Function at 0x7ded828f
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get ntdll base address
Get os information via kuser_shared_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
push 0xa
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x88]
push 0x2c
mov dword [ebp - 0x8c], ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xd4]
push ebx
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xd8], ebx
call 0x7de27f20
mov esi, dword [ebp + 0xc]
add esp, 0xc
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x5c]
mov dword [ebp - 0x60], ebx
rep stosd dword es:[edi], eax
mov dword [ebp - 8], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 1], al
cmp esi, ebx
je 0x7ded82f1
mov byte [ebp - 1], 1
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0xcc]
shr eax, 3
test al, 1
je 0x7ded8312
lea eax, [edi + 0x68]
push eax
lea eax, [edi + 0x78]
push eax
lea eax, [edi + 0x70]
push eax
call fcn.7ded81a9
mov eax, dword [edi + 0x6c]
mov dword [ebp - 0x30], eax
mov eax, dword [edi + 0x80]
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], bl
jne 0x7ded83bf
push ebx
push 0x2c
lea eax, [ebp - 0x8c]
push eax
push ebx
call 0x7de19da0
cmp eax, ebx
mov dword [ebp + 8], eax
jl 0x7ded8801
push ebx
push 0x1c
lea eax, [ebp - 0xa8]
push eax
push ebx
push 0xfffffffffffffffe
call 0x7de19bf8
cmp eax, ebx
mov dword [ebp + 8], eax
jl 0x7ded8801
push ebx
push 0x20
lea eax, [ebp - 0x60]
push eax
push 1
push 0xfffffffffffffffe
call 0x7de19bf8
cmp eax, ebx
mov dword [ebp + 8], eax
jl 0x7ded8801
push ebx
push 0x30
lea eax, [ebp - 0xd8]
push eax
push 3
call 0x7de19da0
cmp eax, ebx
mov dword [ebp + 8], eax
jl 0x7ded8801
lea eax, [ebp - 0x10]
push eax
push ebx
call 0x7de71091
cmp eax, ebx
mov dword [ebp + 8], eax
jl 0x7ded8801
movzx eax, word [edi + 0x68]
movzx ecx, word [edi + 0x60]
lea eax, [eax + ecx + 0x17c]
jmp 0x7ded83cf
lea eax, [esi + 0x20]
mov dword [ebp - 0x1c], eax
movzx eax, word [esi + 4]
mov dword [ebp - 0x14], eax
add eax, 0x48
push dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 8
push dword [eax + 0x18]
call 0x7de28026
mov esi, eax
cmp esi, ebx
jne 0x7ded83fa
mov dword [ebp + 8], 0xc0000017
jmp 0x7ded87ea
lea eax, [ebp - 8]
push eax
push 0x20000080
lea eax, [ebp + 0x10]
push eax
push 1
push 0xc0000000
push dword [ebp - 0x30]
lea ebx, [esi + 0x48]
call fcn.7ded7da9
xor edx, edx
cmp eax, edx
mov dword [ebp + 8], eax
jl 0x7ded87da
cmp byte [ebp + 0x10], 1
jne 0x7ded851f
push edx
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x38]
push esi
push eax
push edx
push edx
push edx
push dword [ebp - 8]
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], edx
call 0x7de198e0
mov dword [ebp + 8], eax
test eax, eax
jl 0x7ded87da
mov eax, dword [esi + 0x88]
shr eax, 1
test al, 1
je 0x7ded8471
mov dword [ebp + 8], 0xc000000d
jmp 0x7ded87da
mov al, byte [esi + 0x6c]
cmp al, byte [0x7ffe026c]
jne 0x7ded8465
mov al, byte [esi + 0x6d]
cmp al, byte [0x7ffe0270]
jne 0x7ded8465
cmp dword [esi + 0x94], 4
jne 0x7ded8465
mov eax, dword [esi + 0x68]
mov ebx, dword [esi + 0x8c]
mov dword [ebp - 0xc], eax
add eax, 0xfffffc00
cmp eax, 0xffc00
ja 0x7ded8465
xor eax, eax
cmp ebx, eax
je 0x7ded8465
mov ecx, dword [esi + 0x78]
or ecx, dword [esi + 0x7c]
je 0x7ded8465
mov ecx, dword [esi + 0x74]
cmp ecx, dword [edi + 0x7c]
jne 0x7ded8465
push eax
lea ecx, [ebp - 0x40]
push ecx
mov dword [esi + 0x78], eax
mov dword [esi + 0x7c], eax
push dword [edi + 0x80]
lea ecx, [ebp - 0x38]
push esi
push ecx
push eax
push eax
push eax
push dword [ebp - 8]
call 0x7de19918
and dword [edi + 0xec], 0
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [edi + 0x100], ebx
mov dword [edi + 0xd8], ebx
imul ebx, eax
and dword [edi + 0xf4], 0
mov dword [edi + 0x80], eax
mov dword [edi + 0xe8], eax
mov eax, dword [ebp - 8]
mov dword [edi + 0xf0], ebx
mov dword [edi + 0x5c], eax
jmp 0x7ded87e8
mov eax, dword [ebp - 0xc]
mov dword [esi], eax
push 4
xor ecx, ecx
pop eax
inc ecx
mov word [esi + 0x36], ax
mov eax, ecx
mov word [esi + 0x34], ax
mov eax, dword [ebp - 0x18]
mov byte [esi + 0x29], 8
mov dword [esi + 0x30], eax
cmp byte [ebp - 1], dl
jne 0x7ded86e3
add eax, 0xffffffb8
mov dword [ebx + 4], eax
mov dword [ebx], 0xc0010000
mov eax, dword [edi + 0x10]
cmp eax, 2
jne 0x7ded8562
call fcn.7ded57a2
jmp 0x7ded8569
cmp eax, 3
jne 0x7ded8571
rdtsc
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], edx
jmp 0x7ded858c
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
call 0x7de32884
mov eax, dword [ebp - 0x2c]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x28]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 0xa0]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 0x9c]
push 0
mov dword [ebx + 8], eax
push dword [ebp - 0x88]
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
call 0x7de72d00
push 0
mov dword [ebx + 0x18], eax
push dword [ebp - 0x88]
push dword [ebp - 0x44]
push dword [ebp - 0x48]
call 0x7de72d00
mov dword [ebx + 0x1c], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov cl, byte [eax + 0xa4]
mov byte [esi + 0x6c], cl
mov cl, byte [eax + 0xa8]
mov byte [esi + 0x6d], cl
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x6e], 1
mov byte [esi + 0x6f], 5
movzx eax, word [eax + 0xac]
mov dword [esi + 0x70], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x170], eax
mov eax, dword [edi + 0x7c]
mov dword [esi + 0x74], eax
xor eax, eax
inc eax
mov dword [esi + 0x90], eax
mov dword [esi + 0x8c], eax
mov dword [esi + 0x94], 4
mov dword [esi + 0x68], ecx
mov eax, dword [edi + 0xc8]
mov dword [esi + 0x84], eax
mov eax, dword [edi + 0xcc]
mov dword [esi + 0x88], eax
mov eax, dword [ebp - 0x88]
mov dword [esi + 0x80], eax
mov eax, dword [ebp - 0xd8]
mov dword [esi + 0x158], eax
mov eax, dword [ebp - 0xd4]
and dword [esi + 0xa0], 0
and dword [esi + 0xa4], 0
mov dword [esi + 0x15c], eax
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x9c], eax
movzx eax, word [edi + 0x60]
inc eax
inc eax
push eax
push dword [edi + 0x64]
lea eax, [esi + 0x178]
push eax
call 0x7de1c340
movzx eax, word [edi + 0x68]
inc eax
inc eax
push eax
movzx eax, word [edi + 0x60]
push dword [edi + 0x6c]
lea eax, [eax + esi + 0x17a]
push eax
call 0x7de1c340
add esp, 0x18
lea eax, [esi + 0xa8]
push eax
call fcn.7ded7ed9
lea eax, [esi + 0x160]
push eax
call 0x7de3282c
mov eax, dword [edi]
mov dword [esi + 0x168], eax
mov eax, dword [edi + 4]
mov dword [esi + 0x16c], eax
mov eax, dword [edi + 8]
mov dword [ebx + 0x10], eax
mov eax, dword [edi + 0xc]
mov dword [ebx + 0x14], eax
jmp 0x7ded871e
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x2c], 8
mov dword [eax + 0x20], 0x10000
mov dword [eax + 0x24], ecx
mov ecx, dword [edi + 0x80]
mov dword [eax], ecx
jne 0x7ded8706
mov eax, dword [eax + 0x110]
jmp 0x7ded870c
mov eax, dword [eax + 0x108]
push dword [ebp - 0x14]
mov dword [edi + 0x10], eax
push dword [ebp + 0xc]
push ebx
call 0x7de1c340
add esp, 0xc
mov eax, dword [esi + 0x30]
mov ebx, dword [ebp - 0xc]
cmp eax, ebx
jae 0x7ded8742
cmp eax, 0x48
jbe 0x7ded8742
mov ecx, ebx
sub ecx, eax
push ecx
add eax, esi
push 0xff
push eax
call 0x7de27f20
add esp, 0xc
xor eax, eax
push eax
push eax
push ebx
push esi
lea ecx, [ebp - 0x38]
push ecx
push eax
push eax
push eax
push dword [ebp - 8]
call 0x7de19918
mov dword [ebp + 8], eax
test eax, eax
jl 0x7ded87da
mov eax, dword [edi + 0xc8]
test eax, eax
je 0x7ded87a8
mov ecx, dword [edi + 0xcc]
test cl, 0x20
je 0x7ded87a8
test ecx, 0x2000
mov ecx, 0x400
jne 0x7ded8785
mov ecx, 0x100000
mul ecx
push 0x14
mov dword [ebp - 0x24], eax
push 8
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 8]
mov dword [ebp - 0x20], edx
call 0x7de19c28
mov dword [ebp + 8], eax
test eax, eax
jl 0x7ded87da
mov ecx, dword [ebp - 8]
xor eax, eax
inc eax
mov dword [edi + 0x100], eax
mov dword [edi + 0xd8], eax
xor eax, eax
mov dword [edi + 0xf0], ebx
mov dword [edi + 0xf4], eax
mov dword [edi + 0xe8], ebx
mov dword [edi + 0xec], eax
mov dword [edi + 0x5c], ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x7ded87e8
push dword [ebp - 8]
call 0x7de199d0
xor ebx, ebx
cmp esi, ebx
je 0x7ded8801
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push ebx
push dword [eax + 0x18]
call 0x7de27f85
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 0xc