Function at 0x7dd83bf3
Capabilities:
Access pe header
Check if file exists
Check os version
Create process on windows
Get file attributes
Print debug messages
Query environment variable
Resume thread
Terminate process

Disassembly:
cmp eax, 0x200
je 0x7ddafc79
cmp eax, 0x8664
jne 0x7ddafc5d
mov dword [ebp - 0x378], 9
jmp 0x7dd844ca
push 0x654
push 0x7dd849a0
call fcn.7dd725e8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x360], eax
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x334], edx
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x33c], esi
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x454], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x458], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x374], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x3dc], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x440], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x3a4], eax
xor ebx, ebx
mov dword [ebp - 0x324], ebx
mov dword [ebp - 0x358], ebx
mov dword [ebp - 0x40c], ebx
mov dword [ebp - 0x3d0], ebx
mov dword [ebp - 0x348], ebx
mov dword [ebp - 0x368], ebx
mov dword [ebp - 0x3d4], ebx
mov dword [ebp - 0x39c], ebx
mov dword [ebp - 0x3f4], ebx
mov dword [ebp - 0x38c], ebx
xor eax, eax
mov word [ebp - 0x380], ax
lea edi, [ebp - 0x37e]
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x554], ebx
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x550]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x430], ebx
cmp edx, ebx
je 0x7dd9c26a
cmp dword [ebp - 0x3a4], ebx
je 0x7dd9a09c
cmp dword [ebp - 0x440], ebx
je 0x7dd9a09c
mov dword [ebp - 0x370], ebx
mov dword [ebp - 0x344], ebx
mov dword [ebp - 0x384], ebx
mov dword [ebp - 0x330], ebx
mov dword [ebp - 0x354], ebx
mov dword [ebp - 0x398], ebx
mov dword [ebp - 0x36c], ebx
mov dword [ebp - 0x388], ebx
mov dword [ebp - 0x3fc], ebx
mov dword [ebp - 0x3c4], ebx
mov dword [ebp - 0x418], ebx
mov dword [ebp - 0x51c], ebx
mov dword [ebp - 0x3b4], ebx
mov dword [ebp - 0x438], ebx
mov dword [ebp - 0x3e8], ebx
mov byte [ebp - 0x33e], bl
mov byte [ebp - 0x33f], bl
mov byte [ebp - 0x32a], bl
mov byte [ebp - 0x33d], bl
mov dword [ebp - 0x400], ebx
mov dword [ebp - 0x3a0], ebx
mov dword [ebp - 0x3ac], ebx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x3bc], ebx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x3c8], ebx
mov dword [ebp - 0x408], ebx
mov dword [ebp - 0x3a8], ebx
mov dword [ebp - 0x3f8], ebx
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], ebx
mov dword [ebp - 0x3cc], ebx
mov dword [ebp - 0x394], ebx
mov dword [ebp - 0x34c], ebx
mov dword [ebp - 0x43c], ebx
mov dword [ebp - 0x470], ebx
mov dword [ebp - 0x46c], ebx
mov dword [ebp - 0x45c], ebx
mov dword [ebp - 0x4ec], ebx
mov dword [ebp - 0x4e0], ebx
mov edi, 0x100
push edi
push ebx
lea eax, [ebp - 0x320]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x3b0], eax
mov ecx, dword [ebp + 0x20]
mov eax, ecx
and eax, 0x18
cmp al, 0x18
je 0x7ddaf105
mov eax, 0x800
test eax, ecx
jne 0x7ddaf112
test ecx, 0x1000
jne 0x7dd83e28
mov edx, dword [0x7de40064]
cmp byte [edx + 0x744], bl
jne 0x7ddaf11f
test cl, 0x40
jne 0x7ddaf129
test ecx, 0x4000
jne 0x7ddaf135
test cl, 0x20
jne 0x7dd99a06
test ecx, 0x8000
jne 0x7ddaf141
test cl, cl
js 0x7ddaf14d
test edi, ecx
jne 0x7ddaf159
mov byte [ebp - 0x329], bl
and dword [ebp + 0x20], 0xffff3e1f
test dword [ebp + 0x20], 0x40000
jne 0x7dd9c6fa
xor esi, esi
inc esi
test dword [ebp + 0x20], 0x1000000
jne 0x7ddaf17e
test dword [ebp + 0x20], 0x10000
jne 0x7ddaf189
test byte [ebp + 0x20], 3
jne 0x7ddaf194
mov dword [ebp - 0x12c], 0x20005
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x11c], 0x10003
mov dword [ebp - 0x118], 8
mov dword [ebp - 0x110], ebx
lea eax, [ebp - 0x450]
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x10c], 6
mov dword [ebp - 0x108], 0x30
mov dword [ebp - 0x100], ebx
lea eax, [ebp - 0x584]
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x328], 3
mov ecx, dword [ebp - 0x398]
push 4
pop eax
cmp ecx, ebx
jne 0x7ddaf1c4
mov ecx, dword [ebp - 0x360]
cmp ecx, ebx
jne 0x7dd9d49f
cmp byte [ebp - 0x329], bl
jne 0x7dd99a12
test dword [ebp + 0x20], 0x4000000
jne 0x7dd9b02f
mov dword [ebp - 4], ebx
xor eax, eax
mov edi, dword [ebp - 0x3a4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
cmp dword [ebp - 0x374], ebx
je 0x7dd83f8e
mov esi, 0x400
test dword [ebp + 0x20], esi
jne 0x7dd83f8e
push 1
lea eax, [ebp - 0x3d4]
push eax
push dword [ebp - 0x374]
call dword [sym.imp.ntdll.dll_RtlCreateEnvironmentEx]
cmp eax, ebx
jl 0x7ddaf1eb
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0x374], eax
or dword [ebp + 0x20], esi
push 0x11
pop ecx
mov eax, dword [ebp - 0x440]
mov esi, eax
lea edi, [ebp - 0x634]
rep movsd dword es:[edi], dword [esi]
test dword [ebp + 0x20], 0x80000
jne 0x7dd89b70
test dword [ebp + 0x20], 0x800
jne 0x7dd83fee
mov eax, dword [ebp - 0x400]
cmp eax, ebx
jne 0x7dd83fc4
or eax, 0xffffffff
lea ecx, [ebp - 0x4c0]
push ecx
push ebx
push eax
call fcn.7dd84a12
test eax, eax
je 0x7dd83fee
cmp dword [ebp - 0x4c0], ebx
je 0x7dd83fee
mov eax, dword [ebp + 0x20]
and eax, 0xffffefff
or eax, 0x800
mov dword [ebp + 0x20], eax
test dword [ebp - 0x608], 0x100
je 0x7dd8400a
test dword [ebp - 0x608], 0x600
jne 0x7ddaf213
cmp dword [ebp - 0x3dc], ebx
je 0x7dd840c4
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x4c8], eax
mov eax, dword fs:[0x18]
mov dword [ebp - 0x5a4], eax
push 0x20a
push dword [ebp - 0x4c8]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
mov dword [ebp - 0x418], edi
cmp edi, ebx
je 0x7ddaf222
lea eax, [ebp - 0x51c]
push eax
push edi
push 0x103
push dword [ebp - 0x3dc]
call fcn.7dd741e1
mov esi, eax
mov dword [ebp - 0x518], esi
cmp esi, 0x104
jae 0x7dd9a076
cmp esi, ebx
je 0x7dd8a795
push edi
call fcn.7dd71add
mov dword [ebp - 0x4f4], eax
cmp eax, 0xffffffff
je 0x7dd9a076
test al, 0x10
je 0x7dd9a076
cmp word [edi + esi*2 - 2], 0x5c
je 0x7dd840c4
push 0x5c
pop eax
mov word [edi + esi*2], ax
inc esi
mov dword [ebp - 0x518], esi
xor eax, eax
mov word [edi + esi*2], ax
lea eax, [ebp - 0x4d8]
push eax
push ebx
push dword [ebp - 0x454]
lea eax, [ebp - 0x64c]
push eax
call sym.KERNEL32.dll_BaseFormatObjectAttributes
cmp eax, ebx
jl 0x7dd9a070
lea eax, [ebp - 0x4d0]
push eax
push ebx
push dword [ebp - 0x458]
lea eax, [ebp - 0x664]
push eax
call sym.KERNEL32.dll_BaseFormatObjectAttributes
cmp eax, ebx
jl 0x7dd9a070
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x4fc], eax
mov eax, dword [ebp - 0x4fc]
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x36c], ebx
jne 0x7ddaf237
cmp dword [ebp - 0x39c], ebx
jne 0x7ddaf261
lea eax, [ebp - 0x380]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
cmp dword [ebp - 0x3a0], ebx
jne 0x7ddaf28b
cmp dword [ebp - 0x344], ebx
jne 0x7ddaf2b5
mov dword [ebp - 0x3f0], ebx
mov dword [ebp - 0x420], ebx
cmp dword [ebp + 0x1c], ebx
je 0x7dd9c033
or dword [ebp - 0x34c], 4
push 0x48
pop esi
push esi
push ebx
lea eax, [ebp - 0x4b8]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x4b8], esi
or byte [ebp - 0x4b0], 2
cmp dword [ebp - 0x368], ebx
jne 0x7dd841ab
cmp dword [ebp + 0x1c], ebx
je 0x7dd9c03f
cmp dword [ebp - 0x3c4], ebx
jne 0x7ddaf2d2
test byte [ebp + 0x20], 3
jne 0x7ddaf33b
cmp byte [ebp - 0x33d], bl
jne 0x7ddaf356
or byte [ebp - 0x4b0], 1
mov eax, 0x2000
mov word [ebp - 0x4ae], ax
mov dword [ebp - 0x4ac], 0x81
cmp dword [ebp - 0x62c], ebx
jne 0x7dd84204
mov eax, dword [ebp - 0x3b0]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x7c]
mov dword [ebp - 0x62c], eax
mov byte [ebp - 0x335], bl
mov byte [ebp - 0x359], bl
mov dword [ebp - 0x41c], 1
mov ecx, dword [ebp - 0x334]
cmp ecx, ebx
je 0x7dd9c277
mov eax, dword [ebp - 0x33c]
cmp eax, ebx
je 0x7ddaf3fc
cmp word [eax], bx
je 0x7ddaf3fc
cmp byte [ebp - 0x335], bl
jne 0x7ddaf40e
cmp byte [ebp - 0x359], bl
jne 0x7ddaf40e
push ebx
push ebx
lea eax, [ebp - 0x380]
push eax
push dword [ebp - 0x334]
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
je 0x7ddaf4d6
push dword [ebp - 0x334]
lea eax, [ebp - 0x3e4]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
cmp eax, ebx
jl 0x7dd9a070
push dword [ebp - 0x334]
call dword [sym.imp.ntdll.dll_RtlDetermineDosPathNameType_U]
mov dword [ebp - 0x504], eax
cmp eax, 2
jne 0x7dd8a6bc
push dword [ebp - 0x334]
call fcn.7dd84a28
test eax, eax
jne 0x7dd8a6d7
push dword [ebp + 0x1c]
push dword [ebp + 0x20]
lea eax, [ebp - 0x634]
push eax
push dword [ebp - 0x374]
push dword [ebp - 0x33c]
push dword [ebp - 0x418]
push dword [ebp - 0x3e0]
push dword [ebp - 0x334]
call fcn.7dd84a82
mov esi, eax
mov dword [ebp - 0x5dc], esi
cmp esi, ebx
je 0x7dd8a795
mov ecx, dword [ebp - 0x37c]
lea eax, [ebp - 0x130]
mov dword [eax + 0xc], ecx
movzx ecx, word [ebp - 0x380]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x328]
shl ecx, 4
add ecx, 4
mov dword [eax], ecx
push eax
lea eax, [ebp - 0x4b8]
push eax
push esi
push 1
push dword [ebp - 0x34c]
push dword [ebp - 0x4d0]
push dword [ebp - 0x4d8]
mov eax, 0x2000000
push eax
push eax
lea eax, [ebp - 0x354]
push eax
lea eax, [ebp - 0x330]
push eax
call dword [sym.imp.ntdll.dll_NtCreateUserProcess]
mov edi, eax
mov dword [ebp - 0x364], edi
push esi
call dword [sym.imp.ntdll.dll_RtlDestroyProcessParameters]
cmp edi, ebx
jl 0x7dd8a75e
mov esi, dword [ebp - 0x4ac]
mov dword [ebp - 0x344], esi
mov eax, dword [ebp - 0x4a8]
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x574], 2
je 0x7dd843a1
cmp dword [ebp - 0x574], 3
jne 0x7ddafa03
movzx eax, word [ebp - 0x570]
push eax
movzx eax, word [ebp - 0x56e]
push eax
call fcn.7dd84da7
test eax, eax
je 0x7ddaf655
test byte [ebp - 0x4b0], 8
je 0x7dd843eb
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x470], eax
mov eax, dword [ebp - 0x47c]
mov dword [ebp - 0x46c], eax
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x45c], eax
push esi
call fcn.7dd84d6d
mov dword [ebp - 0x350], eax
cmp eax, 0xc0000022
je 0x7ddafc08
cmp eax, ebx
jl 0x7ddafc12
push dword [ebp - 0x334]
call fcn.7dd84d04
mov dword [ebp - 0x364], eax
cmp eax, ebx
jl 0x7dd9a070
cmp byte [ebp - 0x33e], bl
jne 0x7dd8443b
test dword [ebp + 0x20], 0x800
je 0x7dd8443b
and dword [ebp + 0x20], 0xfffff7ff
cmp dword [ebp - 0x368], ebx
jne 0x7ddafc1c
mov eax, dword [ebp - 0x488]
mov dword [ebp - 0x410], eax
cmp byte [ebp - 0x32a], bl
jne 0x7dd84489
test dword [ebp + 0x20], 0x2000000
jne 0x7dd84489
push dword [ebp - 0x344]
push dword [ebp - 0x334]
push dword [ebp - 0x360]
call sym.KERNEL32.dll_BasepCheckWinSaferRestrictions
mov dword [ebp - 0x4d4], eax
cmp eax, ebx
jl 0x7dd9a070
lea esi, [ebp - 0x1e8]
lea edi, [esi + 0x20]
push 0x88
push ebx
push edi
call sub.ntdll.dll_memset
add esp, 0xc
movzx eax, word [ebp - 0x564]
cmp eax, 0x14c
jne 0x7dd817e7
test byte [ebp - 0x4b0], 2
jne 0x7ddafc88
mov dword [ebp - 0x378], 0xa
test byte [ebp - 0x4b0], 1
jne 0x7dd8460a
cmp byte [ebp - 0x32a], bl
jne 0x7dd84568
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x3f0]
push eax
lea eax, [ebp - 0x3cc]
push eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x3f8]
push eax
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x3bc]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x3c8]
push eax
push dword [ebp - 0x374]
push dword [ebp - 0x37c]
push dword [ebp - 0x344]
push dword [ebp - 0x378]
movzx eax, byte [ebp - 0x4b0]
shr eax, 1
and eax, 1
push eax
lea eax, [ebp - 0x584]
push eax
push dword [ebp - 0x384]
call fcn.7dd82ee0
test eax, eax
je 0x7dd8a795
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0x460], eax
mov dword [esi + 0x24], eax
lea eax, [ebp - 0x320]
push eax
push edi
lea eax, [ebp - 0x460]
push eax
push dword [ebp - 0x45c]
push dword [ebp - 0x46c]
push dword [ebp - 0x470]
push dword [ebp - 0x410]
mov eax, dword [ebp - 0x566]
shr eax, 9
and eax, 1
push eax
push dword [ebp - 0x434]
push dword [ebp - 0x3bc]
push dword [ebp - 0x3f8]
movzx eax, byte [ebp - 0x4b0]
shr eax, 2
and eax, 1
push eax
push dword [ebp - 0x420]
push dword [ebp - 0x3f0]
push dword [ebp - 0x384]
push dword [ebp - 0x330]
push dword [ebp - 0x344]
lea eax, [ebp - 0x3e4]
push eax
lea eax, [ebp - 0x380]
push eax
call fcn.7dd837bf
mov dword [ebp - 0x364], eax
cmp eax, ebx
jl 0x7dd9a070
mov eax, dword [ebp - 0x488]
mov dword [esi + 0xb0], eax
mov eax, dword [ebp - 0x490]
mov dword [esi + 0xa8], eax
mov eax, dword [ebp - 0x48c]
mov dword [esi + 0xac], eax
mov eax, dword [ebp - 0x330]
mov dword [esi], eax
mov ecx, dword [ebp - 0x354]
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 0x450]
mov dword [esi + 8], ecx
mov ecx, dword [ebp - 0x44c]
mov dword [esi + 0xc], ecx
mov cx, word [ebp - 0x378]
mov word [esi + 0xb4], cx
mov ecx, dword [ebp + 0x20]
and ecx, 0xfffffffc
mov dword [esi + 0x10], ecx
push 2
pop edi
cmp dword [ebp - 0x574], edi
je 0x7dd849d4
cmp byte [ebp - 0x33e], bl
jne 0x7dd849d4
cmp dword [ebp - 0x360], ebx
jne 0x7dd9d4ee
test byte [ebp - 0x608], 0x40
jne 0x7ddafca3
test byte [ebp - 0x608], 0x80
jne 0x7ddafcab
mov eax, dword [ebp - 0x368]
mov dword [esi + 0x14], eax
cmp eax, ebx
jne 0x7ddafcb3
cmp dword [ebp - 0x3c4], ebx
jne 0x7ddafcd8
test byte [ebp - 0x4b0], 1
jne 0x7dd9c709
push esi
call fcn.7dd85125
mov dword [ebp - 0x1f0], eax
cmp eax, ebx
jl 0x7ddafce4
test byte [ebp - 0x4b0], 1
jne 0x7dd84705
mov eax, dword [esi + 0x24]
mov dword [ebp - 0x460], eax
cmp eax, dword [ebp - 0x494]
jne 0x7ddafcfb
cmp byte [ebp - 0x33f], bl
jne 0x7dd8476d
test byte [ebp - 0x43c], 2
jne 0x7dd8476d
or dword [ebp - 0x3a8], 1
push ebx
push ebx
push dword [ebp - 0x360]
push dword [ebp - 0x3cc]
lea eax, [esi + 0xa0]
push eax
lea eax, [esi + 0x88]
push eax
push dword [ebp - 0x424]
push dword [ebp - 0x428]
lea eax, [ebp - 0x3a8]
push eax
push dword [ebp - 0x3e0]
push dword [ebp - 0x330]
call fcn.7dd85135
mov edi, eax
mov dword [ebp - 0x364], edi
cmp edi, ebx
jl 0x7ddafd21
test byte [ebp - 0x4b0], 1
jne 0x7dd848ab
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x3ac]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x3c8]
push eax
push dword [ebp - 0x378]
movzx eax, byte [ebp - 0x4b0]
shr eax, 1
and eax, 1
push eax
lea eax, [ebp - 0x584]
push eax
push dword [ebp - 0x3cc]
lea eax, [esi + 0xa0]
push eax
lea eax, [esi + 0x88]
push eax
push dword [ebp - 0x424]
push dword [ebp - 0x428]
lea eax, [ebp - 0x3a8]
push eax
push dword [ebp - 0x3e0]
call fcn.7dd836cb
cmp dword [ebp - 0x3ac], ebx
jne 0x7dd9db0d
mov eax, dword [ebp - 0x334]
mov dword [ebp - 0x554], eax
