Function at 0x7dd79795
Capabilities:
Access pe header
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x51c
mov eax, dword [0x7de403ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3cc], eax
xor ecx, ecx
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x478], eax
lea eax, [ebp - 0x408]
mov dword [ebp - 0x474], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x300]
mov dword [ebp - 0x470], eax
lea eax, [ebp - 0x2b8]
mov dword [ebp - 0x46c], eax
xor eax, eax
mov dword [ebp - 0x3fc], ecx
lea edi, [ebp - 0x3f8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x4f4], ecx
lea edi, [ebp - 0x4f0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x4dc], ecx
lea edi, [ebp - 0x4d8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov esi, dword [ebp + 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
inc eax
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x40c], eax
lea eax, [ebp - 0x2dc]
mov dword [ebp - 0x4a4], eax
lea eax, [ebp - 0x324]
mov dword [ebp - 0x4a0], eax
lea eax, [ebp - 0x294]
push 0xa0
mov dword [ebp - 0x3d0], eax
push ecx
lea eax, [ebp - 0x3c4]
push eax
mov dword [ebp - 0x3e0], ecx
mov dword [ebp - 0x47c], ecx
mov dword [ebp - 0x448], ecx
mov dword [ebp - 0x3dc], ecx
mov dword [ebp - 0x3e4], ecx
mov dword [ebp - 0x450], ecx
mov dword [ebp - 0x3d4], ecx
mov dword [ebp - 0x444], ecx
mov dword [ebp - 0x400], 0x40
mov dword [ebp - 0x3d8], ecx
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x440], ecx
mov dword [ebp - 0x420], ecx
call sub.ntdll.dll_memset
lea eax, [ebp - 0x214]
mov dword [ebp - 0x2f8], eax
mov dword [ebp - 0x2f4], eax
mov dword [ebp - 0x2fc], eax
add esp, 0xc
xor eax, eax
mov ebx, 0x80
mov word [ebp - 0x214], ax
mov word [ebp - 0x300], ax
mov eax, ebx
mov word [ebp - 0x2fe], ax
mov dword [ebp - 0x2f0], ebx
mov dword [ebp - 0x2ec], ebx
lea eax, [ebp - 0x194]
mov dword [ebp - 0x2b0], eax
mov dword [ebp - 0x2ac], eax
mov dword [ebp - 0x2b4], eax
xor eax, eax
and dword [ebp - 0x404], 0
mov word [ebp - 0x194], ax
mov word [ebp - 0x2b8], ax
mov eax, ebx
mov word [ebp - 0x2b6], ax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x2d4], eax
mov dword [ebp - 0x2d0], eax
mov dword [ebp - 0x2d8], eax
xor eax, eax
mov word [ebp - 0x114], ax
mov word [ebp - 0x2dc], ax
mov eax, ebx
mov word [ebp - 0x2da], ax
lea eax, [ebp - 0x94]
mov dword [ebp - 0x31c], eax
mov dword [ebp - 0x318], eax
mov dword [ebp - 0x320], eax
xor eax, eax
test byte [esi + 4], 2
mov word [ebp - 0x94], ax
mov word [ebp - 0x324], ax
mov eax, ebx
mov word [ebp - 0x322], ax
mov ax, word [esi + 0xc]
mov dword [ebp - 0x2a8], ebx
mov dword [ebp - 0x2a4], ebx
mov dword [ebp - 0x2cc], ebx
mov dword [ebp - 0x2c8], ebx
mov dword [ebp - 0x314], ebx
mov dword [ebp - 0x310], ebx
mov word [ebp - 0x3c0], ax
jne 0x7dda606c
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 0x44c]
push eax
push 0x38
call dword [sym.imp.ntdll.dll_RtlGetThreadPreferredUILanguages]
mov edi, eax
cmp edi, 0xc0000023
je 0x7dda6107
test edi, edi
jl 0x7dd79faa
cmp dword [ebp - 0x44c], 0
je 0x7dda6161
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x400]
add eax, eax
mov word [ebp - 0x3ba], ax
mov word [ebp - 0x3bc], ax
mov eax, dword [esi + 0x14]
test eax, 0xffff0000
jne 0x7dd929f3
mov dword [ebp - 0x34c], eax
push dword [esi + 0x10]
mov edi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x364]
push eax
call edi
cmp word [ebp - 0x364], 0
je 0x7dd79a9c
mov ecx, dword [ebp - 0x362]
mov edx, dword [ebp - 0x364]
mov eax, 0xfffe
and ecx, eax
and edx, eax
cmp edx, ecx
jae 0x7dda616d
movzx eax, word [ebp - 0x364]
mov ecx, dword [ebp - 0x360]
shr eax, 1
cmp word [ecx + eax*2], 0
jne 0x7dda616d
mov eax, dword [esi + 8]
test eax, eax
je 0x7dda649c
cmp word [eax], 0
je 0x7dda649c
mov ecx, dword [ebp - 0x3cc]
or dword [ebp - 0x3f8], 0xffffffff
test byte [esi + 4], 0x40
mov dword [ebp - 0x348], ecx
push eax
jne 0x7dda6189
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push dword [esi + 8]
call dword [sym.imp.ntdll.dll_RtlDetermineDosPathNameType_U]
push 0
push 0
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U_WithStatus]
mov edi, eax
test edi, edi
jl 0x7dd79faa
push 0x2e
push dword [ebp - 0x418]
call sub.ntdll.dll_wcsrchr
mov dword [ebp - 0x3cc], eax
pop ecx
xor eax, eax
pop ecx
test byte [esi + 4], bl
je 0x7dd7da26
mov ecx, dword [esi + 0x1c]
mov dword [ebp - 0x3fc], eax
mov dword [ebp - 0x3f4], eax
mov dword [ebp - 0x3ec], ecx
mov dword [ebp - 0x3e8], eax
mov dword [ebp - 0x450], 1
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x3ec]
mov ecx, eax
or ecx, dword [ebp - 0x3e8]
je 0x7dda6399
lea ecx, [ebp - 0x47c]
push ecx
push 0
push dword [ebp - 0x448]
and eax, 0xfffffffc
push eax
push dword [ebp - 0x450]
call dword [sym.imp.ntdll.dll_RtlImageNtHeaderEx]
mov edi, eax
test edi, edi
jl 0x7dd7db5a
mov dword [ebp - 0x3c8], 1
lea eax, [ebp - 0x3fc]
mov dword [ebp - 0x3e4], eax
lea eax, [ebp - 0x4f4]
mov dword [ebp - 0x3dc], eax
xor eax, eax
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x3c8], eax
je 0x7dd7db7f
test byte [esi + 4], 8
je 0x7dda63b4
mov ecx, dword [ebp - 0x41c]
mov dword [ebp - 0x43c], ecx
mov ecx, dword [ebp - 0x418]
mov dword [ebp - 0x438], ecx
xor ecx, ecx
test byte [esi + 4], 8
mov word [ebp - 0x434], cx
mov word [ebp - 0x432], cx
mov dword [ebp - 0x430], eax
je 0x7dd79c5f
mov eax, dword [esi + 0x14]
test eax, 0xffff0000
jne 0x7dda63be
cmp eax, 1
je 0x7dd79c5f
push eax
push 0x7dd7a1c0
lea eax, [ebp - 0x14]
push 8
push eax
call sub.ntdll.dll_swprintf_s
lea eax, [ebp - 0x14]
add esp, 0x10
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x7dd79c35
sub eax, edx
sar eax, 1
add eax, eax
mov word [ebp - 0x434], ax
push 0x10
pop eax
mov word [ebp - 0x432], ax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x3cc], 0
mov eax, dword [0x7dd790c0]
mov dword [ebp - 0x42c], eax
mov eax, dword [0x7dd790c4]
