Function at 0x14012f960
Capabilities:
Access peb ldr_data

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0x158]
sub rsp, 0x250
mov rax, qword [0x1402bf040]
xor rax, rsp
mov qword [rbp + 0x110], rax
test byte [0x1402c57b0], 1
mov qword [rsp + 0x58], r8
mov dword [rsp + 0x48], edx
mov qword [rsp + 0x50], rcx
jne 0x14012fdac
lock bts qword [0x1402c57b0], 0x1f
setb al
test al, al
jne 0x14012fd87
mov qword [r11 - 0x10], rsi
xor ecx, ecx
mov qword [r11 - 0x18], rdi
mov qword [r11 - 0x20], r12
mov qword [r11 - 0x28], r13
mov qword [r11 + 0x20], rbx
mov qword [r11 - 0x30], r14
mov qword [r11 - 0x38], r15
call sym.SystemInformer.exe_PhCreateSymbolProvider
mov rcx, rax
mov qword [rsp + 0x40], rax
call sym.SystemInformer.exe_PhLoadSymbolProviderOptions
mov rcx, qword gs:[0x30]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov rcx, qword gs:[0x30]
mov rdx, qword ds:[rcx + 0x60]
mov r13, qword [rdx + 0x18]
add r13, 0x10
mov r12, qword [r13]
cmp r12, r13
je 0x14012fb59
nop dword [rax]
cmp word ds:[r12 + 0x58], 0x1c
mov rbx, qword [r12 + 0x60]
jb 0x14012fb4c
lea r14, str.kernelbase.dll
mov esi, 1
movdqu xmm0, xmmword [rbx]
movdqu xmm1, xmmword [r14]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14012fa7f
add rbx, 0x10
add r14, 0x10
sub rsi, 1
jne 0x14012fa52
mov esi, 6
jmp 0x14012fa8a
shl rsi, 4
add rsi, 0xc
shr rsi, 1
sub r14, rbx
nop dword [rax]
movzx ecx, word [rbx]
movzx r15d, word [rbx + r14]
cmp cx, r15w
je 0x14012fabc
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r15w
movzx edi, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp di, ax
jne 0x14012fb4c
add rbx, 2
sub rsi, 1
jne 0x14012fa90
test r12, r12
je 0x14012fb59
movzx eax, word [r12 + 0x48]
lea rcx, [rbp - 0x68]
mov rdi, qword [r12 + 0x30]
mov esi, dword [r12 + 0x40]
mov qword [rbp - 0x68], rax
mov rax, qword [r12 + 0x50]
mov qword [rbp - 0x60], rax
call sym.SystemInformer.exe_PhDosPathNameToNtPathName
mov rcx, qword gs:[0x30]
mov rbx, rax
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x110]
test rax, rax
je 0x14012fb6d
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov r9d, esi
mov r8, rdi
mov rsi, qword [rsp + 0x40]
mov rdx, rbx
mov rcx, rsi
call sym.SystemInformer.exe_PhLoadModuleSymbolProvider
mov rdi, 0xffffffffffffffff
lea rcx, [rbx - 0x10]
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14012fb7f
call fcn.140141ea0
jmp 0x14012fb7f
mov r12, qword [r12]
cmp r12, r13
jne 0x14012fa30
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov rsi, qword [rsp + 0x40]
mov rdi, 0xffffffffffffffff
mov rcx, rsi
call fcn.140159f00
mov r15, qword ss:[rsp + 0x220]
mov r13, qword [rsp + 0x230]
mov r12, qword [rsp + 0x238]
test al, al
je 0x14012fd42
cmp qword [0x1402cab60], 0
je 0x14012fd42
xorps xmm0, xmm0
lea rcx, [0x1402cdcc8]
xor eax, eax
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp], rax
mov dword [rbp - 0x50], 0x58
mov dword [rbp], 0x80