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x54c], eax
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x3ac]
mov dword [ebp - 0x548], eax
mov ax, word [ebp - 0x56e]
mov word [ebp - 0x544], ax
mov ax, word [ebp - 0x570]
mov word [ebp - 0x542], ax
add esi, 0x94
mov dword [ebp - 0x53c], esi
mov eax, dword [ebp - 0x430]
shr eax, 6
and eax, 1
mov dword [ebp - 0x540], eax
lea eax, [ebp - 0x554]
push eax
call fcn.7dd832bd
cmp eax, 1
jne 0x7dd848ab
mov edx, dword [ebp - 0x538]
cmp edx, ebx
je 0x7dd848ab
mov eax, dword [ebp - 0x490]
add eax, 0x368
mov ecx, dword [ebp - 0x48c]
adc ecx, ebx
mov dword [ebp - 0x534], edx
mov dword [ebp - 0x530], ebx
push ebx
push ebx
push 8
lea edx, [ebp - 0x534]
push edx
push ecx
push eax
push dword [ebp - 0x330]
call dword [sym.imp.ntdll.dll_NtWow64WriteVirtualMemory64]
cmp byte [ebp - 0x33f], bl
jne 0x7dd848e1
test byte [ebp - 0x4b0], 1
jne 0x7dd848e1
push dword [ebp - 0x330]
push dword [ebp - 0x378]
push dword [ebp - 0x3a8]
call fcn.7dd83144
mov dword [ebp - 0x364], eax
cmp eax, ebx
jl 0x7ddafd48
test byte [ebp + 0x20], 4
jne 0x7dd84904
push ebx
push dword [ebp - 0x354]
call dword [sym.imp.ntdll.dll_NtResumeThread]
mov esi, eax
mov dword [ebp - 0x364], esi
cmp esi, ebx
jl 0x7ddafd53
mov eax, dword [ebp - 0x370]
xor esi, esi
inc esi
mov dword [ebp - 0x324], esi
cmp dword [ebp - 0x348], ebx
jne 0x7ddafd64
mov dword [ebp - 4], esi
mov dword [ebp - 4], 2
mov dword [ebp - 0x4f8], esi
mov esi, dword [ebp - 0x3a4]
cmp eax, ebx
jne 0x7ddafd70
mov eax, dword [ebp - 0x330]
mov dword [esi], eax
mov eax, dword [ebp - 0x354]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x450]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x44c]
mov dword [esi + 0xc], eax
mov dword [ebp - 0x330], ebx
mov dword [ebp - 0x354], ebx
mov dword [ebp - 4], 1
mov dword [ebp - 0x4f8], 0
call fcn.7dd85113
mov dword [ebp - 4], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.7dd84e75
mov eax, dword [ebp - 0x324]
call fcn.7dd72630
ret 0x30
or eax, edi
mov dword [esi], eax
push ebx
call fcn.7dd7123a
push eax
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov dword [ebp - 0x588], eax
cmp eax, ebx
je 0x7dd84683
cmp word [eax + 0x5c], di
jne 0x7dd84683
or dword [esi], 1
jmp 0x7dd84683
cmp dword [ebp - 0x634], 0x48
jne 0x7ddaf209
mov esi, dword [eax + 0x44]
mov dword [ebp - 0x5e8], esi
cmp esi, ebx
je 0x7dd83fae
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
push 0xf
lea ecx, [ebp - 0x328]
push ecx
lea ecx, [ebp - 0x130]
push ecx
lea ecx, [ebp - 0x400]
push ecx
lea ecx, [ebp - 0x43c]
push ecx
push ebx
push esi
call dword [eax + 0x28]
cmp eax, ebx
jge 0x7dd83fae
jmp 0x7dd9a070
cmp eax, 6
je 0x7dd842aa
cmp eax, 7
je 0x7dd842aa
cmp eax, 1
je 0x7dd842aa
xor eax, eax
mov word [ebp - 0x448], ax
mov word [ebp - 0x446], ax
mov dword [ebp - 0x444], ebx
push ebx
lea eax, [ebp - 0x504]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x448]
push eax
push ebx
lea eax, [ebp - 0x3e4]
push eax
call dword [sym.imp.ntdll.dll_RtlGetFullPathName_UstrEx]
cmp eax, ebx
jl 0x7dd9a070
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0x3e4], eax
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x3e0], eax
mov dword [ebp - 0x39c], eax
mov dword [ebp - 0x444], ebx
jmp 0x7dd842bd
mov dword [ebp - 0x330], ebx
mov dword [ebp - 0x354], ebx
mov eax, dword [ebp - 0x4b4]
cmp eax, ebx
je 0x7dd8a78f
dec eax
jne 0x7ddaf4dd
push dword [ebp - 0x334]
call dword [sym.imp.ntdll.dll_RtlIsDosDeviceName_U]
test eax, eax
jne 0x7ddaf9f9
push edi
call sym.KERNEL32.dll_BaseSetLastNTError
mov dword [ebp - 0x324], ebx
jmp 0x7dd84985
mov byte [ebp - 0x329], 2
jmp 0x7dd83e68
mov ecx, dword [ebp - 0x328]
shl ecx, 4
mov dword [ebp + ecx - 0x12c], 0x20008
mov ecx, dword [ebp - 0x328]
shl ecx, 4
mov dword [ebp + ecx - 0x128], esi
mov ecx, dword [ebp - 0x328]
shl ecx, 4
mov dword [ebp + ecx - 0x120], ebx
mov ecx, dword [ebp - 0x328]
shl ecx, 4
lea edx, [ebp - 0x329]
mov dword [ebp + ecx - 0x124], edx
inc dword [ebp - 0x328]
jmp 0x7dd83f34
xor esi, esi
inc esi
shl esi, cl
shl esi, 2
or esi, eax
xor esi, eax
and esi, 0x1c
xor eax, esi
mov dword [ebp - 0x468], eax
jmp 0x7dd9c214
push eax
jmp 0x7dd8a790
push 0x10b
jmp 0x7ddaf22c
mov dword [ebp - 0x358], esi
jmp 0x7dd9c2fa
cmp dword [ebp - 0x404], ebx
je 0x7ddaf3aa
jmp 0x7ddaf3b5
push 0xc000000d
jmp 0x7ddaff8b
mov dword [ebp - 0x50c], esi
mov ecx, dword [ebp - 0x328]
shl ecx, 4
mov dword [ebp + ecx - 0x12c], 0x20009
mov ecx, dword [ebp - 0x328]
shl ecx, 4
mov dword [ebp + ecx - 0x128], eax
mov eax, dword [ebp - 0x328]
shl eax, 4
mov dword [ebp + eax - 0x120], ebx
mov eax, dword [ebp - 0x328]
shl eax, 4
lea ecx, [ebp - 0x50c]
mov dword [ebp + eax - 0x124], ecx
inc dword [ebp - 0x328]
jmp 0x7dd83f41
and dword [ebp - 0x34c], 0xfffffffb
jmp 0x7dd84179
test dword [ebp - 0x608], 0x100
jne 0x7dd841ab
