Function at 0x7d243bb0
Capabilities:
Check for time delay via gettickcount
Read file on windows
Write file on windows

Disassembly:
sub esp, 0xc0
push ebx
push ebp
mov ebp, dword [esp + 0xcc]
lea eax, [esp + 0x20]
push edi
mov edi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [esp + 0x34], eax
mov eax, dword [0x7d2dea8c]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x24]
push ebp
push eax
mov dword [esp + 0x34], 0x18
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0x40
mov dword [esp + 0x48], 0
call edi
push 0
push 0
push 0x20
push 1
push 7
push 0
push 0
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x4c]
push eax
push 0x120089
lea eax, [esp + 0x34]
push eax
call dword [0x7d2dda40]
cmp byte [esp + 0xd8], 0
je 0x7d243c38
cmp eax, 0xc0000022
je 0x7d243c3f
cmp eax, 0xc0000043
jne 0x7d243c83
push ebp
lea eax, [esp + 0x10]
push eax
call fcn.7d221965
test eax, eax
jns 0x7d243c7a
push 0
push 0
push 0x20
push 1
push 7
push 0
push 0
lea eax, [esp + 0x38]
xor bl, bl
push eax
lea eax, [esp + 0x4c]
push eax
push 0x100080
lea eax, [esp + 0x34]
push eax
call dword [0x7d2dda40]
jmp 0x7d243c8a
mov bl, byte [esp + 0xdc]
jmp 0x7d243c92
mov bl, byte [esp + 0xdc]
test eax, eax
js 0x7d243f85
push esi
push 0x22
push 0x38
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x20]
call dword [0x7d2dda64]
mov esi, eax
test esi, esi
jns 0x7d243cca
push dword [esp + 0x10]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
pop esi
pop edi
pop ebp
pop ebx
add esp, 0xc0
ret 0x10
test bl, bl
je 0x7d243d18
mov ebx, dword [esp + 0x84]
mov esi, dword [esp + 0x80]
push ebx
push esi
push ebp
call fcn.7d2217c6
cmp eax, 2
je 0x7d243d18
test eax, eax
jne 0x7d243d29
push dword [esp + 0x10]
call dword [sym.imp.ntdll.dll_NtClose]
cmp byte [0x7d2ddf91], 0
mov eax, 0xc000000a
pop esi
pop edi
mov ecx, 0xc0000022
pop ebp
cmovne eax, ecx
pop ebx
add esp, 0xc0
ret 0x10
xorps xmm0, xmm0
movlpd qword [esp + 0x14], xmm0
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
push dword [esp + 0xd8]
lea eax, [esp + 0x2c]
push eax
call edi
mov ecx, dword [esp + 0x88]
mov edx, 0x60
push 0
push 0
and ecx, 0x10
mov eax, 0x21
cmove eax, edx
test ecx, 0x10
push eax
push 2
push 7
push 0x80
push 0
lea eax, [esp + 0x3c]
mov edx, 0x120116
push eax
lea eax, [esp + 0x50]
push eax
mov eax, 0x120089
cmove eax, edx
push eax
lea eax, [esp + 0x44]
push eax
call dword [0x7d2dda40]
mov edi, eax
test edi, edi
jns 0x7d243da6
push dword [esp + 0x10]
call dword [sym.imp.ntdll.dll_NtClose]
pop esi
mov eax, edi
pop edi
pop ebp
pop ebx
add esp, 0xc0
ret 0x10
mov eax, esi
or eax, ebx
je 0x7d243ecd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0xbb8
push 0x1000
mov dword [esp + 0x18], eax
call fcn.7d221505
mov ebp, eax
test ebp, ebp
jne 0x7d243de0
mov edi, 0xc000009a
jmp 0x7d243f70
test ebx, ebx
jne 0x7d243dee
mov eax, esi
cmp esi, 0x1000
jbe 0x7d243df3
mov eax, 0x1000
push 0
push 0
push eax
push ebp
lea eax, [esp + 0x30]
push eax
push 0
push 0
push 0
push dword [esp + 0x30]
call dword [sym.imp.ntdll.dll_NtReadFile]
mov edi, eax
test edi, edi
js 0x7d243eb8
mov eax, dword [esp + 0x24]
sub esi, eax
push 0
push 0
push eax
push ebp
lea eax, [esp + 0x30]
sbb ebx, 0
push eax
push 0
push 0
push 0
push dword [esp + 0x3c]
call dword [sym.imp.ntdll.dll_NtWriteFile]
mov edi, eax
test edi, edi
js 0x7d243eb8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [esp + 0x14], eax
jae 0x7d243ea6
push ebx
push esi
add eax, 0x3e8
push str._I64u
mov dword [esp + 0x20], eax
lea eax, [esp + 0x9c]
push 0x20
push eax
call sym.SbieDll.dll_Sbie_snwprintf
mov eax, dword [0x7d2b730c]
add esp, 0x14
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0xd4]
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x90]
mov dword [esp + 0x50], eax
lea eax, [esp + 0x48]
push eax
push 0x896
mov dword [esp + 0x5c], 0
call sym.SbieDll.dll__SbieApi_LogMsgExt_8
test ebx, ebx
ja 0x7d243dee
jb 0x7d243eb8
test esi, esi
jne 0x7d243de0
push ebp
call fcn.7d221537
test edi, edi
js 0x7d243f70
mov ebp, dword [esp + 0xd4]
mov esi, dword [esp + 0xd8]
push esi
push ebp
call fcn.7d238ce0
cmp byte [esp + 0xdc], 0
mov edi, eax
je 0x7d243eef
cmp edi, 0xc0000022
je 0x7d243ef3
test edi, edi
js 0x7d243f70
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0xa8], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0xb0], eax
lea eax, [esp + 0x90]
mov dword [esp + 0x94], ecx
mov ecx, dword [esp + 0x64]
push eax
mov dword [esp + 0xa0], ecx
mov ecx, dword [esp + 0x70]
push esi
push dword [esp + 0x24]
mov dword [esp + 0xb0], ecx
mov ecx, dword [esp + 0x80]
mov dword [esp + 0xb8], ecx
call fcn.7d24b130
mov edi, eax
push dword [esp + 0x10]
mov esi, dword [sym.imp.ntdll.dll_NtClose]
call esi
push dword [esp + 0x1c]
call esi
mov eax, edi
pop esi
pop edi
pop ebp
pop ebx
add esp, 0xc0
ret 0x10