Function at 0x78bd93f0
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r12
push r13
push r14
push r15
sub rsp, 0x380
mov rax, qword [0x78c09100]
xor rax, rsp
mov qword [rsp + 0x370], rax
mov qword [rsp + 0x68], rsp
lea rdx, [0x78bd3ea8]
mov r12d, 2
mov ecx, r12d
call sym.wow64.dll_Wow64LogPrint
mov r13, qword gs:[0x30]
mov qword [rsp + 0xb0], r13
xor r15d, r15d
or rsi, 0xffffffffffffffff
lea rdi, [0x78bd0000]
cmp r15d, r12d
jae 0x78bd99d4
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], rsi
and qword [rsp + 0x78], 0
and qword [rsp + 0xa8], 0
mov byte [rsp + 0x50], 0
mov r14d, r15d
shl r14, 3
mov r8, qword [r14 + rdi + 0x3a198]
lea rdx, [0x78bd3ec8]
mov ecx, r12d
call sym.wow64.dll_Wow64LogPrint
lea r8, [rsp + 0x60]
mov dl, r15b
lea rcx, [0x78bd3ef0]
call qword [0x78bd10c0]
test eax, eax
jns 0x78bd967d
mov rax, qword [r14 + rdi + 0x3a198]
mov qword [rsp + 0x20], rax
mov r9d, 0x7ffe0030
lea r8, [0x78bd3f10]
mov edx, 0x208
lea rcx, [rsp + 0x160]
call fcn.78bd8e44
mov dword [rsp + 0x58], eax
test eax, eax
jns 0x78bd951a
lea rdx, [0x78bd3f20]
mov ecx, 1
call sym.wow64.dll_Wow64LogPrint
lea rdx, [0x78bd9511]
mov rcx, qword [rsp + 0x68]
call fcn.78bfe26a
nop
nop
mov eax, dword [rsp + 0x58]
jmp 0x78bd99d6
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x160]
call qword [0x78bd10c8]
test al, al
jne 0x78bd9557
lea rdx, [0x78bd954d]
mov rcx, qword [rsp + 0x68]
call fcn.78bfe26a
nop
nop
mov eax, 0xc0000001
jmp 0x78bd99d6
mov al, 1
mov byte [rsp + 0x50], al
lea r8, [rsp + 0x98]
lea rdx, [0x78bd3f78]
mov ecx, r12d
call sym.wow64.dll_Wow64LogPrint
mov dword [rsp + 0xe0], 0x30
and qword [rsp + 0xe8], 0
mov dword [rsp + 0xf8], 0x40
lea rax, [rsp + 0x98]
mov qword [rsp + 0xf0], rax
and qword [rsp + 0x100], 0
and qword [rsp + 0x108], 0
mov dword [rsp + 0x28], 0x60
mov dword [rsp + 0x20], 5
lea r9, [rsp + 0x110]
lea r8, [rsp + 0xe0]
mov edx, 0x100001
lea rcx, [rsp + 0x70]
call qword [0x78bd10d0]
mov dword [rsp + 0x58], eax
test eax, eax
jns 0x78bd961b
mov r8d, eax
lea rdx, [0x78bd3fa0]
mov ecx, r12d
call sym.wow64.dll_Wow64LogPrint
lea rdx, [0x78bd9612]
mov rcx, qword [rsp + 0x68]
call fcn.78bfe26a
nop
nop
mov eax, dword [rsp + 0x58]
jmp 0x78bd99d6
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x1000000
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
lea rcx, [rsp + 0x60]
call qword [0x78bd10d8]
mov dword [rsp + 0x58], eax
test eax, eax
jns 0x78bd967d
mov r8d, eax
lea rdx, [0x78bd3fe0]
mov ecx, r12d
call sym.wow64.dll_Wow64LogPrint
lea rdx, [0x78bd9674]
mov rcx, qword [rsp + 0x68]
call fcn.78bfe26a
nop
nop
mov eax, dword [rsp + 0x58]
jmp 0x78bd99d6
mov rdi, qword [r13 + 0x28]
lea rax, [0x78bd4020]
mov qword [r13 + 0x28], rax
mov dword [rsp + 0x48], r12d
and dword [rsp + 0x40], 0
mov dword [rsp + 0x38], r12d
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x30], rax
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x78]
mov rdx, rsi
mov rcx, qword [rsp + 0x60]
call qword [0x78bd10e0]
mov r12d, eax
mov qword [r13 + 0x28], rdi
test eax, eax
js 0x78bd9992
cmp eax, 0x40000003
je 0x78bd9992
mov r12, qword [rsp + 0x78]
lea rdi, [0x78bd0000]
mov qword [r14 + rdi + 0x3af30], r12
xor r13d, r13d
mov dword [rsp + 0x80], r13d
cmp r13d, 1
jae 0x78bd9922
mov rax, qword [r14 + rdi + 0x3a1a8]
mov qword [rsp + 0xd8], rax
