Function at 0x77cffa23
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x2020
call sub.ntdll.dll__chkstk
mov eax, dword [0x77d1a0c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
push 0x77ce0d94
mov dword [ebp - 0x2018], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, esi
jne 0x77cffa5e
mov eax, 0xc0000412
jmp 0x77cffb63
push 0x77cffddc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
mov dword [ebp - 0x2008], eax
jne 0x77cffa7e
mov eax, 0xc000007a
jmp 0x77cffb63
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
mov ebx, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push edi
mov edi, 0x1000
push edi
push 8
push dword [eax + 0x18]
call ebx
cmp eax, esi
mov dword [ebp - 0x2010], eax
je 0x77cffb72
push edi
push esi
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x2018]
push eax
push dword [ebp - 0x2010]
push esi
push esi
push esi
call dword [ebp - 0x2008]
cmp eax, 0x6f
mov dword [ebp - 0x2014], eax
jne 0x77cffb39
push dword [ebp - 0x2010]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword fs:[0x18]
push dword [ebp - 0x2018]
mov eax, dword [eax + 0x30]
mov edi, dword [ebp - 0x2018]
push 8
push dword [eax + 0x18]
call ebx
mov ebx, eax
cmp ebx, esi
mov dword [ebp - 0x2010], ebx
je 0x77cffb72
push edi
push esi
push ebx
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x2018]
push eax
push ebx
push esi
push esi
push esi
call dword [ebp - 0x2008]
mov dword [ebp - 0x2014], eax
cmp dword [ebp - 0x2014], esi
je 0x77cffb79
mov edi, 0xc0000001
push dword [ebp - 0x2010]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.77cc744e
leave
ret 4
mov eax, 0xc0000017
jmp 0x77cffb61
mov edi, dword [ebp - 0x2010]
mov eax, dword [edi + 0x24]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x77cffb85
mov ebx, dword [edi + 0x10]
sub eax, edx
sar eax, 1
cmp ebx, esi
lea eax, [eax + eax + 2]
mov dword [ebp - 0x2008], eax
mov eax, dword [edi + 0x1c]
mov dword [ebp - 0x200c], eax
mov word [ebp - 0x1004], si
je 0x77cffc17
mov eax, dword [ebx + 0xc]
cmp word [eax], 0x17
lea ecx, [ebp - 0x2004]
push ecx
jne 0x77cffbd0
add eax, 8
push eax
call dword [sym.imp.ntdll.dll_RtlIpv6AddressToStringW]
jmp 0x77cffbda
add eax, 4
push eax
call dword [sym.imp.ntdll.dll_RtlIpv4AddressToStringW]
lea eax, [ebp - 0x2004]
push eax
push 0x400
lea eax, [ebp - 0x1004]
push eax
call fcn.77ca0f32
test eax, eax
jl 0x77cffc17
mov ebx, dword [ebx + 8]
cmp ebx, esi
je 0x77cffc17
push 0x77cffdd8
push 0x400
lea eax, [ebp - 0x1004]
push eax
call fcn.77ca0f32
test eax, eax
jge 0x77cffbb4
lea eax, [ebp - 0x1004]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x77cffc20
sub eax, edx
sar eax, 1
cmp dword [ebp - 0x200c], esi
lea ebx, [eax + eax + 2]
mov dword [ebp - 0x201c], ebx
mov word [ebp - 0x804], si
je 0x77cffcbc
mov eax, dword [ebp - 0x200c]
mov eax, dword [eax + 0xc]
cmp word [eax], 0x17
lea ecx, [ebp - 0x1804]
push ecx
jne 0x77cffc69
add eax, 8
push eax
call dword [sym.imp.ntdll.dll_RtlIpv6AddressToStringW]
jmp 0x77cffc73
add eax, 4
push eax
call dword [sym.imp.ntdll.dll_RtlIpv4AddressToStringW]
lea eax, [ebp - 0x1804]
push eax
push 0x400
lea eax, [ebp - 0x804]
push eax
call fcn.77ca0f32
test eax, eax
jl 0x77cffcbc
mov eax, dword [ebp - 0x200c]
mov eax, dword [eax + 8]
cmp eax, esi
mov dword [ebp - 0x200c], eax
je 0x77cffcbc
push 0x77cffdd8
push 0x400
lea eax, [ebp - 0x804]
push eax
call fcn.77ca0f32
test eax, eax
jge 0x77cffc47
lea eax, [ebp - 0x804]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x77cffcc5
mov ecx, dword [ebp - 0x2008]
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
mov dword [ebp - 0x200c], eax
add eax, ebx
lea eax, [eax + ecx + 0x14]
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x2020], eax
add eax, 0x20
push eax
mov eax, dword [ecx + 0x30]
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
cmp ebx, esi
je 0x77cffdc1
push dword [ebp - 0x2008]
mov word [ebx + 6], 0xb0d
mov eax, dword [edi + 0x2c]
lea esi, [ebx + 0x20]
mov dword [esi], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 4], eax
mov eax, dword [edi + 0x34]
add esi, 8
mov dword [esi], eax
mov eax, dword [edi + 4]
add esi, 4
mov dword [esi], eax
mov eax, dword [edi + 0x48]
add esi, 4
mov dword [esi], eax
push dword [edi + 0x24]
add esi, 4
push esi
call sub.ntdll.dll_memcpy
push dword [ebp - 0x201c]
add esi, dword [ebp - 0x2008]
lea eax, [ebp - 0x1004]
push eax
push esi
call sub.ntdll.dll_memcpy
push dword [ebp - 0x200c]
lea eax, [ebp - 0x804]
push eax
mov eax, dword [ebp - 0x201c]
add esi, eax
push esi
call sub.ntdll.dll_memcpy
movzx eax, word [ebp + 8]
add esp, 0x24
push ebx
push dword [ebp - 0x2020]
push 0x40000004
push eax
call dword [sym.imp.ntdll.dll_NtTraceEvent]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov edi, dword [edi + 8]
xor esi, esi
test edi, edi
je 0x77cffdcb
jmp 0x77cffb7f
mov dword [ebp - 0x2014], 0xc0000017
mov edi, dword [ebp - 0x2014]
jmp 0x77cffb46