Function at 0x1400be470
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push r12
push r13
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb8
mov r12, rcx
mov r15, r9
xor ecx, ecx
mov r13d, ecx
cmp dword [r12], ecx
jbe 0x1400be78c
mov qword [rax + 0x20], rbx
mov qword [rax - 0x28], rsi
mov qword [rax - 0x30], rdi
mov qword [rax - 0x38], r14
nop word [rax + rax]
mov eax, r13d
imul r14, rax, 0x128
add r14, 8
add r14, r12
lea rcx, [r14 + 0x10]
call qword [r15 + 0x10]
mov edx, dword [r15 + 0x18]
mov edi, eax
mov rcx, qword [r15 + 0x20]
dec edx
btr edi, 0x1f
and edx, edi
mov r8d, dword [rcx + rdx*4]
cmp r8d, 0xffffffff
je 0x1400be538
nop word [rax + rax]
mov ebx, dword [r15]
add ebx, 8
imul ebx, r8d
add rbx, qword [r15 + 0x30]
cmp dword [rbx], edi
jne 0x1400be522
lea rcx, [rbx + 8]
lea rdx, [r14 + 0x10]
call qword [r15 + 8]
test al, al
jne 0x1400be52e
mov r8d, dword [rbx + 4]
cmp r8d, 0xffffffff
jne 0x1400be500
jmp 0x1400be538
add rbx, 8
jne 0x1400be75f
lea rdx, [r14 + 0x10]
mov rcx, r15
call sym.ProcessHacker.exe_PhAddEntryHashtable
lea rcx, [r14 + 0x28]
or rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp byte [rcx + rdx], 0
jne 0x1400be550
call sym.ProcessHacker.exe_PhConvertMultiByteToUtf16Ex
mov rdx, qword [r14 + 0x10]
mov ecx, 4
cmp rdx, qword [0x14015dea8]
mov rbx, rax
mov eax, 1
mov qword [rbp - 0x21], rdx
cmovbe ecx, eax
xor edi, edi
mov dword [rbp - 0x29], ecx
mov ecx, dword [r14 + 0x18]
mov dword [rbp - 0x19], ecx
mov ecx, dword [r14 + 0x1c]
mov dword [rbp - 9], ecx
movzx ecx, word [r14 + 0x26]
add rcx, 0x28
mov qword [rbp - 0x11], rdi
add rcx, r14
or rdx, 0xffffffffffffffff
inc rdx
cmp byte [rcx + rdx], dil
jne 0x1400be5a4
call sym.ProcessHacker.exe_PhConvertMultiByteToUtf16Ex
mov rcx, rbx
mov qword [rbp - 1], rax
call sym.ProcessHacker.exe_PhGetFileName
mov qword [rbp + 7], rax
lea rcx, [rbx - 0x10]
movzx eax, word [r14 + 0x20]
mov word [rbp + 0xf], ax
movzx eax, word [r14 + 0x24]
mov word [rbp + 0x11], ax
mov eax, 0xffff
mov word [rbp + 0x13], ax
or eax, 0xffffffff
mov qword [rbp + 0x17], rdi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400be5f7
call fcn.1400ae900
cmp word [r14 + 0x26], di
jne 0x1400be719
cmp qword [0x14015dae8], rdi
je 0x1400be618
movups xmm0, xmmword [0x14015dae0]
movaps xmmword [rbp - 0x39], xmm0
jmp 0x1400be662
mov ecx, 0x7ffe0030
mov qword [rbp - 0x41], 0x7ffe0030
call sym.ProcessHacker.exe_PhCountStringZ
add rax, rax
mov qword [rbp - 0x49], rax
cmp word [rax + 0x7ffe002e], 0x5c
jne 0x1400be643
sub rax, 2
mov qword [rbp - 0x49], rax
movaps xmm0, xmmword [rbp - 0x49]
movdqa xmmword [rbp - 0x39], xmm0
mov qword [0x14015dae0], rax
lock or dword [rsp], edi
mov qword [0x14015dae8], 0x7ffe0030
mov r14, qword [rbp - 1]
mov rbx, qword [0x14015e0c8]
mov rsi, qword [rbp - 0x39]
mov rcx, rbx
mov rdi, qword [r14]
add rdi, rsi
add rdi, qword [0x140155a70]
lea rdx, [rdi + 0x12]
call fcn.1400ae820
lock inc dword [rbx + 4]
mov rdx, qword [rbp - 0x31]
lea r12, [rax + 0x10]
mov dword [rax + 8], 1
mov r8, rsi
movzx ecx, byte [rbx + 2]
mov word [rax], cx
lea rax, [r12 + 0x10]
xor ecx, ecx
mov qword [r12 + 8], rax
mov qword [r12], rdi
mov word [rax + rdi], cx
mov rbx, qword [r12 + 8]
mov rcx, rbx
call fcn.1400e3970
mov r8, qword [0x140155a70]
add rbx, rsi
mov rdx, qword [str.System32Drivers_]
mov rcx, rbx
call fcn.1400e3970
add rbx, qword [0x140155a70]
mov r8, qword [r14]
mov rcx, rbx
mov rdx, qword [r14 + 8]
call fcn.1400e3970
mov rcx, qword [rbp + 7]
add rcx, 0xfffffffffffffff0
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400be711
call fcn.1400ae900
mov qword [rbp + 7], r12
mov r12, qword [rbp + 0x67]
mov rdx, qword [rbp + 0x77]
lea rcx, [rbp - 0x29]
call qword [rbp + 0x6f]
mov rcx, qword [rbp - 1]
movzx ebx, al
add rcx, 0xfffffffffffffff0
or edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x1400be741
call fcn.1400ae900
mov rcx, qword [rbp + 7]
add rcx, 0xfffffffffffffff0
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400be75b
call fcn.1400ae900
test bl, bl
je 0x1400be76c
inc r13d
cmp r13d, dword [r12]
jb 0x1400be4c0
mov rdi, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xf8]
mov r14, qword [rsp + 0xa0]
add rsp, 0xb8
pop r15
pop r13
pop r12
pop rbp
ret