Function at 0x1008dff
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0x14]
and dword [ebx], 0
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 8], ecx
test esi, esi
je 0x1008e1d
cmp dword [ebp + 0x10], 0x25
jae 0x1008e49
mov edi, 0x80070057
mov eax, dword [section..data]
cmp eax, section..data
je 0x10090db
test byte [eax + 0x1c], 1
je 0x10090db
push edi
push 0x10017fc
push 0x29
jmp 0x10090ba
movzx edx, word [esi + 5]
movzx ecx, word [esi + 3]
mov ax, dx
shr ax, 3
movzx edi, ax
movzx eax, cx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], eax
test cx, cx
je 0x1008e71
test di, di
jne 0x1008e9d
mov edi, 0x80070057
mov eax, dword [section..data]
cmp eax, section..data
je 0x10090db
test byte [eax + 0x1c], 1
je 0x10090db
push edi
push 0x10017fc
push 0x2a
jmp 0x10090ba
movzx ecx, dx
lea edx, [ebp - 4]
push edx
push ecx
dec eax
push eax
mov dword [ebp - 0x18], ecx
call fcn.0101597e
mov edi, eax
test edi, edi
jge 0x1008edc
mov eax, dword [section..data]
cmp eax, section..data
je 0x10090db
test byte [eax + 0x1c], 1
je 0x10090db
push edi
push 0x10017fc
push 0x2b
jmp 0x10090ba
mov eax, dword [ebp - 4]
lea ecx, [ebp - 4]
push ecx
push 0x30
push eax
mov dword [ebp + 0x14], eax
call fcn.0101597e
mov edi, eax
test edi, edi
jge 0x1008f1b
mov eax, dword [section..data]
cmp eax, section..data
je 0x10090db
test byte [eax + 0x1c], 1
je 0x10090db
push edi
push 0x10017fc
push 0x2c
jmp 0x10090ba
lea eax, [ebp + 0x14]
push eax
push 0x25
push dword [ebp + 0x14]
call fcn.0101597e
mov edi, eax
test edi, edi
jge 0x1008f56
mov eax, dword [section..data]
cmp eax, section..data
je 0x10090db
test byte [eax + 0x1c], 1
je 0x10090db
push edi
push 0x10017fc
push 0x2d
jmp 0x10090ba
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 0x14]
je 0x1008f8a
mov edi, 0x8007000d
mov eax, dword [section..data]
cmp eax, section..data
je 0x10090db
test byte [eax + 0x1c], 1
je 0x10090db
push edi
push 0x10017fc
push 0x2e
jmp 0x10090ba
lea eax, [ebp - 4]
push eax
push 7
push dword [ebp - 4]
call fcn.0101597e
mov edi, eax
test edi, edi
jge 0x1008fc5
mov eax, dword [section..data]
cmp eax, section..data
je 0x10090db
test byte [eax + 0x1c], 1
je 0x10090db
push edi
push 0x10017fc
push 0x2f
jmp 0x10090ba
mov ecx, dword [ebp - 8]
push ebx
push dword [ebp - 4]
add ecx, 0x24
push dword [ebp + 8]
call fcn.010030d5
mov edi, eax
test edi, edi
jge 0x1009004
mov eax, dword [section..data]
cmp eax, section..data
je 0x10090db
test byte [eax + 0x1c], 1
je 0x10090db
push edi
push 0x10017fc
push 0x30
jmp 0x10090ba
mov eax, dword [ebx]
mov cx, word [ebp - 0xc]
mov word [eax + 4], cx
mov eax, dword [ebx]
mov cx, word [ebp - 0x10]
mov word [eax + 6], cx
mov cl, byte [esi]
mov eax, dword [ebx]
mov byte [eax], cl
mov cx, word [esi + 1]
mov eax, dword [ebx]
mov word [eax + 2], cx
mov ecx, dword [esi + 7]
mov eax, dword [ebx]
mov dword [eax + 8], ecx
mov ecx, dword [esi + 0xb]
mov eax, dword [ebx]
mov dword [eax + 0xc], ecx
mov edi, dword [ebx]
push 5
pop ecx
add esi, 0xf
add edi, 0x10
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp + 0xc]
push esi
lea eax, [edi + 0x24]
push eax
mov eax, dword [ebx]
add eax, 0x2c
push eax
call fcn.01011032
mov eax, dword [ebx]
add eax, esi
add esp, 0xc
cmp byte [eax + 0x2b], 0
je 0x100908a
mov edi, 0x8007000d
mov eax, dword [section..data]
cmp eax, section..data
je 0x10090db
test byte [eax + 0x1c], 1
je 0x10090db
push edi
push 0x10017fc
push 0x31
jmp 0x10090ba
add eax, 0x2c
lea ecx, [esi + edi + 0x24]
lea esi, [eax + 7]
and esi, 0xfffffff8
cmp esi, eax
jae 0x10090c7
mov edi, 0x80070216
mov eax, dword [section..data]
cmp eax, section..data
je 0x10090db
test byte [eax + 0x1c], 1
je 0x10090db
push edi
push 0x10017fc
push 0x32
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002fd5
jmp 0x10090db
push dword [ebp - 0x18]
push ecx
push esi
call fcn.01011032
mov eax, dword [ebx]
add esp, 0xc
mov dword [eax + 0x28], esi
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10