Function at 0x76aaa77a
Capabilities:
Get file attributes
Read file on windows
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x76aae004]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0x14]
push ebx
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x18]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp + 0x1c]
push 0x44
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x68]
push str.SystemRoot_system32perf0000.dat
push eax
call sub.msvcrt.dll_memmove
add esp, 0xc
xor esi, esi
cmp dword [0x76aae4f0], 4
mov ebx, 0x76aa25c8
jb 0x76aaa805
mov eax, dword [edi + 4]
cmp eax, esi
je 0x76aaa7e5
push eax
call sub.msvcrt.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
jmp 0x76aaa7e7
xor eax, eax
push esi
push eax
push dword [edi + 4]
lea eax, [ebp + 8]
push 4
push eax
push esi
push 0x10
push 0x18
push 0x81
push ebx
call fcn.76aa5e47
add esp, 0x28
mov eax, dword [ebp + 8]
cmp eax, 7
je 0x76aaa838
cmp eax, 8
je 0x76aaa838
mov dword [ebp - 0x8c], esi
cmp eax, 5
je 0x76aaa871
cmp eax, 7
je 0x76aaa871
push 0x76aa2674
call sub.msvcrt.dll_wcslen
mov dword [ebp - 0x88], 0x68
jmp 0x76aaa885
cmp dword [ebp - 0x78], esi
mov dword [ebp - 0x8c], 1
je 0x76aaa84c
cmp dword [ebp - 0x74], esi
jne 0x76aaa818
cmp dword [0x76aae4f0], 4
jb 0x76aaa869
push esi
push 0x57
push esi
push 0x18
push 0x8d
push ebx
call fcn.76aa5e47
add esp, 0x18
push 0x57
pop eax
jmp 0x76aaac63
push 0x76aa2664
mov dword [ebp - 0x88], 0x63
call sub.msvcrt.dll_wcslen
cmp dword [ebp - 0x6c], esi
pop ecx
jne 0x76aaa8df
mov ecx, dword [edi + 4]
movzx edx, word [edi]
lea ecx, [ecx + eax*2]
mov dword [ebp - 0x6c], ecx
lea eax, [eax + eax + 6]
cmp edx, eax
jb 0x76aaa8be
mov ecx, dword [ebp - 0x6c]
mov cx, word [ecx]
cmp cx, 0x30
jb 0x76aaa8b1
cmp cx, 0x39
jbe 0x76aaa8c5
add dword [ebp - 0x6c], 2
inc eax
inc eax
cmp eax, 6
jbe 0x76aaa8c5
jmp 0x76aaa89b
mov dword [ebp - 0x6c], 0x76aae4a4
push dword [ebp - 0x6c]
call fcn.76aaa6a3
mov eax, dword [ebp - 0x6c]
push eax
mov dword [ebp - 0x6c], eax
call fcn.76aaa3f9
mov edi, eax
cmp edi, esi
jne 0x76aaa8e2
mov edi, dword [ebp - 0x6c]
mov ax, word [edi + 6]
cmp ax, 0x30
jb 0x76aaa8f9
cmp ax, 0x39
mov dword [ebp - 0x6c], 1
jbe 0x76aaa8fc
mov dword [ebp - 0x6c], esi
cmp dword [ebp - 0x6c], esi
push 0x19
pop eax
je 0x76aaa927
push 0x44
lea eax, [ebp - 0x68]
push str.SystemRoot_system32prf00000.dat
push eax
mov dword [ebp - 0x90], 0x18
call sub.msvcrt.dll_memmove
mov eax, dword [ebp - 0x90]
add esp, 0xc
mov cx, word [ebp - 0x88]
add eax, eax
mov word [ebp + eax - 0x68], cx
mov cx, word [edi]
inc edi
inc edi
mov word [ebp + eax - 0x66], cx
mov cx, word [edi]
inc edi
inc edi
cmp dword [ebp - 0x6c], esi
mov word [ebp + eax - 0x64], cx
mov cx, word [edi]
mov word [ebp + eax - 0x62], cx
je 0x76aaa95f
mov cx, word [edi + 2]
mov word [ebp + eax - 0x60], cx
cmp dword [0x76aae4f0], 4
jb 0x76aaa993
lea eax, [ebp - 0x68]
push esi
push eax
call sub.msvcrt.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x68]
push eax
push esi
push 1
push 0x18
pop edi
push edi
push 0xce
push ebx
call fcn.76aa5e47
add esp, 0x20
jmp 0x76aaa996
push 0x18
pop edi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
cmp dword [ebp - 0x8c], esi
lea eax, [ebp - 0xcc]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xac], edi
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0xa0], 0x40
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0x98], esi
lea eax, [ebp - 0x80]
je 0x76aaaa8e
push esi
push esi
push 0x20
push esi
push 1
push 0x80
push esi
push eax
lea eax, [ebp - 0xac]
push eax
push 0x40100000
