Function at 0x7dd83c23
Capabilities:
Access pe header
Check if file exists
Check os version
Create process on windows
Get file attributes
Print debug messages
Query environment variable
Resume thread
Terminate process

Disassembly:
cmp eax, 0x200
je 0x7ddafc59
cmp eax, 0x8664
jne 0x7ddafc3d
mov dword [ebp - 0x378], 9
jmp 0x7dd844fa
push 0x654
push 0x7dd849d0
call fcn.7dd725e8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x360], eax
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x334], edx
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x33c], esi
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x454], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x458], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x374], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x3dc], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x440], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x3a4], eax
xor ebx, ebx
mov dword [ebp - 0x324], ebx
mov dword [ebp - 0x358], ebx
mov dword [ebp - 0x40c], ebx
mov dword [ebp - 0x3d0], ebx
mov dword [ebp - 0x348], ebx
mov dword [ebp - 0x368], ebx
mov dword [ebp - 0x3d4], ebx
mov dword [ebp - 0x39c], ebx
mov dword [ebp - 0x3f4], ebx
mov dword [ebp - 0x38c], ebx
xor eax, eax
mov word [ebp - 0x380], ax
lea edi, [ebp - 0x37e]
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x554], ebx
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x550]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x430], ebx
cmp edx, ebx
je 0x7dd9c27a
cmp dword [ebp - 0x3a4], ebx
je 0x7dd9a0a8
cmp dword [ebp - 0x440], ebx
je 0x7dd9a0a8
mov dword [ebp - 0x370], ebx
mov dword [ebp - 0x344], ebx
mov dword [ebp - 0x384], ebx
mov dword [ebp - 0x330], ebx
mov dword [ebp - 0x354], ebx
mov dword [ebp - 0x398], ebx
mov dword [ebp - 0x36c], ebx
mov dword [ebp - 0x388], ebx
mov dword [ebp - 0x3fc], ebx
mov dword [ebp - 0x3c4], ebx
mov dword [ebp - 0x418], ebx
mov dword [ebp - 0x51c], ebx
mov dword [ebp - 0x3b4], ebx
mov dword [ebp - 0x438], ebx
mov dword [ebp - 0x3e8], ebx
mov byte [ebp - 0x33e], bl
mov byte [ebp - 0x33f], bl
mov byte [ebp - 0x32a], bl
mov byte [ebp - 0x33d], bl
mov dword [ebp - 0x400], ebx
mov dword [ebp - 0x3a0], ebx
mov dword [ebp - 0x3ac], ebx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x3bc], ebx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x3c8], ebx
mov dword [ebp - 0x408], ebx
mov dword [ebp - 0x3a8], ebx
mov dword [ebp - 0x3f8], ebx
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], ebx
mov dword [ebp - 0x3cc], ebx
mov dword [ebp - 0x394], ebx
mov dword [ebp - 0x34c], ebx
mov dword [ebp - 0x43c], ebx
mov dword [ebp - 0x470], ebx
mov dword [ebp - 0x46c], ebx
mov dword [ebp - 0x45c], ebx
mov dword [ebp - 0x4ec], ebx
mov dword [ebp - 0x4e0], ebx
mov edi, 0x100
push edi
push ebx
lea eax, [ebp - 0x320]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x3b0], eax
mov ecx, dword [ebp + 0x20]
mov eax, ecx
and eax, 0x18
cmp al, 0x18
je 0x7ddaf0e5
mov eax, 0x800
test eax, ecx
jne 0x7ddaf0f2
test ecx, 0x1000
jne 0x7dd83e58
mov edx, dword [0x7de40064]
cmp byte [edx + 0x744], bl
jne 0x7ddaf0ff
test cl, 0x40
jne 0x7ddaf109
test ecx, 0x4000
jne 0x7ddaf115
test cl, 0x20
jne 0x7dd99a17
test ecx, 0x8000
jne 0x7ddaf121
test cl, cl
js 0x7ddaf12d
test edi, ecx
jne 0x7ddaf139
mov byte [ebp - 0x329], bl
and dword [ebp + 0x20], 0xffff3e1f
test dword [ebp + 0x20], 0x40000
jne 0x7dd9c70a
xor esi, esi
inc esi
test dword [ebp + 0x20], 0x1000000
jne 0x7ddaf15e
test dword [ebp + 0x20], 0x10000
jne 0x7ddaf169
test byte [ebp + 0x20], 3
jne 0x7ddaf174
mov dword [ebp - 0x12c], 0x20005
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x11c], 0x10003
mov dword [ebp - 0x118], 8
mov dword [ebp - 0x110], ebx
lea eax, [ebp - 0x450]
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x10c], 6
mov dword [ebp - 0x108], 0x30
mov dword [ebp - 0x100], ebx
lea eax, [ebp - 0x584]
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x328], 3
mov ecx, dword [ebp - 0x398]
push 4
pop eax
cmp ecx, ebx
jne 0x7ddaf1a4
mov ecx, dword [ebp - 0x360]
cmp ecx, ebx
jne 0x7dd9d4cf
cmp byte [ebp - 0x329], bl
jne 0x7dd99a23
test dword [ebp + 0x20], 0x4000000
jne 0x7dd9b03f
mov dword [ebp - 4], ebx
xor eax, eax
mov edi, dword [ebp - 0x3a4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
cmp dword [ebp - 0x374], ebx
je 0x7dd83fbe
mov esi, 0x400
test dword [ebp + 0x20], esi
jne 0x7dd83fbe
push 1
lea eax, [ebp - 0x3d4]
push eax
push dword [ebp - 0x374]
call dword [sym.imp.ntdll.dll_RtlCreateEnvironmentEx]
cmp eax, ebx
jl 0x7ddaf1cb
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0x374], eax
or dword [ebp + 0x20], esi
push 0x11
pop ecx
mov eax, dword [ebp - 0x440]
mov esi, eax
lea edi, [ebp - 0x634]
rep movsd dword es:[edi], dword [esi]
test dword [ebp + 0x20], 0x80000
jne 0x7dd89b98
test dword [ebp + 0x20], 0x800
jne 0x7dd8401e
mov eax, dword [ebp - 0x400]
cmp eax, ebx
jne 0x7dd83ff4
or eax, 0xffffffff
lea ecx, [ebp - 0x4c0]
push ecx
push ebx
push eax
call fcn.7dd84a42
test eax, eax
je 0x7dd8401e
cmp dword [ebp - 0x4c0], ebx
je 0x7dd8401e
mov eax, dword [ebp + 0x20]
and eax, 0xffffefff
or eax, 0x800
mov dword [ebp + 0x20], eax
test dword [ebp - 0x608], 0x100
je 0x7dd8403a
test dword [ebp - 0x608], 0x600
jne 0x7ddaf1f3
cmp dword [ebp - 0x3dc], ebx
je 0x7dd840f4
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x4c8], eax
mov eax, dword fs:[0x18]
mov dword [ebp - 0x5a4], eax
push 0x20a
push dword [ebp - 0x4c8]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
mov dword [ebp - 0x418], edi
cmp edi, ebx
je 0x7ddaf202
lea eax, [ebp - 0x51c]
push eax
push edi
push 0x103
push dword [ebp - 0x3dc]
call fcn.7dd741d1
mov esi, eax
mov dword [ebp - 0x518], esi
cmp esi, 0x104
jae 0x7dd9a082
cmp esi, ebx
je 0x7dd8a7bd
push edi
call sub.API_MS_Win_Core_File_L1_1_0.dll_GetFileAttributesW
mov dword [ebp - 0x4f4], eax
cmp eax, 0xffffffff
je 0x7dd9a082
test al, 0x10
je 0x7dd9a082
cmp word [edi + esi*2 - 2], 0x5c
je 0x7dd840f4
push 0x5c
pop eax
mov word [edi + esi*2], ax
inc esi
mov dword [ebp - 0x518], esi
xor eax, eax
mov word [edi + esi*2], ax
lea eax, [ebp - 0x4d8]
push eax
push ebx
push dword [ebp - 0x454]
lea eax, [ebp - 0x64c]
push eax
call sym.KERNEL32.dll_BaseFormatObjectAttributes
cmp eax, ebx
jl 0x7dd9a07c
lea eax, [ebp - 0x4d0]
push eax
push ebx
push dword [ebp - 0x458]
lea eax, [ebp - 0x664]
push eax
call sym.KERNEL32.dll_BaseFormatObjectAttributes
cmp eax, ebx
jl 0x7dd9a07c
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x4fc], eax
mov eax, dword [ebp - 0x4fc]
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x36c], ebx
jne 0x7ddaf217
cmp dword [ebp - 0x39c], ebx
jne 0x7ddaf241
lea eax, [ebp - 0x380]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
cmp dword [ebp - 0x3a0], ebx
jne 0x7ddaf26b
cmp dword [ebp - 0x344], ebx
jne 0x7ddaf295
mov dword [ebp - 0x3f0], ebx
mov dword [ebp - 0x420], ebx
cmp dword [ebp + 0x1c], ebx
je 0x7dd9c043
or dword [ebp - 0x34c], 4
push 0x48
pop esi
push esi
push ebx
lea eax, [ebp - 0x4b8]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x4b8], esi
or byte [ebp - 0x4b0], 2
cmp dword [ebp - 0x368], ebx
jne 0x7dd841db
cmp dword [ebp + 0x1c], ebx
je 0x7dd9c04f
cmp dword [ebp - 0x3c4], ebx
jne 0x7ddaf2b2
test byte [ebp + 0x20], 3
jne 0x7ddaf31b
cmp byte [ebp - 0x33d], bl
jne 0x7ddaf336
or byte [ebp - 0x4b0], 1
mov eax, 0x2000
mov word [ebp - 0x4ae], ax
mov dword [ebp - 0x4ac], 0x81
cmp dword [ebp - 0x62c], ebx
jne 0x7dd84234
mov eax, dword [ebp - 0x3b0]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x7c]
mov dword [ebp - 0x62c], eax
mov byte [ebp - 0x335], bl
mov byte [ebp - 0x359], bl
mov dword [ebp - 0x41c], 1
mov ecx, dword [ebp - 0x334]
cmp ecx, ebx
je 0x7dd9c287
mov eax, dword [ebp - 0x33c]
cmp eax, ebx
je 0x7ddaf3dc
cmp word [eax], bx
je 0x7ddaf3dc
cmp byte [ebp - 0x335], bl
jne 0x7ddaf3ee
cmp byte [ebp - 0x359], bl
jne 0x7ddaf3ee
push ebx
push ebx
lea eax, [ebp - 0x380]
push eax
push dword [ebp - 0x334]
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
je 0x7ddaf4b6
push dword [ebp - 0x334]
lea eax, [ebp - 0x3e4]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
cmp eax, ebx
jl 0x7dd9a07c
push dword [ebp - 0x334]
call dword [sym.imp.ntdll.dll_RtlDetermineDosPathNameType_U]
mov dword [ebp - 0x504], eax
cmp eax, 2
jne 0x7dd8a6e4
push dword [ebp - 0x334]
call fcn.7dd84a58
test eax, eax
jne 0x7dd8a6ff
push dword [ebp + 0x1c]
push dword [ebp + 0x20]
lea eax, [ebp - 0x634]
push eax
push dword [ebp - 0x374]
push dword [ebp - 0x33c]
push dword [ebp - 0x418]
push dword [ebp - 0x3e0]
push dword [ebp - 0x334]
call fcn.7dd84ab2
mov esi, eax
mov dword [ebp - 0x5dc], esi
cmp esi, ebx
je 0x7dd8a7bd
mov ecx, dword [ebp - 0x37c]
lea eax, [ebp - 0x130]
mov dword [eax + 0xc], ecx
movzx ecx, word [ebp - 0x380]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x328]
shl ecx, 4
add ecx, 4
mov dword [eax], ecx
push eax
lea eax, [ebp - 0x4b8]
push eax
push esi
push 1
push dword [ebp - 0x34c]
push dword [ebp - 0x4d0]
push dword [ebp - 0x4d8]
mov eax, 0x2000000
push eax
push eax
lea eax, [ebp - 0x354]
push eax
lea eax, [ebp - 0x330]
push eax
call dword [sym.imp.ntdll.dll_NtCreateUserProcess]
mov edi, eax
mov dword [ebp - 0x364], edi
push esi
call dword [sym.imp.ntdll.dll_RtlDestroyProcessParameters]
cmp edi, ebx
jl 0x7dd8a786
mov esi, dword [ebp - 0x4ac]
mov dword [ebp - 0x344], esi
mov eax, dword [ebp - 0x4a8]
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x574], 2
je 0x7dd843d1
cmp dword [ebp - 0x574], 3
jne 0x7ddaf9e3
movzx eax, word [ebp - 0x570]
push eax
movzx eax, word [ebp - 0x56e]
push eax
call fcn.7dd84dd7
test eax, eax
je 0x7ddaf635
test byte [ebp - 0x4b0], 8
je 0x7dd8441b
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x470], eax
mov eax, dword [ebp - 0x47c]
mov dword [ebp - 0x46c], eax
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x45c], eax
push esi
call fcn.7dd84d9d
mov dword [ebp - 0x350], eax
cmp eax, 0xc0000022
je 0x7ddafbe8
cmp eax, ebx
jl 0x7ddafbf2
push dword [ebp - 0x334]
call fcn.7dd84d34
mov dword [ebp - 0x364], eax
cmp eax, ebx
jl 0x7dd9a07c
cmp byte [ebp - 0x33e], bl
jne 0x7dd8446b
test dword [ebp + 0x20], 0x800
je 0x7dd8446b
and dword [ebp + 0x20], 0xfffff7ff
cmp dword [ebp - 0x368], ebx
jne 0x7ddafbfc
mov eax, dword [ebp - 0x488]
mov dword [ebp - 0x410], eax
cmp byte [ebp - 0x32a], bl
jne 0x7dd844b9
test dword [ebp + 0x20], 0x2000000
jne 0x7dd844b9
push dword [ebp - 0x344]
push dword [ebp - 0x334]
push dword [ebp - 0x360]
call sym.KERNEL32.dll_BasepCheckWinSaferRestrictions
mov dword [ebp - 0x4d4], eax
cmp eax, ebx
jl 0x7dd9a07c
lea esi, [ebp - 0x1e8]
lea edi, [esi + 0x20]
push 0x88
push ebx
push edi
call sub.ntdll.dll_memset
add esp, 0xc
movzx eax, word [ebp - 0x564]
cmp eax, 0x14c
jne 0x7dd81817
test byte [ebp - 0x4b0], 2
jne 0x7ddafc68
mov dword [ebp - 0x378], 0xa
test byte [ebp - 0x4b0], 1
jne 0x7dd8463a
cmp byte [ebp - 0x32a], bl
jne 0x7dd84598
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x3f0]
push eax
lea eax, [ebp - 0x3cc]
push eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x3f8]
push eax
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x3bc]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x3c8]
push eax
push dword [ebp - 0x374]
push dword [ebp - 0x37c]
push dword [ebp - 0x344]
push dword [ebp - 0x378]
movzx eax, byte [ebp - 0x4b0]
shr eax, 1
and eax, 1
push eax
lea eax, [ebp - 0x584]
push eax
push dword [ebp - 0x384]
call fcn.7dd82f10
test eax, eax
je 0x7dd8a7bd
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0x460], eax
mov dword [esi + 0x24], eax
lea eax, [ebp - 0x320]
push eax
push edi
lea eax, [ebp - 0x460]
push eax
push dword [ebp - 0x45c]
push dword [ebp - 0x46c]
push dword [ebp - 0x470]
push dword [ebp - 0x410]
mov eax, dword [ebp - 0x566]
shr eax, 9
and eax, 1
push eax
push dword [ebp - 0x434]
push dword [ebp - 0x3bc]
push dword [ebp - 0x3f8]
movzx eax, byte [ebp - 0x4b0]
shr eax, 2
and eax, 1
push eax
push dword [ebp - 0x420]
push dword [ebp - 0x3f0]
push dword [ebp - 0x384]
push dword [ebp - 0x330]
push dword [ebp - 0x344]
lea eax, [ebp - 0x3e4]
push eax
lea eax, [ebp - 0x380]
push eax
call fcn.7dd837ef
mov dword [ebp - 0x364], eax
cmp eax, ebx
jl 0x7dd9a07c
mov eax, dword [ebp - 0x488]
mov dword [esi + 0xb0], eax
mov eax, dword [ebp - 0x490]
mov dword [esi + 0xa8], eax
mov eax, dword [ebp - 0x48c]
mov dword [esi + 0xac], eax
mov eax, dword [ebp - 0x330]
mov dword [esi], eax
mov ecx, dword [ebp - 0x354]
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 0x450]
mov dword [esi + 8], ecx
mov ecx, dword [ebp - 0x44c]
mov dword [esi + 0xc], ecx
mov cx, word [ebp - 0x378]
mov word [esi + 0xb4], cx
mov ecx, dword [ebp + 0x20]
and ecx, 0xfffffffc
mov dword [esi + 0x10], ecx
push 2
pop edi
cmp dword [ebp - 0x574], edi
je 0x7dd84a04
cmp byte [ebp - 0x33e], bl
jne 0x7dd84a04
cmp dword [ebp - 0x360], ebx
jne 0x7dd9d51e
test byte [ebp - 0x608], 0x40
jne 0x7ddafc83
test byte [ebp - 0x608], 0x80
jne 0x7ddafc8b
mov eax, dword [ebp - 0x368]
mov dword [esi + 0x14], eax
cmp eax, ebx
jne 0x7ddafc93
cmp dword [ebp - 0x3c4], ebx
jne 0x7ddafcb8
test byte [ebp - 0x4b0], 1
jne 0x7dd9c719
push esi
call fcn.7dd8514d
mov dword [ebp - 0x1f0], eax
cmp eax, ebx
jl 0x7ddafcc4
test byte [ebp - 0x4b0], 1
jne 0x7dd84735
mov eax, dword [esi + 0x24]
mov dword [ebp - 0x460], eax
cmp eax, dword [ebp - 0x494]
jne 0x7ddafcdb
cmp byte [ebp - 0x33f], bl
jne 0x7dd8479d
test byte [ebp - 0x43c], 2
jne 0x7dd8479d
or dword [ebp - 0x3a8], 1
push ebx
push ebx
push dword [ebp - 0x360]
push dword [ebp - 0x3cc]
lea eax, [esi + 0xa0]
push eax
lea eax, [esi + 0x88]
push eax
push dword [ebp - 0x424]
push dword [ebp - 0x428]
lea eax, [ebp - 0x3a8]
push eax
push dword [ebp - 0x3e0]
push dword [ebp - 0x330]
call fcn.7dd8515d
mov edi, eax
mov dword [ebp - 0x364], edi
cmp edi, ebx
jl 0x7ddafd01
test byte [ebp - 0x4b0], 1
jne 0x7dd848db
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x3ac]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x3c8]
push eax
push dword [ebp - 0x378]
movzx eax, byte [ebp - 0x4b0]
shr eax, 1
and eax, 1
push eax
lea eax, [ebp - 0x584]
push eax
push dword [ebp - 0x3cc]
lea eax, [esi + 0xa0]
push eax
lea eax, [esi + 0x88]
push eax
push dword [ebp - 0x424]
push dword [ebp - 0x428]
lea eax, [ebp - 0x3a8]
push eax
push dword [ebp - 0x3e0]
call fcn.7dd836fb
cmp dword [ebp - 0x3ac], ebx
jne 0x7dd9db3d
mov eax, dword [ebp - 0x334]
mov dword [ebp - 0x554], eax
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x54c], eax
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x3ac]
mov dword [ebp - 0x548], eax
mov ax, word [ebp - 0x56e]
mov word [ebp - 0x544], ax
mov ax, word [ebp - 0x570]
mov word [ebp - 0x542], ax
add esi, 0x94
mov dword [ebp - 0x53c], esi
mov eax, dword [ebp - 0x430]
shr eax, 6
and eax, 1
mov dword [ebp - 0x540], eax
lea eax, [ebp - 0x554]
push eax
call fcn.7dd832ed
cmp eax, 1
jne 0x7dd848db
mov edx, dword [ebp - 0x538]
cmp edx, ebx
je 0x7dd848db
mov eax, dword [ebp - 0x490]
add eax, 0x368
mov ecx, dword [ebp - 0x48c]
adc ecx, ebx
mov dword [ebp - 0x534], edx
mov dword [ebp - 0x530], ebx
push ebx
push ebx
push 8
lea edx, [ebp - 0x534]
push edx
push ecx
push eax
push dword [ebp - 0x330]
call dword [sym.imp.ntdll.dll_NtWow64WriteVirtualMemory64]
cmp byte [ebp - 0x33f], bl
jne 0x7dd84911
test byte [ebp - 0x4b0], 1
jne 0x7dd84911
push dword [ebp - 0x330]
push dword [ebp - 0x378]
push dword [ebp - 0x3a8]
call fcn.7dd83174
mov dword [ebp - 0x364], eax
cmp eax, ebx
jl 0x7ddafd28
test byte [ebp + 0x20], 4
jne 0x7dd84934
push ebx
push dword [ebp - 0x354]
call dword [sym.imp.ntdll.dll_NtResumeThread]
mov esi, eax
mov dword [ebp - 0x364], esi
cmp esi, ebx
jl 0x7ddafd33
mov eax, dword [ebp - 0x370]
xor esi, esi
inc esi
mov dword [ebp - 0x324], esi
cmp dword [ebp - 0x348], ebx
jne 0x7ddafd44
mov dword [ebp - 4], esi
mov dword [ebp - 4], 2
mov dword [ebp - 0x4f8], esi
mov esi, dword [ebp - 0x3a4]
cmp eax, ebx
jne 0x7ddafd50
mov eax, dword [ebp - 0x330]
mov dword [esi], eax
mov eax, dword [ebp - 0x354]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x450]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x44c]
mov dword [esi + 0xc], eax
mov dword [ebp - 0x330], ebx
mov dword [ebp - 0x354], ebx
mov dword [ebp - 4], 1
mov dword [ebp - 0x4f8], 0
call fcn.7dd8513b
mov dword [ebp - 4], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.7dd84ea5
mov eax, dword [ebp - 0x324]
call fcn.7dd72630
ret 0x30
or eax, edi
mov dword [esi], eax
push ebx
call fcn.7dd7123a
push eax
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov dword [ebp - 0x588], eax
cmp eax, ebx
je 0x7dd846b3
cmp word [eax + 0x5c], di
jne 0x7dd846b3
or dword [esi], 1
jmp 0x7dd846b3
cmp dword [ebp - 0x634], 0x48
jne 0x7ddaf1e9
mov esi, dword [eax + 0x44]
mov dword [ebp - 0x5e8], esi
cmp esi, ebx
je 0x7dd83fde
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
push 0xf
lea ecx, [ebp - 0x328]
push ecx
lea ecx, [ebp - 0x130]
push ecx
lea ecx, [ebp - 0x400]
push ecx
lea ecx, [ebp - 0x43c]
push ecx
push ebx
push esi
call dword [eax + 0x28]
cmp eax, ebx
jge 0x7dd83fde
jmp 0x7dd9a07c
cmp eax, 6
je 0x7dd842da
cmp eax, 7
je 0x7dd842da
cmp eax, 1
je 0x7dd842da
xor eax, eax
mov word [ebp - 0x448], ax
mov word [ebp - 0x446], ax
mov dword [ebp - 0x444], ebx
push ebx
lea eax, [ebp - 0x504]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x448]
push eax
push ebx
lea eax, [ebp - 0x3e4]
push eax
call dword [sym.imp.ntdll.dll_RtlGetFullPathName_UstrEx]
cmp eax, ebx
jl 0x7dd9a07c
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0x3e4], eax
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x3e0], eax
mov dword [ebp - 0x39c], eax
mov dword [ebp - 0x444], ebx
jmp 0x7dd842ed
mov dword [ebp - 0x330], ebx
mov dword [ebp - 0x354], ebx
mov eax, dword [ebp - 0x4b4]
cmp eax, ebx
je 0x7dd8a7b7
dec eax
jne 0x7ddaf4bd
push dword [ebp - 0x334]
call dword [sym.imp.ntdll.dll_RtlIsDosDeviceName_U]
test eax, eax
jne 0x7ddaf9d9
push edi
call sym.KERNEL32.dll_BaseSetLastNTError
mov dword [ebp - 0x324], ebx
jmp 0x7dd849b5
mov byte [ebp - 0x329], 2
jmp 0x7dd83e98
mov ecx, dword [ebp - 0x328]
shl ecx, 4
mov dword [ebp + ecx - 0x12c], 0x20008
mov ecx, dword [ebp - 0x328]
shl ecx, 4
mov dword [ebp + ecx - 0x128], esi
mov ecx, dword [ebp - 0x328]
shl ecx, 4
mov dword [ebp + ecx - 0x120], ebx
mov ecx, dword [ebp - 0x328]
shl ecx, 4
lea edx, [ebp - 0x329]
mov dword [ebp + ecx - 0x124], edx
inc dword [ebp - 0x328]
jmp 0x7dd83f64
xor esi, esi
inc esi
shl esi, cl
shl esi, 2
or esi, eax
xor esi, eax
and esi, 0x1c
xor eax, esi
mov dword [ebp - 0x468], eax
jmp 0x7dd9c224
push eax
jmp 0x7dd8a7b8
push 0x10b
jmp 0x7ddaf20c
mov dword [ebp - 0x358], esi
jmp 0x7dd9c30a
cmp dword [ebp - 0x404], ebx
je 0x7ddaf38a
jmp 0x7ddaf395
push 0xc000000d
jmp 0x7ddaff6b
mov dword [ebp - 0x50c], esi
mov ecx, dword [ebp - 0x328]
shl ecx, 4
mov dword [ebp + ecx - 0x12c], 0x20009
mov ecx, dword [ebp - 0x328]
shl ecx, 4
mov dword [ebp + ecx - 0x128], eax
mov eax, dword [ebp - 0x328]
shl eax, 4
mov dword [ebp + eax - 0x120], ebx
mov eax, dword [ebp - 0x328]
shl eax, 4
lea ecx, [ebp - 0x50c]
mov dword [ebp + eax - 0x124], ecx
inc dword [ebp - 0x328]
jmp 0x7dd83f71
and dword [ebp - 0x34c], 0xfffffffb
jmp 0x7dd841a9
test dword [ebp - 0x608], 0x100
jne 0x7dd841db