mov rax, qword [r14 + rdi + 0x3a1b8]
mov r14, qword [rax + r13*8]
xor r8d, r8d
mov ecx, r12d
lea r9, [rsp + 0xb8]
mov dl, 1
call qword [0x78bd10b8]
mov qword [rsp + 0x58], rax
xor eax, eax
mov rcx, rsi
mov rdi, r14
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp rcx, 0x3e
jbe 0x78bd976a
mov r9d, 0xc000000d
mov dword [rsp + 0x58], r9d
jmp 0x78bd9893
mov edi, 0x7ffffffe
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0xc8], r14
mov edx, 0x40
mov qword [rsp + 0xc0], rdx
lea rax, [rsp + 0x120]
mov qword [rsp + 0x88], rax
xor r9d, r9d
xor ecx, ecx
mov qword [rsp + 0x90], rcx
test rdx, rdx
je 0x78bd97f7
test rdi, rdi
je 0x78bd97f7
mov r8b, byte [r14]
test r8b, r8b
je 0x78bd97f7
mov byte [rax], r8b
inc rax
mov qword [rsp + 0x88], rax
inc r14
mov qword [rsp + 0xc8], r14
dec rdx
mov qword [rsp + 0xc0], rdx
dec rdi
mov qword [rsp + 0xd0], rdi
inc rcx
mov qword [rsp + 0x90], rcx
jmp 0x78bd97a9
test rdx, rdx
jne 0x78bd9818
dec rax
mov qword [rsp + 0x88], rax
dec rcx
mov qword [rsp + 0x90], rcx
mov r9d, 0x80000005
mov byte [rax], 0
test r9d, r9d
jns 0x78bd9827
mov dword [rsp + 0x58], r9d
jmp 0x78bd988e
mov eax, r12d
mov rdi, qword [rsp + 0x58]
mov ecx, dword [rdi + 0x24]
add rcx, rax
mov r9d, dword [rdi + 0x20]
add r9, rax
mov qword [rsp + 0x20], rcx
mov r8d, dword [rdi + 0x18]
mov edx, r12d
lea rcx, [rsp + 0x120]
call fcn.78bd932c
movzx edx, ax
cmp edx, dword [rdi + 0x14]
jb 0x78bd986a
mov r9d, 0xc000007a
mov dword [rsp + 0x58], r9d
jmp 0x78bd9893
mov ecx, dword [rdi + 0x1c]
add ecx, r12d
movzx eax, dx
mov ecx, dword [rcx + rax*4]
lea eax, [r12 + rcx]
mov rdx, qword [rsp + 0xd8]
mov dword [rdx + r13*4], eax
xor r9d, r9d
mov dword [rsp + 0x58], r9d
test r9d, r9d
jns 0x78bd98d6
mov eax, r13d
lea rcx, [0x78bd0000]
mov r8, qword [rcx + r15*8 + 0x3a1b8]
mov r8, qword [r8 + r13*8]
lea rdx, [0x78bd40a0]
mov ecx, 2
call sym.wow64.dll_Wow64LogPrint
lea rdx, [0x78bd98cd]
mov rcx, qword [rsp + 0x68]
call fcn.78bfe26a
nop
nop
mov eax, dword [rsp + 0x58]
jmp 0x78bd99d6
mov r14d, r15d
shl r14, 3
lea rdi, [0x78bd0000]
mov rax, qword [r14 + rdi + 0x3a1a8]
mov r8, qword [r14 + rdi + 0x3a1b8]
mov r9d, dword [rax + r13*4]
mov r8, qword [r8 + r13*8]
lea rdx, [0x78bd40e8]
mov ecx, 2
call sym.wow64.dll_Wow64LogPrint
inc r13d
mov dword [rsp + 0x80], r13d
mov r12, qword [rsp + 0x78]
jmp 0x78bd9703
test r12, r12
je 0x78bd9933
mov rdx, r12
mov rcx, rsi
call qword [0x78bd10e8]
mov rcx, qword [rsp + 0x60]
cmp rcx, rsi
je 0x78bd9943
call qword [0x78bd1058]
mov rcx, qword [rsp + 0x70]
cmp rcx, rsi
je 0x78bd9953
call qword [0x78bd1058]
mov al, byte [rsp + 0x50]
test al, al
je 0x78bd997c
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r8, qword [rsp + 0xa0]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [0x78bd10f0]
inc r15d
mov r13, qword [rsp + 0xb0]
mov r12d, 2
jmp 0x78bd9457
mov r8d, eax
lea rdx, [0x78bd4050]
mov ecx, 2
call sym.wow64.dll_Wow64LogPrint
mov eax, 0xc0000001
cmp r12d, 0x40000003
cmove r12d, eax
mov dword [rsp + 0x58], r12d
lea rdx, [0x78bd99ce]
mov rcx, qword [rsp + 0x68]
call fcn.78bfe26a
nop
nop
mov eax, dword [rsp + 0x58]
jmp 0x78bd99d6
xor eax, eax
mov rcx, qword [rsp + 0x370]
xor rcx, rsp
call fcn.78bfdec0
lea r11, [rsp + 0x380]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov r12, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
ret