Function at 0x7dd97121
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 8], ebx
call fcn.7dd7f1d1
test eax, eax
jge 0x7dd9ea03
cmp dword [edi], 8
jne 0x7dd9e9ad
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
mov eax, dword [edi + 0x64]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 0xc]
cmp byte [eax + 0x19], bl
je 0x7dd9e9df
lea eax, [ebp - 0x14]
push eax
push ebx
push edi
call fcn.7dd7e911
test al, al
jne 0x7dd9e9d4
mov eax, 0xc000000d
jmp 0x7dd9714d
mov eax, dword [ebp - 0x14]
movzx eax, word [eax]
add eax, 8
jmp 0x7dd9e9f7
push ebx
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.7dd7e911
test al, al
je 0x7dd9e9ca
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax]
add eax, 4
mov dword [ebp - 8], eax
mov byte [ebp - 1], 1
mov dword [ebp - 0x24], ebx
jmp 0x7dd9ea42
cmp dword [edi], 8
jne 0x7dd9ea0d
mov eax, dword [edi + 0x60]
jmp 0x7dd9ea10
mov eax, dword [edi + 0x5c]
mov dword [ebp - 0xc], eax
xor eax, eax
cmp dword [edi], 8
sete al
inc eax
inc eax
push eax
push edi
call fcn.7dd7f09d
cmp eax, 0x105
je 0x7dd9ea13
cmp eax, 0x8000001a
jne 0x7dd9714d
mov eax, dword [edi + 0x5c]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], bl
mov dword [ebp - 0x24], eax
cmp dword [edi], 8
jne 0x7dd9ea4e
xor esi, esi
jmp 0x7dd9ebb7
mov eax, dword [edi + 0xc]
cmp byte [eax + 0x19], bl
lea eax, [ebp - 0x10]
push eax
je 0x7dd9ea8f
lea eax, [ebp - 0x18]
push eax
push ebx
push edi
call fcn.7dd963cd
test al, al
je 0x7dd9e9ca
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
dec ecx
dec ecx
add dword [ebp - 8], ecx
jmp 0x7dd9ea88
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x7dd9ea7a
add dword [ebp - 8], 2
cmp word [eax], bx
je 0x7dd9eabc
jmp 0x7dd9ea7a
push ebx
lea eax, [ebp - 0x20]
push eax
push edi
call fcn.7dd963cd
test al, al
je 0x7dd9e9ca
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
dec ecx
add dword [ebp - 8], ecx
jmp 0x7dd9eab8
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x7dd9eaae
inc dword [ebp - 8]
cmp byte [eax], bl
jne 0x7dd9eaae
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov edx, dword [ebp - 8]
mov eax, dword [eax + 0x2c]
mov ecx, dword fs:[0x18]
add edx, 2
push edx
push eax
mov eax, dword [ecx + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
cmp esi, ebx
jne 0x7dd9eaef
mov eax, 0xc0000017
jmp 0x7dd9714d
mov eax, dword [edi + 0xc]
cmp byte [eax + 0x19], bl
mov eax, esi
je 0x7dd9eb6b
cmp byte [ebp - 1], bl
je 0x7dd9eb3e
mov ecx, dword [ebp - 0x14]
push 0x5b
pop eax
mov word [esi], ax
mov edx, dword [ecx + 4]
movzx ecx, word [ecx]
shr ecx, 1
lea eax, [esi + 2]
je 0x7dd9eb26
mov di, word [edx]
dec ecx
mov word [eax], di
inc eax
inc eax
inc edx
inc edx
cmp ecx, ebx
jne 0x7dd9eb14
mov edi, dword [ebp + 8]
push 0x5d
pop ecx
mov word [eax], cx
inc eax
inc eax
push 0xd
pop ecx
mov word [eax], cx
inc eax
inc eax
push 0xa
pop ecx
mov word [eax], cx
inc eax
inc eax
mov ecx, dword [ebp - 0x18]
jmp 0x7dd9eb64
inc ecx
inc ecx
inc eax
inc eax
movzx edx, word [ecx]
mov word [eax], dx
cmp dx, bx
jne 0x7dd9eb43
push 0xd
inc ecx
pop edx
mov word [eax], dx
inc ecx
inc eax
inc eax
push 0xa
pop edx
mov word [eax], dx
inc eax
inc eax
cmp word [ecx], bx
je 0x7dd9ebb7
jmp 0x7dd9eb47
cmp byte [ebp - 1], bl
je 0x7dd9eb9b
mov ecx, dword [ebp - 0x1c]
mov byte [esi], 0x5b
mov edx, dword [ecx + 4]
movzx edi, word [ecx]
lea eax, [esi + 1]
jmp 0x7dd9eb88
mov cl, byte [edx]
dec edi
mov byte [eax], cl
inc eax
inc edx
cmp edi, ebx
jne 0x7dd9eb81
mov edi, dword [ebp + 8]
mov byte [eax], 0x5d
inc eax
mov byte [eax], 0xd
inc eax
mov byte [eax], 0xa
inc eax
mov ecx, dword [ebp - 0x20]
jmp 0x7dd9ebb3
inc ecx
inc eax
mov dl, byte [ecx]
mov byte [eax], dl
cmp dl, bl
jne 0x7dd9eba0
mov byte [eax], 0xd
inc ecx
inc eax
mov byte [eax], 0xa
inc eax
cmp byte [ecx], bl
jne 0x7dd9eba2
push dword [ebp - 8]
push esi
push dword [ebp - 0x24]
push dword [ebp - 0xc]
push edi
call fcn.7dd96746
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, edi
jmp 0x7dd9714d