Function at 0x7de1b3bf
Capabilities:
Get system information on windows
Get windows directory from kuser_shared_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3f0
mov eax, dword [0x7de403ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x35c], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x368], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x36c], eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
push 0x40
mov dword [ebp - 0x37c], eax
lea eax, [ebp - 0x3ec]
push ebx
push eax
mov dword [ebp - 0x358], ebx
mov dword [ebp - 0x3f0], ebx
call sub.ntdll.dll_memset
mov dword [ebp - 0x394], ebx
xor eax, eax
lea edi, [ebp - 0x390]
stosd dword es:[edi], eax
add esp, 0xc
push dword [ebp - 0x35c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x360], ebx
mov dword [ebp - 0x350], ebx
mov dword [ebp - 0x354], ebx
mov dword [ebp - 0x364], ebx
call fcn.7dd7502e
mov dword [ebp - 0x378], eax
cmp eax, ebx
jne 0x7de1b478
call fcn.7dd711c7
cmp eax, ebx
jg 0x7de1b46c
mov edi, eax
jmp 0x7de1b7bb
and eax, 0xffff
or eax, 0x80070000
jmp 0x7de1b465
call fcn.7dd711ff
xor ecx, ecx
cmp dword [ebp - 0x378], eax
push 4
sete cl
mov edi, 0x1000
push edi
push 0x4c0
push ebx
mov dword [ebp - 0x384], ecx
call fcn.7dd71833
mov dword [ebp - 0x350], eax
cmp eax, ebx
jne 0x7de1b4b5
mov edi, 0x8007000e
jmp 0x7de1b7bb
xor eax, eax
inc eax
push 2
push eax
mov dword [ebp - 0x398], eax
push ebx
lea eax, [ebp - 0x358]
push eax
mov dword [ebp - 0x39c], ebx
mov dword [ebp - 0x3a0], 0xc
call fcn.7dd717e0
push eax
push dword [ebp - 0x368]
call fcn.7dd717e0
push eax
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_DuplicateHandle
test eax, eax
jne 0x7de1b4fa
mov dword [ebp - 0x358], ebx
push ebx
push ebx
push 1
lea eax, [ebp - 0x3a0]
push eax
call fcn.7dd7181b
mov dword [ebp - 0x370], eax
cmp eax, ebx
je 0x7de1b66a
cmp esi, ebx
je 0x7de1b66a
push ebx
push 0xc
lea eax, [ebp - 0x3ac]
push eax
push 1
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jl 0x7de1b66a
cmp dword [ebp - 0x368], ebx
je 0x7de1b555
push dword [ebp - 0x368]
call fcn.7dd977c8
mov dword [ebp - 0x344], eax
jmp 0x7de1b55b
mov dword [ebp - 0x344], ebx
movzx eax, word [ebp - 0x3ac]
mov dword [ebp - 0x348], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x34c], 0x28
mov dword [ebp - 0x340], ebx
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x338], ebx
cmp dword [ebp - 0x384], ebx
jne 0x7de1b640
push 4
push edi
push 0x348
push ebx
push dword [ebp - 0x35c]
call fcn.7dd8d9dd
mov dword [ebp - 0x354], eax
cmp eax, ebx
je 0x7de1b66a
push 0x14
pop ecx
lea edi, [ebp - 0x324]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x36c]
mov ecx, 0xb3
lea edi, [ebp - 0x2d4]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x34c]
sub eax, ecx
lea ecx, [ebp + eax - 0x324]
mov dword [ebp - 0x374], eax
lea eax, [ebp + eax - 0x2d4]
mov dword [ebp - 0x32c], eax
lea eax, [ebp - 0x374]
push eax
mov esi, 0x348
push esi
lea eax, [ebp - 0x34c]
push eax
push dword [ebp - 0x354]
mov dword [ebp - 0x334], ecx
push dword [ebp - 0x35c]
mov dword [ebp - 0x330], ebx
mov dword [ebp - 0x328], ebx
call fcn.7dd710d3
test eax, eax
je 0x7de1b66a
cmp dword [ebp - 0x374], esi
jne 0x7de1b66a
mov eax, dword [ebp - 0x354]
jmp 0x7de1b664
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x32c], eax
mov dword [ebp - 0x334], esi
mov dword [ebp - 0x330], ebx
mov dword [ebp - 0x328], ebx
lea eax, [ebp - 0x34c]
mov dword [ebp - 0x364], eax
mov edi, dword [ebp - 0x37c]
cmp word [edi], 0x22
je 0x7de1b6b5
push edi
call dword [sym.imp.ntdll.dll_RtlDetermineDosPathNameType_U]
cmp eax, 5
jne 0x7de1b6b5
mov esi, dword [ebp - 0x350]
push edi
push 0x7ffe0030
push 0x7de1b8d4
add esi, 0x276
push 0x125
push esi
call fcn.7de1adaa
mov edi, eax
add esp, 0x14
cmp edi, ebx
jge 0x7de1b6b7
push edi
push 0x7de1b890
jmp 0x7de1b6e9
mov esi, edi
push dword [ebp - 0x364]
push dword [ebp - 0x370]
push dword [ebp - 0x378]
push esi
push 0x13b
push dword [ebp - 0x350]
call fcn.7de1adaa
mov edi, eax
add esp, 0x18
cmp edi, ebx
jge 0x7de1b6f7
push edi
push 0x7de1b848
push ebx
call fcn.7de1ae08
add esp, 0xc
jmp 0x7de1b79c
call sub.ntdll.dll_RtlGetCurrentTransaction
push ebx
mov dword [ebp - 0x360], eax
call sub.ntdll.dll_RtlSetCurrentTransaction
lea eax, [ebp - 0x394]
push eax
lea eax, [ebp - 0x3f0]
push eax
mov eax, dword [ebp + 0x1c]
push ebx
push ebx
neg eax
sbb eax, eax
and eax, 0x40000
push eax
xor esi, esi
inc esi
push esi
push ebx
push ebx
push dword [ebp - 0x350]
mov dword [ebp - 0x3f0], 0x44
push ebx
mov dword [ebp - 0x3e8], 0x7dd759f8
call sym.KERNEL32.dll_CreateProcessW
test eax, eax
je 0x7de1b79c
mov eax, dword [ebp - 0x370]
cmp eax, ebx
je 0x7de1b79c
mov dword [ebp - 0x380], eax
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0x37c], eax
push ebx
push esi
push esi
lea eax, [ebp - 0x380]
push eax
push 2
call dword [sym.imp.ntdll.dll_NtWaitForMultipleObjects]
cmp eax, 0xc0
je 0x7de1b76b
cmp eax, 0x101
je 0x7de1b76b
cmp eax, esi
jne 0x7de1b796
mov edi, 0x8000ffff
jmp 0x7de1b79c
cmp eax, ebx
jne 0x7de1b79c
xor edi, edi
cmp dword [ebp - 0x354], ebx
je 0x7de1b7bb
push 0x8000
push ebx
push dword [ebp - 0x354]
push dword [ebp - 0x35c]
call fcn.7dd8d9f5
cmp dword [ebp - 0x358], ebx
je 0x7de1b7d4
push dword [ebp - 0x358]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
mov dword [ebp - 0x358], ebx
cmp dword [ebp - 0x394], ebx
je 0x7de1b7e7
push dword [ebp - 0x394]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
cmp dword [ebp - 0x390], ebx
je 0x7de1b7fa
push dword [ebp - 0x390]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
cmp dword [ebp - 0x360], ebx
je 0x7de1b818
push dword [ebp - 0x360]
call sub.ntdll.dll_RtlSetCurrentTransaction
push dword [ebp - 0x360]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
cmp dword [ebp - 0x350], ebx
je 0x7de1b831
push 0x8000
push ebx
push dword [ebp - 0x350]
call fcn.7dd7184b
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.7dd71442
leave
ret 0x18