Function at 0x1402a2af4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 0x10], rdx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r12, r9
mov rsi, r8
mov r13, rcx
test rcx, rcx
jne 0x1402a2b36
mov eax, 0xc00000ef
jmp 0x1402a30b7
test rsi, rsi
je 0x1402a30b2
cmp word [r8], r15w
je 0x1402a30b2
test r12, r12
jne 0x1402a2b58
mov eax, 0xc00000f2
jmp 0x1402a30b7
xorps xmm0, xmm0
mov qword [r9], r15
xorps xmm1, xmm1
mov word [rcx], r15w
xor r9d, r9d
mov qword [rbp - 0x29], r15
mov rcx, rsi
mov word [rbp + 0x6f], r15w
xor r8d, r8d
lea rdx, [rbp - 0x21]
movups xmmword [rbp - 0x21], xmm0
mov r14, r15
movups xmmword [rbp + 0x17], xmm0
movups xmmword [rbp - 9], xmm1
movups xmmword [rbp + 7], xmm1
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U_WithStatus]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x1402a2bc7
lea r9, str.Failed_to_convert_dos_path_to_nt_path___x_
mov r8d, 0x8a6
mov dword [rsp + 0x20], eax
lea rdx, str.AslPathWildcardFindFirst
mov ecx, 1
call fcn.140013f14
jmp 0x1402a3061
lea rcx, [rbp - 0x21]
call fcn.1402a27bc
mov ebx, eax
test eax, eax
jns 0x1402a2be5
lea r9, str.AslPathCleanUstr_failed___x_
mov r8d, 0x8b1
jmp 0x1402a2bad
movzx ecx, word [rbp - 0x21]
lea r8, [rbp + 0x6f]
mov edx, 4
call fcn.1402a4804
mov ebx, eax
test eax, eax
jns 0x1402a2c0c
lea r9, str.RtlUShortAdd_failed___x_
mov r8d, 0x8b7
jmp 0x1402a2bad
mov rax, qword gs:[0x60]
mov edx, 8
movzx ebx, word [rbp + 0x6f]
mov r8d, ebx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov r14, rax
test rax, rax
jne 0x1402a2c43
mov ebx, 0xc0000017
jmp 0x1402a3061
movzx r9d, word [rbp - 0x21]
mov rdx, rbx
mov r8, qword [rbp - 0x19]
mov rcx, r14
call fcn.1402a476c
mov ebx, eax
test eax, eax
jns 0x1402a2c6f
lea r9, str.RtlStringCbCopyNW_failed___x_
mov r8d, 0x8c3
jmp 0x1402a2bad
mov rcx, r14
call fcn.1402a43e4
test eax, eax
jne 0x1402a2ca1
lea r9, str.Failed_to_split_the_wildcard_path
mov r8d, 0x8d5
lea rdx, str.AslPathWildcardFindFirst
mov ebx, 0xc0000039
lea ecx, [rax + 1]
call fcn.140013f14
jmp 0x1402a3061
cmp eax, 1
jne 0x1402a2cf2
mov rcx, qword [rbp - 0x19]
or qword [r12], 0xffffffffffffffff
call fcn.1402a4ca8
test eax, eax
jne 0x1402a2cc2
mov ebx, 0x80000006
jmp 0x1402a3061
mov r8, rsi
mov edx, 0x104
mov rcx, r13
call fcn.1400161d0
mov ebx, eax
test eax, eax
jns 0x1402a2cea
lea r9, str.RtlStringCbCopyNW_failed___x_
mov r8d, 0x8e7
jmp 0x1402a2bad
mov ebx, r15d
jmp 0x1402a3061
mov rax, qword gs:[0x60]
mov edx, 8
mov rcx, qword [rax + 0x30]
lea r8d, [rdx + 0x38]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [rbp - 0x29], rax
mov rdi, rax
test rax, rax
je 0x1402a2c39
mov r8d, 4
lea rdx, [0x14030ddf0]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcsncmp
test eax, eax
mov ecx, r15d
xorps xmm0, xmm0
setne cl
mov dword [rdi], ecx
mov qword [rdi + 8], r14
mov r14, r15
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x30]
mov qword [rdi + 0x10], rcx
mov rcx, r15
mov qword [rdi + 0x30], reloc.OLEAUT32.dll_SafeArrayGetDim
mov qword [rdi + 0x20], r15
mov qword [rdi + 0x28], r15
mov qword [rdi + 0x38], r15
mov qword [rdi + 0x18], 0x20
mov rax, qword [rdi + 0x30]
lea rsi, [rax - 1]
add rax, 7
cmp rax, 8
jb 0x1402a2e3b
mov rdx, qword [rdi + 0x18]
lea r8, [rbp + 0x27]
not rsi
and rsi, rax
call fcn.14023dddc
test eax, eax
jns 0x1402a2dbd
mov ebx, 0xc0000095
jmp 0x1402a2e32
mov rdx, qword [rdi + 0x18]
lea r8, [rbp - 0x39]
mov rcx, rsi
call fcn.14023dddc
test eax, eax
js 0x1402a2db6
mov r8, qword [rdi + 0x38]
xor edx, edx
mov rcx, qword [rdi + 0x10]
test r8, r8
jne 0x1402a2e08
mov r8, qword [rbp - 0x39]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x1402a2e1b
mov r8, qword [rbp - 0x39]
xor edx, edx
