Function at 0x1000a950
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
mov eax, dword [0x10037018]
xor eax, esp
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [esp + 0x10], eax
push esi
mov eax, ebx
push edi
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x1000a976
sub eax, ecx
sar eax, 1
lea edi, [eax + eax + 2]
push edi
call dword [sym.imp.MSVCR100.dll_malloc]
push edi
mov esi, eax
push 0
push esi
call sub.MSVCR100.dll_memset
add edi, 0xfffffffe
push edi
push ebx
push esi
call sub.MSVCR100.dll_memcpy
mov ebx, dword [sym.imp.MSVCR100.dll_wcschr]
push 0x2d
push esi
call ebx
mov edi, dword [sym.imp.MSVCR100.dll__wtoi]
xor ecx, ecx
push esi
mov dword [esp + 0x38], eax
mov word [eax], cx
call edi
movzx edx, ax
mov eax, dword [esp + 0x38]
add eax, 2
push 0x2d
push eax
mov dword [esp + 0x50], edx
mov dword [esp + 0x3c], eax
call ebx
mov edx, dword [esp + 0x3c]
xor ecx, ecx
push edx
mov dword [esp + 0x44], eax
mov word [eax], cx
call edi
movzx eax, ax
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x44]
add eax, 2
push 0x20
push eax
mov dword [esp + 0x48], eax
call ebx
mov edx, dword [esp + 0x48]
xor ecx, ecx
push edx
mov dword [esp + 0x50], eax
mov word [eax], cx
call edi
movzx eax, ax
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x50]
add esp, 0x40
add eax, 2
push 0x3a
push eax
mov dword [esp + 0x14], eax
call ebx
mov edx, dword [esp + 0x14]
xor ecx, ecx
push edx
mov dword [esp + 0x1c], eax
mov word [eax], cx
call edi
movzx eax, ax
add esp, 0xc
cmp eax, 0x18
jne 0x1000aa50
mov dword [esp + 0x14], 0
jmp 0x1000aa57
movzx eax, ax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
add eax, 2
push 0x3a
push eax
mov dword [esp + 0x14], eax
call ebx
mov edx, dword [esp + 0x14]
mov ebx, eax
xor ecx, ecx
push edx
mov word [ebx], cx
call edi
movzx eax, ax
add ebx, 2
push ebx
mov dword [esp + 0x1c], eax
call edi
mov ecx, dword [esp + 0x28]
add esp, 0x10
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ecx
movzx ebx, ax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1000ab57
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx ecx, word [esp + 0x28]
movzx eax, word [esp + 0x20]
mov dx, word [esp + 0x24]
mov word [esp + 0x2e], cx
movzx ecx, word [esp + 0xc]
mov word [esp + 0x2c], ax
movzx eax, word [esp + 0x14]
mov word [esp + 0x32], dx
xor edx, edx
mov word [esp + 0x36], cx
lea ecx, [esp + 0x3c]
mov word [esp + 0x30], dx
push ecx
lea edx, [esp + 0x30]
mov word [esp + 0x38], ax
xor eax, eax
push edx
push eax
mov word [esp + 0x44], bx
mov word [esp + 0x46], ax
call dword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTime]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea edx, [esp + 0x18]
push edx
push 0
mov eax, edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.100256d0
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor al, al
call fcn.100256d0
mov esp, ebp
pop ebp
ret