mov dword [ebp - 0x428], eax
je 0x7dd79c98
push 0x7dd790ac
push dword [ebp - 0x3cc]
call sub.ntdll.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
je 0x7dd7db8d
lea eax, [ebp - 0x43c]
push eax
push 3
lea eax, [ebp - 0x300]
push eax
call dword [sym.imp.ntdll.dll_RtlMultiAppendUnicodeStringBuffer]
mov edi, eax
test edi, edi
jl 0x7dd79faa
mov eax, dword [ebp - 0x408]
mov ecx, dword [ebp - 0x404]
mov dword [ebp - 0x43c], eax
sub eax, dword [ebp - 0x3e0]
mov dword [ebp - 0x438], ecx
mov word [ebp - 0x43c], ax
lea eax, [ebp - 0x43c]
push eax
push 3
lea eax, [ebp - 0x2b8]
push eax
call dword [sym.imp.ntdll.dll_RtlMultiAppendUnicodeStringBuffer]
mov edi, eax
test edi, edi
jl 0x7dd79faa
cmp dword [ebp - 0x3c8], 0
je 0x7dd79db2
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x494], eax
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x490], eax
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0x48c], eax
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x488], eax
mov eax, dword [0x7dd79194]
mov dword [ebp - 0x484], eax
mov eax, dword [0x7dd79198]
mov dword [ebp - 0x480], eax
lea eax, [ebp - 0x494]
push eax
push 3
lea eax, [ebp - 0x2dc]
push eax
call dword [sym.imp.ntdll.dll_RtlMultiAppendUnicodeStringBuffer]
mov edi, eax
test edi, edi
jl 0x7dd79faa
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0x494], eax
mov eax, dword [ebp - 0x404]
mov dword [ebp - 0x490], eax
lea eax, [ebp - 0x494]
push eax
push 3
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.ntdll.dll_RtlMultiAppendUnicodeStringBuffer]
mov edi, eax
test edi, edi
jl 0x7dd79faa
test byte [ebp + 8], 1
jne 0x7dda63d1
xor eax, eax
inc eax
cmp dword [ebp - 0x3c8], 0
lea ecx, [ebp - 0x4a4]
je 0x7dd7dba8
mov dword [ebp - 0x3e0], ecx
mov ecx, dword [esi + 0x14]
mov edx, ecx
dec edx
neg edx
sbb edx, edx
not edx
lea edi, [ebp - 0x38c]
and edx, edi
push edx
lea edx, [ebp - 0x3b4]
push edx
lea edx, [ebp - 0x3c4]
push edx
mov edx, ecx
dec edx
neg edx
sbb edx, edx
not edx
lea edi, [ebp - 0x4dc]
and edx, edi
push edx
mov edx, ecx
dec edx
neg edx
sbb edx, edx
not edx
lea edi, [ebp - 0x470]
and edx, edi
push edx
push ecx
push dword [ebp - 0x3e4]
mov ecx, dword [ebp - 0x3c8]
neg ecx
sbb ecx, ecx
lea edx, [ebp - 0x478]
and ecx, edx
push ecx
push dword [ebp - 0x3dc]
neg eax
sbb eax, eax
and eax, dword [ebp - 0x3e0]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x1200a9
push eax
call fcn.7dd790dd
cmp dword [ebp - 0x3c4], 0
mov edi, eax
je 0x7dda63d8
test byte [ebp - 0x3c4], 2
jne 0x7dd79e79
push edi
call fcn.7dd7917b
test eax, eax
jne 0x7dd8fb4c
test edi, edi
jl 0x7dda63dc
cmp dword [esi + 0x14], 1
je 0x7dd79e9e
mov eax, dword [ebp - 0x470]
mov ecx, dword [eax]
mov dword [ebp - 0x388], ecx
mov eax, dword [eax + 4]
mov dword [ebp - 0x384], eax
test byte [ebp - 0x3c4], 8
jne 0x7dd79f79
mov eax, dword [ebp - 0x3fc]
test eax, eax
jne 0x7dd7dbb3
push 0x60
lea eax, [ebp - 0x408]
mov dword [ebp - 0x460], eax
