Function at 0x49db90
Capabilities:
Get common file path
Timestomp file

Disassembly:
sub esp, 0x2d0
mov dword [esp + 0x28], edx
push ebx
mov dword [esp + 0x30], ecx
push esi
lea eax, [esp + 0x48]
push edi
mov dword [esp + 0x14], 0x18
mov dword [esp + 0x18], 0
push ebp
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x49dbd3
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x2d0
ret
lea edi, [esp + 0x50]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x154]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4a12fc
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x50]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x3e90
and ecx, 3
push 0x42
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GlobalAlloc_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock_1]
mov ebx, eax
test ebx, ebx
jne 0x49dc54
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x2d0
ret
lea eax, [esp + 0x154]
push ebx
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
call ebp
cmp eax, 0xffffffff
je 0x49dc7c
mov edx, dword [ebx + 0x18]
lea eax, [ebx + 0x14]
mov ecx, dword [eax]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
jmp 0x49dc91
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [esp + 0x2c]
mov ebp, dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push eax
push ebx
call ebp
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x48], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x44], ecx
lea eax, [esp + 0x258]
push 0x4000
lea ecx, [esp + 0x54]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_OpenFile]
cmp eax, 0xffffffff
jne 0x49dd3e
lea eax, [esp + 0x50]
push 6
push eax
call dword [sym.imp.KERNEL32.dll__lcreat]
mov ebp, eax
push 4
mov dword [esp + 0x20], 0x14
mov dword [esp + 0x18], 0
lea eax, [esp + 0x18]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll__lwrite]
lea eax, [esp + 0x1c]
push 4
push eax
push ebp
call dword [sym.imp.KERNEL32.dll__lwrite]
push 4
push 0x4a4c28
push ebp
call dword [sym.imp.KERNEL32.dll__lwrite]
lea eax, [esp + 0x18]
push 4
push eax
push ebp
call dword [sym.imp.KERNEL32.dll__lwrite]
lea eax, [esp + 0x14]
push 4
push eax
push ebp
call dword [sym.imp.KERNEL32.dll__lwrite]
lea eax, [esp + 0x14]
push 4
push eax
push ebp
call dword [sym.imp.KERNEL32.dll__lwrite]
jmp 0x49ddec
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
lea eax, [esp + 0x50]
push 0
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov ebp, eax
push 4
lea eax, [esp + 0x18]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
cmp dword [esp + 0x14], 0
jne 0x49ddca
lea eax, [esp + 0x1c]
push 4
push eax
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
cmp dword [esp + 0x1c], 0x14
jne 0x49dda2
push 4
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
lea eax, [esp + 0x18]
push 4
push eax
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
push 8
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
jmp 0x49ddec
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll__llseek]
push 0xc
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
cmp byte [ebx], 0x7b
jne 0x49decc
cmp byte [ebx + 0xb], 0x7d
jne 0x49decc
push 2
push 0
push ebp
call dword [sym.imp.KERNEL32.dll__llseek]
mov dword [esp + 0x18], eax
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll__llseek]
mov dword [esp + 0x1c], 0xa
cmp ebp, 0xffffffff
je 0x49defa
cmp dword [esp + 0x1c], 0x14
mov dword [esp + 0x10], 0x18
je 0x49de0c
mov dword [esp + 0x10], 4
push 0x10
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
mov dword [esp + 0x34], 0
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x10]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
cmp eax, dword [esp + 0x18]
jge 0x49df30
lea eax, [ebx + 0xc]
mov dword [esp + 0x24], eax
cmp dword [eax], 0x3e80
jg 0x49de97
cmp byte [ebx], 0x7b
jne 0x49de97
mov ecx, 0xc
mov esi, dword [0x4a4b78]
mov edi, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x49df07
push 1
mov ecx, dword [eax]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll__llseek]
mov ecx, dword [esp + 0x24]
push 0x10
push ebx
push ebp
mov eax, dword [ecx]
add eax, dword [esp + 0x34]
add dword [esp + 0x1c], eax
mov eax, dword [ecx]
add eax, 0x10
add dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll__lread]
mov dword [esp + 0x28], eax
jmp 0x49de2d
push ebp
call dword [sym.imp.KERNEL32.dll__lclose]
lea ecx, [esp + 0x50]
mov edx, dword [esp + 0x10]
call fcn.0049d980
test eax, eax
jne 0x49df11
lea eax, [esp + 0x258]
push 0x200
lea ecx, [esp + 0x54]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_OpenFile]
jmp 0x49dca9
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock_1]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree_1]
push ebp
call dword [sym.imp.KERNEL32.dll__lclose]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x2d0
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x2d0
ret
mov dword [esp + 0x34], 1
jmp 0x49df30
lea eax, [esp + 0x50]
push 0
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov dword [esp + 0x28], 0
mov ebp, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x154]
push eax
push 0x1a3
lea eax, [esp + 0x15c]
push 0x4a12f8
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea ecx, [esp + 0x154]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll__lcreat]
cmp eax, 0xffffffff
mov esi, eax
jne 0x49df95
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock_1]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree_1]
push ebp
call dword [sym.imp.KERNEL32.dll__lclose]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x2d0
ret
cmp dword [esp + 0x34], 0
je 0x49dfac
mov edi, dword [ebx + 0xc]
push 0
add edi, dword [esp + 0x2c]
add edi, dword [esp + 0x14]
push edi
jmp 0x49dfb7
mov edi, dword [esp + 0x18]
push 0
mov eax, dword [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll__llseek]
mov eax, dword [esp + 0x18]
sub eax, edi
mov edi, 0x3e80
mov dword [esp + 0x14], eax
cmp eax, edi
jl 0x49dff1
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll__lwrite]
sub dword [esp + 0x14], 0x3e80
cmp dword [esp + 0x14], edi
jge 0x49dfd1
mov eax, dword [esp + 0x14]
push eax
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
mov eax, dword [esp + 0x14]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll__lwrite]
push ebp
call dword [sym.imp.KERNEL32.dll__lclose]
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
lea eax, [esp + 0x154]
push 0
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov esi, eax
push 1
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
cmp dword [esp + 0x34], 0
mov edi, eax
jne 0x49e049
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll__llseek]
push 0xc
mov eax, dword [0x4a4b78]
push eax
push edi
call dword [sym.imp.KERNEL32.dll__lwrite]
lea eax, [esp + 0x38]
push 4
push eax
push edi
call dword [sym.imp.KERNEL32.dll__lwrite]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll__lwrite]
mov dword [esp + 0x14], eax
push 0
add eax, 0x10
push 0
add dword [esp + 0x18], eax
push esi
call dword [sym.imp.KERNEL32.dll__llseek]
push 0x3e80
push ebx
push esi
call dword [sym.imp.KERNEL32.dll__lread]
cmp eax, 0x3e80
mov ebp, eax
jne 0x49e0dc
push 0x3e80
push ebx
push edi
call dword [sym.imp.KERNEL32.dll__lwrite]
add dword [esp + 0x10], 0x3e80
push 0x3e80
push ebx
push esi
call dword [sym.imp.KERNEL32.dll__lread]
cmp eax, 0x3e80
mov ebp, eax
je 0x49e0b1
push ebp
push ebx
push edi
call dword [sym.imp.KERNEL32.dll__lwrite]
add dword [esp + 0x10], ebp
cmp dword [esp + 0x1c], 0x14
jne 0x49e196
push 0
push 0xc
push edi
call dword [sym.imp.KERNEL32.dll__llseek]
lea eax, [esp + 0x10]
push 4
push eax
push edi
call dword [sym.imp.KERNEL32.dll__lwrite]
mov eax, dword [esp + 0x10]
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll__llseek]
mov ecx, 0x1800
mov eax, dword [esp + 0x10]
cdq
idiv ecx
mov ebp, ecx
mov eax, 0x3e80
mov dword [esp + 0x10], 0
sub ecx, edx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x10]
mov byte [ecx + ebx], 0x55
inc dword [esp + 0x10]
cmp dword [esp + 0x10], eax
jl 0x49e13c
cmp dword [esp + 0x20], 0x3e80
jl 0x49e189
mov ecx, 0x3e80
mov eax, dword [esp + 0x20]
sub edx, edx
div ecx
mov ebp, eax
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
lea eax, [ecx + ecx*4]
shl eax, 7
neg eax
add dword [esp + 0x20], eax
push 0x3e80
push ebx
push edi
call dword [sym.imp.KERNEL32.dll__lwrite]
dec ebp
jne 0x49e179
mov eax, dword [esp + 0x20]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll__lwrite]
push edi
call dword [sym.imp.KERNEL32.dll__lclose]
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
lea eax, [esp + 0x258]
push 0x200
lea ecx, [esp + 0x158]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_OpenFile]
lea ecx, [esp + 0x50]
push 0
push 0x80
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 3
push 0
push 3
push 0xc0000000
push ecx
call ebp
mov esi, eax
lea ecx, [esp + 0x40]
lea eax, [esp + 0x2c]
lea edx, [esp + 0x48]
push eax
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebp
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock_1]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree_1]
mov eax, dword [esp + 0x38]
cmp dword [esp + 0x14], eax
mov eax, 0
jl 0x49e22d
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x2d0
ret