Function at 0x75df3731
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6a4
mov eax, dword [0x75e50140]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x20a
lea eax, reloc.ntdll.dll_NtClose
push esi
xor edi, edi
mov ebx, ecx
push edi
push eax
call fcn.75dc7439
add esp, 0xc
lea eax, reloc.ntdll.dll_NtClose
push esi
push edi
push eax
call fcn.75dc7439
add esp, 0xc
mov dword [ebp - reloc.ntdll.dll_NtClose], edi
cmp dword [ebx + 4], 0x20c
mov dword [ebp - reloc.ntdll.dll_NtClose], edi
mov dword [ebp - reloc.ntdll.dll_NtClose], edi
jne 0x75df39f0
inc edi
cmp dword [ebx], edi
jne 0x75df39f0
push dword [ebx + 8]
lea ecx, [ebp - 0x68]
call fcn.75df356a
mov esi, eax
test esi, esi
jns 0x75df37c8
push esi
push str.Failed_to_hash_File_path___x_
push 0x79
push str.AeWERQueryFileInfo
push edi
call fcn.75e0e6b8
add esp, 0x14
jmp 0x75df39f5
push str.AppCompatPrograms
push 0x7ffe0030
push str._s_s
lea eax, reloc.ntdll.dll_NtClose
push 0x105
push eax
call fcn.75df36ed
mov esi, eax
add esp, 0x14
test esi, esi
jns 0x75df37fe
push esi
push str.StringCchPrintf_for_StoreDirectory___x_
push 0x87
jmp 0x75df37b5
lea eax, reloc.ntdll.dll_NtClose
push eax
lea ecx, reloc.ntdll.dll_NtClose
call fcn.75df34e4
mov esi, eax
test esi, esi
jns 0x75df3823
push esi
push str.AeGetPersistedLocation_failed___x_
push 0x92
jmp 0x75df37b5
push str.Amcache.hve
lea eax, reloc.ntdll.dll_NtClose
push eax
push str._s_s
lea eax, reloc.ntdll.dll_NtClose
push 0x104
push eax
call fcn.75df36ed
mov esi, eax
add esp, 0x14
test esi, esi
jns 0x75df385e
push esi
push str.StringCchPrintf___x_
push 0xa0
jmp 0x75df37b5
push 0
push 0
push 0x20019
lea eax, reloc.ntdll.dll_NtClose
push eax
lea eax, reloc.ntdll.dll_NtClose
push eax
call dword [0x75e21890]
mov esi, eax
test esi, esi
je 0x75df38c5
cmp esi, 5
je 0x75df3892
cmp esi, 2
je 0x75df3892
mov eax, 0xb2
jmp 0x75df389a
push 3
pop edi
mov eax, 0xae
push esi
push str.RegLoadAppKey_failed___d_
push eax
push str.AeWERQueryFileInfo
push edi
call fcn.75e0e6b8
add esp, 0x14
test esi, esi
jle 0x75df39f5
movzx esi, si
or esi, 0x80070000
jmp 0x75df39f5
lea eax, reloc.ntdll.dll_NtClose
push eax
push 0x20019
push 0
push str.Root
push dword [ebp - 0x69c]
call dword [0x75e21924]
mov esi, eax
test esi, esi
je 0x75df38fc
cmp esi, 2
je 0x75df38b7
push esi
push str.Failed_to_open_file_key___d_
push 0xc0
jmp 0x75df38a1
lea eax, reloc.ntdll.dll_NtClose
push eax
push 0x20019
push 0
push str.InventoryApplicationFile
push dword [ebp - 0x698]
call dword [0x75e21924]
mov esi, eax
test esi, esi
je 0x75df3936
cmp esi, 2
je 0x75df38b7
push esi
push str.Failed_to_open_file_key___d_
push 0xca
jmp 0x75df38a1
lea eax, reloc.ntdll.dll_NtClose
mov dword [ebp - reloc.ntdll.dll_NtClose], 0x100
push eax
lea esi, [ebx + 0xc]
xor edi, edi
push esi
push edi
push 2
push str.ProgramId
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x694]
call dword [0x75e21914]
test eax, eax
je 0x75df3988
cmp eax, 2
je 0x75df3988
push eax
push str.Failed_to_get_program_id___d_
push 0xdf
push str.AeWERQueryFileInfo
push 3
call fcn.75e0e6b8
add esp, 0x14
lea eax, reloc.ntdll.dll_NtClose
mov dword [ebp - reloc.ntdll.dll_NtClose], 0x100
push eax
add ebx, 0x10c
lea eax, [ebp - 0x68]
push ebx
push edi
push 2
push 0x75e255e4
push eax
push dword [ebp - 0x694]
call dword [0x75e21914]
test eax, eax
je 0x75df39db
cmp eax, 2
je 0x75df39db
push eax
push str.Failed_to_get_file_id___d_
push 0xf2
push str.AeWERQueryFileInfo
push 3
call fcn.75e0e6b8
add esp, 0x14
cmp word [ebx], di
jne 0x75df39ec
cmp word [esi], di
jne 0x75df39ec
mov esi, 0x80070002
jmp 0x75df39f5
mov esi, edi
jmp 0x75df39f5
mov esi, 0x80070057
cmp dword [ebp - reloc.ntdll.dll_NtClose], 0
je 0x75df3a0a
push dword [ebp - 0x694]
call dword [0x75e2191c]
cmp dword [ebp - reloc.ntdll.dll_NtClose], 0
je 0x75df3a1f
push dword [ebp - 0x698]
call dword [0x75e2191c]
cmp dword [ebp - reloc.ntdll.dll_NtClose], 0
je 0x75df3a34
push dword [ebp - 0x69c]
call dword [0x75e2191c]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.75dbdd75
leave
ret