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x90], esi
mov dword [ebp - 0x94], esi
call dword [sym.imp.ntdll.dll_NtCreateFile]
cmp eax, esi
mov dword [ebp - 0x6c], eax
jge 0x76aaaa3f
cmp dword [0x76aae4f0], 4
jb 0x76aaab3f
push esi
push eax
push esi
push edi
push 0xec
push ebx
call fcn.76aa5e47
add esp, 0x18
jmp 0x76aaab3f
push esi
lea eax, [ebp - 0x94]
push eax
mov eax, dword [ebp - 0x74]
push dword [eax]
lea eax, [ebp - 0x80]
push dword [ebp - 0x78]
push eax
push esi
push esi
push esi
push dword [ebp - 0x70]
call dword [sym.imp.ntdll.dll_NtWriteFile]
mov edi, eax
cmp edi, esi
jge 0x76aaabd1
cmp dword [0x76aae4f0], 4
jb 0x76aaabd1
push esi
push edi
push esi
push 0x18
push 0xfe
push ebx
call fcn.76aa5e47
add esp, 0x18
jmp 0x76aaabd1
push 0x60
push 7
push eax
lea eax, [ebp - 0xac]
push eax
push 0x80100000
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.ntdll.dll_NtOpenFile]
cmp eax, esi
mov dword [ebp - 0x6c], eax
jge 0x76aaaacb
cmp dword [0x76aae4f0], 4
jb 0x76aaab3f
push esi
push eax
push esi
push edi
push 0x111
jmp 0x76aaaa31
push 5
push edi
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x70]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
cmp eax, esi
mov dword [ebp - 0x6c], eax
jl 0x76aaab1b
cmp dword [ebp - 0xb8], esi
je 0x76aaab14
cmp dword [0x76aae4f0], 4
mov eax, 0x80000005
mov dword [ebp - 0x6c], eax
jb 0x76aaab36
push esi
push eax
push esi
push edi
push 0x120
push ebx
call fcn.76aa5e47
add esp, 0x18
mov eax, dword [ebp - 0x6c]
cmp eax, esi
jge 0x76aaab47
cmp dword [0x76aae4f0], 4
jb 0x76aaab36
push esi
push eax
push esi
push edi
push 0x126
push ebx
call fcn.76aa5e47
add esp, 0x18
push dword [ebp - 0x70]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [ebp - 0x6c]
jmp 0x76aaac63
cmp dword [ebp - 0x78], esi
je 0x76aaabe1
mov ecx, dword [ebp - 0x74]
cmp ecx, esi
je 0x76aaabe1
mov eax, dword [ebp - 0xbc]
cmp dword [ecx], eax
jb 0x76aaabe1
push esi
push esi
push eax
push dword [ebp - 0x78]
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
push dword [ebp - 0x70]
call dword [sym.imp.ntdll.dll_NtReadFile]
mov edi, eax
cmp edi, esi
jl 0x76aaab9a
mov edi, dword [ebp - 0x80]
cmp edi, esi
jl 0x76aaabd1
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0xbc]
je 0x76aaabb6
mov edi, 0xc0000011
jmp 0x76aaabb6
cmp dword [0x76aae4f0], 4
jb 0x76aaabb6
push esi
push edi
push esi
push 0x18
push 0x163
push ebx
call fcn.76aa5e47
add esp, 0x18
cmp edi, esi
jl 0x76aaabd1
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0xbc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
cmp eax, esi
je 0x76aaabd1
mov dword [eax], ecx
push dword [ebp - 0x70]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
jmp 0x76aaac63
push dword [ebp - 0x70]
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [0x76aae4f0], 4
jb 0x76aaac07
push esi
push dword [ebp - 0x6c]
push esi
push edi
push 0x12f
push ebx
call fcn.76aa5e47
add esp, 0x18
mov edi, dword [ebp - 0x84]
cmp edi, esi
je 0x76aaac13
mov dword [edi], esi
cmp dword [ebp - 0x78], esi
je 0x76aaac52
cmp dword [0x76aae4f0], 4
jb 0x76aaac36
push esi
push dword [ebp - 0x6c]
push esi
push 0x18
push 0x137
push ebx
call fcn.76aa5e47
add esp, 0x18
cmp edi, esi
je 0x76aaac4b
mov eax, dword [ebp - 0x74]
cmp eax, esi
je 0x76aaac4b
mov ecx, dword [ebp - 0xbc]
mov dword [edi], esi
mov dword [eax], ecx
mov eax, 0x80000005
jmp 0x76aaac63
mov eax, dword [ebp - 0x74]
cmp eax, esi
je 0x76aaac61
mov ecx, dword [ebp - 0xbc]
mov dword [eax], ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.76aac8aa
leave
ret 0x18