Function at 0x7dd971c7
Capabilities:
Get system information on windows

Disassembly:
push 0x18
push 0x7dd97278
call fcn.7dd715c0
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov eax, 0x10000
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
mov esi, dword [ebp + 0x10]
mov dword [esi], ebx
mov edi, dword [ebp + 0x14]
mov dword [edi], ebx
mov ecx, dword [ebp + 0x20]
mov dword [ecx], ebx
test byte [ebp + 8], 6
jne 0x7dd98acc
test byte [ebp + 8], 0x18
je 0x7dd9725a
cmp dword [ebp - 0x1c], ebx
jl 0x7dd9725a
push ebx
push ebx
call dword [sym.imp.ntdll.dll_RtlCreateQueryDebugBuffer]
mov dword [edi], eax
cmp eax, ebx
je 0x7dda5651
cmp dword [ebp - 0x1c], ebx
jl 0x7dd9725a
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov eax, dword [edi]
mov eax, dword [eax + 0x2c]
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], eax
push dword [edi]
mov eax, dword [ebp + 8]
and eax, 0x10
or eax, 0xe0000000
shl eax, 2
mov ecx, dword [ebp + 8]
shr ecx, 3
and ecx, 1
or eax, ecx
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ntdll.dll_RtlQueryProcessDebugInformation]
mov dword [ebp - 0x1c], eax
test byte [ebp + 8], 1
jne 0x7dda565d
cmp dword [ebp - 0x1c], ebx
jl 0x7dda56ab
mov eax, dword [ebp - 0x1c]
call fcn.7dd71605
ret 0x24
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], eax
push 4
push 0x1000
lea eax, [ebp - 0x24]
push eax
push ebx
push esi
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xfffffffe
cmp dword [ebp - 0x1c], ebx
jl 0x7dd971fc
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x20]
push ecx
push eax
push dword [esi]
push 5
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [ebp - 0x1c], eax
cmp eax, 0xc0000004
je 0x7dda5628
jmp 0x7dd98b2e
cmp dword [ebp - 0x1c], 0xc0000004
jne 0x7dd971fc
jmp 0x7dd98acc
mov eax, dword [ebp - 0x20]
jmp 0x7dd98b1f
push 0x8000
lea eax, [ebp - 0x24]
push eax
push esi
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtFreeVirtualMemory]
mov dword [esi], ebx
mov eax, dword [ebp - 0x20]
add eax, 0x1fff
and eax, 0xffffe000
mov dword [ebp - 0x20], eax
jmp 0x7dd98b1f
mov dword [ebp - 0x1c], 0xc0000001
jmp 0x7dd97219
cmp dword [ebp - 0x1c], ebx
jl 0x7dda56ab
push ebx
push ebx
call dword [sym.imp.ntdll.dll_RtlCreateQueryDebugBuffer]
mov ecx, dword [ebp + 0x20]
mov dword [ecx], eax
cmp eax, ebx
jne 0x7dda567a
mov dword [ebp - 0x1c], 0xc0000001
cmp dword [ebp - 0x1c], ebx
jl 0x7dda56ab
mov eax, dword [ebp + 0x20]
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
mov edx, dword [ebp + 0x24]
mov dword [edx], ecx
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x2c]
mov edx, dword [ebp + 0x28]
mov dword [edx], ecx
push dword [eax]
push 4
push dword [ebp + 0xc]
call dword [sym.imp.ntdll.dll_RtlQueryProcessDebugInformation]
mov dword [ebp - 0x1c], eax
jmp 0x7dd97264
cmp dword [esi], ebx
je 0x7dda56c6
mov dword [ebp + 8], ebx
push 0x8000
lea eax, [ebp + 8]
push eax
push esi
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtFreeVirtualMemory]
mov dword [esi], ebx
mov eax, dword [edi]
cmp eax, ebx
je 0x7dda56d5
push eax
call dword [sym.imp.ntdll.dll_RtlDestroyQueryDebugBuffer]
mov dword [edi], ebx
mov eax, dword [ebp + 0x20]
mov eax, dword [eax]
cmp eax, ebx
je 0x7dd9726d
push eax
call dword [sym.imp.ntdll.dll_RtlDestroyQueryDebugBuffer]
mov eax, dword [ebp + 0x20]
mov dword [eax], ebx
jmp 0x7dd9726d