Function at 0x180071a40
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 0x10], rdx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r12, r9
mov rsi, r8
mov r13, rcx
test rcx, rcx
jne 0x180071a82
mov eax, 0xc00000ef
jmp 0x180072003
test rsi, rsi
je 0x180071ffe
cmp word [r8], r15w
je 0x180071ffe
test r12, r12
jne 0x180071aa4
mov eax, 0xc00000f2
jmp 0x180072003
xorps xmm0, xmm0
mov qword [r9], r15
xorps xmm1, xmm1
mov word [rcx], r15w
xor r9d, r9d
mov qword [rbp - 0x29], r15
mov rcx, rsi
mov word [rbp + 0x6f], r15w
xor r8d, r8d
lea rdx, [rbp - 0x21]
movups xmmword [rbp - 0x21], xmm0
mov r14, r15
movups xmmword [rbp + 0x17], xmm0
movups xmmword [rbp - 9], xmm1
movups xmmword [rbp + 7], xmm1
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U_WithStatus]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x180071b13
lea r9, str.Failed_to_convert_dos_path_to_nt_path___x_
mov r8d, 0x8a6
mov dword [rsp + 0x20], eax
lea rdx, str.AslPathWildcardFindFirst
mov ecx, 1
call fcn.18001188c
jmp 0x180071fad
lea rcx, [rbp - 0x21]
call fcn.180071708
mov ebx, eax
test eax, eax
jns 0x180071b31
lea r9, str.AslPathCleanUstr_failed___x_
mov r8d, 0x8b1
jmp 0x180071af9
movzx ecx, word [rbp - 0x21]
lea r8, [rbp + 0x6f]
mov edx, 4
call fcn.180073748
mov ebx, eax
test eax, eax
jns 0x180071b58
lea r9, str.RtlUShortAdd_failed___x_
mov r8d, 0x8b7
jmp 0x180071af9
mov rax, qword gs:[0x60]
mov edx, 8
movzx ebx, word [rbp + 0x6f]
mov r8d, ebx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov r14, rax
test rax, rax
jne 0x180071b8f
mov ebx, 0xc0000017
jmp 0x180071fad
movzx r9d, word [rbp - 0x21]
mov rdx, rbx
mov r8, qword [rbp - 0x19]
mov rcx, r14
call fcn.1800736b0
mov ebx, eax
test eax, eax
jns 0x180071bbb
lea r9, str.RtlStringCbCopyNW_failed___x_
mov r8d, 0x8c3
jmp 0x180071af9
mov rcx, r14
call fcn.180073330
test eax, eax
jne 0x180071bed
lea r9, str.Failed_to_split_the_wildcard_path
mov r8d, 0x8d5
lea rdx, str.AslPathWildcardFindFirst
mov ebx, 0xc0000039
lea ecx, [rax + 1]
call fcn.18001188c
jmp 0x180071fad
cmp eax, 1
jne 0x180071c3e
mov rcx, qword [rbp - 0x19]
or qword [r12], 0xffffffffffffffff
call fcn.180070700
test eax, eax
jne 0x180071c0e
mov ebx, 0x80000006
jmp 0x180071fad
mov r8, rsi
mov edx, 0x104
mov rcx, r13
call fcn.18000ecd4
mov ebx, eax
test eax, eax
jns 0x180071c36
lea r9, str.RtlStringCbCopyNW_failed___x_
mov r8d, 0x8e7
jmp 0x180071af9
mov ebx, r15d
jmp 0x180071fad
mov rax, qword gs:[0x60]
mov edx, 8
mov rcx, qword [rax + 0x30]
lea r8d, [rdx + 0x38]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [rbp - 0x29], rax
mov rdi, rax
test rax, rax
je 0x180071b85
mov r8d, 4
lea rdx, str.___
mov rcx, rsi
call sub.ntdll.dll_wcsncmp
test eax, eax
mov ecx, r15d
xorps xmm0, xmm0
setne cl
mov dword [rdi], ecx
mov qword [rdi + 8], r14
mov r14, r15
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x30]
mov qword [rdi + 0x10], rcx
mov rcx, r15
mov qword [rdi + 0x30], 0x10
mov qword [rdi + 0x20], r15
mov qword [rdi + 0x28], r15
mov qword [rdi + 0x38], r15
mov qword [rdi + 0x18], 0x20
mov rax, qword [rdi + 0x30]
lea rsi, [rax - 1]
add rax, 7
cmp rax, 8
jb 0x180071d87
mov rdx, qword [rdi + 0x18]
lea r8, [rbp + 0x27]
not rsi
and rsi, rax
call fcn.180073a60
test eax, eax
jns 0x180071d09
mov ebx, 0xc0000095
jmp 0x180071d7e
mov rdx, qword [rdi + 0x18]
lea r8, [rbp - 0x39]
mov rcx, rsi
call fcn.180073a60
test eax, eax
js 0x180071d02
mov r8, qword [rdi + 0x38]
xor edx, edx
mov rcx, qword [rdi + 0x10]
test r8, r8
jne 0x180071d54
mov r8, qword [rbp - 0x39]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x180071d67
mov r8, qword [rbp - 0x39]
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
jmp 0x180071d67
mov r9, qword [rbp - 0x39]
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rbx, rbx
jne 0x180071d73
mov ebx, 0xc0000017
jmp 0x180071d7e
mov qword [rdi + 0x38], rbx
mov ebx, r15d
mov qword [rdi + 0x28], rsi
test ebx, ebx
jne 0x180071d8c
mov ebx, r15d
jmp 0x180071ddc
mov ebx, 0xc0000095
mov r8, qword [rdi + 0x38]
test r8, r8
je 0x180071da7
mov rcx, qword [rdi + 0x10]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
xorps xmm0, xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
test ebx, ebx
jns 0x180071df6
lea r9, str.RtlArrayInitialize_failed___x_
mov dword [rsp + 0x20], ebx
mov r8d, 0x844
lea rdx, str.AslpPathWildcardInitStack
mov ecx, 1
call fcn.18001188c
test ebx, ebx
jns 0x180071df6
mov dword [rsp + 0x20], ebx
lea r9, str.AslpPathWildcardInitStack_failed___x_
mov r8d, 0x90d
jmp 0x180071afd
mov rdi, qword [rbp - 0x29]
lea rcx, [rbp + 0x17]
mov rdx, qword [rdi + 8]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov r8, qword [rdi + 8]
lea rdx, [rbp + 0x17]
mov r9d, 1
mov word [rsp + 0x28], r15w
lea rcx, [rbp - 9]
mov qword [rsp + 0x20], r15
call fcn.180072fa0
mov ebx, eax
test eax, eax
jns 0x180071e48
lea r9, str.AslpPathWildcardAllocMatchNode_failed_to_create_root_of_path___x_
mov r8d, 0x91a
jmp 0x180071af9
mov r15, qword [rdi + 0x20]
cmp r15, qword [rdi + 0x28]
jb 0x180071f38
lea rcx, [r15 + 1]
cmp rcx, qword [rdi + 0x28]
ja 0x180071e86
mov ebx, 0xc000000d
xor r15d, r15d
test ebx, ebx
jns 0x180071f8c
mov dword [rsp + 0x20], ebx
lea r9, str.AslpPathWildcardPushNode_failed___x_
mov r8d, 0x920
jmp 0x180071afd
mov rbx, qword [rdi + 0x30]
dec rbx
lea rax, [rbx + rcx]
cmp rax, rcx
jb 0x180071f59
mov rdx, qword [rdi + 0x18]
lea r8, [rbp + 0x2f]
mov rcx, qword [rdi + 0x28]
not rbx
and rbx, rax
call fcn.180073a60
test eax, eax
jns 0x180071ebc
mov ebx, 0xc0000095
jmp 0x180071f30
mov rdx, qword [rdi + 0x18]
lea r8, [rbp - 0x31]
mov rcx, rbx
call fcn.180073a60
test eax, eax
js 0x180071eb5
mov r8, qword [rdi + 0x38]
xor edx, edx
mov rcx, qword [rdi + 0x10]
test r8, r8
jne 0x180071f07
mov r8, qword [rbp - 0x31]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x180071f1a
mov r8, qword [rbp - 0x31]
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
jmp 0x180071f1a
mov r9, qword [rbp - 0x31]
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
nop dword [rax + rax]
mov rsi, rax
test rsi, rsi
jne 0x180071f26
mov ebx, 0xc0000017
jmp 0x180071f30
mov qword [rdi + 0x28], rbx
xor ebx, ebx
mov qword [rdi + 0x38], rsi
test ebx, ebx
jne 0x180071e65
mov rcx, qword [rdi + 0x18]
lea r8, [rbp - 0x11]
mov rdx, r15
call fcn.180073a60
xor r15d, r15d
test eax, eax
jns 0x180071f63
mov ebx, 0xc0000095
jmp 0x180071e68
mov ebx, 0xc0000095
jmp 0x180071e65
mov rdx, qword [rbp - 0x11]
add rdx, qword [rdi + 0x38]
cmp rdx, qword [rdi + 0x38]
jb 0x180071f4f
movups xmm0, xmmword [rbp - 9]
mov ebx, r15d
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 7]
movups xmmword [rdx + 0x10], xmm1
inc qword [rdi + 0x20]
jmp 0x180071e68
xorps xmm0, xmm0
mov qword [r12], rdi
mov r8, rdi
mov edx, 0x104
mov rcx, r13
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
call fcn.18007202c
mov ebx, eax
lea rcx, [rbp - 0x21]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
nop dword [rax + rax]
test r14, r14
je 0x180071fe0
mov rcx, qword gs:[0x60]
mov r8, r14
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
test ebx, ebx
jns 0x180071ffa
lea rcx, [rbp - 0x29]
call fcn.1800731cc
lea rcx, [rbp - 9]
call fcn.1800732cc
mov qword [r12], r15
mov eax, ebx
jmp 0x180072003
mov eax, 0xc00000f1
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret