Function at 0x7dd9784f
Capabilities:
Print debug messages
Terminate process

Disassembly:
push 0x5c
push 0x7dd97970
call fcn.7dd715c0
mov dword [ebp - 0x20], 6
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], esi
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test byte [eax + 4], 0x10
jne 0x7dd97abc
mov dword [ebp - 0x2c], 1
cmp dword [eax], 0xc0000409
je 0x7dd982ce
push ebx
call fcn.7dd97a41
cmp eax, 0xffffffff
je 0x7dd97ac3
call fcn.7dd979b9
test eax, eax
jne 0x7dd97abc
mov esi, 0x7de4030c
push esi
call dword [sym.imp.ntdll.dll_RtlAcquireSRWLockExclusive]
push dword [0x7de40074]
call dword [sym.imp.ntdll.dll_RtlDecodePointer]
mov edi, eax
test edi, edi
jne 0x7ddb0360
push esi
call dword [sym.imp.ntdll.dll_RtlReleaseSRWLockExclusive]
xor edi, edi
inc edi
push ebx
call dword [sym.imp.ntdll.dll_RtlKnownExceptionFilter]
cmp eax, 0xffffffff
je 0x7dd97ac3
call fcn.7dd81829
test al, 2
jne 0x7dd97ade
call dword [sym.imp.ntdll.dll_RtlGetThreadErrorMode]
test al, 0x20
jne 0x7dd97ade
xor esi, esi
push esi
push 0x30
lea eax, [ebp - 0x6c]
push eax
push 2
push esi
call dword [sym.imp.ntdll.dll_NtQueryInformationJobObject]
test eax, eax
jl 0x7dd97925
test dword [ebp - 0x5c], 0x400
jne 0x7dd97ade
mov dword [ebp + 8], esi
push edi
push ebx
call fcn.7dd97991
mov esi, eax
cmp esi, 8
je 0x7dd97abc
cmp esi, 6
je 0x7ddb03fd
cmp esi, 4
je 0x7ddb0407
xor esi, esi
cmp byte [0x7de40c9c], 0
jne 0x7ddb052a
cmp dword [ebp - 0x1c], esi
jne 0x7ddb053b
mov eax, dword [ebp - 0x2c]
call fcn.7dd71605
ret 4
xor eax, eax
jmp 0x7dd97967
or eax, 0xffffffff
jmp 0x7dd97967
test eax, eax
jne 0x7dd97abc
jmp 0x7dd978d7
test eax, eax
je 0x7dd97943
jmp 0x7dd97abc
mov eax, edi
jmp 0x7dd97967
call fcn.7dd982f2
test eax, eax
jne 0x7ddb0323
call fcn.7dd979b9
test eax, eax
je 0x7dd9788f
jmp 0x7ddb0323
mov dword [ebp - 4], esi
push 0x7ddb0550
call sub.ntdll.dll_DbgPrint
pop ecx
int3
mov eax, dword [0x7de40320]
add eax, 0x220
push eax
push edi
call fcn.7dd788a6
test eax, eax
je 0x7dd978cd
mov eax, dword [0x7de40320]
mov ecx, dword [eax]
cmp ecx, dword [eax + 0x220]
jne 0x7dd978cd
mov ecx, dword [eax + 4]
cmp ecx, dword [eax + 0x224]
jne 0x7dd978cd
mov ecx, dword [eax + 8]
cmp ecx, dword [eax + 0x228]
jne 0x7dd978cd
test ecx, 0x1040000
je 0x7ddb03cd
push 1
lea ecx, [eax + 0x22c]
push ecx
add eax, 0xc
push eax
call dword [sym.imp.ntdll.dll_RtlEqualUnicodeString]
test al, al
je 0x7dd978cd
push esi
call dword [sym.imp.ntdll.dll_RtlReleaseSRWLockExclusive]
push ebx
call edi
xor edi, edi
inc edi
cmp eax, edi
je 0x7dd97967
cmp eax, 0xffffffff
je 0x7dd97967
test eax, eax
jne 0x7dd978d7
call fcn.7dd979b9
jmp 0x7dd97acb
call fcn.7dd979b9
jmp 0x7dd97ad4
push esi
push 0x1000
push 0x24a
xor esi, esi
push esi
call fcn.7dd71833
mov dword [ebp - 0x1c], eax
cmp eax, esi
je 0x7dd97abc
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x24]
push ecx
push 0x125
push eax
push 0xffffffffffffffff
call fcn.7de1b14b
test eax, eax
jl 0x7ddb0449
mov eax, dword [ebp - 0x1c]
cmp word [eax], si
je 0x7ddb0449
mov dword [ebp + 8], edi
cmp dword [ebp - 0x24], esi
jne 0x7ddb04d3
mov eax, dword [ebx]
mov ecx, dword [eax]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x38], ecx
cmp dword [eax], 0xc0000006
jne 0x7ddb0472
cmp dword [eax + 0x10], 3
jb 0x7ddb047f
mov ecx, dword [eax + 0x1c]
jmp 0x7ddb047a
cmp dword [eax + 0x10], edi
jb 0x7ddb047f
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x34], ecx
jmp 0x7ddb0482
mov dword [ebp - 0x34], esi
cmp dword [eax + 0x10], 2
jb 0x7ddb0490
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x30], eax
jmp 0x7ddb0493
mov dword [ebp - 0x30], esi
cmp dword [ebp + 8], esi
je 0x7ddb04a6
cmp byte [0x7de40c9c], 0
jne 0x7ddb04a6
push 2
pop eax
jmp 0x7ddb04a8
mov eax, edi
lea ecx, [ebp - 0x20]
push ecx
push eax
lea eax, [ebp - 0x3c]
push eax
push esi
push 4
push 0xd0000144
call dword [sym.imp.ntdll.dll_NtRaiseHardError]
mov ecx, eax
mov eax, 0xc0000000
and ecx, eax
cmp ecx, eax
jne 0x7ddb04d3
mov dword [ebp - 0x20], 6
cmp dword [ebp + 8], esi
je 0x7dd9794e
cmp dword [ebp - 0x20], 3
je 0x7ddb04eb
cmp dword [ebp - 0x24], esi
je 0x7dd9794e
cmp byte [0x7de40c9c], 0
jne 0x7ddb052a
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
cmp byte [eax + 0x30], 0
jne 0x7dd9794e
push dword [ebp - 0x28]
push dword [ebp - 0x1c]
push dword [ebx + 4]
push dword [ebx]
push 0xfffffffffffffffe
push 0xffffffffffffffff
call fcn.7de1b3bf
test eax, eax
jge 0x7ddb0522
mov byte [0x7de40c9c], 1
mov dword [ebp - 0x2c], esi
jmp 0x7dd9795b
mov eax, dword [ebx]
push dword [eax]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtTerminateProcess]
jmp 0x7dd9795b
push 0x8000
push esi
push dword [ebp - 0x1c]
call fcn.7dd7184b
jmp 0x7dd97964