Function at 0x7dd97141
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 8], ebx
call fcn.7dd7f201
test eax, eax
jge 0x7dd9ea33
cmp dword [edi], 8
jne 0x7dd9e9dd
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
mov eax, dword [edi + 0x64]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 0xc]
cmp byte [eax + 0x19], bl
je 0x7dd9ea0f
lea eax, [ebp - 0x14]
push eax
push ebx
push edi
call fcn.7dd7e941
test al, al
jne 0x7dd9ea04
mov eax, 0xc000000d
jmp 0x7dd9716d
mov eax, dword [ebp - 0x14]
movzx eax, word [eax]
add eax, 8
jmp 0x7dd9ea27
push ebx
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.7dd7e941
test al, al
je 0x7dd9e9fa
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax]
add eax, 4
mov dword [ebp - 8], eax
mov byte [ebp - 1], 1
mov dword [ebp - 0x24], ebx
jmp 0x7dd9ea72
cmp dword [edi], 8
jne 0x7dd9ea3d
mov eax, dword [edi + 0x60]
jmp 0x7dd9ea40
mov eax, dword [edi + 0x5c]
mov dword [ebp - 0xc], eax
xor eax, eax
cmp dword [edi], 8
sete al
inc eax
inc eax
push eax
push edi
call fcn.7dd7f0cd
cmp eax, 0x105
je 0x7dd9ea43
cmp eax, 0x8000001a
jne 0x7dd9716d
mov eax, dword [edi + 0x5c]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], bl
mov dword [ebp - 0x24], eax
cmp dword [edi], 8
jne 0x7dd9ea7e
xor esi, esi
jmp 0x7dd9ebe7
mov eax, dword [edi + 0xc]
cmp byte [eax + 0x19], bl
lea eax, [ebp - 0x10]
push eax
je 0x7dd9eabf
lea eax, [ebp - 0x18]
push eax
push ebx
push edi
call fcn.7dd963ed
test al, al
je 0x7dd9e9fa
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
dec ecx
dec ecx
add dword [ebp - 8], ecx
jmp 0x7dd9eab8
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x7dd9eaaa
add dword [ebp - 8], 2
cmp word [eax], bx
je 0x7dd9eaec
jmp 0x7dd9eaaa
push ebx
lea eax, [ebp - 0x20]
push eax
push edi
call fcn.7dd963ed
test al, al
je 0x7dd9e9fa
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
dec ecx
add dword [ebp - 8], ecx
jmp 0x7dd9eae8
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x7dd9eade
inc dword [ebp - 8]
cmp byte [eax], bl
jne 0x7dd9eade
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov edx, dword [ebp - 8]
mov eax, dword [eax + 0x2c]
mov ecx, dword fs:[0x18]
add edx, 2
push edx
push eax
mov eax, dword [ecx + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
cmp esi, ebx
jne 0x7dd9eb1f
mov eax, 0xc0000017
jmp 0x7dd9716d
mov eax, dword [edi + 0xc]
cmp byte [eax + 0x19], bl
mov eax, esi
je 0x7dd9eb9b
cmp byte [ebp - 1], bl
je 0x7dd9eb6e
mov ecx, dword [ebp - 0x14]
push 0x5b
pop eax
mov word [esi], ax
mov edx, dword [ecx + 4]
movzx ecx, word [ecx]
shr ecx, 1
lea eax, [esi + 2]
je 0x7dd9eb56
mov di, word [edx]
dec ecx
mov word [eax], di
inc eax
inc eax
inc edx
inc edx
cmp ecx, ebx
jne 0x7dd9eb44
mov edi, dword [ebp + 8]
push 0x5d
pop ecx
mov word [eax], cx
inc eax
inc eax
push 0xd
pop ecx
mov word [eax], cx
inc eax
inc eax
push 0xa
pop ecx
mov word [eax], cx
inc eax
inc eax
mov ecx, dword [ebp - 0x18]
jmp 0x7dd9eb94
inc ecx
inc ecx
inc eax
inc eax
movzx edx, word [ecx]
mov word [eax], dx
cmp dx, bx
jne 0x7dd9eb73
push 0xd
inc ecx
pop edx
mov word [eax], dx
inc ecx
inc eax
inc eax
push 0xa
pop edx
mov word [eax], dx
inc eax
inc eax
cmp word [ecx], bx
je 0x7dd9ebe7
jmp 0x7dd9eb77
cmp byte [ebp - 1], bl
je 0x7dd9ebcb
mov ecx, dword [ebp - 0x1c]
mov byte [esi], 0x5b
mov edx, dword [ecx + 4]
movzx edi, word [ecx]
lea eax, [esi + 1]
jmp 0x7dd9ebb8
mov cl, byte [edx]
dec edi
mov byte [eax], cl
inc eax
inc edx
cmp edi, ebx
jne 0x7dd9ebb1
mov edi, dword [ebp + 8]
mov byte [eax], 0x5d
inc eax
mov byte [eax], 0xd
inc eax
mov byte [eax], 0xa
inc eax
mov ecx, dword [ebp - 0x20]
jmp 0x7dd9ebe3
inc ecx
inc eax
mov dl, byte [ecx]
mov byte [eax], dl
cmp dl, bl
jne 0x7dd9ebd0
mov byte [eax], 0xd
inc ecx
inc eax
mov byte [eax], 0xa
inc eax
cmp byte [ecx], bl
jne 0x7dd9ebd2
push dword [ebp - 8]
push esi
push dword [ebp - 0x24]
push dword [ebp - 0xc]
push edi
call fcn.7dd96766
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, edi
jmp 0x7dd9716d