Function at 0x7dd8266e
Capabilities:
Get windows directory from kuser_shared_data
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x7de403ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x7de4035c]
push ebx
xor ebx, ebx
push edi
mov dword [ebp - 0x210], ebx
cmp eax, 1
jne 0x7dd828d4
xor edi, edi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop ebx
call fcn.7dd71442
leave
ret
push esi
cmp eax, 0xffffffff
je 0x7dda77c7
mov ecx, 0x7ffe0030
mov eax, ecx
lea esi, [eax + 2]
jmp 0x7dd828f2
push ebx
push 0xffffffffffffffff
jmp 0x7dd82b24
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x7dd828f2
sub eax, esi
sar eax, 1
lea edx, [eax + eax + 0x2c]
mov eax, 0x208
cmp edx, eax
ja 0x7dda77d1
lea edx, [ebp - 0x20c]
mov word [ebp - 0x216], ax
mov dword [ebp - 0x214], edx
push ecx
lea eax, [ebp - 0x218]
xor edx, edx
push eax
mov word [ebp - 0x218], dx
call dword [sym.imp.ntdll.dll_RtlAppendUnicodeToString]
mov edi, eax
cmp edi, ebx
jl 0x7dd828ea
push 0x7dd82b34
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.ntdll.dll_RtlAppendUnicodeStringToString]
mov edi, eax
cmp edi, ebx
jl 0x7dd828ea
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
call dword [sym.imp.ntdll.dll_LdrLoadDll]
mov edi, eax
cmp edi, ebx
jl 0x7dd828ea
push dword [ebp - 0x210]
push 1
call dword [sym.imp.ntdll.dll_LdrAddRefDll]
mov edi, eax
cmp edi, ebx
jl 0x7dd828ea
mov esi, dword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
lea eax, [ebp - 0x228]
push eax
push ebx
push 0x7dd82b3c
push dword [ebp - 0x210]
call esi
mov edi, eax
cmp edi, ebx
jl 0x7dd828ea
lea eax, [ebp - 0x234]
push eax
push ebx
push 0x7dd82b44
push dword [ebp - 0x210]
call esi
mov edi, eax
cmp edi, ebx
jl 0x7dd828ea
lea eax, [ebp - 0x238]
push eax
push ebx
push 0x7dd82b4c
push dword [ebp - 0x210]
call esi
mov edi, eax
cmp edi, ebx
jl 0x7dd828ea
lea eax, [ebp - 0x230]
push eax
push ebx
push 0x7dd82b54
push dword [ebp - 0x210]
call esi
mov edi, eax
cmp edi, ebx
jl 0x7dd828ea
lea eax, [ebp - 0x224]
push eax
push ebx
push 0x7dd82b5c
push dword [ebp - 0x210]
call esi
mov edi, eax
cmp edi, ebx
jl 0x7dd828ea
lea eax, [ebp - 0x21c]
push eax
push ebx
push 0x7dd82b64
push dword [ebp - 0x210]
call esi
mov edi, eax
cmp edi, ebx
jl 0x7dd828ea
lea eax, [ebp - 0x22c]
push eax
push ebx
push 0x7dd82b6c
push dword [ebp - 0x210]
call esi
mov edi, eax
cmp edi, ebx
jl 0x7dd828ea
lea eax, [ebp - 0x220]
push eax
push ebx
push 0x7dd82b74
push dword [ebp - 0x210]
call esi
mov edi, eax
cmp edi, ebx
jl 0x7dd828ea
mov esi, dword [sym.imp.ntdll.dll_RtlEncodeSystemPointer]
push ebx
push dword [ebp - 0x228]
call esi
push eax
push 0x7de40360
call fcn.7dd7138c
push ebx
push dword [ebp - 0x234]
call esi
push eax
push 0x7de40364
call fcn.7dd7138c
push ebx
push dword [ebp - 0x230]
call esi
push eax
push 0x7de4036c
call fcn.7dd7138c
push ebx
push dword [ebp - 0x224]
call esi
push eax
push 0x7de40370
call fcn.7dd7138c
push ebx
push dword [ebp - 0x21c]
call esi
push eax
push 0x7de40374
call fcn.7dd7138c
push ebx
push dword [ebp - 0x22c]
call esi
push eax
push 0x7de40378
call fcn.7dd7138c
push ebx
push dword [ebp - 0x220]
call esi
push eax
push 0x7de4037c
call fcn.7dd7138c
push ebx
push 1
push 0x7de4035c
call fcn.7dd7138c
pop esi
jmp 0x7dd8269d
mov edi, 0xc0000001
jmp 0x7dd828ea
mov edi, 0xc0000023
jmp 0x7dd828ea