Function at 0x140119820
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r10, qword [rcx]
mov r14d, 1
mov rdi, qword [rcx + 8]
mov r15, rcx
lea r13d, [r14 + 1]
cmp r10, 8
jb 0x140119a58
movzx r9d, byte [0x140244611]
lea rdx, [0x1401f10d8]
sub rdx, rdi
mov rcx, rdi
cmp r9b, r14b
jb 0x140119893
lea r8d, [r14 + 3]
nop dword [rax + rax]
movzx eax, word [rdx + rcx]
cmp word [rcx], ax
jne 0x1401198e8
add rcx, r13
sub r8, r14
jne 0x140119880
jmp 0x1401198a8
mov r8, r14
mov rax, qword [rdx + rcx]
cmp qword [rcx], rax
jne 0x1401198e8
add rcx, 8
sub r8, r14
jne 0x140119896
mov rdx, qword [0x1402418e8]
lea rbx, [r10 - 8]
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rdi, rax
xor ecx, ecx
mov qword [rax], rbx
add rax, 0x10
mov qword [rdi + 8], rax
mov word [rax + rbx], cx
mov r8, qword [r15]
mov rdx, qword [r15 + 8]
sub r8, 8
mov rcx, qword [rdi + 8]
add rdx, 8
jmp 0x140119b95
cmp r10, 0x16
jb 0x140119a60
lea rsi, str.SystemRoot
cmp r9b, r14b
jb 0x140119946
mov rbp, r14
nop dword [rax]
nop word [rax + rax]
movdqu xmm1, xmmword [rsi]
movdqu xmm0, xmmword [rdi]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14011993c
add rdi, 0x10
add rsi, 0x10
sub rbp, 1
jne 0x140119910
mov ebp, 3
jmp 0x140119978
shl rbp, 4
add rbp, 6
jmp 0x140119975
mov rbp, r13
nop dword [rax]
mov rax, qword [rsi]
cmp qword [rdi], rax
jne 0x14011996d
add rdi, 8
add rsi, 8
sub rbp, 1
jne 0x140119950
mov ebp, 3
jmp 0x140119978
lea rbp, [rbp*8 + 6]
shr rbp, 1
sub rsi, rdi
nop dword [rax + rax]
movzx ecx, word [rdi]
movzx r12d, word [rsi + rdi]
cmp cx, r12w
je 0x1401199af
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r12w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140119a58
add rdi, r13
sub rbp, 1
jne 0x140119980
mov rsi, qword [0x1402447d8]
nop
test rsi, rsi
je 0x1401199ce
mov r14, qword [0x1402447d0]
jmp 0x140119a00
mov esi, 0x7ffe0030
mov ecx, esi
call sym.ProcessHacker.exe_PhCountStringZ
add rax, rax
cmp word [rax + 0x7ffe002e], 0x5c
lea r14, [rax - 2]
cmovne r14, rax
mov qword [0x1402447d0], r14
lock or dword [rsp], 0
mov qword [0x1402447d8], rsi
mov rbx, qword [r15]
mov rdx, qword [0x1402418e8]
add rbx, 0xffffffffffffffea
add rbx, r14
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rdi, rax
xor ecx, ecx
mov r8, r14
mov rdx, rsi
mov qword [rax], rbx
add rax, 0x10
mov qword [rdi + 8], rax
mov word [rax + rbx], cx
mov rcx, qword [rdi + 8]
call fcn.140188690
mov r8, qword [r15]
mov rdx, qword [r15 + 8]
sub r8, 0x16
mov rcx, qword [rdi + 8]
add rdx, 0x16
add rcx, r14
jmp 0x140119b95
movzx r9d, byte [0x140244611]
mov rax, qword [r15]
mov rdi, qword [r15 + 8]
cmp rax, 0x12
jb 0x140119c8e
lea rsi, str.system32_
cmp r9b, r14b
jb 0x140119ab5
mov rbp, r14
movdqu xmm1, xmmword [rsi]
movdqu xmm0, xmmword [rdi]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140119aab
add rdi, 0x10
add rsi, 0x10
sub rbp, 1
jne 0x140119a80
mov rbp, r14
jmp 0x140119ae3
shl rbp, 4
add rbp, 2
jmp 0x140119ae0
mov rbp, r13
mov rax, qword ds:[rsi]
cmp qword [rdi], rax
jne 0x140119ad8
add rdi, 8
add rsi, 8
sub rbp, 1
jne 0x140119ab8
mov rbp, r14
jmp 0x140119ae3
lea rbp, [rbp*8 + 2]
shr rbp, 1
sub rsi, rdi
nop word [rax + rax]
movzx ecx, word [rdi]
movzx r12d, word [rsi + rdi]
cmp cx, r12w
je 0x140119b1c
