Function at 0x7dd9065c
Capabilities:
Get file attributes
Get process heap force flags
Process ghostly hollowing
Set file attributes

Disassembly:
push 0x348
push 0x7dd90b50
call fcn.7dd725e8
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x294], ebx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x26c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x298], eax
or dword [ebp - 0x25c], 0xffffffff
or dword [ebp - 0x260], 0xffffffff
xor esi, esi
mov dword [ebp - 0x2b8], esi
mov dword [ebp - 0x2a0], esi
mov dword [ebp - 0x2b4], esi
mov dword [ebp - 0x288], esi
mov dword [ebp - 0x2b0], esi
mov dword [ebp - 0x2a8], esi
mov dword [ebp - 0x29c], esi
mov dword [ebp - 0x2ac], esi
mov dword [ebp - 0x270], esi
mov dword [ebp - 0x2a4], esi
push esi
lea eax, [ebp - 0x290]
push eax
mov edi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
call edi
cmp ebx, esi
je 0x7dd90de4
cmp dword [ebp - 0x26c], esi
je 0x7dd90de4
cmp dword [ebp + 0x18], esi
jne 0x7dd90de4
cmp dword [ebp + 0x1c], esi
jne 0x7dd90de4
test dword [ebp + 0x14], 0xfffffff8
jne 0x7dd90de4
mov dword [ebp - 4], esi
push esi
lea eax, [ebp - 0x27c]
push eax
call edi
push esi
push esi
lea eax, [ebp - 0x27c]
push eax
push ebx
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
je 0x7dd90dc4
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 0x300], 0x18
mov dword [ebp - 0x2fc], esi
mov dword [ebp - 0x2f4], 0x40
lea eax, [ebp - 0x27c]
mov dword [ebp - 0x2f8], eax
mov dword [ebp - 0x2f0], esi
mov dword [ebp - 0x2ec], esi
mov eax, 0x81110000
mov dword [ebp - 0x284], eax
mov ebx, 0x200060
push ebx
push 7
lea ecx, [ebp - 0x268]
push ecx
lea ecx, [ebp - 0x300]
push ecx
push eax
lea eax, [ebp - 0x25c]
push eax
mov edi, dword [sym.imp.ntdll.dll_NtOpenFile]
call edi
mov dword [ebp - 0x258], eax
cmp eax, esi
jge 0x7dd907e7
mov eax, 0x80110000
mov dword [ebp - 0x284], eax
push ebx
push 7
lea ecx, [ebp - 0x268]
push ecx
lea ecx, [ebp - 0x300]
push ecx
push eax
lea eax, [ebp - 0x25c]
push eax
call edi
mov dword [ebp - 0x258], eax
cmp eax, esi
jl 0x7dda23bd
push esi
push esi
lea eax, [ebp - 0x2e8]
push eax
push dword [ebp - 0x26c]
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
je 0x7dd90dc4
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x2b4], eax
mov dword [ebp - 0x2d8], 0x18
mov dword [ebp - 0x2d4], esi
mov dword [ebp - 0x2cc], 0x40
lea eax, [ebp - 0x2e8]
mov dword [ebp - 0x2d0], eax
mov dword [ebp - 0x2c8], esi
mov dword [ebp - 0x2c4], esi
test dword [ebp - 0x284], 0x1000000
jne 0x7dda23c8
mov ebx, 0xc0000022
mov dword [ebp - 0x258], ebx
cmp dword [ebp - 0x258], esi
jge 0x7dd90891
mov eax, 0xc0150000
mov dword [ebp - 0x274], eax
push 0x60
push esi
lea ecx, [ebp - 0x268]
push ecx
lea ecx, [ebp - 0x2d8]
push ecx
push eax
lea eax, [ebp - 0x260]
push eax
call edi
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], ebx
je 0x7dda23fe
cmp dword [ebp - 0x258], esi
jl 0x7dda24b5
mov ebx, dword [sym.imp.ntdll.dll_NtQueryInformationFile]
push 4
push 0x28
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x25c]
call ebx
mov dword [ebp - 0x258], eax
cmp eax, esi
jl 0x7dda24c0
cmp dword [ebp - 0x2ac], esi
jne 0x7dd908ef
test dword [ebp - 0x308], 0x400
jne 0x7dda24d9
test byte [ebp - 0x308], 1
jne 0x7dda2570
push 4
push 0x28
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x260]
call ebx
mov dword [ebp - 0x258], eax
cmp eax, esi
jl 0x7dda2580
mov dword [ebp - 0x320], esi
mov dword [ebp - 0x31c], esi
mov dword [ebp - 0x318], esi
mov dword [ebp - 0x314], esi
mov dword [ebp - 0x310], esi
mov dword [ebp - 0x30c], esi
push 4
push 0x28
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x260]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
mov dword [ebp - 0x258], eax
cmp eax, esi
jl 0x7dda2599
push 5
push 0x218
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x260]
call dword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
mov dword [ebp - 0x258], eax
cmp eax, esi
jl 0x7dda25a8
mov dword [ebp - 0x2c0], esi
push 1
lea eax, [ebp - 0x2c0]
push eax
push dword [ebp - 0x254]
push esi
push 0xc
push dword [ebp - 0x274]
push dword [ebp - 0x260]
push dword [ebp - 0x26c]
push dword [ebp - 0x284]
push dword [ebp - 0x25c]
push dword [ebp - 0x294]
call fcn.7dd91046
test eax, eax
je 0x7dd90cd6
mov edi, dword [ebp + 0x14]
shr edi, 1
and edi, 1
push edi
push dword [ebp - 0x260]
push dword [ebp - 0x25c]
call fcn.7dd90ef1
test eax, eax
je 0x7dd90cd6
cmp dword [ebp - 0x2a8], esi
jne 0x7dd90a57
cmp dword [ebp - 0x29c], esi
jne 0x7dda25b7
mov eax, dword [ebp - 0x338]
push edi
push eax
push dword [ebp - 0x308]
push dword [ebp - 0x26c]
lea eax, [ebp - 0x2d8]
push eax
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x25c]
call fcn.7dd90e21
test eax, eax
je 0x7dd90cd6
mov edi, dword [ebp - 0x298]
cmp edi, esi
jne 0x7dd90dd9
or ebx, 0xffffffff
mov dword [ebp - 0x280], esi
push dword [ebp - 0x294]
call fcn.7dd716c5
add eax, eax
add eax, 0x20
mov dword [ebp - 0x26c], eax
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x2bc], eax
mov eax, dword fs:[0x18]
push dword [ebp - 0x26c]
push dword [ebp - 0x2bc]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
mov dword [ebp - 0x270], edi
cmp edi, esi
je 0x7dda25bf
cmp ebx, 0xffffffff
jne 0x7dd90b6c
cmp dword [ebp - 0x280], 0x10
jae 0x7dd90dcb
call fcn.7dd71113
add eax, dword [ebp - 0x280]
push eax
push 0x7dd90b34
push 0x10
lea eax, [ebp - 0x3c]
push eax
call sub.ntdll.dll_swprintf_s
mov ebx, dword [ebp - 0x26c]
shr ebx, 1
push dword [ebp - 0x294]
push ebx
push edi
call sub.ntdll.dll_wcscpy_s
lea eax, [ebp - 0x3c]
push eax
push ebx
push edi
call sub.ntdll.dll_wcscat_s
add esp, 0x28
push esi
push 0x102
push 1
push esi
push esi
push 0x40010000
push edi
call sub.API_MS_Win_Core_File_L1_1_0.dll_CreateFileW
mov ebx, eax
inc dword [ebp - 0x280]
jmp 0x7dd90ac0
push ebx
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
push esi
push esi
lea eax, [ebp - 0x290]
push eax
push edi
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
je 0x7dd90dc4
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x2e0], eax
mov eax, dword fs:[0x18]
movzx ecx, word [ebp - 0x290]
add ecx, 0x10
push ecx
push dword [ebp - 0x2e0]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
mov edi, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
call edi
mov dword [ebp - 0x288], eax
cmp eax, esi
je 0x7dda25bf
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x2dc], eax
mov eax, dword fs:[0x18]
movzx ecx, word [ebp - 0x27c]
add ecx, 0x10
push ecx
push dword [ebp - 0x2dc]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call edi
mov edi, eax
mov dword [ebp - 0x2b0], edi
cmp edi, esi
je 0x7dda25c9
mov ebx, dword [ebp - 0x288]
mov byte [ebx], 1
mov dword [ebx + 4], esi
movzx eax, word [ebp - 0x290]
mov dword [ebx + 8], eax
movzx eax, word [ebp - 0x290]
push eax
push dword [ebp - 0x28c]
lea eax, [ebx + 0xc]
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
push 0xa
movzx eax, word [ebp - 0x290]
add eax, 0x10
push eax
push ebx
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x25c]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
mov dword [ebp - 0x258], eax
cmp eax, esi
jl 0x7dda25bf
mov byte [edi], 1
mov dword [edi + 4], esi
movzx eax, word [ebp - 0x27c]
mov dword [edi + 8], eax
movzx eax, word [ebp - 0x27c]
push eax
push dword [ebp - 0x278]
lea eax, [edi + 0xc]
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
push 0xa
movzx eax, word [ebp - 0x27c]
add eax, 0x10
push eax
push edi
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x260]
