Function at 0x75b8a77a
Capabilities:
Get file attributes
Read file on windows
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x75b8e004]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0x14]
push ebx
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x18]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp + 0x1c]
push 0x44
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x68]
push str.SystemRoot_system32perf0000.dat
push eax
call sub.msvcrt.dll_memmove
add esp, 0xc
xor esi, esi
cmp dword [0x75b8e4f0], 4
mov ebx, 0x75b825c8
jb 0x75b8a805
mov eax, dword [edi + 4]
cmp eax, esi
je 0x75b8a7e5
push eax
call sub.msvcrt.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
jmp 0x75b8a7e7
xor eax, eax
push esi
push eax
push dword [edi + 4]
lea eax, [ebp + 8]
push 4
push eax
push esi
push 0x10
push 0x18
push 0x81
push ebx
call fcn.75b85e47
add esp, 0x28
mov eax, dword [ebp + 8]
cmp eax, 7
je 0x75b8a838
cmp eax, 8
je 0x75b8a838
mov dword [ebp - 0x8c], esi
cmp eax, 5
je 0x75b8a871
cmp eax, 7
je 0x75b8a871
push 0x75b82674
call sub.msvcrt.dll_wcslen
mov dword [ebp - 0x88], 0x68
jmp 0x75b8a885
cmp dword [ebp - 0x78], esi
mov dword [ebp - 0x8c], 1
je 0x75b8a84c
cmp dword [ebp - 0x74], esi
jne 0x75b8a818
cmp dword [0x75b8e4f0], 4
jb 0x75b8a869
push esi
push 0x57
push esi
push 0x18
push 0x8d
push ebx
call fcn.75b85e47
add esp, 0x18
push 0x57
pop eax
jmp 0x75b8ac63
push 0x75b82664
mov dword [ebp - 0x88], 0x63
call sub.msvcrt.dll_wcslen
cmp dword [ebp - 0x6c], esi
pop ecx
jne 0x75b8a8df
mov ecx, dword [edi + 4]
movzx edx, word [edi]
lea ecx, [ecx + eax*2]
mov dword [ebp - 0x6c], ecx
lea eax, [eax + eax + 6]
cmp edx, eax
jb 0x75b8a8be
mov ecx, dword [ebp - 0x6c]
mov cx, word [ecx]
cmp cx, 0x30
jb 0x75b8a8b1
cmp cx, 0x39
jbe 0x75b8a8c5
add dword [ebp - 0x6c], 2
inc eax
inc eax
cmp eax, 6
jbe 0x75b8a8c5
jmp 0x75b8a89b
mov dword [ebp - 0x6c], 0x75b8e4a4
push dword [ebp - 0x6c]
call fcn.75b8a6a3
mov eax, dword [ebp - 0x6c]
push eax
mov dword [ebp - 0x6c], eax
call fcn.75b8a3f9
mov edi, eax
cmp edi, esi
jne 0x75b8a8e2
mov edi, dword [ebp - 0x6c]
mov ax, word [edi + 6]
cmp ax, 0x30
jb 0x75b8a8f9
cmp ax, 0x39
mov dword [ebp - 0x6c], 1
jbe 0x75b8a8fc
mov dword [ebp - 0x6c], esi
cmp dword [ebp - 0x6c], esi
push 0x19
pop eax
je 0x75b8a927
push 0x44
lea eax, [ebp - 0x68]
push str.SystemRoot_system32prf00000.dat
push eax
mov dword [ebp - 0x90], 0x18
call sub.msvcrt.dll_memmove
mov eax, dword [ebp - 0x90]
add esp, 0xc
mov cx, word [ebp - 0x88]
add eax, eax
mov word [ebp + eax - 0x68], cx
mov cx, word [edi]
inc edi
inc edi
mov word [ebp + eax - 0x66], cx
mov cx, word [edi]
inc edi
inc edi
cmp dword [ebp - 0x6c], esi
mov word [ebp + eax - 0x64], cx
mov cx, word [edi]
mov word [ebp + eax - 0x62], cx
je 0x75b8a95f
mov cx, word [edi + 2]
mov word [ebp + eax - 0x60], cx
cmp dword [0x75b8e4f0], 4
jb 0x75b8a993
lea eax, [ebp - 0x68]
push esi
push eax
call sub.msvcrt.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x68]
push eax
push esi
push 1
push 0x18
pop edi
push edi
push 0xce
push ebx
call fcn.75b85e47
add esp, 0x20
jmp 0x75b8a996
push 0x18
pop edi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
cmp dword [ebp - 0x8c], esi
lea eax, [ebp - 0xcc]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xac], edi
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0xa0], 0x40
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0x98], esi
lea eax, [ebp - 0x80]
je 0x75b8aa8e
push esi
push esi
push 0x20
push esi
push 1
push 0x80
push esi
push eax
lea eax, [ebp - 0xac]
push eax
push 0x40100000
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x90], esi
mov dword [ebp - 0x94], esi
call dword [sym.imp.ntdll.dll_NtCreateFile]
cmp eax, esi
mov dword [ebp - 0x6c], eax
jge 0x75b8aa3f
cmp dword [0x75b8e4f0], 4
jb 0x75b8ab3f
push esi
push eax
push esi
push edi
push 0xec
push ebx
call fcn.75b85e47
add esp, 0x18
jmp 0x75b8ab3f
push esi
lea eax, [ebp - 0x94]
push eax
mov eax, dword [ebp - 0x74]
push dword [eax]
lea eax, [ebp - 0x80]
push dword [ebp - 0x78]
push eax
push esi
push esi
push esi
push dword [ebp - 0x70]
call dword [sym.imp.ntdll.dll_NtWriteFile]
mov edi, eax
cmp edi, esi
jge 0x75b8abd1
cmp dword [0x75b8e4f0], 4
jb 0x75b8abd1
push esi
push edi
push esi
push 0x18
push 0xfe
push ebx
call fcn.75b85e47
add esp, 0x18
jmp 0x75b8abd1
push 0x60
push 7
push eax
lea eax, [ebp - 0xac]
push eax
push 0x80100000
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.ntdll.dll_NtOpenFile]
cmp eax, esi
mov dword [ebp - 0x6c], eax
jge 0x75b8aacb
cmp dword [0x75b8e4f0], 4
jb 0x75b8ab3f
push esi
push eax
push esi
push edi
push 0x111
jmp 0x75b8aa31
push 5
push edi
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x70]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
cmp eax, esi
mov dword [ebp - 0x6c], eax
jl 0x75b8ab1b
cmp dword [ebp - 0xb8], esi
je 0x75b8ab14
cmp dword [0x75b8e4f0], 4
mov eax, 0x80000005
mov dword [ebp - 0x6c], eax
jb 0x75b8ab36
push esi
push eax
push esi
push edi
push 0x120
push ebx
call fcn.75b85e47
add esp, 0x18
mov eax, dword [ebp - 0x6c]
cmp eax, esi
jge 0x75b8ab47
cmp dword [0x75b8e4f0], 4
jb 0x75b8ab36
push esi
push eax
push esi
push edi
push 0x126
push ebx
call fcn.75b85e47
add esp, 0x18
push dword [ebp - 0x70]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [ebp - 0x6c]
jmp 0x75b8ac63
cmp dword [ebp - 0x78], esi
je 0x75b8abe1
mov ecx, dword [ebp - 0x74]
cmp ecx, esi
je 0x75b8abe1
mov eax, dword [ebp - 0xbc]
cmp dword [ecx], eax
jb 0x75b8abe1
push esi
push esi
push eax
push dword [ebp - 0x78]
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
push dword [ebp - 0x70]
call dword [sym.imp.ntdll.dll_NtReadFile]
mov edi, eax
cmp edi, esi
jl 0x75b8ab9a
mov edi, dword [ebp - 0x80]
cmp edi, esi
jl 0x75b8abd1
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0xbc]
je 0x75b8abb6
mov edi, 0xc0000011
jmp 0x75b8abb6
cmp dword [0x75b8e4f0], 4
jb 0x75b8abb6
push esi
push edi
push esi
push 0x18
push 0x163
push ebx
call fcn.75b85e47
add esp, 0x18
cmp edi, esi
jl 0x75b8abd1
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0xbc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
cmp eax, esi
je 0x75b8abd1
mov dword [eax], ecx
push dword [ebp - 0x70]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
jmp 0x75b8ac63
push dword [ebp - 0x70]
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [0x75b8e4f0], 4
jb 0x75b8ac07
push esi
push dword [ebp - 0x6c]
push esi
push edi
push 0x12f
push ebx
call fcn.75b85e47
add esp, 0x18
mov edi, dword [ebp - 0x84]
cmp edi, esi
je 0x75b8ac13
mov dword [edi], esi
cmp dword [ebp - 0x78], esi
je 0x75b8ac52
cmp dword [0x75b8e4f0], 4
jb 0x75b8ac36
push esi
push dword [ebp - 0x6c]
push esi
push 0x18
push 0x137
push ebx
call fcn.75b85e47
add esp, 0x18
cmp edi, esi
je 0x75b8ac4b
mov eax, dword [ebp - 0x74]
cmp eax, esi
je 0x75b8ac4b
mov ecx, dword [ebp - 0xbc]
mov dword [edi], esi
mov dword [eax], ecx
mov eax, 0x80000005
jmp 0x75b8ac63
mov eax, dword [ebp - 0x74]
cmp eax, esi
je 0x75b8ac61
mov ecx, dword [ebp - 0xbc]
mov dword [eax], ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.75b8c8aa
leave
ret 0x18