cmp dword [ebp - 0x400], ebx
jne 0x7dd841db
test dword [ebp + 0x20], 0x8000018
jne 0x7dd841db
mov eax, dword [ebp - 0x468]
and eax, 0xfffffffd
or eax, 1
mov dword [ebp - 0x468], eax
mov dword [ebp - 0x464], 3
and eax, 0xffffffe3
mov dword [ebp - 0x468], eax
mov ecx, dword [ebp - 0x3b0]
mov edx, dword [ecx + 0x10]
add edx, 0x18
mov dword [ebp - 0x5b8], edx
xor ecx, ecx
jmp 0x7dd9c207
mov dword [ebp - 0x4e8], ecx
cmp ecx, 3
jae 0x7dd9c227
mov esi, dword [edx + ecx*4]
and esi, 0x10000003
cmp esi, 3
je 0x7dd9a060
inc ecx
jmp 0x7dd9c207
mov ecx, dword [ebp - 0x328]
shl ecx, 4
lea eax, [ebp - 0x130]
mov dword [ecx + eax + 4], 0x2000a
mov ecx, dword [ebp - 0x328]
shl ecx, 4
mov dword [ecx + eax + 8], 8
mov ecx, dword [ebp - 0x328]
inc ecx
shl ecx, 4
mov dword [ecx + eax], ebx
mov ecx, dword [ebp - 0x328]
shl ecx, 4
lea edx, [ebp - 0x468]
mov dword [ecx + eax + 0xc], edx
inc dword [ebp - 0x328]
jmp 0x7dd841db
cmp esi, ebx
jne 0x7dd83cf4
jmp 0x7ddaf0db
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x4bc], eax
mov eax, dword fs:[0x18]
mov dword [ebp - 0x5bc], eax
push 0x208
push dword [ebp - 0x4bc]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x36c], eax
cmp eax, ebx
je 0x7ddaf202
mov dword [ebp - 0x404], ebx
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0x334], eax
mov dword [ebp - 0x358], eax
mov esi, eax
mov dword [ebp - 0x3c0], esi
cmp word [eax], 0x22
jne 0x7dd9c6c2
mov byte [ebp - 0x35a], bl
lea esi, [eax + 2]
mov dword [ebp - 0x3c0], esi
mov dword [ebp - 0x334], esi
jmp 0x7dd9d339
mov eax, dword [ebp - 0x358]
movzx edi, word [eax]
mov dword [ebp - 0x40c], edi
xor ecx, ecx
mov word [eax], cx
cmp dword [ebp - 0x38c], ebx
jne 0x7ddaf351
lea eax, [ebp - 0x3f4]
push eax
push dword [ebp - 0x334]
call sub.KERNELBASE.dll_BaseGetProcessExePath
mov dword [ebp - 0x38c], eax
cmp eax, ebx
je 0x7ddaf36d
push ebx
push dword [ebp - 0x36c]
push 0x104
push 0x7dd7da1c
push dword [ebp - 0x334]
push dword [ebp - 0x38c]
call fcn.7dd75256
mov dword [ebp - 0x508], eax
cmp eax, ebx
je 0x7dd9a097
cmp eax, 0x104
jae 0x7ddaf374
push dword [ebp - 0x36c]
call sub.API_MS_Win_Core_File_L1_1_0.dll_GetFileAttributesW
mov dword [ebp - 0x4f4], eax
cmp eax, 0xffffffff
je 0x7dd9a097
test al, 0x10
jne 0x7ddaf37b
mov eax, dword [ebp - 0x358]
mov word [eax], di
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x334], eax
jmp 0x7dd8426f
mov byte [ebp - 0x35a], 1
mov dword [ebp - 0x334], eax
movzx eax, word [esi]
cmp ax, bx
je 0x7dd9c30a
cmp ax, 0x20
je 0x7dd9a08c
cmp ax, 9
je 0x7dd9a08c
inc esi
inc esi
mov dword [ebp - 0x3c0], esi
mov dword [ebp - 0x358], esi
jmp 0x7dd9c6cf
mov dword [ebp - 0x33c], edi
jmp 0x7dd84287
mov dword [ebp - 0x34c], 0x40
jmp 0x7dd83eac
or dword [esi + 4], edi
jmp 0x7dd84703
movzx eax, word [esi]
cmp ax, bx
je 0x7dd9c30a
cmp ax, 0x22
je 0x7dd9d35b
inc esi
inc esi
mov dword [ebp - 0x3c0], esi
mov dword [ebp - 0x358], esi
jmp 0x7dd9d339
mov dword [ebp - 0x358], esi
mov dword [ebp - 0x41c], ebx
jmp 0x7dd9c30a
mov edx, dword [ebp - 0x328]
shl edx, 4
mov dword [ebp + edx - 0x12c], 0x60002
mov edx, dword [ebp - 0x328]
shl edx, 4
mov dword [ebp + edx - 0x128], eax
mov edx, dword [ebp - 0x328]
shl edx, 4
mov dword [ebp + edx - 0x120], ebx
mov edx, dword [ebp - 0x328]
shl edx, 4
mov dword [ebp + edx - 0x124], ecx
inc dword [ebp - 0x328]
jmp 0x7dd83f58
lea eax, [ebp - 0x508]
push eax
push 4
lea eax, [ebp - 0x4dc]
push eax
push 0xc
push dword [ebp - 0x360]
call dword [sym.imp.ntdll.dll_NtQueryInformationToken]
mov dword [ebp - 0x364], eax
cmp eax, ebx
jl 0x7dd9a07c
mov eax, dword fs:[0x18]
mov dword [ebp - 0x5f0], eax
mov eax, dword [eax + 0x30]
mov ecx, dword [ebp - 0x4dc]
cmp ecx, dword [eax + 0x1d4]
je 0x7dd846bf
jmp 0x7ddafc7a
mov dword [ebp - 0x3d8], ebx
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x390], eax
push 4
push 0x1000
lea eax, [ebp - 0x390]
push eax
push ebx
lea eax, [ebp - 0x3d8]
push eax
push dword [ebp - 0x330]
call dword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
cmp eax, ebx
jl 0x7dd9a07c
push ebx
push dword [ebp - 0x42c]
push dword [ebp - 0x3ac]
push dword [ebp - 0x3d8]
push dword [ebp - 0x330]
mov edi, dword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
call edi
cmp eax, ebx
jl 0x7dd9a07c
push ebx
push 4
lea eax, [ebp - 0x3d8]
push eax
mov eax, dword [ebp - 0x410]
add eax, 0x1e8
push eax
push dword [ebp - 0x330]
call edi
mov dword [ebp - 0x364], eax
cmp eax, ebx
jl 0x7dd9a07c
mov eax, dword [ebp - 0x490]
add eax, 0x2d8
mov ecx, dword [ebp - 0x48c]
adc ecx, ebx
mov edx, dword [ebp - 0x3d8]
mov dword [ebp - 0x52c], edx
mov dword [ebp - 0x528], ebx
push ebx
push ebx
push 8
lea edx, [ebp - 0x52c]
push edx
push ecx
push eax
push dword [ebp - 0x330]
call dword [sym.imp.ntdll.dll_NtWow64WriteVirtualMemory64]
mov dword [ebp - 0x364], eax
cmp eax, ebx
jge 0x7dd8481e
jmp 0x7dd9a07c
push 0xc0000030
jmp 0x7ddaff6b
push 0x57
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
jmp 0x7ddaff70
test ecx, 0x1000
jne 0x7ddaf0e5
jmp 0x7dd83e58
or ecx, eax
mov dword [ebp + 0x20], ecx
jmp 0x7dd83e58
mov byte [ebp - 0x329], 1
jmp 0x7dd83e98
mov byte [ebp - 0x329], 5
jmp 0x7dd83e98
mov byte [ebp - 0x329], 6
jmp 0x7dd83e98
mov byte [ebp - 0x329], 3
jmp 0x7dd83e98
cmp dword [ebp - 0x360], ebx
setne al
movzx eax, al
push eax
push ebx
call fcn.7de15962
test eax, eax
setne al
add al, 3
mov byte [ebp - 0x329], al
jmp 0x7dd83e98
or dword [ebp - 0x34c], esi
jmp 0x7dd83ebc
or dword [ebp - 0x34c], edi
jmp 0x7dd83ec9
call sub.ntdll.dll_DbgUiConnectToDbg
cmp eax, ebx
jge 0x7ddaf183
push eax
jmp 0x7ddaff6b
call sub.ntdll.dll_DbgUiGetThreadDebugObject
mov dword [ebp - 0x398], eax
test byte [ebp + 0x20], 2
je 0x7dd83ed3
or dword [ebp - 0x34c], 2
jmp 0x7dd83ed3
mov dword [ebp - 0xfc], 0x60001
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0xf4], ecx
mov dword [ebp - 0x328], eax
jmp 0x7dd83f4a
push eax
call sym.KERNEL32.dll_BaseSetLastNTError
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x7de403ac
call fcn.7dd9d6c0
add esp, 0xc
jmp 0x7ddaff70
push 0xc000000d
jmp 0x7dd8a7b8
and dword [ebp - 0x608], 0xfffffeff
jmp 0x7dd8403a
push 0xc0000017
jmp 0x7dd8a7b8
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
jmp 0x7dd8a7bd
mov eax, dword fs:[0x18]
mov dword [ebp - 0x5e4], eax
push dword [ebp - 0x36c]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebp - 0x36c], ebx
jmp 0x7dd8415c
mov eax, dword fs:[0x18]
mov dword [ebp - 0x5ac], eax
push dword [ebp - 0x39c]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebp - 0x39c], ebx
jmp 0x7dd84168
mov eax, dword fs:[0x18]
mov dword [ebp - 0x5d8], eax
push dword [ebp - 0x3a0]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebp - 0x3a0], ebx
jmp 0x7dd84181
push dword [ebp - 0x344]
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x344], ebx
jmp 0x7dd8418d
mov ecx, dword [ebp - 0x328]
shl ecx, 4
lea eax, [ebp - 0x130]
mov dword [ecx + eax + 4], 0x20007
mov ecx, dword [ebp - 0x328]
shl ecx, 4
mov dword [ecx + eax + 8], 8
mov ecx, dword [ebp - 0x328]
inc ecx
shl ecx, 4
mov dword [ecx + eax], ebx
mov ecx, dword [ebp - 0x328]
shl ecx, 4
lea edx, [ebp - 0x524]
mov dword [ecx + eax + 0xc], edx
inc dword [ebp - 0x328]
mov dword [ebp - 0x524], 1
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0x520], eax
jmp 0x7dd841e7
mov eax, dword [ebp - 0x3b0]
cmp byte [eax + 1], bl
jne 0x7dd841f1
mov al, byte [ebp - 0x4af]
and al, 0xfe
or al, 2
jmp 0x7ddaf346
mov byte [ebp - 0x33d], bl
mov al, byte [ebp - 0x4af]
and al, 0xfd
or al, 1
mov byte [ebp - 0x4af], al
jmp 0x7dd841fd
push dword [ebp - 0x3f4]
push dword [ebp - 0x38c]
call sub.KERNELBASE.dll_BaseReleaseProcessExePath
mov dword [ebp - 0x38c], ebx
jmp 0x7dd9c32a
push 8
jmp 0x7ddaf20c
push 0xc0000106
jmp 0x7ddaf380
push 0xc00000ba
call sym.KERNEL32.dll_BaseSetLastNTError
jmp 0x7dd9a097
call fcn.7dd711c7
mov dword [ebp - 0x404], eax
mov eax, dword [ebp - 0x358]
mov word [eax], di
cmp word [esi], bx
je 0x7ddaf3d1
cmp byte [ebp - 0x35a], bl
je 0x7ddaf3d1
inc esi
inc esi
mov dword [ebp - 0x3c0], esi
mov dword [ebp - 0x358], esi
mov byte [ebp - 0x335], 1
mov dword [ebp - 0x41c], ebx
mov eax, dword [ebp - 0x33c]
jmp 0x7dd9c6c9
push dword [ebp - 0x404]
jmp 0x7ddaf20c
mov byte [ebp - 0x359], 1
mov dword [ebp - 0x33c], ecx
jmp 0x7dd8426f
mov eax, dword [ebp - 0x33c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x7ddaf3f7
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 6]
mov dword [ebp - 0x390], eax
mov eax, dword fs:[0x18]
mov dword [ebp - 0x5c4], eax
push dword [ebp - 0x390]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
mov dword [ebp - 0x3a0], edi
cmp edi, ebx
je 0x7dd84287
push 0x7dde2fd8
push dword [ebp - 0x390]
push edi
call fcn.7ddef8fd
mov esi, dword [ebp - 0x358]
cmp byte [ebp - 0x335], bl
je 0x7ddaf46b
movzx eax, word [esi]
mov dword [ebp - 0x40c], eax
xor eax, eax
mov word [esi], ax
push dword [ebp - 0x33c]
push dword [ebp - 0x390]
push edi
call fcn.7de16bcf
push 0x7dde2fd8
push dword [ebp - 0x390]
push edi
call fcn.7de16bcf
cmp byte [ebp - 0x335], bl
je 0x7dd9c6ff
mov ax, word [ebp - 0x40c]
mov word [esi], ax
push esi
push dword [ebp - 0x390]
push edi
call fcn.7de16bcf
jmp 0x7dd9c6ff
push 3
jmp 0x7ddaf20c
dec eax
je 0x7ddaf63f
dec eax
je 0x7ddaf635
dec eax
je 0x7ddaf5e7
dec eax
jne 0x7dd843a3
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x388], ebx
jne 0x7ddaf52c
mov eax, dword fs:[0x18]
mov dword [ebp - 0x58c], eax
push 0x20a
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x388], eax
cmp eax, ebx
jne 0x7ddaf52c
push dword [ebp - 0x414]
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [ebp - 0x350], eax
jmp 0x7ddaf36d
lea eax, [ebp - 0x514]
push eax
