qword [0x1402bb040]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov rax, qword [rcx + 0x20]
xorps xmm0, xmm0
mov qword [r11 + 0x18], r12
mov rbx, rcx
mov rcx, qword [rcx]
xor r12d, r12d
mov qword [rbp - 0x18], r12
mov edx, 0x587
mov rdi, qword [rax + 0x20]
mov qword [r11 - 0x28], r15
mov qword [rbp - 0x40], r12
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 8]
xor r9d, r9d
xor r8d, r8d
mov qword [rbp - 0x48], rax
mov edx, 0x845c
mov r15, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword ds:[rbx + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1009
call qword [sym.imp.USER32.dll_SendMessageW]
mov r8, qword [rbx + 0x30]
test r8, r8
je 0x140037b82
mov rcx, qword [0x1402c6140]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov qword [rbx + 0x30], r12
mov ecx, dword [0x1402bbf68]
mov edx, 0x30
mov qword [rsp + 0x258], rsi
lea eax, [rcx - 0x3e]
cmp eax, 1
ja 0x140037bfa
mov rax, qword [rbx + 0x20]
lea r9, [rbp - 0x60]
mov esi, dword [0x1402c8fac]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], edx
xorps xmm0, xmm0
mov edx, 0x1fffff
mov qword [rbp - 0x58], r12
mov rcx, qword [rax + 0x20]
mov qword [rbp - 0x60], rcx
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x58], r12d
mov qword [rsp + 0x50], r12
movdqu xmmword [rsp + 0x60], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x140037c67
cmp esi, 5
jne 0x140037c67
mov edx, 0x1fffff
jmp 0x140037c5a
cmp ecx, 0x64
jb 0x140037c67
mov rax, qword [rbx + 0x20]
lea r9, [rbp - 0x60]
mov esi, dword [0x1402c8fac]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], edx
xorps xmm0, xmm0
mov edx, 0x3000
mov qword [rbp - 0x58], r12
mov rcx, qword [rax + 0x20]
mov qword [rbp - 0x60], rcx
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x58], r12d
mov qword [rsp + 0x50], r12
movdqu xmmword [rsp + 0x60], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x140037c67
cmp esi, 5
jne 0x140037c67
mov edx, 0x3000
lea r8, [rbp - 0x60]
lea rcx, [rbp - 0x18]
call fcn.140178dc0
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140037c79
lea rdx, [rbp - 0x40]
call fcn.14016fee0
lea rax, str.EnableHeapReflection
mov qword [rbp - 0x60], 0x28
lea rcx, [rbp - 0x60]
mov qword [rbp - 0x58], rax
call sym.SystemInformer.exe_Ordinal_1886
test eax, eax
je 0x140037cae
mov r8, rdi
lea rcx, [rbp - 0x38]
xor edx, edx
call fcn.140142d80
test eax, eax
cmovns rdi, qword [rbp - 0x28]
mov rax, qword [rbx + 0x20]
mov qword [rsp + 0x268], r13
mov qword [rsp + 0x228], r14
test dword [rax + 0xf0], 0x200
je 0x140038385
mov rcx, qword ds:[rbx]
xor r8d, r8d
mov edx, 1
call sym.SystemInformer.exe_Ordinal_1184
test al, al
je 0x14003834a
cmp qword [0x1402cb1d0], r12
jne 0x140037d05
mov edi, 0xc0000037
jmp 0x1400382be
xor edx, edx
lea rcx, [rbp - 0x10]
mov r8d, 0xb0
call fcn.14020c410
mov dword [rbp + 0x20], edi
mov rdi, qword [0x1402cb1d8]
mov dword [rbp + 0x18], 0x13
test rdi, rdi
je 0x1400382b9
mov edx, 8
mov r8d, 0x1000
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
test rax, rax
je 0x1400382b9
mov rcx, qword [0x1402cb1d0]
lea r8, [rbp - 0x10]
sub eax, edi
mov dword [rbp + 0x24], 0x1000
lea rdx, [rbp - 0x10]
mov dword [rbp + 0x28], eax
mov qword [rbp - 0x10], 0xb00088
call qword [sym.imp.ntdll.dll_NtRequestWaitReplyPort]
mov edi, dword [rbp + 0x1c]
test eax, eax
cmovs edi, eax
cmp edi, 0x80000005
jne 0x140037dee
mov rcx, qword [0x1402cb1d8]
test rcx, rcx
je 0x140037da6
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov edx, dword [rbp + 0x20]
lea r8, [rbp + 0x24]
xor ecx, ecx
call fcn.1400a4660
mov rsi, rax
test rax, rax
je 0x1400382b9
mov rcx, qword [0x1402cb1d0]
lea r8, [rbp - 0x10]
lea rdx, [rbp - 0x10]
mov qword [rbp - 0x10], 0xb00088
call qword [sym.imp.ntdll.dll_NtRequestWaitReplyPort]
mov edi, dword [rbp + 0x1c]
test eax, eax
cmovs edi, eax
test edi, edi
js 0x140037e02
mov edx, dword [rbp + 0x20]
mov rcx, rsi
call sym.SystemInformer.exe_Ordinal_1330
mov r14, rax
jmp 0x140037e06
mov r14, qword [rbp - 0x60]
mov rcx, qword [0x1402cb1d8]
test rcx, rcx
je 0x140037e1d
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax]
call sym.SystemInformer.exe_Ordinal_1190
test edi, edi
jns 0x140037e7f
mov rsi, qword [rbx]
mov eax, edi
cmp edi, 0xc0000022
je 0x140037e5d
cmp eax, 0xc0000005
je 0x140037e5d
mov ecx, eax
shr ecx, 0x10
and ecx, 0xfff
cmp ecx, 7
jne 0x140037e52
movzx ecx, ax
jmp 0x140037e6a
cmp ecx, 0xb
jne 0x1400382c8
jmp 0x140037e68
lfence
mov ecx, edi
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
mov ecx, eax
test ecx, ecx
je 0x1400382c8
lfence
call sym.SystemInformer.exe_Ordinal_1670
jmp 0x1400382d2
mov rdi, qword [0x1402c6140]
mov edx, 4
mov rcx, rdi
mov r8d, 0xb14
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor edx, edx
mov r8d, 0xb14
mov rcx, rax
mov rsi, rax
call fcn.14020c410
mov r8, rsi
mov edx, 0xb14
mov rcx, r14
call sym.SystemInformer.exe_Ordinal_1396
nop dword [rax]
test al, al
jne 0x140037ed7
mov r8, rsi
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x140038853
mov qword [rbx + 0x30], rsi
mov edx, r12d
mov eax, dword [rsi + 4]
mov qword [rbx + 0x28], rax
cmp dword [rsi], r12d
jbe 0x140038298
cmp r15d, 1
mov qword [rbp - 0x60], r14
mov eax, 0xff
lea r15, str.NT_Heap
cmove eax, r12d
lea r13, str.NT_Heap__Lookaside_
mov dword [rsp + 0x34], eax
lea r12, str.NT_Heap__LFH_
nop dword [rax + rax]
mov eax, edx
lea ecx, [rdx + 1]
imul r14, rax, 0x1c
mov r8d, 0xa
mov dword [rsp + 0x30], ecx
add r14, 8
lea rdx, [rbp + 0xa0]
add r14, rsi
call fcn.1401ec938
mov rcx, qword [rbx + 8]
lea rax, [rbp + 0xa0]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x58], rax
xor r8d, r8d
mov dword [rsp + 0x40], 5
mov edx, 0x104d
mov qword [rsp + 0x44], 0x7fffffff
mov qword [rsp + 0x68], r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword ds:[r14 + 0x10]
lea rdx, [rbp + 0xa4]
mov r8d, 0x10
mov dword [rbp + 0xa0], 0x780030
mov rdi, rax
call fcn.1401ec914
mov rcx, qword [rbx + 8]
lea rax, [rbp + 0xa0]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x58], rax
xor r8d, r8d
mov dword [rsp + 0x40], 1
mov edx, 0x104c
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x48], 1
call qword [sym.imp.USER32.dll_SendMessageW]
movzx ecx, byte [0x1402c29e0]
mov edx, dword [r14 + 0x14]
movzx eax, byte [rsp + 0x34]
cmp dword [rbp - 0x48], 1
mov qword [rsp + 0x50], rdx
mov edx, 1
cmove ecx, eax
mov dword [rsp + 0x40], 0x10d
mov byte [rsp + 0x4a], cl
xor r8d, r8d
lea rcx, [rsp + 0x40]
call sym.SystemInformer.exe_Ordinal_1375
mov rcx, rax
call sym.SystemInformer.exe_Ordinal_1238
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 1
xor r8d, r8d
mov dword [rsp + 0x44], edi
mov edx, 0x104c
mov dword [rsp + 0x48], 2
mov rcx, qword [rax + 8]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx ecx, byte [0x1402c29e0]
mov edx, dword [r14 + 0x18]
movzx eax, byte [rsp + 0x34]
cmp dword [rbp - 0x48], 1
mov qword [rsp + 0x50], rdx
