Function at 0xdd5778
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
mov eax, 0x103e794
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
call fcn.00f4f878
cmp dword [ebx + 4], 0
jne 0xdd5879
push 0x50
call fcn.00f4dd50
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0xdd5864
mov word [ebp - 0x1c], 0x14
mov edx, dword [ebp - 4]
mov dword [edx], 1
mov esi, dword [ebp - 4]
add esi, 4
xor eax, eax
mov dword [esi], eax
mov byte [esi + 4], 0
inc dword [ebp - 0x10]
mov edi, dword [ebp - 4]
add edi, 0xc
xor eax, eax
mov dword [edi], eax
mov byte [edi + 4], 0
inc dword [ebp - 0x10]
mov edx, dword [ebp - 4]
add edx, 0x14
mov dword [ebp - 0x30], edx
mov ecx, dword [ebp - 0x30]
xor eax, eax
mov dword [ecx], eax
mov edx, dword [ebp - 0x30]
mov byte [edx + 4], 0
inc dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
add ecx, 0x1c
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
xor edx, edx
mov dword [eax], edx
mov ecx, dword [ebp - 0x34]
mov byte [ecx + 4], 0
inc dword [ebp - 0x10]
mov eax, dword [ebp - 4]
add eax, 0x24
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
xor ecx, ecx
mov dword [edx], ecx
mov eax, dword [ebp - 0x38]
mov byte [eax + 4], 0
inc dword [ebp - 0x10]
mov edx, dword [ebp - 4]
add edx, 0x2c
mov dword [ebp - 0x3c], edx
mov ecx, dword [ebp - 0x3c]
xor eax, eax
mov dword [ecx], eax
mov edx, dword [ebp - 0x3c]
mov byte [edx + 4], 0
inc dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
add ecx, 0x38
push ecx
call fcn.00e1bf70
pop ecx
add dword [ebp - 0x10], 2
add dword [ebp - 0x10], 0xfffffff8
mov word [ebp - 0x1c], 8
mov eax, dword [ebp - 4]
jmp 0xdd5867
mov eax, dword [ebp - 4]
mov dword [ebx + 4], eax
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
jmp 0xdd59f7
mov ecx, dword [ebx + 4]
cmp dword [ecx], 1
jne 0xdd588f
mov eax, dword [ebp - 0x2c]
mov dword fs:[0], eax
jmp 0xdd59f7
push 0x50
call fcn.00f4dd50
pop ecx
mov dword [ebp - 8], eax
test eax, eax
je 0xdd595b
mov word [ebp - 0x1c], 0x2c
mov edx, dword [ebp - 8]
mov dword [edx], 1
mov esi, dword [ebp - 8]
add esi, 4
xor eax, eax
mov dword [esi], eax
mov byte [esi + 4], 0
inc dword [ebp - 0x10]
mov edi, dword [ebp - 8]
add edi, 0xc
xor eax, eax
mov dword [edi], eax
mov byte [edi + 4], 0
inc dword [ebp - 0x10]
mov edx, dword [ebp - 8]
add edx, 0x14
mov dword [ebp - 0x40], edx
mov ecx, dword [ebp - 0x40]
xor eax, eax
mov dword [ecx], eax
mov edx, dword [ebp - 0x40]
mov byte [edx + 4], 0
inc dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
add ecx, 0x1c
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
xor edx, edx
mov dword [eax], edx
mov ecx, dword [ebp - 0x44]
mov byte [ecx + 4], 0
inc dword [ebp - 0x10]
mov eax, dword [ebp - 8]
add eax, 0x24
mov dword [ebp - 0x48], eax
mov edx, dword [ebp - 0x48]
xor ecx, ecx
mov dword [edx], ecx
mov eax, dword [ebp - 0x48]
mov byte [eax + 4], 0
inc dword [ebp - 0x10]
mov edx, dword [ebp - 8]
add edx, 0x2c
mov dword [ebp - 0x4c], edx
mov ecx, dword [ebp - 0x4c]
xor eax, eax
mov dword [ecx], eax
mov edx, dword [ebp - 0x4c]
mov byte [edx + 4], 0
inc dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
add ecx, 0x38
push ecx
call fcn.00e1bf70
pop ecx
add dword [ebp - 0x10], 2
add dword [ebp - 0x10], 0xfffffff8
mov word [ebp - 0x1c], 0x20
mov eax, dword [ebp - 8]
jmp 0xdd595e
mov eax, dword [ebp - 8]
mov esi, eax
mov edx, dword [ebx + 4]
mov ecx, dword [edx + 4]
mov dword [esi + 4], ecx
mov eax, dword [ebx + 4]
mov dl, byte [eax + 8]
mov byte [esi + 8], dl
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x14]
mov dword [esi + 0x14], eax
mov edx, dword [ebx + 4]
mov cl, byte [edx + 0x18]
mov byte [esi + 0x18], cl
mov eax, dword [ebx + 4]
mov edx, dword [eax + 0x24]
mov dword [esi + 0x24], edx
mov ecx, dword [ebx + 4]
mov al, byte [ecx + 0x28]
mov byte [esi + 0x28], al
mov edx, dword [ebx + 4]
mov ecx, dword [edx + 0xc]
mov dword [esi + 0xc], ecx
mov eax, dword [ebx + 4]
mov dl, byte [eax + 0x10]
mov byte [esi + 0x10], dl
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x1c]
mov dword [esi + 0x1c], eax
mov edx, dword [ebx + 4]
mov cl, byte [edx + 0x20]
mov byte [esi + 0x20], cl
mov eax, dword [ebx + 4]
mov edx, dword [eax + 0x2c]
mov dword [esi + 0x2c], edx
mov ecx, dword [ebx + 4]
mov al, byte [ecx + 0x30]
mov byte [esi + 0x30], al
mov edx, dword [ebx + 4]
add edx, 0x38
push edx
lea ecx, [esi + 0x38]
push ecx
call fcn.00e1c4c4
mov eax, dword [ebx + 4]
add esp, 8
dec dword [eax]
mov dword [ebx + 4], esi
sete dl
and edx, 1
mov ecx, dword [ebp - 0x2c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret