Function at 0x14012fcc0
Capabilities:
Access peb ldr_data

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0x158]
sub rsp, 0x250
mov rax, qword [0x1402c0040]
xor rax, rsp
mov qword [rbp + 0x110], rax
test byte [0x1402c67b8], 1
mov qword [rsp + 0x58], r8
mov dword [rsp + 0x48], edx
mov qword [rsp + 0x50], rcx
jne 0x14013010c
lock bts qword [0x1402c67b8], 0x1f
setb al
test al, al
jne 0x1401300e7
mov qword [r11 - 0x10], rsi
xor ecx, ecx
mov qword [r11 - 0x18], rdi
mov qword [r11 - 0x20], r12
mov qword [r11 - 0x28], r13
mov qword [r11 + 0x20], rbx
mov qword [r11 - 0x30], r14
mov qword [r11 - 0x38], r15
call sym.SystemInformer.exe_PhCreateSymbolProvider
mov rcx, rax
mov qword [rsp + 0x40], rax
call sym.SystemInformer.exe_PhLoadSymbolProviderOptions
mov rcx, qword gs:[0x30]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov rcx, qword gs:[0x30]
mov rdx, qword ds:[rcx + 0x60]
mov r13, qword [rdx + 0x18]
add r13, 0x10
mov r12, qword [r13]
cmp r12, r13
je 0x14012feb9
nop dword [rax]
cmp word ds:[r12 + 0x58], 0x1c
mov rbx, qword [r12 + 0x60]
jb 0x14012feac
lea r14, str.kernelbase.dll
mov esi, 1
movdqu xmm0, xmmword [rbx]
movdqu xmm1, xmmword [r14]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14012fddf
add rbx, 0x10
add r14, 0x10
sub rsi, 1
jne 0x14012fdb2
mov esi, 6
jmp 0x14012fdea
shl rsi, 4
add rsi, 0xc
shr rsi, 1
sub r14, rbx
nop dword [rax]
movzx ecx, word [rbx]
movzx r15d, word [rbx + r14]
cmp cx, r15w
je 0x14012fe1c
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r15w
movzx edi, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp di, ax
jne 0x14012feac
add rbx, 2
sub rsi, 1
jne 0x14012fdf0
test r12, r12
je 0x14012feb9
movzx eax, word [r12 + 0x48]
lea rcx, [rbp - 0x68]
mov rdi, qword [r12 + 0x30]
mov esi, dword [r12 + 0x40]
mov qword [rbp - 0x68], rax
mov rax, qword [r12 + 0x50]
mov qword [rbp - 0x60], rax
call sym.SystemInformer.exe_PhDosPathNameToNtPathName
mov rcx, qword gs:[0x30]
mov rbx, rax
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x110]
test rax, rax
je 0x14012fecd
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov r9d, esi
mov r8, rdi
mov rsi, qword [rsp + 0x40]
mov rdx, rbx
mov rcx, rsi
call sym.SystemInformer.exe_PhLoadModuleSymbolProvider
mov rdi, 0xffffffffffffffff
lea rcx, [rbx - 0x10]
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14012fedf
call fcn.140142200
jmp 0x14012fedf
mov r12, qword [r12]
cmp r12, r13
jne 0x14012fd90
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov rsi, qword [rsp + 0x40]
mov rdi, 0xffffffffffffffff
mov rcx, rsi
call fcn.14015ab80
mov r15, qword ss:[rsp + 0x220]
mov r13, qword [rsp + 0x230]
mov r12, qword [rsp + 0x238]
test al, al
je 0x1401300a2
cmp qword [0x1402cba88], 0
je 0x1401300a2
xorps xmm0, xmm0
lea rcx, [0x1402cebf8]
xor eax, eax
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp], rax
mov dword [rbp - 0x50], 0x58
mov dword [rbp], 0x80
