Function at 0x140056cb0
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
push rbp
push rbx
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x258]
sub rsp, 0x358
mov rax, qword [0x14020a008]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov rbx, rdx
mov r15, rcx
xor edx, edx
lea rcx, [rbp + 0xb0]
mov r8d, 0x190
call fcn.140163170
xor r13d, r13d
mov qword [rsp + 0x60], rbx
cmp byte [0x1402130ef], r13b
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x68], r13
mov edx, 0x410
jne 0x140056d5e
xorps xmm0, xmm0
mov dword [rbp - 0x78], 0x30
lea r9, [rsp + 0x60]
mov qword [rbp - 0x70], r13
lea r8, [rbp - 0x78]
mov dword [rbp - 0x60], r13d
movdqu xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x68], r13
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x140056d68
movzx eax, byte [0x1402130ef]
nop dword [rax]
test al, al
je 0x140056d7f
mov edx, 0x410
lea rcx, [rsp + 0x30]
lea r8, [rsp + 0x60]
call fcn.140123530
nop dword [rax + rax]
test eax, eax
jns 0x140056eb5
movzx eax, byte [0x1402130ef]
mov qword [rsp + 0x70], rbx
mov edx, 0x400
mov qword [rsp + 0x78], r13
lea rcx, [rsp + 0x30]
test al, al
jne 0x140056ddd
xorps xmm0, xmm0
mov dword [rbp - 0x48], 0x30
lea r9, [rsp + 0x70]
mov qword [rbp - 0x40], r13
lea r8, [rbp - 0x48]
mov dword [rbp - 0x30], r13d
movdqu xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x38], r13
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov ebx, eax
cmp eax, 0xc0000022
jne 0x140056de9
cmp byte [0x1402130ef], r13b
je 0x140056e1c
mov edx, 0x400
lea rcx, [rsp + 0x30]
lea r8, [rsp + 0x70]
call fcn.140123530
mov ebx, eax
nop dword [rax]
test ebx, ebx
jns 0x140056eb5
cmp ebx, 0xc0000022
je 0x140056e1c
cmp ebx, 0xc0000005
je 0x140056e1c
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x140056e28
movzx eax, bx
jmp 0x140056e24
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x140056e32
mov ecx, ebx
call sym.ProcessHacker.exe_PhGetNtMessage
nop
jmp 0x140056e39
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
lea r9, str.Unable_to_open_the_process.
mov rbx, rax
mov rcx, r15
test rax, rax
je 0x140056e9a
mov rax, qword ds:[rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov r8d, 0xfffe
lea rax, [0x1401b439c]
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhShowMessage2
lea rcx, [rbx - 0x10]
mov r14d, 0xffffffff
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x140057184
nop
call fcn.140106290
jmp 0x140057184
lea r8, [0x1401c7ff8]
mov edx, 0x10
call sym.ProcessHacker.exe_PhShowMessage
nop dword [rax + rax]
jmp 0x140057184
cmp qword [0x1402169b8], r13
mov qword [rsp + 0x3a0], rsi
mov qword [rsp + 0x350], r12
mov r12, qword [rsp + 0x30]
mov qword [rsp + 0x50], r13
je 0x140056ee6
movups xmm0, xmmword [0x1402169b0]
movaps xmmword [rsp + 0x40], xmm0
jmp 0x140056f36
mov ecx, 0x7ffe0030
mov qword [rsp + 0x48], 0x7ffe0030
call sym.ProcessHacker.exe_PhCountStringZ
add rax, rax
mov qword [rsp + 0x40], rax
cmp word [rax + 0x7ffe002e], 0x5c
jne 0x140056f14
add rax, 0xfffffffffffffffe
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
mov qword [0x1402169b0], rax
lock or dword [rsp], r13d
mov qword [0x1402169b8], 0x7ffe0030
mov rdi, qword [rsp + 0x40]
mov rdx, qword [0x140213b58]
lea rbx, [rdi + 0x26]
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, qword ds:[rsp + 0x48]
mov r8, rdi
mov rsi, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rcx + rbx], r13w
mov rcx, qword [rax + 8]
call fcn.140165120
mov rcx, qword [rsi + 8]
lea r8, str.LdrSystemDllInitBlock
movups xmm0, xmmword [str.System32_ntdll.dll]
mov qword [rsp + 0x28], r13
xor r9d, r9d
movups xmmword [rcx + rdi], xmm0
movups xmm1, xmmword [0x1401bc4d0]
movups xmmword [rcx + rdi + 0x10], xmm1
mov eax, dword [0x1401bc4e0]
mov dword [rcx + rdi + 0x20], eax
movzx eax, word [0x1401bc4e4]
mov word [rcx + rdi + 0x24], ax
lea rax, [rsp + 0x50]
mov rdx, qword [rsi + 8]
mov rcx, r12
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhGetProcedureAddressRemote
mov r14d, 0xffffffff
lea rcx, [rsi - 0x10]
mov edx, r14d
mov ebx, eax
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140056fe9
call fcn.140106290
test ebx, ebx
js 0x140057064
mov rdi, qword [rsp + 0x50]
test rdi, rdi
je 0x140057058
mov rcx, qword [0x140213cd0]
mov edx, 4
mov r8d, 0xe0
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor edx, edx
mov r8d, 0xe0
mov rcx, rax
mov rbx, rax
call fcn.140163170
mov r9d, 0xe0
mov qword [rsp + 0x20], r13
mov r8, rbx
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
test eax, eax
jns 0x14005705d
mov rcx, qword [0x140213cd0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x140057064
mov rbx, qword [rsp + 0x58]
mov qword [rbp + 0xb8], rbx
mov rcx, qword ds:[rsp + 0x30]
lea rdx, [rbp - 0x10]
call fcn.14009beb0
mov r12, qword [rsp + 0x350]
test eax, eax
js 0x140057156
mov edi, r13d
lea rbx, [rbp + 0xd0]
lea rsi, [rbp - 0x10]
mov rdx, qword [rsi]
test rdx, rdx
je 0x1400570bf
lea r9, [rsp + 0x58]
mov ecx, edi
lea r8, [rbp - 0x80]
call fcn.14009c390
test al, al
je 0x1400570bf
mov rax, qword [rbp - 0x80]
mov qword [rbx - 8], rax
mov rax, qword [rsp + 0x58]
mov qword [rbx], rax
inc edi
add rsi, 8
add rbx, 0x18
cmp edi, 0x10
jl 0x140057093
mov rcx, qword [sym.ProcessHacker.exe_PhInstanceHandle]
lea rax, [rbp + 0xb0]
lea r9, [0x1400571b0]
mov qword [rsp + 0x20], rax
mov r8, r15
mov edx, 0xd7
call qword [sym.imp.USER32.dll_DialogBoxParamW]
lea rbx, [rbp + 0xd0]
mov edi, 0x10
mov rcx, qword [rbx - 8]
mov qword [rbx - 8], r13
test rcx, rcx
je 0x140057125
add rcx, 0xfffffffffffffff0
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140057125
call fcn.140106290
mov rcx, qword ds:[rbx]
mov qword [rbx], r13
test rcx, rcx
je 0x14005714b
add rcx, 0xfffffffffffffff0
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14005714b
call fcn.140106290
add rbx, 0x18
sub rdi, 1
jne 0x140057102
mov r8, qword [rbp + 0xb8]
mov rsi, qword [rsp + 0x3a0]
test r8, r8
je 0x140057179
mov rcx, qword [0x140213cd0]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
nop
call fcn.140161390
add rsp, 0x358
pop r15
pop r14
pop r13
pop rdi
pop rbx
pop rbp
ret