Function at 0x7ddea274
Capabilities:
Check for peb beingdebugged flag
Get process heap flags

Disassembly:
push 0x3c
push 0x7ddea690
call fcn.7dd715c0
mov esi, dword [ebp + 8]
cmp dword [esi], 8
jne 0x7ddea296
push dword [ebp + 0xc]
push esi
call fcn.7ddea0bf
jmp 0x7ddea688
mov ebx, dword [esi + 0x4c]
test ebx, ebx
je 0x7ddea2a4
mov edi, dword [esi + 0x50]
test edi, edi
jne 0x7ddea2ba
mov ebx, dword [esi + 0x54]
test ebx, ebx
je 0x7ddea683
mov edi, dword [esi + 0x58]
test edi, edi
je 0x7ddea683
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov ecx, dword fs:[0x18]
push edi
push eax
mov eax, dword [ecx + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x7ddea2e8
mov eax, 0xc0000017
jmp 0x7ddea688
and dword [ebp - 0x24], 0
and dword [ebp - 4], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x34], edi
push edi
push ebx
push dword [ebp - 0x20]
call sub.ntdll.dll_memmove
add esp, 0xc
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
and dword [ebp - 0x34], 0
xor ebx, ebx
cmp edi, ebx
je 0x7ddea555
mov eax, dword [ebp - 0x2c]
cmp byte [esi + 5], 0
je 0x7ddea427
mov dword [ebp - 0x28], eax
shr edi, 1
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], ebx
je 0x7ddea555
movzx ecx, word [eax]
cmp cx, bx
je 0x7ddea351
cmp cx, 0x20
ja 0x7ddea351
dec dword [ebp - 0x1c]
inc eax
inc eax
mov dword [ebp - 0x28], eax
jmp 0x7ddea330
cmp dword [ebp - 0x1c], ebx
je 0x7ddea555
cmp word [eax], bx
je 0x7ddea555
mov dword [ebp - 0x38], eax
mov dword [esi + 0x44], eax
cmp dword [ebp - 0x1c], ebx
je 0x7ddea555
cmp word [eax], 0x3d
je 0x7ddea382
dec dword [ebp - 0x1c]
inc eax
inc eax
mov dword [ebp - 0x28], eax
jmp 0x7ddea369
cmp dword [ebp - 0x1c], ebx
je 0x7ddea555
mov ecx, eax
inc eax
inc eax
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x1c]
mov dword [ebp - 0x40], ecx
cmp ecx, dword [esi + 0x44]
jbe 0x7ddea3aa
lea edx, [ecx - 2]
cmp word [edx], 0x20
ja 0x7ddea3aa
mov ecx, edx
jmp 0x7ddea395
sub ecx, dword [esi + 0x44]
mov word [esi + 0x40], cx
cmp cx, bx
je 0x7ddea555
add ecx, 2
mov word [esi + 0x42], cx
cmp dword [ebp - 0x1c], ebx
je 0x7ddea3d6
cmp word [eax], 0x20
jne 0x7ddea3d6
dec dword [ebp - 0x1c]
inc eax
inc eax
mov dword [ebp - 0x28], eax
jmp 0x7ddea3c1
mov dword [esi + 0x54], eax
cmp dword [ebp - 0x1c], ebx
je 0x7ddea555
cmp word [eax], bx
je 0x7ddea3f1
dec dword [ebp - 0x1c]
inc eax
inc eax
mov dword [ebp - 0x28], eax
jmp 0x7ddea3d9
cmp dword [ebp - 0x1c], ebx
je 0x7ddea555
mov cx, ax
sub cx, word [esi + 0x54]
movzx ecx, cx
mov dword [esi + 0x58], ecx
dec dword [ebp - 0x1c]
inc eax
inc eax
mov dword [ebp - 0x28], eax
mov ecx, eax
sub ecx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x2c], eax
mov edi, dword [ebp - 0x1c]
add edi, edi
mov dword [ebp - 0x28], edi
jmp 0x7ddea56f
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], ebx
je 0x7ddea555
mov cl, byte [eax]
test cl, cl
je 0x7ddea44a
cmp cl, 0x20
ja 0x7ddea44a
dec dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x2c], eax
jmp 0x7ddea42d
cmp dword [ebp - 0x1c], ebx
