Function at 0x7de1b16b
Capabilities:
Get system information on windows
Get windows directory from kuser_shared_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3f0
mov eax, dword [0x7de403ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x35c], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x368], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x36c], eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
push 0x40
mov dword [ebp - 0x37c], eax
lea eax, [ebp - 0x3ec]
push ebx
push eax
mov dword [ebp - 0x358], ebx
mov dword [ebp - 0x3f0], ebx
call sub.ntdll.dll_memset
mov dword [ebp - 0x394], ebx
xor eax, eax
lea edi, [ebp - 0x390]
stosd dword es:[edi], eax
add esp, 0xc
push dword [ebp - 0x35c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x360], ebx
mov dword [ebp - 0x350], ebx
mov dword [ebp - 0x354], ebx
mov dword [ebp - 0x364], ebx
call fcn.7dd7501e
mov dword [ebp - 0x378], eax
cmp eax, ebx
jne 0x7de1b224
call fcn.7dd711c7
cmp eax, ebx
jg 0x7de1b218
mov edi, eax
jmp 0x7de1b567
and eax, 0xffff
or eax, 0x80070000
jmp 0x7de1b211
call fcn.7dd711ff
xor ecx, ecx
cmp dword [ebp - 0x378], eax
push 4
sete cl
mov edi, 0x1000
push edi
push 0x4c0
push ebx
mov dword [ebp - 0x384], ecx
call fcn.7dd71833
mov dword [ebp - 0x350], eax
cmp eax, ebx
jne 0x7de1b261
mov edi, 0x8007000e
jmp 0x7de1b567
xor eax, eax
inc eax
push 2
push eax
mov dword [ebp - 0x398], eax
push ebx
lea eax, [ebp - 0x358]
push eax
mov dword [ebp - 0x39c], ebx
mov dword [ebp - 0x3a0], 0xc
call fcn.7dd717e0
push eax
push dword [ebp - 0x368]
call fcn.7dd717e0
push eax
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_DuplicateHandle
test eax, eax
jne 0x7de1b2a6
mov dword [ebp - 0x358], ebx
push ebx
push ebx
push 1
lea eax, [ebp - 0x3a0]
push eax
call fcn.7dd7181b
mov dword [ebp - 0x370], eax
cmp eax, ebx
je 0x7de1b416
cmp esi, ebx
je 0x7de1b416
push ebx
push 0xc
lea eax, [ebp - 0x3ac]
push eax
push 1
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jl 0x7de1b416
cmp dword [ebp - 0x368], ebx
je 0x7de1b301
push dword [ebp - 0x368]
call fcn.7dd977e8
mov dword [ebp - 0x344], eax
jmp 0x7de1b307
mov dword [ebp - 0x344], ebx
movzx eax, word [ebp - 0x3ac]
mov dword [ebp - 0x348], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x34c], 0x28
mov dword [ebp - 0x340], ebx
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x338], ebx
cmp dword [ebp - 0x384], ebx
jne 0x7de1b3ec
push 4
push edi
push 0x348
push ebx
push dword [ebp - 0x35c]
call fcn.7dd8da05
mov dword [ebp - 0x354], eax
cmp eax, ebx
je 0x7de1b416
push 0x14
pop ecx
lea edi, [ebp - 0x324]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x36c]
mov ecx, 0xb3
lea edi, [ebp - 0x2d4]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x34c]
sub eax, ecx
lea ecx, [ebp + eax - 0x324]
mov dword [ebp - 0x374], eax
lea eax, [ebp + eax - 0x2d4]
mov dword [ebp - 0x32c], eax
lea eax, [ebp - 0x374]
push eax
mov esi, 0x348
push esi
lea eax, [ebp - 0x34c]
push eax
push dword [ebp - 0x354]
