Function at 0x417970
Capabilities:
Timestomp file
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4364d2
mov eax, dword fs:[0]
push eax
sub esp, 0x194
mov eax, dword [0x443284]
xor eax, esp
mov dword [esp + 0x190], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x443284]
xor eax, esp
push eax
lea eax, [esp + 0x1a8]
mov dword fs:[0], eax
xor ebx, ebx
sub esp, 0x1c
mov dword [esp + 0x1cc], 3
cmp dword [esp + 0x220], ebx
mov ecx, esp
mov dword [esp + 0x38], esp
lea ebp, [ebx + 0xf]
push 0xffffffffffffffff
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push ebx
mov byte [ecx + 4], bl
jbe 0x417ad7
lea eax, [esp + 0x1f8]
push eax
call fcn.00401960
call fcn.004190c0
add esp, 0x1c
cmp al, bl
je 0x417a28
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0xffffffffffffffff
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
mov byte [ecx + 4], bl
push ebx
lea edx, [esp + 0x214]
push edx
call fcn.00401960
call fcn.004190c0
add esp, 0x1c
cmp al, bl
jne 0x417ae3
mov esi, 0x10
cmp dword [esp + 0x1d0], esi
jb 0x417a46
mov eax, dword [esp + 0x1bc]
push eax
call fcn.0041f829
add esp, 4
cmp dword [esp + 0x1ec], esi
mov byte [esp + 0x1bc], bl
mov dword [esp + 0x1cc], ebx
mov dword [esp + 0x1d0], ebp
jb 0x417a74
mov ecx, dword [esp + 0x1d8]
push ecx
call fcn.0041f829
add esp, 4
cmp dword [esp + 0x208], esi
mov byte [esp + 0x1d8], bl
mov dword [esp + 0x1e8], ebx
mov dword [esp + 0x1ec], ebp
jb 0x417aa2
mov edx, dword [esp + 0x1f4]
push edx
call fcn.0041f829
add esp, 4
cmp dword [esp + 0x224], esi
mov dword [esp + 0x208], ebp
mov dword [esp + 0x204], ebx
mov byte [esp + 0x1f4], bl
jb 0x417ad0
mov eax, dword [esp + 0x210]
push eax
call fcn.0041f829
add esp, 4
xor eax, eax
jmp 0x418289
lea edx, [esp + 0x1f8]
jmp 0x417a12
cmp dword [esp + 0x1d0], 0x10
mov eax, dword [esp + 0x1bc]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
jae 0x417b03
lea eax, [esp + 0x1bc]
push 6
push eax
call fcn.004205fb
add esp, 8
test eax, eax
jne 0x4181dd
sub esp, 0x1c
mov dword [esp + 0x38], esp
mov esi, esp
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x54], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x1f8]
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.00401960
call fcn.004120d0
add esp, 0x1c
call fcn.00412dc0
add esp, 0x1c
push ebx
push 0x20
push 3
push ebx
push 1
push connect
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x50], esp
push 0xffffffffffffffff
mov byte [esp + 0x4f], al
push ebx
lea eax, [esp + 0x1f4]
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00401960
lea esi, [esp + 0xe8]
call fcn.004120d0
mov edi, 8
add esp, 0x1c
cmp dword [eax + 0x18], edi
jb 0x417ba2
mov eax, dword [eax + 4]
jmp 0x417ba5
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp dword [esp + 0xcc], edi
mov esi, eax
jb 0x417bc7
mov ecx, dword [esp + 0xb8]
push ecx
call fcn.0041f829
add esp, 4
cmp esi, ebx
mov dword [esp + 0xcc], 7
mov dword [esp + 0xc8], ebx
mov word [esp + 0xb8], bx
je 0x417c07
lea edx, [esp + 0x5c]
push edx
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x5c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x417c07
mov dword [esp + 0x28], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x64]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x1e0]
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00401960
lea esi, [esp + 0xd4]
call fcn.004120d0
add esp, 0x1c
cmp dword [eax + 0x18], edi
jb 0x417c4e
mov eax, dword [eax + 4]
jmp 0x417c51
add eax, 4
push eax
call fcn.004201a2
add esp, 8
test eax, eax
sete byte [esp + 0x23]
