Function at 0x14012ad60
Capabilities:
Access peb ldr_data

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0x168]
sub rsp, 0x260
mov rax, qword [0x1402b5020]
xor rax, rsp
mov qword [rbp + 0x120], rax
test byte [0x1402bb4f0], 1
mov qword [rsp + 0x58], r8
mov dword [rsp + 0x48], edx
mov qword [rsp + 0x50], rcx
jne 0x14012b19e
lock bts qword [0x1402bb4f0], 0x1f
jb 0x14012b179
mov qword [r11 - 0x10], rsi
xor ecx, ecx
mov qword [r11 - 0x18], rdi
mov qword [r11 - 0x20], r12
mov qword [r11 - 0x28], r13
mov qword [r11 + 0x20], rbx
mov qword [r11 - 0x30], r14
mov qword [r11 - 0x38], r15
call sym.SystemInformer.exe_PhCreateSymbolProvider
mov rcx, rax
mov qword [rsp + 0x40], rax
call sym.SystemInformer.exe_PhLoadSymbolProviderOptions
mov rcx, qword gs:[0x30]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov rcx, qword gs:[0x30]
mov rdx, qword [rcx + 0x60]
mov r13, qword [rdx + 0x18]
add r13, 0x10
mov r12, qword [r13]
cmp r12, r13
je 0x14012af59
nop word [rax + rax]
mov rbx, qword [r12 + 0x60]
cmp word [r12 + 0x58], 0x1c
jb 0x14012af4c
lea r14, str.kernelbase.dll
mov esi, 1
nop
movdqu xmm0, xmmword [rbx]
movdqu xmm1, xmmword [r14]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14012ae6d
add rbx, 0x10
add r14, 0x10
sub rsi, 1
jne 0x14012ae40
mov esi, 6
jmp 0x14012ae78
shl rsi, 4
add rsi, 0xc
shr rsi, 1
sub r14, rbx
nop dword [rax + rax]
movzx ecx, word [rbx]
movzx r15d, word [r14 + rbx]
cmp cx, r15w
je 0x14012aeaf
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r15w
movzx edi, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp di, ax
jne 0x14012af4c
add rbx, 2
sub rsi, 1
jne 0x14012ae80
nop dword [rax]
test r12, r12
je 0x14012af59
movzx eax, word [r12 + 0x48]
lea rcx, [rsp + 0x60]
mov rdi, qword [r12 + 0x30]
mov esi, dword [r12 + 0x40]
mov qword [rsp + 0x60], rax
mov rax, qword [r12 + 0x50]
mov qword [rsp + 0x68], rax
call sym.SystemInformer.exe_PhDosPathNameToNtPathName
mov rcx, qword gs:[0x30]
mov rbx, rax
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x110]
test rax, rax
je 0x14012af6d
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov r9d, esi
mov r8, rdi
mov rsi, qword [rsp + 0x40]
mov rdx, rbx
mov rcx, rsi
call sym.SystemInformer.exe_PhLoadModuleSymbolProvider
mov rdi, 0xffffffffffffffff
lea rcx, [rbx - 0x10]
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14012af7f
call fcn.14013d2a0
jmp 0x14012af7f
mov r12, qword [r12]
cmp r12, r13
jne 0x14012ae20
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov rsi, qword [rsp + 0x40]
mov rdi, 0xffffffffffffffff
mov rcx, rsi
call fcn.140152400
mov r15, qword ss:[rsp + 0x230]
mov r13, qword [rsp + 0x240]
mov r12, qword [rsp + 0x248]
test al, al
je 0x14012b138
cmp qword [0x1402bfec0], 0
je 0x14012b138
xorps xmm0, xmm0
lea rcx, [0x1402c2f98]
xor eax, eax
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp + 0x10], rax
mov dword [rbp - 0x40], 0x58
