Function at 0x7ddf2b63
Capabilities:
Get process heap flags

Disassembly:
push 0x264
push 0x7ddf2eb8
call fcn.7dd725e8
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x22c], ebx
push 0x5c
pop ecx
mov word [ebp - 0x250], cx
xor ecx, ecx
mov word [ebp - 0x24e], cx
cmp eax, ebx
je 0x7ddf2ba7
push eax
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
jmp 0x7ddf2bbd
xor eax, eax
mov word [ebp - 0x238], ax
mov word [ebp - 0x236], ax
mov dword [ebp - 0x234], ebx
cmp esi, ebx
je 0x7ddf2be3
push 0x104
lea eax, [ebp - 0x224]
push eax
push esi
call sym.KERNEL32.dll_GetVolumeNameForVolumeMountPointW
test eax, eax
je 0x7ddf2bdf
lea esi, [ebp - 0x224]
jmp 0x7ddf2be9
cmp esi, ebx
jne 0x7ddf2be9
lea esi, [ebp - 0x250]
push ebx
push ebx
lea eax, [ebp - 0x24c]
push eax
push esi
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
cmp al, bl
jne 0x7ddf2c0c
push 3
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
xor eax, eax
jmp 0x7ddf2e78
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x244], eax
movzx ecx, word [ebp - 0x24c]
shr ecx, 1
cmp word [eax + ecx*2 - 2], 0x5c
je 0x7ddf2c49
push eax
push ebx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push 0xc0000033
call sym.KERNEL32.dll_BaseSetLastNTError
jmp 0x7ddf2c05
mov dword [ebp - 0x268], 0x18
mov dword [ebp - 0x264], ebx
mov dword [ebp - 0x25c], 0x40
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x258], ebx
mov dword [ebp - 0x254], ebx
push 0x20
push 3
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x268]
push eax
mov edi, 0x100002
push edi
lea eax, [ebp - 0x228]
push eax
mov esi, dword [sym.imp.ntdll.dll_NtOpenFile]
call esi
mov dword [ebp - 0x230], eax
cmp eax, ebx
jge 0x7ddf2cd0
push dword [ebp - 0x244]
push ebx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [ebp - 0x230]
jmp 0x7ddf2c42
push ebx
push dword [ebp - 0x228]
call fcn.7de15841
test eax, eax
jne 0x7ddf2d0f
push dword [ebp - 0x244]
push ebx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [ebp - 0x228]
call dword [sym.imp.ntdll.dll_NtClose]
push 0x90
jmp 0x7ddf2bff
push dword [ebp - 0x228]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, 0xfffe
add word [ebp - 0x24c], ax
mov dword [ebp - 0x268], 0x18
mov dword [ebp - 0x264], ebx
mov dword [ebp - 0x25c], 0x40
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x258], ebx
mov dword [ebp - 0x254], ebx
push 0x20
push 3
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x268]
push eax
push edi
lea eax, [ebp - 0x228]
push eax
call esi
mov dword [ebp - 0x230], eax
mov eax, dword fs:[0x18]
push dword [ebp - 0x244]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [ebp - 0x230], ebx
jl 0x7ddf2cc5
mov dword [ebp - 0x240], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x22c], 1
cmp word [ebp - 0x238], bx
je 0x7ddf2dce
movzx eax, word [ebp - 0x238]
add eax, 6
mov dword [ebp - 0x23c], eax
jmp 0x7ddf2dd8
mov dword [ebp - 0x23c], 8
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x26c], eax
mov eax, dword fs:[0x18]
push dword [ebp - 0x23c]
push dword [ebp - 0x26c]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
mov dword [ebp - 0x240], esi
cmp esi, ebx
je 0x7ddf2e56
movzx eax, word [ebp - 0x238]
push eax
push dword [ebp - 0x234]
lea eax, [esi + 4]
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
movzx eax, word [ebp - 0x238]
mov dword [esi], eax
push 2
push dword [ebp - 0x23c]
push esi
lea eax, [ebp - 0x274]
push eax
push dword [ebp - 0x228]
call dword [sym.imp.ntdll.dll_NtSetVolumeInformationFile]
cmp eax, ebx
jge 0x7ddf2e66
push eax
jmp 0x7ddf2e5b
push 0xc0000017
mov dword [ebp - 0x22c], ebx
call sym.KERNEL32.dll_BaseSetLastNTError
mov dword [ebp - 4], 0xfffffffe
call fcn.7ddf2e8d
mov eax, dword [ebp - 0x22c]
call fcn.7dd72630
ret 8