Function at 0x1400233f8
Capabilities:
Timestomp file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xf0
mov rax, qword [0x14002e008]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov r15, qword [rbp + 0x7f]
xor r12d, r12d
mov r14, rdx
mov rcx, r8
lea r9, [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov r8d, Ordinal_134
mov qword [r15], r12
mov byte [rsp + 0x50], r12b
mov qword [rsp + 0x38], r12
call fcn.140026604
mov ebx, eax
test eax, eax
js 0x14002362f
mov ecx, 0x460
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov rdi, rax
test rax, rax
je 0x1400234cd
or qword [rax + 0x420], 0xffffffffffffffff
mov qword [rax + 0x410], r12
mov qword [rax + 0x418], r12
mov qword [rax + 0x428], r12
mov qword [rax + 0x430], r12
mov qword [rax + 0x450], r12
mov dword [rax + 0x458], 1
mov byte [rax + 0x45d], r12b
lea rcx, [rax + 0x438]
lea r8d, [r12 + 0x18]
xor edx, edx
mov word [rax], r12w
mov word [rax + 0x208], r12w
call sub.msvcrt.dll_memset
jmp 0x1400234d0
mov rdi, r12
test rdi, rdi
jne 0x1400234e9
mov ebx, 0x8007000e
mov dword [0x14002ecc8], 0x1a7
jmp 0x14002362f
lea rsi, [rdi + 0x410]
mov rdx, rsi
call fcn.140023a4c
mov ebx, eax
test eax, eax
js 0x14002362f
mov rcx, qword [rsi]
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14002351f
mov ecx, eax
call fcn.140023c18
mov ebx, eax
jmp 0x140023522
mov ebx, r12d
test ebx, ebx
js 0x14002361e
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
mov byte [rsp + 0x30], 1
call fcn.1400238e4
mov ebx, eax
test eax, eax
js 0x140023659
cmp byte [rsp + 0x30], r12b
jne 0x14002359c
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
jne 0x140023579
call fcn.140025e64
jmp 0x14002357c
mov eax, r12d
test eax, eax
js 0x14002359c
mov rcx, qword [rdi + 0x420]
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, qword [rdi + 0x418]
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400235bd
mov ecx, eax
call fcn.140023c18
mov ebx, eax
jmp 0x1400235c0
mov ebx, r12d
test ebx, ebx
js 0x140023659
mov rcx, qword [rsi]
call fcn.140023c8c
mov ebx, eax
test eax, eax
js 0x1400235e5
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.1400242f8
mov ebx, eax
mov rcx, qword [rdi + 0x418]
call fcn.140023c8c
test eax, eax
jns 0x14002368a
test ebx, ebx
js 0x14002361e
mov ebx, 0x80070570
cmp eax, ebx
je 0x140023614
mov ebx, eax
mov dword [0x14002ecc8], 0x1d6
jmp 0x14002368a
mov dword [0x14002eccc], 0x1d6
mov rcx, rdi
call fcn.1400231fc
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov eax, ebx
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.14002ad70
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov rcx, qword [rsi]
call fcn.140023c8c
test eax, eax
jns 0x14002368a
test ebx, ebx
js 0x14002361e
mov ebx, 0x80070570
cmp eax, ebx
je 0x140023680
mov ebx, eax
mov dword [0x14002ecc8], 0x1dc
jmp 0x14002368a
mov dword [0x14002eccc], 0x1dc
test ebx, ebx
js 0x14002361e
mov qword [r15], rdi
mov ebx, r12d
jmp 0x14002362f