Function at 0x180052f20
Capabilities:
Timestomp file

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xf0
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xor edi, edi
mov qword [rbp + 0x17], rdi
mov qword [rbp + 0x1f], reloc.WS2_32.dll_ntohs
lea ecx, [rdi + 0x30]
call fcn.1800d22f8
mov qword [rbp + 7], rax
mov qword [rbp + 0x17], reloc.WLDAP32.dll_Ordinal_32
mov qword [rbp + 0x1f], Ordinal_50
movups xmm0, xmmword [str.C:WindowsSysWOW64_regedt32.exe]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1800f5468]
movups xmmword [rax + 0x10], xmm1
mov byte [rax + 0x20], dil
xorps xmm0, xmm0
movups xmmword [rbp - 0x69], xmm0
mov qword [rbp - 0x59], rdi
mov qword [rbp - 0x51], reloc.WS2_32.dll_ntohs
lea ecx, [rdi + 0x30]
call fcn.1800d22f8
mov qword [rbp - 0x69], rax
mov qword [rbp - 0x59], reloc.WLDAP32.dll_Ordinal_32
mov qword [rbp - 0x51], Ordinal_50
movups xmm0, xmmword [str.C:WindowsSysWOW64_regedt64.exe]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1800f5490]
movups xmmword [rax + 0x10], xmm1
mov byte [rax + 0x20], dil
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], reloc.WS2_32.dll_ntohs
lea ecx, [rdi + 0x30]
call fcn.1800d22f8
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x39], reloc.WLDAP32.dll_Ordinal_33
mov qword [rbp - 0x31], Ordinal_50
movups xmm0, xmmword [str.C:WindowsSysWOW64_reguwpapi.dll]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1800f54b8]
movups xmmword [rax + 0x10], xmm1
movzx edx, byte [0x1800f54c8]
mov byte [rax + 0x20], dl
mov byte [rax + 0x21], dil
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x11], rdi
mov qword [rbp - 9], reloc.WS2_32.dll_ntohs
lea ecx, [rdi + 0x30]
call fcn.1800d22f8
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x11], reloc.WLDAP32.dll_Ordinal_35
mov qword [rbp - 9], Ordinal_50
movups xmm0, xmmword [0x1800f54d0]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1800f54e0]
movups xmmword [rax + 0x10], xmm1
movzx ecx, word [0x1800f54f0]
mov word [rax + 0x20], cx
movzx ecx, byte [0x1800f54f2]
mov byte [rax + 0x22], cl
mov byte [rax + 0x23], dil
lea rdx, [rbp - 0x69]
lea rcx, [rbp + 7]
call fcn.180052b00
lea rdx, [rbp - 0x21]
lea rcx, [rbp - 0x49]
call fcn.180052b00
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1800530b5
imul rax, rax, 0x64
jmp 0x1800530d0
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rcx, 0x7fffffff4d2fa1ff
cmp rax, rcx
jge 0x1800530ed
mov ecx, 0xb2d05e00
add rcx, rax
mov qword [rbp + 0x67], rcx
jmp 0x1800530fb
movabs rax, 0x7fffffffffffffff
mov qword [rbp + 0x67], rax
lea rcx, [rbp + 0x67]
call fcn.18006c020
mov dword [rsp + 0x40], 0xc07e3
mov esi, 7
mov dword [rsp + 0x46], 0xb0007
mov dword [rbp - 0x7f], 9
mov word [rbp - 0x7b], di
lea rdx, [rbp + 0x6f]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x180053188
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, esi
mov edx, 0x100
lea rcx, [0x1800f5230]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180053188
lea r9, [rbp + 0x6f]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp - 0x79], 0xc07e3
mov dword [rbp - 0x73], 0xb0007
mov dword [rbp - 0x6f], 9
mov word [rbp - 0x6b], di
lea rdx, [rbp + 0x77]
lea rcx, [rbp - 0x79]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x180053205
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, esi
mov edx, 0x100
lea rcx, str.C:WindowsSysWOW64_reguwpapi32.dll
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180053205
lea r9, [rbp + 0x77]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp - 9]
cmp rdx, 0x10
jb 0x180053243
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005323e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18005323e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800d2160
mov qword [rbp - 0x11], rdi
mov qword [rbp - 9], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x21], 0
mov rdx, qword [rbp - 0x31]
cmp rdx, 0x10
jb 0x180053291
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005328c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18005328c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800d2160
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x49], 0
mov rdx, qword [rbp - 0x51]
cmp rdx, 0x10
jb 0x1800532df
inc rdx
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800532da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800532da
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800d2160
mov qword [rbp - 0x59], rdi
mov qword [rbp - 0x51], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x69], 0
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x18005332d
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180053328
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180053328
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800d2160
mov rbx, qword [rsp + 0x148]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret