Function at 0x1017021c
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, edx
mov dword [ebp - 0x108], ecx
push esi
push edi
test ebx, ebx
je 0x10170243
and dword [ebx], 0
test ecx, ecx
jne 0x10170287
mov dword [ebp - 0xf8], 0x1d7
mov dword [ebp - 0xf4], 0x100709f4
mov esi, 0xc000000d
push esi
lea ecx, [ebp - 0x100]
mov dword [ebp - 0x100], 0x100709b4
mov dword [ebp - 0xfc], 0x10070af0
call fcn.1016dbec
mov eax, esi
jmp 0x10170520
test ebx, ebx
jne 0x101702a1
mov dword [ebp - 0xf8], 0x1d8
mov dword [ebp - 0xf4], 0x100709d4
jmp 0x1017025b
lea edx, [ebp - 0xfc]
mov ecx, 0x7ffe0030
call fcn.100b637d
test eax, eax
js 0x10170520
mov edx, dword [ebp - 0xfc]
mov ecx, edx
mov eax, dword [ebp - 0xf4]
shr ecx, 1
cmp word [eax + ecx*2 - 2], 0x5c
jne 0x101702da
sub edx, 2
mov dword [ebp - 0xfc], edx
push 6
pop edi
push 0x18
pop eax
and dword [ebp - 0x74], 0
mov esi, 0x10069344
and dword [ebp - 0x44], 0
push 0x1a
pop edx
push 0x14
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xa4], eax
pop eax
push 0x16
pop ecx
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x8c], eax
push 2
pop eax
mov dword [ebp - 0xb4], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0xb8], edi
mov dword [ebp - 0x58], edi
lea edi, [ebp - 0x2c]
push 0x18
pop esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x34], esi
lea esi, [ebp - 0xfc]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0xc8]
mov dword [ebp - 0xc8], 0x10
mov dword [ebp - 0xc4], 0x12
mov dword [ebp - 0xc0], 0x10070b30
mov dword [ebp - 0xbc], 4
mov dword [ebp - 0xac], edx
mov dword [ebp - 0xa8], 0x10070b14
mov dword [ebp - 0xa0], edx
mov dword [ebp - 0x9c], 0x10070b5c
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x90], 0x10070b44
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x84], 0x10070b84
mov dword [ebp - 0x80], 8
mov dword [ebp - 0x7c], 0xa
mov dword [ebp - 0x78], 0x10070b78
mov dword [ebp - 0x6c], 0x100082e8
mov dword [ebp - 0x68], 0x20
mov dword [ebp - 0x64], 0x22
mov dword [ebp - 0x60], 0x10070bb8
mov dword [ebp - 0x5c], 4
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x48], 0x10070b9c
mov dword [ebp - 0x3c], 0x100082e8
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x30], 0x10070c0c
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x104], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x108]
xor esi, esi
mov dword [ebp - 0x20], 0x2c
mov dword [ebp - 0x1c], 0x2e
mov dword [ebp - 0x18], 0x10070bdc
mov dword [ebp - 0x14], 0x24
mov dword [ebp - 0x10], 0x26
mov dword [ebp - 0xc], 0x10070c24
lea ecx, [ebp - 0xed]
mov byte [ebp - 0xed], 0
push ecx
push 0x101718e0
mov edx, eax
mov ecx, edi
call fcn.1016d724
test eax, eax
js 0x10170520
cmp byte [ebp - 0xed], 0
jne 0x10170479
mov eax, dword [ebp - 0x104]
inc esi
add eax, 0x18
mov dword [ebp - 0x104], eax
cmp esi, 8
jb 0x10170437
cmp esi, 8
jne 0x10170499
and dword [ebp - 0xf4], 0
mov esi, 0xc0000039
mov dword [ebp - 0xf8], 0x209
jmp 0x10170260
mov eax, dword [edi + 4]
imul edx, esi, 0x18
lea esi, [ebp - 0xbc]
push 2
add esi, edx
mov ecx, dword [ebp + edx - 0xc8]
sub eax, ecx
mov dword [ebp - 0xf8], eax
mov eax, dword [edi]
sub eax, ecx
mov dword [ebp - 0xfc], eax
mov eax, dword [edi + 8]
lea edi, [ebp - 0xec]
movsd dword es:[edi], dword [esi]
add eax, ecx
mov dword [ebp - 0xf4], eax
xor ecx, ecx
lea eax, [ebp - 0xec]
inc ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0xfc]
lea edi, [ebp - 0xe0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
push ebx
push eax
push 3
pop edx
mov dword [ebp - 0xd4], esi
mov dword [ebp - 0xd0], esi
mov dword [ebp - 0xcc], 0x100082e8
call fcn.1016cfb8
test eax, eax
js 0x10170520
mov eax, dword [ebx]
cmp eax, esi
jbe 0x1017051e
add eax, 0xfffffffe
mov dword [ebx], eax
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret