Function at 0x140008070
Capabilities:
Timestomp file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x1d0
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x140094840]
xor rax, rsp
mov qword [rbp + 0x160], rax
movabs rdi, 0xc1554a71ebe84608
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rbx, 0x7c21ffdc35cdf49f
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x63ed182b3a7c0b0d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rsi, 0xb538fa5b35635182
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs r14, 0xae312418bcb47c4b
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
movabs r15, 0x104991b5429187e8
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
movabs r12, 0x6388604e144e387d
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x140]
vmovdqa ymmword [rbp + 0x20], ymm1
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0xd0]
vzeroupper
call fcn.14000a710
nop
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x63ed182b3a7a0e0d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
vmovdqa ymmword [rbp + 0x20], ymm1
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x140]
vzeroupper
call fcn.14000a710
nop
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x753de2cc31cdf49f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x11ed051e487c0b10
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0xd9549e75411038c6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rcx, 0x7d2b684c23d8ed9f
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rdx, 0xba93f4699e8bcb2c
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
vmovdqa ymmword [rbp + 0x20], ymm1
vmovdqa xmm0, xmmword [rbp + 0x40]
vxorps xmm0, xmm0, xmmword [rbp + 0x120]
vmovdqa xmmword [rbp + 0x40], xmm0
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0xb0]
vzeroupper
call fcn.14000a710
nop
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x63e40c2a3a7a0e0d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
vmovdqa ymmword [rbp + 0x20], ymm1
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x90]
vzeroupper
call fcn.14000a710
nop
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0xd0]
call fcn.140007d00
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0xb0]
call fcn.140007d00
lea rcx, [rbp]
call fcn.1400053d0
mov rax, qword [rbp]
movabs rcx, 0x7fffffff4d2fa1fe
cmp rax, rcx
jg 0x140008411
mov ebx, 0xb2d05e00
add rbx, rax
jmp 0x14000841b
movabs rbx, 0x7fffffffffffffff
mov esi, 0xff
movabs rdi, 0x4e94914f0000
movabs r14, 0x431bde82d7b634db
lea rcx, [rbp]
call fcn.1400053d0
mov rax, qword [rbp]
cmp rbx, rax
je 0x140008495
mov ecx, 1
cmovl ecx, esi
test cl, cl
jle 0x140008495
mov rcx, rbx
sub rcx, rax
cmp rcx, rdi
jge 0x140008489
mov rax, r14
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140008480
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x140008434
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x140008434
movabs r14, 0xae662444bc8e7c08
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs r15, 0x102691d142ff8781
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs r12, 0x63ff6012143d380a
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs r13, 0xb554fa33350d51eb
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x7d05687823eeedef
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0xba93f40c9ef3cb49
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0xae312418bcb47c4b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0x104991b5429187e8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movabs rax, 0x6388604e144e387d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
movabs rax, 0xb538fa5b35635182
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
movabs rax, 0x7d2b684c23d8ed9f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
movabs rax, 0xba93f4699e8bcb2c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
vmovdqa ymmword [rbp + 0x20], ymm1
vmovdqa xmm0, xmmword [rbp + 0x40]
vxorps xmm0, xmm0, xmmword [rbp + 0x120]
vmovdqa xmmword [rbp + 0x40], xmm0
mov dword [rbp + 0x60], 0xc07e3
mov esi, 7
mov dword [rbp + 0x66], 0xb0007
mov dword [rbp + 0x6a], 0x30
xor edi, edi
mov word [rbp + 0x6e], di
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x60]
vzeroupper
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x14000865c
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, esi
mov edx, 0x100
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000865c
lea r9, [rbp + 0x80]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x7d05687823eeedef
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0xba93f4059ee7cb48
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0xae312418bcb47c4b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0x104991b5429187e8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movabs rax, 0x6388604e144e387d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
movabs rax, 0xb538fa5b35635182
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
movabs rax, 0x7d2b684c23d8ed9f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
movabs rax, 0xba93f4699e8bcb2c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
vmovdqa ymmword [rbp + 0x20], ymm1
vmovdqa xmm0, xmmword [rbp + 0x40]
vxorps xmm0, xmm0, xmmword [rbp + 0x120]
vmovdqa xmmword [rbp + 0x40], xmm0
mov dword [rbp + 0x70], 0xc07e3
mov dword [rbp + 0x76], 0xb0007
mov dword [rbp + 0x7a], 0x30
mov word [rbp + 0x7e], di
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x70]
vzeroupper
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x1400087f5
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, esi
mov edx, 0x100
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400087f5
lea r9, [rbp + 0x88]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0xf
jbe 0x140008839
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008834
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008834
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140071e70
movdqa xmm0, xmmword [0x140088f60]
movdqu xmmword [rbp + 0xa0], xmm0
mov byte [rbp + 0x90], 0
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x14000889c
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000888f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000888f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140071e70
movdqa xmm0, xmmword [0x140088f60]
movdqu xmmword [rbp + 0xc0], xmm0
mov byte [rbp + 0xb0], 0
mov rdx, qword [rbp + 0x158]
cmp rdx, 0xf
jbe 0x1400088f7
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400088ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400088ea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140071e70
movdqa xmm0, xmmword [0x140088f60]
movdqu xmmword [rbp + 0x150], xmm0
mov byte [rbp + 0x140], 0
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0xf
jbe 0x14000894a
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008945
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008945
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140071e70
xor eax, eax
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.140071e50
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret