Function at 0x7dd84ea5
Capabilities:
Terminate process

Disassembly:
mov esi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [ebp - 0x388], ebx
jne 0x7ddafe09
cmp dword [ebp - 0x39c], ebx
jne 0x7dd8a766
lea eax, [ebp - 0x380]
push eax
mov edi, dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
call edi
cmp dword [ebp - 0x368], ebx
jne 0x7dd84ee6
lea eax, [ebp - 0x320]
push eax
call fcn.7dd84e10
cmp dword [ebp - 0x3d4], ebx
je 0x7dd84f00
push dword [ebp - 0x3d4]
call dword [sym.imp.ntdll.dll_RtlDestroyEnvironment]
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x3a0], ebx
jne 0x7ddafe29
mov eax, dword fs:[0x18]
mov dword [ebp - 0x594], eax
push dword [ebp - 0x36c]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call esi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x5e0], eax
push dword [ebp - 0x418]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call esi
jmp 0x7ddafe49
mov esi, dword [sym.imp.ntdll.dll_NtClose]
cmp dword [ebp - 0x344], ebx
je 0x7dd84f63
push dword [ebp - 0x344]
call esi
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x384], ebx
je 0x7dd84f79
push dword [ebp - 0x384]
call esi
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x354], ebx
jne 0x7ddafe98
cmp dword [ebp - 0x330], ebx
jne 0x7ddafee4
push dword [ebp - 0x3c8]
push dword [ebp - 0x3bc]
push dword [ebp - 0x3ac]
call sym.KERNEL32.dll_BasepFreeAppCompatData
lea eax, [ebp - 0x3ec]
push eax
call edi
cmp dword [ebp - 0x4ec], ebx
jne 0x7ddafef7
cmp dword [ebp - 0x4e0], ebx
jne 0x7ddafef7
cmp dword [ebp - 0x348], ebx
jne 0x7ddaff0f
cmp dword [ebp - 0x38c], ebx
jne 0x7dd9c3cc
cmp dword [ebp - 0x3fc], ebx
jne 0x7ddaff54
ret
mov eax, dword fs:[0x18]
mov dword [ebp - 0x5c0], eax
push dword [ebp - 0x39c]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call esi
jmp 0x7dd84ec3
push dword [ebp - 0x3f4]
push dword [ebp - 0x38c]
call sub.KERNELBASE.dll_BaseReleaseProcessExePath
jmp 0x7dd84fe1
mov eax, dword fs:[0x18]
mov dword [ebp - 0x5ec], eax
push dword [ebp - 0x388]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call esi
jmp 0x7dd84eb7
mov eax, dword fs:[0x18]
mov dword [ebp - 0x5c8], eax
push dword [ebp - 0x3a0]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call esi
jmp 0x7dd84f0c
cmp dword [ebp - 0x3b4], ebx
je 0x7ddafe6c
mov eax, dword fs:[0x18]
mov dword [ebp - 0x59c], eax
push dword [ebp - 0x3b4]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call esi
cmp dword [ebp - 0x438], ebx
je 0x7dd84f47
mov eax, dword fs:[0x18]
mov dword [ebp - 0x5d0], eax
push dword [ebp - 0x438]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call esi
jmp 0x7dd84f47
cmp dword [ebp - 0x398], ebx
je 0x7ddafeb1
push dword [ebp - 0x398]
push dword [ebp - 0x330]
call sub.ntdll.dll_NtRemoveProcessDebug
push dword [ebp - 0x394]
push dword [ebp - 0x330]
call dword [sym.imp.ntdll.dll_NtTerminateProcess]
push ebx
push ebx
push dword [ebp - 0x330]
call dword [sym.imp.ntdll.dll_NtWaitForSingleObject]
push dword [ebp - 0x354]
call esi
mov dword [ebp - 0x350], eax
jmp 0x7dd84f85
push dword [ebp - 0x330]
call esi
mov dword [ebp - 0x350], eax
jmp 0x7dd84f91
lea eax, [ebp - 0x4e4]
push eax
lea eax, [ebp - 0x4f0]
push eax
call fcn.7ddf999b
jmp 0x7dd84fc9
test byte [ebp - 0x348], 8
jne 0x7dd84fd5
push dword [ebp - 0x368]
push dword [ebp - 0x348]
lea eax, [ebp - 0x3d0]
push eax
push ebx
call fcn.7ddf9731
cmp dword [ebp - 0x370], ebx
je 0x7dd84fd5
push dword [ebp - 0x370]
call esi
mov dword [ebp - 0x350], eax
jmp 0x7dd84fd5
push dword [ebp - 0x3fc]
call dword [sym.imp.ntdll.dll_CsrFreeCaptureBuffer]
mov dword [ebp - 0x3fc], ebx
jmp 0x7dd84fed