So after some further digging, and with some help from one of our sysadmins, I believe I have found a lead.
(Apologies if I’m vague, security and all that jazz. @bschaaf, I’ll follow up in an email to you directly).
Our anti-virus software seems to be the culprit from builds 4166 onwards, particularly the real-time and malicious behaviour functions, though it isn’t generating specific logs when it interjects in sublime_text.exe or plugin_host-3.*.exe.
Installing and opening builds 4166 to 4180 work without issue when these two particular functions are turned off, suggesting that something has changed in these applications since build 4152 that looks suspicious to our AV software.
The crashes in ntdll.dll appear to be caused when our AV interjects, perhaps when scanning to see if plugin_host-3.*.exe is suspect, causing it to crash though I’m only speculating here.
Interestingly, submitting each of those executables to VirusTotal doesn’t flag an issue in almost all of their AV solutions they use, a line of inquiry I tried in my initial investigations. There was one exception though, which I can’t recall the name of (seemingly relatively unknown AV solution, at least to me) that flagged one of the plugin host executables. That said, I gather they’re only checking for malicious files based on signatures and not actual behaviour using ‘real-time’ engines.
Its interesting that I can launch the affected builds eventually, by launching sublime_text.exe a bunch of times in quick succession, sans plugin functionality. Perhaps this could be a fail-graceful condition? (On launch, test if plugin_host-3.*.exe crashes, then warn on visible in sublime_text.exe, as sometimes it will just fail to launch/crash silently).