push 0x208
mov edi, dword [ebp - 0x388]
push edi
push 1
push 0x7ddb0088
push dword [ebp - 0x414]
call dword [sym.imp.ntdll.dll_LdrQueryImageFileKeyOption]
mov esi, eax
push dword [ebp - 0x414]
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [ebp - 0x350], eax
cmp esi, ebx
jl 0x7ddaf5b6
cmp dword [ebp - 0x514], 2
jb 0x7ddaf5b6
cmp word [edi], bx
je 0x7ddaf5b6
xor eax, eax
mov word [edi + 0x208], ax
lea eax, [ebp - 0x3ec]
push eax
push dword [ebp - 0x33c]
push ebx
push edi
push 3
call fcn.7de16a35
test eax, eax
je 0x7dd8a7bd
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x334], ebx
jmp 0x7dd84144
mov eax, dword fs:[0x18]
mov dword [ebp - 0x590], eax
push dword [ebp - 0x388]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebp - 0x388], ebx
mov byte [ebp - 0x33d], 1
jmp 0x7dd84144
mov dword [ebp - 0x4c4], 6
lea eax, [ebp - 0x380]
mov dword [ebp - 0x5b4], eax
lea eax, [ebp - 0x4c4]
push eax
push 1
lea eax, [ebp - 0x5b4]
push eax
push 1
push 1
push 0x40000023
call dword [sym.imp.ntdll.dll_NtRaiseHardError]
mov eax, dword [ebp - 0x3b0]
cmp dword [eax + 0xb8], 3
jbe 0x7ddaf635
push 0xd8
jmp 0x7ddaf20c
push 0xc1
jmp 0x7ddaf20c
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x344], eax
cmp edi, 0xc0000022
jne 0x7ddaf65a
push 5
jmp 0x7ddaf20c
mov eax, 0xc000012f
cmp byte [ebp - 0x32a], bl
jne 0x7dd8a7b7
cmp edi, eax
jne 0x7ddaf82f
cmp word [ebp - 0x380], 8
jb 0x7ddaf842
movzx eax, word [ebp - 0x380]
shr eax, 1
mov ecx, dword [ebp - 0x37c]
lea esi, [ecx + eax*2 - 8]
mov dword [ebp - 0x598], esi
push 4
push 0x7ddb007c
push esi
call dword [sym.imp.ntdll.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x7ddaf6c8
push 4
push 0x7ddb0070
push esi
call dword [sym.imp.ntdll.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x7ddaf83d
mov byte [ebp - 0x33f], 1
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x3f0]
push eax
lea eax, [ebp - 0x3cc]
push eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x3f8]
push eax
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x3bc]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x3c8]
push eax
push dword [ebp - 0x374]
push dword [ebp - 0x37c]
push dword [ebp - 0x344]
push ebx
push ebx
push ebx
push ebx
call fcn.7dd82f10
mov dword [ebp - 0x324], eax
cmp eax, ebx
je 0x7dd849b5
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x500], eax
mov eax, dword fs:[0x18]
mov dword [ebp - 0x5a0], eax
push 0x20e
push dword [ebp - 0x500]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
mov dword [ebp - 0x3b4], esi
cmp esi, ebx
je 0x7ddaf202
mov edi, 0x104
push edi
push esi
push 0x7ddb0060
call sub.API_MS_Win_Core_ProcessEnvironment_L1_1_0.dll_GetEnvironmentVariableW
mov dword [ebp - 0x3b8], eax
cmp eax, edi
jb 0x7ddaf7a4
push 0xc000000f
jmp 0x7dd8a7b8
cmp eax, ebx
jne 0x7ddaf7d5
push 0xf3
push esi
push 0x7ddb34ac
call sub.API_MS_Win_Core_ProcessEnvironment_L1_1_0.dll_GetEnvironmentVariableW
mov dword [ebp - 0x3b8], eax
cmp eax, 0xf3
jae 0x7ddaf825
cmp eax, ebx
je 0x7ddaf825
push 0x7ddb003c
push edi
push esi
call fcn.7ddf3cd5
push 0x7ddb0034
push 0x107
push esi
call fcn.7ddf3cd5
lea eax, [ebp - 0x3ec]
push eax
push dword [ebp - 0x33c]
push ebx
push esi
push dword [ebp - 0x41c]
call fcn.7de16a35
test eax, eax
je 0x7dd8a7bd
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x334], ebx
mov byte [ebp - 0x32a], 1
jmp 0x7dd84144
push 0xc0000103
jmp 0x7dd8a7b8
cmp byte [ebp - 0x32a], bl
jne 0x7dd8a7b7
jmp 0x7ddaf842
mov eax, 0xc000012f
test dword [ebp + 0x20], 0x2000000
jne 0x7ddaf8b6
mov byte [ebp - 0x35b], 1
cmp edi, 0xc000011b
je 0x7ddaf889
cmp edi, eax
je 0x7ddaf872
jle 0x7ddaf883
cmp edi, 0xc0000131
jle 0x7ddaf889
cmp edi, 0xc0000267
jne 0x7ddaf883
jmp 0x7ddaf889
push eax
lea eax, [ebp - 0x380]
push eax
call fcn.7ddf981a
test eax, eax
jne 0x7ddaf889
mov byte [ebp - 0x35b], bl
cmp byte [ebp - 0x35b], bl
je 0x7ddaf8b6
push dword [ebp - 0x344]
push dword [ebp - 0x334]
push dword [ebp - 0x360]
call sym.KERNEL32.dll_BasepCheckWinSaferRestrictions
mov dword [ebp - 0x4d4], eax
cmp eax, ebx
jl 0x7dd9a07c
cmp edi, 0xc0000131
jne 0x7ddaf92f
push ebx
push dword [ebp - 0x3a4]
push dword [ebp - 0x440]
push dword [ebp - 0x3dc]
push dword [ebp - 0x374]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp - 0x458]
push dword [ebp - 0x454]
push dword [ebp - 0x33c]
push dword [ebp - 0x334]
push dword [ebp - 0x360]
call fcn.7ddf42f5
mov dword [ebp - 0x324], eax
cmp eax, ebx
jne 0x7dd849b5
call fcn.7dd711c7
cmp eax, 0xd8
jne 0x7dd849b5
lea eax, [ebp - 0x380]
push eax
call fcn.7ddf3170
jmp 0x7dd849b5
lea eax, [ebp - 0x370]
push eax
lea eax, [ebp - 0x3c4]
push eax
lea eax, [ebp - 0x368]
push eax
lea eax, [ebp - 0x348]
push eax
lea eax, [ebp - 0x4e4]
push eax
lea eax, [ebp - 0x4f0]
push eax
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0x3d0]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x33e]