je 0x7ddea555
cmp byte [eax], 0
je 0x7ddea555
mov dword [ebp - 0x38], eax
mov dword [esi + 0x34], eax
cmp dword [ebp - 0x1c], ebx
je 0x7ddea555
cmp byte [eax], 0x3d
je 0x7ddea479
dec dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x2c], eax
jmp 0x7ddea462
cmp dword [ebp - 0x1c], ebx
je 0x7ddea555
mov ecx, eax
inc eax
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x1c]
mov dword [ebp - 0x44], ecx
cmp ecx, dword [esi + 0x34]
jbe 0x7ddea49f
lea edx, [ecx - 1]
cmp byte [edx], 0x20
ja 0x7ddea49f
mov ecx, edx
jmp 0x7ddea48b
sub ecx, dword [esi + 0x34]
mov word [esi + 0x30], cx
cmp cx, bx
je 0x7ddea555
inc ecx
mov word [esi + 0x32], cx
cmp dword [ebp - 0x1c], ebx
je 0x7ddea4c7
cmp byte [eax], 0x20
jne 0x7ddea4c7
dec dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x2c], eax
jmp 0x7ddea4b4
mov dword [esi + 0x4c], eax
cmp dword [ebp - 0x1c], ebx
je 0x7ddea555
cmp byte [eax], 0
je 0x7ddea4e1
dec dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x2c], eax
jmp 0x7ddea4ca
cmp dword [ebp - 0x1c], ebx
je 0x7ddea555
mov cx, ax
sub cx, word [esi + 0x4c]
movzx ecx, cx
mov dword [esi + 0x50], ecx
dec dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x2c], eax
mov ecx, eax
sub ecx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
movzx eax, word [esi + 0x32]
add eax, eax
mov word [esi + 0x42], ax
xor eax, eax
mov word [esi + 0x40], ax
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x48], eax
mov eax, dword fs:[0x18]
mov ecx, dword [esi + 0x50]
movzx edx, word [esi + 0x42]
lea ecx, [edx + ecx*2 + 2]
push ecx
push dword [ebp - 0x48]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x24], eax
cmp eax, ebx
jne 0x7ddea55d
mov dword [ebp - 0x30], 0xc0000017
mov dword [ebp - 4], ebx
jmp 0x7ddea60f
mov eax, dword [ebp - 0x24]
mov dword [esi + 0x44], eax
movzx ecx, word [esi + 0x42]
add ecx, eax
mov dword [esi + 0x54], ecx
mov edi, dword [ebp - 0x28]
push ebx
push ebx
push dword [ebp + 0xc]
push esi
call fcn.7dde9f24
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x24], ebx
je 0x7ddea5af
mov eax, dword fs:[0x18]
push dword [ebp - 0x24]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebp - 0x24], ebx
push ebx
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov edi, dword [ebp - 0x28]
cmp dword [ebp - 0x30], ebx
jge 0x7ddea313
cmp dword [ebp - 0x30], 0xc0000016
jne 0x7ddea555
push dword [ebp - 0x3c]
push dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x20]
add eax, ecx
push eax
call sub.ntdll.dll_memmove
add esp, 0xc
mov eax, dword [ebp - 0x3c]
add dword [ebp - 0x34], eax
mov dword [ebp - 0x30], ebx
jmp 0x7ddea313
mov eax, dword [ebp - 0x34]
cmp eax, ebx
je 0x7ddea634
mov byte [esi + 6], 1
mov ecx, dword [ebp - 0x20]
cmp byte [esi + 5], 0
je 0x7ddea62b
mov dword [esi + 0x54], ecx
mov dword [esi + 0x58], eax
jmp 0x7ddea631
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x50], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.7ddea64c
mov eax, dword [ebp - 0x30]
jmp 0x7ddea688
mov eax, 0xc000000d
call fcn.7dd71605
ret 8