Function at 0x409760
Capabilities:
Timestomp file
Write file on windows

Disassembly:
mov eax, dword [0x4eb878]
sub esp, 0x74
test eax, eax
push ebp
push esi
push edi
jne 0x409779
pop edi
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x74
ret
mov eax, dword [esp + 0x94]
push ebx
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov edi, dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f02
push 0
call edi
mov ebx, dword [sym.imp.USER32.dll_SetCursor]
push eax
call ebx
mov edx, dword [esp + 0x8c]
mov ebp, dword [esp + 0x88]
lea ecx, [esp + 0x50]
push 0
push ecx
push 0
push 0
push edx
push ebp
call dword [0x4eb870]
push 0x7f00
push 0
mov esi, eax
call edi
push eax
call ebx
test si, si
pop ebx
je 0x40989c
movsx eax, si
cmp eax, 0xfffffc0d
jg 0x409833
je 0x40982c
add eax, 0x403
cmp eax, 0xe
ja case.0x409843.1005
xor ecx, ecx
mov cl, byte [eax + 0x409b00]
jmp dword [ecx*4 + 0x409ae4]
mov eax, 0x217
jmp 0x409872
mov eax, 0x21a
jmp 0x409872
mov eax, 0x21b
jmp 0x409872
mov eax, 0x21c
jmp 0x409872
mov eax, 0x21d
jmp 0x409872
mov eax, 0x21e
jmp 0x409872
mov eax, 0x219
jmp 0x409872
test eax, eax
jg case.0x409843.1005
je 0x40986d
add eax, 0x3ee
cmp eax, 6
ja case.0x409843.1005
jmp dword [eax*4 + 0x409b10]
mov eax, 0x213
jmp 0x409872
mov eax, 0x214
jmp 0x409872
mov eax, 0x215
jmp 0x409872
mov eax, 0x216
jmp 0x409872
mov eax, 0x218
jmp 0x409872
mov eax, 0x212
mov edx, dword [esp + 0x94]
push 0
push 0xa2
push eax
mov eax, dword [esp + 0x9c]
push edx
push eax
call fcn.0044adc0
add esp, 0x14
pop edi
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x74
ret
mov eax, dword [esp + 0x60]
mov edi, dword [esp + 0x94]
mov ecx, dword [esp + 0x98]
mov edx, dword [esp + 0x9c]
push eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x18], eax
call fcn.004be967
mov dword [esp + 0x14], eax
add esp, 4
lea eax, [esp + 0x30]
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x50]
push edx
push eax
push ebp
mov dword [esp + 0x28], 0x409b80
call dword [0x4eb874]
test ax, ax
je 0x4099d4
cmp ax, 0xfc14
je case.0x409975.1005
movsx eax, ax
cmp eax, 0xfffffc0d
jg 0x409965
je 0x40995e
add eax, 0x403
cmp eax, 0xe
ja case.0x409975.1005
xor ecx, ecx
mov cl, byte [eax + 0x409b48]
jmp dword [ecx*4 + 0x409b2c]
mov eax, 0x217
jmp 0x4099a4
mov eax, 0x21a
jmp 0x4099a4
mov eax, 0x21b
jmp 0x4099a4
mov eax, 0x21c
jmp 0x4099a4
mov eax, 0x21d
jmp 0x4099a4
mov eax, 0x21e
jmp 0x4099a4
mov eax, 0x219
jmp 0x4099a4
test eax, eax
jg case.0x409975.1005
je 0x40999f
add eax, 0x3ee
cmp eax, 6
ja case.0x409975.1005
jmp dword [eax*4 + 0x409b58]
mov eax, 0x213
jmp 0x4099a4
mov eax, 0x214
jmp 0x4099a4
mov eax, 0x215
jmp 0x4099a4
mov eax, 0x216
jmp 0x4099a4
mov eax, 0x218
jmp 0x4099a4
mov eax, 0x212
mov edx, dword [esp + 0x90]
push 0
push 0xa2
push eax
push edi
push edx
call fcn.0044adc0
add esp, 0x14
mov eax, dword [esp + 0x10]
push eax
call fcn.004be975
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
add esp, 0x74
ret
mov ecx, dword [esp + 0x8c]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x409a20
push str.CreateFile__
push edi
call fcn.0044ae60
mov edx, dword [esp + 0x18]
push edx
call fcn.004be975
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebp
add esp, 0x74
ret
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push 0
push eax
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
mov eax, dword [esp + 0x10]
push eax
call fcn.004be975
add esp, 4
test edi, edi
je 0x409ad4
mov ecx, dword [esp + 0x76]
mov edx, dword [esp + 0x74]
mov ax, word [esp + 0x78]
add ecx, 0x76c
inc edx
mov word [esp + 0x40], ax
mov ax, word [esp + 0x6e]
mov word [esp + 0x3e], dx
mov dx, word [esp + 0x70]
mov word [esp + 0x3c], cx
mov cx, word [esp + 0x72]
mov word [esp + 0x44], dx
mov word [esp + 0x46], ax
lea edx, [esp + 0x28]
mov word [esp + 0x42], cx
mov cx, word [esp + 0x6c]
lea eax, [esp + 0x3c]
push edx
push eax
mov word [esp + 0x50], cx
mov word [esp + 0x52], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea ecx, [esp + 0x20]
lea edx, [esp + 0x28]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x20]
push eax
push 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x74
ret