mov edx, 1
cmove ecx, eax
mov dword [rsp + 0x40], 0x10d
mov byte [rsp + 0x4a], cl
xor r8d, r8d
lea rcx, [rsp + 0x40]
call sym.SystemInformer.exe_Ordinal_1375
mov rcx, rax
call sym.SystemInformer.exe_Ordinal_1238
mov dword [rsp + 0x40], 1
lea r9, [rsp + 0x40]
mov dword [rsp + 0x44], edi
xor r8d, r8d
mov dword [rsp + 0x48], 3
mov edx, 0x104c
mov rcx, qword [rax + 8]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [r14 + 0xc]
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x50], rax
mov edx, 1
mov dword [rsp + 0x40], 0x10009
call sym.SystemInformer.exe_Ordinal_1375
mov rcx, rax
call sym.SystemInformer.exe_Ordinal_1238
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 1
xor r8d, r8d
mov dword [rsp + 0x44], edi
mov edx, 0x104c
mov dword [rsp + 0x48], 4
mov rcx, qword [rax + 8]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [r14]
and ecx, 0xffff0fff
call fcn.140037360
mov rcx, rax
call sym.SystemInformer.exe_Ordinal_1238
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 1
xor r8d, r8d
mov dword [rsp + 0x44], edi
mov edx, 0x104c
mov dword [rsp + 0x48], 5
mov rcx, qword [rax + 8]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [r14]
and ecx, 0xf000
call fcn.140037a00
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x40]
mov edx, 0x104c
mov dword [rsp + 0x40], 1
xor r8d, r8d
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x48], 6
mov qword [rsp + 0x58], rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [r14 + 4]
cmp eax, 0xddeeddee
je 0x14003821d
nop word [rax + rax]
cmp eax, 0xffeeffee
jne 0x140038288
movzx ecx, byte [r14 + 8]
lea r9, [rsp + 0x40]
mov r10, qword [rbx + 8]
mov edx, 0x104c
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x48], 7
sub ecx, 1
je 0x140038216
xor r8d, r8d
cmp ecx, 1
mov rcx, r10
je 0x14003820c
mov qword [rsp + 0x58], r15
jmp 0x140038282
mov qword [rsp + 0x58], r12
jmp 0x140038282
mov qword [rsp + 0x58], r13
jmp 0x14003827c
movzx ecx, byte [r14 + 8]
lea r9, [rsp + 0x40]
mov r10, qword [rbx + 8]
mov edx, 0x104c
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x48], 7
sub ecx, 1
je 0x140038270
xor r8d, r8d
cmp ecx, 1
mov rcx, r10
je 0x140038262
lea rax, str.Segment_Heap
mov qword [rsp + 0x58], rax
jmp 0x140038282
lea rax, str.Segment_Heap__LFH_
mov qword [rsp + 0x58], rax
jmp 0x140038282
lea rax, str.Segment_Heap__Lookaside_
mov qword [rsp + 0x58], rax
mov rcx, r10
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [rsp + 0x30]
cmp edx, dword [rsi]
jb 0x140037f20
mov r14, qword [rbp - 0x60]
lea rcx, [r14 - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140038853
call fcn.140143da0
jmp 0x140038853
mov edi, 0xc0000229
nop
call sym.SystemInformer.exe_Ordinal_1190
mov rsi, qword [rbx]
lfence
mov ecx, edi
call sym.SystemInformer.exe_Ordinal_1660
lea r8, [0x14023c43c]
mov rdi, rax
lea r9, str.Unable_to_query_heap_information.
mov rcx, rsi
test rax, rax
je 0x140038336
lfence
lfence
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.SystemInformer.exe_Ordinal_1699
lea rcx, ds:[rdi - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140038853
lfence
call fcn.140143da0
jmp 0x140038853
mov edx, 0x10
call sym.SystemInformer.exe_Ordinal_1698
jmp 0x140038853
mov rcx, qword [rbx]
lea rax, str.The_32_bit_version_of_System_Informer_could_not_be_located.
lea r8, [0x14023c43c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
lea r9, str.Unable_to_query_32bit_heap_information.
mov r8d, 0xfffe
mov edx, 0x20
call sym.SystemInformer.exe_Ordinal_1699
nop dword [rax]
jmp 0x140038853
lea rdx, [rbp - 0x60]
mov rcx, rdi
call fcn.14016f0e0
mov edi, eax
test eax, eax
jns 0x14003845f
mov rsi, qword ds:[rbx]
cmp eax, 0xc0000022
je 0x1400383d3
cmp eax, 0xc0000005
je 0x1400383d3
mov ecx, eax
and ecx, 0xfff0000
cmp ecx, 0x70000
jne 0x1400383c3
movzx eax, di
jmp 0x1400383de
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x1400383e4
mov eax, edi
jmp 0x1400383de
lfence
mov ecx, edi
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
nop
test eax, eax
jne 0x1400383f0
lfence
mov ecx, edi
call sym.SystemInformer.exe_Ordinal_1660
jmp 0x1400383fa
lfence
mov ecx, eax
call sym.SystemInformer.exe_Ordinal_1670
lea r8, [0x14023c43c]
mov rdi, rax
lea r9, str.Unable_to_query_heap_information.
mov rcx, rsi
test rax, rax
je 0x140038336
lfence
lfence
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.SystemInformer.exe_Ordinal_1699
lea rcx, [rdi - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140038853
lfence
call fcn.140143da0
jmp 0x140038853
mov r14, qword [rbp - 0x60]
mov edx, r12d
mov qword [rbx + 0x30], r14
mov rax, qword [r14 + 8]
mov qword [rbx + 0x28], rax
cmp dword [r14], r12d
jbe 0x140038853
cmp r15d, 1
lea r13, str.NT_Heap__Lookaside_
mov eax, 0xff
lea r15, str.NT_Heap
cmove eax, r12d
lea r12, str.NT_Heap__LFH_
mov dword [rsp + 0x34], eax
mov eax, edx
lea ecx, [rdx + 1]
mov r8d, 0xa
mov dword [rsp + 0x30], ecx
lea rdx, [rbp - 0x10]
lea rsi, [rax*4 + 2]
add rsi, rax
lea rsi, [r14 + rsi*8]
call fcn.1401ec938
mov rcx, qword [rbx + 8]
lea rax, [rbp - 0x10]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x58], rax
xor r8d, r8d
mov dword [rsp + 0x40], 5
mov edx, 0x104d
mov qword [rsp + 0x44], 0x7fffffff
mov qword [rsp + 0x68], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsi + 0x10]
lea rdx, [rbp - 0xc]
mov r8d, 0x10
mov dword [rbp - 0x10], 0x780030
mov rdi, rax
call fcn.1401ec914
mov rcx, qword [rbx + 8]
lea rax, [rbp - 0x10]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x58], rax
xor r8d, r8d
mov dword [rsp + 0x40], 1
mov edx, 0x104c
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x48], 1
call qword [sym.imp.USER32.dll_SendMessageW]
movzx ecx, byte [0x1402c29e0]
mov edx, 1
movzx eax, byte [rsp + 0x34]
cmp dword [rbp - 0x48], 1
mov dword [rsp + 0x40], 0x10d
cmove ecx, eax
mov rax, qword [rsi + 0x18]
mov byte [rsp + 0x4a], cl
xor r8d, r8d
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x50], rax
call sym.SystemInformer.exe_Ordinal_1375
mov rcx, rax
mov dword [rbp + 0xa0], 1
mov dword [rbp + 0xa4], edi
mov dword [rbp + 0xa8], 2
call sym.SystemInformer.exe_Ordinal_1238
lea r9, [rbp + 0xa0]
xor r8d, r8d
mov edx, 0x104c
mov rcx, qword [rax + 8]
mov qword [rbp + 0xb8], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx ecx, byte [0x1402c29e0]
mov edx, 1
movzx eax, byte [rsp + 0x34]
cmp dword [rbp - 0x48], 1
mov dword [rsp + 0x40], 0x10d
cmove ecx, eax
mov rax, qword [rsi + 0x20]
mov byte [rsp + 0x4a], cl
xor r8d, r8d
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x50], rax
call sym.SystemInformer.exe_Ordinal_1375
mov rcx, rax
mov dword [rbp + 0xa0], 1
mov dword [rbp + 0xa4], edi
mov dword [rbp + 0xa8], 3
call sym.SystemInformer.exe_Ordinal_1238
lea r9, [rbp + 0xa0]
xor r8d, r8d
mov edx, 0x104c
mov rcx, qword [rax + 8]
mov qword [rbp + 0xb8], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [rsi + 0xc]
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x50], rax
mov edx, 1
mov dword [rsp + 0x40], 0x10009
call sym.SystemInformer.exe_Ordinal_1375
mov rcx, rax
mov dword [rbp + 0xa0], 1
mov dword [rbp + 0xa4], edi
mov dword [rbp + 0xa8], 4
call sym.SystemInformer.exe_Ordinal_1238
lea r9, [rbp + 0xa0]
xor r8d, r8d
mov edx, 0x104c
mov rcx, qword [rax + 8]
mov qword [rbp + 0xb8], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [rsi]
and ecx, 0xffff0fff
mov dword [rbp + 0xa0], 1
mov dword [rbp + 0xa4], edi
mov dword [rbp + 0xa8], 5
call fcn.140037360
mov rcx, rax
call sym.SystemInformer.exe_Ordinal_1238
lea r9, [rbp + 0xa0]
xor r8d, r8d
mov edx, 0x104c
mov rcx, qword [rax + 8]
mov qword [rbp + 0xb8], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [rsi]
and ecx, 0xf000
mov dword [rbp + 0xa0], 1
mov dword [rbp + 0xa4], edi
mov dword [rbp + 0xa8], 6
call fcn.140037a00
mov rcx, qword [rbx + 8]
lea r9, [rbp + 0xa0]
mov edx, 0x104c
mov qword [rbp + 0xb8], rax
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [rsi + 4]
cmp eax, 0xddeeddee
je 0x1400387ca
nop
cmp eax, 0xffeeffee
jne 0x140038846
movzx edx, byte [rsi + 8]
lea r9, [rbp + 0xa0]
mov rcx, qword [rbx + 8]
mov dword [rbp + 0xa0], 1
mov dword [rbp + 0xa4], edi
mov dword [rbp + 0xa8], 7
sub edx, 1
je 0x1400387be
xor r8d, r8d
cmp edx, 1
mov edx, 0x104c
je 0x1400387b2
mov qword [rbp + 0xb8], r15
jmp 0x14003883b
mov qword [rbp + 0xb8], r12
jmp 0x14003883b
mov qword [rbp + 0xb8], r13
jmp 0x140038833
movzx edx, byte [rsi + 8]
lea r9, [rbp + 0xa0]
mov rcx, qword [rbx + 8]
mov dword [rbp + 0xa0], 1
mov dword [rbp + 0xa4], edi
mov dword [rbp + 0xa8], 7
sub edx, 1
je 0x140038825
xor r8d, r8d
cmp edx, 1
mov edx, 0x104c
je 0x140038815
lea rax, str.Segment_Heap
mov qword [rbp + 0xb8], rax
jmp 0x14003883b
lea rax, str.Segment_Heap__LFH_
mov qword [rbp + 0xb8], rax
jmp 0x14003883b
lea rax, str.Segment_Heap__Lookaside_
mov qword [rbp + 0xb8], rax
mov edx, 0x104c
xor r8d, r8d
nop dword [rax + rax]
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [rsp + 0x30]
cmp edx, dword [r14]
jb 0x1400384a1
mov rcx, qword ds:[rbp - 0x30]
mov r15, qword [rsp + 0x220]
mov r14, qword [rsp + 0x228]
mov r13, qword [rsp + 0x268]
mov r12, qword [rsp + 0x260]
mov rsi, qword [rsp + 0x258]
test rcx, rcx
je 0x14003888b
call qword [sym.imp.ntdll.dll_NtClose]
mov rdi, qword [rbp - 0x38]
test rdi, rdi
je 0x1400388a8
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
mov rdi, qword [rbp - 0x40]
test rdi, rdi
je 0x1400388f1
xor eax, eax
mov qword [rbp - 0x60], rdi
xor r9d, r9d
mov word [rbp - 0x53], ax
mov r8d, 0x18
mov byte [rbp - 0x51], al
lea rdx, [rbp - 0x60]
mov byte [rbp - 0x54], al
mov ecx, 0x2c
mov qword [rbp - 0x50], rax
mov dword [rsp + 0x20], eax
mov dword [rbp - 0x58], 3
call qword [sym.imp.ntdll.dll_NtPowerInformation]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rbx + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x844d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 8]
xor r9d, r9d
mov edx, 0x845c
mov r8d, 1
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.1401e5e40
add rsp, 0x230
pop rdi
pop rbx
pop rbp
ret