Function at 0x7ddea3e4
Capabilities:
Check for peb beingdebugged flag
Get process heap flags

Disassembly:
push 0x3c
push 0x7ddea800
call fcn.7dd715c0
mov esi, dword [ebp + 8]
cmp dword [esi], 8
jne 0x7ddea406
push dword [ebp + 0xc]
push esi
call fcn.7ddea22f
jmp 0x7ddea7f8
mov ebx, dword [esi + 0x4c]
test ebx, ebx
je 0x7ddea414
mov edi, dword [esi + 0x50]
test edi, edi
jne 0x7ddea42a
mov ebx, dword [esi + 0x54]
test ebx, ebx
je 0x7ddea7f3
mov edi, dword [esi + 0x58]
test edi, edi
je 0x7ddea7f3
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov ecx, dword fs:[0x18]
push edi
push eax
mov eax, dword [ecx + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x7ddea458
mov eax, 0xc0000017
jmp 0x7ddea7f8
and dword [ebp - 0x24], 0
and dword [ebp - 4], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x34], edi
push edi
push ebx
push dword [ebp - 0x20]
call sub.ntdll.dll_memmove
add esp, 0xc
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
and dword [ebp - 0x34], 0
xor ebx, ebx
cmp edi, ebx
je 0x7ddea6c5
mov eax, dword [ebp - 0x2c]
cmp byte [esi + 5], 0
je 0x7ddea597
mov dword [ebp - 0x28], eax
shr edi, 1
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], ebx
je 0x7ddea6c5
movzx ecx, word [eax]
cmp cx, bx
je 0x7ddea4c1
cmp cx, 0x20
ja 0x7ddea4c1
dec dword [ebp - 0x1c]
inc eax
inc eax
mov dword [ebp - 0x28], eax
jmp 0x7ddea4a0
cmp dword [ebp - 0x1c], ebx
je 0x7ddea6c5
cmp word [eax], bx
je 0x7ddea6c5
mov dword [ebp - 0x38], eax
mov dword [esi + 0x44], eax
cmp dword [ebp - 0x1c], ebx
je 0x7ddea6c5
cmp word [eax], 0x3d
je 0x7ddea4f2
dec dword [ebp - 0x1c]
inc eax
inc eax
mov dword [ebp - 0x28], eax
jmp 0x7ddea4d9
cmp dword [ebp - 0x1c], ebx
je 0x7ddea6c5
mov ecx, eax
inc eax
inc eax
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x1c]
mov dword [ebp - 0x40], ecx
cmp ecx, dword [esi + 0x44]
jbe 0x7ddea51a
lea edx, [ecx - 2]
cmp word [edx], 0x20
ja 0x7ddea51a
mov ecx, edx
jmp 0x7ddea505
sub ecx, dword [esi + 0x44]
mov word [esi + 0x40], cx
cmp cx, bx
je 0x7ddea6c5
add ecx, 2
mov word [esi + 0x42], cx
cmp dword [ebp - 0x1c], ebx
je 0x7ddea546
cmp word [eax], 0x20
jne 0x7ddea546
dec dword [ebp - 0x1c]
inc eax
inc eax
mov dword [ebp - 0x28], eax
jmp 0x7ddea531
mov dword [esi + 0x54], eax
cmp dword [ebp - 0x1c], ebx
je 0x7ddea6c5
cmp word [eax], bx
je 0x7ddea561
dec dword [ebp - 0x1c]
inc eax
inc eax
mov dword [ebp - 0x28], eax
jmp 0x7ddea549
cmp dword [ebp - 0x1c], ebx
je 0x7ddea6c5
mov cx, ax
sub cx, word [esi + 0x54]
movzx ecx, cx
mov dword [esi + 0x58], ecx
dec dword [ebp - 0x1c]
inc eax
inc eax
mov dword [ebp - 0x28], eax
mov ecx, eax
sub ecx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x2c], eax
mov edi, dword [ebp - 0x1c]
add edi, edi
mov dword [ebp - 0x28], edi
jmp 0x7ddea6df
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], ebx
je 0x7ddea6c5
mov cl, byte [eax]
test cl, cl
je 0x7ddea5ba
cmp cl, 0x20
ja 0x7ddea5ba
dec dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x2c], eax
jmp 0x7ddea59d
cmp dword [ebp - 0x1c], ebx
