Function at 0x7ddf3abb
Capabilities:
Check for peb beingdebugged flag
Get process heap force flags

Disassembly:
push 0x90
push 0x7ddf3da0
call fcn.7dd715c0
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0xc], ebx
jne 0x7ddf3d84
mov eax, dword [esi + 8]
cmp word [eax], 2
jne 0x7ddf3d84
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 4], 1
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword fs:[0x18]
mov edi, 0x104
push edi
push dword [ebp - 0x30]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x20], eax
cmp eax, ebx
jne 0x7ddf3b32
push 8
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
jmp 0x7ddf3c11
push ebx
push eax
push edi
push 0x7ddf3d98
push dword [ebp + 8]
push ebx
call sym.KERNEL32.dll_SearchPathA
mov dword [ebp + 0xc], eax
cmp eax, ebx
je 0x7ddf3c50
cmp eax, edi
jae 0x7ddf3c50
push 0x44
pop edi
push edi
push ebx
lea eax, [ebp - 0xa0]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0xa0], edi
mov dword [ebp - 0x74], 1
mov eax, dword [esi + 8]
mov ax, word [eax + 2]
mov word [ebp - 0x70], ax
mov eax, dword [esi + 4]
movzx eax, byte [eax]
mov dword [ebp - 0x24], eax
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword fs:[0x18]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp + 0xc]
lea edi, [ecx + edx]
lea ecx, [edi + 2]
push ecx
push dword [ebp - 0x34]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x7ddf3b25
push dword [ebp + 0xc]
push dword [ebp - 0x20]
push eax
call sub.ntdll.dll_memcpy
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
add eax, ecx
mov byte [eax], 0x20
push dword [ebp - 0x24]
mov ecx, dword [esi + 4]
inc ecx
push ecx
inc eax
push eax
call sub.ntdll.dll_memcpy
add esp, 0x18
mov eax, dword [ebp - 0x1c]
mov byte [eax + edi + 1], bl
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0xa0]
push ecx
push ebx
push dword [esi]
push ebx
push ebx
push ebx
push ebx
push eax
push dword [ebp - 0x20]
call sym.KERNEL32.dll_CreateProcessA
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], ebx
call fcn.7ddf3cf7
mov dword [ebp - 4], 0xfffffffe
cmp dword [ebp - 0x28], ebx
je 0x7ddf3d34
mov eax, dword [0x7de4003c]
cmp eax, ebx
je 0x7ddf3c3c
push 0x7530
push dword [ebp - 0x58]
call eax
push dword [ebp - 0x58]
mov esi, dword [sym.imp.ntdll.dll_NtClose]
call esi
push dword [ebp - 0x54]
call esi
push 0x21
jmp 0x7ddf3c76
push dword [ebp + 8]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.ntdll.dll_RtlInitAnsiStringEx]
test eax, eax
jge 0x7ddf3c7c
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x7de403ac
call fcn.7dd9d690
add esp, 0xc
push 2
pop eax
jmp 0x7ddf3d90
push 1
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
test eax, eax
jl 0x7ddf3c61
push dword [ebp - 0x38]
call dword [sym.imp.ntdll.dll_RtlDetermineDosPathNameType_U]
mov esi, eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
cmp esi, 5
je 0x7ddf3c61
push ebx
push 0x80
push 3
push ebx
push 3
push 0x80000000
push dword [ebp + 8]
call sym.KERNEL32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x7ddf3ccf
push eax
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
jmp 0x7ddf3c61
call fcn.7dd711c7
mov esi, eax
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x7de403ac
call fcn.7dd9d690
add esp, 0xc
mov eax, esi
jmp 0x7ddf3d90
call fcn.7dd711c7
dec eax
dec eax
je 0x7ddf3c74
dec eax
je 0x7ddf3d52
sub eax, 0xbe
jne 0x7ddf3d8e
push 0xb
jmp 0x7ddf3c76
push 3
jmp 0x7ddf3c76
push 0xc000000d
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
call fcn.7dd71605
ret 8