Function at 0x7ddf3883
Capabilities:
Check for peb beingdebugged flag
Get process heap force flags

Disassembly:
push 0x90
push 0x7ddf3b68
call fcn.7dd715c0
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0xc], ebx
jne 0x7ddf3b4c
mov eax, dword [esi + 8]
cmp word [eax], 2
jne 0x7ddf3b4c
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 4], 1
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword fs:[0x18]
mov edi, 0x104
push edi
push dword [ebp - 0x30]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x20], eax
cmp eax, ebx
jne 0x7ddf38fa
push 8
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
jmp 0x7ddf39d9
push ebx
push eax
push edi
push 0x7ddf3b60
push dword [ebp + 8]
push ebx
call sym.KERNEL32.dll_SearchPathA
mov dword [ebp + 0xc], eax
cmp eax, ebx
je 0x7ddf3a18
cmp eax, edi
jae 0x7ddf3a18
push 0x44
pop edi
push edi
push ebx
lea eax, [ebp - 0xa0]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0xa0], edi
mov dword [ebp - 0x74], 1
mov eax, dword [esi + 8]
mov ax, word [eax + 2]
mov word [ebp - 0x70], ax
mov eax, dword [esi + 4]
movzx eax, byte [eax]
mov dword [ebp - 0x24], eax
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword fs:[0x18]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp + 0xc]
lea edi, [ecx + edx]
lea ecx, [edi + 2]
push ecx
push dword [ebp - 0x34]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x7ddf38ed
push dword [ebp + 0xc]
push dword [ebp - 0x20]
push eax
call sub.ntdll.dll_memcpy
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
add eax, ecx
mov byte [eax], 0x20
push dword [ebp - 0x24]
mov ecx, dword [esi + 4]
inc ecx
push ecx
inc eax
push eax
call sub.ntdll.dll_memcpy
add esp, 0x18
mov eax, dword [ebp - 0x1c]
mov byte [eax + edi + 1], bl
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0xa0]
push ecx
push ebx
push dword [esi]
push ebx
push ebx
push ebx
push ebx
push eax
push dword [ebp - 0x20]
call sym.KERNEL32.dll_CreateProcessA
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], ebx
call fcn.7ddf3abf
mov dword [ebp - 4], 0xfffffffe
cmp dword [ebp - 0x28], ebx
je 0x7ddf3afc
mov eax, dword [0x7de4003c]
cmp eax, ebx
je 0x7ddf3a04
push 0x7530
push dword [ebp - 0x58]
call eax
push dword [ebp - 0x58]
mov esi, dword [sym.imp.ntdll.dll_NtClose]
call esi
push dword [ebp - 0x54]
call esi
push 0x21
jmp 0x7ddf3a3e
push dword [ebp + 8]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.ntdll.dll_RtlInitAnsiStringEx]
test eax, eax
jge 0x7ddf3a44
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x7de403ac
call fcn.7dd9d6c0
add esp, 0xc
push 2
pop eax
jmp 0x7ddf3b58
push 1
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
test eax, eax
jl 0x7ddf3a29
push dword [ebp - 0x38]
call dword [sym.imp.ntdll.dll_RtlDetermineDosPathNameType_U]
mov esi, eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
cmp esi, 5
je 0x7ddf3a29
push ebx
push 0x80
push 3
push ebx
push 3
push 0x80000000
push dword [ebp + 8]
call fcn.7dd75da6
cmp eax, 0xffffffff
je 0x7ddf3a97
push eax
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
jmp 0x7ddf3a29
call fcn.7dd711c7
mov esi, eax
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x7de403ac
call fcn.7dd9d6c0
add esp, 0xc
mov eax, esi
jmp 0x7ddf3b58
call fcn.7dd711c7
dec eax
dec eax
je 0x7ddf3a3c
dec eax
je 0x7ddf3b1a
sub eax, 0xbe
jne 0x7ddf3b56
push 0xb
jmp 0x7ddf3a3e
push 3
jmp 0x7ddf3a3e
push 0xc000000d
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
call fcn.7dd71605
ret 8