Function at 0x3ff6201d
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x3ff6a040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x104], eax
push ebx
xor eax, eax
push esi
push edi
xor ecx, ecx
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x120], ecx
lea edi, [ebp - 0x11c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x12c], ecx
lea edi, [ebp - 0x128]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov edx, dword [ebp + 8]
mov dword [ebp - 0x138], ecx
lea edi, [ebp - 0x134]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x110], ecx
lea edi, [ebp - 0x10c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [esi], ecx
mov edi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0x104]
xor eax, eax
stosd dword es:[edi], eax
push ecx
stosd dword es:[edi], eax
lea eax, [ebp - 0x114]
push eax
push ebx
push edx
mov dword [ebp - 0x100], ecx
mov dword [ebp - 0x114], ecx
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
mov ecx, dword [ebp - 0x114]
mov dword [esi], ecx
test al, al
je 0x3ff63baf
test ecx, ecx
je 0x3ff622ab
mov eax, dword [ebx + 4]
cmp word [eax], 0x5c
jne 0x3ff622e1
cmp word [eax + 2], 0x3f
jne 0x3ff622e1
cmp word [eax + 4], 0x3f
jne 0x3ff622e1
cmp word [eax + 6], 0x5c
jne 0x3ff622e1
lea edx, [ebp - 0x138]
mov ecx, 0x7ffe0030
call fcn.3ff61686
mov esi, eax
test esi, esi
jl 0x3ff622ad
lea eax, [ebp - 0x100]
push eax
push dword [ebp - 0x138]
push 8
pop edi
push edi
call fcn.3ff61484
mov esi, eax
test esi, esi
jl 0x3ff622ad
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 0x100]
call fcn.3ff61630
mov esi, eax
test esi, esi
jl 0x3ff622ad
mov ecx, dword [ebp - 0x108]
push 0x5c
pop eax
mov word [ecx], ax
mov ecx, dword [ebp - 0x108]
push 0x3f
pop eax
mov word [ecx + 2], ax
mov ecx, dword [ebp - 0x108]
mov word [ecx + 4], ax
mov ecx, dword [ebp - 0x108]
push 0x5c
pop eax
mov word [ecx + 6], ax
push dword [ebp - 0x138]
mov eax, dword [ebp - 0x108]
push dword [ebp - 0x130]
add eax, edi
push eax
mov dword [ebp - 0x110], edi
call sub.ntdll.dll_memcpy
mov eax, dword [ebp - 0x138]
add dword [ebp - 0x110], eax
mov ebx, dword [ebx + 4]
mov eax, dword [ebp - 0x114]
sub eax, ebx
sar eax, 1
add esp, 0xc
add eax, eax
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x12c], eax
je 0x3ff621e4
mov ecx, eax
shr ecx, 1
movzx ecx, word [ebx + ecx*2 - 2]
cmp cx, 0x5c
jne 0x3ff622cb
dec eax
dec eax
and dword [ebp - 0x120], 0
sub eax, edi
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], eax
lea eax, [ebp - 0xfc]
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x12c]
push eax
add ebx, edi
push 0
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x11c], 0xf8
call fcn.3ff61743
mov esi, eax
test esi, esi
jl 0x3ff622ad
lea eax, [ebp - 0x100]
push eax
push dword [ebp - 0x120]
call fcn.3ff61437
test eax, eax
jl 0x3ff622da
lea eax, [ebp - 0x100]
push eax
push 0x38
push dword [ebp - 0x100]
call fcn.3ff6145d
test eax, eax
jl 0x3ff622da
push dword [ebp - 0x104]
push dword [ebp - 0x100]
call fcn.3ff61dd0
mov esi, eax
test esi, esi
jl 0x3ff622ad
push 0x3ff622f0
push dword [ebp - 0x104]
call dword [sym.imp.ntdll.dll_RtlCopyUnicodeString]
push dword [ebp - 0x104]
lea eax, [ebp - 0x120]
push eax
call fcn.3ff62380
mov esi, eax
test esi, esi
jl 0x3ff622ad
xor esi, esi
lea ecx, [ebp - 0x110]
call fcn.3ff62337
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.3ff61425
leave
ret 0x10
cmp cx, 0x2f
je 0x3ff621e2
jmp 0x3ff621e4
mov esi, 0xc0000095
jmp 0x3ff622ad
push ebx
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
jmp 0x3ff63bb9
mov esi, 0xc0000017
jmp 0x3ff622ad
xor eax, eax
mov edi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [esi], 0
jmp 0x3ff622ab