push 5
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x468]
push eax
xor esi, esi
push 0x120089
lea eax, [ebp - 0x3d4]
push eax
mov dword [ebp - 0x468], 0x18
mov dword [ebp - 0x464], esi
mov dword [ebp - 0x45c], 0x40
mov dword [ebp - 0x458], esi
mov dword [ebp - 0x454], esi
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov edi, eax
cmp edi, esi
jl 0x7dda61a1
mov dword [ebp - 0x444], 1
push 0
push dword [ebp - 0x3d4]
call fcn.7dd7904b
test eax, eax
jne 0x7dd79f79
or dword [ebp - 0x3c4], 0x40
push 4
push 0x28
lea eax, [ebp - 0x51c]
push eax
lea eax, [ebp - 0x49c]
push eax
push dword [ebp - 0x3d4]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov edi, eax
test edi, edi
jl 0x7dd79faa
mov eax, dword [ebp - 0x50c]
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0x508]
mov dword [ebp - 0x350], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
test dword [eax + 8], 0x8000
jne 0x7dda6432
lea eax, [ebp - 0x3c4]
push eax
call fcn.7dd7a1cf
mov edi, eax
test edi, edi
jl 0x7dda643d
xor edi, edi
cmp dword [ebp - 0x440], 0
jne 0x7dda64be
cmp dword [ebp - 0x410], 0
jne 0x7dd7dbbe
xor esi, esi
cmp dword [ebp - 0x40c], esi
jne 0x7dda64d8
cmp dword [ebp - 0x3dc], esi
je 0x7dd79fe5
push dword [ebp - 0x3dc]
call fcn.7dd78d6f
cmp dword [ebp - 0x3e4], esi
je 0x7dd79ff9
cmp dword [ebp - 0x410], esi
jne 0x7dd929e3
lea eax, [ebp - 0x4dc]
push eax
call fcn.7dd78d6f
cmp dword [ebp - 0x444], esi
je 0x7dd7a021
cmp dword [ebp - 0x3d4], esi
je 0x7dd7a021
push dword [ebp - 0x3d4]
call dword [sym.imp.ntdll.dll_NtClose]
push dword [ebp - 0x404]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [sym.imp.ntdll.dll_RtlFreeHeap]
push esi
push dword [eax + 0x18]
call ebx
mov ecx, dword [ebp - 0x2f8]
mov eax, dword [ebp - 0x2f4]
cmp ecx, esi
mov esi, dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
je 0x7dd7a06c
cmp ecx, eax
jne 0x7dd7a85a
mov ecx, dword [ebp - 0x2ec]
mov dword [ebp - 0x2f8], eax
mov dword [ebp - 0x2f0], ecx
mov dword [ebp - 0x2fc], eax
test eax, eax
je 0x7dd7a07b
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 0x2b0]
xor eax, eax
mov word [ebp - 0x300], ax
mov ax, word [ebp - 0x2ec]
mov word [ebp - 0x2fe], ax
mov eax, dword [ebp - 0x2ac]
test ecx, ecx
je 0x7dd7a0bc
cmp ecx, eax
jne 0x7dd7a80c
mov ecx, dword [ebp - 0x2a4]
mov dword [ebp - 0x2b0], eax
mov dword [ebp - 0x2a8], ecx
mov dword [ebp - 0x2b4], eax
test eax, eax
je 0x7dd7a0cb
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 0x2d4]
xor eax, eax
mov word [ebp - 0x2b8], ax
mov ax, word [ebp - 0x2a4]
mov word [ebp - 0x2b6], ax
mov eax, dword [ebp - 0x2d0]
test ecx, ecx
je 0x7dd7a10c
cmp ecx, eax
jne 0x7dd7a826
mov ecx, dword [ebp - 0x2c8]
mov dword [ebp - 0x2d4], eax
mov dword [ebp - 0x2cc], ecx
mov dword [ebp - 0x2d8], eax
test eax, eax
je 0x7dd7a11b
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 0x31c]
xor eax, eax
mov word [ebp - 0x2dc], ax
mov ax, word [ebp - 0x2c8]
mov word [ebp - 0x2da], ax
mov eax, dword [ebp - 0x318]
test ecx, ecx
je 0x7dd7a15c
cmp ecx, eax
jne 0x7dd7a840
mov ecx, dword [ebp - 0x310]
mov dword [ebp - 0x31c], eax
mov dword [ebp - 0x314], ecx
mov dword [ebp - 0x320], eax
test eax, eax
je 0x7dd7a16b
xor ecx, ecx
mov word [eax], cx
xor eax, eax
cmp dword [ebp - 0x3d0], 0
mov word [ebp - 0x324], ax
mov ax, word [ebp - 0x310]
mov word [ebp - 0x322], ax
je 0x7dd7a19d
lea eax, [ebp - 0x294]
cmp dword [ebp - 0x3d0], eax
jne 0x7dda64e9
cmp dword [ebp - 0x3d8], 0
jne 0x7dda6504
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.7dd71442
leave
ret 0xc
lea eax, [ebp - 0x4c4]
push eax
mov dword [ebp - 0x4c0], ecx
call esi
mov eax, dword [ebp - 0x2ac]
jmp 0x7dd7a0aa
lea eax, [ebp - 0x4b4]
push eax
mov dword [ebp - 0x4b0], ecx
call esi
mov eax, dword [ebp - 0x2d0]
jmp 0x7dd7a0fa
lea eax, [ebp - 0x4ac]
push eax
mov dword [ebp - 0x4a8], ecx
call esi
mov eax, dword [ebp - 0x318]
jmp 0x7dd7a14a
lea eax, [ebp - 0x4bc]
push eax
mov dword [ebp - 0x4b8], ecx
call esi
mov eax, dword [ebp - 0x2f4]
jmp 0x7dd7a05a
push 0x60
mov dword [ebp - 0x464], eax
mov dword [ebp - 0x458], eax
mov dword [ebp - 0x454], eax
push 5
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x468]
push eax
push 0x1200a9
lea eax, [ebp - 0x3fc]
lea ecx, [ebp - 0x408]
push eax
mov dword [ebp - 0x468], 0x18
mov dword [ebp - 0x45c], 0x40
mov dword [ebp - 0x460], ecx
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov edi, eax
test edi, edi
jl 0x7dda61a1
cmp dword [ebp - 0x3cc], 0
je 0x7dd7dac3
push 0x7dd7db50
push dword [ebp - 0x3cc]
call sub.ntdll.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
je 0x7dd9d631
push 0x7dd7da1c
push dword [ebp - 0x3cc]
call sub.ntdll.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
je 0x7dd9d631
cmp dword [ebp - 0x3f4], 0
jne 0x7dd7daee
push dword [ebp - 0x3fc]
lea eax, [ebp - 0x3f4]
push 0x8000000
push 2
push 0
push 0
push 4
push eax
call dword [sym.imp.ntdll.dll_NtCreateSection]
mov edi, eax
test edi, edi
jl 0x7dda632c
push 2
xor eax, eax
push eax
push 1
lea ecx, [ebp - 0x448]
push ecx
push eax
push eax
push eax
mov dword [ebp - 0x3c8], eax
lea eax, [ebp - 0x3c8]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x3f4]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov edi, eax
test edi, edi
jl 0x7dda62aa
mov eax, dword [ebp - 0x3c8]
xor ecx, ecx
mov dword [ebp - 0x3e8], ecx
cmp dword [ebp - 0x420], ecx
jne 0x7dd7db45
or eax, 1
mov dword [ebp - 0x3ec], eax
jmp 0x7dd79b57
cmp edi, 0xc000007b
jne 0x7dd79faa
and dword [ebp - 0x3c8], 0
and dword [ebp - 0x3e4], 0
lea eax, [ebp - 0x3fc]
jmp 0x7dd79bb0
cmp dword [esi + 0x14], eax
je 0x7dd79bd4
jmp 0x7dda638f
mov eax, 0xffee
add word [ebp - 0x43c], ax
mov dword [ebp - 0x3e0], 0x12
jmp 0x7dd79c98
lea ecx, [ebp - 0x478]
jmp 0x7dd79dc8
mov dword [ebp - 0x3d4], eax
jmp 0x7dd79f25
mov eax, dword [ebp - 0x3ec]
mov ecx, eax
xor esi, esi
or ecx, dword [ebp - 0x3e8]
je 0x7dd79fc6
cmp dword [ebp - 0x420], esi
jne 0x7dd79fc6
and eax, 0xfffffffc
mov dword [ebp - 0x3ec], eax
mov dword [ebp - 0x3e8], esi
jmp 0x7dd79fc6
xor edi, edi
jmp 0x7dd79e79
push dword [ebp - 0x3e4]
call fcn.7dd78d6f
jmp 0x7dd79ff9
or dword [ebp - 0x34c], 0xffffffff
jmp 0x7dd79a49
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0xf70]
mov eax, dword [eax + 0x14d0]
mov ecx, dword [0x7de40388]
cmp ecx, dword [eax]
jb 0x7dd7dac3
push dword [ebp - 0x3fc]
lea eax, [ebp - 0x3f4]
push 0x1000000
push 2
push 0
push 0
push 4
push eax
call dword [sym.imp.ntdll.dll_NtCreateSection]
mov edi, eax
test edi, edi
jl 0x7dda6223
mov dword [ebp - 0x420], 1
jmp 0x7dd7dac3
lea eax, [ebp - 0x414]
push eax
push 0
lea eax, [ebp - 0x424]
push eax
push 0x48
call dword [sym.imp.ntdll.dll_RtlGetThreadPreferredUILanguages]
mov edi, eax
test edi, edi
jl 0x7dd7dbbe
cmp dword [ebp - 0x424], 0
jbe 0x7dda60ee
mov eax, dword fs:[0x18]
mov ecx, dword [ebp - 0x414]
mov eax, dword [eax + 0x30]
add ecx, ecx
push ecx
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x3d8], eax
test eax, eax
jne 0x7dda60c8
mov edi, 0xc0000017
jmp 0x7dd7dbbe
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x3d8]
lea eax, [ebp - 0x424]
push eax
push 0x48
call dword [sym.imp.ntdll.dll_RtlGetThreadPreferredUILanguages]
mov edi, eax
test edi, edi
jl 0x7dd7dbbe
movzx eax, word [esi + 0xe]
push eax
call sym.KERNEL32.dll_SetThreadUILanguage
mov dword [ebp - 0x440], 1
jmp 0x7dd799d3
mov eax, dword fs:[0x18]
mov ecx, dword [ebp - 0x400]
mov eax, dword [eax + 0x30]
add ecx, ecx
push ecx
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x3d0], eax
test eax, eax
jne 0x7dda6136
add edi, 0xfffffff4
jmp 0x7dd79faa
lea eax, [ebp - 0x400]
push eax
push dword [ebp - 0x3d0]
lea eax, [ebp - 0x44c]
push eax
push 0x38
call dword [sym.imp.ntdll.dll_RtlGetThreadPreferredUILanguages]
mov edi, eax
test edi, edi
jge 0x7dd79a13
jmp 0x7dd79faa
and dword [ebp - 0x3d0], 0
jmp 0x7dd79a13
push 0x7dda6658
push 0x7dda6624
push 0
push 0x33
call dword [sym.imp.ntdll.dll_DbgPrintEx]
add esp, 0x10
jmp 0x7dda64b4
lea eax, [ebp - 0x35c]
push eax
mov dword [ebp - 0x3c4], 8
call edi
jmp 0x7dd79e9e
cmp edi, 0xc0000034
je 0x7dd79faa
cmp edi, 0xc0000089
je 0x7dd79faa
cmp edi, 0xc000008a
je 0x7dd79faa
cmp edi, 0xc000008b
je 0x7dd79faa
cmp edi, 0xc0000204
je 0x7dd79faa
cmp edi, 0xc0150002
je 0x7dd79faa
cmp edi, 0xc0150004
je 0x7dd79faa
cmp edi, 0xc000000f
je 0x7dd79faa
push dword [ebp - 0x460]
push 0x7dda6658
push 0x7dda6600
push 0
push 0x33
call dword [sym.imp.ntdll.dll_DbgPrintEx]
add esp, 0x14
jmp 0x7dd79faa
cmp edi, 0xc000007b
je 0x7dda62a3
cmp edi, 0xc000012f
je 0x7dda62a3
cmp edi, 0xc0000130
je 0x7dda62a3
cmp edi, 0xc0000131
je 0x7dda62a3
cmp edi, 0xc000035a
je 0x7dda62a3
cmp edi, 0xc0000034
je 0x7dda628f
cmp edi, 0xc0000089
je 0x7dda628f
cmp edi, 0xc000008a
je 0x7dda628f
cmp edi, 0xc000008b
je 0x7dda628f
cmp edi, 0xc0000204
je 0x7dda628f
