Function at 0x1400242b4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x140078140]
xor rax, rsp
mov qword [rbp + 0x2f], rax
and dword [rbp + 0x27], 0
mov r12, rcx
lea rcx, [0x140078110]
call fcn.140054d38
mov rcx, qword gs:[0x60]
xor ebx, ebx
xor edx, edx
mov rcx, qword [rcx + 0x30]
lea r8d, [rbx + 0x20]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
lea edi, [rbx + 1]
mov rsi, rax
test rax, rax
je 0x14002433f
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
lea rax, method..virtual_0
mov dword [rsi + 8], edi
mov qword [rsi], rax
mov byte [rsi + 0x19], dil
mov dword [rsi + 0x1c], ebx
jmp 0x140024341
xor esi, esi
test rsi, rsi
jne 0x140024377
lea rax, str.onecore_basewcp_sil_ntsystem.cpp
mov dword [rbp - 0x29], 0x20c8
mov qword [rbp - 0x39], rax
lea rcx, [rbp - 0x39]
lea rax, str.Windows::Rtl::RtlGetDirectSystem
mov qword [rbp - 0x31], rax
lea rax, str.DirectFsProvider.Allocate__
mov qword [rbp - 0x21], rax
jmp 0x140024460
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
lea r8d, [rdx + 0x10]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x1400243b1
and dword [rax + 0xc], 0
lea rax, method..virtual_0
mov qword [rbx], rax
mov dword [rbx + 8], edi
jmp 0x1400243b3
xor ebx, ebx
test rbx, rbx
jne 0x1400243e6
lea rax, str.onecore_basewcp_sil_ntsystem.cpp
mov dword [rbp - 9], 0x20ca
mov qword [rbp - 0x19], rax
lea rcx, [rbp - 0x19]
lea rax, str.Windows::Rtl::RtlGetDirectSystem
mov qword [rbp - 0x11], rax
lea rax, str.DirectRegProvider.Allocate__
mov qword [rbp - 1], rax
jmp 0x140024460
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
lea r8d, [rdx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov r14, rax
test rax, rax
je 0x14002442c
and qword [r14 + 0x10], 0
lea rax, vtable..0
and qword [r14 + 0x20], 0
and qword [r14 + 0x28], 0
mov qword [r14], rax
mov dword [r14 + 8], edi
jmp 0x14002442f
xor r14d, r14d
test r14, r14
jne 0x140024473
lea rax, str.onecore_basewcp_sil_ntsystem.cpp
mov dword [rbp + 0x17], 0x20cc
mov qword [rbp + 7], rax
lea rcx, [rbp + 7]
lea rax, str.Windows::Rtl::RtlGetDirectSystem
mov qword [rbp + 0xf], rax
lea rax, str.DirectUserProvider.Allocate__
mov qword [rbp + 0x1f], rax
mov r8d, 0xc0000017
call fcn.14004f4fc
mov r15d, 0xc0000017
jmp 0x14002449d
xor r9d, r9d
mov r8, rbx
mov rdx, rsi
mov rcx, r14
call fcn.1400238ec
mov r15d, eax
test eax, eax
jns 0x1400244d4
mov rax, qword [r14]
mov edx, edi
mov rcx, r14
mov rax, qword [rax + 0x10]
call qword [case.0x1400532ec.0]
test rbx, rbx
je 0x1400244b4
mov rax, qword [rbx]
mov edx, edi
mov rcx, rbx
mov rax, qword [rax + 0x10]
call qword [case.0x1400532ec.0]
test rsi, rsi
je 0x14002455c
mov rax, qword [rsi]
mov edx, edi
mov rcx, rsi
mov rax, qword [rax + 0x10]
call qword [case.0x1400532ec.0]
jmp 0x14002455c
and qword [rbp - 0x69], 0
lea rcx, [rbp - 0x69]
call fcn.14003491c
mov rdi, qword [rbp - 0x69]
mov r15d, eax
test eax, eax
js 0x14002451b
mov r8, r12
mov qword [rbp - 0x61], rsi
lea rdx, [rbp - 0x61]
mov qword [rbp - 0x59], rbx
mov qword [rbp - 0x51], r14
mov byte [rbp - 0x41], 0
mov qword [rbp - 0x49], rdi
mov dword [rbp - 0x3d], 2
call fcn.140027110
mov r15d, eax
test eax, eax
jns 0x140024561
test rdi, rdi
je 0x14002452f
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax]
call qword [case.0x1400532ec.0]
mov rax, qword [r14]
mov rcx, r14
mov rax, qword [rax]
call qword [case.0x1400532ec.0]
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rcx, rbx
call qword [case.0x1400532ec.0]
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rcx, rsi
call qword [case.0x1400532ec.0]
mov eax, r15d
jmp 0x1400245a4
test rdi, rdi
je 0x140024575
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax]
call qword [case.0x1400532ec.0]
mov rax, qword [r14]
mov rcx, r14
mov rax, qword [rax]
call qword [case.0x1400532ec.0]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x1400532ec.0]
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax]
call qword [case.0x1400532ec.0]
xor eax, eax
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140058110
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret