Function at 0x7dd797a5
Capabilities:
Access pe header
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4f4
mov eax, dword [0x7de403ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3cc], eax
xor ecx, ecx
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x478], eax
lea eax, [ebp - 0x408]
mov dword [ebp - 0x474], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x300]
mov dword [ebp - 0x470], eax
lea eax, [ebp - 0x2b8]
mov dword [ebp - 0x46c], eax
xor eax, eax
mov dword [ebp - 0x3fc], ecx
lea edi, [ebp - 0x3f8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x4f4], ecx
lea edi, [ebp - 0x4f0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x4dc], ecx
lea edi, [ebp - 0x4d8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov esi, dword [ebp + 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
inc eax
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x40c], eax
lea eax, [ebp - 0x2dc]
mov dword [ebp - 0x49c], eax
lea eax, [ebp - 0x324]
mov dword [ebp - 0x498], eax
lea eax, [ebp - 0x294]
push 0xa0
mov dword [ebp - 0x3d0], eax
push ecx
lea eax, [ebp - 0x3c4]
push eax
mov dword [ebp - 0x3d4], ecx
mov dword [ebp - 0x47c], ecx
mov dword [ebp - 0x448], ecx
mov dword [ebp - 0x3d8], ecx
mov dword [ebp - 0x3dc], ecx
mov dword [ebp - 0x450], ecx
mov dword [ebp - 0x3e4], ecx
mov dword [ebp - 0x444], ecx
mov dword [ebp - 0x400], 0x40
mov dword [ebp - 0x3e0], ecx
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x440], ecx
mov dword [ebp - 0x420], ecx
call sub.ntdll.dll_memset
lea eax, [ebp - 0x214]
mov dword [ebp - 0x2f8], eax
mov dword [ebp - 0x2f4], eax
mov dword [ebp - 0x2fc], eax
add esp, 0xc
xor eax, eax
mov ebx, 0x80
mov word [ebp - 0x214], ax
mov word [ebp - 0x300], ax
mov eax, ebx
mov word [ebp - 0x2fe], ax
mov dword [ebp - 0x2f0], ebx
mov dword [ebp - 0x2ec], ebx
lea eax, [ebp - 0x194]
mov dword [ebp - 0x2b0], eax
mov dword [ebp - 0x2ac], eax
mov dword [ebp - 0x2b4], eax
xor eax, eax
and dword [ebp - 0x404], 0
mov word [ebp - 0x194], ax
mov word [ebp - 0x2b8], ax
mov eax, ebx
mov word [ebp - 0x2b6], ax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x2d4], eax
mov dword [ebp - 0x2d0], eax
mov dword [ebp - 0x2d8], eax
xor eax, eax
mov word [ebp - 0x114], ax
mov word [ebp - 0x2dc], ax
mov eax, ebx
mov word [ebp - 0x2da], ax
lea eax, [ebp - 0x94]
mov dword [ebp - 0x31c], eax
mov dword [ebp - 0x318], eax
mov dword [ebp - 0x320], eax
xor eax, eax
test byte [esi + 4], 2
mov word [ebp - 0x94], ax
mov word [ebp - 0x324], ax
mov eax, ebx
mov word [ebp - 0x322], ax
mov ax, word [esi + 0xc]
mov dword [ebp - 0x2a8], ebx
mov dword [ebp - 0x2a4], ebx
mov dword [ebp - 0x2cc], ebx
mov dword [ebp - 0x2c8], ebx
mov dword [ebp - 0x314], ebx
mov dword [ebp - 0x310], ebx
mov word [ebp - 0x3c0], ax
jne 0x7dda6034
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 0x44c]
push eax
push 0x38
call dword [sym.imp.ntdll.dll_RtlGetThreadPreferredUILanguages]
mov edi, eax
cmp edi, 0xc0000023
je 0x7dda60cf
test edi, edi
jl 0x7dd79f7e
cmp dword [ebp - 0x44c], 0
je 0x7dda6129
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x400]
add eax, eax
mov word [ebp - 0x3ba], ax
mov word [ebp - 0x3bc], ax
mov eax, dword [esi + 0x14]
test eax, 0xffff0000
jne 0x7dd929cb
mov dword [ebp - 0x34c], eax
push dword [esi + 0x10]
mov edi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x364]
push eax
call edi
cmp word [ebp - 0x364], 0
je 0x7dd79aac
mov ecx, dword [ebp - 0x362]
mov edx, dword [ebp - 0x364]
mov eax, 0xfffe
and ecx, eax
and edx, eax
cmp edx, ecx
jae 0x7dda6135
movzx eax, word [ebp - 0x364]
mov ecx, dword [ebp - 0x360]
shr eax, 1
cmp word [ecx + eax*2], 0
jne 0x7dda6135
mov eax, dword [esi + 8]
test eax, eax
je 0x7dda6464
cmp word [eax], 0
je 0x7dda6464
mov ecx, dword [ebp - 0x3cc]
or dword [ebp - 0x3f8], 0xffffffff
test byte [esi + 4], 0x40
mov dword [ebp - 0x348], ecx
push eax
jne 0x7dda6151
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push dword [esi + 8]
call dword [sym.imp.ntdll.dll_RtlDetermineDosPathNameType_U]
push 0
push 0
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U_WithStatus]
mov edi, eax
test edi, edi
jl 0x7dd79f7e
push 0x2e
push dword [ebp - 0x418]
call sub.ntdll.dll_wcsrchr
mov dword [ebp - 0x3cc], eax
pop ecx
xor eax, eax
pop ecx
test byte [esi + 4], bl
je 0x7dd7d9f6
mov ecx, dword [esi + 0x1c]
mov dword [ebp - 0x3fc], eax
mov dword [ebp - 0x3f4], eax
mov dword [ebp - 0x3ec], ecx
mov dword [ebp - 0x3e8], eax
mov dword [ebp - 0x450], 1
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x3ec]
mov ecx, eax
or ecx, dword [ebp - 0x3e8]
je 0x7dda6361
lea ecx, [ebp - 0x47c]
push ecx
push 0
push dword [ebp - 0x448]
and eax, 0xfffffffc
push eax
push dword [ebp - 0x450]
call dword [sym.imp.ntdll.dll_RtlImageNtHeaderEx]
mov edi, eax
test edi, edi
jl 0x7dd7db2a
mov dword [ebp - 0x3c8], 1
lea eax, [ebp - 0x3fc]
mov dword [ebp - 0x3dc], eax
lea eax, [ebp - 0x4f4]
mov dword [ebp - 0x3d8], eax
xor eax, eax
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x3c8], eax
je 0x7dd7db4f
test byte [esi + 4], 8
je 0x7dda637c
mov ecx, dword [ebp - 0x41c]
mov dword [ebp - 0x43c], ecx
mov ecx, dword [ebp - 0x418]
mov dword [ebp - 0x438], ecx
xor ecx, ecx
test byte [esi + 4], 8
mov word [ebp - 0x434], cx
mov word [ebp - 0x432], cx
mov dword [ebp - 0x430], eax
je 0x7dd79c6f
mov eax, dword [esi + 0x14]
test eax, 0xffff0000
jne 0x7dda6386
cmp eax, 1
je 0x7dd79c6f
push eax
push 0x7dd7a194
lea eax, [ebp - 0x14]
push 8
push eax
call sub.ntdll.dll_swprintf_s
lea eax, [ebp - 0x14]
add esp, 0x10
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x7dd79c45
sub eax, edx
sar eax, 1
add eax, eax
mov word [ebp - 0x434], ax
push 0x10
pop eax
mov word [ebp - 0x432], ax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x3cc], 0
mov eax, dword [0x7dd790d0]
mov dword [ebp - 0x42c], eax
mov eax, dword [0x7dd790d4]
mov dword [ebp - 0x428], eax
je 0x7dd79ca8
push 0x7dd790bc
push dword [ebp - 0x3cc]
call sub.ntdll.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
je 0x7dd7db5d
lea eax, [ebp - 0x43c]
push eax
push 3
lea eax, [ebp - 0x300]
push eax
call dword [sym.imp.ntdll.dll_RtlMultiAppendUnicodeStringBuffer]
mov edi, eax
test edi, edi
jl 0x7dd79f7e
mov eax, dword [ebp - 0x408]
mov ecx, dword [ebp - 0x404]
mov dword [ebp - 0x43c], eax
sub eax, dword [ebp - 0x3d4]
mov dword [ebp - 0x438], ecx
mov word [ebp - 0x43c], ax
lea eax, [ebp - 0x43c]
push eax
push 3
lea eax, [ebp - 0x2b8]
push eax
call dword [sym.imp.ntdll.dll_RtlMultiAppendUnicodeStringBuffer]
mov edi, eax
test edi, edi
jl 0x7dd79f7e
cmp dword [ebp - 0x3c8], 0
je 0x7dd79dc2
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x494], eax
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x490], eax
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0x48c], eax
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x488], eax
mov eax, dword [0x7dd791a4]
mov dword [ebp - 0x484], eax
mov eax, dword [0x7dd791a8]
mov dword [ebp - 0x480], eax
lea eax, [ebp - 0x494]
push eax
push 3
lea eax, [ebp - 0x2dc]
push eax
call dword [sym.imp.ntdll.dll_RtlMultiAppendUnicodeStringBuffer]
mov edi, eax
test edi, edi
jl 0x7dd79f7e
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0x494], eax
mov eax, dword [ebp - 0x404]
mov dword [ebp - 0x490], eax
lea eax, [ebp - 0x494]
push eax
push 3
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.ntdll.dll_RtlMultiAppendUnicodeStringBuffer]
mov edi, eax
test edi, edi
jl 0x7dd79f7e
test byte [ebp + 8], 1
jne 0x7dda6399
xor eax, eax
inc eax
cmp dword [ebp - 0x3c8], 0
lea ecx, [ebp - 0x49c]
je 0x7dd7db78
mov dword [ebp - 0x3d4], ecx
mov ecx, dword [esi + 0x14]
mov edx, ecx
dec edx
neg edx
sbb edx, edx
not edx
lea edi, [ebp - 0x38c]
and edx, edi
push edx
lea edx, [ebp - 0x3b4]
push edx
lea edx, [ebp - 0x3c4]
push edx
mov edx, ecx
dec edx
neg edx
sbb edx, edx
not edx
lea edi, [ebp - 0x4dc]
and edx, edi
push edx
mov edx, ecx
dec edx
neg edx
sbb edx, edx
not edx
lea edi, [ebp - 0x470]
and edx, edi
push edx
push ecx
push dword [ebp - 0x3dc]
mov ecx, dword [ebp - 0x3c8]
neg ecx
sbb ecx, ecx
lea edx, [ebp - 0x478]
and ecx, edx
push ecx
push dword [ebp - 0x3d8]
neg eax
sbb eax, eax
and eax, dword [ebp - 0x3d4]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x1200a9
push eax
call fcn.7dd790ed
cmp dword [ebp - 0x3c4], 0
mov edi, eax
je 0x7dda63a0
test byte [ebp - 0x3c4], 2
jne 0x7dd79e89
push edi
call fcn.7dd7918b
test eax, eax
jne 0x7dd8fb24
test edi, edi
jl 0x7dda63a4
cmp dword [esi + 0x14], 1
je 0x7dd79eae
mov eax, dword [ebp - 0x470]
mov ecx, dword [eax]
mov dword [ebp - 0x388], ecx
mov eax, dword [eax + 4]
mov dword [ebp - 0x384], eax
test byte [ebp - 0x3c4], 8
jne 0x7dd79f4d
mov eax, dword [ebp - 0x3fc]
test eax, eax
jne 0x7dd7db83
push 0x60
lea eax, [ebp - 0x408]
mov dword [ebp - 0x460], eax
push 5
lea eax, [ebp - 0x4c4]
push eax
lea eax, [ebp - 0x468]
push eax
xor esi, esi
push 0x120089
lea eax, [ebp - 0x3e4]
push eax
mov dword [ebp - 0x468], 0x18
mov dword [ebp - 0x464], esi
mov dword [ebp - 0x45c], 0x40
mov dword [ebp - 0x458], esi
mov dword [ebp - 0x454], esi
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov edi, eax
cmp edi, esi
jl 0x7dda6169
mov dword [ebp - 0x444], 1
push 0
push dword [ebp - 0x3e4]
call fcn.7dd7905b
test eax, eax
jne 0x7dd79f4d
or dword [ebp - 0x3c4], 0x40
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
test dword [eax + 8], 0x8000
jne 0x7dda63fa
lea eax, [ebp - 0x3c4]
push eax
call fcn.7dd7a1a3
mov edi, eax
test edi, edi
jl 0x7dda6405
xor edi, edi
cmp dword [ebp - 0x440], 0
jne 0x7dda6486
cmp dword [ebp - 0x410], 0
jne 0x7dd7db8e
xor esi, esi
cmp dword [ebp - 0x40c], esi
jne 0x7dda64a0
cmp dword [ebp - 0x3d8], esi
je 0x7dd79fb9
push dword [ebp - 0x3d8]
call fcn.7dd78d7f
cmp dword [ebp - 0x3dc], esi
je 0x7dd79fcd
cmp dword [ebp - 0x410], esi
jne 0x7dd929bb
lea eax, [ebp - 0x4dc]
push eax
call fcn.7dd78d7f
cmp dword [ebp - 0x444], esi
je 0x7dd79ff5
cmp dword [ebp - 0x3e4], esi
je 0x7dd79ff5
push dword [ebp - 0x3e4]
call dword [sym.imp.ntdll.dll_NtClose]
push dword [ebp - 0x404]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [sym.imp.ntdll.dll_RtlFreeHeap]
push esi
push dword [eax + 0x18]
call ebx
mov ecx, dword [ebp - 0x2f8]
mov eax, dword [ebp - 0x2f4]
cmp ecx, esi
mov esi, dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
je 0x7dd7a040
cmp ecx, eax
jne 0x7dd7a82a
mov ecx, dword [ebp - 0x2ec]
mov dword [ebp - 0x2f8], eax
mov dword [ebp - 0x2f0], ecx
mov dword [ebp - 0x2fc], eax
test eax, eax
je 0x7dd7a04f
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 0x2b0]
xor eax, eax
mov word [ebp - 0x300], ax
mov ax, word [ebp - 0x2ec]
mov word [ebp - 0x2fe], ax
mov eax, dword [ebp - 0x2ac]
test ecx, ecx
je 0x7dd7a090
cmp ecx, eax
jne 0x7dd7a7dc
mov ecx, dword [ebp - 0x2a4]
mov dword [ebp - 0x2b0], eax
mov dword [ebp - 0x2a8], ecx
mov dword [ebp - 0x2b4], eax
test eax, eax
je 0x7dd7a09f
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 0x2d4]
xor eax, eax
mov word [ebp - 0x2b8], ax
mov ax, word [ebp - 0x2a4]
mov word [ebp - 0x2b6], ax
mov eax, dword [ebp - 0x2d0]
test ecx, ecx
je 0x7dd7a0e0
cmp ecx, eax
jne 0x7dd7a7f6
mov ecx, dword [ebp - 0x2c8]
mov dword [ebp - 0x2d4], eax
mov dword [ebp - 0x2cc], ecx
mov dword [ebp - 0x2d8], eax
test eax, eax
je 0x7dd7a0ef
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 0x31c]
xor eax, eax
mov word [ebp - 0x2dc], ax
mov ax, word [ebp - 0x2c8]
mov word [ebp - 0x2da], ax
mov eax, dword [ebp - 0x318]
test ecx, ecx
je 0x7dd7a130
cmp ecx, eax
jne 0x7dd7a810
mov ecx, dword [ebp - 0x310]
mov dword [ebp - 0x31c], eax
mov dword [ebp - 0x314], ecx
mov dword [ebp - 0x320], eax
test eax, eax
je 0x7dd7a13f
xor ecx, ecx
mov word [eax], cx
xor eax, eax
cmp dword [ebp - 0x3d0], 0
mov word [ebp - 0x324], ax
mov ax, word [ebp - 0x310]
mov word [ebp - 0x322], ax
je 0x7dd7a171
lea eax, [ebp - 0x294]
cmp dword [ebp - 0x3d0], eax
jne 0x7dda64b1
cmp dword [ebp - 0x3e0], 0
jne 0x7dda64cc
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.7dd71442
leave
ret 0xc
lea eax, [ebp - 0x4b4]
push eax
mov dword [ebp - 0x4b0], ecx
call esi
mov eax, dword [ebp - 0x2ac]
jmp 0x7dd7a07e
lea eax, [ebp - 0x4ac]
push eax
mov dword [ebp - 0x4a8], ecx
call esi
mov eax, dword [ebp - 0x2d0]
jmp 0x7dd7a0ce
lea eax, [ebp - 0x4bc]
push eax
mov dword [ebp - 0x4b8], ecx
call esi
mov eax, dword [ebp - 0x318]
jmp 0x7dd7a11e
lea eax, [ebp - 0x4a4]
push eax
mov dword [ebp - 0x4a0], ecx
call esi
mov eax, dword [ebp - 0x2f4]
jmp 0x7dd7a02e
push 0x60
mov dword [ebp - 0x464], eax
mov dword [ebp - 0x458], eax
mov dword [ebp - 0x454], eax
push 5
lea eax, [ebp - 0x4c4]
push eax
lea eax, [ebp - 0x468]
push eax
push 0x1200a9
lea eax, [ebp - 0x3fc]
lea ecx, [ebp - 0x408]
push eax
mov dword [ebp - 0x468], 0x18
mov dword [ebp - 0x45c], 0x40
mov dword [ebp - 0x460], ecx
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov edi, eax
test edi, edi
jl 0x7dda6169
cmp dword [ebp - 0x3cc], 0
je 0x7dd7da93
push 0x7dd7db20
push dword [ebp - 0x3cc]
call sub.ntdll.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
je 0x7dd9d601
push 0x7dd7d9ec
push dword [ebp - 0x3cc]
call sub.ntdll.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
je 0x7dd9d601
cmp dword [ebp - 0x3f4], 0
jne 0x7dd7dabe
push dword [ebp - 0x3fc]
lea eax, [ebp - 0x3f4]
push 0x8000000
push 2
push 0
push 0
push 4
push eax
call dword [sym.imp.ntdll.dll_NtCreateSection]
mov edi, eax
test edi, edi
jl 0x7dda62f4
push 2
xor eax, eax
push eax
push 1
lea ecx, [ebp - 0x448]
push ecx
push eax
push eax
push eax
mov dword [ebp - 0x3c8], eax
lea eax, [ebp - 0x3c8]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x3f4]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov edi, eax
test edi, edi
jl 0x7dda6272
mov eax, dword [ebp - 0x3c8]
xor ecx, ecx
mov dword [ebp - 0x3e8], ecx
cmp dword [ebp - 0x420], ecx
jne 0x7dd7db15
or eax, 1
mov dword [ebp - 0x3ec], eax
jmp 0x7dd79b67
cmp edi, 0xc000007b
jne 0x7dd79f7e
and dword [ebp - 0x3c8], 0
and dword [ebp - 0x3dc], 0
lea eax, [ebp - 0x3fc]
jmp 0x7dd79bc0
cmp dword [esi + 0x14], eax
je 0x7dd79be4
jmp 0x7dda6357
mov eax, 0xffee
add word [ebp - 0x43c], ax
mov dword [ebp - 0x3d4], 0x12
jmp 0x7dd79ca8
lea ecx, [ebp - 0x478]
jmp 0x7dd79dd8
mov dword [ebp - 0x3e4], eax
jmp 0x7dd79f35
mov eax, dword [ebp - 0x3ec]
mov ecx, eax
xor esi, esi
or ecx, dword [ebp - 0x3e8]
je 0x7dd79f9a
cmp dword [ebp - 0x420], esi
jne 0x7dd79f9a
and eax, 0xfffffffc
mov dword [ebp - 0x3ec], eax
mov dword [ebp - 0x3e8], esi
jmp 0x7dd79f9a
xor edi, edi
jmp 0x7dd79e89
push dword [ebp - 0x3dc]
call fcn.7dd78d7f
jmp 0x7dd79fcd
or dword [ebp - 0x34c], 0xffffffff
jmp 0x7dd79a59
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0xf70]
mov eax, dword [eax + 0x14d0]
mov ecx, dword [0x7de40388]
cmp ecx, dword [eax]
jb 0x7dd7da93
push dword [ebp - 0x3fc]
lea eax, [ebp - 0x3f4]
push 0x1000000
push 2
push 0
push 0
push 4
push eax
call dword [sym.imp.ntdll.dll_NtCreateSection]
mov edi, eax
test edi, edi
jl 0x7dda61eb
mov dword [ebp - 0x420], 1
jmp 0x7dd7da93
lea eax, [ebp - 0x414]
push eax
push 0
lea eax, [ebp - 0x424]
push eax
push 0x48
call dword [sym.imp.ntdll.dll_RtlGetThreadPreferredUILanguages]
mov edi, eax
test edi, edi
jl 0x7dd7db8e
cmp dword [ebp - 0x424], 0
jbe 0x7dda60b6
mov eax, dword fs:[0x18]
mov ecx, dword [ebp - 0x414]
mov eax, dword [eax + 0x30]
add ecx, ecx
push ecx
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x3e0], eax
test eax, eax
jne 0x7dda6090
mov edi, 0xc0000017
jmp 0x7dd7db8e
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x3e0]
lea eax, [ebp - 0x424]
push eax
push 0x48
call dword [sym.imp.ntdll.dll_RtlGetThreadPreferredUILanguages]
mov edi, eax
test edi, edi
jl 0x7dd7db8e
movzx eax, word [esi + 0xe]
push eax
call sym.KERNEL32.dll_SetThreadUILanguage
mov dword [ebp - 0x440], 1
jmp 0x7dd799e3
mov eax, dword fs:[0x18]
mov ecx, dword [ebp - 0x400]
mov eax, dword [eax + 0x30]
add ecx, ecx
push ecx
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x3d0], eax
test eax, eax
jne 0x7dda60fe
add edi, 0xfffffff4
jmp 0x7dd79f7e
lea eax, [ebp - 0x400]
push eax
push dword [ebp - 0x3d0]
lea eax, [ebp - 0x44c]
push eax
push 0x38
call dword [sym.imp.ntdll.dll_RtlGetThreadPreferredUILanguages]
mov edi, eax
test edi, edi
jge 0x7dd79a23
jmp 0x7dd79f7e
and dword [ebp - 0x3d0], 0
jmp 0x7dd79a23
push 0x7dda6620
push 0x7dda65ec
push 0
push 0x33
call dword [sym.imp.ntdll.dll_DbgPrintEx]
add esp, 0x10
jmp 0x7dda647c
lea eax, [ebp - 0x35c]
push eax
mov dword [ebp - 0x3c4], 8
call edi
jmp 0x7dd79eae
cmp edi, 0xc0000034
je 0x7dd79f7e
cmp edi, 0xc0000089
je 0x7dd79f7e
cmp edi, 0xc000008a
je 0x7dd79f7e
cmp edi, 0xc000008b
je 0x7dd79f7e
cmp edi, 0xc0000204
je 0x7dd79f7e
cmp edi, 0xc0150002
je 0x7dd79f7e
cmp edi, 0xc0150004
je 0x7dd79f7e
cmp edi, 0xc000000f
je 0x7dd79f7e
push dword [ebp - 0x460]
push 0x7dda6620
push 0x7dda65c8
push 0
push 0x33
call dword [sym.imp.ntdll.dll_DbgPrintEx]
add esp, 0x14
jmp 0x7dd79f7e
cmp edi, 0xc000007b
je 0x7dda626b
cmp edi, 0xc000012f
je 0x7dda626b
cmp edi, 0xc0000130
je 0x7dda626b
cmp edi, 0xc0000131
je 0x7dda626b
cmp edi, 0xc000035a
je 0x7dda626b
cmp edi, 0xc0000034
je 0x7dda6257
cmp edi, 0xc0000089
je 0x7dda6257
cmp edi, 0xc000008a
je 0x7dda6257
cmp edi, 0xc000008b
je 0x7dda6257
cmp edi, 0xc0000204
je 0x7dda6257
cmp edi, 0xc0150002
je 0x7dda6257
cmp edi, 0xc0150004
je 0x7dda6257
cmp edi, 0xc000000f
je 0x7dda6257
xor eax, eax
jmp 0x7dda625a
push 2
pop eax
push edi
push 0x7dda6620
push 0x7ddb3700
push eax
jmp 0x7dda61db
xor edi, edi
jmp 0x7dd7da93
cmp edi, 0xc0000017
je 0x7dda62dc
cmp edi, 0xc0000034
je 0x7dda62be
cmp edi, 0xc0000089
je 0x7dda62be
cmp edi, 0xc000008a
je 0x7dda62be
cmp edi, 0xc000008b
je 0x7dda62be
cmp edi, 0xc0000204
je 0x7dda62be
cmp edi, 0xc0150002
je 0x7dda62be
cmp edi, 0xc0150004
je 0x7dda62be
cmp edi, 0xc000000f
je 0x7dda62be
xor eax, eax
jmp 0x7dda62c1
push 2
pop eax
push 0x7dda6620
push 0x7dda65a0
push eax
push 0x33
call dword [sym.imp.ntdll.dll_DbgPrintEx]
add esp, 0x10
jmp 0x7dd79f7e
push dword [ebp - 0x3f4]
call dword [sym.imp.ntdll.dll_NtClose]
and dword [ebp - 0x3f4], 0
jmp 0x7dd79b67
cmp edi, 0xc0000040
je 0x7dd79b67
cmp edi, 0xc0000034
je 0x7dda6344
cmp edi, 0xc0000089
je 0x7dda6344
cmp edi, 0xc000008a
je 0x7dda6344
cmp edi, 0xc000008b
je 0x7dda6344
cmp edi, 0xc0000204
je 0x7dda6344
cmp edi, 0xc0150002
je 0x7dda6344
cmp edi, 0xc0150004
je 0x7dda6344
cmp edi, 0xc000000f
je 0x7dda6344
xor eax, eax
jmp 0x7dda6347
push 2
pop eax
push edi
push 0x7dda6620
push 0x7dda656c
jmp 0x7dda6265
mov edi, 0xc000007b
jmp 0x7dd79f7e
xor eax, eax
cmp dword [esi + 0x14], eax
setne al
mov dword [ebp - 0x3c8], eax
test eax, eax
jne 0x7dd79bae
jmp 0x7dd7db3d
mov edi, 0xc000008a
jmp 0x7dd79f7e
push eax
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
jmp 0x7dd79c6f
xor eax, eax
jmp 0x7dd79dc5
test edi, edi
jge 0x7dda63e8
cmp edi, 0xc0000034
je 0x7dda63e8
cmp edi, 0xc0000089
je 0x7dda63e8
cmp edi, 0xc000008a
je 0x7dda63e8
cmp edi, 0xc000008b
je 0x7dda63e8
cmp edi, 0xc0000204
je 0x7dda63e8
cmp edi, 0xc0150002
je 0x7dda63e8
cmp edi, 0xc0150004
je 0x7dda63e8
cmp edi, 0xc000000f
je 0x7dda63e8
xor eax, eax
jmp 0x7dda63eb
push 2
pop eax
push 0x7dda6620
push 0x7dda6540
jmp 0x7dda62cb
or dword [ebp - 0x3c4], ebx
jmp 0x7dd79f66
cmp edi, 0xc0000022
je 0x7dda6451
cmp edi, 0xc0000034
je 0x7dda6451
cmp edi, 0xc0000089
je 0x7dda6451
cmp edi, 0xc000008a
je 0x7dda6451
cmp edi, 0xc000008b
je 0x7dda6451
cmp edi, 0xc0000204
je 0x7dda6451
cmp edi, 0xc0150002
je 0x7dda6451
cmp edi, 0xc0150004
je 0x7dda6451
cmp edi, 0xc000000f
je 0x7dda6451
xor eax, eax
jmp 0x7dda6454
push 2
pop eax
push edi
push 0x7dda6620
push 0x7dda6508
jmp 0x7dda6265
push eax
push 0x7dda6620
push 0x7dda64e8
push 0
push 0x33
call dword [sym.imp.ntdll.dll_DbgPrintEx]
add esp, 0x14
mov edi, 0xc000000d
jmp 0x7dd79f7e
lea eax, [ebp - 0x424]
push eax
push dword [ebp - 0x3e0]
push 8
call dword [sym.imp.ntdll.dll_RtlSetThreadPreferredUILanguages]
jmp 0x7dd79f8b
lea eax, [ebp - 0x3fc]
push eax
call fcn.7dd78d7f
jmp 0x7dd79fa6
push dword [ebp - 0x3d0]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call ebx
jmp 0x7dd7a171
push dword [ebp - 0x3e0]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call ebx
jmp 0x7dd7a17e