Function at 0x14012d120
Capabilities:
Access peb ldr_data

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0x168]
sub rsp, 0x260
mov rax, qword [0x1402ba040]
xor rax, rsp
mov qword [rbp + 0x120], rax
test byte [0x1402c06d0], 1
mov qword [rsp + 0x58], r8
mov dword [rsp + 0x48], edx
mov qword [rsp + 0x50], rcx
jne 0x14012d55e
lock bts qword [0x1402c06d0], 0x1f
jb 0x14012d539
mov qword [r11 - 0x10], rsi
xor ecx, ecx
mov qword [r11 - 0x18], rdi
mov qword [r11 - 0x20], r12
mov qword [r11 - 0x28], r13
mov qword [r11 + 0x20], rbx
mov qword [r11 - 0x30], r14
mov qword [r11 - 0x38], r15
call sym.SystemInformer.exe_QiCreateSymbolProvider
mov rcx, rax
mov qword [rsp + 0x40], rax
call sym.SystemInformer.exe_QiLoadSymbolProviderOptions
mov rcx, qword gs:[0x30]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov rcx, qword gs:[0x30]
mov rdx, qword [rcx + 0x60]
mov r13, qword [rdx + 0x18]
add r13, 0x10
mov r12, qword [r13]
cmp r12, r13
je 0x14012d319
nop word [rax + rax]
cmp word [r12 + 0x58], 0x1c
mov rbx, qword [r12 + 0x60]
jb 0x14012d30c
lea r14, str.kernelbase.dll
mov esi, 1
nop
movdqu xmm0, xmmword [rbx]
movdqu xmm1, xmmword [r14]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14012d22d
add rbx, 0x10
add r14, 0x10
sub rsi, 1
jne 0x14012d200
mov esi, 6
jmp 0x14012d238
shl rsi, 4
add rsi, 0xc
shr rsi, 1
sub r14, rbx
nop dword [rax + rax]
movzx ecx, word [rbx]
movzx r15d, word [r14 + rbx]
cmp cx, r15w
je 0x14012d26f
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r15w
movzx edi, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp di, ax
jne 0x14012d30c
add rbx, 2
sub rsi, 1
jne 0x14012d240
nop dword [rax]
test r12, r12
je 0x14012d319
movzx eax, word [r12 + 0x48]
lea rcx, [rsp + 0x60]
mov rdi, qword [r12 + 0x30]
mov esi, dword [r12 + 0x40]
mov qword [rsp + 0x60], rax
mov rax, qword [r12 + 0x50]
mov qword [rsp + 0x68], rax
call sym.SystemInformer.exe_QiDosPathNameToNtPathName
mov rcx, qword gs:[0x30]
mov rbx, rax
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x110]
test rax, rax
je 0x14012d32d
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov r9d, esi
mov r8, rdi
mov rsi, qword [rsp + 0x40]
mov rdx, rbx
mov rcx, rsi
call sym.SystemInformer.exe_QiLoadModuleSymbolProvider
mov rdi, 0xffffffffffffffff
lea rcx, [rbx - 0x10]
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14012d33f
call fcn.14013fb00
jmp 0x14012d33f
mov r12, qword [r12]
cmp r12, r13
jne 0x14012d1e0
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov rsi, qword [rsp + 0x40]
mov rdi, 0xffffffffffffffff
mov rcx, rsi
call fcn.140158fa0
mov r15, qword ss:[rsp + 0x230]
mov r13, qword [rsp + 0x240]
mov r12, qword [rsp + 0x248]
test al, al
je 0x14012d4f8
cmp qword [0x1402c5188], 0
je 0x14012d4f8
xorps xmm0, xmm0
lea rcx, [0x1402c8260]
xor eax, eax
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp + 0x10], rax
mov dword [rbp - 0x40], 0x58
mov dword [rbp + 0x10], 0x80
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
call sym.SystemInformer.exe_QifAcquireFastLockExclusive
mov rcx, qword [rsi + 0x18]
lea r8, [rbp - 0x40]
mov rax, qword [0x1402c5188]
lea rdx, str.GetAppModelPolicy
call qword [case.0x14013b5a0.0]
mov ebx, eax
nop dword [rax + rax]
mov edx, dword [0x1402c8260]
mov eax, edx
cmp edx, 0x400000
jb 0x14012d408
lea ecx, [rdx - 0x3fffff]
lock cmpxchg dword [0x1402c8260], ecx
cmp eax, edx
jne 0x14012d42a
mov rcx, qword [0x1402c8268]
mov edx, 1
jmp 0x14012d43d
mov r9d, edx
mov ecx, edx
shr r9d, 0xc
and r9d, 0x3ff
and ecx, 0xffc00ffe
lock cmpxchg dword [0x1402c8260], ecx
cmp eax, edx
je 0x14012d42e
pause
jmp 0x14012d3d0
test r9d, r9d
je 0x14012d446
mov rcx, qword [0x1402c8270]
mov edx, r9d
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtReleaseSemaphore]
test ebx, ebx
je 0x14012d4f8
xor r14d, r14d
mov dword [rsp + 0x4c], r14d
call fcn.14016ece0
nop dword [rax + rax]
test rax, rax
je 0x14012d4f8
mov rbx, qword [rbp - 8]
xorps xmm0, xmm0
mov rax, rbx
mov qword [rsp + 0x78], 0x1000
and rax, 0xfffffffffffff000
mov qword [rbp - 0x48], 1
mov qword [rsp + 0x70], rax
mov rax, rbx
and eax, 0xfff
mov qword [rbp - 0x80], 1
mov qword [rbp - 0x50], rax
lea rax, [rsp + 0x4c]
mov qword [rbp - 0x78], rax
lea rax, [rbp - 0x50]
mov qword [rbp - 0x70], rax
movdqu xmmword [rbp - 0x68], xmm0
call fcn.14016ece0
lea rcx, ds:[rbp - 0x80]
mov dword [rsp + 0x28], 0x28
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x70]
mov rcx, rdi
lea edx, [r14 + 2]
lea r8d, [r14 + 1]
call qword [case.0x14013b5a0.0]
cmp eax, 0xc0000045
je 0x14012d4f1
test eax, eax
js 0x14012d4f8
mov qword [0x1402c7ff0], rbx
lea rcx, [rsi - 0x10]
lock xadd dword [rcx + 8], edi
mov r14, qword [rsp + 0x238]
cmp edi, 1
mov rdi, qword [rsp + 0x250]
mov rsi, qword [rsp + 0x258]
mov rbx, qword [rsp + 0x288]
jne 0x14012d52b
call fcn.14013fb00
lea rcx, [0x1402c06d0]
call sym.SystemInformer.exe_QifSetEvent
jmp 0x14012d550
test byte [0x1402c06d0], 1
jne 0x14012d55e
xor edx, edx
lea rcx, [0x1402c06d0]
call sym.SystemInformer.exe_QifWaitForEvent
mov r8, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov edx, dword [rsp + 0x48]
mov r9, qword [0x1402c7ff0]
test r9, r9
je 0x14012d5cd
mov eax, dword [0x1402baf40]
cmp edx, 0x38
jl 0x14012d57a
cmp eax, 0x72
jb 0x14012d5b9
cmp edx, 0x30
jl 0x14012d585
nop
cmp eax, 0x6d
jb 0x14012d5b9
cmp edx, 0x2e
jl 0x14012d58f
cmp eax, 0x6b
jb 0x14012d5b9
cmp edx, 0x2d
jl 0x14012d599
cmp eax, 0x6a
jb 0x14012d5b9
cmp edx, 0x2a
jl 0x14012d5a5
nop
cmp eax, 0x69
jb 0x14012d5b9
cmp edx, 0x23
jl 0x14012d5af
cmp eax, 0x68
jb 0x14012d5b9
cmp edx, 0x1f
jl 0x14012d5c2
cmp eax, 0x67
jae 0x14012d5c2
mov eax, 0xc0000003
jmp 0x14012d5d2
mov rax, r9
call qword [case.0x14013b5a0.0]
jmp 0x14012d5d2
mov eax, 0xc000007a
mov rcx, qword ds:[rbp + 0x120]
xor rcx, rsp
call fcn.1401e0100
add rsp, 0x260
pop rbp
ret