Function at 0x7dd898b8
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Delete file
Get file attributes
Get ntdll base address
Get process heap flags
Get process heap force flags
Set file attributes

Disassembly:
push 0x98
push 0x7dd89a88
call fcn.7dd715c0
or dword [ebp - 0x20], 0xffffffff
xor ebx, ebx
mov byte [ebp - 0x19], bl
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x7dd898ef
push dword [ebp + 0xc]
call dword [sym.imp.ntdll.dll_RtlIsDosDeviceName_U]
test eax, eax
jne 0x7dd9f2b8
mov al, byte [ebp + 0x18]
and al, 1
mov byte [ebp - 0x1a], al
push ebx
push ebx
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
cmp al, bl
je 0x7dd8aa9f
mov eax, dword [ebp + 0x18]
and eax, 4
mov dword [ebp - 0x2c], eax
jne 0x7dd9f2c2
mov dword [ebp - 0x74], 0x18
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x68], 0x40
lea eax, [ebp - 0x38]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov esi, dword [ebp + 0x18]
and esi, 8
or esi, 0x10080
shr esi, 2
mov eax, esi
or eax, 0x200000
push eax
push 7
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x74]
push eax
push 0x110080
lea eax, [ebp - 0x20]
push eax
mov edi, dword [sym.imp.ntdll.dll_NtOpenFile]
call edi
cmp eax, ebx
jl 0x7dd9f2d6
push 0x23
push 8
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
cmp eax, ebx
jl 0x7dd9f338
test dword [ebp - 0x50], 0x400
jne 0x7dd9f353
cmp dword [ebp - 0x2c], ebx
jne 0x7dd9f2f9
push ebx
push ebx
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
cmp al, bl
je 0x7dd8aa9f
cmp dword [ebp - 0x2c], ebx
jne 0x7dd9f37c
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x54], eax
mov eax, dword fs:[0x18]
movzx ecx, word [ebp - 0x28]
add ecx, 0x10
push ecx
push dword [ebp - 0x54]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
mov dword [ebp - 0x48], esi
cmp esi, ebx
je 0x7dd9f3b8
movzx eax, word [ebp - 0x28]
push eax
push dword [ebp - 0x24]
lea eax, [esi + 0xc]
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
mov al, byte [ebp - 0x1a]
mov byte [esi], al
mov dword [esi + 4], ebx
movzx eax, word [ebp - 0x28]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x18]
and eax, 0x10
or eax, 0xa0
shr eax, 4
push eax
movzx eax, word [ebp - 0x28]
add eax, 0x10
push eax
push esi
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
mov dword [ebp - 0x5c], eax
mov eax, dword fs:[0x18]
push dword [ebp - 0x48]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [ebp - 0x5c]
cmp eax, ebx
jl 0x7dd8aa85
mov byte [ebp - 0x19], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.7dd89ab5
movzx eax, byte [ebp - 0x19]
call fcn.7dd71605
ret 0x18
cmp eax, 0xc00000d4
je 0x7dd9f47c
cmp eax, 0xc0190038
jne 0x7dd8aa9c
jmp 0x7dd9f47c
push eax
jmp 0x7dd8aac6
push 0xc000003a
jmp 0x7dd8aac6
cmp eax, ebx
jl 0x7dd8aa9c
jmp 0x7dd8999e
cmp eax, ebx
jge 0x7dd89991
jmp 0x7dd8999e
cmp eax, ebx
jge 0x7dd89a68
jmp 0x7dd8aa9c
call sym.KERNEL32.dll_BaseSetLastNTError
jmp 0x7dd89a6c
push 0xc0000035
jmp 0x7dd8aac6
test byte [ebp + 0x18], 0x10
je 0x7dd8991d
push 0xc000000d
jmp 0x7dd8aac6
cmp dword [ebp - 0x2c], ebx
je 0x7dd9f312
cmp eax, 0xc0000043
je 0x7dd9f2f0
cmp eax, 0xc0000034
je 0x7dd9f2f0
cmp eax, 0xc000003a
jne 0x7dd9f312
or dword [ebp - 0x20], 0xffffffff
jmp 0x7dd8999e
cmp dword [ebp + 0xc], ebx
jne 0x7dd899a7
push ebx
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
jmp 0x7dd899be
cmp eax, 0xc000000d
jne 0x7dd8aaa6
push esi
push 3
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x74]
push eax
push pe_overlay
lea eax, [ebp - 0x20]
push eax
call edi
jmp 0x7dd8aaa6
cmp eax, 0xc0000002
je 0x7dd8aaaf
cmp eax, 0xc000000d
je 0x7dd8aaaf
jmp 0x7dd8aa9c
cmp dword [ebp - 0x4c], 0xa0000003
je 0x7dd8999e
cmp dword [ebp - 0x4c], 0xa000000c
je 0x7dd8999e
push dword [ebp - 0x20]
call dword [sym.imp.ntdll.dll_NtClose]
or dword [ebp - 0x20], 0xffffffff
jmp 0x7dd9f31d
cmp byte [ebp - 0x1a], bl
je 0x7dd9f409
cmp word [ebp - 0x28], bx
je 0x7dd9f409
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x58], eax
mov eax, dword fs:[0x18]
movzx ecx, word [ebp - 0x28]
inc ecx
inc ecx
push ecx
push dword [ebp - 0x58]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
cmp esi, ebx
jne 0x7dd9f3c2
push 0xc0000017
jmp 0x7dd8aac6
push 0x21
pop eax
mov word [esi], ax
movzx eax, word [ebp - 0x28]
push eax
push dword [ebp - 0x24]
lea eax, [esi + 2]
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x28]
add eax, 2
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x26]
add eax, 2
mov word [ebp - 0x26], ax
mov eax, dword fs:[0x18]
push dword [ebp - 0x24]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebp - 0x24], esi
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_RtlDetermineDosPathNameType_U]
xor esi, esi
inc esi
cmp eax, esi
jne 0x7dd9f423
mov eax, 0xc000000d
jmp 0x7dd8aa9c
test byte [ebp + 0x18], 2
jne 0x7dd9f419
push dword [ebp + 0x1c]
push ebx
push 2
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.7dded817
cmp eax, 0xc0000034
jne 0x7dd8aabc
push dword [ebp + 0x1c]
push esi
push esi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.7dded817
cmp eax, 0xc000009a
jne 0x7dd8aabc
push dword [ebp + 0x1c]
push esi
push 2
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.7dded817
jmp 0x7dd8aabc
test byte [ebp + 0x18], 2
je 0x7dd8aa9c
push 4
push 0x28
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
cmp eax, ebx
jl 0x7dd9f4b5
test byte [ebp - 0x88], 0x10
je 0x7dd9f4b5
push 0xc00000ba
jmp 0x7dd8aac6
push dword [ebp - 0x20]
call dword [sym.imp.ntdll.dll_NtClose]
or dword [ebp - 0x20], 0xffffffff
or dword [ebp - 0x2c], 0xffffffff
or dword [ebp - 0x30], 0xffffffff
call sub.ntdll.dll_RtlGetCurrentTransaction
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x78], eax
push ebx
call sub.ntdll.dll_RtlSetCurrentTransaction
mov dword [ebp - 4], 1
push dword [ebp - 0x44]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
xor eax, eax
cmp byte [ebp - 0x1a], bl
sete al
or eax, 0x804
push eax
push ebx
lea eax, [ebp - 0x80]
push eax
push 0x7ddec969
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.7dd93d7b
mov byte [ebp - 0x19], al
mov dword [ebp - 4], ebx
call fcn.7dd9f5d8
or edi, 0xffffffff
cmp byte [ebp - 0x19], bl
je 0x7dd9f57e
cmp dword [ebp - 0x2c], edi
je 0x7dd9f58e
cmp dword [ebp - 0x30], edi
je 0x7dd9f57e
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x30]
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.7ddeca31
mov esi, eax
cmp esi, ebx
jge 0x7dd9f57e
test byte [ebp + 0x18], 0x20
je 0x7dd9f57e
cmp dword [ebp - 0x30], edi
je 0x7dd9f56a
push dword [ebp - 0x30]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
mov dword [ebp - 0x30], edi
push dword [ebp + 0xc]
call fcn.7dd725e0
mov byte [ebp - 0x19], bl
push esi
call sym.KERNEL32.dll_BaseSetLastNTError
cmp dword [ebp - 0x2c], edi
je 0x7dd9f58e
push dword [ebp - 0x2c]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x30], edi
je 0x7dd9f59e
push dword [ebp - 0x30]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
mov dword [ebp - 0x30], edi
cmp byte [ebp - 0x19], bl
je 0x7dd89a6c
push dword [ebp + 8]
call fcn.7dd725e0
test eax, eax
jne 0x7dd89a6c
push 0x80
push dword [ebp + 8]
call fcn.7dd8d524
push dword [ebp + 8]
call fcn.7dd725e0
jmp 0x7dd89a6c