mov ebx, dword [sym.imp.ntdll.dll_NtSetInformationFile]
call ebx
mov dword [ebp - 0x258], eax
cmp eax, esi
jl 0x7dda25d3
test byte [ebp + 0x14], 1
jne 0x7dda267c
mov dword [ebp - 0x2b8], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.7dd90cf5
mov eax, dword [ebp - 0x2b8]
call fcn.7dd72630
ret 0x18
push 3
jmp 0x7dda23b2
cmp ebx, 0xffffffff
jne 0x7dd90b6c
jmp 0x7dda25bf
mov dword [ebp - 0x270], edi
jmp 0x7dd90b72
push 0x57
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
jmp 0x7dd90ce2
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
jmp 0x7dd90cd6
push eax
call sym.KERNEL32.dll_BaseSetLastNTError
jmp 0x7dd90cd6
mov eax, 0xc1150000
mov dword [ebp - 0x274], eax
push 0x60
push esi
lea ecx, [ebp - 0x268]
push ecx
lea ecx, [ebp - 0x2d8]
push ecx
push eax
lea eax, [ebp - 0x260]
push eax
call edi
mov dword [ebp - 0x258], eax
mov ebx, 0xc0000022
jmp 0x7dd9085d
test byte [ebp + 0x14], 6
je 0x7dda2430
mov eax, 0xc0110000
mov dword [ebp - 0x274], eax
push 0x60
push esi
lea ecx, [ebp - 0x268]
push ecx
lea ecx, [ebp - 0x2d8]
push ecx
push eax
lea eax, [ebp - 0x260]
push eax
call edi
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], ebx
jne 0x7dd9089d
test byte [ebp + 0x14], 2
je 0x7dda246e
mov eax, 0x80150000
mov dword [ebp - 0x274], eax
push 0x60
push esi
lea ecx, [ebp - 0x268]
push ecx
lea ecx, [ebp - 0x2d8]
push ecx
push eax
lea eax, [ebp - 0x260]
push eax
call edi
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], ebx
jne 0x7dd9089d
test byte [ebp + 0x14], 2
je 0x7dd9089d
mov eax, 0x80110000
mov dword [ebp - 0x274], eax
push 0x60
push esi
lea ecx, [ebp - 0x268]
push ecx
lea ecx, [ebp - 0x2d8]
push ecx
push eax
lea eax, [ebp - 0x260]
push eax
call edi
mov dword [ebp - 0x258], eax
jmp 0x7dd9089d
push dword [ebp - 0x258]
jmp 0x7dda23be
test byte [ebp + 0x14], 2
je 0x7dda23bd
mov dword [ebp - 0x2a8], 1
jmp 0x7dd90974
mov dword [ebp - 0x2ac], 1
push 0x23
push 8
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x25c]
call ebx
mov dword [ebp - 0x258], eax
cmp eax, esi
jl 0x7dda23bd
test dword [ebp - 0x32c], 0x20000000
jne 0x7dda255e
push dword [ebp - 0x25c]
call dword [sym.imp.ntdll.dll_NtClose]
or dword [ebp - 0x25c], 0xffffffff
push 0x60
push 7
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x300]
push eax
push dword [ebp - 0x284]
lea eax, [ebp - 0x25c]
push eax
call edi
mov dword [ebp - 0x258], eax
cmp eax, esi
jl 0x7dda23bd
jmp 0x7dd908af
cmp eax, esi
jl 0x7dda23bd
push 0x5b8
jmp 0x7dda23b2
mov eax, 0xc0000022
mov dword [ebp - 0x258], eax
jmp 0x7dda23bd
test byte [ebp + 0x14], 2
je 0x7dda23bd
mov dword [ebp - 0x29c], 1
jmp 0x7dd90924
test byte [ebp + 0x14], 2
jne 0x7dd90974
jmp 0x7dda23bd
test byte [ebp + 0x14], 2
je 0x7dda23bd
jmp 0x7dd909ec
or eax, 0xffffffff
jmp 0x7dd90a28
push 0x497
jmp 0x7dda23b2
push 0x498
jmp 0x7dda23b2
push 0xa
movzx eax, word [ebp - 0x27c]
add eax, 0x10
push eax
push edi
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x25c]
call ebx
mov dword [ebp - 0x258], eax
cmp eax, 0xc00000d5
jne 0x7dda2653
push dword [ebp - 0x25c]
call dword [sym.imp.ntdll.dll_NtClose]
or dword [ebp - 0x25c], 0xffffffff
push esi
push 0x80
push 3
push esi
push esi
push 0x40010000
push dword [ebp - 0x270]
call sub.API_MS_Win_Core_File_L1_1_0.dll_CreateFileW
mov dword [ebp - 0x25c], eax
cmp eax, 0xffffffff
je 0x7dda2653
push 0xa
movzx ecx, word [ebp - 0x27c]
add ecx, 0x10
push ecx
push edi
lea ecx, [ebp - 0x268]
push ecx
push eax
call ebx
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], esi
jge 0x7dda2662
push 0x499
jmp 0x7dda2667
push 0x498
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
mov dword [ebp - 0x2a4], 1
jmp 0x7dd90cd6
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x25c]
call dword [sym.imp.ntdll.dll_NtFlushBuffersFile]
jmp 0x7dd90ccc