Function at 0x1402af484
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 0x10], rdx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r12, r9
mov rsi, r8
mov r13, rcx
test rcx, rcx
jne 0x1402af4c6
mov eax, 0xc00000ef
jmp 0x1402afa47
test rsi, rsi
je 0x1402afa42
cmp word [r8], r15w
je 0x1402afa42
test r12, r12
jne 0x1402af4e8
mov eax, 0xc00000f2
jmp 0x1402afa47
xorps xmm0, xmm0
mov qword [r9], r15
xorps xmm1, xmm1
mov word [rcx], r15w
xor r9d, r9d
mov qword [rbp - 0x29], r15
mov rcx, rsi
mov word [rbp + 0x6f], r15w
xor r8d, r8d
lea rdx, [rbp - 0x21]
movups xmmword [rbp - 0x21], xmm0
mov r14, r15
movups xmmword [rbp + 0x17], xmm0
movups xmmword [rbp - 9], xmm1
movups xmmword [rbp + 7], xmm1
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U_WithStatus]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x1402af557
lea r9, str.Failed_to_convert_dos_path_to_nt_path___x_
mov r8d, 0x8a6
mov dword [rsp + 0x20], eax
lea rdx, str.AslPathWildcardFindFirst
mov ecx, 1
call fcn.1400139b4
jmp 0x1402af9f1
lea rcx, [rbp - 0x21]
call fcn.1402af14c
mov ebx, eax
test eax, eax
jns 0x1402af575
lea r9, str.AslPathCleanUstr_failed___x_
mov r8d, 0x8b1
jmp 0x1402af53d
movzx ecx, word [rbp - 0x21]
lea r8, [rbp + 0x6f]
mov edx, 4
call fcn.1402b1194
mov ebx, eax
test eax, eax
jns 0x1402af59c
lea r9, str.RtlUShortAdd_failed___x_
mov r8d, 0x8b7
jmp 0x1402af53d
mov rax, qword gs:[0x60]
mov edx, 8
movzx ebx, word [rbp + 0x6f]
mov r8d, ebx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov r14, rax
test rax, rax
jne 0x1402af5d3
mov ebx, 0xc0000017
jmp 0x1402af9f1
movzx r9d, word [rbp - 0x21]
mov rdx, rbx
mov r8, qword [rbp - 0x19]
mov rcx, r14
call fcn.1402b10fc
mov ebx, eax
test eax, eax
jns 0x1402af5ff
lea r9, str.RtlStringCbCopyNW_failed___x_
mov r8d, 0x8c3
jmp 0x1402af53d
mov rcx, r14
call fcn.1402b0d74
test eax, eax
jne 0x1402af631
lea r9, str.Failed_to_split_the_wildcard_path
mov r8d, 0x8d5
lea rdx, str.AslPathWildcardFindFirst
mov ebx, 0xc0000039
lea ecx, [rax + 1]
call fcn.1400139b4
jmp 0x1402af9f1
cmp eax, 1
jne 0x1402af682
mov rcx, qword [rbp - 0x19]
or qword [r12], 0xffffffffffffffff
call fcn.1402b1638
test eax, eax
jne 0x1402af652
mov ebx, 0x80000006
jmp 0x1402af9f1
mov r8, rsi
mov edx, 0x104
mov rcx, r13
call fcn.140015c70
mov ebx, eax
test eax, eax
jns 0x1402af67a
lea r9, str.RtlStringCbCopyNW_failed___x_
mov r8d, 0x8e7
jmp 0x1402af53d
mov ebx, r15d
jmp 0x1402af9f1
mov rax, qword gs:[0x60]
mov edx, 8
mov rcx, qword [rax + 0x30]
lea r8d, [rdx + 0x38]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [rbp - 0x29], rax
mov rdi, rax
test rax, rax
je 0x1402af5c9
mov r8d, 4
lea rdx, [0x14031b900]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcsncmp
test eax, eax
mov ecx, r15d
xorps xmm0, xmm0
setne cl
mov dword [rdi], ecx
mov qword [rdi + 8], r14
mov r14, r15
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x30]
mov qword [rdi + 0x10], rcx
mov rcx, r15
mov qword [rdi + 0x30], reloc.OLEAUT32.dll_SafeArrayGetDim
mov qword [rdi + 0x20], r15
mov qword [rdi + 0x28], r15
mov qword [rdi + 0x38], r15
mov qword [rdi + 0x18], 0x20
mov rax, qword [rdi + 0x30]
lea rsi, [rax - 1]
add rax, 7
cmp rax, 8
jb 0x1402af7cb
mov rdx, qword [rdi + 0x18]
lea r8, [rbp + 0x27]
not rsi
and rsi, rax
call fcn.14024a7fc
test eax, eax
jns 0x1402af74d
mov ebx, 0xc0000095
jmp 0x1402af7c2
mov rdx, qword [rdi + 0x18]
lea r8, [rbp - 0x39]
mov rcx, rsi
call fcn.14024a7fc
test eax, eax
js 0x1402af746
mov r8, qword [rdi + 0x38]
xor edx, edx
mov rcx, qword [rdi + 0x10]
test r8, r8
jne 0x1402af798
mov r8, qword [rbp - 0x39]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x1402af7ab
mov r8, qword [rbp - 0x39]
xor edx, edx