cmp dword [ebp - 0x400], ebx
jne 0x7dd841ab
test dword [ebp + 0x20], 0x8000018
jne 0x7dd841ab
mov eax, dword [ebp - 0x468]
and eax, 0xfffffffd
or eax, 1
mov dword [ebp - 0x468], eax
mov dword [ebp - 0x464], 3
and eax, 0xffffffe3
mov dword [ebp - 0x468], eax
mov ecx, dword [ebp - 0x3b0]
mov edx, dword [ecx + 0x10]
add edx, 0x18
mov dword [ebp - 0x5b8], edx
xor ecx, ecx
jmp 0x7dd9c1f7
mov dword [ebp - 0x4e8], ecx
cmp ecx, 3
jae 0x7dd9c217
mov esi, dword [edx + ecx*4]
and esi, 0x10000003
cmp esi, 3
je 0x7dd9a054
inc ecx
jmp 0x7dd9c1f7
mov ecx, dword [ebp - 0x328]
shl ecx, 4
lea eax, [ebp - 0x130]
mov dword [ecx + eax + 4], 0x2000a
mov ecx, dword [ebp - 0x328]
shl ecx, 4
mov dword [ecx + eax + 8], 8
mov ecx, dword [ebp - 0x328]
inc ecx
shl ecx, 4
mov dword [ecx + eax], ebx
mov ecx, dword [ebp - 0x328]
shl ecx, 4
lea edx, [ebp - 0x468]
mov dword [ecx + eax + 0xc], edx
inc dword [ebp - 0x328]
jmp 0x7dd841ab
cmp esi, ebx
jne 0x7dd83cc4
jmp 0x7ddaf0fb
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x4bc], eax
mov eax, dword fs:[0x18]
mov dword [ebp - 0x5bc], eax
push 0x208
push dword [ebp - 0x4bc]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x36c], eax
cmp eax, ebx
je 0x7ddaf222
mov dword [ebp - 0x404], ebx
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0x334], eax
mov dword [ebp - 0x358], eax
mov esi, eax
mov dword [ebp - 0x3c0], esi
cmp word [eax], 0x22
jne 0x7dd9c6b2
mov byte [ebp - 0x35a], bl
lea esi, [eax + 2]
mov dword [ebp - 0x3c0], esi
mov dword [ebp - 0x334], esi
jmp 0x7dd9d309
mov eax, dword [ebp - 0x358]
movzx edi, word [eax]
mov dword [ebp - 0x40c], edi
xor ecx, ecx
mov word [eax], cx
cmp dword [ebp - 0x38c], ebx
jne 0x7ddaf371
lea eax, [ebp - 0x3f4]
push eax
push dword [ebp - 0x334]
call sub.KERNELBASE.dll_BaseGetProcessExePath
mov dword [ebp - 0x38c], eax
cmp eax, ebx
je 0x7ddaf38d
push ebx
push dword [ebp - 0x36c]
push 0x104
push 0x7dd7d9ec
push dword [ebp - 0x334]
push dword [ebp - 0x38c]
call fcn.7dd75266
mov dword [ebp - 0x508], eax
cmp eax, ebx
je 0x7dd9a08b
cmp eax, 0x104
jae 0x7ddaf394
push dword [ebp - 0x36c]
call fcn.7dd71add
mov dword [ebp - 0x4f4], eax
cmp eax, 0xffffffff
je 0x7dd9a08b
test al, 0x10
jne 0x7ddaf39b
mov eax, dword [ebp - 0x358]
mov word [eax], di
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x334], eax
jmp 0x7dd8423f
mov byte [ebp - 0x35a], 1
mov dword [ebp - 0x334], eax
movzx eax, word [esi]
cmp ax, bx
je 0x7dd9c2fa
cmp ax, 0x20
je 0x7dd9a080
cmp ax, 9
je 0x7dd9a080
inc esi
inc esi
mov dword [ebp - 0x3c0], esi
mov dword [ebp - 0x358], esi
jmp 0x7dd9c6bf
mov dword [ebp - 0x33c], edi
jmp 0x7dd84257
mov dword [ebp - 0x34c], 0x40
jmp 0x7dd83e7c
or dword [esi + 4], edi
jmp 0x7dd846d3
movzx eax, word [esi]
cmp ax, bx
je 0x7dd9c2fa
cmp ax, 0x22
je 0x7dd9d32b
inc esi
inc esi
mov dword [ebp - 0x3c0], esi
mov dword [ebp - 0x358], esi
jmp 0x7dd9d309
mov dword [ebp - 0x358], esi
mov dword [ebp - 0x41c], ebx
jmp 0x7dd9c2fa
mov edx, dword [ebp - 0x328]
shl edx, 4
mov dword [ebp + edx - 0x12c], 0x60002
mov edx, dword [ebp - 0x328]
shl edx, 4
mov dword [ebp + edx - 0x128], eax
mov edx, dword [ebp - 0x328]
shl edx, 4
mov dword [ebp + edx - 0x120], ebx
mov edx, dword [ebp - 0x328]
shl edx, 4
mov dword [ebp + edx - 0x124], ecx
inc dword [ebp - 0x328]
jmp 0x7dd83f28
lea eax, [ebp - 0x508]
push eax
push 4
lea eax, [ebp - 0x4dc]
push eax
push 0xc
push dword [ebp - 0x360]
call dword [sym.imp.ntdll.dll_NtQueryInformationToken]
mov dword [ebp - 0x364], eax
cmp eax, ebx
jl 0x7dd9a070
mov eax, dword fs:[0x18]
mov dword [ebp - 0x5f0], eax
mov eax, dword [eax + 0x30]
mov ecx, dword [ebp - 0x4dc]
cmp ecx, dword [eax + 0x1d4]
je 0x7dd8468f
jmp 0x7ddafc9a
mov dword [ebp - 0x3d8], ebx
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x390], eax
push 4
push 0x1000
lea eax, [ebp - 0x390]
push eax
push ebx
lea eax, [ebp - 0x3d8]
push eax
push dword [ebp - 0x330]
call dword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
cmp eax, ebx
jl 0x7dd9a070
push ebx
push dword [ebp - 0x42c]
push dword [ebp - 0x3ac]
push dword [ebp - 0x3d8]
push dword [ebp - 0x330]
mov edi, dword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
call edi
cmp eax, ebx
jl 0x7dd9a070
push ebx
push 4
lea eax, [ebp - 0x3d8]
push eax
mov eax, dword [ebp - 0x410]
add eax, 0x1e8
push eax
push dword [ebp - 0x330]
call edi
mov dword [ebp - 0x364], eax
cmp eax, ebx
jl 0x7dd9a070
mov eax, dword [ebp - 0x490]
add eax, 0x2d8
mov ecx, dword [ebp - 0x48c]
adc ecx, ebx
mov edx, dword [ebp - 0x3d8]
mov dword [ebp - 0x52c], edx
mov dword [ebp - 0x528], ebx
push ebx
push ebx
push 8
lea edx, [ebp - 0x52c]
push edx
push ecx
push eax
push dword [ebp - 0x330]
call dword [sym.imp.ntdll.dll_NtWow64WriteVirtualMemory64]
mov dword [ebp - 0x364], eax
cmp eax, ebx
jge 0x7dd847ee
jmp 0x7dd9a070
push 0xc0000030
jmp 0x7ddaff8b
push 0x57
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
jmp 0x7ddaff90
test ecx, 0x1000
jne 0x7ddaf105
jmp 0x7dd83e28
or ecx, eax
mov dword [ebp + 0x20], ecx
jmp 0x7dd83e28
mov byte [ebp - 0x329], 1
jmp 0x7dd83e68
mov byte [ebp - 0x329], 5
jmp 0x7dd83e68
mov byte [ebp - 0x329], 6
jmp 0x7dd83e68
mov byte [ebp - 0x329], 3
jmp 0x7dd83e68
cmp dword [ebp - 0x360], ebx
setne al
movzx eax, al
push eax
push ebx
call fcn.7de15bc2
test eax, eax
setne al
add al, 3
mov byte [ebp - 0x329], al
jmp 0x7dd83e68
or dword [ebp - 0x34c], esi
jmp 0x7dd83e8c
or dword [ebp - 0x34c], edi
jmp 0x7dd83e99
call sub.ntdll.dll_DbgUiConnectToDbg
cmp eax, ebx
jge 0x7ddaf1a3
push eax
jmp 0x7ddaff8b
call sub.ntdll.dll_DbgUiGetThreadDebugObject
mov dword [ebp - 0x398], eax
test byte [ebp + 0x20], 2
je 0x7dd83ea3
or dword [ebp - 0x34c], 2
jmp 0x7dd83ea3
mov dword [ebp - 0xfc], 0x60001
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0xf4], ecx
mov dword [ebp - 0x328], eax
jmp 0x7dd83f1a
push eax
call sym.KERNEL32.dll_BaseSetLastNTError
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x7de403ac
call fcn.7dd9d690
add esp, 0xc
jmp 0x7ddaff90
push 0xc000000d
jmp 0x7dd8a790
and dword [ebp - 0x608], 0xfffffeff
jmp 0x7dd8400a
push 0xc0000017
jmp 0x7dd8a790
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
jmp 0x7dd8a795
mov eax, dword fs:[0x18]
mov dword [ebp - 0x5e4], eax
push dword [ebp - 0x36c]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebp - 0x36c], ebx
jmp 0x7dd8412c
mov eax, dword fs:[0x18]
mov dword [ebp - 0x5ac], eax
push dword [ebp - 0x39c]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebp - 0x39c], ebx
jmp 0x7dd84138
mov eax, dword fs:[0x18]
mov dword [ebp - 0x5d8], eax
push dword [ebp - 0x3a0]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebp - 0x3a0], ebx
jmp 0x7dd84151
push dword [ebp - 0x344]
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x344], ebx
jmp 0x7dd8415d
mov ecx, dword [ebp - 0x328]
shl ecx, 4
lea eax, [ebp - 0x130]
mov dword [ecx + eax + 4], 0x20007
mov ecx, dword [ebp - 0x328]
shl ecx, 4
mov dword [ecx + eax + 8], 8
mov ecx, dword [ebp - 0x328]
inc ecx
shl ecx, 4
mov dword [ecx + eax], ebx
mov ecx, dword [ebp - 0x328]
shl ecx, 4
lea edx, [ebp - 0x524]
mov dword [ecx + eax + 0xc], edx
inc dword [ebp - 0x328]
mov dword [ebp - 0x524], 1
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0x520], eax
jmp 0x7dd841b7
mov eax, dword [ebp - 0x3b0]
cmp byte [eax + 1], bl
jne 0x7dd841c1
mov al, byte [ebp - 0x4af]
and al, 0xfe
or al, 2
jmp 0x7ddaf366
mov byte [ebp - 0x33d], bl
mov al, byte [ebp - 0x4af]
and al, 0xfd
or al, 1
mov byte [ebp - 0x4af], al
jmp 0x7dd841cd
push dword [ebp - 0x3f4]
push dword [ebp - 0x38c]
call sub.KERNELBASE.dll_BaseReleaseProcessExePath
mov dword [ebp - 0x38c], ebx
jmp 0x7dd9c31a
push 8
jmp 0x7ddaf22c
push 0xc0000106
jmp 0x7ddaf3a0
push 0xc00000ba
call sym.KERNEL32.dll_BaseSetLastNTError
jmp 0x7dd9a08b
call fcn.7dd711c7
mov dword [ebp - 0x404], eax
mov eax, dword [ebp - 0x358]
mov word [eax], di
cmp word [esi], bx
je 0x7ddaf3f1
cmp byte [ebp - 0x35a], bl
je 0x7ddaf3f1
inc esi
inc esi
mov dword [ebp - 0x3c0], esi
mov dword [ebp - 0x358], esi
mov byte [ebp - 0x335], 1
mov dword [ebp - 0x41c], ebx
mov eax, dword [ebp - 0x33c]
jmp 0x7dd9c6b9
push dword [ebp - 0x404]
jmp 0x7ddaf22c
mov byte [ebp - 0x359], 1
mov dword [ebp - 0x33c], ecx
jmp 0x7dd8423f
mov eax, dword [ebp - 0x33c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x7ddaf417
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 6]
mov dword [ebp - 0x390], eax
mov eax, dword fs:[0x18]
mov dword [ebp - 0x5c4], eax
push dword [ebp - 0x390]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
mov dword [ebp - 0x3a0], edi
cmp edi, ebx
je 0x7dd84257
push 0x7dde3110
push dword [ebp - 0x390]
push edi
call fcn.7ddefb1c
mov esi, dword [ebp - 0x358]
cmp byte [ebp - 0x335], bl
je 0x7ddaf48b
movzx eax, word [esi]
mov dword [ebp - 0x40c], eax
xor eax, eax
mov word [esi], ax
push dword [ebp - 0x33c]
push dword [ebp - 0x390]
push edi
call fcn.7de16e2f
push 0x7dde3110
push dword [ebp - 0x390]
push edi
call fcn.7de16e2f
cmp byte [ebp - 0x335], bl
je 0x7dd9c6ef
mov ax, word [ebp - 0x40c]
mov word [esi], ax
push esi
push dword [ebp - 0x390]
push edi
call fcn.7de16e2f
jmp 0x7dd9c6ef
push 3
jmp 0x7ddaf22c
dec eax
je 0x7ddaf65f
dec eax
je 0x7ddaf655
dec eax
je 0x7ddaf607
dec eax
jne 0x7dd84373
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x388], ebx
jne 0x7ddaf54c
mov eax, dword fs:[0x18]
mov dword [ebp - 0x58c], eax
push 0x20a
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x388], eax
cmp eax, ebx
jne 0x7ddaf54c
push dword [ebp - 0x414]
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [ebp - 0x350], eax
jmp 0x7ddaf38d
lea eax, [ebp - 0x514]
push eax
push 0x208
mov edi, dword [ebp - 0x388]
push edi
push 1
push 0x7ddb00a8
push dword [ebp - 0x414]
call dword [sym.imp.ntdll.dll_LdrQueryImageFileKeyOption]
mov esi, eax
push dword [ebp - 0x414]
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [ebp - 0x350], eax
cmp esi, ebx
jl 0x7ddaf5d6
cmp dword [ebp - 0x514], 2
jb 0x7ddaf5d6
cmp word [edi], bx
je 0x7ddaf5d6
xor eax, eax
mov word [edi + 0x208], ax
lea eax, [ebp - 0x3ec]
push eax
push dword [ebp - 0x33c]
push ebx
push edi
push 3
call fcn.7de16c95
test eax, eax
je 0x7dd8a795
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x334], ebx
jmp 0x7dd84114
mov eax, dword fs:[0x18]
mov dword [ebp - 0x590], eax
push dword [ebp - 0x388]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebp - 0x388], ebx
mov byte [ebp - 0x33d], 1
jmp 0x7dd84114
mov dword [ebp - 0x4c4], 6
lea eax, [ebp - 0x380]
mov dword [ebp - 0x5b4], eax
lea eax, [ebp - 0x4c4]
push eax
push 1
lea eax, [ebp - 0x5b4]
push eax
push 1
push 1
push 0x40000023
call dword [sym.imp.ntdll.dll_NtRaiseHardError]
mov eax, dword [ebp - 0x3b0]
cmp dword [eax + 0xb8], 3
jbe 0x7ddaf655
push 0xd8
jmp 0x7ddaf22c
push 0xc1
jmp 0x7ddaf22c
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x344], eax
cmp edi, 0xc0000022
jne 0x7ddaf67a
push 5
jmp 0x7ddaf22c
mov eax, 0xc000012f
cmp byte [ebp - 0x32a], bl
jne 0x7dd8a78f
cmp edi, eax
jne 0x7ddaf84f
cmp word [ebp - 0x380], 8
jb 0x7ddaf862
movzx eax, word [ebp - 0x380]
shr eax, 1
mov ecx, dword [ebp - 0x37c]
lea esi, [ecx + eax*2 - 8]
mov dword [ebp - 0x598], esi
push 4
push 0x7ddb009c
push esi
call dword [sym.imp.ntdll.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x7ddaf6e8
push 4
push 0x7ddb0090
push esi
call dword [sym.imp.ntdll.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x7ddaf85d
mov byte [ebp - 0x33f], 1
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x3f0]
push eax
lea eax, [ebp - 0x3cc]
push eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x3f8]
push eax
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x3bc]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x3c8]
push eax
push dword [ebp - 0x374]
push dword [ebp - 0x37c]
push dword [ebp - 0x344]
push ebx
push ebx
push ebx
push ebx
call fcn.7dd82ee0
mov dword [ebp - 0x324], eax
cmp eax, ebx
je 0x7dd84985
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x500], eax
mov eax, dword fs:[0x18]
mov dword [ebp - 0x5a0], eax
push 0x20e
push dword [ebp - 0x500]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
mov dword [ebp - 0x3b4], esi
cmp esi, ebx
je 0x7ddaf222
mov edi, 0x104
push edi
push esi
push 0x7ddb0080
call sub.API_MS_Win_Core_ProcessEnvironment_L1_1_0.dll_GetEnvironmentVariableW
mov dword [ebp - 0x3b8], eax
cmp eax, edi
jb 0x7ddaf7c4
push 0xc000000f
jmp 0x7dd8a790
cmp eax, ebx
jne 0x7ddaf7f5
push 0xf3
push esi
push 0x7ddb34dc
call sub.API_MS_Win_Core_ProcessEnvironment_L1_1_0.dll_GetEnvironmentVariableW
mov dword [ebp - 0x3b8], eax
cmp eax, 0xf3
jae 0x7ddaf845
cmp eax, ebx
je 0x7ddaf845
push 0x7ddb005c
push edi
push esi
call fcn.7ddf3f0d
push 0x7ddb0054
push 0x107
push esi
call fcn.7ddf3f0d
lea eax, [ebp - 0x3ec]
push eax
push dword [ebp - 0x33c]
push ebx
push esi
push dword [ebp - 0x41c]
call fcn.7de16c95
test eax, eax
je 0x7dd8a795
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x334], ebx
mov byte [ebp - 0x32a], 1
jmp 0x7dd84114
push 0xc0000103
jmp 0x7dd8a790
cmp byte [ebp - 0x32a], bl
jne 0x7dd8a78f
jmp 0x7ddaf862
mov eax, 0xc000012f
test dword [ebp + 0x20], 0x2000000
jne 0x7ddaf8d6
mov byte [ebp - 0x35b], 1
cmp edi, 0xc000011b
je 0x7ddaf8a9
cmp edi, eax
je 0x7ddaf892
jle 0x7ddaf8a3
cmp edi, 0xc0000131
jle 0x7ddaf8a9
cmp edi, 0xc0000267
jne 0x7ddaf8a3
jmp 0x7ddaf8a9
push eax
lea eax, [ebp - 0x380]
push eax
call fcn.7ddf9a52
test eax, eax
jne 0x7ddaf8a9
mov byte [ebp - 0x35b], bl
cmp byte [ebp - 0x35b], bl
je 0x7ddaf8d6
push dword [ebp - 0x344]
push dword [ebp - 0x334]
push dword [ebp - 0x360]
call sym.KERNEL32.dll_BasepCheckWinSaferRestrictions
mov dword [ebp - 0x4d4], eax
cmp eax, ebx
jl 0x7dd9a070
cmp edi, 0xc0000131
jne 0x7ddaf94f
push ebx
push dword [ebp - 0x3a4]
push dword [ebp - 0x440]
push dword [ebp - 0x3dc]
push dword [ebp - 0x374]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp - 0x458]
push dword [ebp - 0x454]
push dword [ebp - 0x33c]
push dword [ebp - 0x334]
push dword [ebp - 0x360]
call fcn.7ddf452d
mov dword [ebp - 0x324], eax
cmp eax, ebx
jne 0x7dd84985
call fcn.7dd711c7
cmp eax, 0xd8
jne 0x7dd84985
lea eax, [ebp - 0x380]
push eax
call fcn.7ddf33a8
jmp 0x7dd84985
lea eax, [ebp - 0x370]
push eax
lea eax, [ebp - 0x3c4]
push eax
lea eax, [ebp - 0x368]
push eax
lea eax, [ebp - 0x348]
push eax
lea eax, [ebp - 0x4e4]
push eax
lea eax, [ebp - 0x4f0]
push eax
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0x3d0]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x33e]
