Function at 0x180042ff0
Capabilities:
Timestomp file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [0x1800c37a8]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov esi, r8d
mov dword [rsp + 0x54], r8d
mov r8, rdx
mov qword [rsp + 0x48], rdx
mov r15, rcx
mov qword [rsp + 0x70], rcx
xor r9d, r9d
mov qword [rbp - 0x70], r9
mov r13d, 7
mov qword [rbp - 0x68], r13
mov word [rbp - 0x80], r9w
mov qword [rbp], r9
mov edx, r13d
mov qword [rbp + 8], rdx
mov word [rbp - 0x10], r9w
lea eax, [rsi + 0x41d]
mov dword [rsp + 0x60], eax
cmp esi, eax
jae 0x1800436c9
lea r12d, [r9 + 1]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x40]
mov edx, 0x7b2
mov ecx, 4
cmp esi, 0xd3
ja 0x1800432d1
je 0x1800432ac
mov eax, esi
sub eax, 0x3b
je 0x18004320f
sub eax, 0x23
je 0x18004315e
sub eax, 0xd
je 0x1800430c1
cmp eax, 0x45
je 0x1800437d8
jmp 0x1800436b4
mov esi, 0x104
nop word [rax + rax]
mov edi, 0x8d
mov eax, edi
sub eax, 0x8d
je 0x180043111
cmp eax, 1
jne 0x180043145
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
mov r8d, dword [rbp - 0x70]
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x180043154
add esi, 0x104
jmp 0x180043142
mov edx, esi
cmp rdx, qword [rbp - 0x70]
ja 0x180043132
mov qword [rbp - 0x70], rdx
lea rax, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rax, qword [rbp - 0x80]
mov word [rax + rdx*2], r9w
jmp 0x180043145
xor r8d, r8d
sub rdx, qword [rbp - 0x70]
lea rcx, [rbp - 0x80]
call fcn.18001d670
xor r9d, r9d
inc edi
cmp edi, 0x8f
jb 0x1800430d5
jmp 0x1800430d0
mov esi, 0x6b
jmp 0x1800436ac
cmp qword [0x1800c3cc0], 0
jne 0x1800436b4
mov edi, ILFindLastID
cmp edi, 0x97f
ja 0x1800431b4
je 0x1800431ab
cmp edi, 0xd
je 0x1800431a2
cmp edi, 0x333
je 0x180043199
cmp edi, 0x659
jne 0x1800431f8
mov dword [rbp - 0x38], 0
jmp 0x1800431f8
mov dword [rbp - 0x3c], 0x10004
jmp 0x1800431f8
mov dword [rbp - 0x40], 0x107b2
jmp 0x1800431f8
mov dword [rbp - 0x34], 0
jmp 0x1800431f8
cmp edi, 0xca5
je 0x1800431dc
cmp edi, 0xfcb
jne 0x1800431f8
mov ecx, dword [rsp + 0x5c]
shl rcx, 0x20
mov eax, dword [rsp + 0x58]
add rcx, rax
mov qword [0x1800c3cc0], rcx
jmp 0x1800431f3
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
xor r9d, r9d
mov edx, 0x7b2
mov ecx, 4
add edi, 0x326
cmp edi, 0x12e4
jbe 0x180043171
jmp 0x1800436af
mov qword [rsp + 0x68], r9
xor r8d, r8d
lea rdx, [rsp + 0x68]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoul]
mov ebx, eax
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1800436ac
mov r8d, 0x68
mov esi, dword [rsp + 0x50]
nop
cmp r8d, 0x68
je 0x18004325c
cmp r8d, 0x10f
jne 0x18004328f
movsxd rax, esi
imul rbx, rax
shr rbx, 3
jmp 0x18004328f
movzx edx, byte [rcx]
lea eax, [rdx - 0x4b]
test al, 0xdf
je 0x18004327a
sub dl, 0x4d
test dl, 0xdf
je 0x180043273
mov esi, r12d
jmp 0x180043287
mov esi, 0x100000
jmp 0x18004327f
mov esi, 0x400
inc rcx
mov qword [rsp + 0x68], rcx
cmp byte [rcx], 0x42
jne 0x18004328f
shl esi, 3
add r8d, 0xa7
cmp r8d, 0x1b6
jb 0x180043240
mov dword [rsp + 0x50], esi
mov esi, dword [rsp + 0x54]
jmp 0x1800436ac
mov eax, dword [r8]
imul rcx, rax, 0x989680
add rcx, qword [0x1800c3cc0]
mov rax, rcx
shr rax, 0x20
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x58], ecx
jmp 0x1800436b4
mov eax, esi
sub eax, 0xe0
je 0x1800435b1
sub eax, 0x68
je 0x180043722
sub eax, 0xd
je 0x1800434b2
cmp eax, 0x75
jne 0x1800436b4
mov rcx, qword [rsp + 0x40]
inc rcx
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x18], r13
mov word [rbp - 0x30], r9w
mov rax, qword [rbp - 0x70]
cmp rax, rcx
jb 0x1800438a8
sub rax, rcx
mov r8, qword [rsp + 0x78]
cmp rax, r8
cmovb r8, rax
lea rax, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rax, qword [rbp - 0x80]
lea rdx, [rax + rcx*2]
lea rcx, [rbp - 0x30]
call fcn.18001d950
nop
lea rdi, [rbp - 0x30]
mov rsi, qword [rbp - 0x30]
mov r15, qword [rbp - 0x18]
cmp r15, 8
cmovae rdi, rsi
mov r12, qword [rbp - 0x20]
cmp r12, 8
jae 0x18004336d
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x60], xmm0
jmp 0x1800433ad
mov r13, r12
or r13, 7
movabs rax, 0x7ffffffffffffffe
cmp r13, rax
cmova r13, rax
lea rdx, [r13 + 1]
lea rcx, [rbp - 0x60]
call fcn.18001d3f0
mov qword [rbp - 0x60], rax
lea r8, [r12*2 + 2]
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [rbp - 0x60]
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x50], r12
mov r14, r12
mov rax, qword [rbp + 8]
cmp rax, 8
jb 0x1800433fc
lea rdx, [rax*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800433f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180043714
call fcn.1800a1078
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rbp - 0x10], xmm0
movups xmm0, xmmword [rbp - 0x50]
movups xmmword [rbp], xmm0
cmp r15, 8
jb 0x180043447
lea rdx, [r15*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x18004343f
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004371b
mov rcx, rsi
call fcn.1800a1078
mov r15, qword [rsp + 0x70]
xor r8d, r8d
mov rdx, r14
lea rcx, [r15 + 0x28]
call fcn.180061db0
xor r9d, r9d
mov ecx, r9d
test r14, r14
je 0x18004349a
mov r8, qword [rbp - 0x60]
nop word [rax + rax]
lea rax, [rbp - 0x10]
cmp r13, 8
cmovae rax, r8
lea rdx, [r15 + 0x28]
cmp qword [r15 + 0x40], 0x10
jb 0x18004348b
mov rdx, qword [r15 + 0x28]
movzx eax, byte [rax + rcx*2]
mov byte [rdx + rcx], al
inc rcx
cmp rcx, r12
jb 0x180043470
mov r14, qword [rsp + 0x40]
mov esi, dword [rsp + 0x54]
mov r13d, 7
lea r12d, [r13 - 6]
jmp 0x1800436af
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
mov rax, qword [rbp - 0x70]
test rax, rax
je 0x18004350e
lea rcx, [rax - 1]
mov rax, 0xffffffffffffffff
cmp rcx, rax
cmovb rax, rcx
lea rcx, [rdx + rax*2]
cmp word [rcx], 0x2e
je 0x1800434f4
cmp rcx, rdx
je 0x18004350e
sub rcx, 2
cmp word [rcx], 0x2e
jne 0x1800434e5
sub rcx, rdx
sar rcx, 1
cmp rcx, 0xffffffffffffffff
je 0x18004350e
mov rax, rcx
sub rax, r14
dec rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x50], r9
mov qword [rbp - 0x48], r13
mov word [rbp - 0x60], r9w
lea r8, [r14 + 1]
cmp qword [rbp - 0x70], r8
cmovb r8, qword [rbp - 0x70]
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
lea rcx, [rbp - 0x60]
call fcn.18001d950
lea rdi, [r15 + 8]
lea rax, [rbp - 0x60]
cmp rdi, rax
je 0x180043568
mov rcx, rdi
call fcn.18001c9c0
movups xmm0, xmmword [rbp - 0x60]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbp - 0x50]
movups xmmword [rdi + 0x10], xmm1
jmp 0x1800436ac
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x1800436ac
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800435a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004371b
call fcn.1800a1078
jmp 0x1800436ac
