Function at 0x7dd81faf
Capabilities:
Check os version
Get number of processors

Disassembly:
mov ecx, dword [ebp - 0x3c]
mov dword [eax], ecx
jmp 0x7dd8210c
mov ecx, dword [ebp - 0x64]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x60]
mov dword [eax + 4], ecx
jmp 0x7dd82138
push 0x64
push 0x7dd82160
call fcn.7dd715c0
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x64], ebx
xor eax, eax
lea edi, [ebp - 0x60]
stosd dword es:[edi], eax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x40], ebx
mov word [ebp - 0x5c], ax
lea edi, [ebp - 0x5a]
stosd dword es:[edi], eax
stosw word es:[edi], ax
call sym.KERNEL32.dll_RegKrnGetGlobalState
mov eax, dword [eax + 0x4c]
mov dword [ebp - 0x44], eax
cmp dword [ebp + 0x14], ebx
jne 0x7dd89dc8
mov edi, dword [ebp + 0x10]
cmp dword [ebp + 0xc], ebx
jne 0x7dd89db6
mov esi, dword [ebp + 8]
call sym.KERNEL32.dll_RegKrnGetGlobalState
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp + 8]
push ecx
push esi
call dword [eax + 0xb0]
mov dword [ebp - 0x1c], eax
cmp eax, ebx
jne 0x7dd82138
cmp dword [ebp + 0xc], ebx
jne 0x7dd82044
cmp edi, ebx
jne 0x7ddadbf3
cmp dword [ebp + 0x20], ebx
jne 0x7dd89ccd
cmp dword [ebp + 0x30], ebx
jne 0x7dd89cd8
cmp dword [ebp + 0xc], ebx
jne 0x7dd89ce3
lea ebx, [ebp - 0x74]
mov dword [ebp - 0x48], ebx
xor eax, eax
mov word [ebp - 0x74], ax
mov word [ebp - 0x72], ax
and dword [ebp - 0x70], eax
mov eax, dword [ebp + 8]
test al, 1
jne 0x7ddadc06
lea ecx, [ebp - 0x64]
push ecx
push dword [ebp - 0x40]
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x3c]
push ecx
push dword [ebp - 0x30]
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x38]
push ecx
push ebx
push eax
call fcn.7dd77fad
mov dword [ebp - 0x1c], eax
shr dword [ebp - 0x28], 1
xor edi, edi
cmp dword [ebp - 0x30], edi
jne 0x7dd89dc0
shr dword [ebp - 0x20], 1
movzx eax, word [ebx]
cmp ax, 2
jae 0x7dd89d25
cmp dword [ebp - 0x1c], edi
jne 0x7dd820d3
mov edx, dword [ebp + 0xc]
cmp edx, edi
jne 0x7dd89d30
mov esi, dword [ebp + 0x10]
cmp esi, edi
jne 0x7ddadd23
mov eax, dword [ebp + 0x18]
cmp eax, edi
je 0x7dd820ea
mov ecx, dword [ebp - 0x38]
mov dword [eax], ecx
mov eax, dword [ebp + 0x1c]
cmp eax, edi
je 0x7dd820f6
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
mov eax, dword [ebp + 0x20]
cmp eax, edi
jne 0x7dd89d72
mov eax, dword [ebp + 0x24]
cmp eax, edi
jne 0x7dd8196d
mov eax, dword [ebp + 0x28]
cmp eax, edi
jne 0x7dd89d7c
mov eax, dword [ebp + 0x2c]
cmp eax, edi
jne 0x7dd89d86
mov eax, dword [ebp + 0x30]
cmp eax, edi
jne 0x7dd89d90
mov eax, dword [ebp + 0x34]
cmp eax, edi
jne 0x7dd81977
cmp dword [ebp - 0x58], 0
jne 0x7dd89d9a
mov esi, dword [ebp - 0x4c]
mov edi, dword [ebp - 0x50]
call sym.KERNEL32.dll_RegKrnGetGlobalState
push esi
push edi
call dword [eax + 0xa8]
mov eax, dword [ebp - 0x1c]
call fcn.7dd71605
ret 0x30
lea eax, [ebp - 0x24]
mov dword [ebp - 0x30], eax
jmp 0x7dd8204d
lea eax, [ebp - 0x34]
mov dword [ebp - 0x40], eax
jmp 0x7dd82056
cmp dword [edi], ebx
je 0x7dd8205f
