Function at 0x180029fd8
Capabilities:
Read file on windows
Timestomp file
Write file on windows

Disassembly:
push rbp
sub rsp, 0x820
lea rbp, [rsp + 0x40]
mov qword [rsp], rax
mov rax, 0x81c
mov dword [rsp + rax], 0xcccccccc
sub rax, 4
cmp rax, 4
jg 0x180029ff0
mov rax, qword [rsp]
mov dword [rsp], 0xcccccccc
mov dword [rsp + 4], 0xcccccccc
mov qword [rbp + 0x1b0], rsi
mov qword [rbp + 0x1a8], rbx
mov qword [rbp + 0x7f0], rcx
mov rax, qword [0x1800f4ae8]
xor rax, rbp
mov qword [rbp + 0x7d8], rax
mov byte [rbp + 0x52], 0
mov byte [rbp + 0x51], 0
mov byte [rbp + 0x50], 0
mov dword [rbp + 0x54], 0
mov dword [rbp + 0x58], 0
mov eax, dword [0x1800f67b8]
test eax, eax
jne 0x18002a070
call fcn.180028d10
mov dword [rbp + 0x5c], eax
mov dword [0x1800f67b8], 1
call fcn.180014ec4
mov dword [rbp + 0x60], eax
mov byte [rbp + 0x50], 1
mov eax, dword [rbp + 0x60]
mov dword [rbp + 0x64], eax
movzx eax, byte [rbp + 0x50]
test eax, eax
jne 0x18002a099
lea rax, [0x1801025f4]
mov rcx, rax
call fcn.180064a90
mov eax, dword [rbp + 0x64]
test eax, eax
jne 0x18002a149
call fcn.180010939
mov dword [rbp + 0x68], eax
mov eax, dword [rbp + 0x68]
and eax, 0xffff0000
cmp eax, 0x6000000
jb 0x18002a149
mov eax, 1
mov ecx, eax
call fcn.18002658e
mov dword [rbp + 0x78], eax
mov byte [rbp + 0x50], 1
mov eax, dword [rbp + 0x78]
mov dword [rbp + 0x64], eax
movzx eax, byte [rbp + 0x50]
test eax, eax
jne 0x18002a0ef
lea rax, [0x1801025f4]
mov rcx, rax
call fcn.180064a90
mov eax, dword [rbp + 0x64]
test eax, eax
jne 0x18002a142
mov eax, 0
mov dword [rbp + 0xd8], eax
lea rax, [0x1800c6b40]
mov rdx, rax
mov rcx, rbp
call fcn.180061140
mov rax, qword [rbp + 0x7d8]
xor rax, rbp
mov rcx, rax
call fcn.1800612f0
mov eax, dword [rbp + 0xd8]
mov rbx, qword [rbp + 0x1a8]
mov rsi, qword [rbp + 0x1b0]
lea rsp, [rbp + 0x7e0]
pop rbp
ret
mov dword [rbp + 0x58], 1
mov dword [rbp + 0x6c], 0
mov qword [rbp + 0xe0], 0
mov dword [rbp + 0x70], 0
lea rax, [rbp + 0x5c8]
mov edx, 0x104
mov rcx, qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov qword [rbp + 0x130], rcx
mov rcx, rax
mov rax, qword [rbp + 0x130]
call rax
mov dword [rbp + 0x74], eax
lea rax, [rbp + 0x5c8]
lea rdx, [0x180102548]
mov rcx, rax
call fcn.1800625e0
mov qword [rbp + 0xe8], rax
lea rax, [rbp + 0x5c8]
lea rdx, [0x18010254c]
mov rcx, rax
call fcn.1800625e0
mov qword [rbp + 0xf0], rax
lea rax, [rbp + 0x5c8]
lea rdx, [0x18010255c]
mov rcx, rax
call fcn.1800625e0
mov qword [rbp + 0xf8], rax
lea rax, [rbp + 0x5c8]
lea rdx, [0x180102560]
mov rcx, rax
call fcn.1800625e0
mov qword [rbp + 0x100], rax
lea rax, [rbp + 0x1c0]
mov edx, 0x200
lea rcx, [0x180102578]
lea rbx, [rbp + 0x5c8]
mov qword [rbp + 0x138], rcx
mov rcx, rax
mov rax, qword [rbp + 0x138]
mov r8, rax
mov r9, rbx
call fcn.1800667e0
mov dword [rbp + 0x7c], eax
lea rax, [rbp + 0x1c0]
mov edx, 1
mov rcx, rax
call fcn.1800147d5
mov dword [rbp + 0x80], eax
lea rax, [rbp + 0x1c0]
mov edx, 0x200
lea rcx, [0x1801024a0]
lea rbx, [rbp + 0x5c8]
mov qword [rbp + 0x140], rcx
mov rcx, rax
mov rax, qword [rbp + 0x140]
mov r8, rax
mov r9, rbx
call fcn.1800667e0
mov dword [rbp + 0x84], eax
lea rax, [rbp + 0x1c0]
mov edx, 1
mov rcx, rax
call fcn.1800147d5
mov dword [rbp + 0x88], eax
lea rax, [rbp + 0x5c8]
mov edx, 0x1f01ff
mov ecx, 1
mov ebx, 0
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
mov rsi, qword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [rbp + 0x148], ecx
mov rcx, rax
mov eax, dword [rbp + 0x148]
mov r8d, eax
mov r9, rbx
call rsi
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
cmp rax, 0xffffffffffffffff
je 0x18002a4b4
mov rax, qword [rbp + 0x110]
lea rdx, [rbp + 0x14]
lea rcx, [rbp + 0x24]
lea rbx, [rbp + 0x34]
mov rsi, qword [sym.imp.KERNEL32.dll_GetFileTime]
mov qword [rbp + 0x150], rcx
mov rcx, rax
mov rax, qword [rbp + 0x150]
mov r8, rax
mov r9, rbx
call rsi
mov dword [rbp + 0x8c], eax
mov rax, qword [rbp + 0x110]
mov edx, 0
mov rcx, qword [sym.imp.KERNEL32.dll_GetFileSize]
mov qword [rbp + 0x158], rcx
mov rcx, rax
mov rax, qword [rbp + 0x158]
call rax
mov dword [rbp + 0x90], eax
mov eax, dword [rbp + 0x90]
mov dword [rbp + 0x70], eax
mov eax, dword [rbp + 0x70]
test eax, eax
je 0x18002a516
mov eax, dword [rbp + 0x70]
mov ecx, eax
call fcn.1800106cc
mov qword [rbp + 0x120], rax
mov rax, qword [rbp + 0x120]
mov qword [rbp + 0xe0], rax
mov rax, qword [rbp + 0xe0]
test rax, rax
je 0x18002a45d
mov byte [rbp + 0x51], 1
mov rax, qword [rbp + 0x110]
mov rdx, qword [rbp + 0xe0]
mov ecx, dword [rbp + 0x70]
lea rbx, [rbp + 8]
mov qword [rsp + 0x20], 0
mov rsi, qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rbp + 0x160], ecx
mov rcx, rax
mov eax, dword [rbp + 0x160]
mov r8d, eax
mov r9, rbx
call rsi
mov dword [rbp + 0x9c], eax
mov byte [rbp + 0x50], 1
mov eax, dword [rbp + 0x9c]
mov dword [rbp + 0x64], eax
movzx eax, byte [rbp + 0x50]
test eax, eax
jne 0x18002a42d
lea rax, [0x1801025f4]
mov rcx, rax
call fcn.180064a90
mov eax, dword [rbp + 0x64]
cmp eax, 1
jne 0x18002a45d
movzx eax, byte [rbp + 0x51]
test eax, eax
jne 0x18002a44c
lea rax, [0x1801025f8]
mov rcx, rax
call fcn.180064a90
mov eax, dword [rbp + 8]
mov edx, dword [rbp + 0x70]
cmp eax, edx
jne 0x18002a45d
mov dword [rbp + 0x6c], 1
mov rax, qword [rbp + 0x110]
mov edx, 0
mov ecx, 0
mov ebx, 0
mov rsi, qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rbp + 0x168], rcx
mov rcx, rax
mov rax, qword [rbp + 0x168]
mov r8, rax
mov r9d, ebx
call rsi
mov dword [rbp + 0xa0], eax
mov rax, qword [rbp + 0x110]
mov rdx, qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rcx, rax
call rdx
mov dword [rbp + 0xa8], eax
jmp 0x18002a516
lea rax, [rbp + 0x5c8]
mov edx, 0x1f01ff
mov ecx, 1
mov ebx, 0
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
mov rsi, qword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [rbp + 0x170], ecx
mov rcx, rax
mov eax, dword [rbp + 0x170]
mov r8d, eax
mov r9, rbx
call rsi
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x118]
mov qword [rbp + 0x110], rax
mov byte [rbp + 0x50], 1
mov dword [rbp + 0x64], 0
mov rax, qword [rbp + 0x110]
cmp rax, 0xffffffffffffffff
je 0x18002a59d
mov byte [rbp + 0x51], 1
mov rax, qword [rbp + 0x110]
mov rdx, qword [0x1800ef9a8]
mov ecx, dword [0x1800ef9a4]
lea rbx, [rbp + 8]
mov qword [rsp + 0x20], 0
mov rsi, qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rbp + 0x178], ecx
mov rcx, rax
mov eax, dword [rbp + 0x178]
mov r8d, eax
mov r9, rbx
call rsi
mov dword [rbp + 0x94], eax
mov byte [rbp + 0x50], 1
mov eax, dword [rbp + 0x94]
mov dword [rbp + 0x64], eax
