Function at 0x180009670
Capabilities:
Timestomp file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x48]
sub rsp, 0x120
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x1801b4100]
xor rax, rsp
mov qword [rbp + 8], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 8], xmm1
mov r8d, 0x17
lea rdx, str.C:Windowswinhlp32.exe
lea rcx, [rbp - 0x18]
call fcn.180002f80
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x38], xmm1
mov r8d, 0x17
lea rdx, [0x180192fb8]
lea rcx, [rbp - 0x48]
call fcn.180002f80
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x58], xmm1
mov r8d, 0x20
lea rdx, str.C:Windows_system32PeerDist.dll
lea rcx, [rbp - 0x68]
call fcn.180002f80
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
mov r8d, 0x17
lea rdx, [0x180192ff8]
lea rcx, [rsp + 0x78]
call fcn.180002f80
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x18]
call fcn.180009380
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x68]
call fcn.180009380
lea rcx, [rsp + 0x40]
call fcn.180005040
movabs rdx, 0x7fffffff4d2fa1ff
mov r14d, 0xff
mov rax, qword [rsp + 0x40]
cmp rax, rdx
je 0x180009795
mov ecx, 1
cmovl ecx, r14d
test cl, cl
jns 0x180009795
mov edi, 0xb2d05e00
add rdi, rax
jmp 0x18000979f
movabs rdi, 0x7fffffffffffffff
movabs rsi, 0x311cdad160000
movabs r15, 0x112e0be826d694b3
movsd xmm6, qword [0x180199b68]
nop dword [rax + rax]
lea rcx, [rsp + 0x40]
call fcn.180005040
mov rbx, qword [rsp + 0x40]
cmp rdi, rbx
je 0x180009834
mov eax, 1
cmovl eax, r14d
test al, al
jle 0x180009834
call fcn.1800af6bc
imul rcx, rax, 0x64
mov rax, rdi
sub rax, rbx
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
comisd xmm0, xmm6
jbe 0x180009803
add rcx, rsi
jmp 0x180009806
add rcx, rax
mov rax, r15
imul rcx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rbp - 0x28], rdx
imul eax, edx, 0x3b9aca00
sub ecx, eax
mov dword [rbp - 0x20], ecx
lea rcx, [rbp - 0x28]
call fcn.1800b5fb4
jmp 0x1800097c0
mov dword [rsp + 0x48], 0xc07e3
mov esi, 7
mov dword [rsp + 0x4e], 0xb0007
mov dword [rsp + 0x52], 0x30
xor edi, edi
mov word [rsp + 0x56], di
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x1800098be
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, esi
mov edx, 0x100
lea rcx, str.C:Windowswinhlp64.exe
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800098be
lea r9, [rsp + 0x68]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x58], 0xc07e3
mov dword [rsp + 0x5e], 0xb0007
mov dword [rsp + 0x62], 0x30
mov word [rsp + 0x66], di
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x180009942
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, esi
mov edx, 0x100
lea rcx, str.C:Windowswinhlp64.dll
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180009942
lea r9, [rsp + 0x70]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x18000997e
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009979
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009a99
call fcn.1800d84dc
movdqa xmm0, xmmword [0x180199c10]
movdqu xmmword [rbp - 0x78], xmm0
mov byte [rsp + 0x78], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x1800099cb
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800099c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009a9f
call fcn.1800d84dc
movdqa xmm0, xmmword [0x180199c10]
movdqu xmmword [rbp - 0x58], xmm0
mov byte [rbp - 0x68], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x180009a17
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009a12
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009aa5
call fcn.1800d84dc
movdqa xmm0, xmmword [0x180199c10]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], 0
mov rdx, qword [rbp]
cmp rdx, 0xf
jbe 0x180009a5f
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009a5a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009a93
call fcn.1800d84dc
xor eax, eax
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.1800d7ff0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1800df45c
nop
call fcn.1800df45c
nop
call fcn.1800df45c
nop
call fcn.1800df45c
int3