Function at 0x75ddf519
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x75e50140]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x75e50a38]
push ebx
xor ebx, ebx
push esi
xor esi, esi
inc ebx
mov dword [ebp - reloc.ntdll.dll_NtClose], esi
push edi
cmp eax, ebx
je 0x75ddf55c
or edi, reloc.ntdll.dll_NtClose
cmp eax, edi
jne 0x75ddf56d
mov esi, 0xc0000001
mov ecx, 0x75e50a38
xor eax, eax
lock cmpxchg dword [ecx], edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.75dbdd75
leave
ret
mov ecx, 0x7ffe0030
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x75ddf575
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 0x2c]
mov ecx, 0x208
cmp eax, ecx
jbe 0x75ddf59b
mov esi, 0xc0000023
jmp 0x75ddf551
lea eax, reloc.ntdll.dll_NtClose
mov dword [ebp - reloc.ntdll.dll_NtClose], 0x2080000
mov dword [ebp - reloc.ntdll.dll_NtClose], eax
lea eax, reloc.ntdll.dll_NtClose
push 0x7ffe0030
push eax
call dword [0x75e21df8]
mov esi, eax
test esi, esi
js 0x75ddf551
push 0x75e20c1c
lea eax, reloc.ntdll.dll_NtClose
push eax
call dword [0x75e21e0c]
mov esi, eax
test esi, esi
js 0x75ddf551
lea eax, reloc.ntdll.dll_NtClose
push eax
lea eax, reloc.ntdll.dll_NtClose
push eax
push 0
push 0
call dword [0x75e21de4]
mov esi, eax
test esi, esi
js 0x75ddf551
push dword [ebp - 0x214]
push ebx
call dword [0x75e21e7c]
mov esi, eax
test esi, esi
js 0x75ddf551
lea eax, reloc.ntdll.dll_NtClose
push eax
push 0
push 0x75e20c14
push dword [ebp - 0x214]
call dword [0x75e21e10]
mov esi, eax
test esi, esi
js 0x75ddf551
lea eax, reloc.ntdll.dll_NtClose
push eax
push 0
push 0x75e20c0c
push dword [ebp - 0x214]
call dword [0x75e21e10]
mov esi, eax
test esi, esi
js 0x75ddf551
lea eax, reloc.ntdll.dll_NtClose
push eax
push 0
push 0x75e20c04
push dword [ebp - 0x214]
call dword [0x75e21e10]
mov esi, eax
test esi, esi
js 0x75ddf551
lea eax, reloc.ntdll.dll_NtClose
push eax
push 0
push 0x75e20bfc
push dword [ebp - 0x214]
call dword [0x75e21e10]
mov esi, eax
test esi, esi
js 0x75ddf551
lea eax, reloc.ntdll.dll_NtClose
push eax
push 0
push 0x75e20bf4
push dword [ebp - 0x214]
call dword [0x75e21e10]
mov esi, eax
test esi, esi
js 0x75ddf551
lea eax, reloc.ntdll.dll_NtClose
push eax
push 0
push 0x75e20bec
push dword [ebp - 0x214]
call dword [0x75e21e10]
mov esi, eax
test esi, esi
js 0x75ddf551
lea eax, reloc.ntdll.dll_NtClose
push eax
push 0
push 0x75e20be4
push dword [ebp - 0x214]
call dword [0x75e21e10]
mov esi, eax
test esi, esi
js 0x75ddf551
push dword [ebp - 0x220]
call dword [0x75e21cc8]
mov ecx, eax
mov edx, 0x75e50a40
xor eax, eax
lock cmpxchg dword [edx], ecx
push dword [ebp - 0x224]
call dword [0x75e21cc8]
mov ecx, eax
mov edx, 0x75e50a44
xor eax, eax
lock cmpxchg dword [edx], ecx
push dword [ebp - 0x228]
call dword [0x75e21cc8]
mov ecx, eax
mov edx, 0x75e50a48
xor eax, eax
lock cmpxchg dword [edx], ecx
push dword [ebp - 0x22c]
call dword [0x75e21cc8]
mov ecx, eax
mov edx, 0x75e50a4c
xor eax, eax
lock cmpxchg dword [edx], ecx
push dword [ebp - 0x230]
call dword [0x75e21cc8]
mov ecx, eax
mov edx, 0x75e50a50
xor eax, eax
lock cmpxchg dword [edx], ecx
push dword [ebp - 0x234]
call dword [0x75e21cc8]
mov ecx, eax
mov edx, 0x75e50a54
xor eax, eax
lock cmpxchg dword [edx], ecx
push dword [ebp - 0x238]
call dword [0x75e21cc8]
mov ecx, eax
mov edx, 0x75e50a58
xor eax, eax
lock cmpxchg dword [edx], ecx
mov ecx, 0x75e50a38
xor eax, eax
lock cmpxchg dword [ecx], ebx
jmp 0x75ddf55c