Function at 0x100d6359
Capabilities:
Timestomp file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x74
mov eax, dword [0x101042d0]
xor eax, esp
mov dword [esp + 0x70], eax
push ebx
push esi
mov esi, ecx
mov dword [esp + 0xc], edx
push edi
mov edi, edx
cmp esi, 0xfffffffe
jne 0x100d6452
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, dword [0x101042e0]
mov esi, eax
call fcn.100290c0
mov ecx, dword [0x101042e4]
or ebx, 0xffffffff
xor edi, edi
mov dword [esp + 0x14], eax
cmp ecx, ebx
je 0x100d63be
call fcn.100290c0
test eax, eax
je 0x100d63b8
cmp eax, ebx
je 0x100d6432
jmp 0x100d6428
mov ecx, dword [0x101042e4]
mov edx, ebx
call fcn.1003b000
test eax, eax
je 0x100d6432
push 0x364
push 2
call sym.ucrtbase.dll__calloc_base
mov dword [esp + 0x18], eax
pop ecx
pop ecx
mov ecx, dword [0x101042e4]
test eax, eax
jne 0x100d63f5
xor edx, edx
call fcn.1003b000
push edi
call sym.ucrtbase.dll__free_base
pop ecx
jmp 0x100d6432
mov edx, eax
call fcn.1003b000
test eax, eax
jne 0x100d6413
mov ecx, dword [0x101042e4]
xor edx, edx
call fcn.1003b000
push dword [esp + 0x10]
jmp 0x100d63ed
mov ecx, dword [esp + 0x10]
call fcn.1003e545
push 0
call sym.ucrtbase.dll__free_base
mov eax, dword [esp + 0x14]
pop ecx
imul edi, dword [esp + 0x14], 0x364
add edi, eax
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
test edi, edi
jne 0x100d6444
mov edi, 0x101049f4
jmp 0x100d6447
add edi, 0x10
mov dword [edi], 9
jmp 0x100d682e
test esi, esi
js 0x100d647d
cmp esi, dword [0x10105540]
jae 0x100d647d
mov eax, esi
mov edx, esi
and eax, 0x3f
shr edx, 6
imul ecx, eax, 0x38
mov eax, dword [edx*4 + 0x10105340]
test byte [eax + ecx + 0x28], 1
jne 0x100d6513
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, dword [0x101042e0]
mov esi, eax
call fcn.100290c0
mov ecx, dword [0x101042e4]
or ebx, 0xffffffff
xor edi, edi
mov dword [esp + 0x14], eax
cmp ecx, ebx
je 0x100d64bf
call fcn.100290c0
test eax, eax
je 0x100d64b9
cmp eax, ebx
je 0x100d680e
jmp 0x100d6804
mov ecx, dword [0x101042e4]
mov edx, ebx
call fcn.1003b000
test eax, eax
je 0x100d680e
push 0x364
push 2
call sym.ucrtbase.dll__calloc_base
mov dword [esp + 0x18], eax
pop ecx
pop ecx
mov ecx, dword [0x101042e4]
test eax, eax
je 0x100d67df
mov edx, eax
call fcn.1003b000
test eax, eax
jne 0x100d67ef
mov ecx, dword [0x101042e4]
xor edx, edx
call fcn.1003b000
push dword [esp + 0x10]
jmp 0x100d67e7
or ebx, 0xffffffff
test edi, edi
jne 0x100d6558
xor eax, eax
lea edi, [esp + 0x38]
stosd dword es:[edi], eax
lea ecx, [esp + 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.10075902
cmp eax, 1
je 0x100d6538
mov eax, ebx
mov ecx, ebx
jmp 0x100d6540
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
lea edi, [esp + 0x38]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ecx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x10], edi
lea edx, [edi + 8]
lea ecx, [esp + 0x48]
call fcn.1004c237
test eax, eax
je 0x100d6638
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, dword [0x101042e0]
mov esi, eax
call fcn.100290c0
mov ecx, dword [0x101042e4]
xor edi, edi
mov dword [esp + 0x14], eax
cmp ecx, ebx
je 0x100d65a4
call fcn.100290c0
test eax, eax
je 0x100d659e
cmp eax, ebx
je 0x100d6618
jmp 0x100d660e
mov ecx, dword [0x101042e4]
mov edx, ebx
call fcn.1003b000
test eax, eax
je 0x100d6618
push 0x364
push 2
call sym.ucrtbase.dll__calloc_base
mov dword [esp + 0x18], eax
pop ecx
pop ecx
mov ecx, dword [0x101042e4]
test eax, eax
jne 0x100d65db
xor edx, edx
call fcn.1003b000
push edi
call sym.ucrtbase.dll__free_base
pop ecx
jmp 0x100d6618
mov edx, eax
call fcn.1003b000
test eax, eax
jne 0x100d65f9
mov ecx, dword [0x101042e4]
xor edx, edx
call fcn.1003b000
push dword [esp + 0x10]
jmp 0x100d65d3
mov ecx, dword [esp + 0x10]
call fcn.1003e545
push 0
call sym.ucrtbase.dll__free_base
mov eax, dword [esp + 0x14]
pop ecx
imul edi, dword [esp + 0x14], 0x364
add edi, eax
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
test edi, edi
jne 0x100d662a
mov edi, 0x101049f4
jmp 0x100d662d
add edi, 0x10
mov dword [edi], 0x16
jmp 0x100d682e
mov eax, dword [esp + 0x5c]
xor edi, edi
add eax, 0x76c
mov word [esp + 0x28], ax
mov eax, dword [esp + 0x58]
inc eax
mov word [esp + 0x2a], ax
mov ax, word [esp + 0x54]
mov word [esp + 0x2e], ax
mov ax, word [esp + 0x50]
mov word [esp + 0x30], ax
mov ax, word [esp + 0x4c]
mov word [esp + 0x32], ax
mov ax, word [esp + 0x48]
mov word [esp + 0x34], ax
xor eax, eax
mov word [esp + 0x36], ax
lea eax, [esp + 0x6c]
push eax
lea eax, [esp + 0x2c]
push eax
push edi
call dword [sym.imp.api_ms_win_core_timezone_l1_1_0.dll_TzSpecificLocalTimeToSystemTime]
test eax, eax
je 0x100d66bf
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.api_ms_win_core_timezone_l1_1_0.dll_SystemTimeToFileTime]
test eax, eax
je 0x100d66bf
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x48]
call fcn.1004c237
test eax, eax
je 0x100d6740
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, dword [0x101042e0]
mov esi, eax
call fcn.100290c0
mov ecx, dword [0x101042e4]
mov dword [esp + 0x14], eax
cmp ecx, ebx
je 0x100d66f3
call fcn.100290c0
test eax, eax
jne 0x100d6598
mov ecx, dword [0x101042e4]
mov edx, ebx
call fcn.1003b000
test eax, eax
je 0x100d6618
push 0x364
push 2
call sym.ucrtbase.dll__calloc_base
mov dword [esp + 0x18], eax
pop ecx
pop ecx
mov ecx, dword [0x101042e4]
test eax, eax
je 0x100d65cb
mov edx, eax
call fcn.1003b000
test eax, eax
je 0x100d65e6
mov ecx, dword [esp + 0x10]
call fcn.1003e545
push edi
jmp 0x100d6604
mov eax, dword [esp + 0x5c]
add eax, 0x76c
mov word [esp + 0x28], ax
mov eax, dword [esp + 0x58]
inc eax
mov word [esp + 0x2a], ax
mov ax, word [esp + 0x54]
mov word [esp + 0x2e], ax
mov ax, word [esp + 0x50]
mov word [esp + 0x30], ax
mov ax, word [esp + 0x4c]
mov word [esp + 0x32], ax
mov ax, word [esp + 0x48]
mov word [esp + 0x34], ax
xor eax, eax
mov word [esp + 0x36], ax
lea eax, [esp + 0x6c]
push eax
lea eax, [esp + 0x2c]
push eax
push edi
call dword [sym.imp.api_ms_win_core_timezone_l1_1_0.dll_TzSpecificLocalTimeToSystemTime]
test eax, eax
je 0x100d66bf
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.api_ms_win_core_timezone_l1_1_0.dll_SystemTimeToFileTime]
test eax, eax
je 0x100d66bf
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
push eax
push edi
push ecx
push esi
call sym.ucrtbase.dll__get_osfhandle
pop ecx
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileTime]
test eax, eax
je 0x100d66bf
xor eax, eax
jmp 0x100d6830
xor edx, edx
call fcn.1003b000
push edi
call sym.ucrtbase.dll__free_base
pop ecx
jmp 0x100d680e
mov ecx, dword [esp + 0x10]
call fcn.1003e545
push 0
call sym.ucrtbase.dll__free_base
mov eax, dword [esp + 0x14]
pop ecx
imul edi, dword [esp + 0x14], 0x364
add edi, eax
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
test edi, edi
jne 0x100d6820
mov edi, 0x101049f4
jmp 0x100d6823
add edi, 0x10
mov dword [edi], 9
call sym.ucrtbase.dll__invalid_parameter_noinfo
mov eax, ebx
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10068820
mov esp, ebp
pop ebp
ret