Function at 0x14012f800
Capabilities:
Access peb ldr_data

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0x158]
sub rsp, 0x250
mov rax, qword [0x1402bf040]
xor rax, rsp
mov qword [rbp + 0x110], rax
test byte [0x1402c5790], 1
mov qword [rsp + 0x58], r8
mov dword [rsp + 0x48], edx
mov qword [rsp + 0x50], rcx
jne 0x14012fc4c
lock bts qword [0x1402c5790], 0x1f
setb al
test al, al
jne 0x14012fc27
mov qword [r11 - 0x10], rsi
xor ecx, ecx
mov qword [r11 - 0x18], rdi
mov qword [r11 - 0x20], r12
mov qword [r11 - 0x28], r13
mov qword [r11 + 0x20], rbx
mov qword [r11 - 0x30], r14
mov qword [r11 - 0x38], r15
call sym.SystemInformer.exe_PhCreateSymbolProvider
mov rcx, rax
mov qword [rsp + 0x40], rax
call sym.SystemInformer.exe_PhLoadSymbolProviderOptions
mov rcx, qword gs:[0x30]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov rcx, qword gs:[0x30]
mov rdx, qword ds:[rcx + 0x60]
mov r13, qword [rdx + 0x18]
add r13, 0x10
mov r12, qword [r13]
cmp r12, r13
je 0x14012f9f9
nop dword [rax]
cmp word ds:[r12 + 0x58], 0x1c
mov rbx, qword [r12 + 0x60]
jb 0x14012f9ec
lea r14, str.kernelbase.dll
mov esi, 1
movdqu xmm0, xmmword [rbx]
movdqu xmm1, xmmword [r14]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14012f91f
add rbx, 0x10
add r14, 0x10
sub rsi, 1
jne 0x14012f8f2
mov esi, 6
jmp 0x14012f92a
shl rsi, 4
add rsi, 0xc
shr rsi, 1
sub r14, rbx
nop dword [rax]
movzx ecx, word [rbx]
movzx r15d, word [rbx + r14]
cmp cx, r15w
je 0x14012f95c
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r15w
movzx edi, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp di, ax
jne 0x14012f9ec
add rbx, 2
sub rsi, 1
jne 0x14012f930
test r12, r12
je 0x14012f9f9
movzx eax, word [r12 + 0x48]
lea rcx, [rbp - 0x68]
mov rdi, qword [r12 + 0x30]
mov esi, dword [r12 + 0x40]
mov qword [rbp - 0x68], rax
mov rax, qword [r12 + 0x50]
mov qword [rbp - 0x60], rax
call sym.SystemInformer.exe_PhDosPathNameToNtPathName
mov rcx, qword gs:[0x30]
mov rbx, rax
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x110]
test rax, rax
je 0x14012fa0d
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov r9d, esi
mov r8, rdi
mov rsi, qword [rsp + 0x40]
mov rdx, rbx
mov rcx, rsi
call sym.SystemInformer.exe_PhLoadModuleSymbolProvider
mov rdi, 0xffffffffffffffff
lea rcx, [rbx - 0x10]
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14012fa1f
call fcn.140141ca0
jmp 0x14012fa1f
mov r12, qword [r12]
cmp r12, r13
jne 0x14012f8d0
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov rsi, qword [rsp + 0x40]
mov rdi, 0xffffffffffffffff
mov rcx, rsi
call fcn.140159820
mov r15, qword ss:[rsp + 0x220]
mov r13, qword [rsp + 0x230]
mov r12, qword [rsp + 0x238]
test al, al
je 0x14012fbe2
cmp qword [0x1402cab40], 0
je 0x14012fbe2
xorps xmm0, xmm0
lea rcx, [0x1402cdca8]
xor eax, eax
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp], rax
mov dword [rbp - 0x50], 0x58
mov dword [rbp], 0x80
