Function at 0x7dd898e0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Delete file
Get file attributes
Get ntdll base address
Get process heap flags
Get process heap force flags
Set file attributes

Disassembly:
push 0x98
push 0x7dd89ab0
call fcn.7dd715c0
or dword [ebp - 0x20], 0xffffffff
xor ebx, ebx
mov byte [ebp - 0x19], bl
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x7dd89917
push dword [ebp + 0xc]
call dword [sym.imp.ntdll.dll_RtlIsDosDeviceName_U]
test eax, eax
jne 0x7dd9f2e8
mov al, byte [ebp + 0x18]
and al, 1
mov byte [ebp - 0x1a], al
push ebx
push ebx
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
cmp al, bl
je 0x7dd8aac7
mov eax, dword [ebp + 0x18]
and eax, 4
mov dword [ebp - 0x2c], eax
jne 0x7dd9f2f2
mov dword [ebp - 0x74], 0x18
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x68], 0x40
lea eax, [ebp - 0x38]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov esi, dword [ebp + 0x18]
and esi, 8
or esi, 0x10080
shr esi, 2
mov eax, esi
or eax, 0x200000
push eax
push 7
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x74]
push eax
push 0x110080
lea eax, [ebp - 0x20]
push eax
mov edi, dword [sym.imp.ntdll.dll_NtOpenFile]
call edi
cmp eax, ebx
jl 0x7dd9f306
push 0x23
push 8
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
cmp eax, ebx
jl 0x7dd9f368
test dword [ebp - 0x50], 0x400
jne 0x7dd9f383
cmp dword [ebp - 0x2c], ebx
jne 0x7dd9f329
push ebx
push ebx
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
cmp al, bl
je 0x7dd8aac7
cmp dword [ebp - 0x2c], ebx
jne 0x7dd9f3ac
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x54], eax
mov eax, dword fs:[0x18]
movzx ecx, word [ebp - 0x28]
add ecx, 0x10
push ecx
push dword [ebp - 0x54]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
mov dword [ebp - 0x48], esi
cmp esi, ebx
je 0x7dd9f3e8
movzx eax, word [ebp - 0x28]
push eax
push dword [ebp - 0x24]
lea eax, [esi + 0xc]
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
mov al, byte [ebp - 0x1a]
mov byte [esi], al
mov dword [esi + 4], ebx
movzx eax, word [ebp - 0x28]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x18]
and eax, 0x10
or eax, 0xa0
shr eax, 4
push eax
movzx eax, word [ebp - 0x28]
add eax, 0x10
push eax
push esi
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
mov dword [ebp - 0x5c], eax
mov eax, dword fs:[0x18]
push dword [ebp - 0x48]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [ebp - 0x5c]
cmp eax, ebx
jl 0x7dd8aaad
mov byte [ebp - 0x19], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.7dd89add
movzx eax, byte [ebp - 0x19]
call fcn.7dd71605
ret 0x18
cmp eax, 0xc00000d4
je 0x7dd9f4ac
cmp eax, 0xc0190038
jne 0x7dd8aac4
jmp 0x7dd9f4ac
push eax
jmp 0x7dd8aaee
push 0xc000003a
jmp 0x7dd8aaee
cmp eax, ebx
jl 0x7dd8aac4
jmp 0x7dd899c6
cmp eax, ebx
jge 0x7dd899b9
jmp 0x7dd899c6
cmp eax, ebx
jge 0x7dd89a90
jmp 0x7dd8aac4
call sym.KERNEL32.dll_BaseSetLastNTError
jmp 0x7dd89a94
push 0xc0000035
jmp 0x7dd8aaee
test byte [ebp + 0x18], 0x10
je 0x7dd89945
push 0xc000000d
jmp 0x7dd8aaee
cmp dword [ebp - 0x2c], ebx
je 0x7dd9f342
cmp eax, 0xc0000043
je 0x7dd9f320
cmp eax, 0xc0000034
je 0x7dd9f320
cmp eax, 0xc000003a
jne 0x7dd9f342
or dword [ebp - 0x20], 0xffffffff
jmp 0x7dd899c6
cmp dword [ebp + 0xc], ebx
jne 0x7dd899cf
push ebx
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
jmp 0x7dd899e6
cmp eax, 0xc000000d
jne 0x7dd8aace
push esi
push 3
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x74]
push eax
push 0x110000
lea eax, [ebp - 0x20]
push eax
call edi
jmp 0x7dd8aace
cmp eax, 0xc0000002
je 0x7dd8aad7
cmp eax, 0xc000000d
je 0x7dd8aad7
jmp 0x7dd8aac4
cmp dword [ebp - 0x4c], 0xa0000003
je 0x7dd899c6
cmp dword [ebp - 0x4c], 0xa000000c
je 0x7dd899c6
push dword [ebp - 0x20]
call dword [sym.imp.ntdll.dll_NtClose]
or dword [ebp - 0x20], 0xffffffff
jmp 0x7dd9f34d
cmp byte [ebp - 0x1a], bl
je 0x7dd9f439
cmp word [ebp - 0x28], bx
je 0x7dd9f439
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x58], eax
mov eax, dword fs:[0x18]
movzx ecx, word [ebp - 0x28]
inc ecx
inc ecx
push ecx
push dword [ebp - 0x58]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
cmp esi, ebx
jne 0x7dd9f3f2
push 0xc0000017
jmp 0x7dd8aaee
push 0x21
pop eax
mov word [esi], ax
movzx eax, word [ebp - 0x28]
push eax
push dword [ebp - 0x24]
lea eax, [esi + 2]
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x28]
add eax, 2
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x26]
add eax, 2
mov word [ebp - 0x26], ax
mov eax, dword fs:[0x18]
push dword [ebp - 0x24]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebp - 0x24], esi
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_RtlDetermineDosPathNameType_U]
xor esi, esi
inc esi
cmp eax, esi
jne 0x7dd9f453
mov eax, 0xc000000d
jmp 0x7dd8aac4
test byte [ebp + 0x18], 2
jne 0x7dd9f449
push dword [ebp + 0x1c]
push ebx
push 2
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.7dded68f
cmp eax, 0xc0000034
jne 0x7dd8aae4
push dword [ebp + 0x1c]
push esi
push esi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.7dded68f
cmp eax, 0xc000009a
jne 0x7dd8aae4
push dword [ebp + 0x1c]
push esi
push 2
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.7dded68f
jmp 0x7dd8aae4
test byte [ebp + 0x18], 2
je 0x7dd8aac4
push 4
push 0x28
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
cmp eax, ebx
jl 0x7dd9f4e5
test byte [ebp - 0x88], 0x10
je 0x7dd9f4e5
push 0xc00000ba
jmp 0x7dd8aaee
push dword [ebp - 0x20]
call dword [sym.imp.ntdll.dll_NtClose]
or dword [ebp - 0x20], 0xffffffff
or dword [ebp - 0x2c], 0xffffffff
or dword [ebp - 0x30], 0xffffffff
call sub.ntdll.dll_RtlGetCurrentTransaction
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x78], eax
push ebx
call sub.ntdll.dll_RtlSetCurrentTransaction
mov dword [ebp - 4], 1
push dword [ebp - 0x44]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
xor eax, eax
cmp byte [ebp - 0x1a], bl
sete al
or eax, 0x804
push eax
push ebx
lea eax, [ebp - 0x80]
push eax
push 0x7ddec7e1
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.7dd93d9b
mov byte [ebp - 0x19], al
mov dword [ebp - 4], ebx
call fcn.7dd9f608
or edi, 0xffffffff
cmp byte [ebp - 0x19], bl
je 0x7dd9f5ae
cmp dword [ebp - 0x2c], edi
je 0x7dd9f5be
cmp dword [ebp - 0x30], edi
je 0x7dd9f5ae
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x30]
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.7ddec8a9
mov esi, eax
cmp esi, ebx
jge 0x7dd9f5ae
test byte [ebp + 0x18], 0x20
je 0x7dd9f5ae
cmp dword [ebp - 0x30], edi
je 0x7dd9f59a
push dword [ebp - 0x30]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
mov dword [ebp - 0x30], edi
push dword [ebp + 0xc]
call fcn.7dd725e0
mov byte [ebp - 0x19], bl
push esi
call sym.KERNEL32.dll_BaseSetLastNTError
cmp dword [ebp - 0x2c], edi
je 0x7dd9f5be
push dword [ebp - 0x2c]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x30], edi
je 0x7dd9f5ce
push dword [ebp - 0x30]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
mov dword [ebp - 0x30], edi
cmp byte [ebp - 0x19], bl
je 0x7dd89a94
push dword [ebp + 8]
call fcn.7dd725e0
test eax, eax
jne 0x7dd89a94
push 0x80
push dword [ebp + 8]
call sub.API_MS_Win_Core_File_L1_1_0.dll_SetFileAttributesW
push dword [ebp + 8]
call fcn.7dd725e0
jmp 0x7dd89a94