Function at 0x7dd93d7b
Capabilities:
Delete file
Get file attributes
Inspect section memory permissions
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push 0x39c
push 0x7dd94238
call fcn.7dd725e8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x280], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x270], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x298], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x318], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x314], eax
mov esi, dword [ebp + 0x2c]
or dword [ebp - 0x238], 0xffffffff
or dword [ebp - 0x248], 0xffffffff
xor ebx, ebx
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x2c0], ebx
mov dword [ebp - 0x2b4], ebx
mov dword [ebp - 0x25c], ebx
mov dword [ebp - 0x24c], ebx
mov dword [ebp - 0x254], ebx
mov dword [ebp - 0x29c], ebx
mov dword [ebp - 0x2b8], ebx
test dword [ebp + 0x1c], 0xffffe7f0
jne 0x7dda269b
mov eax, dword [ebp + 0x20]
test eax, 0xfffff80f
jne 0x7dda269b
or dword [ebp + 0x1c], eax
call sub.ntdll.dll_RtlGetCurrentTransaction
test eax, eax
jne 0x7dda26ac
push esi
call sub.ntdll.dll_RtlSetCurrentTransaction
mov dword [ebp - 4], ebx
mov esi, 0x1000
test dword [ebp + 0x1c], esi
jne 0x7dd93e57
call fcn.7dd93c92
test eax, eax
jne 0x7dda26b9
test byte [ebp + 0x1c], 2
jne 0x7dda26c1
mov eax, dword [0x7de4000c]
test dword [ebp + 0x1c], 0x180
jne 0x7dda26d4
mov esi, dword [ebp + 0x1c]
and esi, 0xfffffffc
or esi, 0xfffffff8
shl esi, 9
mov ecx, dword [ebp + 0x1c]
and ecx, 0x20
or esi, ecx
shl esi, 0x13
mov dword [ebp - 0x310], esi
or eax, dword [ebp - 0x29c]
or eax, 0x8200000
mov dword [ebp - 0x244], eax
mov eax, dword [ebp + 0x1c]
and eax, 0x1000
shl eax, 0x11
or dword [ebp - 0x244], eax
mov dword [ebp - 0x2b0], ebx
push 5
pop edi
mov dword [ebp - 0x30c], edi
mov dword [ebp - 0x250], esi
mov dword [ebp - 0x274], edi
push ebx
push dword [ebp - 0x244]
push 3
push ebx
push dword [ebp - 0x274]
push dword [ebp - 0x250]
push dword [ebp - 0x280]
call sub.API_MS_Win_Core_File_L1_1_0.dll_CreateFileW
mov dword [ebp - 0x238], eax
cmp eax, 0xffffffff
je 0x7dd9603e
cmp dword [ebp - 0x2b0], ebx
jne 0x7dd93f64
xor eax, eax
inc eax
mov dword [ebp - 0x2b0], eax
mov ecx, dword [ebp + 0x1c]
shr ecx, 0xb
and ecx, eax
push ecx
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x2b4]
push eax
lea eax, [ebp - 0x2c0]
push eax
push dword [ebp - 0x238]
call fcn.7dd9431f
mov dword [ebp - 0x23c], eax
cmp eax, ebx
jl 0x7dda2724
cmp dword [ebp - 0x2c0], ebx
jne 0x7dda2746
cmp dword [ebp - 0x2b4], ebx
je 0x7dda27e0
test byte [ebp + 0x1c], 2
jne 0x7dd93fbf
test dword [ebp - 0x244], 0x20000000
jne 0x7dd93fbf
push 4
push 8
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x238]
call dword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
mov dword [ebp - 0x23c], eax
cmp eax, ebx
jl 0x7dd9870e
test byte [ebp - 0x330], 0x10
jne 0x7dda2801
test dword [ebp - 0x244], 0x40000000
jne 0x7dd95020
push 5
push 0x18
lea eax, [ebp - 0x3ac]
push eax
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x238]
mov edi, dword [sym.imp.ntdll.dll_NtQueryInformationFile]