cmp dword [esp + 0xcc], edi
jb 0x417c7a
mov ecx, dword [esp + 0xb8]
push ecx
call fcn.0041f829
add esp, 4
cmp byte [esp + 0x23], bl
je 0x4181dd
mov eax, dword [esp + 0x78]
cmp eax, ebx
jle 0x4181dd
cmp eax, 0x100
jle 0x4181dd
cmp byte [esp + 0x17], bl
je 0x417cbf
sub esp, 0x1c
lea edx, [esp + 0x1d4]
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call fcn.0040f900
call fcn.004182c0
add esp, 0x1c
push 0x43a36a
lea ecx, [esp + 0xd4]
call fcn.00401810
push 0x43a36a
lea ecx, [esp + 0xf0]
mov byte [esp + 0x1b4], 4
call fcn.00401810
push 0x43a36a
lea ecx, [esp + 0x10c]
mov byte [esp + 0x1b4], 5
call fcn.00401810
push 0x43a36a
lea ecx, [esp + 0xb8]
mov byte [esp + 0x1b4], 6
call fcn.00401810
push 1
lea eax, [esp + 0x20]
push eax
sub esp, 0x1c
lea edx, [esp + 0x1dc]
mov byte [esp + 0x1d4], 7
mov ecx, esp
mov dword [esp + 0x48], esp
mov dword [esp + 0x40], ebx
push edx
lea esi, [esp + 0x130]
lea edi, [esp + 0x114]
lea ebx, [esp + 0xf8]
call fcn.0040f900
lea eax, [esp + 0x54]
push eax
mov edx, esi
mov ecx, edi
call fcn.004174f0
add esp, 0x28
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0xc0]
mov ebp, 8
mov byte [esp + 0x1bc], 8
call fcn.00401960
lea ecx, [esp + 0x30]
mov byte [esp + 0x1b0], 7
call fcn.00401850
lea ecx, [esp + 0x64]
push ecx
sub esp, 0x1c
lea edx, [esp + 0x1d8]
mov ecx, esp
mov dword [esp + 0x44], esp
push edx
call fcn.0040f900
lea esi, [esp + 0x50]
call fcn.004120d0
add esp, 0x1c
cmp dword [eax + 0x18], ebp
jb 0x417dca
mov eax, dword [eax + 4]
jmp 0x417dcd
add eax, 4
push eax
call fcn.004201a2
add esp, 8
test eax, eax
lea ecx, [esp + 0x30]
sete bl
call fcn.004018f0
test bl, bl
je 0x4181a8
cmp dword [esp + 0x78], 0
jle 0x4181a8
push 0x43b0f4
sub esp, 0x1c
lea eax, [esp + 0x1d8]
mov ecx, esp
mov dword [esp + 0x44], esp
push eax
call fcn.0040f900
lea esi, [esp + 0x50]
call fcn.004120d0
add esp, 0x1c
cmp dword [eax + 0x18], ebp
jb 0x417e28
mov eax, dword [eax + 4]
jmp 0x417e2b
add eax, 4
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.0041f92f
add esp, 0xc
test eax, eax
lea ecx, [esp + 0x30]
sete bl
call fcn.004018f0
test bl, bl
je 0x4181a8
cmp dword [esp + 0xc8], 0
mov edx, dword [esp + 0x78]
mov eax, dword [esp + 0x18]
push 0
jbe 0x417f40
add edx, 0xffffff80
push edx
push eax
call fcn.00421d7a
add esp, 0xc
test eax, eax
jne 0x417ed8
push 0x80
push eax
lea ecx, [esp + 0x12c]
push ecx
call fcn.00424a50
mov eax, dword [esp + 0x200]
add esp, 0xc
cmp dword [esp + 0x208], 0x10
jae 0x417ea6
lea eax, [esp + 0x1f4]
push eax
lea edx, [esp + 0x128]
push 0x80
push edx
call fcn.0041fe8c
mov eax, dword [esp + 0x24]
add esp, 0xc
push eax
push 0x80
lea ecx, [esp + 0x12c]
push 1
push ecx
call fcn.00420cf5
add esp, 0x10
mov edx, dword [esp + 0x78]
mov eax, dword [esp + 0x18]
push 0
add edx, 0xffffff00
push edx
push eax
call fcn.00421d7a
add esp, 0xc
test eax, eax
jne 0x418031
push 0x80
push eax
lea ecx, [esp + 0x12c]
push ecx
call fcn.00424a50
mov eax, dword [esp + 0x1e4]
add esp, 0xc
cmp dword [esp + 0x1ec], 0x10
jae 0x417f28
lea eax, [esp + 0x1d8]
push eax
lea edx, [esp + 0x128]
push 0x80
push edx
call fcn.0041fe8c
jmp 0x418012
push edx
push eax
call fcn.00421d7a
add esp, 0xc
test eax, eax
jne 0x417fb1
push 0x80
push eax
lea ecx, [esp + 0x12c]
push ecx
call fcn.00424a50
mov eax, dword [esp + 0x1e4]
add esp, 0xc
cmp dword [esp + 0x1ec], 0x10
jae 0x417f7c
lea eax, [esp + 0x1d8]
mov edx, dword [esp + 0x1e8]
push edx
push eax
lea eax, [esp + 0x12c]
push eax
call fcn.00423740
mov ecx, dword [esp + 0x24]
add esp, 0xc
push ecx
push 0x80
lea edx, [esp + 0x12c]
push 1
push edx
call fcn.00420cf5
add esp, 0x10
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x18]
push 0
add eax, 0x80
push eax
push ecx
call fcn.00421d7a
add esp, 0xc
test eax, eax
jne 0x418031
push 0x80
push eax
lea edx, [esp + 0x12c]
push edx
call fcn.00424a50
mov eax, dword [esp + 0x200]
add esp, 0xc
cmp dword [esp + 0x208], 0x10
jae 0x417ffc
lea eax, [esp + 0x1f4]
mov ecx, dword [esp + 0x204]
push ecx
push eax
lea edx, [esp + 0x12c]
push edx
call fcn.00423740
mov eax, dword [esp + 0x24]
add esp, 0xc
push eax
push 0x80
lea ecx, [esp + 0x12c]
push 1
push ecx
call fcn.00420cf5
add esp, 0x10
mov edx, dword [esp + 0x18]
push edx
mov dword [esp + 0x30], 1
call fcn.00420024
add esp, 4
cmp dword [esp + 0x220], 0
jbe 0x418124
cmp byte [esp + 0x17], 0
je 0x418124
call fcn.00411b50
sub esp, 0x1c
mov edi, eax
lea eax, [esp + 0x1d4]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
call fcn.0040f900
lea esi, [esp + 0xb4]
call fcn.004120d0
add esp, 0x1c
mov byte [esp + 0x1b0], 9
cmp dword [eax + 0x18], ebp
jb 0x41809d
mov eax, dword [eax + 4]
jmp 0x4180a0
add eax, 4
push eax
sub esp, 0x1c
lea edx, [esp + 0x22c]
mov ecx, esp
mov dword [esp + 0x44], esp
push edx
call fcn.0040f900
lea esi, [esp + 0x50]
call fcn.004120d0
add esp, 0x1c
cmp dword [eax + 0x18], ebp
jb 0x4180cd
mov eax, dword [eax + 4]
jmp 0x4180d0
add eax, 4
mov ecx, dword [edi + 8]
push eax
mov eax, dword [edi + 0x10]
push str.sign__f___s____sha1_9414F6B365D177351220926C06176F741D7762E6__t__http:__timestamp.wosign.com_timestamp____s_
push 0xffffffffffffffff
shr eax, 1
push eax
push ecx
call fcn.0041f84a
add esp, 0x18
lea ecx, [esp + 0x30]
call fcn.004018f0
lea ecx, [esp + 0x98]
mov byte [esp + 0x1b0], 7
call fcn.004018f0
mov edx, dword [edi + 8]
push 1
push 0
push 0
push edx
mov ecx, str.signtool.exe
call fcn.00416e40
push edi
call fcn.00411cd0
add esp, 0x14
cmp dword [esp + 0x28], 0
je 0x4181a8
push 0
push 0x20
push 3
push 0
push 3
push 0xc0000000
sub esp, 0x1c
lea eax, [esp + 0x1ec]
mov ecx, esp
mov dword [esp + 0x58], esp
push eax
call fcn.0040f900
lea esi, [esp + 0xcc]
call fcn.004120d0
add esp, 0x1c
cmp dword [eax + 0x18], ebp
jb 0x418169
mov eax, dword [eax + 4]
jmp 0x41816c
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ecx, [esp + 0x98]
mov esi, eax
call fcn.004018f0
test esi, esi
je 0x4181a1
lea ecx, [esp + 0x5c]
push ecx
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x5c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0xb4]
call fcn.00401850
lea ecx, [esp + 0x108]
call fcn.00401850
lea ecx, [esp + 0xec]
call fcn.00401850
lea ecx, [esp + 0xd0]
call fcn.00401850
xor ebx, ebx
lea ebp, [ebx + 0xf]
mov esi, 0x10
cmp dword [esp + 0x1d0], esi
jb 0x4181fb
mov ecx, dword [esp + 0x1bc]
push ecx
call fcn.0041f829
add esp, 4
cmp dword [esp + 0x1ec], esi
mov dword [esp + 0x1d0], ebp
mov dword [esp + 0x1cc], ebx
mov byte [esp + 0x1bc], bl
jb 0x418229
mov edx, dword [esp + 0x1d8]
push edx
call fcn.0041f829
add esp, 4
cmp dword [esp + 0x208], esi
mov dword [esp + 0x1ec], ebp
mov dword [esp + 0x1e8], ebx
mov byte [esp + 0x1d8], bl
jb 0x418257
mov eax, dword [esp + 0x1f4]
push eax
call fcn.0041f829
add esp, 4
cmp dword [esp + 0x224], esi
mov dword [esp + 0x208], ebp
mov dword [esp + 0x204], ebx
mov byte [esp + 0x1f4], bl
jb 0x418285
mov ecx, dword [esp + 0x210]
push ecx
call fcn.0041f829
add esp, 4
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x1a8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0041f134
add esp, 0x1a0
ret