Function at 0x14000b910
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
mov rax, rsp
push rbp
push rbx
push r12
lea rbp, [rax - 0x168]
sub rsp, 0x250
xor r12b, r12b
mov rbx, rdx
test rcx, 0xfffffffffffffffb
je 0x14000c083
test rdx, rdx
je 0x14000c075
cmp qword ds:[rdx], 0
je 0x14000c075
cmp qword [0x1402169b8], 0
mov qword ds:[rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax - 0x20], r14
mov qword [rax - 0x28], r15
je 0x14000b980
movups xmm0, xmmword [0x1402169b0]
movaps xmmword [rsp + 0x30], xmm0
jmp 0x14000b9d2
mov ecx, 0x7ffe0030
mov qword [rsp + 0x28], 0x7ffe0030
call sym.ProcessHacker.exe_PhCountStringZ
add rax, rax
mov qword [rsp + 0x20], rax
cmp word [rax + 0x7ffe002e], 0x5c
jne 0x14000b9b0
add rax, 0xfffffffffffffffe
mov qword [rsp + 0x20], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x30], xmm0
mov qword [0x1402169b0], rax
lock or dword [rsp], 0
mov qword [0x1402169b8], 0x7ffe0030
lea r15, ds:[rbx - 0x10]
lock inc dword [r15 + 8]
movups xmm1, xmmword [rbx]
mov r14, qword [rsp + 0x30]
xor ebx, ebx
mov qword [rsp + 0x40], r14
movdqa xmm0, xmm1
movq rdi, xmm1
psrldq xmm0, 8
movq rsi, xmm0
mov qword [rsp + 0x48], rsi
movups xmmword [rsp + 0x20], xmm1
mov qword [rsp + 0x28], rsi
cmp rdi, r14
jb 0x14000c021
mov r8b, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call sym.ProcessHacker.exe_PhEqualStringRef
nop dword [rax + rax]
test al, al
je 0x14000c021
lea rax, [0x1401b3ff8]
mov qword [rsp + 0x50], 0x1a
add rsi, r14
mov qword [rsp + 0x58], rax
sub rdi, r14
mov qword [rsp + 0x28], rsi
mov r8b, 1
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
nop
test al, al
je 0x14000ba7e
mov ebx, 0xd
jmp 0x14000c021
mov qword [rsp + 0x60], 0x12
lea rax, str.System32
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], 0x12
cmp rdi, 0x12
jb 0x14000babd
mov r8b, 1
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x70]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x14000bb01
mov qword [rbp - 0x80], 0x12
lea rax, str.SysWow64
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x70], 0x12
cmp rdi, 0x12
jb 0x14000beca
mov r8b, 1
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x70]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000beca
mov r12b, 1
lea rax, [rdi - 0x12]
mov qword [rbp - 0x60], 0x12
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x60]
lea rax, str._smss.exe
add rsi, 0x12
mov r8b, 1
mov qword [rbp - 0x58], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], rsi
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000bb45
mov ebx, 2
jmp 0x14000c021
lea rax, str.csrss.exe
mov qword [rbp - 0x50], 0x14
mov r8b, 1
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000bb77
mov ebx, 3
jmp 0x14000c021
lea rax, str.wininit.exe
mov qword [rbp - 0x40], 0x18
mov r8b, 1
mov qword [rbp - 0x38], rax
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000bba9
mov ebx, 4
jmp 0x14000c021
lea rax, str._services.exe
mov qword [rbp - 0x30], 0x1a
mov r8b, 1
mov qword [rbp - 0x28], rax
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
nop dword [rax]
test al, al
je 0x14000bbde
mov ebx, 5
jmp 0x14000c021
lea rax, str.lsass.exe
mov qword [rbp - 0x20], 0x14
mov r8b, 1
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000bc15
mov ebx, 6
jmp 0x14000c021
lea rax, str.lsm.exe
mov qword [rbp - 0x10], 0x10
mov r8b, 1
mov qword [rbp - 8], rax
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000bc47
mov ebx, 7
jmp 0x14000c021
lea rax, str.winlogon.exe
mov qword [rbp], 0x1a
mov r8b, 1
mov qword [rbp + 8], rax
lea rdx, [rbp]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000bc79
mov ebx, 8
jmp 0x14000c021
lea rax, str._svchost.exe
mov qword [rbp + 0x10], 0x18
mov r8b, 1
mov qword [rbp + 0x18], rax
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000bcab
mov ebx, 9
jmp 0x14000c021
lea rax, str._rundll32.exe
mov qword [rbp + 0x20], 0x1a
mov r8b, 1
mov qword [rbp + 0x28], rax
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
nop
test al, al
je 0x14000bcde
mov ebx, 0xa
jmp 0x14000c021
lea rax, str.dllhost.exe
mov qword [rbp + 0x30], 0x18
mov r8b, 1
mov qword [rbp + 0x38], rax
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000bd15
mov ebx, 0xb
jmp 0x14000c021
lea rax, str._taskeng.exe
mov qword [rbp + 0x40], 0x18
mov r8b, 1
mov qword [rbp + 0x48], rax
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000bd47
mov ebx, 0xc
jmp 0x14000c021
lea rax, str._taskhost.exe
mov qword [rbp + 0x50], 0x1a
mov r8b, 1
mov qword [rbp + 0x58], rax
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000bd79
mov ebx, 0xc
jmp 0x14000c021
lea rax, str._taskhostex.exe
mov qword [rbp + 0x60], 0x1e
mov r8b, 1
mov qword [rbp + 0x68], rax
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000bdab
mov ebx, 0xc
jmp 0x14000c021
lea rax, str._taskhostw.exe
mov qword [rbp + 0x70], 0x1c
mov r8b, 1
mov qword [rbp + 0x78], rax
lea rdx, [rbp + 0x70]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
nop
test al, al
je 0x14000bdde
mov ebx, 0xc
jmp 0x14000c021
lea rax, str.wudfhost.exe
mov qword [rbp + 0x80], 0x1a
mov r8b, 1
mov qword [rbp + 0x88], rax
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000be19
mov ebx, 0xe
jmp 0x14000c021
lea rax, str.wbemWmiPrvSE.exe
mov qword [rbp + 0x90], 0x24
mov r8b, 1
mov qword [rbp + 0x98], rax
lea rdx, [rbp + 0x90]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000be55
mov ebx, 0x10
jmp 0x14000c021
lea rax, str.MicrosoftEdgeCP.exe
mov qword [rbp + 0xa0], 0x28
mov r8b, 1
mov qword [rbp + 0xa8], rax
lea rdx, [rbp + 0xa0]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x14000c01c
lea rax, str.MicrosoftEdgeSH.exe
mov qword [rbp + 0xb0], 0x28
mov r8b, 1
mov qword [rbp + 0xb8], rax
lea rdx, [rbp + 0xb0]
lea rcx, [rsp + 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
mov ecx, ebx
test al, al
mov ebx, 0xf
cmovne ecx, ebx
mov ebx, ecx
jmp 0x14000c021
mov qword [rbp + 0xc0], 0x28
lea rax, str.MicrosoftEdgeCP.exe
mov qword [rbp + 0xc8], rax
cmp rdi, 0x28
jb 0x14000bf20
lea rax, [rdi - 0x28]
mov qword [rbp + 0xd0], 0x28
add rax, rsi
lea rdx, [rbp + 0xc0]
mov r8b, 1
mov qword [rbp + 0xd8], rax
lea rcx, [rbp + 0xd0]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x14000c01c
mov qword [rbp + 0xe0], 0x24
lea rax, str.MicrosoftEdge.exe
mov qword [rbp + 0xe8], rax
cmp rdi, 0x24
jb 0x14000bf78
lea rax, [rdi - 0x24]
mov qword [rbp + 0xf0], 0x24
add rax, rsi
lea rdx, [rbp + 0xe0]
mov r8b, 1
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 0xf0]
call sym.ProcessHacker.exe_PhEqualStringRef
nop
test al, al
jne 0x14000c01c
mov qword [rbp + 0x100], 0x2c
lea rax, str.ServiceWorkerHost.exe
mov qword [rbp + 0x108], rax
cmp rdi, 0x2c
jb 0x14000bfca
lea rax, [rdi - 0x2c]
mov qword [rbp + 0x110], 0x2c
add rax, rsi
lea rdx, [rbp + 0x100]
mov r8b, 1
mov qword [rbp + 0x118], rax
lea rcx, [rbp + 0x110]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x14000c01c
mov qword [rbp + 0x120], 0x38
lea rax, str.Windows.WARP.JITService.exe
mov qword [rbp + 0x128], rax
cmp rdi, 0x38
jb 0x14000c021
lea rax, [rdi - 0x38]
mov qword [rbp + 0x130], 0x38
add rax, rsi
lea rdx, [rbp + 0x120]
mov r8b, 1
mov qword [rbp + 0x138], rax
lea rcx, [rbp + 0x130]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000c021
mov ebx, 0xf
mov eax, 0xffffffff
lock xadd dword [r15 + 8], eax
mov r14, qword [rsp + 0x248]
mov rdi, qword [rsp + 0x280]
mov rsi, qword [rsp + 0x278]
cmp eax, 1
jne 0x14000c055
mov rcx, r15
call fcn.140106290
mov r15, qword [rsp + 0x240]
mov eax, ebx
bts eax, 0x11
test r12b, r12b
cmove eax, ebx
add rsp, 0x250
pop r12
pop rbx
pop rbp
ret
xor eax, eax
add rsp, 0x250
pop r12
pop rbx
pop rbp
ret
mov eax, 1
add rsp, 0x250
pop r12
pop rbx
pop rbp
ret