call edi
mov dword [ebp - 0x23c], eax
cmp eax, ebx
jl 0x7dd9870e
push 4
push 0x28
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x238]
call edi
mov dword [ebp - 0x23c], eax
cmp eax, ebx
jl 0x7dd9870e
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0x2c8], eax
mov eax, dword [ebp - 0x298]
cmp eax, ebx
jne 0x7dd95317
cmp dword [ebp - 0x2a0], ebx
jne 0x7dd95317
mov dword [ebp - 0x290], 0x1000
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x304], eax
mov eax, dword fs:[0x18]
mov esi, dword [ebp - 0x290]
push esi
push dword [ebp - 0x304]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x24c], eax
cmp eax, ebx
je 0x7dda2859
push 0x16
add esi, 0xfffffffe
push esi
push dword [ebp - 0x24c]
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x238]
call edi
mov dword [ebp - 0x23c], eax
cmp eax, ebx
jl 0x7dda2863
cmp dword [ebp - 0x264], ebx
je 0x7dda2895
cmp dword [ebp - 0x23c], 0x80000005
je 0x7dd94045
cmp dword [ebp - 0x23c], 0xc0000023
je 0x7dd94045
cmp dword [ebp - 0x298], ebx
jne 0x7dd99239
test byte [ebp + 0x1c], 2
jne 0x7dd99239
mov dword [ebp - 0x35c], ebx
mov dword [ebp - 0x358], ebx
mov dword [ebp - 0x354], ebx
mov dword [ebp - 0x350], ebx
mov dword [ebp - 0x33c], ebx
test byte [ebp + 0x1c], 2
jne 0x7dda2940
lea eax, [ebp - 0x2b8]
push eax
push dword [ebp - 0x328]
push dword [ebp - 0x25c]
lea eax, [ebp - 0x300]
push eax
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x308]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp - 0x3a4]
push eax
push ebx
push dword [ebp - 0x270]
push dword [ebp - 0x250]
push dword [ebp - 0x238]
push dword [ebp - 0x280]
call fcn.7dd9438b
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x25c], ebx
jne 0x7dda296c
cmp dword [ebp - 0x240], ebx
je 0x7dd9421b
cmp dword [ebp - 0x24c], ebx
je 0x7dd941d0
mov dword [ebp - 0x278], ebx
mov byte [ebp - 0x256], bl
mov byte [ebp - 0x255], bl
mov edi, dword [ebp - 0x24c]
mov dword [ebp - 0x26c], edi
mov esi, dword [ebp - 0x254]
mov dword [ebp - 0x23c], ebx
cmp dword [edi + 4], 2
jbe 0x7dd941c8
cmp word [edi + 0x1a], 0x3a
jne 0x7dda2a37
cmp dword [edi], ebx
jne 0x7dda2f8b
cmp dword [ebp - 0x240], ebx
je 0x7dd9421b
test byte [ebp + 0x1c], 2
jne 0x7dda2d7f
cmp dword [ebp - 0x240], ebx
je 0x7dd9421b
push 4
push 0x28
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x248]
mov esi, dword [sym.imp.ntdll.dll_NtSetInformationFile]
call esi
mov dword [ebp - 0x23c], eax
cmp eax, 0xc0000043
je 0x7dda2e81
mov dword [ebp - 4], 0xfffffffe
call fcn.7dd94259
mov eax, dword [ebp - 0x240]
call fcn.7dd72630
ret 0x28
push dword [ebp - 0x238]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
or dword [ebp - 0x238], 0xffffffff
and dword [ebp - 0x244], 0xbfffffff
mov dword [0x7de4000c], ebx
jmp 0x7dd93ecd
mov ecx, dword [ebp - 0x3a4]
mov dword [ebp - 0x37c], ecx
mov ecx, dword [ebp - 0x3a0]
mov dword [ebp - 0x378], ecx
mov dword [ebp - 0x374], ebx
mov dword [ebp - 0x370], ebx
mov dword [ebp - 0x36c], ebx
mov ecx, dword [ebp - 0x2a0]
mov dword [ebp - 0x368], ecx
mov ecx, dword [ebp - 0x2bc]
