Function at 0x7dd93d9b
Capabilities:
Delete file
Get file attributes
Inspect section memory permissions
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push 0x39c
push 0x7dd94258
call fcn.7dd725e8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x280], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x270], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x298], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x318], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x314], eax
mov esi, dword [ebp + 0x2c]
or dword [ebp - 0x238], 0xffffffff
or dword [ebp - 0x248], 0xffffffff
xor ebx, ebx
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x2c0], ebx
mov dword [ebp - 0x2b4], ebx
mov dword [ebp - 0x25c], ebx
mov dword [ebp - 0x24c], ebx
mov dword [ebp - 0x254], ebx
mov dword [ebp - 0x29c], ebx
mov dword [ebp - 0x2b8], ebx
test dword [ebp + 0x1c], 0xffffe7f0
jne 0x7dda26cb
mov eax, dword [ebp + 0x20]
test eax, 0xfffff80f
jne 0x7dda26cb
or dword [ebp + 0x1c], eax
call sub.ntdll.dll_RtlGetCurrentTransaction
test eax, eax
jne 0x7dda26dc
push esi
call sub.ntdll.dll_RtlSetCurrentTransaction
mov dword [ebp - 4], ebx
mov esi, 0x1000
test dword [ebp + 0x1c], esi
jne 0x7dd93e77
call fcn.7dd93cb5
test eax, eax
jne 0x7dda26e9
test byte [ebp + 0x1c], 2
jne 0x7dda26f1
mov eax, dword [0x7de4000c]
test dword [ebp + 0x1c], 0x180
jne 0x7dda2704
mov esi, dword [ebp + 0x1c]
and esi, 0xfffffffc
or esi, 0xfffffff8
shl esi, 9
mov ecx, dword [ebp + 0x1c]
and ecx, 0x20
or esi, ecx
shl esi, 0x13
mov dword [ebp - 0x310], esi
or eax, dword [ebp - 0x29c]
or eax, 0x8200000
mov dword [ebp - 0x244], eax
mov eax, dword [ebp + 0x1c]
and eax, 0x1000
shl eax, 0x11
or dword [ebp - 0x244], eax
mov dword [ebp - 0x2b0], ebx
push 5
pop edi
mov dword [ebp - 0x30c], edi
mov dword [ebp - 0x250], esi
mov dword [ebp - 0x274], edi
push ebx
push dword [ebp - 0x244]
push 3
push ebx
push dword [ebp - 0x274]
push dword [ebp - 0x250]
push dword [ebp - 0x280]
call sub.API_MS_Win_Core_File_L1_1_0.dll_CreateFileW
mov dword [ebp - 0x238], eax
cmp eax, 0xffffffff
je 0x7dd9605e
cmp dword [ebp - 0x2b0], ebx
jne 0x7dd93f84
xor eax, eax
inc eax
mov dword [ebp - 0x2b0], eax
mov ecx, dword [ebp + 0x1c]
shr ecx, 0xb
and ecx, eax
push ecx
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x2b4]
push eax
lea eax, [ebp - 0x2c0]
push eax
push dword [ebp - 0x238]
call fcn.7dd9433f
mov dword [ebp - 0x23c], eax
cmp eax, ebx
jl 0x7dda2754
cmp dword [ebp - 0x2c0], ebx
jne 0x7dda2776
cmp dword [ebp - 0x2b4], ebx
je 0x7dda2810
test byte [ebp + 0x1c], 2
jne 0x7dd93fdf
test dword [ebp - 0x244], 0x20000000
jne 0x7dd93fdf
push 4
push 8
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x238]
call dword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
mov dword [ebp - 0x23c], eax
cmp eax, ebx
jl 0x7dd9872e
test byte [ebp - 0x330], 0x10
jne 0x7dda2831
test dword [ebp - 0x244], 0x40000000
jne 0x7dd95040
push 5
push 0x18
lea eax, [ebp - 0x3ac]
push eax
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x238]
mov edi, dword [sym.imp.ntdll.dll_NtQueryInformationFile]
call edi
mov dword [ebp - 0x23c], eax
cmp eax, ebx
jl 0x7dd9872e
push 4
push 0x28
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x238]
call edi
mov dword [ebp - 0x23c], eax
cmp eax, ebx
jl 0x7dd9872e
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0x2c8], eax
mov eax, dword [ebp - 0x298]
cmp eax, ebx
jne 0x7dd95337
cmp dword [ebp - 0x2a0], ebx
jne 0x7dd95337
mov dword [ebp - 0x290], 0x1000
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x304], eax
mov eax, dword fs:[0x18]
mov esi, dword [ebp - 0x290]
push esi
push dword [ebp - 0x304]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x24c], eax
cmp eax, ebx
je 0x7dda2889
push 0x16
add esi, 0xfffffffe
push esi
push dword [ebp - 0x24c]
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x238]
call edi
mov dword [ebp - 0x23c], eax
cmp eax, ebx
jl 0x7dda2893
cmp dword [ebp - 0x264], ebx
je 0x7dda28c5
cmp dword [ebp - 0x23c], 0x80000005
je 0x7dd94065
cmp dword [ebp - 0x23c], 0xc0000023
je 0x7dd94065
cmp dword [ebp - 0x298], ebx
jne 0x7dd99259
test byte [ebp + 0x1c], 2
jne 0x7dd99259
mov dword [ebp - 0x35c], ebx
mov dword [ebp - 0x358], ebx
mov dword [ebp - 0x354], ebx
mov dword [ebp - 0x350], ebx
mov dword [ebp - 0x33c], ebx
test byte [ebp + 0x1c], 2
jne 0x7dda2970
lea eax, [ebp - 0x2b8]
push eax
push dword [ebp - 0x328]
push dword [ebp - 0x25c]
lea eax, [ebp - 0x300]
push eax
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x308]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp - 0x3a4]
push eax
push ebx
push dword [ebp - 0x270]
push dword [ebp - 0x250]
push dword [ebp - 0x238]
push dword [ebp - 0x280]
call fcn.7dd943ab
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x25c], ebx
jne 0x7dda299c
cmp dword [ebp - 0x240], ebx
je 0x7dd9423b
cmp dword [ebp - 0x24c], ebx
je 0x7dd941f0
mov dword [ebp - 0x278], ebx
mov byte [ebp - 0x256], bl
mov byte [ebp - 0x255], bl
mov edi, dword [ebp - 0x24c]
mov dword [ebp - 0x26c], edi
mov esi, dword [ebp - 0x254]
mov dword [ebp - 0x23c], ebx
cmp dword [edi + 4], 2
jbe 0x7dd941e8
cmp word [edi + 0x1a], 0x3a
jne 0x7dda2a67
cmp dword [edi], ebx
jne 0x7dda2fbb
cmp dword [ebp - 0x240], ebx
je 0x7dd9423b
test byte [ebp + 0x1c], 2
jne 0x7dda2daf
cmp dword [ebp - 0x240], ebx
je 0x7dd9423b
push 4
push 0x28
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x248]
mov esi, dword [sym.imp.ntdll.dll_NtSetInformationFile]
call esi
mov dword [ebp - 0x23c], eax
cmp eax, 0xc0000043
je 0x7dda2eb1
mov dword [ebp - 4], 0xfffffffe
call fcn.7dd94279
mov eax, dword [ebp - 0x240]
call fcn.7dd72630
ret 0x28
push dword [ebp - 0x238]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
or dword [ebp - 0x238], 0xffffffff
and dword [ebp - 0x244], 0xbfffffff
mov dword [0x7de4000c], ebx
jmp 0x7dd93eed
mov ecx, dword [ebp - 0x3a4]
mov dword [ebp - 0x37c], ecx
mov ecx, dword [ebp - 0x3a0]
mov dword [ebp - 0x378], ecx
mov dword [ebp - 0x374], ebx
mov dword [ebp - 0x370], ebx
mov dword [ebp - 0x36c], ebx
mov ecx, dword [ebp - 0x2a0]
mov dword [ebp - 0x368], ecx
mov ecx, dword [ebp - 0x2bc]
mov dword [ebp - 0x364], ecx
mov dword [ebp - 0x360], eax
lea eax, [ebp - 0x37c]
mov dword [ebp - 0x254], eax
jmp 0x7dd9405b
call fcn.7dd711c7
cmp eax, 0x522
je 0x7dda2713
call fcn.7dd711c7
cmp eax, 5
je 0x7dda2713
call fcn.7dd711c7
cmp eax, 5
je 0x7dd960c0
call fcn.7dd711c7
cmp eax, 0x20
je 0x7dd960c0
test byte [ebp - 0x274], 2
jne 0x7dd9870f
or dword [ebp - 0x274], 2
mov dword [ebp - 0x250], esi
and dword [ebp - 0x244], 0xdfffffff
and dword [ebp + 0x1c], 0xffffefff
jmp 0x7dd93eed
test dword [ebp - 0x250], 0x40000000
je 0x7dd96090
jmp 0x7dda2732
test dword [ebp - 0x244], 0x200000
je 0x7dd9423b
and dword [ebp - 0x244], 0xffdfffff
jmp 0x7dd93ee1
push eax
jmp 0x7dda276c
add eax, dword [eax]
jmp 0x7dd9927d
test byte [ebp + 0x1c], 2
jne 0x7dda28e9
mov eax, dword [ebp - 0x24c]
cmp eax, ebx
je 0x7dd94107
mov dword [ebp - 0x2ac], ebx
mov dword [ebp - 0x2a8], ebx
mov dword [ebp - 0x26c], eax
mov ecx, dword [eax + 8]
add dword [ebp - 0x2ac], ecx
mov ecx, dword [eax + 0xc]
adc dword [ebp - 0x2a8], ecx
inc dword [ebp - 0x2fc]
cmp dword [eax], ebx
jne 0x7dd98734
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x37c], eax
mov ecx, dword [ebp - 0x2a8]
mov dword [ebp - 0x378], ecx
mov dword [ebp - 0x2e0], eax
mov dword [ebp - 0x2dc], ecx
dec dword [ebp - 0x2fc]
jmp 0x7dd94107
push 0xc000000d
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
jmp 0x7dd9424d
push 0x1a45
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
jmp 0x7dda26d5
or dword [ebp + 0x1c], esi
jmp 0x7dd93e77
and dword [ebp + 0x1c], 0xffffefff
xor eax, eax
mov dword [0x7de4000c], eax
jmp 0x7dd93e86
mov dword [ebp - 0x29c], 0x2000000
jmp 0x7dd93e93
test dword [ebp - 0x250], 0x1000000
je 0x7dd9607c
and dword [ebp - 0x250], 0xfeffffff
jmp 0x7dd93eed
and dword [ebp - 0x250], 0xbfffffff
mov eax, 0x1000000
test eax, esi
je 0x7dd93eed
or dword [ebp - 0x250], eax
jmp 0x7dd93eed
push dword [ebp - 0x238]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
or dword [ebp - 0x238], 0xffffffff
push dword [ebp - 0x23c]
call sym.KERNEL32.dll_BaseSetLastNTError
jmp 0x7dd9423b
push ebx
push ebx
push ebx
push ebx
call fcn.7dd7181b
mov esi, eax
cmp esi, ebx
jne 0x7dda279c
push dword [ebp - 0x238]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
or dword [ebp - 0x238], 0xffffffff
jmp 0x7dd9423b
push esi
lea eax, [ebp + 0x1c]
push eax
push dword [ebp - 0x2a0]
push dword [ebp - 0x2bc]
push dword [ebp - 0x298]
mov eax, dword [ebp + 0x20]
and al, 0x80
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x4001
push eax
push dword [ebp - 0x270]
push dword [ebp - 0x280]
push dword [ebp - 0x238]
call fcn.7ddee691
mov dword [ebp - 0x23c], eax
push esi
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
push dword [ebp - 0x238]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
or dword [ebp - 0x238], 0xffffffff
xor eax, eax
cmp dword [ebp - 0x23c], ebx
setne al
mov dword [ebp - 0x240], eax
jmp 0x7dd9423b
and dword [ebp - 0x244], 0xffdfffff
push dword [ebp - 0x238]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
or dword [ebp - 0x238], 0xffffffff
jmp 0x7dd93eed
test dword [ebp - 0x330], 0x1000
jne 0x7dd93fcf
push dword [ebp - 0x238]
test dword [ebp - 0x244], 0x40000000
jne 0x7dda2874
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
or dword [ebp - 0x238], 0xffffffff
mov eax, 0x40000000
or dword [ebp - 0x244], eax
mov dword [0x7de4000c], eax
jmp 0x7dd93eed
call fcn.7ddedfd7
push dword [ebp - 0x238]
call fcn.7ddee0b3
jmp 0x7dd93fdf
push 0xc0000017
jmp 0x7dda276c
mov eax, dword fs:[0x18]
push dword [ebp - 0x24c]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebp - 0x24c], ebx
mov eax, dword [ebp - 0x290]
add eax, eax
mov dword [ebp - 0x290], eax
jmp 0x7dd940d5
mov eax, dword fs:[0x18]
push dword [ebp - 0x24c]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebp - 0x24c], ebx
jmp 0x7dd940d5
mov eax, 0x7a9b
mov word [ebp - 0x300], ax
push 0x38
pop eax
mov word [ebp - 0x2fe], ax
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0x2f8], eax
mov eax, dword [ebp - 0x358]
mov dword [ebp - 0x2f4], eax
mov eax, dword [ebp - 0x34c]
mov dword [ebp - 0x2f0], eax
mov eax, dword [ebp - 0x348]
mov dword [ebp - 0x2ec], eax
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x2e8], eax
mov ecx, dword [ebp - 0x3a0]
mov dword [ebp - 0x2e4], ecx
mov dword [ebp - 0x2e0], eax
mov dword [ebp - 0x2dc], ecx
mov dword [ebp - 0x2fc], ebx
mov dword [ebp - 0x2d0], ebx
mov dword [ebp - 0x2d8], ebx
mov dword [ebp - 0x2d4], ebx
jmp 0x7dd99263
cmp dword [ebp - 0x2dc], ebx
jl 0x7dda2993
jg 0x7dda2986
cmp dword [ebp - 0x2e0], 0x80000
jb 0x7dda2993
test byte [ebp - 0x2c8], 0x10
je 0x7dd9412f
and dword [ebp + 0x1c], 0xfffffffd
jmp 0x7dd9412f
cmp eax, ebx
jne 0x7dd941a5
call fcn.7dd711c7
cmp eax, 0x50
jne 0x7dda29b8
test byte [ebp + 0x1c], 1
jne 0x7dd94199
mov esi, dword [ebp - 0x2c8]
and esi, 1
jne 0x7dda29d3
push 0x80
push dword [ebp - 0x248]
call fcn.7ddee4e1
or edi, 0xffffffff
cmp dword [ebp - 0x248], edi
je 0x7dda29ef
push dword [ebp - 0x248]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
mov dword [ebp - 0x248], edi
cmp esi, ebx
je 0x7dda2a0e
push 0x80
push dword [ebp - 0x270]
call sub.API_MS_Win_Core_File_L1_1_0.dll_SetFileAttributesW
push dword [ebp - 0x270]
call fcn.7dd725e0
cmp dword [ebp - 0x238], edi
je 0x7dda2a27
push dword [ebp - 0x238]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
mov dword [ebp - 0x238], edi
mov eax, dword fs:[0x18]
push dword [ebp - 0x24c]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebp - 0x24c], ebx
and dword [ebp - 0x244], 0xffdfffff
mov dword [ebp - 0x25c], ebx
mov edi, dword [ebp - 0x30c]
mov esi, dword [ebp - 0x310]
jmp 0x7dd93ee1
inc dword [ebp - 0x278]
cmp dword [ebp - 0x240], 2
jne 0x7dda2aa5
cmp esi, ebx
je 0x7dda2aa5
mov eax, dword [ebp - 0x278]
cmp eax, dword [ebp - 0x2d0]
jae 0x7dda2a93
mov eax, dword [edi + 8]
add dword [esi + 8], eax
mov eax, dword [edi + 0xc]
jmp 0x7dda2aa2
mov eax, dword [ebp - 0x2d8]
add dword [esi + 8], eax
mov eax, dword [ebp - 0x2d4]
adc dword [esi + 0xc], eax
cmp byte [ebp - 0x256], bl
jne 0x7dda2b43
mov byte [ebp - 0x256], 1
push 5
push 0x218
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x248]
mov esi, dword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
call esi
mov dword [ebp - 0x23c], eax
cmp eax, ebx
jl 0x7dda2f39
test dword [ebp - 0x234], 0x40000
je 0x7dda2b18
push 5
push 0x218
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x238]
call esi
mov dword [ebp - 0x23c], eax
cmp eax, ebx
jl 0x7dda2f39
test dword [ebp - 0x234], 0x40000
je 0x7dda2f2a
mov byte [ebp - 0x255], 1
mov dword [ebp - 0x23c], ebx
mov esi, dword [ebp - 0x254]
cmp dword [ebp - 0x240], 1
je 0x7dda2b6b
cmp dword [ebp - 0x240], 2
jne 0x7dda2d6d
mov eax, dword [ebp - 0x2d0]
cmp eax, dword [ebp - 0x278]
jne 0x7dda2d6d
cmp dword [ebp - 0x240], 2
je 0x7dda2b8c
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x2d0], eax
mov dword [ebp - 0x2d8], ebx
mov dword [ebp - 0x2d4], ebx
lea eax, [edi + 0x18]
mov dword [ebp - 0x284], eax
mov ax, word [edi + 4]
mov word [ebp - 0x288], ax
mov word [ebp - 0x286], ax
mov dword [ebp - 0x394], 0x18
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x390], eax
mov dword [ebp - 0x388], ebx
lea eax, [ebp - 0x288]
mov dword [ebp - 0x38c], eax
mov dword [ebp - 0x384], ebx
mov dword [ebp - 0x380], ebx
mov dword [ebp - 0x260], 0x24
cmp dword [ebp - 0x25c], ebx
je 0x7dda2bf7
mov dword [ebp - 0x260], 0x200024
push ebx
push ebx
push dword [ebp - 0x260]
push 1
push 1
push ebx
push ebx
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x394]
push eax
push 0x80100000
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.ntdll.dll_NtCreateFile]
mov dword [ebp - 0x23c], eax
cmp eax, 0xc0000043
jne 0x7dda2c66
push ebx
push ebx
push dword [ebp - 0x260]
push 1
push 3
push ebx
push ebx
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x394]
push eax
push 0x80100000
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.ntdll.dll_NtCreateFile]
mov dword [ebp - 0x23c], eax
cmp eax, ebx
jl 0x7dda2d6d
movzx eax, word [ebp - 0x288]
shr eax, 1
mov ecx, dword [ebp - 0x284]
lea eax, [ecx + eax*2]
movzx esi, word [eax]
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 0x27c], ebx
mov eax, dword [ebp + 0x1c]
and eax, 0xfffffffe
mov dword [ebp - 0x2c4], eax
and eax, 0xffffefff
mov dword [ebp - 0x2c4], eax
lea eax, [ebp - 0x2b8]
push eax
push dword [ebp - 0x328]
push dword [ebp - 0x25c]
lea eax, [ebp - 0x300]
push eax
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x308]
push eax
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x2c4]
push eax
lea eax, [edi + 8]
push eax
push dword [ebp - 0x248]
push dword [ebp - 0x284]
push dword [ebp - 0x250]
push dword [ebp - 0x28c]
push dword [ebp - 0x280]
call fcn.7dd943ab
mov dword [ebp - 0x240], eax
movzx eax, word [ebp - 0x288]
shr eax, 1
mov ecx, dword [ebp - 0x284]
mov word [ecx + eax*2], si
push dword [ebp - 0x28c]
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [ebp - 0x27c], ebx
je 0x7dda2d67
cmp dword [ebp - 0x240], ebx
je 0x7dda2d5b
push 4
push 0x28
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x27c]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
mov dword [ebp - 0x23c], eax
push dword [ebp - 0x27c]
call dword [sym.imp.ntdll.dll_NtClose]
mov esi, dword [ebp - 0x254]
cmp dword [ebp - 0x23c], ebx
jge 0x7dda2d86
mov dword [ebp - 0x240], ebx
push dword [ebp - 0x23c]
call sym.KERNEL32.dll_BaseSetLastNTError
cmp dword [ebp - 0x240], ebx
jne 0x7dd941e8
cmp byte [ebp - 0x255], bl
je 0x7dda2fa6
push ebx
push dword [ebp - 0x248]
call fcn.7ddee4e1
jmp 0x7dd941f0
push ebx
push ebx
push ebx
push dword [ebp - 0x238]
call fcn.7dd7168a
push ebx
push ebx
push ebx
mov esi, dword [ebp - 0x248]
push esi
call fcn.7dd7168a
push 0x38
pop edi
mov dword [ebp - 0x294], edi
mov edx, dword [ebp - 0x3a4]
mov ecx, edx
add ecx, 0xffffffff
mov eax, dword [ebp - 0x3a0]
adc eax, 0xffffffff
cmp eax, ebx
ja 0x7dda2dfa
jb 0x7dda2df4
cmp ecx, 0x36
ja 0x7dda2dfa
mov dword [ebp - 0x294], edx
push ebx
lea eax, [ebp - 0x2a4]
push eax
push dword [ebp - 0x294]
lea eax, [ebp - 0x300]
push eax
push dword [ebp - 0x238]
call sub.API_MS_Win_Core_File_L1_1_0.dll_ReadFile
mov dword [ebp - 0x240], eax
cmp eax, ebx
je 0x7dda2e9f
mov eax, dword [ebp - 0x2a4]
cmp eax, dword [ebp - 0x294]
jne 0x7dda2e9f
push ebx
lea ecx, [ebp - 0x31c]
push ecx
push eax
lea eax, [ebp - 0x300]
push eax
push esi
call sub.API_MS_Win_Core_File_L1_1_0.dll_WriteFile
mov dword [ebp - 0x240], eax
cmp eax, ebx
je 0x7dda2e9f
mov eax, dword [ebp - 0x31c]
cmp dword [ebp - 0x2a4], eax
jne 0x7dda2e9f
cmp dword [ebp - 0x2a4], edi
jae 0x7dd94202
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x320], ebx
push 0x14
push 8
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x268]
push eax
push esi
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
mov dword [ebp - 0x23c], eax
cmp eax, ebx
jge 0x7dd94202
push ebx
push esi
call fcn.7ddee4e1
mov dword [ebp - 0x240], ebx
jmp 0x7dd94202
push dword [ebp - 0x248]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
or dword [ebp - 0x248], 0xffffffff
mov dword [ebp - 0x260], 0x80
cmp dword [ebp - 0x25c], ebx
je 0x7dda2edf
mov dword [ebp - 0x260], 0x200080
push ebx
mov eax, dword [ebp - 0x29c]
or eax, dword [ebp - 0x260]
push eax
push 3
push ebx
push ebx
push 0x100
push dword [ebp - 0x270]
call sub.API_MS_Win_Core_File_L1_1_0.dll_CreateFileW
mov dword [ebp - 0x248], eax
cmp eax, 0xffffffff
je 0x7dd9423b
push 4
push 0x28
lea ecx, [ebp - 0x35c]
push ecx
lea ecx, [ebp - 0x268]
push ecx
push eax
call esi
jmp 0x7dd9423b
cmp eax, ebx
jl 0x7dda2f39
mov eax, 0xc00000bb
mov dword [ebp - 0x23c], eax
test dword [ebp + 0x1c], 0x7f0
je 0x7dda2b37
push ebx
push dword [ebp - 0x248]
push dword [ebp - 0x238]
push 2
push ebx
push dword [ebp - 0x254]
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
push 1
call fcn.7dd9062d
test eax, eax
jne 0x7dda2b37
mov eax, dword fs:[0x18]
cmp eax, ebx
je 0x7dda2f8b
mov eax, dword [eax + 0xbf4]
mov dword [ebp - 0x23c], eax
jmp 0x7dda2f95
mov dword [ebp - 0x23c], 0xc000000d
mov dword [ebp - 0x240], ebx
mov edi, dword [ebp - 0x26c]
jmp 0x7dda2d67
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x240], 1
jmp 0x7dd941e8
add edi, dword [edi]
mov dword [ebp - 0x26c], edi
jmp 0x7dd941d1