Function at 0xb11f50
Capabilities:
Get common file path
Timestomp file

Disassembly:
sub esp, 0x28
push ebx
push esi
push edi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push ebp
push 0xbb80
push 0x42
call esi
push eax
mov edi, dword [sym.imp.KERNEL32.dll_GlobalLock]
call edi
mov ebx, eax
test ebx, ebx
jne 0xb11f7f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x28
ret
push 0x104
push 0x42
call esi
push eax
call edi
mov ebp, eax
test ebp, ebp
jne 0xb11fb5
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x28
ret
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0xb11ffd
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebp
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x28
ret
mov edi, ebp
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0xb144a0
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
mov edi, ebp
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 2
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll__lopen]
cmp eax, 0xffffffff
jne 0xb120f7
mov edi, ebx
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0xb14490
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
mov edi, ebp
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 2
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll__lopen]
cmp eax, 0xffffffff
jne 0xb120f7
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebp
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x28
ret
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
lea ecx, [esp + 0x30]
lea eax, [esp + 0x28]
lea edx, [esp + 0x20]
push eax
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0xb1215e
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [esp + 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x30], edx
mov dword [esp + 0x28], edx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x2c], ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 2
push ebp
call dword [sym.imp.KERNEL32.dll__lopen]
mov dword [esp + 0x10], eax
push 2
push 0xfffffffffffffffc
push eax
call dword [sym.imp.KERNEL32.dll__llseek]
lea eax, [esp + 0x14]
push 4
mov ecx, dword [esp + 0x14]
push eax
push ecx
mov esi, dword [sym.imp.KERNEL32.dll__lread]
call esi
cmp dword [esp + 0x14], 0x55ffaaff
je 0xb121b6
mov dword [esp + 0x14], 0xfffffff4
mov dword [esp + 0x18], 1
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
jmp 0xb1224e
mov eax, dword [esp + 0x10]
push 2
push 0xfffffffffffffff4
push eax
call dword [sym.imp.KERNEL32.dll__llseek]
lea eax, [esp + 0x14]
push 4
mov ecx, dword [esp + 0x14]
push eax
push ecx
call esi
push 2
mov eax, 0xfffffff4
sub eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll__llseek]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
push ebx
push edx
call esi
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
mov edx, dword [esp + 0x18]
push ecx
push eax
mov ecx, ebx
mov edi, ebx
call fcn.00b0f600
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push ecx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [esp + 0x1c]
push ecx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov edx, dword [0xb16b24]
mov ecx, dword [esp + 0x18]
add ecx, ebx
mov eax, dword [edx]
mov dword [ecx - 1], eax
dec ecx
mov edi, dword [edx + 4]
mov dword [ecx + 4], edi
mov eax, dword [edx + 8]
mov dword [ecx + 8], eax
lea eax, [esp + 0x1c]
mov dl, byte [edx + 0xc]
mov byte [ecx + 0xc], dl
lea ecx, [esp + 0x18]
add dword [esp + 0x18], 0xc
mov edx, dword [esp + 0x18]
push ecx
push eax
mov ecx, ebx
call fcn.00b0f750
push 2
mov eax, 0xfffffff4
sub eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll__llseek]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
push ecx
push edx
mov edi, dword [sym.imp.KERNEL32.dll__lwrite]
push eax
call edi
lea ecx, [esp + 0x18]
push 4
mov eax, dword [esp + 0x14]
push ecx
push eax
call edi
lea ecx, [esp + 0x14]
push 4
mov edx, dword [esp + 0x14]
push ecx
mov dword [esp + 0x1c], 0
push edx
call edi
lea ecx, [esp + 0x14]
push 4
mov edx, dword [esp + 0x14]
push ecx
mov dword [esp + 0x1c], 0x55ffaaff
push edx
call edi
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll__lclose]
mov ecx, dword [esp + 0x1c]
push ecx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [esp + 0x1c]
push ecx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
lea ecx, [esp + 0x28]
lea eax, [esp + 0x30]
push ecx
lea edx, [esp + 0x24]
push eax
push edx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebp
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x28
ret