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
jmp 0x1402af7ab
mov r9, qword [rbp - 0x39]
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rbx, rbx
jne 0x1402af7b7
mov ebx, 0xc0000017
jmp 0x1402af7c2
mov qword [rdi + 0x38], rbx
mov ebx, r15d
mov qword [rdi + 0x28], rsi
test ebx, ebx
jne 0x1402af7d0
mov ebx, r15d
jmp 0x1402af820
mov ebx, 0xc0000095
mov r8, qword [rdi + 0x38]
test r8, r8
je 0x1402af7eb
mov rcx, qword [rdi + 0x10]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
xorps xmm0, xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
test ebx, ebx
jns 0x1402af83a
lea r9, str.RtlArrayInitialize_failed___x_
mov dword [rsp + 0x20], ebx
mov r8d, 0x844
lea rdx, str.AslpPathWildcardInitStack
mov ecx, 1
call fcn.1400139b4
test ebx, ebx
jns 0x1402af83a
mov dword [rsp + 0x20], ebx
lea r9, str.AslpPathWildcardInitStack_failed___x_
mov r8d, 0x90d
jmp 0x1402af541
mov rdi, qword [rbp - 0x29]
lea rcx, [rbp + 0x17]
mov rdx, qword [rdi + 8]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov r8, qword [rdi + 8]
lea rdx, [rbp + 0x17]
mov r9d, 1
mov word [rsp + 0x28], r15w
lea rcx, [rbp - 9]
mov qword [rsp + 0x20], r15
call fcn.1402b09e4
mov ebx, eax
test eax, eax
jns 0x1402af88c
lea r9, str.AslpPathWildcardAllocMatchNode_failed_to_create_root_of_path___x_
mov r8d, 0x91a
jmp 0x1402af53d
mov r15, qword [rdi + 0x20]
cmp r15, qword [rdi + 0x28]
jb 0x1402af97c
lea rcx, [r15 + 1]
cmp rcx, qword [rdi + 0x28]
ja 0x1402af8ca
mov ebx, 0xc000000d
xor r15d, r15d
test ebx, ebx
jns 0x1402af9d0
mov dword [rsp + 0x20], ebx
lea r9, str.AslpPathWildcardPushNode_failed___x_
mov r8d, 0x920
jmp 0x1402af541
mov rbx, qword [rdi + 0x30]
dec rbx
lea rax, [rbx + rcx]
cmp rax, rcx
jb 0x1402af99d
mov rdx, qword [rdi + 0x18]
lea r8, [rbp + 0x2f]
mov rcx, qword [rdi + 0x28]
not rbx
and rbx, rax
call fcn.14024a7fc
test eax, eax
jns 0x1402af900
mov ebx, 0xc0000095
jmp 0x1402af974
mov rdx, qword [rdi + 0x18]
lea r8, [rbp - 0x31]
mov rcx, rbx
call fcn.14024a7fc
test eax, eax
js 0x1402af8f9
mov r8, qword [rdi + 0x38]
xor edx, edx
mov rcx, qword [rdi + 0x10]
test r8, r8
jne 0x1402af94b
mov r8, qword [rbp - 0x31]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x1402af95e
mov r8, qword [rbp - 0x31]
xor edx, edx
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
jmp 0x1402af95e
mov r9, qword [rbp - 0x31]
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
nop dword [rax + rax]
mov rsi, rax
test rsi, rsi
jne 0x1402af96a
mov ebx, 0xc0000017
jmp 0x1402af974
mov qword [rdi + 0x28], rbx
xor ebx, ebx
mov qword [rdi + 0x38], rsi
test ebx, ebx
jne 0x1402af8a9
mov rcx, qword [rdi + 0x18]
lea r8, [rbp - 0x11]
mov rdx, r15
call fcn.14024a7fc
xor r15d, r15d
test eax, eax
jns 0x1402af9a7
mov ebx, 0xc0000095
jmp 0x1402af8ac
mov ebx, 0xc0000095
jmp 0x1402af8a9
mov rdx, qword [rbp - 0x11]
add rdx, qword [rdi + 0x38]
cmp rdx, qword [rdi + 0x38]
jb 0x1402af993
movups xmm0, xmmword [rbp - 9]
mov ebx, r15d
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 7]
movups xmmword [rdx + 0x10], xmm1
inc qword [rdi + 0x20]
jmp 0x1402af8ac
xorps xmm0, xmm0
mov qword [r12], rdi
mov r8, rdi
mov edx, 0x104
mov rcx, r13
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
call fcn.1402afa70
mov ebx, eax
lea rcx, [rbp - 0x21]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
nop dword [rax + rax]
test r14, r14
je 0x1402afa24
mov rcx, qword gs:[0x60]
mov r8, r14
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
test ebx, ebx
jns 0x1402afa3e
lea rcx, [rbp - 0x29]
call fcn.1402b0c10
lea rcx, [rbp - 9]
call fcn.1402b0d10
mov qword [r12], r15
mov eax, ebx
jmp 0x1402afa47
mov eax, 0xc00000f1
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret