Function at 0x7dd971e7
Capabilities:
Get system information on windows

Disassembly:
push 0x18
push 0x7dd97298
call fcn.7dd715c0
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov eax, 0x10000
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
mov esi, dword [ebp + 0x10]
mov dword [esi], ebx
mov edi, dword [ebp + 0x14]
mov dword [edi], ebx
mov ecx, dword [ebp + 0x20]
mov dword [ecx], ebx
test byte [ebp + 8], 6
jne 0x7dd98aec
test byte [ebp + 8], 0x18
je 0x7dd9727a
cmp dword [ebp - 0x1c], ebx
jl 0x7dd9727a
push ebx
push ebx
call dword [sym.imp.ntdll.dll_RtlCreateQueryDebugBuffer]
mov dword [edi], eax
cmp eax, ebx
je 0x7dda5679
cmp dword [ebp - 0x1c], ebx
jl 0x7dd9727a
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov eax, dword [edi]
mov eax, dword [eax + 0x2c]
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], eax
push dword [edi]
mov eax, dword [ebp + 8]
and eax, 0x10
or eax, 0xe0000000
shl eax, 2
mov ecx, dword [ebp + 8]
shr ecx, 3
and ecx, 1
or eax, ecx
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ntdll.dll_RtlQueryProcessDebugInformation]
mov dword [ebp - 0x1c], eax
test byte [ebp + 8], 1
jne 0x7dda5685
cmp dword [ebp - 0x1c], ebx
jl 0x7dda56d3
mov eax, dword [ebp - 0x1c]
call fcn.7dd71605
ret 0x24
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], eax
push 4
push 0x1000
lea eax, [ebp - 0x24]
push eax
push ebx
push esi
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xfffffffe
cmp dword [ebp - 0x1c], ebx
jl 0x7dd9721c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x20]
push ecx
push eax
push dword [esi]
push 5
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [ebp - 0x1c], eax
cmp eax, 0xc0000004
je 0x7dda5650
jmp 0x7dd98b4e
cmp dword [ebp - 0x1c], 0xc0000004
jne 0x7dd9721c
jmp 0x7dd98aec
mov eax, dword [ebp - 0x20]
jmp 0x7dd98b3f
push 0x8000
lea eax, [ebp - 0x24]
push eax
push esi
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtFreeVirtualMemory]
mov dword [esi], ebx
mov eax, dword [ebp - 0x20]
add eax, 0x1fff
and eax, 0xffffe000
mov dword [ebp - 0x20], eax
jmp 0x7dd98b3f
mov dword [ebp - 0x1c], 0xc0000001
jmp 0x7dd97239
cmp dword [ebp - 0x1c], ebx
jl 0x7dda56d3
push ebx
push ebx
call dword [sym.imp.ntdll.dll_RtlCreateQueryDebugBuffer]
mov ecx, dword [ebp + 0x20]
mov dword [ecx], eax
cmp eax, ebx
jne 0x7dda56a2
mov dword [ebp - 0x1c], 0xc0000001
cmp dword [ebp - 0x1c], ebx
jl 0x7dda56d3
mov eax, dword [ebp + 0x20]
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
mov edx, dword [ebp + 0x24]
mov dword [edx], ecx
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x2c]
mov edx, dword [ebp + 0x28]
mov dword [edx], ecx
push dword [eax]
push 4
push dword [ebp + 0xc]
call dword [sym.imp.ntdll.dll_RtlQueryProcessDebugInformation]
mov dword [ebp - 0x1c], eax
jmp 0x7dd97284
cmp dword [esi], ebx
je 0x7dda56ee
mov dword [ebp + 8], ebx
push 0x8000
lea eax, [ebp + 8]
push eax
push esi
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtFreeVirtualMemory]
mov dword [esi], ebx
mov eax, dword [edi]
cmp eax, ebx
je 0x7dda56fd
push eax
call dword [sym.imp.ntdll.dll_RtlDestroyQueryDebugBuffer]
mov dword [edi], ebx
mov eax, dword [ebp + 0x20]
mov eax, dword [eax]
cmp eax, ebx
je 0x7dd9728d
push eax
call dword [sym.imp.ntdll.dll_RtlDestroyQueryDebugBuffer]
mov eax, dword [ebp + 0x20]
mov dword [eax], ebx
jmp 0x7dd9728d