je 0x7ddea6c5
cmp byte [eax], 0
je 0x7ddea6c5
mov dword [ebp - 0x38], eax
mov dword [esi + 0x34], eax
cmp dword [ebp - 0x1c], ebx
je 0x7ddea6c5
cmp byte [eax], 0x3d
je 0x7ddea5e9
dec dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x2c], eax
jmp 0x7ddea5d2
cmp dword [ebp - 0x1c], ebx
je 0x7ddea6c5
mov ecx, eax
inc eax
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x1c]
mov dword [ebp - 0x44], ecx
cmp ecx, dword [esi + 0x34]
jbe 0x7ddea60f
lea edx, [ecx - 1]
cmp byte [edx], 0x20
ja 0x7ddea60f
mov ecx, edx
jmp 0x7ddea5fb
sub ecx, dword [esi + 0x34]
mov word [esi + 0x30], cx
cmp cx, bx
je 0x7ddea6c5
inc ecx
mov word [esi + 0x32], cx
cmp dword [ebp - 0x1c], ebx
je 0x7ddea637
cmp byte [eax], 0x20
jne 0x7ddea637
dec dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x2c], eax
jmp 0x7ddea624
mov dword [esi + 0x4c], eax
cmp dword [ebp - 0x1c], ebx
je 0x7ddea6c5
cmp byte [eax], 0
je 0x7ddea651
dec dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x2c], eax
jmp 0x7ddea63a
cmp dword [ebp - 0x1c], ebx
je 0x7ddea6c5
mov cx, ax
sub cx, word [esi + 0x4c]
movzx ecx, cx
mov dword [esi + 0x50], ecx
dec dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x2c], eax
mov ecx, eax
sub ecx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
movzx eax, word [esi + 0x32]
add eax, eax
mov word [esi + 0x42], ax
xor eax, eax
mov word [esi + 0x40], ax
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x48], eax
mov eax, dword fs:[0x18]
mov ecx, dword [esi + 0x50]
movzx edx, word [esi + 0x42]
lea ecx, [edx + ecx*2 + 2]
push ecx
push dword [ebp - 0x48]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x24], eax
cmp eax, ebx
jne 0x7ddea6cd
mov dword [ebp - 0x30], 0xc0000017
mov dword [ebp - 4], ebx
jmp 0x7ddea77f
mov eax, dword [ebp - 0x24]
mov dword [esi + 0x44], eax
movzx ecx, word [esi + 0x42]
add ecx, eax
mov dword [esi + 0x54], ecx
mov edi, dword [ebp - 0x28]
push ebx
push ebx
push dword [ebp + 0xc]
push esi
call fcn.7ddea094
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x24], ebx
je 0x7ddea71f
mov eax, dword fs:[0x18]
push dword [ebp - 0x24]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebp - 0x24], ebx
push ebx
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov edi, dword [ebp - 0x28]
cmp dword [ebp - 0x30], ebx
jge 0x7ddea483
cmp dword [ebp - 0x30], 0xc0000016
jne 0x7ddea6c5
push dword [ebp - 0x3c]
push dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x20]
add eax, ecx
push eax
call sub.ntdll.dll_memmove
add esp, 0xc
mov eax, dword [ebp - 0x3c]
add dword [ebp - 0x34], eax
mov dword [ebp - 0x30], ebx
jmp 0x7ddea483
mov eax, dword [ebp - 0x34]
cmp eax, ebx
je 0x7ddea7a4
mov byte [esi + 6], 1
mov ecx, dword [ebp - 0x20]
cmp byte [esi + 5], 0
je 0x7ddea79b
mov dword [esi + 0x54], ecx
mov dword [esi + 0x58], eax
jmp 0x7ddea7a1
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x50], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.7ddea7bc
mov eax, dword [ebp - 0x30]
jmp 0x7ddea7f8
mov eax, 0xc000000d
call fcn.7dd71605
ret 8