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r12w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140119bba
add rdi, r13
sub rbp, 1
jne 0x140119af0
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhGetSystemRoot
mov rsi, qword [rsp + 0x20]
mov rdx, qword [0x1402418e8]
lea rbx, [rsi + 2]
add rbx, qword [r15]
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, qword [rsp + 0x28]
mov rdi, rax
xor ecx, ecx
mov r8, rsi
mov qword [rax], rbx
add rax, 0x10
mov qword [rdi + 8], rax
mov word [rax + rbx], cx
mov rcx, qword [rdi + 8]
call fcn.140188690
mov rcx, qword [rdi + 8]
mov rdx, rsi
shr rdx, 1
mov eax, 0x5c
mov word [rcx + rdx*2], ax
mov rcx, qword [rdi + 8]
add rcx, r13
add rcx, rsi
mov r8, qword [r15]
mov rdx, qword [r15 + 8]
call fcn.140188690
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, qword [r15]
mov rdi, qword [r15 + 8]
cmp rax, 0x12
jb 0x140119c8e
cmp byte [0x140244611], r14b
lea rsi, str.SysWOW64_
jb 0x140119c15
mov rbp, r14
nop
movdqu xmm1, xmmword [rsi]
movdqu xmm0, xmmword [rdi]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140119c0b
add rdi, 0x10
add rsi, 0x10
sub rbp, 1
jne 0x140119be0
mov rbp, r14
jmp 0x140119c43
shl rbp, 4
add rbp, 2
jmp 0x140119c40
mov rbp, r13
mov rax, qword ds:[rsi]
cmp qword [rdi], rax
jne 0x140119c38
add rdi, 8
add rsi, 8
sub rbp, 1
jne 0x140119c18
mov rbp, r14
jmp 0x140119c43
lea rbp, [rbp*8 + 2]
shr rbp, 1
sub rsi, rdi
nop word [rax + rax]
movzx ecx, word [rdi]
movzx r12d, word [rsi + rdi]
cmp cx, r12w
je 0x140119c78
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r12w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140119c8b
add rdi, r13
sub rbp, 1
jne 0x140119c50
jmp 0x140119b26
mov rax, qword [r15]
test rax, rax
je 0x140119dcd
mov rax, qword ds:[r15 + 8]
cmp word [rax], 0x5c
jne 0x140119dcd
mov rcx, r15
call sym.ProcessHacker.exe_PhResolveDevicePrefix
test rax, rax
jne 0x140119b9d
cmp qword ds:[r15], 0x10
mov rdi, qword [r15 + 8]
jb 0x140119dcd
cmp byte [0x140244611], r14b
lea rsi, str.Windows
jb 0x140119d10
nop word [rax + rax]
movdqu xmm1, xmmword [rsi]
movdqu xmm0, xmmword [rdi]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140119d08
add rdi, 0x10
add rsi, 0x10
sub r14, 1
jne 0x140119ce0
jmp 0x140119d6f
shl r14, 4
jmp 0x140119d2f
mov rax, qword [rsi]
cmp qword [rdi], rax
jne 0x140119d27
add rdi, 8
add rsi, 8
sub r13, r14
jne 0x140119d10
jmp 0x140119d6f
lea r14, [r13*8]
shr r14, 1
test r14, r14
je 0x140119d6f
sub rsi, rdi
nop word [rax + rax]
movzx ecx, word [rdi]
movzx ebp, word [rsi + rdi]
cmp cx, bp
je 0x140119d65
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, bp
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
nop
cmp bx, ax
jne 0x140119dcd
add rdi, 2
sub r14, 1
jne 0x140119d40
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhGetSystemRoot
mov rbx, qword [r15]
mov rdx, qword [0x1402418e8]
add rbx, 4
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rdi, rax
xor ecx, ecx
mov qword [rax], rbx
add rax, 0x10
mov qword [rdi + 8], rax
mov word [rax + rbx], cx
mov rax, qword [rsp + 0x28]
mov rdx, qword [rdi + 8]
movzx ecx, word [rax]
mov word [rdx], cx
mov ecx, 0x3a
mov rax, qword [rdi + 8]
mov word [rax + 2], cx
mov rcx, qword [rdi + 8]
add rcx, 4
jmp 0x140119b8e
lock inc dword [r15 - 8]
mov rax, r15
jmp 0x140119b9d