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call sym.SystemInformer.exe_PhfAcquireFastLockExclusive
mov rcx, qword [rsi + 0x18]
lea r8, [rbp - 0x50]
mov rax, qword [0x1402cba88]
lea rdx, str.GetAppModelPolicy
call qword [case.0x14013dbaa.0]
mov ebx, eax
nop dword [rax + rax]
mov edx, dword [0x1402cebf8]
mov eax, edx
cmp edx, 0x400000
jb 0x14012ffa8
lea ecx, [rdx - 0x3fffff]
lock cmpxchg dword [0x1402cebf8], ecx
cmp eax, edx
jne 0x14012ffca
mov rcx, qword [0x1402cec00]
mov edx, 1
jmp 0x14012ffdd
mov r9d, edx
mov ecx, edx
shr r9d, 0xc
and r9d, 0x3ff
and ecx, 0xffc00ffe
lock cmpxchg dword [0x1402cebf8], ecx
cmp eax, edx
je 0x14012ffce
pause
jmp 0x14012ff70
test r9d, r9d
je 0x14012ffe6
mov rcx, qword [0x1402cec08]
mov edx, r9d
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtReleaseSemaphore]
test ebx, ebx
je 0x1401300a2
xor r14d, r14d
mov dword [rsp + 0x40], r14d
call fcn.140171f80
nop dword [rax + rax]
test rax, rax
je 0x1401300a2
mov rbx, qword ds:[rbp - 0x18]
xorps xmm0, xmm0
mov rax, rbx
mov qword [rsp + 0x68], 0x1000
and rax, 0xfffffffffffff000
mov qword [rbp - 0x60], 1
mov qword [rsp + 0x60], rax
mov rax, rbx
and eax, 0xfff
mov qword [rsp + 0x70], 1
mov qword [rbp - 0x68], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x78], rax
lea rax, [rbp - 0x68]
mov qword [rbp - 0x80], rax
movdqu xmmword [rbp - 0x78], xmm0
call fcn.140171f80
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x28], 0x28
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x60]
mov rcx, rdi
mov edx, 2
mov r8d, 1
call qword [case.0x14013dbaa.0]
cmp eax, 0xc0000045
je 0x14013009b
test eax, eax
js 0x1401300a2
mov qword [0x1402ce978], rbx
lea rcx, [rsi - 0x10]
lock xadd dword [rcx + 8], edi
mov r14, qword [rsp + 0x228]
cmp edi, 1
mov rdi, qword [rsp + 0x240]
mov rsi, qword [rsp + 0x248]
mov rbx, qword [rsp + 0x278]
jne 0x1401300d5
call fcn.140142200
lea rcx, [0x1402c67b8]
nop dword [rax]
call sym.SystemInformer.exe_PhfSetEvent
jmp 0x1401300fe
test byte [0x1402c67b8], 1
jne 0x14013010c
xor edx, edx
lea rcx, [0x1402c67b8]
call sym.SystemInformer.exe_PhfWaitForEvent
mov r8, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov edx, dword [rsp + 0x48]
mov r9, qword [0x1402ce978]
test r9, r9
je 0x140130188
mov eax, dword [0x1402c0f40]
nop
cmp edx, 0x38
jl 0x14013012a
cmp eax, 0x72
jb 0x14013016a
cmp edx, 0x30
jl 0x140130134
cmp eax, 0x6d
jb 0x14013016a
cmp edx, 0x2e
jl 0x14013013e
cmp eax, 0x6b
jb 0x14013016a
nop
cmp edx, 0x2d
jl 0x14013014a
cmp eax, 0x6a
jb 0x14013016a
cmp edx, 0x2a
jl 0x140130154
cmp eax, 0x69
jb 0x14013016a
cmp edx, 0x23
jl 0x14013015e
cmp eax, 0x68
jb 0x14013016a
nop
cmp edx, 0x1f
jl 0x140130171
cmp eax, 0x67
jae 0x140130171
mov eax, 0xc0000003
jmp 0x14013018d
movabs r10, 0xd560b75118d7e170
mov rax, r9
call qword [0x14020e260]
jmp 0x14013018d
mov eax, 0xc000007a
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.1401e5e20
add rsp, 0x250
pop rbp
ret