lea rdi, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdi, qword [rbp - 0x80]
cmp qword [rbp - 0x70], 0
je 0x18004368a
mov r14d, 0x100
mov r8d, r14d
xor edx, edx
lea rcx, [rbp + 0x10]
call sub.VCRUNTIME140.dll_memset
lea rcx, [0x1800ad14c]
movzx eax, word [rcx]
cmp ax, r14w
jae 0x180043644
movzx eax, al
mov byte [rbp + rax + 0x10], 1
add rcx, 2
lea rax, [0x1800ad150]
cmp rcx, rax
jne 0x1800435e5
mov rcx, qword [rbp - 0x70]
dec rcx
mov rax, 0xffffffffffffffff
cmp rcx, rax
cmovb rax, rcx
lea r8, [rdi + rax*2]
nop
movzx eax, word [r8]
cmp ax, r14w
jae 0x180043631
cmp byte [rbp + rax + 0x10], 0
jne 0x18004363c
cmp r8, rdi
je 0x18004368a
sub r8, 2
jmp 0x180043620
sub r8, rdi
sar r8, 1
jmp 0x180043691
mov rcx, qword [rbp - 0x70]
dec rcx
mov rax, 0xffffffffffffffff
cmp rcx, rax
cmovb rax, rcx
lea r8, [rdi + rax*2]
nop dword [rax]
mov ecx, 2
lea rax, [0x1800ad14c]
movzx edx, word [r8]
cmp word [rax], dx
je 0x18004363c
add rax, 2
sub rcx, 1
jne 0x180043670
cmp r8, rdi
je 0x18004368a
sub r8, 2
jmp 0x180043660
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x40], r8
cmp r8, 0xffffffffffffffff
je 0x1800437d3
mov qword [rsp + 0x78], 0xffffffffffffffff
mov r14, r8
xor r9d, r9d
mov r8, qword [rsp + 0x48]
add esi, 0x75
mov dword [rsp + 0x54], esi
cmp esi, dword [rsp + 0x60]
jb 0x18004307e
mov rdx, qword [rbp + 8]
mov rbx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x180043838
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180043832
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180043832
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea r12, [0x180000000]
mov ebx, dword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x70]
nop word [rax + rax]
cmp r13d, 0xa
ja case.0x180043758.3
mov eax, r13d
mov ecx, dword [r12 + rax*4 + 0x438b0]
add rcx, r12
jmp rcx
test r15, r15
je case.0x180043758.10
jmp case.0x180043758.3
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x58]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov edi, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov ebx, r9d
test edi, edi
setne bl
jmp case.0x180043758.3
mov qword [rsp + 0x30], r9
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x100
lea r8d, [r9 + 3]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
jmp 0x180043819
cmp rsi, 0xffffffffffffffff
jne case.0x180043758.3
mov ebx, r9d
mov dword [rsp + 0x40], ebx
mov rbx, qword [rsp + 0x40]
mov rdx, qword [rbp + 8]
jmp 0x1800436ce
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180043819
mov r14, r15
xor r9d, r9d
xor r8d, r8d
mov edx, 0xaa
mov rcx, r15
call fcn.1800280f0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r15], xmm0
movups xmmword [r15 + 0x10], xmm0
movups xmmword [r15 + 0x20], xmm0
mov qword [r15 + 0x30], rax
xor r9d, r9d
inc r13d
lea eax, [r13 + 0xec]
cmp eax, 0xfa
jae case.0x180043758.10
jmp 0x180043740
call fcn.1800a1078
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x18004387b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180043876
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180043876
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800a1078
mov rax, rbx
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.1800a1820
mov rbx, qword [rsp + 0x270]
add rsp, 0x220
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.18001ca70
nop
nop
pop rdx
invalid