mov dword [ebp - 0x364], ecx
mov dword [ebp - 0x360], eax
lea eax, [ebp - 0x37c]
mov dword [ebp - 0x254], eax
jmp 0x7dd9403b
call fcn.7dd711c7
cmp eax, 0x522
je 0x7dda26e3
call fcn.7dd711c7
cmp eax, 5
je 0x7dda26e3
call fcn.7dd711c7
cmp eax, 5
je 0x7dd960a0
call fcn.7dd711c7
cmp eax, 0x20
je 0x7dd960a0
test byte [ebp - 0x274], 2
jne 0x7dd986ef
or dword [ebp - 0x274], 2
mov dword [ebp - 0x250], esi
and dword [ebp - 0x244], 0xdfffffff
and dword [ebp + 0x1c], 0xffffefff
jmp 0x7dd93ecd
test dword [ebp - 0x250], 0x40000000
je 0x7dd96070
jmp 0x7dda2702
test dword [ebp - 0x244], 0x200000
je 0x7dd9421b
and dword [ebp - 0x244], 0xffdfffff
jmp 0x7dd93ec1
push eax
jmp 0x7dda273c
add eax, dword [eax]
jmp 0x7dd9925d
test byte [ebp + 0x1c], 2
jne 0x7dda28b9
mov eax, dword [ebp - 0x24c]
cmp eax, ebx
je 0x7dd940e7
mov dword [ebp - 0x2ac], ebx
mov dword [ebp - 0x2a8], ebx
mov dword [ebp - 0x26c], eax
mov ecx, dword [eax + 8]
add dword [ebp - 0x2ac], ecx
mov ecx, dword [eax + 0xc]
adc dword [ebp - 0x2a8], ecx
inc dword [ebp - 0x2fc]
cmp dword [eax], ebx
jne 0x7dd98714
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x37c], eax
mov ecx, dword [ebp - 0x2a8]
mov dword [ebp - 0x378], ecx
mov dword [ebp - 0x2e0], eax
mov dword [ebp - 0x2dc], ecx
dec dword [ebp - 0x2fc]
jmp 0x7dd940e7
push 0xc000000d
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
jmp 0x7dd9422d
push 0x1a45
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
jmp 0x7dda26a5
or dword [ebp + 0x1c], esi
jmp 0x7dd93e57
and dword [ebp + 0x1c], 0xffffefff
xor eax, eax
mov dword [0x7de4000c], eax
jmp 0x7dd93e66
mov dword [ebp - 0x29c], 0x2000000
jmp 0x7dd93e73
test dword [ebp - 0x250], 0x1000000
je 0x7dd9605c
and dword [ebp - 0x250], 0xfeffffff
jmp 0x7dd93ecd
and dword [ebp - 0x250], 0xbfffffff
mov eax, 0x1000000
test eax, esi
je 0x7dd93ecd
or dword [ebp - 0x250], eax
jmp 0x7dd93ecd
push dword [ebp - 0x238]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
or dword [ebp - 0x238], 0xffffffff
push dword [ebp - 0x23c]
call sym.KERNEL32.dll_BaseSetLastNTError
jmp 0x7dd9421b
push ebx
push ebx
push ebx
push ebx
call fcn.7dd7181b
mov esi, eax
cmp esi, ebx
jne 0x7dda276c
push dword [ebp - 0x238]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
or dword [ebp - 0x238], 0xffffffff
jmp 0x7dd9421b
push esi
lea eax, [ebp + 0x1c]
push eax
push dword [ebp - 0x2a0]
push dword [ebp - 0x2bc]
push dword [ebp - 0x298]
mov eax, dword [ebp + 0x20]
and al, 0x80
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x4001
push eax
push dword [ebp - 0x270]
push dword [ebp - 0x280]
push dword [ebp - 0x238]
call fcn.7ddee819
mov dword [ebp - 0x23c], eax
push esi
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
push dword [ebp - 0x238]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
or dword [ebp - 0x238], 0xffffffff
xor eax, eax
cmp dword [ebp - 0x23c], ebx
setne al
mov dword [ebp - 0x240], eax
jmp 0x7dd9421b
and dword [ebp - 0x244], 0xffdfffff
push dword [ebp - 0x238]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