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call sym.SystemInformer.exe_PhfAcquireFastLockExclusive
mov rcx, qword [rsi + 0x18]
lea r8, [rbp - 0x50]
mov rax, qword [0x1402cab40]
lea rdx, str.GetAppModelPolicy
call qword [case.0x14013d64a.0]
mov ebx, eax
nop dword [rax + rax]
mov edx, dword [0x1402cdca8]
mov eax, edx
cmp edx, 0x400000
jb 0x14012fae8
lea ecx, [rdx - 0x3fffff]
lock cmpxchg dword [0x1402cdca8], ecx
cmp eax, edx
jne 0x14012fb0a
mov rcx, qword [0x1402cdcb0]
mov edx, 1
jmp 0x14012fb1d
mov r9d, edx
mov ecx, edx
shr r9d, 0xc
and r9d, 0x3ff
and ecx, 0xffc00ffe
lock cmpxchg dword [0x1402cdca8], ecx
cmp eax, edx
je 0x14012fb0e
pause
jmp 0x14012fab0
test r9d, r9d
je 0x14012fb26
mov rcx, qword [0x1402cdcb8]
mov edx, r9d
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtReleaseSemaphore]
test ebx, ebx
je 0x14012fbe2
xor r14d, r14d
mov dword [rsp + 0x40], r14d
call fcn.140170a80
nop dword [rax + rax]
test rax, rax
je 0x14012fbe2
mov rbx, qword ds:[rbp - 0x18]
xorps xmm0, xmm0
mov rax, rbx
mov qword [rsp + 0x68], 0x1000
and rax, 0xfffffffffffff000
mov qword [rbp - 0x60], 1
mov qword [rsp + 0x60], rax
mov rax, rbx
and eax, 0xfff
mov qword [rsp + 0x70], 1
mov qword [rbp - 0x68], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x78], rax
lea rax, [rbp - 0x68]
mov qword [rbp - 0x80], rax
movdqu xmmword [rbp - 0x78], xmm0
call fcn.140170a80
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x28], 0x28
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x60]
mov rcx, rdi
mov edx, 2
mov r8d, 1
call qword [case.0x14013d64a.0]
cmp eax, 0xc0000045
je 0x14012fbdb
test eax, eax
js 0x14012fbe2
mov qword [0x1402cda28], rbx
lea rcx, [rsi - 0x10]
lock xadd dword [rcx + 8], edi
mov r14, qword [rsp + 0x228]
cmp edi, 1
mov rdi, qword [rsp + 0x240]
mov rsi, qword [rsp + 0x248]
mov rbx, qword [rsp + 0x278]
jne 0x14012fc15
call fcn.140141ca0
lea rcx, [0x1402c5790]
nop dword [rax]
call sym.SystemInformer.exe_PhfSetEvent
jmp 0x14012fc3e
test byte [0x1402c5790], 1
jne 0x14012fc4c
xor edx, edx
lea rcx, [0x1402c5790]
call sym.SystemInformer.exe_PhfWaitForEvent
mov r8, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov edx, dword [rsp + 0x48]
mov r9, qword [0x1402cda28]
test r9, r9
je 0x14012fcc8
mov eax, dword [0x1402bff40]
nop
cmp edx, 0x38
jl 0x14012fc6a
cmp eax, 0x72
jb 0x14012fcaa
cmp edx, 0x30
jl 0x14012fc74
cmp eax, 0x6d
jb 0x14012fcaa
cmp edx, 0x2e
jl 0x14012fc7e
cmp eax, 0x6b
jb 0x14012fcaa
nop
cmp edx, 0x2d
jl 0x14012fc8a
cmp eax, 0x6a
jb 0x14012fcaa
cmp edx, 0x2a
jl 0x14012fc94
cmp eax, 0x69
jb 0x14012fcaa
cmp edx, 0x23
jl 0x14012fc9e
cmp eax, 0x68
jb 0x14012fcaa
nop
cmp edx, 0x1f
jl 0x14012fcb1
cmp eax, 0x67
jae 0x14012fcb1
mov eax, 0xc0000003
jmp 0x14012fccd
movabs r10, 0xd560b75118d7e170
mov rax, r9
call qword [0x14020d258]
jmp 0x14012fccd
mov eax, 0xc000007a
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.1401e4160
add rsp, 0x250
pop rbp
ret