Function at 0x7dd9a35e
Capabilities:
Access pe header

Disassembly:
push 0x80
push 0x7dd9a4a8
call fcn.7dd715c0
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x19], bl
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x48]
push eax
push ebx
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_RtlDosPathNameToRelativeNtPathName_U]
cmp al, bl
je 0x7dda58ce
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x48]
cmp ax, bx
jne 0x7dda58dd
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x60], 0x18
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x54], 0x40
lea eax, [ebp - 0x30]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
push 0x60
push 5
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x60]
push eax
push 0x100020
lea eax, [ebp + 8]
push eax
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov esi, eax
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.ntdll.dll_RtlReleaseRelativeName]
cmp esi, ebx
jl 0x7dda58eb
push dword [ebp + 8]
push 0x1000000
push 0x10
push ebx
push ebx
push 0xf001f
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntdll.dll_NtCreateSection]
mov edi, eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtClose]
cmp edi, ebx
jl 0x7dda58ee
push ebx
push 0x30
lea eax, [ebp - 0x90]
push eax
push 1
push dword [ebp - 0x24]
call dword [sym.imp.ntdll.dll_NtQuerySection]
cmp eax, ebx
jl 0x7dda5976
test dword [ebp - 0x74], 0x2000
jne 0x7dda597c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 8]
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov ecx, eax
mov ax, word [ebp - 0x70]
cmp ax, word [ecx + 4]
jne 0x7dda598c
cmp dword [ebp - 0x80], 2
jne 0x7dda59b1
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
mov byte [ebp - 0x19], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.7dd9a4c9
movzx eax, byte [ebp - 0x19]
call fcn.7dd71605
ret 8
push 0xc0000033
call sym.KERNEL32.dll_BaseSetLastNTError
jmp 0x7dd9a48c
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], eax
jmp 0x7dd9a3ad
push esi
jmp 0x7dda58d3
mov dword [ebp - 0x24], ebx
cmp edi, 0xc000011b
je 0x7dda596a
mov esi, 0xc000012f
cmp edi, esi
je 0x7dda5945
cmp edi, 0xc0000130
je 0x7dda596a
cmp edi, 0xc0000131
je 0x7dda5939
cmp edi, 0xc0000359
je 0x7dda5931
cmp edi, 0xc000035a
je 0x7dda5925
push edi
jmp 0x7dda58d3
mov dword [ebp - 0x20], 6
jmp 0x7dd9a480
mov dword [ebp - 0x20], ebx
jmp 0x7dd9a480
mov dword [ebp - 0x20], 2
jmp 0x7dd9a480
push esi
lea eax, [ebp - 0x30]
push eax
call fcn.7ddf981a
mov dword [ebp - 0x20], eax
cmp eax, ebx
je 0x7dda58eb
xor ecx, ecx
cmp eax, 3
sete cl
lea ecx, [ecx + ecx + 1]
mov dword [ebp - 0x20], ecx
jmp 0x7dd9a480
mov dword [ebp - 0x20], 1
jmp 0x7dd9a480
push eax
jmp 0x7dda58d3
push 0xc1
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
jmp 0x7dd9a48c
movzx eax, ax
cmp eax, 0x14c
je 0x7dda59a9
cmp eax, 0x200
je 0x7dda5925
cmp eax, 0x8664
jne 0x7dda597c
jmp 0x7dda5925
mov dword [ebp - 0x20], ebx
jmp 0x7dd9a476
cmp dword [ebp - 0x80], 3
je 0x7dd9a480
cmp dword [ebp - 0x80], 7
jne 0x7dd9a480
mov dword [ebp - 0x20], 4
jmp 0x7dd9a480