cmp edi, 0xc0150002
je 0x7dda628f
cmp edi, 0xc0150004
je 0x7dda628f
cmp edi, 0xc000000f
je 0x7dda628f
xor eax, eax
jmp 0x7dda6292
push 2
pop eax
push edi
push 0x7dda6658
push 0x7ddb36d0
push eax
jmp 0x7dda6213
xor edi, edi
jmp 0x7dd7dac3
cmp edi, 0xc0000017
je 0x7dda6314
cmp edi, 0xc0000034
je 0x7dda62f6
cmp edi, 0xc0000089
je 0x7dda62f6
cmp edi, 0xc000008a
je 0x7dda62f6
cmp edi, 0xc000008b
je 0x7dda62f6
cmp edi, 0xc0000204
je 0x7dda62f6
cmp edi, 0xc0150002
je 0x7dda62f6
cmp edi, 0xc0150004
je 0x7dda62f6
cmp edi, 0xc000000f
je 0x7dda62f6
xor eax, eax
jmp 0x7dda62f9
push 2
pop eax
push 0x7dda6658
push 0x7dda65d8
push eax
push 0x33
call dword [sym.imp.ntdll.dll_DbgPrintEx]
add esp, 0x10
jmp 0x7dd79faa
push dword [ebp - 0x3f4]
call dword [sym.imp.ntdll.dll_NtClose]
and dword [ebp - 0x3f4], 0
jmp 0x7dd79b57
cmp edi, 0xc0000040
je 0x7dd79b57
cmp edi, 0xc0000034
je 0x7dda637c
cmp edi, 0xc0000089
je 0x7dda637c
cmp edi, 0xc000008a
je 0x7dda637c
cmp edi, 0xc000008b
je 0x7dda637c
cmp edi, 0xc0000204
je 0x7dda637c
cmp edi, 0xc0150002
je 0x7dda637c
cmp edi, 0xc0150004
je 0x7dda637c
cmp edi, 0xc000000f
je 0x7dda637c
xor eax, eax
jmp 0x7dda637f
push 2
pop eax
push edi
push 0x7dda6658
push 0x7dda65a4
jmp 0x7dda629d
mov edi, 0xc000007b
jmp 0x7dd79faa
xor eax, eax
cmp dword [esi + 0x14], eax
setne al
mov dword [ebp - 0x3c8], eax
test eax, eax
jne 0x7dd79b9e
jmp 0x7dd7db6d
mov edi, 0xc000008a
jmp 0x7dd79faa
push eax
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
jmp 0x7dd79c5f
xor eax, eax
jmp 0x7dd79db5
test edi, edi
jge 0x7dda6420
cmp edi, 0xc0000034
je 0x7dda6420
cmp edi, 0xc0000089
je 0x7dda6420
cmp edi, 0xc000008a
je 0x7dda6420
cmp edi, 0xc000008b
je 0x7dda6420
cmp edi, 0xc0000204
je 0x7dda6420
cmp edi, 0xc0150002
je 0x7dda6420
cmp edi, 0xc0150004
je 0x7dda6420
cmp edi, 0xc000000f
je 0x7dda6420
xor eax, eax
jmp 0x7dda6423
push 2
pop eax
push 0x7dda6658
push 0x7dda6578
jmp 0x7dda6303
or dword [ebp - 0x3c4], ebx
jmp 0x7dd79f92
cmp edi, 0xc0000022
je 0x7dda6489
cmp edi, 0xc0000034
je 0x7dda6489
cmp edi, 0xc0000089
je 0x7dda6489
cmp edi, 0xc000008a
je 0x7dda6489
cmp edi, 0xc000008b
je 0x7dda6489
cmp edi, 0xc0000204
je 0x7dda6489
cmp edi, 0xc0150002
je 0x7dda6489
cmp edi, 0xc0150004
je 0x7dda6489
cmp edi, 0xc000000f
je 0x7dda6489
xor eax, eax
jmp 0x7dda648c
push 2
pop eax
push edi
push 0x7dda6658
push 0x7dda6540
jmp 0x7dda629d
push eax
push 0x7dda6658
push 0x7dda6520
push 0
push 0x33
call dword [sym.imp.ntdll.dll_DbgPrintEx]
add esp, 0x14
mov edi, 0xc000000d
jmp 0x7dd79faa
lea eax, [ebp - 0x424]
push eax
push dword [ebp - 0x3d8]
push 8
call dword [sym.imp.ntdll.dll_RtlSetThreadPreferredUILanguages]
jmp 0x7dd79fb7
lea eax, [ebp - 0x3fc]
push eax
call fcn.7dd78d6f
jmp 0x7dd79fd2
push dword [ebp - 0x3d0]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call ebx
jmp 0x7dd7a19d
push dword [ebp - 0x3d8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call ebx
jmp 0x7dd7a1aa