push eax
lea eax, [ebp - 0x380]
push eax
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x20]
push eax
push dword [ebp - 0x3dc]
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0x334]
push eax
push dword [ebp - 0x3e0]
push dword [ebp - 0x360]
push edi
call fcn.7ddf40ed
mov dword [ebp - 0x324], eax
cmp eax, ebx
je 0x7dd84985
mov eax, dword [ebp - 0x370]
cmp eax, ebx
je 0x7ddaf839
jmp 0x7dd8490a
push 0x4b0
jmp 0x7ddaf22c
cmp dword [ebp - 0x574], 7
jne 0x7ddafbfe
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x4cc], eax
mov eax, dword fs:[0x18]
mov dword [ebp - 0x5a8], eax
push 0x20e
push dword [ebp - 0x4cc]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
mov dword [ebp - 0x3b4], esi
cmp esi, ebx
je 0x7ddaf222
mov dword [ebp - 0x3b8], 0x208
lea eax, [ebp - 0x3b8]
push eax
push esi
push ebx
push 2
push 0x7ddb0044
push 0x7ddb0010
push 0x80000002
call sym.KERNEL32.dll_RegGetValueW
mov dword [ebp - 0x5cc], eax
cmp eax, ebx
je 0x7ddafb37
mov edi, 0xf1
push edi
push esi
push 0x7ddb34dc
call sub.API_MS_Win_Core_ProcessEnvironment_L1_1_0.dll_GetEnvironmentVariableW
mov dword [ebp - 0x3b8], eax
cmp eax, edi
jae 0x7ddaf845
cmp eax, ebx
je 0x7ddaf845
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x510], eax
mov eax, dword fs:[0x18]
mov dword [ebp - 0x5d4], eax
push 0x410
push dword [ebp - 0x510]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
mov dword [ebp - 0x438], edi
cmp edi, ebx
je 0x7ddaf222
mov esi, dword [ebp - 0x3b4]
push esi
push esi
push 0x7ddafff0
push 0x208
push edi
call fcn.7dded7b9
add esp, 0x14
push ebx
push esi
push 0x104
push ebx
push 0x7ddaffdc
push edi
call fcn.7dd75266
mov dword [ebp - 0x3b8], eax
cmp eax, 0x104
jae 0x7ddaf845
cmp eax, ebx
je 0x7ddaf845
push 0x7ddaffd4
push 0x107
push esi
call fcn.7ddf3f0d
lea eax, [ebp - 0x3ec]
push eax
push dword [ebp - 0x33c]
push dword [ebp - 0x334]
push esi
push 2
call fcn.7de16c95
test eax, eax
je 0x7dd8a795
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x334], ebx
cmp dword [ebp - 0x398], ebx
je 0x7ddafb95
push dword [ebp - 0x398]
push dword [ebp - 0x330]
call sub.ntdll.dll_NtRemoveProcessDebug
push dword [ebp - 0x394]
push dword [ebp - 0x330]
call dword [sym.imp.ntdll.dll_NtTerminateProcess]
push ebx
push ebx
push dword [ebp - 0x330]
call dword [sym.imp.ntdll.dll_NtWaitForSingleObject]
push dword [ebp - 0x330]
mov esi, dword [sym.imp.ntdll.dll_NtClose]
call esi
mov dword [ebp - 0x330], ebx
push dword [ebp - 0x354]
call esi
mov dword [ebp - 0x354], ebx
push dword [ebp - 0x384]
call esi
mov dword [ebp - 0x384], ebx
push dword [ebp - 0x344]
call esi
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x344], ebx
jmp 0x7ddaf839
push 0x81
jmp 0x7ddaf22c
push 0x4fd
jmp 0x7ddaf22c
push 0x4fe
jmp 0x7ddaf22c
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x370], eax
push dword [ebp - 0x368]
push dword [ebp - 0x3d0]
lea eax, [ebp - 0x370]
push eax
push 1
call fcn.7ddf9969
test eax, eax
jne 0x7ddafc51
mov dword [ebp - 0x370], ebx
jmp 0x7dd8a795
or dword [ebp - 0x348], 2
jmp 0x7dd84447
push eax
push 0x7ddaff98
call sub.ntdll.dll_DbgPrint
pop ecx
pop ecx
mov dword [ebp - 0x378], 0xffff
jmp 0x7dd844ca
mov dword [ebp - 0x378], 6
jmp 0x7dd844ca
movzx eax, word [0x7de40350]
mov dword [ebp - 0x378], eax
jmp 0x7dd844ca
or dword [esi + 4], 1
jmp 0x7dd8468f
or dword [esi], 1
jmp 0x7dd8469c
and dword [esi], 0xfffffffe
jmp 0x7dd846a9
mov ecx, dword [ebp - 0x3d0]
cmp ecx, ebx
je 0x7ddafcc1
xor eax, eax
jmp 0x7ddafccd
mov eax, dword [ebp - 0x3b0]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x10]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], ecx
jmp 0x7dd846c6
mov dword [esi + 0x14], 0x80
jmp 0x7dd846c6
push eax
call sym.KERNEL32.dll_BaseSetLastNTError
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x394], eax
jmp 0x7dd8a795
lea ecx, [ebp - 0x4b8]
push ecx
push eax
push dword [ebp - 0x330]
call fcn.7de16c47
mov dword [ebp - 0x364], eax
cmp eax, ebx
jge 0x7dd84705
jmp 0x7dd9a070
cmp edi, 0xc000042c
jne 0x7ddafd37
test byte [ebp - 0x43c], 1
jne 0x7ddafd37
call fcn.7ddeb4f8
push edi
call sym.KERNEL32.dll_BaseSetLastNTError
mov dword [ebp - 0x394], edi
jmp 0x7dd8a795
mov dword [ebp - 0x394], eax
jmp 0x7dd9a070
push esi
call sym.KERNEL32.dll_BaseSetLastNTError
mov dword [ebp - 0x394], esi
jmp 0x7dd8a795
or dword [ebp - 0x348], 8
jmp 0x7dd8491f
cmp dword [ebp - 0x368], 0x20
jne 0x7ddafd95
or eax, 2
mov dword [esi], eax
test byte [ebp - 0x348], 4
je 0x7ddafd9a
mov dword [ebp - 0x450], ebx
mov dword [ebp - 0x44c], ebx
jmp 0x7ddafd9a
or eax, 1
mov dword [esi], eax
cmp dword [ebp - 0x330], ebx
je 0x7dd84945
push dword [ebp - 0x330]
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [ebp - 0x350], eax
jmp 0x7dd84945
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
jmp 0x7dd84997