Function at 0x18009b2a0
Capabilities:
Timestomp file

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xe8
lea eax, [r9 + 0x29f]
mov rsi, r8
mov dword [rsp + 0x30], eax
mov r15, rdx
cmp r9d, eax
jae case.0x18009b330.10
mov edi, dword [rbp + 0x7f]
lea r14d, [r9 - 0x36]
mov r12d, dword [rbp + 0x7f]
lea rdx, [0x180000000]
mov r13, qword [rsp + 0x48]
xor ebx, ebx
mov eax, dword [rbp + 0x7f]
mov ecx, dword [rsp + 0x30]
mov dword [rsp + 0x38], r14d
nop dword [rax + rax]
cmp r14d, 0xd9
ja case.default.0x18009b330
movzx eax, byte [rdx + r14 + 0x9b71c]
mov ecx, dword [rdx + rax*4 + 0x9b6ec]
add rcx, rdx
jmp rcx
mov eax, dword [rbp - 0x79]
lea rdx, [rsp + 0x38]
xor r9d, r9d
mov dword [rsp + 0x38], eax
mov r8d, 0x101
mov rcx, rsi
call fcn.18000bd00
mov rcx, rax
movzx eax, di
add rcx, rax
mov qword [r15], rcx
jmp 0x18009b68f
mov qword [rsp + 0x28], rbx
mov r9d, 0x62
xor r8d, r8d
mov qword [rsp + 0x20], r15
xor edx, edx
xor ecx, ecx
mov r12d, ebx
call fcn.180064120
mov qword [rbp - 0x61], rax
cmp rax, 0
jne 0x18009b68f
mov dword [rsp + 0x40], 0xffffffff
mov rax, qword [rsp + 0x40]
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rsi, rbx
mov qword [rbp + 0x77], rbx
jmp case.0x18009b330.11
mov dword [rsp + 0x38], ebx
mov r9, r15
lea rcx, [rsp + 0x38]
xor edx, edx
mov r8d, 0xfe
call fcn.1800dee70
jmp 0x18009b68f
mov rax, qword [r15 + 8]
mov rcx, qword [r15]
mov edi, dword [rax + rcx*4]
mov eax, edi
shr eax, 0x18
mov dword [rbp - 0x79], eax
jmp case.0x18009b330.11
mov eax, r12d
neg eax
sbb ecx, ecx
neg ecx
dec ecx
mov dword [rsp + 0x40], ecx
jmp case.0x18009b330.11
mov rsi, rbx
mov qword [rbp + 0x77], rbx
mov dword [rsp + 0x38], 1
jmp 0x18009b3be
mov eax, dword [r15 + 0x10]
test al, 4
jne 0x18009b6d6
test al, 0xa
jne 0x18009b6cd
test al, 1
jne 0x18009b6b9
test al, 0x20
jne case.0x18009b330.9
test al, 0x40
je 0x18009b49b
mov r14d, 0xaf
mov eax, r14d
sub eax, 0xaf
je 0x18009b481
sub eax, 0x63
je 0x18009b45c
cmp eax, 0x63
je case.0x18009b330.10
jmp 0x18009b485
mov esi, dword [r13 + 0x2c]
lea rcx, [rbp - 0x39]
xor r9d, r9d
mov dword [rsp + 0x20], 0x58
xor r8d, r8d
mov rdx, r13
call fcn.1800b1a40
mov qword [rsp + 0x40], rsi
jmp 0x18009b485
mov r13, qword [r15 + 8]
add r14d, 0x63
cmp r14d, 0x1d8
jb 0x18009b442
mov rsi, qword [rbp + 0x77]
jmp 0x18009b68a
test al, al
jns 0x18009b576
mov esi, 0x34
nop dword [rax + rax]
cmp esi, 0x34
je 0x18009b53f
cmp esi, 0xd7
je 0x18009b4fb
cmp esi, 0x17a
jne 0x18009b55b
mov rcx, qword [r15 + 8]
xor r8d, r8d
mov edx, 0xc2
call fcn.1800ebc50
mov r9d, 0xbf
