Function at 0x180082cf0
Capabilities:
Timestomp file

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180135928]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov r14, qword [rsp + 0x68]
lea edi, [r9 + 0x8ea]
mov r15d, dword [rsp + 0x50]
mov ebx, r9d
mov r10d, r9d
mov dword [rsp + 0x30], r9d
mov rsi, r8
mov qword [rsp + 0x38], rdx
mov r8, rdx
mov qword [rsp + 0x70], rcx
mov rdx, qword [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x58], rdx
cmp ebx, edi
jae 0x18008302a
mov rcx, qword [rsp + 0x68]
lea r12, [0x180000000]
mov qword [rsp + 0x48], rcx
mov r13d, 0x6547
cmp ebx, 0x137
ja 0x180082e7e
je 0x180082e57
lea eax, [rbx - 0x18]
cmp eax, 0xf4
ja case.default.0x180082da6
movzx eax, byte [r12 + rax + 0x8360c]
mov ecx, dword [r12 + rax*4 + 0x835f0]
add rcx, r12
jmp rcx
mov edx, 0x75
mov dword [rsp + 0x50], 4
lea rcx, [rsp + 0x50]
mov rsi, r9
call fcn.1800d2280
jmp 0x180082f7b
mov r9, r8
mov dword [rsp + 0x50], 0xb8
xor r8d, r8d
lea rcx, [rsp + 0x50]
mov edx, 0xd5
call fcn.1800c77c0
mov r8, qword [rsp + 0x38]
mov rax, qword [rsi + 8]
mov qword [r8 + 8], rax
jmp 0x180082f80
mov rax, qword [rsi + 0x20]
mov qword [r8 + 0x20], rax
mov rax, qword [rsi + 0x28]
mov qword [r8 + 0x28], rax
jmp case.0x180082da6.30
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xd8
call fcn.180104b00
mov r8, qword [rsp + 0x38]
mov rdx, rax
mov qword [rsp + 0x58], rax
jmp 0x180082f85
mov r15d, r9d
jmp case.0x180082da6.30
mov r8d, 2
mov byte [rbp - 0x30], 0
lea rdx, [0x18010ee26]
lea rcx, [rbp - 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x180082f7b
mov rdx, r8
mov ecx, 0xf
call fcn.1800d0d90
mov rdx, qword [rsp + 0x58]
mov rcx, rax
mov r8, qword [rsp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x48], rax
jmp case.default.0x180082da6
cmp ebx, 0x252
ja 0x180082f23
je 0x180082f08
mov eax, ebx
sub eax, 0x1af
je 0x180082eeb
sub eax, 8
je 0x180082ed0
cmp eax, 0x23
jne case.default.0x180082da6
test rcx, rcx
je 0x180083020
mov qword [rsp + 0x68], rcx
lea r8, [rsp + 0x68]
mov qword [rsp + 0x20], r9
xor ecx, ecx
lea r9d, [rax + 0x31]
xor edx, edx
call fcn.1800bf800
mov r14, rax
jmp 0x180082f7b
mov r8d, 0x1388
lea rdx, [0x18010edb4]
lea rcx, [rbp + 0x10]
call fcn.180105fd0
jmp 0x180082f7b
mov r8d, 4
lea rdx, [0x18010ee0c]
lea rcx, [rbp - 0x2e]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp - 0x2a], 0
jmp 0x180082f7b
movzx eax, word [0x18010edf8]
mov word [rbp - 0x2a], ax
movzx eax, byte [0x18010edfa]
mov byte [rbp - 0x28], al
mov byte [rbp - 0x27], 0
jmp case.default.0x180082da6
cmp ebx, 0x25a
je 0x180082f51
cmp ebx, 0x2f5
jne case.default.0x180082da6
mov r8d, 1
lea rdx, [0x18010edbd]
lea rcx, [rbp - 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov word [rbp - 0x20], r13w
jmp 0x180082f7b
lea rax, [rbp + 0x10]
mov r9, rdx
mov qword [rsp + 0x50], rax
xor r8d, r8d
lea rax, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], IsCharSpaceW
call fcn.18004f100
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x58]
xor r9d, r9d
mov rcx, qword [rsp + 0x48]
add ebx, 0xa3
cmp ebx, edi
jb 0x180082d72
mov rcx, qword [rsp + 0x70]
mov r10d, dword [rsp + 0x30]
imul r13d, r10d, 0x8c0
mov edi, r10d
mov r9, 0xffffffffffffffff
cmp r10d, r13d
ja 0x1800832ca
movzx r12d, byte [rsp + 0x40]
lea ebx, [r9 + 0x54]
mov r11d, 0x74
cmp edi, 0x5d14
ja 0x1800831ea
je 0x1800831d6
cmp edi, 0xf18
ja 0x1800831a1
je 0x18008313a
mov eax, edi
sub eax, 0x18
je 0x18008312d
sub eax, 0x7c
je 0x180083039
cmp eax, 0x78
jne 0x180083290
mov word [rbp - 0x1e], r11w
mov word [rbp - 0x1d], bx
jmp 0x180083290
mov eax, 0xffffffff
jmp 0x1800835c7
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
jmp 0x180082fa5
test r14, r14
je 0x18008310d
mov ebx, 0x9f
nop word [rax + rax]
mov eax, ebx
sub eax, 0x9d
je 0x1800830ec
sub eax, 1
je 0x18008309f
cmp eax, 1
jne 0x1800830f5
mov rax, qword [rsi]
lea rcx, [rbp - 0x80]
test rax, rax
jns 0x18008307f
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
jmp 0x1800830f5
mov qword [rsp + 0x78], rcx
lea r9, [rbp - 0x78]
xor ecx, ecx
mov qword [rbp - 0x78], rax
lea r8, [rsp + 0x78]
mov edx, 0x26
call fcn.1800bef60
jmp 0x1800830f5
mov rax, qword [rcx]
test rax, rax
jns 0x1800830b1
mov rax, qword [rbp - 0x80]
mov qword [rbp - 0x70], rax
jmp 0x1800830d3
lea rcx, [rbp - 0x70]
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x78], rcx
lea r9, [rsp + 0x78]
xor ecx, ecx
lea r8, [rbp - 0x78]
mov edx, 0x26
call fcn.1800bef60
xor r9d, r9d
lea r8, [rbp - 0x70]
lea rdx, [rbp - 0x80]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov r15d, eax
jmp 0x1800830f5
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
dec ebx
cmp ebx, 0x9c
ja 0x180083050
mov ebx, 0x53
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x48]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r10d, dword [rsp + 0x30]
jmp 0x180083290
cmp qword [rsi], 0
setne r12b
jmp 0x180083290
test r12b, r12b
je 0x180083194
mov ebx, 0xa8
mov eax, ebx
sub eax, 0xa6
je 0x180083175
sub eax, 1
je 0x18008315f
cmp eax, 1
jne 0x180083180
mov rax, qword [rsi]
mov qword [r8], rax
jmp 0x180083180
mov rax, qword [r8]
mov ecx, 1
call qword [rax + 0x10]
mov r8, qword [rsp + 0x38]
mov qword [r8 + 0x30], rax
jmp 0x180083180
cmp qword [r8 + 0x30], 0
je 0x1800832c0
dec ebx
cmp ebx, 0xa5
ja 0x180083144
mov r10d, dword [rsp + 0x30]
mov ebx, 0x53
mov dword [rsp + 0x50], 0
jmp 0x180083290
cmp edi, 0x1e18
je 0x1800835c3
cmp edi, 0x4711
jne 0x180083290
mov r8d, r9d
lea rdx, [0x18010edb4]
lea rcx, [rbp + 0x10]
call fcn.180105fd0
mov r10d, dword [rsp + 0x30]
jmp 0x180083290
mov eax, r15d
neg eax
sbb ecx, ecx
neg ecx
dec ecx
mov dword [rsp + 0x50], ecx
jmp 0x180083290
cmp edi, 0xd451
ja 0x180083265
je 0x18008324c
cmp edi, 0x8db1
je 0x18008321b
cmp edi, 0xa88c
je 0x180083212
cmp edi, 0xb994
je 0x1800835c3
jmp 0x180083290
mov dword [rbp - 0x1c], 0x65747379
jmp 0x180083290
lea rax, [rbp + 0x10]
mov r9, rdx
mov qword [rsp + 0x78], rax
xor r8d, r8d
lea rax, [rsp + 0x78]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], IsCharSpaceW
call fcn.18004f100
mov r10d, dword [rsp + 0x30]
jmp 0x180083290
mov r8, rdx
xor r9d, r9d
mov edx, 0xa1
xor ecx, ecx
call fcn.1800587a0
mov r10d, dword [rsp + 0x30]
jmp 0x180083290
cmp edi, 0x1500c
je 0x180083289
cmp edi, 0x1f78c
jne 0x180083290
mov eax, 0x66
mov word [rbp - 0x15], ax
mov eax, 0x6f
mov word [rbp - 0x14], ax
jmp 0x180083290
mov dword [rbp - 0x18], 0x6e496d
lea eax, [r10 + r10*4]
mov r9, 0xffffffffffffffff
shl eax, 5
add edi, eax
cmp edi, r13d
ja 0x1800832ca
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x38]
jmp 0x180082fc9
mov eax, 0xffffffe9
jmp 0x1800835c7
imul r12d, r10d, 0x1c0
mov edi, r10d
cmp r10d, r12d
ja 0x1800835c3
mov esi, dword [rsp + 0x60]
movzx r15d, byte [rsp + 0x40]
mov r13, qword [rsp + 0x78]
mov r14d, dword [rsp + 0x60]
cmp edi, 0xeb8c
ja 0x180083430
je 0x1800833ef
cmp edi, 0x658c
ja 0x180083387
je 0x180083364
cmp edi, 0x10c
je 0x180083358
cmp edi, 0x228c
je 0x18008334c
cmp edi, 0x440c
jne 0x1800835ab
movzx eax, word [0x18010ee5c]
movsd xmm0, qword [0x18010ee54]
mov word [rbp - 4], ax
xor eax, eax
mov word [rbp - 2], ax
movsd qword [rbp - 0xc], xmm0
jmp 0x1800835ab
mov dword [rbp - 0xe], 0x65
jmp 0x1800835ab
mov dword [rbp - 0x10], 0x6b
jmp 0x1800835ab
movzx eax, word [0x18010ef18]
movsd xmm0, qword [0x18010ef10]
mov word [rbp + 6], ax
xor eax, eax
mov word [rbp + 8], ax
movsd qword [rbp - 2], xmm0
jmp 0x1800835ab
cmp edi, 0x870c
je 0x1800833e7
cmp edi, 0xa88c
je 0x1800833be
cmp edi, 0xca0c
jne 0x1800835ab
lea rax, [rbp - 0x30]
mov rsi, r9
nop word [rax + rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x1800833b0
jmp 0x1800835ab
xor eax, eax
lea r8, [rbp - 0x10]
mov r9d, 0x94
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x20]
xor ecx, ecx
call fcn.1800e4330
mov r10d, dword [rsp + 0x30]
mov r13, rax
jmp 0x1800835ab
mov r15b, 1
jmp 0x1800835ab
mov rax, qword [rsp + 0x38]
cmp qword [rax + 0x20], 0
je 0x180083425
mov eax, 0xdc
cmp eax, 0xdc
je 0x180083414
cmp eax, 0xabe0
je 0x1800835c3
jmp 0x180083419
mov byte [rsp + 0x50], 1
add eax, 0xab04
cmp eax, 0x15608
jbe 0x180083400
xor eax, eax
mov dword [rsp + 0x60], eax
jmp 0x1800835ab
cmp edi, 0x1718c
ja 0x18008351b
je 0x1800834ee
cmp edi, 0x10d0c
je 0x1800834a8
cmp edi, 0x12e8c
je 0x180083480
cmp edi, 0x1500c
jne 0x1800835ab
mov rcx, qword [rsp + 0x38]
mov eax, dword [rbp - 0x40]
mov dword [rcx + 0x28], eax
xor eax, eax
mov ecx, eax
test r14d, r14d
movzx eax, r15b
cmove ecx, eax
movzx r15d, cl
jmp 0x1800835ab
lea rcx, [rbp - 0x60]
call r13
lea r9, [rbp - 0x68]
mov edx, esi
lea r8, [rsp + 0x60]
lea rcx, [rbp - 0x30]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
mov r10d, dword [rsp + 0x30]
mov r14d, eax
jmp 0x1800835ab
mov rcx, qword [rsp + 0x38]
mov edx, 0x11a
call fcn.1800741d0
test al, al
jne 0x1800834de
mov ecx, 0x64
mov eax, ecx
sub eax, 0x64
je 0x1800834d2
cmp eax, 1
je 0x1800835c3
jmp 0x1800834d7
mov byte [rsp + 0x50], 0
inc ecx
cmp ecx, 0x66
jb 0x1800834c0
mov r10d, dword [rsp + 0x30]
xor eax, eax
mov qword [rbp - 0x68], rax
jmp 0x1800835ab
mov rbx, qword [rsp + 0x38]
mov eax, 0x30
mov ecx, dword [rbx + 0x28]
add rcx, rcx
mul rcx
cmovo rax, r9
mov rcx, rax
call fcn.180106104
mov r10d, dword [rsp + 0x30]
mov qword [rbx + 0x10], rax
jmp 0x1800835ab
cmp edi, 0x1930c
je 0x180083531
cmp edi, 0x1b48c
je 0x1800835c3
jmp 0x1800835ab
test r15b, r15b
je 0x1800835a6
mov ebx, 0x124
nop dword [rax + rax]
cmp ebx, 0x124
je 0x18008358c
cmp ebx, 0x17f4
je 0x180083569
cmp ebx, 0x2ec4
jne 0x180083593
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x180083593
call sub.RPCRT4.dll_MesHandleFree
jmp 0x180083593
lea r8, [rsp + 0x70]
mov edx, esi
lea rcx, [rbp - 0x30]
call sub.RPCRT4.dll_MesDecodeBufferHandleCreate
mov rcx, qword [rbp - 0x68]
mov r14d, eax
test rcx, rcx
je 0x180083593
call sub.RPCRT4.dll_MesHandleFree
jmp 0x180083593
xor eax, eax
mov qword [rsp + 0x70], rax
add ebx, 0x16d0
cmp ebx, 0x4470
jbe 0x180083540
mov r10d, dword [rsp + 0x30]
mov byte [rsp + 0x50], 1
mov eax, r10d
mov r9, 0xffffffffffffffff
shl eax, 5
add edi, eax
cmp edi, r12d
jbe 0x1800832f1
mov eax, dword [rsp + 0x50]
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.180106610
mov rbx, qword [rsp + 0x188]
add rsp, 0x130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret