Function at 0x140041880
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rsi, rdx
mov r15, rcx
xor edx, edx
lea rcx, [rbp - 0x40]
mov r8d, 0x160
call fcn.14010ed90
xor r12d, r12d
mov qword [rsp + 0x30], rsi
or r14d, 0xffffffff
mov qword [rsp + 0x38], r12
cmp byte [0x1401937ba], r12b
lea rcx, [rbp + 0x220]
mov edx, 0x410
jne 0x140041926
xorps xmm0, xmm0
mov dword [rsp + 0x60], 0x30
lea r9, [rsp + 0x30]
mov qword [rsp + 0x68], r12
lea r8, [rsp + 0x60]
mov dword [rsp + 0x78], r12d
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rsp + 0x70], r12
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x140041930
cmp byte [0x1401937ba], r12b
je 0x140041a23
mov edx, 0x410
lea rcx, [rbp + 0x220]
lea r8, [rsp + 0x30]
call fcn.1400dcab0
test eax, eax
js 0x140041a23
mov rcx, qword [0x140196670]
mov edx, 4
mov qword [rsp + 0x310], r13
mov r8d, 0xe0
mov r13, qword [rbp + 0x220]
mov qword [rbp + 0x228], r12
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor edx, edx
mov r8d, 0xe0
mov rcx, rax
mov r12, rax
call fcn.14010ed90
lea rdx, str.System32_ntdll.dll
mov ecx, 0x7ffe0030
call sym.ProcessHacker.exe_PhConcatStrings2
mov rbx, rax
mov qword [rsp + 0x28], 0
lea rax, [rbp + 0x228]
xor r9d, r9d
lea r8, str.LdrSystemDllInitBlock
mov qword [rsp + 0x20], rax
mov rcx, r13
mov rdx, qword [rbx + 8]
call sym.ProcessHacker.exe_PhGetProcedureAddressRemote
mov edi, eax
lea rcx, [rbx - 0x10]
mov edx, r14d
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x1400419d0
call fcn.1400c8bc0
test edi, edi
js 0x140041a0b
mov rdx, qword [rbp + 0x228]
test rdx, rdx
je 0x1400419fd
mov r9d, 0xe0
mov qword [rsp + 0x20], 0
mov r8, r12
mov rcx, r13
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
mov edi, eax
mov rax, qword [rbp - 0x38]
test edi, edi
cmovns rax, r12
mov qword [rbp - 0x38], rax
mov rcx, qword [rbp + 0x220]
call qword [sym.imp.ntdll.dll_NtClose]
mov r13, qword [rsp + 0x310]
xor r12d, r12d
cmp byte [0x1401937ba], 0
lea rcx, [rbp + 0x220]
mov qword [rsp + 0x40], rsi
mov edx, 0x400
mov qword [rsp + 0x48], r12
jne 0x140041a8e
xorps xmm0, xmm0
mov dword [rbp - 0x70], 0x30
lea r9, [rsp + 0x40]
mov qword [rbp - 0x68], r12
lea r8, [rbp - 0x70]
mov dword [rbp - 0x58], r12d
movdqu xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x60], r12
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov ebx, eax
cmp eax, 0xc0000022
jne 0x140041a9a
cmp byte [0x1401937ba], 0
je 0x140041bdb
mov edx, 0x400
lea rcx, [rbp + 0x220]
lea r8, [rsp + 0x40]
call fcn.1400dcab0
mov ebx, eax
test ebx, ebx
js 0x140041bb8
mov rcx, qword [rbp + 0x220]
lea rdx, [rbp + 0x120]
call fcn.14007a560
test eax, eax
js 0x140041b8e
mov edi, r12d
lea rbx, [rbp - 0x20]
lea rsi, [rbp + 0x120]
nop dword [rax + rax]
mov rdx, qword [rsi]
test rdx, rdx
je 0x140041afe
lea r9, [rsp + 0x58]
mov ecx, edi
lea r8, [rsp + 0x50]
call fcn.14007a9e0
test al, al
je 0x140041afe
mov rax, qword [rsp + 0x50]
mov qword [rbx - 8], rax
mov rax, qword [rsp + 0x58]
mov qword [rbx], rax
inc edi
add rsi, 8
add rbx, 0x18
cmp edi, 0xe
jl 0x140041ad0
mov rcx, qword [sym.ProcessHacker.exe_PhInstanceHandle]
lea rax, [rbp - 0x40]
lea r9, [0x140041c60]
mov qword [rsp + 0x20], rax
mov r8, r15
mov edx, 0xd7
call qword [sym.imp.USER32.dll_DialogBoxParamW]
lea rbx, [rbp - 0x20]
mov edi, 0xe
nop dword [rax + rax]
mov rcx, qword [rbx - 8]
mov qword [rbx - 8], r12
test rcx, rcx
je 0x140041b63
add rcx, 0xfffffffffffffff0
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140041b63
call fcn.1400c8bc0
mov rcx, qword [rbx]
mov qword [rbx], r12
test rcx, rcx
je 0x140041b84
add rcx, 0xfffffffffffffff0
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140041b84
call fcn.1400c8bc0
add rbx, 0x18
sub rdi, 1
jne 0x140041b40
mov r8, qword [rbp - 0x38]
test r8, r8
je 0x140041ba6
mov rcx, qword [0x140196670]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rbp + 0x220]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x140041c48
cmp ebx, 0xc0000022
je 0x140041bdb
cmp ebx, 0xc0000005
je 0x140041bdb
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x140041be7
movzx eax, bx
jmp 0x140041be3
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x140041bf0
mov ecx, ebx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x140041bf7
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
lea r9, str.Unable_to_open_the_process
mov rbx, rax
mov rcx, r15
test rax, rax
jne 0x140041c1a
lea r8, [0x1401689f8]
lea edx, [rax + 0x10]
call sym.ProcessHacker.exe_PhShowMessage
jmp 0x140041c48
mov rax, qword [rbx + 8]
mov edx, 0x20
mov r8d, 0xfffe
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhShowMessage2
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x140041c48
call fcn.1400c8bc0
add rsp, 0x2d0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret