Function at 0x7ddeec91
Capabilities:
Read file on windows

Disassembly:
push 0x54
push 0x7ddeef20
call fcn.7dd715c0
mov eax, dword [ebp + 0x20]
mov esi, dword [eax]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x1c], 1
xor edi, edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 4], edi
or dword [ebp + 0x24], 0x8000000
cmp dword [ebp + 0x28], edi
je 0x7ddeecc7
or dword [ebp + 0x24], 0x200000
push dword [ebp + 8]
push dword [ebp + 0x24]
push 3
push edi
push 3
push 0xc0010000
push dword [ebp + 0xc]
call sub.API_MS_Win_Core_File_L1_1_0.dll_CreateFileW
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
cmp eax, 0xffffffff
je 0x7ddeedd5
push edi
lea ecx, [ebp - 0x24]
push ecx
push 0x38
lea ecx, [ebp - 0x64]
push ecx
push eax
call sub.API_MS_Win_Core_File_L1_1_0.dll_ReadFile
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x7ddeeebc
cmp dword [ebp - 0x24], 0x38
jne 0x7ddeeebc
mov eax, 0x7a9b
cmp word [ebp - 0x64], ax
jne 0x7ddeeea5
cmp word [ebp - 0x62], 0x38
jne 0x7ddeeea5
mov eax, dword [ebp - 0x44]
mov edi, dword [ebp + 0x18]
cmp eax, dword [edi + 0x20]
jne 0x7ddeeea5
mov eax, dword [ebp - 0x40]
cmp eax, dword [edi + 0x24]
jne 0x7ddeeea5
mov eax, dword [ebp - 0x4c]
cmp eax, dword [edi + 0x18]
jne 0x7ddeeea5
mov eax, dword [ebp - 0x48]
cmp eax, dword [edi + 0x1c]
jne 0x7ddeeea5
mov eax, dword [ebp - 0x60]
cmp eax, dword [edi + 4]
jne 0x7ddeeea5
mov eax, dword [ebp - 0x5c]
cmp eax, dword [edi + 8]
jne 0x7ddeeea5
mov eax, dword [ebp - 0x58]
cmp eax, dword [edi + 0xc]
jne 0x7ddeeea5
mov eax, dword [ebp - 0x54]
cmp eax, dword [edi + 0x10]
jne 0x7ddeeea5
mov eax, dword [ebp - 0x50]
cmp eax, dword [edi + 0x14]
jne 0x7ddeeea5
push 0x1a
lea eax, [ebp - 0x64]
push eax
call fcn.7ddee121
cmp dword [ebp - 0x30], eax
jne 0x7ddeeea5
mov eax, dword [ebp - 0x34]
mov dword [edi + 0x30], eax
mov ecx, dword [ebp - 0x3c]
mov dword [edi + 0x28], ecx
mov edx, dword [ebp - 0x38]
mov dword [edi + 0x2c], edx
xor edx, edx
cmp eax, edx
jne 0x7ddeede1
cmp esi, edx
je 0x7ddeedd5
mov dword [esi + 8], ecx
mov eax, dword [ebp - 0x38]
mov dword [esi + 0xc], eax
mov dword [ebp - 0x1c], 1
jmp 0x7ddeeee3
cmp esi, edx
je 0x7ddeee84
mov edi, dword [ebp + 0x1c]
mov eax, dword [edi]
mov dword [esi + 8], eax
mov eax, dword [edi + 4]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x34]
mov dword [esi + 0x10], eax
cmp dword [esi + 0x1c], edx
je 0x7ddeee5e
call sub.ntdll.dll_RtlGetCurrentTransaction
mov dword [ebp - 0x2c], eax
push 0
call sub.ntdll.dll_RtlSetCurrentTransaction
xor eax, eax
inc eax
mov dword [ebp - 4], eax
push dword [esi + 0x18]
push dword [ebx]
push dword [ebp + 8]
push eax
push eax
push dword [esi + 0xc]
push dword [esi + 8]
push dword [edi + 4]
push dword [edi]
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
push dword [esi]
call dword [esi + 0x1c]
mov dword [ebp - 0x20], eax
and dword [ebp - 4], 0
call fcn.7ddeee55
xor edx, edx
jmp 0x7ddeee61
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], 1
je 0x7ddeee8d
cmp dword [esi + 0x14], edx
je 0x7ddeee73
mov eax, dword [esi + 0x14]
cmp dword [eax], edx
jne 0x7ddeee8d
cmp dword [ebp - 0x20], 2
je 0x7ddeee95
cmp dword [ebp - 0x20], 3
jne 0x7ddeee84
mov eax, dword [ebp + 0x20]
mov dword [eax], edx
mov dword [ebp - 0x1c], 2
jmp 0x7ddeeee3
push edx
push dword [ebx]
call fcn.7ddee669
push 0xc0000240
call sym.KERNEL32.dll_BaseSetLastNTError
and dword [ebp - 0x1c], 0
jmp 0x7ddeeee3
test byte [ebp + 0x14], 1
je 0x7ddeeed2
and dword [ebp - 0x1c], 0
push 0xb7
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
jmp 0x7ddeeee3
test byte [ebp + 0x14], 1
je 0x7ddeeed2
push 0xb7
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
mov dword [ebp - 0x1c], edi
jmp 0x7ddeeee3
mov dword [ebp - 0x1c], 1
push dword [ebx]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
or dword [ebx], 0xffffffff
mov dword [ebp - 4], 0xfffffffe
call fcn.7ddeef02
mov eax, dword [ebp - 0x1c]
call fcn.7dd71605
ret 0x24