Function at 0x75de0420
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x254
mov eax, dword [0x75e50140]
xor eax, esp
mov dword [esp + reloc.ntdll.dll_NtClose], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x4c], edi
mov dword [esp + 0x48], ebx
test edi, edi
je 0x75de08ce
test ebx, ebx
je 0x75de08ce
cmp dword [ebx], reloc.ntdll.dll_NtClose
jne 0x75de08ce
cmp dword [0x75e50a04], 0
jne 0x75de0874
cmp dword [0x75e50a00], 0
jne 0x75de04d3
mov eax, dword fs:[0x30]
push 0x18
push 0
push dword [eax + 0x18]
call dword [0x75e221e0]
mov esi, eax
test esi, esi
jne 0x75de04a2
mov esi, 0xc000009a
jmp 0x75de086a
push esi
call dword [0x75e2199c]
mov ecx, esi
mov edx, 0x75e50a00
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x75de04d3
push esi
call dword [0x75e219a0]
mov eax, dword fs:[0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [0x75e221d0]
push dword [0x75e50a00]
call dword [0x75e219a4]
cmp dword [0x75e50a04], 0
jne 0x75de0858
call fcn.75db5ebd
mov esi, eax
test esi, esi
js 0x75de085a
cmp dword [0x75e50a04], 0
jne 0x75de050e
mov esi, 0xc0000001
jmp 0x75de085a
mov eax, dword fs:[0x30]
mov ecx, dword [eax + reloc.ntdll.dll_NtClose]
test ecx, ecx
je 0x75de053e
mov eax, dword [0x75e50a04]
mov eax, dword [eax + 4]
mov dword [ecx + reloc.ntdll.dll_NtClose], eax
mov eax, dword [0x75e50a04]
cdq
mov dword [ecx + reloc.ntdll.dll_NtClose], eax
mov dword [ecx + reloc.ntdll.dll_NtClose], edx
push 0x75e509f8
xor esi, esi
push esi
push esi
push 0x75e23fc0
call dword [0x75e21cd4]
mov ebx, 0x75e23fb0
test eax, eax
js 0x75de0573
push ebx
push dword [0x75e509fc]
push dword [0x75e509f8]
call dword [0x75e21cd0]
movzx eax, al
jmp 0x75de0581
mov dword [0x75e509f8], esi
mov eax, esi
mov dword [0x75e509fc], esi
mov dword [0x75e5099c], eax
lea edi, [esp + 0x18]
mov eax, dword [0x75e50a04]
mov dword [esp + 0x44], eax
xor eax, eax
push 6
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword fs:[0x30]
cmp byte [eax + 2], 0
jne 0x75de05c8
push ebx
push dword [0x75e509fc]
push dword [0x75e509f8]
call dword [0x75e21cd0]
test al, al
jne 0x75de05c8
mov dword [0x75e50998], esi
jmp 0x75de0835
lea eax, [esp + 0x50]
mov dword [0x75e50998], 1
push eax
lea eax, [esp + 0x38]
mov edi, 0x104
push eax
mov dword [esp + 0x3c], edi
call dword [0x75e20d9c]
test eax, eax
js 0x75de05f6
cmp word [esp + 0x50], si
jne 0x75de060f
push edi
lea eax, [esp + 0x54]
mov dword [esp + 0x38], edi
push eax
push esi
call dword [0x75e213cc]
test eax, eax
je 0x75de0835
lea eax, [esp + 0x14]
mov dword [esp + 0x14], esi
push eax
push esi
push esi
push 8
lea eax, [esp + 0x60]
push eax
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsQuirks
push 0x80000001
call dword [0x75e21914]
test eax, eax
jne 0x75de0835
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], ecx
test ecx, ecx
je 0x75de0835
mov eax, dword fs:[0x30]
mov edi, dword [eax + 0x18]
test edi, edi
jne 0x75de0662
call dword [0x75e212e4]
mov ecx, dword [esp + 0x10]
mov edi, eax
mov dword [esp + 0x18], edi
mov ebx, esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], esi
test ecx, ecx
je 0x75de06ea
lea eax, [esp + 0x30]
mov edx, 0x3ff
push eax
call fcn.75db9942
test eax, eax
jns 0x75de068e
mov ebx, 0x8000000b