lea ebx, [ebp - 0x5c]
mov dword [ebp - 0x48], ebx
mov eax, dword fs:[0x18]
mov esi, 0x208
push esi
push 0
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x58], eax
test eax, eax
je 0x7ddadbfa
xor eax, eax
mov word [ebp - 0x5c], ax
mov word [ebp - 0x5a], si
jmp 0x7dd82072
add eax, 0xfffffffe
mov word [ebx], ax
jmp 0x7dd820c3
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
cmp eax, edi
je 0x7dd820d6
mov ecx, 0xffff
cmp eax, ecx
mov word [ebp - 0x6a], cx
ja 0x7dd89d4e
mov word [ebp - 0x6a], ax
mov dword [ebp - 0x68], edx
push edi
push ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.ntdll.dll_RtlUnicodeStringToAnsiString]
movzx ecx, word [ebp - 0x6c]
mov dword [esi], ecx
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [ebp - 0x1c], eax
jmp 0x7dd820de
mov ecx, dword [ebp - 0x24]
mov dword [eax], ecx
jmp 0x7dd82101
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
jmp 0x7dd82117
mov ecx, dword [ebp - 0x2c]
mov dword [eax], ecx
jmp 0x7dd82122
mov ecx, dword [ebp - 0x34]
mov dword [eax], ecx
jmp 0x7dd8212d
push dword [ebp - 0x58]
push 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x7dd82142
cmp edi, ebx
jne 0x7dd82011
jmp 0x7dd89dc8
shr dword [ebp - 0x24], 1
jmp 0x7dd820b3
push 0x57
pop eax
jmp 0x7dd82158
mov dword [edi], ebx
jmp 0x7dd82044
mov dword [ebp - 0x1c], 0xe
jmp 0x7dd82138
cmp dword [ebp - 0x44], 0
je 0x7dd820a5
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x30], ecx
and dword [ebp - 4], 0
lea ecx, [ebp - 0x64]
push ecx
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x38]
push ecx
push ebx
push 0xfffffffffffffffe
pop edi
and eax, edi
push eax
call dword [ebp - 0x44]
mov edx, eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], edi
jmp 0x7ddadc70
mov ecx, 0xea
test edx, edx
je 0x7ddadc7d
cmp edx, ecx
jne 0x7ddadc93
mov eax, 0x7fff0000
cmp dword [ebp - 0x28], eax
jbe 0x7ddadc98
mov dword [ebp - 0x1c], 0xd
jmp 0x7dd82138
mov eax, 0x7fff0000
test edx, edx
je 0x7ddadca0
cmp edx, ecx
jne 0x7ddadca5
cmp dword [ebp - 0x24], eax
ja 0x7ddadc87
test edx, edx
je 0x7ddadcad
cmp edx, ecx
jne 0x7ddadcb2
cmp dword [ebp - 0x20], eax
ja 0x7ddadc87
test edx, edx
je 0x7ddadcba
cmp edx, ecx
jne 0x7ddadcbf
cmp dword [ebp - 0x2c], eax
ja 0x7ddadc87
test edx, edx
je 0x7ddadcc7
cmp edx, ecx
jne 0x7ddadccc
cmp dword [ebp - 0x34], eax
ja 0x7ddadc87
test edx, edx
jne 0x7dd820a5
and dword [ebp + 0x14], edx
mov esi, dword [ebp + 8]
and esi, edi
call sym.KERNEL32.dll_RegKrnGetGlobalState
mov eax, dword [eax + 0x8c]
test eax, eax
je 0x7dd820a5
lea ecx, [ebp + 0x14]
push ecx
push esi
call eax
test eax, eax
jne 0x7dd820a5
cmp dword [ebp + 0x14], 5
jb 0x7ddadd0e
cmp dword [ebp + 0x14], 0xa
jbe 0x7dd820a5
mov eax, dword [ebp - 0x20]
add eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x2c]
add eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x7dd820a5
movzx eax, word [ebx]
cmp ax, di
jne 0x7ddadd32
mov dword [esi], edi
jmp 0x7dd820de
movzx eax, ax
shr eax, 1
mov dword [esi], eax
jmp 0x7dd820de