Function at 0x7dd8263e
Capabilities:
Get windows directory from kuser_shared_data
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x7de403ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x7de4035c]
push ebx
xor ebx, ebx
push edi
mov dword [ebp - 0x210], ebx
cmp eax, 1
jne 0x7dd828a4
xor edi, edi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop ebx
call fcn.7dd71442
leave
ret
push esi
cmp eax, 0xffffffff
je 0x7dda778f
mov ecx, 0x7ffe0030
mov eax, ecx
lea esi, [eax + 2]
jmp 0x7dd828c2
push ebx
push 0xffffffffffffffff
jmp 0x7dd82af4
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x7dd828c2
sub eax, esi
sar eax, 1
lea edx, [eax + eax + 0x2c]
mov eax, 0x208
cmp edx, eax
ja 0x7dda7799
lea edx, [ebp - 0x20c]
mov word [ebp - 0x216], ax
mov dword [ebp - 0x214], edx
push ecx
lea eax, [ebp - 0x218]
xor edx, edx
push eax
mov word [ebp - 0x218], dx
call dword [sym.imp.ntdll.dll_RtlAppendUnicodeToString]
mov edi, eax
cmp edi, ebx
jl 0x7dd828ba
push 0x7dd82b04
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.ntdll.dll_RtlAppendUnicodeStringToString]
mov edi, eax
cmp edi, ebx
jl 0x7dd828ba
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
call dword [sym.imp.ntdll.dll_LdrLoadDll]
mov edi, eax
cmp edi, ebx
jl 0x7dd828ba
push dword [ebp - 0x210]
push 1
call dword [sym.imp.ntdll.dll_LdrAddRefDll]
mov edi, eax
cmp edi, ebx
jl 0x7dd828ba
mov esi, dword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
lea eax, [ebp - 0x228]
push eax
push ebx
push 0x7dd82b0c
push dword [ebp - 0x210]
call esi
mov edi, eax
cmp edi, ebx
jl 0x7dd828ba
lea eax, [ebp - 0x234]
push eax
push ebx
push 0x7dd82b14
push dword [ebp - 0x210]
call esi
mov edi, eax
cmp edi, ebx
jl 0x7dd828ba
lea eax, [ebp - 0x238]
push eax
push ebx
push 0x7dd82b1c
push dword [ebp - 0x210]
call esi
mov edi, eax
cmp edi, ebx
jl 0x7dd828ba
lea eax, [ebp - 0x230]
push eax
push ebx
push 0x7dd82b24
push dword [ebp - 0x210]
call esi
mov edi, eax
cmp edi, ebx
jl 0x7dd828ba
lea eax, [ebp - 0x224]
push eax
push ebx
push 0x7dd82b2c
push dword [ebp - 0x210]
call esi
mov edi, eax
cmp edi, ebx
jl 0x7dd828ba
lea eax, [ebp - 0x21c]
push eax
push ebx
push 0x7dd82b34
push dword [ebp - 0x210]
call esi
mov edi, eax
cmp edi, ebx
jl 0x7dd828ba
lea eax, [ebp - 0x22c]
push eax
push ebx
push 0x7dd82b3c
push dword [ebp - 0x210]
call esi
mov edi, eax
cmp edi, ebx
jl 0x7dd828ba
lea eax, [ebp - 0x220]
push eax
push ebx
push 0x7dd82b44
push dword [ebp - 0x210]
call esi
mov edi, eax
cmp edi, ebx
jl 0x7dd828ba
mov esi, dword [sym.imp.ntdll.dll_RtlEncodeSystemPointer]
push ebx
push dword [ebp - 0x228]
call esi
push eax
push 0x7de40360
call fcn.7dd7138c
push ebx
push dword [ebp - 0x234]
call esi
push eax
push 0x7de40364
call fcn.7dd7138c
push ebx
push dword [ebp - 0x230]
call esi
push eax
push 0x7de4036c
call fcn.7dd7138c
push ebx
push dword [ebp - 0x224]
call esi
push eax
push 0x7de40370
call fcn.7dd7138c
push ebx
push dword [ebp - 0x21c]
call esi
push eax
push 0x7de40374
call fcn.7dd7138c
push ebx
push dword [ebp - 0x22c]
call esi
push eax
push 0x7de40378
call fcn.7dd7138c
push ebx
push dword [ebp - 0x220]
call esi
push eax
push 0x7de4037c
call fcn.7dd7138c
push ebx
push 1
push 0x7de4035c
call fcn.7dd7138c
pop esi
jmp 0x7dd8266d
mov edi, 0xc0000001
jmp 0x7dd828ba
mov edi, 0xc0000023
jmp 0x7dd828ba