Function at 0x7dd78b75
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
xor esi, esi
push esi
push 0x10
lea eax, [ebp - 0x18]
push eax
push 0x7b
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, dword [ebp + 8]
mov dword [ebx], 0x20
mov ecx, dword [0x7ffe02e8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0xf70]
mov eax, dword [eax + 0x14d0]
mov eax, dword [eax]
xor edx, edx
div dword [0x7de40388]
push esi
push ecx
push esi
push eax
call sub.ntdll.dll__allmul
mov edi, edx
mov dword [ebp - 8], eax
cmp esi, edi
jb 0x7dd78bdd
ja 0x7dd78d2c
cmp dword [ebp - 0x18], eax
ja 0x7dd78d2c
push 0x64
pop ecx
cmp dword [ebp - 0x18], ecx
jb 0x7dda33f2
xor ecx, ecx
sub eax, dword [ebp - 0x18]
push esi
push 0x64
sbb edx, ecx
push edx
push eax
call sub.ntdll.dll__allmul
push edi
push dword [ebp - 8]
push edx
push eax
call sub.ntdll.dll__aulldiv
mov dword [ebx + 4], eax
mov eax, dword [ebp - 8]
push edi
push eax
push esi
push dword [0x7de40388]
call sub.ntdll.dll__allmul
cmp edx, esi
ja 0x7dd78d34
jb 0x7dd78c2c
cmp eax, 0xffffffff
jae 0x7dd78d34
mov dword [ebp - 4], edx
lea edi, [ebx + 8]
mov dword [edi], eax
mov eax, dword [0x7de40388]
mul dword [ebp - 0x18]
cmp edx, esi
ja 0x7dd78d3f
jb 0x7dd78c4f
cmp eax, 0xffffffff
jae 0x7dd78d3f
mov ecx, eax
mov dword [ebp - 4], edx
lea eax, [ebx + 0xc]
mov dword [eax], ecx
mov ecx, dword [0x7de403d8]
cmp ecx, esi
jne 0x7dda33fa
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x38]
push 0x2c
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x64]
push esi
push eax
call sub.ntdll.dll_memset
add esp, 0xc
push esi
mov esi, dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
push 0x20
lea eax, [ebp - 0x38]
push eax
push 1
push 0xffffffffffffffff
call esi
push 0
push 0x2c
lea eax, [ebp - 0x64]
push eax
push 3
push 0xffffffffffffffff
call esi
mov edi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
mov eax, edi
cmp edi, ecx
jae 0x7dda3409
mul dword [0x7de40388]
test edx, edx
ja 0x7dd78d4a
jb 0x7dd78cca
cmp eax, 0xffffffff
jae 0x7dd78d4a
mov dword [ebp - 4], edx
mov dword [ebx + 0x10], eax
cmp edi, dword [ebp - 0x14]
jb 0x7dda3410
mov eax, dword [ebp - 0x40]
mov esi, dword [0x7de40388]
xor edx, edx
div esi
cmp ecx, eax
jb 0x7dda3418
sub ecx, eax
mov eax, edi
sub eax, dword [ebp - 0x14]
cmp eax, ecx
jae 0x7dda341f
mul esi
test edx, edx
ja 0x7dd78d56
jb 0x7dd78d0a
cmp eax, 0xffffffff
jae 0x7dd78d56
mov dword [ebp - 4], edx
mov dword [ebx + 0x14], eax
mov eax, dword [0x7de403a0]
sub eax, dword [0x7de4039c]
pop edi
inc eax
mov dword [ebx + 0x18], eax
sub eax, dword [ebp - 0x60]
pop esi
mov dword [ebx + 0x1c], eax
pop ebx
leave
ret 4
mov dword [ebp - 0x18], eax
jmp 0x7dd78bdd
or eax, 0xffffffff
mov dword [ebp - 4], esi
jmp 0x7dd78c2f
or ecx, 0xffffffff
mov dword [ebp - 4], esi
jmp 0x7dd78c54
or eax, 0xffffffff
and dword [ebp - 4], 0
jmp 0x7dd78ccd
or eax, 0xffffffff
and dword [ebp - 4], 0
jmp 0x7dd78d0d
mov dword [ebx + 4], ecx
jmp 0x7dd78c0b
push dword [0x7de40388]
push eax
push edi
call ecx
jmp 0x7dd78c67
mov eax, ecx
jmp 0x7dd78cb1
mov edi, dword [ebp - 0x14]
jmp 0x7dd78cd9
mov ecx, eax
jmp 0x7dd78cee
mov eax, ecx
jmp 0x7dd78cfd