or dword [ebp - 0x238], 0xffffffff
jmp 0x7dd93ecd
test dword [ebp - 0x330], 0x1000
jne 0x7dd93faf
push dword [ebp - 0x238]
test dword [ebp - 0x244], 0x40000000
jne 0x7dda2844
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
or dword [ebp - 0x238], 0xffffffff
mov eax, 0x40000000
or dword [ebp - 0x244], eax
mov dword [0x7de4000c], eax
jmp 0x7dd93ecd
call fcn.7ddee15f
push dword [ebp - 0x238]
call fcn.7ddee23b
jmp 0x7dd93fbf
push 0xc0000017
jmp 0x7dda273c
mov eax, dword fs:[0x18]
push dword [ebp - 0x24c]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebp - 0x24c], ebx
mov eax, dword [ebp - 0x290]
add eax, eax
mov dword [ebp - 0x290], eax
jmp 0x7dd940b5
mov eax, dword fs:[0x18]
push dword [ebp - 0x24c]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebp - 0x24c], ebx
jmp 0x7dd940b5
mov eax, 0x7a9b
mov word [ebp - 0x300], ax
push 0x38
pop eax
mov word [ebp - 0x2fe], ax
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0x2f8], eax
mov eax, dword [ebp - 0x358]
mov dword [ebp - 0x2f4], eax
mov eax, dword [ebp - 0x34c]
mov dword [ebp - 0x2f0], eax
mov eax, dword [ebp - 0x348]
mov dword [ebp - 0x2ec], eax
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x2e8], eax
mov ecx, dword [ebp - 0x3a0]
mov dword [ebp - 0x2e4], ecx
mov dword [ebp - 0x2e0], eax
mov dword [ebp - 0x2dc], ecx
mov dword [ebp - 0x2fc], ebx
mov dword [ebp - 0x2d0], ebx
mov dword [ebp - 0x2d8], ebx
mov dword [ebp - 0x2d4], ebx
jmp 0x7dd99243
cmp dword [ebp - 0x2dc], ebx
jl 0x7dda2963
jg 0x7dda2956
cmp dword [ebp - 0x2e0], 0x80000
jb 0x7dda2963
test byte [ebp - 0x2c8], 0x10
je 0x7dd9410f
and dword [ebp + 0x1c], 0xfffffffd
jmp 0x7dd9410f
cmp eax, ebx
jne 0x7dd94185
call fcn.7dd711c7
cmp eax, 0x50
jne 0x7dda2988
test byte [ebp + 0x1c], 1
jne 0x7dd94179
mov esi, dword [ebp - 0x2c8]
and esi, 1
jne 0x7dda29a3
push 0x80
push dword [ebp - 0x248]
call fcn.7ddee669
or edi, 0xffffffff
cmp dword [ebp - 0x248], edi
je 0x7dda29bf
push dword [ebp - 0x248]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
mov dword [ebp - 0x248], edi
cmp esi, ebx
je 0x7dda29de
push 0x80
push dword [ebp - 0x270]
call fcn.7dd8d524
push dword [ebp - 0x270]
call fcn.7dd725e0
cmp dword [ebp - 0x238], edi
je 0x7dda29f7
push dword [ebp - 0x238]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
mov dword [ebp - 0x238], edi
mov eax, dword fs:[0x18]
push dword [ebp - 0x24c]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebp - 0x24c], ebx
and dword [ebp - 0x244], 0xffdfffff
mov dword [ebp - 0x25c], ebx
mov edi, dword [ebp - 0x30c]
mov esi, dword [ebp - 0x310]
jmp 0x7dd93ec1
inc dword [ebp - 0x278]
cmp dword [ebp - 0x240], 2
jne 0x7dda2a75
cmp esi, ebx
je 0x7dda2a75
mov eax, dword [ebp - 0x278]
cmp eax, dword [ebp - 0x2d0]
jae 0x7dda2a63
mov eax, dword [edi + 8]
add dword [esi + 8], eax
mov eax, dword [edi + 0xc]
jmp 0x7dda2a72
mov eax, dword [ebp - 0x2d8]
add dword [esi + 8], eax
mov eax, dword [ebp - 0x2d4]
adc dword [esi + 0xc], eax
cmp byte [ebp - 0x256], bl
jne 0x7dda2b13
mov byte [ebp - 0x256], 1
push 5
push 0x218
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x248]
mov esi, dword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
call esi
mov dword [ebp - 0x23c], eax
cmp eax, ebx
jl 0x7dda2f09
test dword [ebp - 0x234], 0x40000
je 0x7dda2ae8
push 5
push 0x218
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x238]
call esi
mov dword [ebp - 0x23c], eax
cmp eax, ebx
jl 0x7dda2f09
test dword [ebp - 0x234], 0x40000
je 0x7dda2efa
mov byte [ebp - 0x255], 1
mov dword [ebp - 0x23c], ebx
mov esi, dword [ebp - 0x254]
cmp dword [ebp - 0x240], 1
je 0x7dda2b3b
cmp dword [ebp - 0x240], 2
jne 0x7dda2d3d
mov eax, dword [ebp - 0x2d0]
cmp eax, dword [ebp - 0x278]
jne 0x7dda2d3d
cmp dword [ebp - 0x240], 2
je 0x7dda2b5c
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x2d0], eax
mov dword [ebp - 0x2d8], ebx
mov dword [ebp - 0x2d4], ebx
lea eax, [edi + 0x18]
mov dword [ebp - 0x284], eax
mov ax, word [edi + 4]
mov word [ebp - 0x288], ax
mov word [ebp - 0x286], ax
mov dword [ebp - 0x394], 0x18
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x390], eax
mov dword [ebp - 0x388], ebx
lea eax, [ebp - 0x288]
mov dword [ebp - 0x38c], eax
mov dword [ebp - 0x384], ebx
mov dword [ebp - 0x380], ebx
mov dword [ebp - 0x260], 0x24
cmp dword [ebp - 0x25c], ebx
je 0x7dda2bc7
mov dword [ebp - 0x260], 0x200024
push ebx
push ebx
push dword [ebp - 0x260]
push 1
push 1
push ebx
push ebx
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x394]
push eax
push 0x80100000
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.ntdll.dll_NtCreateFile]
mov dword [ebp - 0x23c], eax
cmp eax, 0xc0000043
jne 0x7dda2c36
push ebx
push ebx
push dword [ebp - 0x260]
push 1
push 3
push ebx
push ebx
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x394]
push eax
push 0x80100000
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.ntdll.dll_NtCreateFile]
mov dword [ebp - 0x23c], eax
cmp eax, ebx
jl 0x7dda2d3d
movzx eax, word [ebp - 0x288]
shr eax, 1
mov ecx, dword [ebp - 0x284]
lea eax, [ecx + eax*2]
movzx esi, word [eax]
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 0x27c], ebx
mov eax, dword [ebp + 0x1c]
and eax, 0xfffffffe
mov dword [ebp - 0x2c4], eax
and eax, 0xffffefff
mov dword [ebp - 0x2c4], eax
lea eax, [ebp - 0x2b8]
push eax
push dword [ebp - 0x328]
push dword [ebp - 0x25c]
lea eax, [ebp - 0x300]
push eax
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x308]
push eax
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x2c4]
push eax
lea eax, [edi + 8]
push eax
push dword [ebp - 0x248]
push dword [ebp - 0x284]
push dword [ebp - 0x250]
push dword [ebp - 0x28c]
push dword [ebp - 0x280]
call fcn.7dd9438b
mov dword [ebp - 0x240], eax
movzx eax, word [ebp - 0x288]
shr eax, 1
mov ecx, dword [ebp - 0x284]
mov word [ecx + eax*2], si
push dword [ebp - 0x28c]
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [ebp - 0x27c], ebx
je 0x7dda2d37
cmp dword [ebp - 0x240], ebx
je 0x7dda2d2b
push 4
push 0x28
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x27c]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
mov dword [ebp - 0x23c], eax
push dword [ebp - 0x27c]
call dword [sym.imp.ntdll.dll_NtClose]
mov esi, dword [ebp - 0x254]
cmp dword [ebp - 0x23c], ebx
jge 0x7dda2d56
mov dword [ebp - 0x240], ebx
push dword [ebp - 0x23c]
call sym.KERNEL32.dll_BaseSetLastNTError
cmp dword [ebp - 0x240], ebx
jne 0x7dd941c8
cmp byte [ebp - 0x255], bl
je 0x7dda2f76
push ebx
push dword [ebp - 0x248]
call fcn.7ddee669
jmp 0x7dd941d0
push ebx
push ebx
push ebx
push dword [ebp - 0x238]
call fcn.7dd7168a
push ebx
push ebx
push ebx
mov esi, dword [ebp - 0x248]
push esi
call fcn.7dd7168a
push 0x38
pop edi
mov dword [ebp - 0x294], edi
mov edx, dword [ebp - 0x3a4]
mov ecx, edx
add ecx, 0xffffffff
mov eax, dword [ebp - 0x3a0]
adc eax, 0xffffffff
cmp eax, ebx
ja 0x7dda2dca
jb 0x7dda2dc4
cmp ecx, 0x36
ja 0x7dda2dca
mov dword [ebp - 0x294], edx
push ebx
lea eax, [ebp - 0x2a4]
push eax
push dword [ebp - 0x294]
lea eax, [ebp - 0x300]
push eax
push dword [ebp - 0x238]
call sub.API_MS_Win_Core_File_L1_1_0.dll_ReadFile
mov dword [ebp - 0x240], eax
cmp eax, ebx
je 0x7dda2e6f
mov eax, dword [ebp - 0x2a4]
cmp eax, dword [ebp - 0x294]
jne 0x7dda2e6f
push ebx
lea ecx, [ebp - 0x31c]
push ecx
push eax
lea eax, [ebp - 0x300]
push eax
push esi
call sub.API_MS_Win_Core_File_L1_1_0.dll_WriteFile
mov dword [ebp - 0x240], eax
cmp eax, ebx
je 0x7dda2e6f
mov eax, dword [ebp - 0x31c]
cmp dword [ebp - 0x2a4], eax
jne 0x7dda2e6f
cmp dword [ebp - 0x2a4], edi
jae 0x7dd941e2
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x320], ebx
push 0x14
push 8
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x268]
push eax
push esi
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
mov dword [ebp - 0x23c], eax
cmp eax, ebx
jge 0x7dd941e2
push ebx
push esi
call fcn.7ddee669
mov dword [ebp - 0x240], ebx
jmp 0x7dd941e2
push dword [ebp - 0x248]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
or dword [ebp - 0x248], 0xffffffff
mov dword [ebp - 0x260], 0x80
cmp dword [ebp - 0x25c], ebx
je 0x7dda2eaf
mov dword [ebp - 0x260], 0x200080
push ebx
mov eax, dword [ebp - 0x29c]
or eax, dword [ebp - 0x260]
push eax
push 3
push ebx
push ebx
push 0x100
push dword [ebp - 0x270]
call sub.API_MS_Win_Core_File_L1_1_0.dll_CreateFileW
mov dword [ebp - 0x248], eax
cmp eax, 0xffffffff
je 0x7dd9421b
push 4
push 0x28
lea ecx, [ebp - 0x35c]
push ecx
lea ecx, [ebp - 0x268]
push ecx
push eax
call esi
jmp 0x7dd9421b
cmp eax, ebx
jl 0x7dda2f09
mov eax, 0xc00000bb
mov dword [ebp - 0x23c], eax
test dword [ebp + 0x1c], 0x7f0
je 0x7dda2b07
push ebx
push dword [ebp - 0x248]
push dword [ebp - 0x238]
push 2
push ebx
push dword [ebp - 0x254]
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
push 1
call fcn.7dd90605
test eax, eax
jne 0x7dda2b07
mov eax, dword fs:[0x18]
cmp eax, ebx
je 0x7dda2f5b
mov eax, dword [eax + 0xbf4]
mov dword [ebp - 0x23c], eax
jmp 0x7dda2f65
mov dword [ebp - 0x23c], 0xc000000d
mov dword [ebp - 0x240], ebx
mov edi, dword [ebp - 0x26c]
jmp 0x7dda2d37
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x240], 1
jmp 0x7dd941c8
add edi, dword [edi]
mov dword [ebp - 0x26c], edi
jmp 0x7dd941b1