Function at 0x402894
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fa4
call fcn.0040f2e0
push ebx
push esi
xor ebx, ebx
push edi
lea esi, [ebp - 0xda0]
mov dword [ebp - 0x3c], ebx
call fcn.00405329
push 0x24c
lea eax, [ebp - 0x2c4]
push ebx
push eax
mov dword [ebp - 0x2c8], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x2c8]
push eax
push dword [ebp + 8]
call fcn.00406dd3
xor eax, eax
mov ecx, 0x94
lea esi, [ebp - 0x2c8]
lea edi, [ebp - 0x518]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x10], ebx
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
mov eax, dword [esi + 0x870]
push ebx
mov dword [ebp - 0x34], eax
mov dword [ebp - 8], ebx
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x38], ebx
mov ebx, dword [ebp + 0x10]
lea edi, [ebp - 4]
stosd dword es:[edi], eax
push ebx
lea eax, [ebp - 0x2c4]
push eax
push esi
push esi
call fcn.004024d2
add esp, 0x1c
test eax, eax
je 0x40293e
lea eax, [ebp - 0x2c4]
mov dword [ebp - 0x18], eax
push 0
push ebx
lea eax, [ebp - 0x2b4]
push eax
lea eax, [esi + 0x21c]
push eax
push esi
call fcn.004024d2
add esp, 0x14
test eax, eax
je 0x402965
lea eax, [ebp - 0x2b4]
mov dword [ebp - 0x1c], eax
push 0
push ebx
lea eax, [ebp - 0x2bc]
push eax
lea eax, [esi + 0x438]
push eax
push esi
call fcn.004024d2
add esp, 0x14
test eax, eax
je 0x40298c
lea eax, [ebp - 0x2bc]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x870]
test eax, eax
je 0x402ae0
add eax, 0xfffffffc
cmp eax, 5
ja 0x402a42
lea edx, [ebp - 0x74]
call fcn.00402f63
and word [ebp - 0x30], 0
xor eax, eax
lea edi, [ebp - 0x2e]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi + 0x870]
call fcn.0040284d
lea ecx, [ebp - 0x30]
push ecx
push dword [ebp + 8]
mov edi, eax
call fcn.0040dcdc
test eax, eax
jne 0x402a2d
cmp dword [esi + 0x860], eax
jne 0x4029ea
cmp dword [esi + 0x85c], eax
je 0x402a00
cmp word [ebp - 0x30], ax
jne 0x402a00
lea eax, [ebp - 0x28]
push eax
mov word [ebp - 0x30], 0x40
call dword [sym.imp.KERNEL32.DLL_GetSystemTimeAsFileTime]
cmp word [ebp - 0x30], 0x40
jne 0x402a2d
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24]
push 0
mov dword [ebp - 0xc], eax
push ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x654]
push eax
push esi
call fcn.004024d2
add esp, 0x14
mov dword [ebp - 0x38], eax
lea esi, [ebp - 0x60]
call fcn.004070a9
lea esi, [ebp - 0x70]
call fcn.004078ec
jmp 0x402add
lea edi, [ebp - 0x16a0]
call fcn.00402f8d
lea eax, [ebp - 0xda0]
push eax
push dword [ebp + 8]
mov ebx, edi
call fcn.00405b88
test eax, eax
je 0x402ac7
mov eax, dword [esi + 0x870]
cmp eax, 1
jne 0x402a7e
mov eax, dword [ebp - 0xd98]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xd94]
jmp 0x402aa8
cmp eax, 2
jne 0x402a94
mov eax, dword [ebp - 0xd90]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xd8c]
jmp 0x402aa8
cmp eax, 3
jne 0x402aab
mov eax, dword [ebp - 0xda0]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xd9c]
mov dword [ebp - 0xc], eax
push 1
push dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x654]
push eax
push esi
call fcn.004024d2
add esp, 0x14
mov dword [ebp - 0x38], eax
lea esi, [ebp - 0x1690]
call fcn.004078b3
lea esi, [ebp - 0x169c]
call fcn.004078b3
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x88c], 0
je 0x402d58
mov eax, dword [esi + 0x890]
cmp eax, 1
jne 0x402b09
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2b0]
jmp 0x402b33
cmp eax, 2
jne 0x402b1f
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c0]
jmp 0x402b33
cmp eax, 3
jne 0x402b3b
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 4], eax
jmp 0x402cac
cmp eax, 7
jb 0x402bed
cmp eax, 0xb
ja 0x402bed
lea edx, [ebp - 0x74]
call fcn.00402f63
and word [ebp - 0x30], 0
mov esi, dword [esi + 0x890]
xor eax, eax
cmp esi, 7
lea edi, [ebp - 0x2e]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, 0x410484
jne 0x402b7b
mov edi, str.System.ItemDate
jmp 0x402bb5
cmp esi, 8
jne 0x402b87
mov edi, str.System.Media.DateEncoded
jmp 0x402bb5
cmp esi, 9
jne 0x402b93
mov edi, str.System.DateAcquired
jmp 0x402bb5
cmp esi, 0xa
jne 0x402b9f
mov edi, str.System.Document.DateCreated
jmp 0x402bb5
cmp esi, 0xb
jne 0x402bab
mov edi, str.System.Document.DateSaved
jmp 0x402bb5
cmp esi, 0xc
jne 0x402bb5
mov edi, str.System.Photo.DateTaken
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 8]
call fcn.0040dcdc
test eax, eax
jne 0x402bd8
cmp word [ebp - 0x30], 0x40
jne 0x402bd8
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
lea esi, [ebp - 0x60]
call fcn.004070a9
lea esi, [ebp - 0x70]
call fcn.004078ec
jmp 0x402ca9
cmp eax, 4
jb 0x402cac
cmp eax, 6
