Function at 0x7dd78b85
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
xor esi, esi
push esi
push 0x10
lea eax, [ebp - 0x18]
push eax
push 0x7b
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, dword [ebp + 8]
mov dword [ebx], 0x20
mov ecx, dword [0x7ffe02e8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0xf70]
mov eax, dword [eax + 0x14d0]
mov eax, dword [eax]
xor edx, edx
div dword [0x7de40388]
push esi
push ecx
push esi
push eax
call sub.ntdll.dll__allmul
mov edi, edx
mov dword [ebp - 8], eax
cmp esi, edi
jb 0x7dd78bed
ja 0x7dd78d3c
cmp dword [ebp - 0x18], eax
ja 0x7dd78d3c
push 0x64
pop ecx
cmp dword [ebp - 0x18], ecx
jb 0x7dda33c2
xor ecx, ecx
sub eax, dword [ebp - 0x18]
push esi
push 0x64
sbb edx, ecx
push edx
push eax
call sub.ntdll.dll__allmul
push edi
push dword [ebp - 8]
push edx
push eax
call sub.ntdll.dll__aulldiv
mov dword [ebx + 4], eax
mov eax, dword [ebp - 8]
push edi
push eax
push esi
push dword [0x7de40388]
call sub.ntdll.dll__allmul
cmp edx, esi
ja 0x7dd78d44
jb 0x7dd78c3c
cmp eax, 0xffffffff
jae 0x7dd78d44
mov dword [ebp - 4], edx
lea edi, [ebx + 8]
mov dword [edi], eax
mov eax, dword [0x7de40388]
mul dword [ebp - 0x18]
cmp edx, esi
ja 0x7dd78d4f
jb 0x7dd78c5f
cmp eax, 0xffffffff
jae 0x7dd78d4f
mov ecx, eax
mov dword [ebp - 4], edx
lea eax, [ebx + 0xc]
mov dword [eax], ecx
mov ecx, dword [0x7de403d8]
cmp ecx, esi
jne 0x7dda33ca
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x38]
push 0x2c
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x64]
push esi
push eax
call sub.ntdll.dll_memset
add esp, 0xc
push esi
mov esi, dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
push 0x20
lea eax, [ebp - 0x38]
push eax
push 1
push 0xffffffffffffffff
call esi
push 0
push 0x2c
lea eax, [ebp - 0x64]
push eax
push 3
push 0xffffffffffffffff
call esi
mov edi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
mov eax, edi
cmp edi, ecx
jae 0x7dda33d9
mul dword [0x7de40388]
test edx, edx
ja 0x7dd78d5a
jb 0x7dd78cda
cmp eax, 0xffffffff
jae 0x7dd78d5a
mov dword [ebp - 4], edx
mov dword [ebx + 0x10], eax
cmp edi, dword [ebp - 0x14]
jb 0x7dda33e0
mov eax, dword [ebp - 0x40]
mov esi, dword [0x7de40388]
xor edx, edx
div esi
cmp ecx, eax
jb 0x7dda33e8
sub ecx, eax
mov eax, edi
sub eax, dword [ebp - 0x14]
cmp eax, ecx
jae 0x7dda33ef
mul esi
test edx, edx
ja 0x7dd78d66
jb 0x7dd78d1a
cmp eax, 0xffffffff
jae 0x7dd78d66
mov dword [ebp - 4], edx
mov dword [ebx + 0x14], eax
mov eax, dword [0x7de403a0]
sub eax, dword [0x7de4039c]
pop edi
inc eax
mov dword [ebx + 0x18], eax
sub eax, dword [ebp - 0x60]
pop esi
mov dword [ebx + 0x1c], eax
pop ebx
leave
ret 4
mov dword [ebp - 0x18], eax
jmp 0x7dd78bed
or eax, 0xffffffff
mov dword [ebp - 4], esi
jmp 0x7dd78c3f
or ecx, 0xffffffff
mov dword [ebp - 4], esi
jmp 0x7dd78c64
or eax, 0xffffffff
and dword [ebp - 4], 0
jmp 0x7dd78cdd
or eax, 0xffffffff
and dword [ebp - 4], 0
jmp 0x7dd78d1d
mov dword [ebx + 4], ecx
jmp 0x7dd78c1b
push dword [0x7de40388]
push eax
push edi
call ecx
jmp 0x7dd78c77
mov eax, ecx
jmp 0x7dd78cc1
mov edi, dword [ebp - 0x14]
jmp 0x7dd78ce9
mov ecx, eax
jmp 0x7dd78cfe
mov eax, ecx
jmp 0x7dd78d0d