Function at 0x7dd9786f
Capabilities:
Print debug messages
Terminate process

Disassembly:
push 0x5c
push 0x7dd97990
call fcn.7dd715c0
mov dword [ebp - 0x20], 6
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], esi
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test byte [eax + 4], 0x10
jne 0x7dd97adc
mov dword [ebp - 0x2c], 1
cmp dword [eax], 0xc0000409
je 0x7dd982ee
push ebx
call fcn.7dd97a61
cmp eax, 0xffffffff
je 0x7dd97ae3
call fcn.7dd979d9
test eax, eax
jne 0x7dd97adc
mov esi, 0x7de4030c
push esi
call dword [sym.imp.ntdll.dll_RtlAcquireSRWLockExclusive]
push dword [0x7de40074]
call dword [sym.imp.ntdll.dll_RtlDecodePointer]
mov edi, eax
test edi, edi
jne 0x7ddb0340
push esi
call dword [sym.imp.ntdll.dll_RtlReleaseSRWLockExclusive]
xor edi, edi
inc edi
push ebx
call dword [sym.imp.ntdll.dll_RtlKnownExceptionFilter]
cmp eax, 0xffffffff
je 0x7dd97ae3
call fcn.7dd81859
test al, 2
jne 0x7dd97afe
call dword [sym.imp.ntdll.dll_RtlGetThreadErrorMode]
test al, 0x20
jne 0x7dd97afe
xor esi, esi
push esi
push 0x30
lea eax, [ebp - 0x6c]
push eax
push 2
push esi
call dword [sym.imp.ntdll.dll_NtQueryInformationJobObject]
test eax, eax
jl 0x7dd97945
test dword [ebp - 0x5c], 0x400
jne 0x7dd97afe
mov dword [ebp + 8], esi
push edi
push ebx
call fcn.7dd979b1
mov esi, eax
cmp esi, 8
je 0x7dd97adc
cmp esi, 6
je 0x7ddb03dd
cmp esi, 4
je 0x7ddb03e7
xor esi, esi
cmp byte [0x7de40c9c], 0
jne 0x7ddb050a
cmp dword [ebp - 0x1c], esi
jne 0x7ddb051b
mov eax, dword [ebp - 0x2c]
call fcn.7dd71605
ret 4
xor eax, eax
jmp 0x7dd97987
or eax, 0xffffffff
jmp 0x7dd97987
test eax, eax
jne 0x7dd97adc
jmp 0x7dd978f7
test eax, eax
je 0x7dd97963
jmp 0x7dd97adc
mov eax, edi
jmp 0x7dd97987
call fcn.7dd98312
test eax, eax
jne 0x7ddb0303
call fcn.7dd979d9
test eax, eax
je 0x7dd978af
jmp 0x7ddb0303
mov dword [ebp - 4], esi
push 0x7ddb0530
call sub.ntdll.dll_DbgPrint
pop ecx
int3
mov eax, dword [0x7de40320]
add eax, 0x220
push eax
push edi
call fcn.7dd78896
test eax, eax
je 0x7dd978ed
mov eax, dword [0x7de40320]
mov ecx, dword [eax]
cmp ecx, dword [eax + 0x220]
jne 0x7dd978ed
mov ecx, dword [eax + 4]
cmp ecx, dword [eax + 0x224]
jne 0x7dd978ed
mov ecx, dword [eax + 8]
cmp ecx, dword [eax + 0x228]
jne 0x7dd978ed
test ecx, 0x1040000
je 0x7ddb03ad
push 1
lea ecx, [eax + 0x22c]
push ecx
add eax, 0xc
push eax
call dword [sym.imp.ntdll.dll_RtlEqualUnicodeString]
test al, al
je 0x7dd978ed
push esi
call dword [sym.imp.ntdll.dll_RtlReleaseSRWLockExclusive]
push ebx
call edi
xor edi, edi
inc edi
cmp eax, edi
je 0x7dd97987
cmp eax, 0xffffffff
je 0x7dd97987
test eax, eax
jne 0x7dd978f7
call fcn.7dd979d9
jmp 0x7dd97aeb
call fcn.7dd979d9
jmp 0x7dd97af4
push esi
push 0x1000
push 0x24a
xor esi, esi
push esi
call fcn.7dd71833
mov dword [ebp - 0x1c], eax
cmp eax, esi
je 0x7dd97adc
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x24]
push ecx
push 0x125
push eax
push 0xffffffffffffffff
call fcn.7de1aef7
test eax, eax
jl 0x7ddb0429
mov eax, dword [ebp - 0x1c]
cmp word [eax], si
je 0x7ddb0429
mov dword [ebp + 8], edi
cmp dword [ebp - 0x24], esi
jne 0x7ddb04b3
mov eax, dword [ebx]
mov ecx, dword [eax]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x38], ecx
cmp dword [eax], 0xc0000006
jne 0x7ddb0452
cmp dword [eax + 0x10], 3
jb 0x7ddb045f
mov ecx, dword [eax + 0x1c]
jmp 0x7ddb045a
cmp dword [eax + 0x10], edi
jb 0x7ddb045f
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x34], ecx
jmp 0x7ddb0462
mov dword [ebp - 0x34], esi
cmp dword [eax + 0x10], 2
jb 0x7ddb0470
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x30], eax
jmp 0x7ddb0473
mov dword [ebp - 0x30], esi
cmp dword [ebp + 8], esi
je 0x7ddb0486
cmp byte [0x7de40c9c], 0
jne 0x7ddb0486
push 2
pop eax
jmp 0x7ddb0488
mov eax, edi
lea ecx, [ebp - 0x20]
push ecx
push eax
lea eax, [ebp - 0x3c]
push eax
push esi
push 4
push 0xd0000144
call dword [sym.imp.ntdll.dll_NtRaiseHardError]
mov ecx, eax
mov eax, 0xc0000000
and ecx, eax
cmp ecx, eax
jne 0x7ddb04b3
mov dword [ebp - 0x20], 6
cmp dword [ebp + 8], esi
je 0x7dd9796e
cmp dword [ebp - 0x20], 3
je 0x7ddb04cb
cmp dword [ebp - 0x24], esi
je 0x7dd9796e
cmp byte [0x7de40c9c], 0
jne 0x7ddb050a
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
cmp byte [eax + 0x30], 0
jne 0x7dd9796e
push dword [ebp - 0x28]
push dword [ebp - 0x1c]
push dword [ebx + 4]
push dword [ebx]
push 0xfffffffffffffffe
push 0xffffffffffffffff
call fcn.7de1b16b
test eax, eax
jge 0x7ddb0502
mov byte [0x7de40c9c], 1
mov dword [ebp - 0x2c], esi
jmp 0x7dd9797b
mov eax, dword [ebx]
push dword [eax]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtTerminateProcess]
jmp 0x7dd9797b
push 0x8000
push esi
push dword [ebp - 0x1c]
call fcn.7dd7184b
jmp 0x7dd97984