ja 0x402cac
lea edi, [ebp - 0x1fa0]
call fcn.00402f8d
lea esi, [ebp - 0x1628]
call fcn.00405329
mov eax, esi
push eax
push dword [ebp + 8]
mov ebx, edi
call fcn.00405b88
test eax, eax
je 0x402c93
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x890]
cmp eax, 4
jne 0x402c45
mov eax, dword [ebp - 0x1620]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x161c]
jmp 0x402c6f
cmp eax, 5
jne 0x402c5b
mov eax, dword [ebp - 0x1618]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1614]
jmp 0x402c6f
cmp eax, 6
jne 0x402c72
mov eax, dword [ebp - 0x1628]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1624]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x402c93
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00406e9f
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x24]
pop ecx
pop ecx
mov dword [ebp - 4], eax
lea esi, [ebp - 0x1f90]
call fcn.004078b3
lea esi, [ebp - 0x1f9c]
call fcn.004078b3
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
xor edx, edx
cmp ecx, edx
je 0x402d58
cmp dword [esi + 0x89c], edx
je 0x402cc7
lea eax, [ebp - 8]
mov dword [ebp - 0x14], eax
cmp dword [esi + 0x898], edx
je 0x402cd5
lea eax, [ebp - 8]
mov dword [ebp - 0x1c], eax
cmp dword [esi + 0x894], edx
je 0x402ce3
lea eax, [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x8a4]
cmp eax, edx
je 0x402d58
lea edi, [eax - 4]
cmp edi, 5
ja 0x402d03
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
jmp 0x402d63
lea edi, [ebp - 0x1fa0]
call fcn.00402f8d
lea eax, [ebp - 0xda0]
push eax
push dword [ebp + 8]
mov ebx, edi
call fcn.00405b88
test eax, eax
je 0x402d42
mov eax, dword [esi + 0x8a4]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x38], 1
call fcn.00406e40
pop ecx
pop ecx
lea esi, [ebp - 0x1f90]
call fcn.004078b3
lea esi, [ebp - 0x1f9c]
call fcn.004078b3
xor edx, edx
cmp dword [ebp - 0x38], edx
je 0x402e4d
mov eax, dword [ebp - 0x34]
lea ecx, [eax - 4]
cmp ecx, 5
ja 0x402ddb
lea edx, [ebp - 0x74]
call fcn.00402f63
xor eax, eax
lea edi, [ebp - 0x2e]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp - 0x34]
call fcn.0040284d
cmp dword [0x4142d0], 0
mov edi, eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xc]
mov word [ebp - 0x30], 0x40
mov dword [ebp - 0x24], eax
je 0x402db9
push dword [ebp + 8]
mov ecx, 0x4142d0
push str.Changing_the_media_date_time_of__s
call fcn.0040a89c
pop ecx
pop ecx
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x74]
push eax
call fcn.0040de0b
lea esi, [ebp - 0x60]
call fcn.004070a9
lea esi, [ebp - 0x70]
call fcn.004078ec
jmp 0x402e4d
cmp eax, 1
jne 0x402de8
lea esi, [ebp - 0x564]
jmp 0x402e00
cmp eax, 2
jne 0x402df5
lea esi, [ebp - 0x540]
jmp 0x402e00
cmp eax, 3
jne 0x402e4d
lea esi, [ebp - 0x588]
cmp dword [0x4142d0], edx
je 0x402e1c
push dword [ebp + 8]
mov ecx, 0x4142d0
push str.Changing_the_EXIF_date_time_of__s
call fcn.0040a89c
pop ecx
pop ecx
lea edi, [ebp - 0x1fa0]
call fcn.00402f8d
lea eax, [ebp - 0x10]
push eax
push dword [esi + 0x20]
push esi
push dword [ebp + 8]
call fcn.004053dc
lea esi, [ebp - 0x1f90]
call fcn.004078b3
lea esi, [ebp - 0x1f9c]
call fcn.004078b3
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x402e62
cmp dword [ebp - 0x1c], eax
jne 0x402e62
cmp dword [ebp - 0x14], eax
je 0x402f5b
cmp dword [0x4142d0], 0
je 0x402e7f
push dword [ebp + 8]
mov ecx, 0x4142d0
push str.Changing_the_date_time_of__s
call fcn.0040a89c
pop ecx
pop ecx
test byte [ebp - 0x2c8], 0x10
je 0x402e95
push 0
push 0x2000000
push 3
push 0
jmp 0x402e9c
xor eax, eax
push eax
push eax
push 3
push eax
push 3
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x402f40
cmp dword [0x4142d0], 0
je 0x402f05
push 0x410cc8
push dword [ebp - 0x18]
lea eax, [ebp - 0x514]
push eax
call fcn.004027e9
add esp, 0xc
push 0x410cd8
push dword [ebp - 0x1c]
lea eax, [ebp - 0x504]
push eax
call fcn.004027e9
add esp, 0xc
push 0x410cec
push dword [ebp - 0x14]
lea eax, [ebp - 0x50c]
push eax
call fcn.004027e9
add esp, 0xc
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push ebx
call dword [sym.imp.KERNEL32.DLL_SetFileTime]
test eax, eax
mov dword [ebp - 0x3c], eax
jne 0x402f37
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, 0x4142d0
mov edi, eax
call fcn.0040a8f8
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x402f37
mov dword [eax], edi
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x402f5b
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, 0x4142d0
mov edi, eax
call fcn.0040a8f8
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x402f5b
mov dword [eax], edi
mov eax, dword [ebp - 0x3c]
pop edi
pop esi
pop ebx
leave
ret