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call sym.SystemInformer.exe_PhfAcquireFastLockExclusive
mov rcx, qword [rsi + 0x18]
lea r8, [rbp - 0x50]
mov rax, qword [0x1402cab60]
lea rdx, str.GetAppModelPolicy
call qword [case.0x14013d84a.0]
mov ebx, eax
nop dword [rax + rax]
mov edx, dword [0x1402cdcc8]
mov eax, edx
cmp edx, 0x400000
jb 0x14012fc48
lea ecx, [rdx - 0x3fffff]
lock cmpxchg dword [0x1402cdcc8], ecx
cmp eax, edx
jne 0x14012fc6a
mov rcx, qword [0x1402cdcd0]
mov edx, 1
jmp 0x14012fc7d
mov r9d, edx
mov ecx, edx
shr r9d, 0xc
and r9d, 0x3ff
and ecx, 0xffc00ffe
lock cmpxchg dword [0x1402cdcc8], ecx
cmp eax, edx
je 0x14012fc6e
pause
jmp 0x14012fc10
test r9d, r9d
je 0x14012fc86
mov rcx, qword [0x1402cdcd8]
mov edx, r9d
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtReleaseSemaphore]
test ebx, ebx
je 0x14012fd42
xor r14d, r14d
mov dword [rsp + 0x40], r14d
call fcn.140171300
nop dword [rax + rax]
test rax, rax
je 0x14012fd42
mov rbx, qword ds:[rbp - 0x18]
xorps xmm0, xmm0
mov rax, rbx
mov qword [rsp + 0x68], 0x1000
and rax, 0xfffffffffffff000
mov qword [rbp - 0x60], 1
mov qword [rsp + 0x60], rax
mov rax, rbx
and eax, 0xfff
mov qword [rsp + 0x70], 1
mov qword [rbp - 0x68], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x78], rax
lea rax, [rbp - 0x68]
mov qword [rbp - 0x80], rax
movdqu xmmword [rbp - 0x78], xmm0
call fcn.140171300
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x28], 0x28
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x60]
mov rcx, rdi
mov edx, 2
mov r8d, 1
call qword [case.0x14013d84a.0]
cmp eax, 0xc0000045
je 0x14012fd3b
test eax, eax
js 0x14012fd42
mov qword [0x1402cda48], rbx
lea rcx, [rsi - 0x10]
lock xadd dword [rcx + 8], edi
mov r14, qword [rsp + 0x228]
cmp edi, 1
mov rdi, qword [rsp + 0x240]
mov rsi, qword [rsp + 0x248]
mov rbx, qword [rsp + 0x278]
jne 0x14012fd75
call fcn.140141ea0
lea rcx, [0x1402c57b0]
nop dword [rax]
call sym.SystemInformer.exe_PhfSetEvent
jmp 0x14012fd9e
test byte [0x1402c57b0], 1
jne 0x14012fdac
xor edx, edx
lea rcx, [0x1402c57b0]
call sym.SystemInformer.exe_PhfWaitForEvent
mov r8, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov edx, dword [rsp + 0x48]
mov r9, qword [0x1402cda48]
test r9, r9
je 0x14012fe1c
mov eax, dword [0x1402bff40]
nop
cmp edx, 0x38
jl 0x14012fdca
cmp eax, 0x72
jb 0x14012fe0a
cmp edx, 0x30
jl 0x14012fdd4
cmp eax, 0x6d
jb 0x14012fe0a
cmp edx, 0x2e
jl 0x14012fdde
cmp eax, 0x6b
jb 0x14012fe0a
nop
cmp edx, 0x2d
jl 0x14012fdea
cmp eax, 0x6a
jb 0x14012fe0a
cmp edx, 0x2a
jl 0x14012fdf4
cmp eax, 0x69
jb 0x14012fe0a
cmp edx, 0x23
jl 0x14012fdfe
cmp eax, 0x68
jb 0x14012fe0a
nop
cmp edx, 0x1f
jl 0x14012fe11
cmp eax, 0x67
jae 0x14012fe11
mov eax, 0xc0000003
jmp 0x14012fe21
mov rax, r9
call qword [case.0x14013d84a.0]
jmp 0x14012fe21
mov eax, 0xc000007a
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.1401e4a20
add rsp, 0x250
pop rbp
ret