Function at 0x180051510
Capabilities:
Timestomp file

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xe0
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xor edi, edi
mov qword [rbp + 0x17], rdi
mov qword [rbp + 0x1f], reloc.WS2_32.dll_ntohs
lea ecx, [rdi + 0x20]
call fcn.1800d0088
mov rdx, rax
mov qword [rbp + 7], rax
mov qword [rbp + reloc.WS2_32.dll_socket], 0x17
mov qword [rbp + Ordinal_35], 0x1f
movups xmm0, xmmword [str.C:Windowswinhlp32.exe]
movups xmmword [rax], xmm0
mov ecx, dword [0x1800f23d0]
mov dword [rax + 0x10], ecx
movzx ecx, word [0x1800f23d4]
mov word [rax + 0x14], cx
movzx eax, byte [0x1800f23d6]
mov byte [rdx + 0x16], al
mov byte [rdx + 0x17], dil
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], rdi
mov qword [rbp - 1], reloc.WS2_32.dll_ntohs
lea ecx, [rdi + 0x20]
call fcn.1800d0088
mov qword [rbp - 0x19], rax
mov qword [rbp - 9], reloc.WS2_32.dll_socket
mov qword [rbp - 1], Ordinal_35
movups xmm0, xmmword [str.C:Windowswinhlp64.exe]
movups xmmword [rax], xmm0
mov ecx, dword [0x1800f23e8]
mov dword [rax + 0x10], ecx
movzx ecx, word [0x1800f23ec]
mov word [rax + 0x14], cx
movzx ecx, byte [0x1800f23ee]
mov byte [rax + 0x16], cl
mov byte [rax + 0x17], dil
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], reloc.WS2_32.dll_ntohs
lea ecx, [rdi + 0x30]
call fcn.1800d0088
mov qword [rbp - 0x39], rax
mov qword [rbp - 0x29], reloc.WLDAP32.dll_Ordinal_32
mov qword [rbp - 0x21], Ordinal_50
movups xmm0, xmmword [str.C:Windows_system32PeerDist.dll]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1800f2400]
movups xmmword [rax + 0x10], xmm1
mov byte [rax + 0x20], dil
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x49], rdi
mov qword [rbp - 0x41], reloc.WS2_32.dll_ntohs
lea ecx, [rdi + 0x20]
call fcn.1800d0088
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x49], reloc.WS2_32.dll_socket
mov qword [rbp - 0x41], Ordinal_35
movups xmm0, xmmword [0x1800f2418]
movups xmmword [rax], xmm0
mov ecx, dword [0x1800f2428]
mov dword [rax + 0x10], ecx
movzx ecx, word [0x1800f242c]
mov word [rax + 0x14], cx
movzx ecx, byte [0x1800f242e]
mov byte [rax + 0x16], cl
mov byte [rax + 0x17], dil
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 7]
call fcn.1800510f0
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x39]
call fcn.1800510f0
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1800516c2
imul rax, rax, 0x64
jmp 0x1800516dd
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rcx, 0x7fffffff4d2fa1ff
cmp rax, rcx
jge 0x1800516fa
mov ecx, 0xb2d05e00
add rcx, rax
mov qword [rbp + 0x67], rcx
jmp 0x180051708
movabs rax, 0x7fffffffffffffff
mov qword [rbp + 0x67], rax
lea rcx, [rbp + 0x67]
call fcn.180069db0
mov dword [rbp - 0x79], 0xc07e3
mov esi, 7
mov dword [rbp - 0x73], 0xb0007
mov dword [rbp - 0x6f], Ordinal_50
mov word [rbp - 0x6b], di
lea rdx, [rbp + 0x6f]
lea rcx, [rbp - 0x79]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x180051792
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, esi
mov edx, 0x100
lea rcx, [0x1800f2228]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180051792
lea r9, [rbp + 0x6f]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp - 0x69], 0xc07e3
mov dword [rbp - 0x63], 0xb0007
mov dword [rbp - 0x5f], Ordinal_50
mov word [rbp - 0x5b], di
lea rdx, [rbp + 0x77]
lea rcx, [rbp - 0x69]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x18005180f
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, esi
mov edx, 0x100
lea rcx, str.C:Windowswinhlp64.dll
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18005180f
lea r9, [rbp + 0x77]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp - 0x41]
cmp rdx, 0x10
jb 0x18005184d
inc rdx
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180051848
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180051848
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800cfef0
mov qword [rbp - 0x49], rdi
mov qword [rbp - 0x41], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x59], 0
mov rdx, qword [rbp - 0x21]
cmp rdx, 0x10
jb 0x18005189b
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180051896
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180051896
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800cfef0
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x39], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x1800518e9
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800518e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800518e4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800cfef0
mov qword [rbp - 9], rdi
mov qword [rbp - 1], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x19], 0
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x180051937
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180051932
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180051932
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800cfef0
mov rbx, qword [rsp + 0x138]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret