Function at 0x7dd90684
Capabilities:
Get file attributes
Get process heap force flags
Process ghostly hollowing
Set file attributes

Disassembly:
push 0x348
push 0x7dd90b78
call fcn.7dd725e8
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x294], ebx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x26c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x298], eax
or dword [ebp - 0x25c], 0xffffffff
or dword [ebp - 0x260], 0xffffffff
xor esi, esi
mov dword [ebp - 0x2b8], esi
mov dword [ebp - 0x2a0], esi
mov dword [ebp - 0x2b4], esi
mov dword [ebp - 0x288], esi
mov dword [ebp - 0x2b0], esi
mov dword [ebp - 0x2a8], esi
mov dword [ebp - 0x29c], esi
mov dword [ebp - 0x2ac], esi
mov dword [ebp - 0x270], esi
mov dword [ebp - 0x2a4], esi
push esi
lea eax, [ebp - 0x290]
push eax
mov edi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
call edi
cmp ebx, esi
je 0x7dd90e0c
cmp dword [ebp - 0x26c], esi
je 0x7dd90e0c
cmp dword [ebp + 0x18], esi
jne 0x7dd90e0c
cmp dword [ebp + 0x1c], esi
jne 0x7dd90e0c
test dword [ebp + 0x14], 0xfffffff8
jne 0x7dd90e0c
mov dword [ebp - 4], esi
push esi
lea eax, [ebp - 0x27c]
push eax
call edi
push esi
push esi
lea eax, [ebp - 0x27c]
push eax
push ebx
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
je 0x7dd90dec
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 0x300], 0x18
mov dword [ebp - 0x2fc], esi
mov dword [ebp - 0x2f4], 0x40
lea eax, [ebp - 0x27c]
mov dword [ebp - 0x2f8], eax
mov dword [ebp - 0x2f0], esi
mov dword [ebp - 0x2ec], esi
mov eax, 0x81110000
mov dword [ebp - 0x284], eax
mov ebx, 0x200060
push ebx
push 7
lea ecx, [ebp - 0x268]
push ecx
lea ecx, [ebp - 0x300]
push ecx
push eax
lea eax, [ebp - 0x25c]
push eax
mov edi, dword [sym.imp.ntdll.dll_NtOpenFile]
call edi
mov dword [ebp - 0x258], eax
cmp eax, esi
jge 0x7dd9080f
mov eax, 0x80110000
mov dword [ebp - 0x284], eax
push ebx
push 7
lea ecx, [ebp - 0x268]
push ecx
lea ecx, [ebp - 0x300]
push ecx
push eax
lea eax, [ebp - 0x25c]
push eax
call edi
mov dword [ebp - 0x258], eax
cmp eax, esi
jl 0x7dda23ed
push esi
push esi
lea eax, [ebp - 0x2e8]
push eax
push dword [ebp - 0x26c]
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
je 0x7dd90dec
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x2b4], eax
mov dword [ebp - 0x2d8], 0x18
mov dword [ebp - 0x2d4], esi
mov dword [ebp - 0x2cc], 0x40
lea eax, [ebp - 0x2e8]
mov dword [ebp - 0x2d0], eax
mov dword [ebp - 0x2c8], esi
mov dword [ebp - 0x2c4], esi
test dword [ebp - 0x284], 0x1000000
jne 0x7dda23f8
mov ebx, 0xc0000022
mov dword [ebp - 0x258], ebx
cmp dword [ebp - 0x258], esi
jge 0x7dd908b9
mov eax, 0xc0150000
mov dword [ebp - 0x274], eax
push 0x60
push esi
lea ecx, [ebp - 0x268]
push ecx
lea ecx, [ebp - 0x2d8]
push ecx
push eax
lea eax, [ebp - 0x260]
push eax
call edi
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], ebx
je 0x7dda242e
cmp dword [ebp - 0x258], esi
jl 0x7dda24e5
mov ebx, dword [sym.imp.ntdll.dll_NtQueryInformationFile]
push 4
push 0x28
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x25c]
call ebx
mov dword [ebp - 0x258], eax
cmp eax, esi
jl 0x7dda24f0
cmp dword [ebp - 0x2ac], esi
jne 0x7dd90917
test dword [ebp - 0x308], 0x400
jne 0x7dda2509
test byte [ebp - 0x308], 1
jne 0x7dda25a0
push 4
push 0x28
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x260]
call ebx
mov dword [ebp - 0x258], eax
cmp eax, esi
jl 0x7dda25b0
mov dword [ebp - 0x320], esi
mov dword [ebp - 0x31c], esi
mov dword [ebp - 0x318], esi
mov dword [ebp - 0x314], esi
mov dword [ebp - 0x310], esi
mov dword [ebp - 0x30c], esi
push 4
push 0x28
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x260]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
mov dword [ebp - 0x258], eax
cmp eax, esi
jl 0x7dda25c9
push 5
push 0x218
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x260]
call dword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
mov dword [ebp - 0x258], eax
cmp eax, esi
jl 0x7dda25d8
mov dword [ebp - 0x2c0], esi
push 1
lea eax, [ebp - 0x2c0]
push eax
push dword [ebp - 0x254]
push esi
push 0xc
push dword [ebp - 0x274]
push dword [ebp - 0x260]
push dword [ebp - 0x26c]
push dword [ebp - 0x284]
push dword [ebp - 0x25c]
push dword [ebp - 0x294]
call fcn.7dd9106e
test eax, eax
je 0x7dd90cfe
mov edi, dword [ebp + 0x14]
shr edi, 1
and edi, 1
push edi
push dword [ebp - 0x260]
push dword [ebp - 0x25c]
call fcn.7dd90f19
test eax, eax
je 0x7dd90cfe
cmp dword [ebp - 0x2a8], esi
jne 0x7dd90a7f
cmp dword [ebp - 0x29c], esi
jne 0x7dda25e7
mov eax, dword [ebp - 0x338]
push edi
push eax
push dword [ebp - 0x308]
push dword [ebp - 0x26c]
lea eax, [ebp - 0x2d8]
push eax
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x25c]
call fcn.7dd90e49
test eax, eax
je 0x7dd90cfe
mov edi, dword [ebp - 0x298]
cmp edi, esi
jne 0x7dd90e01
or ebx, 0xffffffff
mov dword [ebp - 0x280], esi
push dword [ebp - 0x294]
call fcn.7dd716c5
add eax, eax
add eax, 0x20
mov dword [ebp - 0x26c], eax
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x2bc], eax
mov eax, dword fs:[0x18]
push dword [ebp - 0x26c]
push dword [ebp - 0x2bc]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
mov dword [ebp - 0x270], edi
cmp edi, esi
je 0x7dda25ef
cmp ebx, 0xffffffff
jne 0x7dd90b94
cmp dword [ebp - 0x280], 0x10
jae 0x7dd90df3
call fcn.7dd71113
add eax, dword [ebp - 0x280]
push eax
push 0x7dd90b5c
push 0x10
lea eax, [ebp - 0x3c]
push eax
call sub.ntdll.dll_swprintf_s
mov ebx, dword [ebp - 0x26c]
shr ebx, 1
push dword [ebp - 0x294]
push ebx
push edi
call sub.ntdll.dll_wcscpy_s
lea eax, [ebp - 0x3c]
push eax
push ebx
push edi
call sub.ntdll.dll_wcscat_s
add esp, 0x28
push esi
push 0x102
push 1
push esi
push esi
push 0x40010000
push edi
call sub.API_MS_Win_Core_File_L1_1_0.dll_CreateFileW
mov ebx, eax
inc dword [ebp - 0x280]
jmp 0x7dd90ae8
push ebx
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
push esi
push esi
lea eax, [ebp - 0x290]
push eax
push edi
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
je 0x7dd90dec
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x2e0], eax
mov eax, dword fs:[0x18]
movzx ecx, word [ebp - 0x290]
add ecx, 0x10
push ecx
push dword [ebp - 0x2e0]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
mov edi, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
call edi
mov dword [ebp - 0x288], eax
cmp eax, esi
je 0x7dda25ef
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x2dc], eax
mov eax, dword fs:[0x18]
movzx ecx, word [ebp - 0x27c]
add ecx, 0x10
push ecx
push dword [ebp - 0x2dc]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call edi
mov edi, eax
mov dword [ebp - 0x2b0], edi
cmp edi, esi
je 0x7dda25f9
mov ebx, dword [ebp - 0x288]
mov byte [ebx], 1
mov dword [ebx + 4], esi
movzx eax, word [ebp - 0x290]
mov dword [ebx + 8], eax
movzx eax, word [ebp - 0x290]
push eax
push dword [ebp - 0x28c]
lea eax, [ebx + 0xc]
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
push 0xa
movzx eax, word [ebp - 0x290]
add eax, 0x10
push eax
push ebx
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x25c]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
mov dword [ebp - 0x258], eax
cmp eax, esi
jl 0x7dda25ef
mov byte [edi], 1
mov dword [edi + 4], esi
movzx eax, word [ebp - 0x27c]
mov dword [edi + 8], eax
movzx eax, word [ebp - 0x27c]
push eax
push dword [ebp - 0x278]
lea eax, [edi + 0xc]
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
push 0xa
movzx eax, word [ebp - 0x27c]
add eax, 0x10
push eax
push edi
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x260]
mov ebx, dword [sym.imp.ntdll.dll_NtSetInformationFile]
call ebx
mov dword [ebp - 0x258], eax
cmp eax, esi
jl 0x7dda2603
test byte [ebp + 0x14], 1
jne 0x7dda26ac
mov dword [ebp - 0x2b8], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.7dd90d1d
mov eax, dword [ebp - 0x2b8]
call fcn.7dd72630
ret 0x18
push 3
jmp 0x7dda23e2
cmp ebx, 0xffffffff
jne 0x7dd90b94
jmp 0x7dda25ef
mov dword [ebp - 0x270], edi
jmp 0x7dd90b9a
push 0x57
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
jmp 0x7dd90d0a
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
jmp 0x7dd90cfe
push eax
call sym.KERNEL32.dll_BaseSetLastNTError
jmp 0x7dd90cfe
mov eax, 0xc1150000
mov dword [ebp - 0x274], eax
push 0x60
push esi
lea ecx, [ebp - 0x268]
push ecx
lea ecx, [ebp - 0x2d8]
push ecx
push eax
lea eax, [ebp - 0x260]
push eax
call edi
mov dword [ebp - 0x258], eax
mov ebx, 0xc0000022
jmp 0x7dd90885
test byte [ebp + 0x14], 6
je 0x7dda2460
mov eax, 0xc0110000
mov dword [ebp - 0x274], eax
push 0x60
push esi
lea ecx, [ebp - 0x268]
push ecx
lea ecx, [ebp - 0x2d8]
push ecx
push eax
lea eax, [ebp - 0x260]
push eax
call edi
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], ebx
jne 0x7dd908c5
test byte [ebp + 0x14], 2
je 0x7dda249e
mov eax, 0x80150000
mov dword [ebp - 0x274], eax
push 0x60
push esi
lea ecx, [ebp - 0x268]
push ecx
lea ecx, [ebp - 0x2d8]
push ecx
push eax
lea eax, [ebp - 0x260]
push eax
call edi
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], ebx
jne 0x7dd908c5
test byte [ebp + 0x14], 2
je 0x7dd908c5
mov eax, 0x80110000
mov dword [ebp - 0x274], eax
push 0x60
push esi
lea ecx, [ebp - 0x268]
push ecx
lea ecx, [ebp - 0x2d8]
push ecx
push eax
lea eax, [ebp - 0x260]
push eax
call edi
mov dword [ebp - 0x258], eax
jmp 0x7dd908c5
push dword [ebp - 0x258]
jmp 0x7dda23ee
test byte [ebp + 0x14], 2
je 0x7dda23ed
mov dword [ebp - 0x2a8], 1
jmp 0x7dd9099c
mov dword [ebp - 0x2ac], 1
push 0x23
push 8
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x25c]
call ebx
mov dword [ebp - 0x258], eax
cmp eax, esi
jl 0x7dda23ed
test dword [ebp - 0x32c], 0x20000000
jne 0x7dda258e
push dword [ebp - 0x25c]
call dword [sym.imp.ntdll.dll_NtClose]
or dword [ebp - 0x25c], 0xffffffff
push 0x60
push 7
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x300]
push eax
push dword [ebp - 0x284]
lea eax, [ebp - 0x25c]
push eax
call edi
mov dword [ebp - 0x258], eax
cmp eax, esi
jl 0x7dda23ed
jmp 0x7dd908d7
cmp eax, esi
jl 0x7dda23ed
push 0x5b8
jmp 0x7dda23e2
mov eax, 0xc0000022
mov dword [ebp - 0x258], eax
jmp 0x7dda23ed
test byte [ebp + 0x14], 2
je 0x7dda23ed
mov dword [ebp - 0x29c], 1
jmp 0x7dd9094c
test byte [ebp + 0x14], 2
jne 0x7dd9099c
jmp 0x7dda23ed
test byte [ebp + 0x14], 2
je 0x7dda23ed
jmp 0x7dd90a14
or eax, 0xffffffff
jmp 0x7dd90a50
push 0x497
jmp 0x7dda23e2
push 0x498
jmp 0x7dda23e2
push 0xa
movzx eax, word [ebp - 0x27c]
add eax, 0x10
push eax
push edi
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x25c]
call ebx
mov dword [ebp - 0x258], eax
cmp eax, 0xc00000d5
jne 0x7dda2683
push dword [ebp - 0x25c]
call dword [sym.imp.ntdll.dll_NtClose]
or dword [ebp - 0x25c], 0xffffffff
push esi
push 0x80
push 3
push esi
push esi
push 0x40010000
push dword [ebp - 0x270]
call sub.API_MS_Win_Core_File_L1_1_0.dll_CreateFileW
mov dword [ebp - 0x25c], eax
cmp eax, 0xffffffff
je 0x7dda2683
push 0xa
movzx ecx, word [ebp - 0x27c]
add ecx, 0x10
push ecx
push edi
lea ecx, [ebp - 0x268]
push ecx
push eax
call ebx
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], esi
jge 0x7dda2692
push 0x499
jmp 0x7dda2697
push 0x498
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
mov dword [ebp - 0x2a4], 1
jmp 0x7dd90cfe
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x25c]
call dword [sym.imp.ntdll.dll_NtFlushBuffersFile]
jmp 0x7dd90cf4