Function at 0x7dd9a352
Capabilities:
Access pe header

Disassembly:
push 0x80
push 0x7dd9a498
call fcn.7dd715c0
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x19], bl
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x48]
push eax
push ebx
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_RtlDosPathNameToRelativeNtPathName_U]
cmp al, bl
je 0x7dda58a6
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x48]
cmp ax, bx
jne 0x7dda58b5
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x60], 0x18
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x54], 0x40
lea eax, [ebp - 0x30]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
push 0x60
push 5
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x60]
push eax
push 0x100020
lea eax, [ebp + 8]
push eax
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov esi, eax
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.ntdll.dll_RtlReleaseRelativeName]
cmp esi, ebx
jl 0x7dda58c3
push dword [ebp + 8]
push 0x1000000
push 0x10
push ebx
push ebx
push 0xf001f
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntdll.dll_NtCreateSection]
mov edi, eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtClose]
cmp edi, ebx
jl 0x7dda58c6
push ebx
push 0x30
lea eax, [ebp - 0x90]
push eax
push 1
push dword [ebp - 0x24]
call dword [sym.imp.ntdll.dll_NtQuerySection]
cmp eax, ebx
jl 0x7dda594e
test dword [ebp - 0x74], 0x2000
jne 0x7dda5954
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 8]
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov ecx, eax
mov ax, word [ebp - 0x70]
cmp ax, word [ecx + 4]
jne 0x7dda5964
cmp dword [ebp - 0x80], 2
jne 0x7dda5989
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
mov byte [ebp - 0x19], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.7dd9a4b9
movzx eax, byte [ebp - 0x19]
call fcn.7dd71605
ret 8
push 0xc0000033
call sym.KERNEL32.dll_BaseSetLastNTError
jmp 0x7dd9a480
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], eax
jmp 0x7dd9a3a1
push esi
jmp 0x7dda58ab
mov dword [ebp - 0x24], ebx
cmp edi, 0xc000011b
je 0x7dda5942
mov esi, 0xc000012f
cmp edi, esi
je 0x7dda591d
cmp edi, 0xc0000130
je 0x7dda5942
cmp edi, 0xc0000131
je 0x7dda5911
cmp edi, 0xc0000359
je 0x7dda5909
cmp edi, 0xc000035a
je 0x7dda58fd
push edi
jmp 0x7dda58ab
mov dword [ebp - 0x20], 6
jmp 0x7dd9a474
mov dword [ebp - 0x20], ebx
jmp 0x7dd9a474
mov dword [ebp - 0x20], 2
jmp 0x7dd9a474
push esi
lea eax, [ebp - 0x30]
push eax
call fcn.7ddf9a52
mov dword [ebp - 0x20], eax
cmp eax, ebx
je 0x7dda58c3
xor ecx, ecx
cmp eax, 3
sete cl
lea ecx, [ecx + ecx + 1]
mov dword [ebp - 0x20], ecx
jmp 0x7dd9a474
mov dword [ebp - 0x20], 1
jmp 0x7dd9a474
push eax
jmp 0x7dda58ab
push 0xc1
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
jmp 0x7dd9a480
movzx eax, ax
cmp eax, 0x14c
je 0x7dda5981
cmp eax, 0x200
je 0x7dda58fd
cmp eax, 0x8664
jne 0x7dda5954
jmp 0x7dda58fd
mov dword [ebp - 0x20], ebx
jmp 0x7dd9a46a
cmp dword [ebp - 0x80], 3
je 0x7dd9a474
cmp dword [ebp - 0x80], 7
jne 0x7dd9a474
mov dword [ebp - 0x20], 4
jmp 0x7dd9a474