Function at 0x78bd8f20
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x2d0
mov rax, qword [0x78c09100]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov rax, qword gs:[0x30]
and dword [rsp + 0x38], 0
lea r8, [0x78bd3c58]
mov rdi, qword [rax + 0x60]
mov rax, qword [0x78bd10b0]
lea rcx, [rsp + 0x50]
mov qword [0x78c0af50], rax
mov rax, qword [0x78c0a778]
mov edx, 1
and dword [rax + 8], 0
mov dword [rax], 0x1000
call qword [0x78bd1038]
test eax, eax
js 0x78bd8ff6
mov rcx, qword [rsp + 0x50]
mov r8d, 4
lea r9, [rsp + 0x38]
lea rdx, [0x78bd3c88]
mov dword [rsp + 0x20], r8d
call sym.wow64.dll_Wow64GetWow64ImageOption
test eax, eax
js 0x78bd8feb
mov eax, dword [rsp + 0x38]
mov edx, 0xf00
test edx, eax
je 0x78bd8fd0
mov ecx, eax
and ecx, edx
shl ecx, 4
mov qword [0x78c0a1f8], rcx
movzx ecx, al
test al, al
je 0x78bd8fe1
shl ecx, 0xc
mov qword [0x78c09298], rcx
mov rcx, qword [0x78c0a778]
mov dword [rcx + 8], eax
mov rcx, qword [rsp + 0x50]
call qword [0x78bd1058]
and qword [rsp + 0x30], 0
lea r8, [0x78bd3cc0]
lea rcx, [rsp + 0xb0]
mov r9d, 0x7ffe0030
mov edx, 0x208
call fcn.78bd8e44
test eax, eax
js 0x78bd9150
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x58]
call qword [0x78bd1040]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x58]
xor edx, edx
xor ecx, ecx
call qword [0x78bd1088]
test eax, eax
js 0x78bd9120
lea rdx, [0x78bd3cf8]
lea rcx, [rsp + 0x40]
call qword [0x78bd1090]
mov rcx, qword [rsp + 0x30]
lea r9, [0x78c0afa0]
lea rdx, [rsp + 0x40]
xor r8d, r8d
call qword [0x78bd1098]
test eax, eax
js 0x78bd9120
lea rdx, [0x78bd3d10]
lea rcx, [rsp + 0x40]
call qword [0x78bd1090]
mov rcx, qword [rsp + 0x30]
lea r9, [0x78c0af98]
lea rdx, [rsp + 0x40]
xor r8d, r8d
call qword [0x78bd1098]
test eax, eax
js 0x78bd9120
lea rdx, [0x78bd3d28]
lea rcx, [rsp + 0x40]
call qword [0x78bd1090]
mov rcx, qword [rsp + 0x30]
lea r9, [0x78c0af90]
lea rdx, [rsp + 0x40]
xor r8d, r8d
call qword [0x78bd1098]
test eax, eax
js 0x78bd9120
lea rdx, [0x78bd3d40]
lea rcx, [rsp + 0x40]
call qword [0x78bd1090]
mov rcx, qword [rsp + 0x30]
lea r9, [0x78c0af88]
lea rdx, [rsp + 0x40]
xor r8d, r8d
call qword [0x78bd1098]
test eax, eax
js 0x78bd9120
call qword [0x78c0afa0]
test eax, eax
jns 0x78bd9150
mov rcx, qword [rsp + 0x30]
and qword [0x78c0afa0], 0
and qword [0x78c0af98], 0
and qword [0x78c0af90], 0
and qword [0x78c0af88], 0
test rcx, rcx
je 0x78bd9150
call qword [0x78bd10a0]
call fcn.78bd93f0
test eax, eax
js 0x78bd9202
xor r9d, r9d
lea rdx, [rsp + 0x70]
lea r8d, [r9 + 0x40]
lea ecx, [r9 + 0x3e]
call qword [0x78bd10a8]
test eax, eax
js 0x78bd9202
mov rax, qword [rsp + 0x98]
mov qword [0x78c0af60], rax
mov eax, dword [0x7ffe036c]
mov dword [0x78c0af68], eax
mov eax, dword [0x7ffe0340]
mov dword [0x78c0af84], eax
mov eax, dword [0x7ffe0344]
mov dword [0x78c0af80], eax
mov eax, dword [0x7ffe0348]
mov dword [0x78c0af7c], eax
mov eax, dword [0x7ffe034c]
mov dword [0x78c0af78], eax
mov eax, dword [0x7ffe0350]
mov dword [0x78c0af58], eax
call fcn.78bd9c34
test eax, eax
js 0x78bd9202
call fcn.78bda530
mov ebx, eax
test eax, eax
jns 0x78bd9227
mov r8d, eax
lea rdx, [0x78bd3de0]
mov ecx, 1
call sym.wow64.dll_Wow64LogPrint
mov eax, ebx
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.78bfdec0
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov ebx, 0x30
lea rcx, [0x78c0aa00]
lea rdx, [0x78c0a168]
mov r8, rbx
call fcn.78bfe074
mov rdx, qword [0x78bd1f68]
lea rcx, [0x78c0aa60]
mov r8, rbx
call fcn.78bfe074
mov rdx, qword [0x78bd1f70]
lea rcx, [0x78c0aa30]
mov r8, rbx
call fcn.78bfe074
lea rcx, [0x78c0aa90]
lea rdx, [0x78c09268]
mov r8, rbx
call fcn.78bfe074
mov r11, qword gs:[0x30]
mov eax, dword [rdi + 0x2f8]
mov ecx, dword [r11 + 0x2030]
mov qword [0x78c0af70], rcx
cmp dword [rcx + 0x1e8], 0
mov dword [rcx + 0x1f8], eax
mov eax, dword [rdi + 0x308]
mov dword [rcx + 0x200], eax
jne 0x78bd92c8
mov eax, dword [rdi + 0x2d8]
mov dword [rcx + 0x1e8], eax
lea rsi, [0x78bd3e28]
mov rcx, rsi
call fcn.78bd8bfc
lea rdx, [0x78c0a9f0]
mov rcx, rax
mov rdi, rax
call qword [0x78bd1f28]
mov ebx, eax
cmp rdi, rsi
je 0x78bd930d
mov rcx, qword gs:[0x30]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [0x78bd10f0]
test ebx, ebx
jns 0x78bd9200
mov r8d, ebx
lea rdx, [0x78bd3e48]
jmp 0x78bd91f6