push eax
lea eax, [ebp - 0x380]
push eax
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x20]
push eax
push dword [ebp - 0x3dc]
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0x334]
push eax
push dword [ebp - 0x3e0]
push dword [ebp - 0x360]
push edi
call fcn.7ddf3eb5
mov dword [ebp - 0x324], eax
cmp eax, ebx
je 0x7dd849b5
mov eax, dword [ebp - 0x370]
cmp eax, ebx
je 0x7ddaf819
jmp 0x7dd8493a
push 0x4b0
jmp 0x7ddaf20c
cmp dword [ebp - 0x574], 7
jne 0x7ddafbde
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x4cc], eax
mov eax, dword fs:[0x18]
mov dword [ebp - 0x5a8], eax
push 0x20e
push dword [ebp - 0x4cc]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
mov dword [ebp - 0x3b4], esi
cmp esi, ebx
je 0x7ddaf202
mov dword [ebp - 0x3b8], 0x208
lea eax, [ebp - 0x3b8]
push eax
push esi
push ebx
push 2
push 0x7ddb0024
push 0x7ddafff0
push 0x80000002
call sym.KERNEL32.dll_RegGetValueW
mov dword [ebp - 0x5cc], eax
cmp eax, ebx
je 0x7ddafb17
mov edi, 0xf1
push edi
push esi
push 0x7ddb34ac
call sub.API_MS_Win_Core_ProcessEnvironment_L1_1_0.dll_GetEnvironmentVariableW
mov dword [ebp - 0x3b8], eax
cmp eax, edi
jae 0x7ddaf825
cmp eax, ebx
je 0x7ddaf825
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x510], eax
mov eax, dword fs:[0x18]
mov dword [ebp - 0x5d4], eax
push 0x410
push dword [ebp - 0x510]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
mov dword [ebp - 0x438], edi
cmp edi, ebx
je 0x7ddaf202
mov esi, dword [ebp - 0x3b4]
push esi
push esi
push 0x7ddaffd0
push 0x208
push edi
call fcn.7dded631
add esp, 0x14
push ebx
push esi
push 0x104
push ebx
push 0x7ddaffbc
push edi
call fcn.7dd75256
mov dword [ebp - 0x3b8], eax
cmp eax, 0x104
jae 0x7ddaf825
cmp eax, ebx
je 0x7ddaf825
push 0x7ddaffb4
push 0x107
push esi
call fcn.7ddf3cd5
lea eax, [ebp - 0x3ec]
push eax
push dword [ebp - 0x33c]
push dword [ebp - 0x334]
push esi
push 2
call fcn.7de16a35
test eax, eax
je 0x7dd8a7bd
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x334], ebx
cmp dword [ebp - 0x398], ebx
je 0x7ddafb75
push dword [ebp - 0x398]
push dword [ebp - 0x330]
call sub.ntdll.dll_NtRemoveProcessDebug
push dword [ebp - 0x394]
push dword [ebp - 0x330]
call dword [sym.imp.ntdll.dll_NtTerminateProcess]
push ebx
push ebx
push dword [ebp - 0x330]
call dword [sym.imp.ntdll.dll_NtWaitForSingleObject]
push dword [ebp - 0x330]
mov esi, dword [sym.imp.ntdll.dll_NtClose]
call esi
mov dword [ebp - 0x330], ebx
push dword [ebp - 0x354]
call esi
mov dword [ebp - 0x354], ebx
push dword [ebp - 0x384]
call esi
mov dword [ebp - 0x384], ebx
push dword [ebp - 0x344]
call esi
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x344], ebx
jmp 0x7ddaf819
push 0x81
jmp 0x7ddaf20c
push 0x4fd
jmp 0x7ddaf20c
push 0x4fe
jmp 0x7ddaf20c
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x370], eax
push dword [ebp - 0x368]
push dword [ebp - 0x3d0]
lea eax, [ebp - 0x370]
push eax
push 1
call fcn.7ddf9731
test eax, eax
jne 0x7ddafc31
mov dword [ebp - 0x370], ebx
jmp 0x7dd8a7bd
or dword [ebp - 0x348], 2
jmp 0x7dd84477
push eax
push 0x7ddaff78
call sub.ntdll.dll_DbgPrint
pop ecx
pop ecx
mov dword [ebp - 0x378], 0xffff
jmp 0x7dd844fa
mov dword [ebp - 0x378], 6
jmp 0x7dd844fa
movzx eax, word [0x7de40350]
mov dword [ebp - 0x378], eax
jmp 0x7dd844fa
or dword [esi + 4], 1
jmp 0x7dd846bf
or dword [esi], 1
jmp 0x7dd846cc
and dword [esi], 0xfffffffe
jmp 0x7dd846d9
mov ecx, dword [ebp - 0x3d0]
cmp ecx, ebx
je 0x7ddafca1
xor eax, eax
jmp 0x7ddafcad
mov eax, dword [ebp - 0x3b0]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x10]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], ecx
jmp 0x7dd846f6
mov dword [esi + 0x14], 0x80
jmp 0x7dd846f6
push eax
call sym.KERNEL32.dll_BaseSetLastNTError
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x394], eax
jmp 0x7dd8a7bd
lea ecx, [ebp - 0x4b8]
push ecx
push eax
push dword [ebp - 0x330]
call fcn.7de169e7
mov dword [ebp - 0x364], eax
cmp eax, ebx
jge 0x7dd84735
jmp 0x7dd9a07c
cmp edi, 0xc000042c
jne 0x7ddafd17
test byte [ebp - 0x43c], 1
jne 0x7ddafd17
call fcn.7ddeb388
push edi
call sym.KERNEL32.dll_BaseSetLastNTError
mov dword [ebp - 0x394], edi
jmp 0x7dd8a7bd
mov dword [ebp - 0x394], eax
jmp 0x7dd9a07c
push esi
call sym.KERNEL32.dll_BaseSetLastNTError
mov dword [ebp - 0x394], esi
jmp 0x7dd8a7bd
or dword [ebp - 0x348], 8
jmp 0x7dd8494f
cmp dword [ebp - 0x368], 0x20
jne 0x7ddafd75
or eax, 2
mov dword [esi], eax
test byte [ebp - 0x348], 4
je 0x7ddafd7a
mov dword [ebp - 0x450], ebx
mov dword [ebp - 0x44c], ebx
jmp 0x7ddafd7a
or eax, 1
mov dword [esi], eax
cmp dword [ebp - 0x330], ebx
je 0x7dd84975
push dword [ebp - 0x330]
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [ebp - 0x350], eax
jmp 0x7dd84975
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
jmp 0x7dd849c7