mov rax, qword [rbp + 0x110]
mov rdx, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rax
call rdx
mov dword [rbp + 0x98], eax
movzx eax, byte [rbp + 0x50]
test eax, eax
jne 0x18002a5b4
lea rax, [0x1801025f4]
mov rcx, rax
call fcn.180064a90
mov eax, dword [rbp + 0x64]
cmp eax, 1
jne 0x18002a5e1
lea rax, [rbp + 0x5c8]
lea rdx, [0x180102598]
mov rcx, rax
call fcn.18005cfd9
mov dword [rbp + 0xa4], eax
mov eax, dword [rbp + 0xa4]
mov dword [rbp + 0x54], eax
mov eax, dword [rbp + 0x6c]
test eax, eax
je 0x18002a7be
lea rax, [rbp + 0x5c8]
mov edx, 0x1f01ff
mov ecx, 1
mov ebx, 0
mov dword [rsp + 0x20], 2
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
mov rsi, qword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [rbp + 0x180], ecx
mov rcx, rax
mov eax, dword [rbp + 0x180]
mov r8d, eax
mov r9, rbx
call rsi
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x128]
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
cmp rax, 0xffffffffffffffff
je 0x18002a710
mov byte [rbp + 0x52], 1
mov rax, qword [rbp + 0x110]
mov rdx, qword [rbp + 0xe0]
mov ecx, dword [rbp + 0x70]
lea rbx, [rbp + 0x44]
mov qword [rsp + 0x20], 0
mov rsi, qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rbp + 0x188], ecx
mov rcx, rax
mov eax, dword [rbp + 0x188]
mov r8d, eax
mov r9, rbx
call rsi
mov dword [rbp + 0xb0], eax
mov rax, qword [rbp + 0x110]
mov rdx, qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rcx, rax
call rdx
mov dword [rbp + 0xbc], eax
mov rax, qword [rbp + 0x110]
lea rdx, [rbp + 0x14]
lea rcx, [rbp + 0x24]
lea rbx, [rbp + 0x34]
mov rsi, qword [sym.imp.KERNEL32.dll_SetFileTime]
mov qword [rbp + 0x190], rcx
mov rcx, rax
mov rax, qword [rbp + 0x190]
mov r8, rax
mov r9, rbx
call rsi
mov dword [rbp + 0xc4], eax
mov rax, qword [rbp + 0x110]
mov rdx, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rax
call rdx
mov dword [rbp + 0xd0], eax
lea rax, [rbp + 0x1c0]
mov edx, 0x200
lea rcx, [0x1801024e0]
lea rbx, [rbp + 0x5c8]
mov qword [rbp + 0x198], rcx
mov rcx, rax
mov rax, qword [rbp + 0x198]
mov r8, rax
mov r9, rbx
call fcn.1800667e0
mov dword [rbp + 0xb4], eax
lea rax, [rbp + 0x1c0]
mov edx, 1
mov rcx, rax
call fcn.1800147d5
mov dword [rbp + 0xc0], eax
lea rax, [rbp + 0x1c0]
mov edx, 0x200
lea rcx, [0x1801025b4]
lea rbx, [rbp + 0x5c8]
mov qword [rbp + 0x1a0], rcx
mov rcx, rax
mov rax, qword [rbp + 0x1a0]
mov r8, rax
mov r9, rbx
call fcn.1800667e0
mov dword [rbp + 0xc8], eax
lea rax, [rbp + 0x1c0]
mov edx, 1
mov rcx, rax
call fcn.1800147d5
mov dword [rbp + 0xd4], eax
jmp 0x18002a7d3
lea rax, [rbp + 0x5c8]
mov rcx, rax
call fcn.180016167
mov dword [rbp + 0xac], eax
mov eax, dword [rbp + 0x58]
test eax, eax
je 0x18002a816
call fcn.180010939
mov dword [rbp + 0xb8], eax
mov eax, dword [rbp + 0xb8]
and eax, 0xffff0000
cmp eax, 0x6000000
jb 0x18002a816
mov eax, 0
mov ecx, eax
call fcn.18002658e
mov dword [rbp + 0xcc], eax
mov byte [rbp + 0x50], 1
mov eax, dword [rbp + 0xcc]
mov dword [rbp + 0x64], eax
mov eax, dword [rbp + 0x54]
mov dword [rbp + 0xdc], eax
lea rax, [0x1800c6b40]
mov rdx, rax
mov rcx, rbp
call fcn.180061140
mov rax, qword [rbp + 0x7d8]
xor rax, rbp
mov rcx, rax
call fcn.1800612f0
mov eax, dword [rbp + 0xdc]
mov rbx, qword [rbp + 0x1a8]
mov rsi, qword [rbp + 0x1b0]
lea rsp, [rbp + 0x7e0]
pop rbp
ret