Function at 0x7dd8a327
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push 0xdc
push 0x7dd8a4a8
call fcn.7dd725e8
mov eax, dword [ebp + 8]
mov dword [ebp - 0xb4], eax
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0xd0], ebx
xor eax, eax
mov dword [ebp - 0xb0], eax
push 0x22
pop ecx
mov esi, ebx
lea edi, [ebp - 0xa4]
rep movsd dword es:[edi], dword [esi]
or dword [ebp - 0xa8], 0xffffffff
mov dword [ebp - 4], eax
push eax
mov esi, dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
call esi
mov edx, dword [ebp + 0x10]
test edx, 0x100
jne 0x7dd9f74b
mov al, dl
and al, 1
movzx edi, al
neg edi
sbb edi, edi
mov ecx, 0xc0000000
and edi, ecx
add edi, 0x80000000
mov dword [ebp - 0xc0], edi
test dl, 2
jne 0x7dd9f795
push edx
call fcn.7dd8a2ee
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xbc], 3
mov dword [ebp - 0xac], edx
and dword [ebp - 0xac], 0x1000
jne 0x7dd9f7a2
test edx, 0x8000
jne 0x7dd8a436
lea eax, [ebx + 8]
lea ecx, [ebp - 0xc4]
push ecx
push eax
push 0x7f
push 0
push dword [ebp - 0xb4]
push 0
call sym.KERNEL32.dll_SearchPathA
cmp eax, 0x7f
ja 0x7dd8a4d3
test eax, eax
jne 0x7dd8a436
mov dword [ebp - 0xb0], 1
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebx + 8]
push eax
push 0x7f
push dword [ebp - 0xb4]
call fcn.7dd7e2b6
test eax, eax
je 0x7dd8a4d3
cmp eax, 0x7f
ja 0x7dd8a4d3
test dword [ebp + 0x10], 0x4000
jne 0x7dd9f7b9
test dword [ebp + 0x10], 0x200
jne 0x7dd9f7fb
lea eax, [ebx + 8]
xor ecx, ecx
push ecx
push ecx
push dword [ebp - 0xbc]
push ecx
push dword [ebp - 0xd4]
push edi
push eax
call sym.KERNEL32.dll_CreateFileA
mov esi, eax
mov dword [ebp - 0xa8], esi
cmp esi, 0xffffffff
jne 0x7dd9f8ee
test dword [ebp + 0x10], 0x2000
jne 0x7dd9f82c
mov dword [ebp - 4], 0xfffffffe
call fcn.7dd8a4c9
mov eax, dword [ebp - 0xa8]
call fcn.7dd72630
ret 0xc
push 0xd
jmp 0x7dd9f76e
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebx + 8]
push eax
push 0x7f
push dword [ebp - 0xb4]
call fcn.7dd7e2b6
cmp eax, 0x7f
ja 0x7dd8a4d3
jmp 0x7dd9f775
call esi
jmp 0x7dd9fa00
mov byte [ebx], 0x88
mov byte [ebx + 1], 1
xor eax, eax
mov word [ebx + 2], ax
mov word [ebx + 4], ax
mov word [ebx + 6], ax
and dword [ebp - 0xa8], eax
jmp 0x7dd8a489
or edi, ecx
mov dword [ebp - 0xc0], edi
jmp 0x7dd8a3a6
mov dword [ebp - 0xbc], 2
mov edi, ecx
mov dword [ebp - 0xc0], edi
jmp 0x7dd8a3d2
cmp dword [ebp - 0xac], 0
jne 0x7dd8a443
cmp dword [ebp - 0xb0], 0
je 0x7dd9f7d3
push 2
jmp 0x7dd9f76e
lea eax, [ebx + 8]
push eax
call fcn.7dd75e11
cmp eax, 0xffffffff
je 0x7dd9f7cf
test al, 0x10
je 0x7dd9f7e9
push 5
jmp 0x7dd9f76e
mov dword [ebp - 0xa8], 1
mov byte [ebx], 0x88
jmp 0x7dd8a489
lea eax, [ebx + 8]
push eax
call fcn.7dd75e41
test eax, eax
je 0x7dd9f820
xor eax, eax
mov word [ebx + 2], ax
mov byte [ebx], 0x88
mov dword [ebp - 0xa8], 1
jmp 0x7dd8a489
push 2
pop eax
mov word [ebx + 2], ax
jmp 0x7dd9fa00
call fcn.7dd81829
test eax, 0x8000
jne 0x7dd8a489
call dword [sym.imp.ntdll.dll_RtlGetThreadErrorMode]
test al, 0x40
jne 0x7dd8a489
call fcn.7dd711c7
cmp eax, 2
jne 0x7dd9f85b
mov esi, 0xc000000f
jmp 0x7dd9f869
cmp eax, 3
jne 0x7dd8a489
mov esi, 0xc000003a
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0xe4]
push eax
call dword [sym.imp.ntdll.dll_RtlInitAnsiString]
push 1
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0xb8]
push eax
call dword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
test eax, eax
jl 0x7dd8a489
lea eax, [ebp - 0xb8]
mov dword [ebp - 0xb0], eax
lea eax, [ebp - 0xac]
push eax
push 3
lea eax, [ebp - 0xb0]
push eax
push 1
push 1
or esi, 0x10000000
push esi
call dword [sym.imp.ntdll.dll_NtRaiseHardError]
mov esi, eax
lea eax, [ebp - 0xb8]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
test esi, esi
jl 0x7dd8a489
cmp dword [ebp - 0xac], 7
je 0x7dd8a450
jmp 0x7dd8a489
test dword [ebp + 0x10], 0x4000
je 0x7dd9f902
push esi
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
jmp 0x7dd9f7e9
push 4
push 8
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0xec]
push eax
push esi
call dword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
mov edi, eax
test edi, edi
jge 0x7dd9f932
push esi
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
push edi
call sym.KERNEL32.dll_BaseSetLastNTError
jmp 0x7dd9fa00
cmp dword [ebp - 0xcc], 7
jb 0x7dd9f953
cmp dword [ebp - 0xcc], 8
ja 0x7dd9f953
mov al, byte [ebp - 0xc8]
not al
and al, 1
mov byte [ebx + 1], al
jmp 0x7dd9f957
mov byte [ebx + 1], 0
lea eax, [ebp - 0xdc]
push eax
push 0
push 0
push esi
call fcn.7dd74483
lea esi, [ebx + 4]
lea edi, [ebx + 6]
test eax, eax
je 0x7dd9f984
push edi
push esi
lea eax, [ebp - 0xdc]
push eax
call sym.KERNEL32.dll_FileTimeToDosDateTime
test eax, eax
jne 0x7dd9f98c
xor eax, eax
mov word [esi], ax
mov word [edi], ax
mov byte [ebx], 0x88
test dword [ebp + 0x10], 0x400
je 0x7dd8a489
mov ax, word [ebp - 0xa0]
cmp ax, word [esi]
jne 0x7dd9f9e8
mov ax, word [ebp - 0x9e]
cmp ax, word [edi]
jne 0x7dd9f9e8
lea esi, [ebx + 8]
lea eax, [ebp - 0x9c]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x7dd9f9db
test cl, cl
je 0x7dd9f9d7
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x7dd9f9db
inc eax
inc eax
inc esi
inc esi
test cl, cl
jne 0x7dd9f9bd
xor eax, eax
jmp 0x7dd9f9e0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x7dd8a489
push 0x22
pop ecx
lea esi, [ebp - 0xa4]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
push dword [ebp - 0xa8]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
or dword [ebp - 0xa8], 0xffffffff
jmp 0x7dd8a489