Function at 0x1337c0e9a7b0
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov r15, rdx
mov r13, rcx
xor r12d, r12d
mov qword [rcx], r12
mov qword [rcx + 8], r8
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r12w
mov rdi, qword [rdx + 8]
cmp rdi, 0xc
jb 0x1337c0e9a9f0
mov dword [rbp + 0x44], reloc.SHLWAPI.dll_SHCreateMemStream
mov dword [rbp + 0x40], 0x6a1b2d84
mov r14, qword [rdx]
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], reloc.SHLWAPI.dll_SHCreateMemStream
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x40]
call fcn.1337c0e9ae20
test al, al
je 0x1337c0e9a9ff
mov edx, 0x7ffe0030
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1337c0e9a840
lea rcx, [rbp - 0x20]
call fcn.1337c0e8dc50
lea rax, [rbp - 0x20]
mov rcx, qword [rbp - 0x20]
mov rdi, qword [rbp - 8]
cmp rdi, 7
cmova rax, rcx
mov rsi, qword [rbp - 0x10]
cmp word [rax + rsi*2 - 2], 0x5c
je 0x1337c0e9a9e0
cmp rsi, rdi
jae 0x1337c0e9a8ab
lea rax, [rsi + 1]
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x20]
cmp rdi, 7
cmova rax, rcx
mov dword [rax + rsi*2], 0x5c
mov rdx, qword [r15]
mov r8, qword [r15 + 8]
add r8, rdx
add rdx, 0xc
jmp 0x1337c0e9aa45
movabs rbx, 0x3ffffffffffffffe
mov rax, rbx
sub rax, rsi
cmp rax, 1
jb 0x1337c0e9ab5a
lea r12, [rsi + 1]
mov rcx, r12
or rcx, 7
cmp rcx, rbx
ja 0x1337c0e9a8f4
mov rdx, rdi
shr rdx, 1
mov rax, rbx
sub rax, rdx
cmp rdi, rax
ja 0x1337c0e9a8f4
lea rax, [rdi + rdx]
mov rbx, rcx
cmp rcx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
mov edx, 2
call fcn.1337c0f348e0
mov r14, rax
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], rbx
add rsi, rsi
mov r8, rsi
mov rcx, rax
cmp rdi, 7
jbe 0x1337c0e9a9c8
mov rbx, qword [rbp - 0x20]
mov rdx, rbx
call fcn.1337c105b8f0
mov dword [rsi + r14], 0x5c
xor r12d, r12d
test rbx, rbx
je 0x1337c0e9a9dc
lea r10, [rbx - 1]
and r10, 0xfffffffffe000000
mov rcx, qword gs:[0x30]
mov rax, qword [r10 + 0x100]
cmp rcx, rax
sete cl
mov rax, rbx
sub rax, r10
shr rax, 0x10
lea rax, [rax + rax*4]
shl rax, 4
lea rdx, [r10 + 0x108]
add rdx, rax
mov eax, dword [rdx + 4]
sub rdx, rax
test cl, cl
je 0x1337c0e9a9b8
cmp byte [rdx + 0xe], r12b
jne 0x1337c0e9a9a8
mov rax, qword [rdx + 0x20]
mov qword [rbx], rax
mov qword [rdx + 0x20], rbx
add dword [rdx + 0x18], 0xffffffff
jne 0x1337c0e9a9dc
mov rcx, rdx
call fcn.1337c0f351b0
jmp 0x1337c0e9a9dc
mov r8b, 1
mov r9, rbx
mov rcx, r10
call fcn.1337c0f342c0
jmp 0x1337c0e9a9dc
xor r8d, r8d
mov r9, rbx
mov rcx, r10
call fcn.1337c0f342c0
jmp 0x1337c0e9a9dc
lea rdx, [rbp - 0x20]
call fcn.1337c105b8f0
mov dword [rsi + r14], 0x5c
xor r12d, r12d
mov qword [rbp - 0x20], r14
mov rdx, qword [r15]
mov r8, qword [r15 + 8]
add r8, rdx
add rdx, 0xc
jmp 0x1337c0e9aa45
mov rbx, qword [rdx]
mov r14, rbx
mov rsi, r12
cmp rdi, 4
jb 0x1337c0e9aa3d
mov dword [rbp + 0x44], 4
mov rbx, r14
mov dword [rbp + 0x40], 0xb62df971
mov eax, 4
cmp rdi, rax
cmovb rax, rdi
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rax
mov rsi, r12
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x40]
call fcn.1337c0e9ae20
test al, al
je 0x1337c0e9aa3d
mov esi, 4
lea r8, [rbx + rdi]
lea rdx, [rsi + rbx]
lea rcx, [rbp - 0x20]
call fcn.1337c0e9ae90
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rcx, qword [rbp - 0x20]
mov dword [rbp + 0x40], r12d
mov rax, qword [rbp - 0x10]
add rax, rax
mov word [rbp - 0x30], ax
mov word [rbp - 0x2e], ax
mov qword [rbp - 0x28], rcx
mov dword [rbp + 0x4c], 0xa
mov dword [rbp + 0x48], 0xf8eba529
mov dword [rbp + 0x54], 9
mov dword [rbp + 0x50], 0x8767f69
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x50]
call fcn.1337c0ea0bc0
mov r9, r13
lea r8, [rbp - 0x30]
lea rdx, [rbp + 0x40]
mov ecx, 1
call rax
nop
cmp qword [rbp - 8], 7
jbe 0x1337c0e9ab3f
mov r11, qword [rbp - 0x20]
test r11, r11
je 0x1337c0e9ab3f
dec r11
and r11, 0xfffffffffe000000
mov rdx, qword gs:[0x30]
mov rcx, qword [r11 + 0x100]
mov r9, qword [rbp - 0x20]
mov rax, r9
sub rax, r11
shr rax, 0x10
lea rax, [rax + rax*4]
shl rax, 4
lea r10, [r11 + 0x108]
add r10, rax
mov eax, dword [r10 + 4]
sub r10, rax
cmp rdx, rcx
jne 0x1337c0e9ab31
cmp byte [r10 + 0xe], 0
jne 0x1337c0e9ab2c
mov rax, qword [r10 + 0x20]
mov qword [r9], rax
mov qword [r10 + 0x20], r9
add dword [r10 + 0x18], 0xffffffff
jne 0x1337c0e9ab3f
mov rcx, r10
call fcn.1337c0f351b0
jmp 0x1337c0e9ab3f
mov r8b, 1
jmp 0x1337c0e9ab34
xor r8d, r8d
mov rdx, r10
mov rcx, r11
call fcn.1337c0f342c0
mov rax, r13
mov rbx, qword [rsp + 0xa8]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1337c0e4edf0
nop