lea rdx, [rbp - 0x39]
xor r8d, r8d
xor ecx, ecx
call fcn.180029510
mov rax, qword [rbp - 0x49]
jmp 0x18009b39a
mov rax, qword [r15 + 0x18]
lea r9, str.__toInt
mov rdx, qword [r15 + 8]
lea r8, [rbp - 0x71]
mov qword [rsp + 0x28], rax
lea rcx, [rbp - 0x39]
mov dword [rsp + 0x20], 0x8c
mov dword [rbp - 0x71], 7
call fcn.18002be30
test eax, eax
jne 0x18009b55b
test byte [rbp - 0x29], 2
je 0x18009b55b
mov r14, qword [rbp - 0x31]
mov qword [rbp - 0x49], r14
jmp 0x18009b55b
mov r9, qword [r15 + 0x18]
lea rdx, [rbp - 0x39]
xor r8d, r8d
mov qword [rbp - 0x49], 1
lea ecx, [r8 + 0x11]
call fcn.180089a20
add esi, 0xa3
cmp esi, 0x21d
jb 0x18009b4b0
mov rsi, qword [rbp + 0x77]
jmp 0x18009b68a
bt eax, 8
jae case.0x18009b330.11
cmp qword [r15 + 8], 0
setne bl
mov rax, rbx
jmp 0x18009b39a
mov rax, qword [rbp - 0x61]
lea r8, [rbp - 0x71]
mov edx, 0xd9
mov qword [rbp - 0x71], rax
xor ecx, ecx
call fcn.180052950
mov r14, rax
test rax, rax
je 0x18009b675
mov rbx, qword [rbp + 0x77]
mov esi, 0xdd
mov r15, qword [rbp + 0x67]
mov eax, esi
sub eax, 0xdc
je 0x18009b654
cmp eax, 1
jne 0x18009b65d
mov rax, qword [rbx]
lea rcx, [rbp - 0x69]
test rax, rax
jns 0x18009b5eb
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
jmp 0x18009b608
xor edx, edx
mov qword [rsp + 0x48], rcx
lea r9, [rbp - 0x59]
mov qword [rbp - 0x59], rax
lea rcx, [rsp + 0x48]
lea r8d, [rdx + 0x65]
call fcn.1800c8a80
mov rax, qword [r15]
test rax, rax
jns 0x18009b61a
mov rax, qword [rbp - 0x69]
mov qword [rbp - 0x51], rax
jmp 0x18009b63b
xor edx, edx
mov qword [rsp + 0x48], rax
lea rcx, [rbp - 0x51]
mov qword [rbp - 0x59], rcx
lea r9, [rsp + 0x48]
lea rcx, [rbp - 0x59]
lea r8d, [rdx + 0x65]
call fcn.1800c8a80
xor r9d, r9d
lea r8, [rbp - 0x51]
lea rdx, [rbp - 0x69]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov r12d, eax
jmp 0x18009b65d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
dec esi
cmp esi, 0xdb
ja 0x18009b5c1
mov r15, qword [rbp + 0x6f]
xor ebx, ebx
mov rsi, qword [rbp + 0x77]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp - 0x61]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r14d, dword [rsp + 0x38]
lea rdx, [0x180000000]
mov ecx, dword [rsp + 0x30]
mov eax, dword [rbp + 0x7f]
add eax, 0x3d
add r14d, 0x3d
mov dword [rbp + 0x7f], eax
mov dword [rsp + 0x38], r14d
cmp eax, ecx
jb 0x18009b310
jmp case.0x18009b330.10
mov r8, r15
xor edx, edx
mov ecx, 0x88
call fcn.1800cb380
jmp 0x18009b39a
mov rax, qword [r15 + 8]
jmp 0x18009b39a
xor r8d, r8d
mov rdx, r15
mov ecx, 0x8d
call fcn.18000fb00
jmp 0x18009b39a