Function at 0x40f410
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 4]
push esi
push edi
mov edi, 8
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], str.___
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edi
cmp dword [ebx], edi
jb 0x40f4af
push 0
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x14]
call fcn.00410e70
test al, al
je 0x40f4af
mov esi, dword [ebx]
mov eax, dword [0x682b2c]
sub esi, edi
lea ecx, [esi + 0xa]
mov edi, eax
mov dword [ebp + 8], ecx
call fcn.004124f0
lea ecx, [edi + 0x10]
mov edx, 1
lock xadd dword [ecx], edx
mov ecx, dword [ebp + 8]
mov dword [eax + 0xc], edi
mov dword [eax + 8], ecx
mov dword [eax], 1
lea edi, [eax + 0x10]
mov dword [edi], esi
lea eax, [edi + 8]
mov dword [edi + 4], eax
xor edx, edx
mov word [eax + esi], dx
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov edx, dword [edi + 4]
sub eax, 8
push eax
add ecx, 8
push ecx
push edx
call fcn.00534c80
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebx + 4]
mov eax, 0x16
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], str.SystemRoot
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
cmp dword [ebx], eax
jb 0x40f56a
push 1
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
call fcn.00410e70
test al, al
je 0x40f56a
lea esi, [ebp - 0xc]
call fcn.00412c60
mov edx, dword [ebx]
mov eax, dword [ebp - 0xc]
lea edi, [edx + eax - 0x16]
mov eax, dword [0x682b2c]
lea ecx, [edi + 0xa]
mov esi, eax
call fcn.004124f0
lea ecx, [esi + 0x10]
mov edx, 1
lock xadd dword [ecx], edx
mov edx, dword [ebp - 8]
mov dword [eax + 0xc], esi
lea esi, [eax + 0x10]
mov dword [eax], 1
lea ecx, [edi + 0xa]
mov dword [eax + 8], ecx
lea eax, [esi + 8]
mov dword [esi], edi
mov dword [esi + 4], eax
xor ecx, ecx
mov word [eax + edi], cx
mov edi, dword [ebp - 0xc]
mov eax, dword [esi + 4]
push edi
push edx
push eax
call fcn.00534c80
mov ecx, dword [ebx]
mov edx, dword [ebx + 4]
mov eax, dword [esi + 4]
add esp, 0xc
sub ecx, 0x16
push ecx
add edx, 0x16
push edx
add eax, edi
push eax
call fcn.00534c80
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [ebx], 0
je 0x40f61a
mov ecx, dword [ebx + 4]
cmp word [ecx], 0x5c
jne 0x40f61a
push ebx
call fcn.0040f110
test eax, eax
jne 0x40f628
mov edx, dword [ebx + 4]
mov eax, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], str.Windows
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
cmp dword [ebx], eax
jb 0x40f603
push 1
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
call fcn.00410e70
test al, al
je 0x40f603
mov edi, dword [ebx]
add edi, 4
push 0
call fcn.004110a0
mov cx, word [0x7ffe0030]
mov esi, eax
mov eax, dword [esi + 4]
mov word [eax], cx
mov edx, dword [esi + 4]
mov eax, 0x3a
mov word [edx + 2], ax
mov ecx, dword [ebx]
mov edx, dword [ebx + 4]
mov eax, dword [esi + 4]
push ecx
push edx
add eax, 4
push eax
call fcn.00534c80
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebx - 0x10]
mov edx, 1
lock xadd dword [ecx], edx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebx - 0x10]
mov ecx, 1
lock xadd dword [eax], ecx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4