Function at 0x7ff7bffcb910
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
mov rax, rsp
push rbp
push rbx
push r12
lea rbp, [rax - 0x168]
sub rsp, 0x250
xor r12b, r12b
mov rbx, rdx
test rcx, 0xfffffffffffffffb
je 0x7ff7bffcc083
test rdx, rdx
je 0x7ff7bffcc075
cmp qword ds:[rdx], 0
je 0x7ff7bffcc075
cmp qword [0x7ff7c01d69b8], 0
mov qword ds:[rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax - 0x20], r14
mov qword [rax - 0x28], r15
je 0x7ff7bffcb980
movups xmm0, xmmword [0x7ff7c01d69b0]
movaps xmmword [rsp + 0x30], xmm0
jmp 0x7ff7bffcb9d2
mov ecx, 0x7ffe0030
mov qword [rsp + 0x28], 0x7ffe0030
call sym.ProcessHacker.exe_PhCountStringZ
add rax, rax
mov qword [rsp + 0x20], rax
cmp word [rax + 0x7ffe002e], 0x5c
jne 0x7ff7bffcb9b0
add rax, 0xfffffffffffffffe
mov qword [rsp + 0x20], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x30], xmm0
mov qword [0x7ff7c01d69b0], rax
lock or dword [rsp], 0
mov qword [0x7ff7c01d69b8], 0x7ffe0030
lea r15, ds:[rbx - 0x10]
lock inc dword [r15 + 8]
movups xmm1, xmmword [rbx]
mov r14, qword [rsp + 0x30]
xor ebx, ebx
mov qword [rsp + 0x40], r14
movdqa xmm0, xmm1
movq rdi, xmm1
psrldq xmm0, 8
movq rsi, xmm0
mov qword [rsp + 0x48], rsi
movups xmmword [rsp + 0x20], xmm1
mov qword [rsp + 0x28], rsi
cmp rdi, r14
jb 0x7ff7bffcc021
mov r8b, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call sym.ProcessHacker.exe_PhEqualStringRef
nop dword [rax + rax]
test al, al
je 0x7ff7bffcc021
lea rax, [0x7ff7c0173ff8]
mov qword [rsp + 0x50], 0x1a
add rsi, r14
mov qword [rsp + 0x58], rax
sub rdi, r14
mov qword [rsp + 0x28], rsi
mov r8b, 1
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
nop
test al, al
je 0x7ff7bffcba7e
mov ebx, 0xd
jmp 0x7ff7bffcc021
mov qword [rsp + 0x60], 0x12
lea rax, [0x7ff7c0174018]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], 0x12
cmp rdi, 0x12
jb 0x7ff7bffcbabd
mov r8b, 1
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x70]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x7ff7bffcbb01
mov qword [rbp - 0x80], 0x12
lea rax, [0x7ff7c0174030]
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x70], 0x12
cmp rdi, 0x12
jb 0x7ff7bffcbeca
mov r8b, 1
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x70]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffcbeca
mov r12b, 1
lea rax, [rdi - 0x12]
mov qword [rbp - 0x60], 0x12
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x60]
lea rax, [0x7ff7c0174048]
add rsi, 0x12
mov r8b, 1
mov qword [rbp - 0x58], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], rsi
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffcbb45
mov ebx, 2
jmp 0x7ff7bffcc021
lea rax, [0x7ff7c0174060]
mov qword [rbp - 0x50], 0x14
mov r8b, 1
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffcbb77
mov ebx, 3
jmp 0x7ff7bffcc021
lea rax, [0x7ff7c0174078]
mov qword [rbp - 0x40], 0x18
mov r8b, 1
mov qword [rbp - 0x38], rax
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffcbba9
mov ebx, 4
jmp 0x7ff7bffcc021
lea rax, [0x7ff7c0174098]
mov qword [rbp - 0x30], 0x1a
mov r8b, 1
mov qword [rbp - 0x28], rax
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
nop dword [rax]
test al, al
je 0x7ff7bffcbbde
mov ebx, 5
jmp 0x7ff7bffcc021
lea rax, [0x7ff7c01740b8]
mov qword [rbp - 0x20], 0x14
mov r8b, 1
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffcbc15
mov ebx, 6
jmp 0x7ff7bffcc021
lea rax, [0x7ff7c01740d0]
mov qword [rbp - 0x10], 0x10
mov r8b, 1
mov qword [rbp - 8], rax
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffcbc47
mov ebx, 7
jmp 0x7ff7bffcc021
lea rax, [0x7ff7c01740e8]
mov qword [rbp], 0x1a
mov r8b, 1
mov qword [rbp + 8], rax
lea rdx, [rbp]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffcbc79
mov ebx, 8
jmp 0x7ff7bffcc021
lea rax, [0x7ff7c0174108]
mov qword [rbp + 0x10], 0x18
mov r8b, 1
mov qword [rbp + 0x18], rax
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffcbcab
mov ebx, 9
jmp 0x7ff7bffcc021
lea rax, [0x7ff7c0174128]
mov qword [rbp + 0x20], 0x1a
mov r8b, 1
mov qword [rbp + 0x28], rax
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
nop
test al, al
je 0x7ff7bffcbcde
mov ebx, 0xa
jmp 0x7ff7bffcc021
lea rax, [0x7ff7c0174148]
mov qword [rbp + 0x30], 0x18
mov r8b, 1
mov qword [rbp + 0x38], rax
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffcbd15
mov ebx, 0xb
jmp 0x7ff7bffcc021
lea rax, [0x7ff7c0174168]
mov qword [rbp + 0x40], 0x18
mov r8b, 1
mov qword [rbp + 0x48], rax
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffcbd47
mov ebx, 0xc
jmp 0x7ff7bffcc021
lea rax, [0x7ff7c0174188]
mov qword [rbp + 0x50], 0x1a
mov r8b, 1
mov qword [rbp + 0x58], rax
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffcbd79
mov ebx, 0xc
jmp 0x7ff7bffcc021
lea rax, [0x7ff7c01741a8]
mov qword [rbp + 0x60], 0x1e
mov r8b, 1
mov qword [rbp + 0x68], rax
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffcbdab
mov ebx, 0xc
jmp 0x7ff7bffcc021
lea rax, [0x7ff7c01741c8]
mov qword [rbp + 0x70], 0x1c
mov r8b, 1
mov qword [rbp + 0x78], rax
lea rdx, [rbp + 0x70]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
nop
test al, al
je 0x7ff7bffcbdde
mov ebx, 0xc
jmp 0x7ff7bffcc021
lea rax, [0x7ff7c01741e8]
mov qword [rbp + 0x80], 0x1a
mov r8b, 1
mov qword [rbp + 0x88], rax
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffcbe19
mov ebx, 0xe
jmp 0x7ff7bffcc021
lea rax, [0x7ff7c0174208]
mov qword [rbp + 0x90], 0x24
mov r8b, 1
mov qword [rbp + 0x98], rax
lea rdx, [rbp + 0x90]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffcbe55
mov ebx, 0x10
jmp 0x7ff7bffcc021
lea rax, [0x7ff7c0174230]
mov qword [rbp + 0xa0], 0x28
mov r8b, 1
mov qword [rbp + 0xa8], rax
lea rdx, [rbp + 0xa0]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x7ff7bffcc01c
lea rax, [0x7ff7c0174260]
mov qword [rbp + 0xb0], 0x28
mov r8b, 1
mov qword [rbp + 0xb8], rax
lea rdx, [rbp + 0xb0]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
mov ecx, ebx
test al, al
mov ebx, 0xf
cmovne ecx, ebx
mov ebx, ecx
jmp 0x7ff7bffcc021
mov qword [rbp + 0xc0], 0x28
lea rax, [0x7ff7c0174230]
mov qword [rbp + 0xc8], rax
cmp rdi, 0x28
jb 0x7ff7bffcbf20
lea rax, [rdi - 0x28]
mov qword [rbp + 0xd0], 0x28
add rax, rsi
lea rdx, [rbp + 0xc0]
mov r8b, 1
mov qword [rbp + 0xd8], rax
lea rcx, [rbp + 0xd0]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x7ff7bffcc01c
mov qword [rbp + 0xe0], 0x24
lea rax, [0x7ff7c0174290]
mov qword [rbp + 0xe8], rax
cmp rdi, 0x24
jb 0x7ff7bffcbf78
lea rax, [rdi - 0x24]
mov qword [rbp + 0xf0], 0x24
add rax, rsi
lea rdx, [rbp + 0xe0]
mov r8b, 1
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 0xf0]
call sym.ProcessHacker.exe_PhEqualStringRef
nop
test al, al
jne 0x7ff7bffcc01c
mov qword [rbp + 0x100], 0x2c
lea rax, [0x7ff7c01742b8]
mov qword [rbp + 0x108], rax
cmp rdi, 0x2c
jb 0x7ff7bffcbfca
lea rax, [rdi - 0x2c]
mov qword [rbp + 0x110], 0x2c
add rax, rsi
lea rdx, [rbp + 0x100]
mov r8b, 1
mov qword [rbp + 0x118], rax
lea rcx, [rbp + 0x110]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x7ff7bffcc01c
mov qword [rbp + 0x120], 0x38
lea rax, [0x7ff7c01742e8]
mov qword [rbp + 0x128], rax
cmp rdi, 0x38
jb 0x7ff7bffcc021
lea rax, [rdi - 0x38]
mov qword [rbp + 0x130], 0x38
add rax, rsi
lea rdx, [rbp + 0x120]
mov r8b, 1
mov qword [rbp + 0x138], rax
lea rcx, [rbp + 0x130]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffcc021
mov ebx, 0xf
mov eax, 0xffffffff
lock xadd dword [r15 + 8], eax
mov r14, qword [rsp + 0x248]
mov rdi, qword [rsp + 0x280]
mov rsi, qword [rsp + 0x278]
cmp eax, 1
jne 0x7ff7bffcc055
mov rcx, r15
call fcn.7ff7c00c6290
mov r15, qword [rsp + 0x240]
mov eax, ebx
bts eax, 0x11
test r12b, r12b
cmove eax, ebx
add rsp, 0x250
pop r12
pop rbx
pop rbp
ret
xor eax, eax
add rsp, 0x250
pop r12
pop rbx
pop rbp
ret
mov eax, 1
add rsp, 0x250
pop r12
pop rbx
pop rbp
ret