Function at 0x7dd8b489
Capabilities:
Get number of processors

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x7de403ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
push ebx
push edi
xor edi, edi
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x78], ecx
lea ebx, [ebp - 0x68]
cmp ecx, edi
je 0x7dd8b613
cmp eax, edi
je 0x7dd8b613
cmp dword [ebp + 0xc], edi
jne 0x7dd8b613
push esi
mov esi, dword [sym.imp.ntdll.dll_NtQueryInformationToken]
lea ecx, [ebp - 0x74]
push ecx
push 0x64
lea ecx, [ebp - 0x68]
push ecx
push 1
push eax
call esi
cmp eax, edi
jl 0x7ddadb71
push 1
push dword [ebx]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.ntdll.dll_RtlConvertSidToUnicodeString]
mov esi, eax
cmp esi, edi
jl 0x7dd8b5e6
mov eax, dword [ebp - 0x80]
add eax, 0x32
mov word [ebp - 0x6e], ax
mov eax, dword fs:[0x18]
movzx ecx, word [ebp - 0x6e]
mov eax, dword [eax + 0x30]
push ecx
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x6c], eax
cmp eax, edi
je 0x7dd8b618
push 0x7dd8b620
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
mov esi, eax
cmp esi, edi
jl 0x7dd8b5c6
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.ntdll.dll_RtlCopyUnicodeString]
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.ntdll.dll_RtlAppendUnicodeStringToString]
mov esi, eax
cmp esi, edi
jl 0x7dd8b5c6
push 0x7dd8b8cc
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.ntdll.dll_RtlAppendUnicodeToString]
mov esi, eax
cmp esi, edi
jl 0x7dd8b5c6
lea eax, [ebp - 0x70]
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0x9c]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 0x9c], 0x18
push dword [ebp - 0x78]
mov dword [ebp - 0x98], edi
mov dword [ebp - 0x90], 0x40
mov dword [ebp - 0x8c], edi
mov dword [ebp - 0x88], edi
call dword [sym.imp.ntdll.dll_NtOpenKey]
mov esi, eax
push dword [ebp - 0x6c]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
lea eax, [ebp - 0x68]
cmp ebx, eax
jne 0x7ddadbda
cmp esi, edi
jl 0x7dd8b5fb
mov eax, dword [ebp - 0x78]
or dword [eax], 2
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.7dd71442
leave
ret 0x10
push 0x57
pop eax
jmp 0x7dd8b603
mov esi, 0xc0000017
jmp 0x7dd8b5dc
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
cmp eax, 0x7a
jne 0x7dd8b602
mov eax, dword fs:[0x18]
push dword [ebp - 0x74]
mov eax, dword [eax + 0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
cmp ebx, edi
jne 0x7ddadba5
push 8
pop eax
jmp 0x7dd8b602
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x74]
push ebx
push 1
push dword [ebp - 0x84]
call esi
mov esi, eax
cmp esi, edi
jge 0x7dd8b4eb
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x7dd8b5fb
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x7dd8b5f1