Function at 0x77d0c883
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x2020
call sub.ntdll.dll__chkstk
mov eax, dword [0x77d260c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
push 0x77cef594
mov dword [ebp - 0x2018], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, esi
jne 0x77d0c8be
mov eax, 0xc0000412
jmp 0x77d0c9c3
push 0x77d0cc3c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
mov dword [ebp - 0x2008], eax
jne 0x77d0c8de
mov eax, 0xc000007a
jmp 0x77d0c9c3
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
mov ebx, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push edi
mov edi, 0x1000
push edi
push 8
push dword [eax + 0x18]
call ebx
cmp eax, esi
mov dword [ebp - 0x2010], eax
je 0x77d0c9d2
push edi
push esi
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x2018]
push eax
push dword [ebp - 0x2010]
push esi
push esi
push esi
call dword [ebp - 0x2008]
cmp eax, 0x6f
mov dword [ebp - 0x2014], eax
jne 0x77d0c999
push dword [ebp - 0x2010]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword fs:[0x18]
push dword [ebp - 0x2018]
mov eax, dword [eax + 0x30]
mov edi, dword [ebp - 0x2018]
push 8
push dword [eax + 0x18]
call ebx
mov ebx, eax
cmp ebx, esi
mov dword [ebp - 0x2010], ebx
je 0x77d0c9d2
push edi
push esi
push ebx
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x2018]
push eax
push ebx
push esi
push esi
push esi
call dword [ebp - 0x2008]
mov dword [ebp - 0x2014], eax
cmp dword [ebp - 0x2014], esi
je 0x77d0c9d9
mov edi, 0xc0000001
push dword [ebp - 0x2010]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.77cd6011
leave
ret 4
mov eax, 0xc0000017
jmp 0x77d0c9c1
mov edi, dword [ebp - 0x2010]
mov eax, dword [edi + 0x24]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x77d0c9e5
mov ebx, dword [edi + 0x10]
sub eax, edx
sar eax, 1
cmp ebx, esi
lea eax, [eax + eax + 2]
mov dword [ebp - 0x2008], eax
mov eax, dword [edi + 0x1c]
mov dword [ebp - 0x200c], eax
mov word [ebp - 0x1004], si
je 0x77d0ca77
mov eax, dword [ebx + 0xc]
cmp word [eax], 0x17
lea ecx, [ebp - 0x2004]
push ecx
jne 0x77d0ca30
add eax, 8
push eax
call dword [sym.imp.ntdll.dll_RtlIpv6AddressToStringW]
jmp 0x77d0ca3a
add eax, 4
push eax
call dword [sym.imp.ntdll.dll_RtlIpv4AddressToStringW]
lea eax, [ebp - 0x2004]
push eax
push 0x400
lea eax, [ebp - 0x1004]
push eax
call fcn.77cac786
test eax, eax
jl 0x77d0ca77
mov ebx, dword [ebx + 8]
cmp ebx, esi
je 0x77d0ca77
push 0x77d0cc38
push 0x400
lea eax, [ebp - 0x1004]
push eax
call fcn.77cac786
test eax, eax
jge 0x77d0ca14
lea eax, [ebp - 0x1004]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x77d0ca80
sub eax, edx
sar eax, 1
cmp dword [ebp - 0x200c], esi
lea ebx, [eax + eax + 2]
mov dword [ebp - 0x201c], ebx
mov word [ebp - 0x804], si
je 0x77d0cb1c
mov eax, dword [ebp - 0x200c]
mov eax, dword [eax + 0xc]
cmp word [eax], 0x17
lea ecx, [ebp - 0x1804]
push ecx
jne 0x77d0cac9
add eax, 8
push eax
call dword [sym.imp.ntdll.dll_RtlIpv6AddressToStringW]
jmp 0x77d0cad3
add eax, 4
push eax
call dword [sym.imp.ntdll.dll_RtlIpv4AddressToStringW]
lea eax, [ebp - 0x1804]
push eax
push 0x400
lea eax, [ebp - 0x804]
push eax
call fcn.77cac786
test eax, eax
jl 0x77d0cb1c
mov eax, dword [ebp - 0x200c]
mov eax, dword [eax + 8]
cmp eax, esi
mov dword [ebp - 0x200c], eax
je 0x77d0cb1c
push 0x77d0cc38
push 0x400
lea eax, [ebp - 0x804]
push eax
call fcn.77cac786
test eax, eax
jge 0x77d0caa7
lea eax, [ebp - 0x804]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x77d0cb25
mov ecx, dword [ebp - 0x2008]
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
mov dword [ebp - 0x200c], eax
add eax, ebx
lea eax, [eax + ecx + 0x14]
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x2020], eax
add eax, 0x20
push eax
mov eax, dword [ecx + 0x30]
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
cmp ebx, esi
je 0x77d0cc21
push dword [ebp - 0x2008]
mov word [ebx + 6], 0xb0d
mov eax, dword [edi + 0x2c]
lea esi, [ebx + 0x20]
mov dword [esi], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 4], eax
mov eax, dword [edi + 0x34]
add esi, 8
mov dword [esi], eax
mov eax, dword [edi + 4]
add esi, 4
mov dword [esi], eax
mov eax, dword [edi + 0x48]
add esi, 4
mov dword [esi], eax
push dword [edi + 0x24]
add esi, 4
push esi
call sub.ntdll.dll_memcpy
push dword [ebp - 0x201c]
add esi, dword [ebp - 0x2008]
lea eax, [ebp - 0x1004]
push eax
push esi
call sub.ntdll.dll_memcpy
push dword [ebp - 0x200c]
lea eax, [ebp - 0x804]
push eax
mov eax, dword [ebp - 0x201c]
add esi, eax
push esi
call sub.ntdll.dll_memcpy
movzx eax, word [ebp + 8]
add esp, 0x24
push ebx
push dword [ebp - 0x2020]
push 0x40000004
push eax
call dword [sym.imp.ntdll.dll_NtTraceEvent]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov edi, dword [edi + 8]
xor esi, esi
test edi, edi
je 0x77d0cc2b
jmp 0x77d0c9df
mov dword [ebp - 0x2014], 0xc0000017
mov edi, dword [ebp - 0x2014]
jmp 0x77d0c9a6