jmp 0x75de06cb
mov eax, dword [esp + 0x30]
and eax, 0xfffffc00
push eax
push 0
push edi
mov dword [esp + 0x3c], eax
call dword [0x75e21314]
mov dword [esp + 0x10], eax
test eax, eax
je 0x75de06c6
push dword [esp + 0x30]
push 0
push eax
call fcn.75dc7439
mov esi, dword [esp + 0x1c]
add esp, 0xc
mov dword [esp + 0x2c], esi
jmp 0x75de06ea
mov ebx, 0x8007000e
push 6
xor eax, eax
lea edi, [esp + 0x1c]
pop ecx
rep stosd dword es:[edi], eax
test ebx, ebx
js 0x75de0835
mov esi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x14]
push eax
push esi
push 0
push 8
lea eax, [esp + 0x60]
push eax
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsQuirks
push 0x80000001
call dword [0x75e21914]
test eax, eax
jne 0x75de083d
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x14], eax
jne 0x75de083d
cmp ebx, eax
ja 0x75de083d
lea eax, [esp + 0x38]
mov ecx, ebx
push eax
push 4
pop edx
call fcn.75db9942
test eax, eax
js 0x75de083d
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x38], eax
ja 0x75de083d
lea eax, [esp + 0x28]
mov ecx, ebx
push eax
push 4
pop edx
call fcn.75db9942
test eax, eax
js 0x75de0835
cmp dword [ebx + esi], reloc.ntdll.dll_NtClose
jne 0x75de0835
jmp 0x75de0825
lea eax, [esp + 0x3c]
mov ecx, esi
push eax
push 4
pop edx
call fcn.75db9942
test eax, eax
js 0x75de0835
cmp dword [esp + 0x3c], edi
ja 0x75de0835
mov eax, dword [esp + 0x2c]
mov ecx, esi
mov ebx, dword [esi + eax]
lea eax, [esp + 0x28]
push eax
push 4
pop edx
call fcn.75db9942
test eax, eax
js 0x75de0835
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x1c]
cmp esi, edi
ja 0x75de0835
lea eax, [esp + 0x40]
mov ecx, esi
push eax
push 4
pop edx
call fcn.75db9942
test eax, eax
js 0x75de0835
cmp dword [esp + 0x40], edi
ja 0x75de0835
mov eax, dword [esp + 0x2c]
mov ecx, esi
mov edi, dword [esi + eax]
lea eax, [esp + 0x28]
push eax
push 4
pop edx
call fcn.75db9942
test eax, eax
js 0x75de0835
mov ecx, dword [esp + 0x44]
mov edx, ebx
call fcn.75de1bd5
test eax, eax
je 0x75de0835
mov ecx, dword [eax + reloc.ntdll.dll_NtClose]
and ecx, 0xfffffffc
test edi, edi
je 0x75de081c
or ecx, 1
jmp 0x75de081f
or ecx, 2
mov dword [eax + reloc.ntdll.dll_NtClose], ecx
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x28]
cmp esi, edi
jb 0x75de0781
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x75de084b
push esi
push 0
push edi
call dword [0x75e212e0]
call fcn.75db5f22
mov ebx, dword [esp + 0x48]
mov edi, dword [esp + 0x4c]
xor esi, esi
push dword [0x75e50a00]
call dword [0x75e219a8]
test esi, esi
jns 0x75de0874
or esi, 0x10000000
mov eax, esi
jmp 0x75de08d3
mov edx, edi
call fcn.75de1c00
mov esi, eax
test esi, esi
jne 0x75de0888
mov eax, 0x80070490
jmp 0x75de08d3
movzx ecx, word [esi + 0x116]
mov edi, 0x80
movzx eax, word [esi + 0x114]
mov edx, edi
shl ecx, 0x10
or ecx, eax
mov dword [ebx + 4], ecx
lea ecx, [ebx + 8]
push esi
call fcn.75dcf1ae
test eax, eax
js 0x75de08d3
lea eax, reloc.ntdll.dll_NtClose
mov edx, edi
push eax
lea ecx, reloc.ntdll.dll_NtClose
call fcn.75dcf1ae
test eax, eax
js 0x75de08d3
xor eax, eax
jmp 0x75de08d3
mov eax, 0x80070057
mov ecx, dword [esp + reloc.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.75dbdd75
mov esp, ebp
pop ebp
ret 8