mov dword [rbp + 0x10], 0x80
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
call sym.SystemInformer.exe_PhfAcquireFastLockExclusive
mov rcx, qword [rsi + 0x18]
lea r8, [rbp - 0x40]
mov rax, qword [0x1402bfec0]
lea rdx, str.GetAppModelPolicy
call qword [str.PB__]
mov ebx, eax
nop dword [rax + rax]
mov edx, dword [0x1402c2f98]
mov eax, edx
cmp edx, 0x400000
jb 0x14012b048
lea ecx, [rdx - 0x3fffff]
lock cmpxchg dword [0x1402c2f98], ecx
cmp eax, edx
jne 0x14012b06a
mov rcx, qword [0x1402c2fa0]
mov edx, 1
jmp 0x14012b07d
mov r9d, edx
mov ecx, edx
shr r9d, 0xc
and r9d, 0x3ff
and ecx, 0xffc00ffe
lock cmpxchg dword [0x1402c2f98], ecx
cmp eax, edx
je 0x14012b06e
pause
jmp 0x14012b010
test r9d, r9d
je 0x14012b086
mov rcx, qword [0x1402c2fa8]
mov edx, r9d
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtReleaseSemaphore]
test ebx, ebx
je 0x14012b138
xor r14d, r14d
mov dword [rsp + 0x4c], r14d
call fcn.140167ce0
nop dword [rax + rax]
test rax, rax
je 0x14012b138
mov rbx, qword [rbp - 8]
xorps xmm0, xmm0
mov rax, rbx
mov qword [rsp + 0x78], 0x1000
and rax, 0xfffffffffffff000
mov qword [rbp - 0x48], 1
mov qword [rsp + 0x70], rax
mov rax, rbx
and eax, 0xfff
mov qword [rbp - 0x80], 1
mov qword [rbp - 0x50], rax
lea rax, [rsp + 0x4c]
mov qword [rbp - 0x78], rax
lea rax, [rbp - 0x50]
mov qword [rbp - 0x70], rax
movdqu xmmword [rbp - 0x68], xmm0
call fcn.140167ce0
lea rcx, ds:[rbp - 0x80]
mov dword [rsp + 0x28], 0x28
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x70]
mov rcx, rdi
lea edx, [r14 + 2]
lea r8d, [r14 + 1]
call qword [str.PB__]
cmp eax, 0xc0000045
je 0x14012b131
test eax, eax
js 0x14012b138
mov qword [0x1402c2d30], rbx
lea rcx, [rsi - 0x10]
lock xadd dword [rcx + 8], edi
mov r14, qword [rsp + 0x238]
cmp edi, 1
mov rdi, qword [rsp + 0x250]
mov rsi, qword [rsp + 0x258]
mov rbx, qword [rsp + 0x288]
jne 0x14012b16b
call fcn.14013d2a0
lea rcx, [0x1402bb4f0]
call sym.SystemInformer.exe_PhfSetEvent
jmp 0x14012b190
test byte [0x1402bb4f0], 1
jne 0x14012b19e
xor edx, edx
lea rcx, [0x1402bb4f0]
call sym.SystemInformer.exe_PhfWaitForEvent
mov r8, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov edx, dword [rsp + 0x48]
mov r9, qword [0x1402c2d30]
test r9, r9
je 0x14012b20d
mov eax, dword [0x1402b5e88]
cmp edx, 0x38
jl 0x14012b1ba
cmp eax, 0x72
jb 0x14012b1f9
cmp edx, 0x30
jl 0x14012b1c5
nop
cmp eax, 0x6d
jb 0x14012b1f9
cmp edx, 0x2e
jl 0x14012b1cf
cmp eax, 0x6b
jb 0x14012b1f9
cmp edx, 0x2d
jl 0x14012b1d9
cmp eax, 0x6a
jb 0x14012b1f9
cmp edx, 0x2a
jl 0x14012b1e5
nop
cmp eax, 0x69
jb 0x14012b1f9
cmp edx, 0x23
jl 0x14012b1ef
cmp eax, 0x68
jb 0x14012b1f9
cmp edx, 0x1f
jl 0x14012b202
cmp eax, 0x67
jae 0x14012b202
mov eax, 0xc0000003
jmp 0x14012b212
mov rax, r9
call qword [str.PB__]
jmp 0x14012b212
mov eax, 0xc000007a
mov rcx, qword ds:[rbp + 0x120]
xor rcx, rsp
call fcn.1401dd6a0
add rsp, 0x260
pop rbp
ret