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
jmp 0x1402a2e1b
mov r9, qword [rbp - 0x39]
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rbx, rbx
jne 0x1402a2e27
mov ebx, 0xc0000017
jmp 0x1402a2e32
mov qword [rdi + 0x38], rbx
mov ebx, r15d
mov qword [rdi + 0x28], rsi
test ebx, ebx
jne 0x1402a2e40
mov ebx, r15d
jmp 0x1402a2e90
mov ebx, 0xc0000095
mov r8, qword [rdi + 0x38]
test r8, r8
je 0x1402a2e5b
mov rcx, qword [rdi + 0x10]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
xorps xmm0, xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
test ebx, ebx
jns 0x1402a2eaa
lea r9, str.RtlArrayInitialize_failed___x_
mov dword [rsp + 0x20], ebx
mov r8d, 0x844
lea rdx, str.AslpPathWildcardInitStack
mov ecx, 1
call fcn.140013f14
test ebx, ebx
jns 0x1402a2eaa
mov dword [rsp + 0x20], ebx
lea r9, str.AslpPathWildcardInitStack_failed___x_
mov r8d, 0x90d
jmp 0x1402a2bb1
mov rdi, qword [rbp - 0x29]
lea rcx, [rbp + 0x17]
mov rdx, qword [rdi + 8]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov r8, qword [rdi + 8]
lea rdx, [rbp + 0x17]
mov r9d, 1
mov word [rsp + 0x28], r15w
lea rcx, [rbp - 9]
mov qword [rsp + 0x20], r15
call fcn.1402a4054
mov ebx, eax
test eax, eax
jns 0x1402a2efc
lea r9, str.AslpPathWildcardAllocMatchNode_failed_to_create_root_of_path___x_
mov r8d, 0x91a
jmp 0x1402a2bad
mov r15, qword [rdi + 0x20]
cmp r15, qword [rdi + 0x28]
jb 0x1402a2fec
lea rcx, [r15 + 1]
cmp rcx, qword [rdi + 0x28]
ja 0x1402a2f3a
mov ebx, 0xc000000d
xor r15d, r15d
test ebx, ebx
jns 0x1402a3040
mov dword [rsp + 0x20], ebx
lea r9, str.AslpPathWildcardPushNode_failed___x_
mov r8d, 0x920
jmp 0x1402a2bb1
mov rbx, qword [rdi + 0x30]
dec rbx
lea rax, [rbx + rcx]
cmp rax, rcx
jb 0x1402a300d
mov rdx, qword [rdi + 0x18]
lea r8, [rbp + 0x2f]
mov rcx, qword [rdi + 0x28]
not rbx
and rbx, rax
call fcn.14023dddc
test eax, eax
jns 0x1402a2f70
mov ebx, 0xc0000095
jmp 0x1402a2fe4
mov rdx, qword [rdi + 0x18]
lea r8, [rbp - 0x31]
mov rcx, rbx
call fcn.14023dddc
test eax, eax
js 0x1402a2f69
mov r8, qword [rdi + 0x38]
xor edx, edx
mov rcx, qword [rdi + 0x10]
test r8, r8
jne 0x1402a2fbb
mov r8, qword [rbp - 0x31]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x1402a2fce
mov r8, qword [rbp - 0x31]
xor edx, edx
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
jmp 0x1402a2fce
mov r9, qword [rbp - 0x31]
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
nop dword [rax + rax]
mov rsi, rax
test rsi, rsi
jne 0x1402a2fda
mov ebx, 0xc0000017
jmp 0x1402a2fe4
mov qword [rdi + 0x28], rbx
xor ebx, ebx
mov qword [rdi + 0x38], rsi
test ebx, ebx
jne 0x1402a2f19
mov rcx, qword [rdi + 0x18]
lea r8, [rbp - 0x11]
mov rdx, r15
call fcn.14023dddc
xor r15d, r15d
test eax, eax
jns 0x1402a3017
mov ebx, 0xc0000095
jmp 0x1402a2f1c
mov ebx, 0xc0000095
jmp 0x1402a2f19
mov rdx, qword [rbp - 0x11]
add rdx, qword [rdi + 0x38]
cmp rdx, qword [rdi + 0x38]
jb 0x1402a3003
movups xmm0, xmmword [rbp - 9]
mov ebx, r15d
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 7]
movups xmmword [rdx + 0x10], xmm1
inc qword [rdi + 0x20]
jmp 0x1402a2f1c
xorps xmm0, xmm0
mov qword [r12], rdi
mov r8, rdi
mov edx, 0x104
mov rcx, r13
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
call fcn.1402a30e0
mov ebx, eax
lea rcx, [rbp - 0x21]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
nop dword [rax + rax]
test r14, r14
je 0x1402a3094
mov rcx, qword gs:[0x60]
mov r8, r14
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
test ebx, ebx
jns 0x1402a30ae
lea rcx, [rbp - 0x29]
call fcn.1402a4280
lea rcx, [rbp - 9]
call fcn.1402a4380
mov qword [r12], r15
mov eax, ebx
jmp 0x1402a30b7
mov eax, 0xc00000f1
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret