Function at 0x78bdc120
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get windows directory from kuser_shared_data

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x520
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x538], rbx
mov qword [rbp + 0x540], rsi
mov qword [rbp + 0x548], rdi
mov rax, qword [0x78c09100]
xor rax, rbp
mov qword [rbp + 0x4f0], rax
mov rax, qword gs:[0x30]
mov rdi, rcx
xor r13d, r13d
mov ecx, dword [rax + 0x2030]
or r15, 0xffffffffffffffff
mov r14d, 1
add rcx, 0x248
mov qword [0x78c0a778], rcx
mov rcx, qword gs:[0x30]
mov rax, qword [0x78c0a778]
mov qword [rcx + 0x14d0], rax
cmp byte [0x78c0a770], r13b
jne 0x78bdc2b0
lea rcx, [0x78c0a9f0]
call fcn.78bd8f20
mov ebx, eax
call qword [0x78bd11f8]
cmp ebx, r13d
jge 0x78bdc1f2
lea rdx, [0x78bd4a48]
mov r8d, ebx
mov ecx, r14d
call sym.wow64.dll_Wow64LogPrint
lea rdx, [0x78bd4a80]
mov ecx, r14d
call sym.wow64.dll_Wow64LogPrint
mov edx, ebx
mov rcx, r15
call qword [0x78bd11c8]
mov rax, qword gs:[0x30]
mov byte [0x78c0a770], r14b
lea rbx, [0x78bd4ab8]
mov rsi, qword [rax + 0x60]
mov rax, qword [rsi + 0x20]
cmp word [rax + 0x60], r13w
je 0x78bdc21c
mov rbx, qword [rax + 0x68]
mov rcx, qword [rsi + 0x10]
call qword [0x78bd1200]
mov rdx, qword [rsi + 0x10]
mov rcx, rbx
mov r8d, dword [rax + 0x50]
call qword [0x78bd1ee8]
lea r8, [0x78bd4ac8]
lea rcx, [rbp + 0x2e0]
mov r9d, 0x7ffe0030
mov edx, 0x210
call fcn.78bd8e44
cmp eax, r13d
mov ebx, eax
jge 0x78bdc288
lea rdx, [0x78bd4af8]
mov r8d, eax
mov ecx, r14d
call sym.wow64.dll_Wow64LogPrint
lea rdx, [0x78bd4a80]
mov ecx, r14d
call sym.wow64.dll_Wow64LogPrint
mov edx, ebx
mov rcx, r15
call qword [0x78bd11c8]
mov ecx, dword [0x78c0af68]
call qword [0x78bd1200]
mov edx, dword [0x78c0af68]
lea rcx, [rbp + 0x2e0]
mov r8d, dword [rax + 0x50]
call qword [0x78bd1ee8]
call fcn.78bdd240
movabs rax, 0xf0e0d0c0a0908070
cmp qword [rdi + 0xc0], rax
je 0x78bdc2cc
mov rbx, qword [rdi + 0x80]
jmp 0x78bdc2d3
mov rbx, qword [rdi + 0xf8]
mov rax, qword gs:[0x30]
mov esi, 2
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rcx, qword [rax + 0x10]
mov r12, qword [rcx]
cmp rbx, qword [r12 + 0x30]
jb 0x78bdc373
mov eax, dword [r12 + 0x40]
add rax, qword [r12 + 0x30]
cmp rbx, rax
jae 0x78bdc373
mov rdx, rdi
mov rcx, rbx
call fcn.78bd9ff4
cmp al, r13b
jne 0x78bdc3a9
mov r8, qword [r12 + 0x60]
lea rdx, [0x78bd43f0]
mov ecx, esi
call sym.wow64.dll_Wow64LogPrint
lea rdx, [0x78bd4410]
mov r8, rbx
mov ecx, esi
call sym.wow64.dll_Wow64LogPrint
mov rcx, qword [rbp + 0x4f0]
xor rcx, rbp
call fcn.78bfdec0
mov rbx, qword [rbp + 0x538]
mov rsi, qword [rbp + 0x540]
mov rdi, qword [rbp + 0x548]
lea rsp, [rbp + 0x500]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov r12d, r13d
lea r11, [0x78c0a1d0]
mov rcx, qword [r11]
cmp rbx, rcx
jb 0x78bdc39d
add rcx, qword [r11 + 8]
cmp rbx, rcx
jae 0x78bdc39d
mov ecx, ebx
call fcn.78bd9a0c
mov r10d, eax
cmp r10, rbx
je 0x78bdc406
add r12d, r14d
add r11, 0x18
cmp r12d, esi
jb 0x78bdc37d
mov rax, qword gs:[0x30]
mov r12, qword [rax + 0x1488]
cmp r12, r13
jne 0x78bdc43c
mov r8, qword [0x78c0a9f0]
lea rax, [r8 + 0xf]
cmp rax, r8
ja 0x78bdc3d8
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.78bfe276
sub rsp, rax
xor edx, edx
lea rbx, [rsp + 0x20]
mov rcx, rbx
call fcn.78bfe282
lea rdx, [0x78bd4b38]
mov r8, rbx
mov ecx, esi
call sym.wow64.dll_Wow64LogPrint
jmp 0x78bdc440
movsxd rax, r12d
lea rdx, [0x78bd4460]
mov r8, rbx
lea r9, [rax + rax*2]
lea rax, [0x78c0a1c8]
mov ecx, esi
mov r9, qword [rax + r9*8]
call sym.wow64.dll_Wow64LogPrint
lea r11, [0x78bd9fa4]
mov qword [rdi + 0xf8], r11
jmp 0x78bdc33e
mov rbx, qword [rbp]
mov rcx, qword gs:[0x30]
mov rdx, qword gs:[0x30]
mov eax, dword [rcx + 0x108]
mov dword [rdx + 0x20c4], eax
mov al, byte [rcx + 0x1747]
mov rcx, rbx
mov byte [rdx + 0x2f77], al
call qword [0x78bd1f18]
cmp eax, r13d
mov ebx, eax
jge 0x78bdc4b6
lea rdx, [0x78bd3e78]
mov r8d, eax
mov ecx, r14d
call sym.wow64.dll_Wow64LogPrint
lea rdx, [0x78bd4b78]
mov r8d, ebx
mov ecx, r14d
call sym.wow64.dll_Wow64LogPrint
lea rdx, [0x78bd4bb0]
mov ecx, r14d
call sym.wow64.dll_Wow64LogPrint
mov ecx, ebx
call qword [fcn.78bd1170]
int3
mov dword [rbp + 0x10], 0x1002f
cmp r12, r13
je 0x78bdc503
mov r8, qword gs:[0x30]
lea r9, [rbp + 0x10]
mov rdx, r15
mov rcx, 0xfffffffffffffffe
call qword [fcn.78bd1f48]
mov r11d, dword [0x7ffe0360]
cmp dword [rbp + 0xc8], r11d
jne 0x78bdc53b
mov ecx, dword [rbp + 0xc0]
call fcn.78bd9a0c
mov dword [rbp + 0xc0], eax
jmp 0x78bdc53b
mov ecx, dword [rdi + 0xf8]
call qword [0x78bd1f30]
mov r8, qword gs:[0x30]
lea r9, [rbp + 0x10]
mov rdx, r15
mov rcx, 0xfffffffffffffffe
call qword [fcn.78bd1f48]
lea rcx, [rbp + 0x10]
mov r8b, r14b
mov rdx, rdi
call fcn.78bd9a68
lea rcx, [rbp + 0x10]
call fcn.78bdd090
call fcn.78bdd074
int3