mov dword [ebp - 0x334], ecx
push dword [ebp - 0x35c]
mov dword [ebp - 0x330], ebx
mov dword [ebp - 0x328], ebx
call fcn.7dd710d3
test eax, eax
je 0x7de1b416
cmp dword [ebp - 0x374], esi
jne 0x7de1b416
mov eax, dword [ebp - 0x354]
jmp 0x7de1b410
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x32c], eax
mov dword [ebp - 0x334], esi
mov dword [ebp - 0x330], ebx
mov dword [ebp - 0x328], ebx
lea eax, [ebp - 0x34c]
mov dword [ebp - 0x364], eax
mov edi, dword [ebp - 0x37c]
cmp word [edi], 0x22
je 0x7de1b461
push edi
call dword [sym.imp.ntdll.dll_RtlDetermineDosPathNameType_U]
cmp eax, 5
jne 0x7de1b461
mov esi, dword [ebp - 0x350]
push edi
push 0x7ffe0030
push 0x7de1b67c
add esi, 0x276
push 0x125
push esi
call fcn.7de1ab55
mov edi, eax
add esp, 0x14
cmp edi, ebx
jge 0x7de1b463
push edi
push 0x7de1b638
jmp 0x7de1b495
mov esi, edi
push dword [ebp - 0x364]
push dword [ebp - 0x370]
push dword [ebp - 0x378]
push esi
push 0x13b
push dword [ebp - 0x350]
call fcn.7de1ab55
mov edi, eax
add esp, 0x18
cmp edi, ebx
jge 0x7de1b4a3
push edi
push 0x7de1b5f0
push ebx
call fcn.7de1abb3
add esp, 0xc
jmp 0x7de1b548
call sub.ntdll.dll_RtlGetCurrentTransaction
push ebx
mov dword [ebp - 0x360], eax
call sub.ntdll.dll_RtlSetCurrentTransaction
lea eax, [ebp - 0x394]
push eax
lea eax, [ebp - 0x3f0]
push eax
mov eax, dword [ebp + 0x1c]
push ebx
push ebx
neg eax
sbb eax, eax
and eax, 0x40000
push eax
xor esi, esi
inc esi
push esi
push ebx
push ebx
push dword [ebp - 0x350]
mov dword [ebp - 0x3f0], 0x44
push ebx
mov dword [ebp - 0x3e8], 0x7dd759e8
call sym.KERNEL32.dll_CreateProcessW
test eax, eax
je 0x7de1b548
mov eax, dword [ebp - 0x370]
cmp eax, ebx
je 0x7de1b548
mov dword [ebp - 0x380], eax
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0x37c], eax
push ebx
push esi
push esi
lea eax, [ebp - 0x380]
push eax
push 2
call dword [sym.imp.ntdll.dll_NtWaitForMultipleObjects]
cmp eax, 0xc0
je 0x7de1b517
cmp eax, 0x101
je 0x7de1b517
cmp eax, esi
jne 0x7de1b542
mov edi, 0x8000ffff
jmp 0x7de1b548
cmp eax, ebx
jne 0x7de1b548
xor edi, edi
cmp dword [ebp - 0x354], ebx
je 0x7de1b567
push 0x8000
push ebx
push dword [ebp - 0x354]
push dword [ebp - 0x35c]
call fcn.7dd8da1d
cmp dword [ebp - 0x358], ebx
je 0x7de1b580
push dword [ebp - 0x358]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
mov dword [ebp - 0x358], ebx
cmp dword [ebp - 0x394], ebx
je 0x7de1b593
push dword [ebp - 0x394]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
cmp dword [ebp - 0x390], ebx
je 0x7de1b5a6
push dword [ebp - 0x390]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
cmp dword [ebp - 0x360], ebx
je 0x7de1b5c4
push dword [ebp - 0x360]
call sub.ntdll.dll_RtlSetCurrentTransaction
push dword [ebp - 0x360]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
cmp dword [ebp - 0x350], ebx
je 0x7de1b5dd
push 0x8000
push ebx
push dword [ebp - 0x350]
call fcn.7dd7184b
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.7dd71442
leave
ret 0x18