Function at 0x7dd84e75
Capabilities:
Terminate process

Disassembly:
mov esi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [ebp - 0x388], ebx
jne 0x7ddafe29
cmp dword [ebp - 0x39c], ebx
jne 0x7dd8a73e
lea eax, [ebp - 0x380]
push eax
mov edi, dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
call edi
cmp dword [ebp - 0x368], ebx
jne 0x7dd84eb6
lea eax, [ebp - 0x320]
push eax
call fcn.7dd84de0
cmp dword [ebp - 0x3d4], ebx
je 0x7dd84ed0
push dword [ebp - 0x3d4]
call dword [sym.imp.ntdll.dll_RtlDestroyEnvironment]
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x3a0], ebx
jne 0x7ddafe49
mov eax, dword fs:[0x18]
mov dword [ebp - 0x594], eax
push dword [ebp - 0x36c]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call esi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x5e0], eax
push dword [ebp - 0x418]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call esi
jmp 0x7ddafe69
mov esi, dword [sym.imp.ntdll.dll_NtClose]
cmp dword [ebp - 0x344], ebx
je 0x7dd84f33
push dword [ebp - 0x344]
call esi
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x384], ebx
je 0x7dd84f49
push dword [ebp - 0x384]
call esi
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x354], ebx
jne 0x7ddafeb8
cmp dword [ebp - 0x330], ebx
jne 0x7ddaff04
push dword [ebp - 0x3c8]
push dword [ebp - 0x3bc]
push dword [ebp - 0x3ac]
call sym.KERNEL32.dll_BasepFreeAppCompatData
lea eax, [ebp - 0x3ec]
push eax
call edi
cmp dword [ebp - 0x4ec], ebx
jne 0x7ddaff17
cmp dword [ebp - 0x4e0], ebx
jne 0x7ddaff17
cmp dword [ebp - 0x348], ebx
jne 0x7ddaff2f
cmp dword [ebp - 0x38c], ebx
jne 0x7dd9c3bc
cmp dword [ebp - 0x3fc], ebx
jne 0x7ddaff74
ret
mov eax, dword fs:[0x18]
mov dword [ebp - 0x5c0], eax
push dword [ebp - 0x39c]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call esi
jmp 0x7dd84e93
push dword [ebp - 0x3f4]
push dword [ebp - 0x38c]
call sub.KERNELBASE.dll_BaseReleaseProcessExePath
jmp 0x7dd84fb1
mov eax, dword fs:[0x18]
mov dword [ebp - 0x5ec], eax
push dword [ebp - 0x388]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call esi
jmp 0x7dd84e87
mov eax, dword fs:[0x18]
mov dword [ebp - 0x5c8], eax
push dword [ebp - 0x3a0]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call esi
jmp 0x7dd84edc
cmp dword [ebp - 0x3b4], ebx
je 0x7ddafe8c
mov eax, dword fs:[0x18]
mov dword [ebp - 0x59c], eax
push dword [ebp - 0x3b4]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call esi
cmp dword [ebp - 0x438], ebx
je 0x7dd84f17
mov eax, dword fs:[0x18]
mov dword [ebp - 0x5d0], eax
push dword [ebp - 0x438]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call esi
jmp 0x7dd84f17
cmp dword [ebp - 0x398], ebx
je 0x7ddafed1
push dword [ebp - 0x398]
push dword [ebp - 0x330]
call sub.ntdll.dll_NtRemoveProcessDebug
push dword [ebp - 0x394]
push dword [ebp - 0x330]
call dword [sym.imp.ntdll.dll_NtTerminateProcess]
push ebx
push ebx
push dword [ebp - 0x330]
call dword [sym.imp.ntdll.dll_NtWaitForSingleObject]
push dword [ebp - 0x354]
call esi
mov dword [ebp - 0x350], eax
jmp 0x7dd84f55
push dword [ebp - 0x330]
call esi
mov dword [ebp - 0x350], eax
jmp 0x7dd84f61
lea eax, [ebp - 0x4e4]
push eax
lea eax, [ebp - 0x4f0]
push eax
call fcn.7ddf9bd3
jmp 0x7dd84f99
test byte [ebp - 0x348], 8
jne 0x7dd84fa5
push dword [ebp - 0x368]
push dword [ebp - 0x348]
lea eax, [ebp - 0x3d0]
push eax
push ebx
call fcn.7ddf9969
cmp dword [ebp - 0x370], ebx
je 0x7dd84fa5
push dword [ebp - 0x370]
call esi
mov dword [ebp - 0x350], eax
jmp 0x7dd84fa5
push dword [ebp - 0x3fc]
call dword [sym.imp.ntdll.dll_CsrFreeCaptureBuffer]
mov dword [ebp - 0x3fc], ebx
jmp 0x7dd84fbd