Function at 0x1400033d0
Capabilities:
Get file size
Timestomp file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x35d8]
mov eax, 0x36e8
call fcn.1400a5130
sub rsp, rax
mov rax, qword [0x14014dcf0]
xor rax, rsp
mov qword [rbp + 0x35c0], rax
xor ebx, ebx
mov r13d, 1
or r14, 0xffffffffffffffff
mov dword [rbp - 0x4c], r9d
mov r15, r8
mov qword [rbp - 0x28], r8
mov dword [rbp - 0x3c], r13d
mov r12d, r13d
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x78], r14
mov dword [rbp - 0x54], ebx
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x38], rbx
mov qword [rbp - 8], rdx
mov rsi, rcx
mov qword [rbp - 0x80], rcx
call fcn.140014fd0
mov edi, eax
mov dword [rbp - 0x40], eax
cmp dword [r15], ebx
jne 0x14000345a
mov eax, r14d
jmp 0x14000422d
call fcn.1400192a0
mov r15, qword [rbp - 8]
lea r9, [rbp - 0x60]
lea rcx, [rbp + 0x31a0]
mov r8, r15
mov edx, 0x208
call fcn.14001ca70
cmp dword [rbp - 0x60], ebx
jne 0x1400034de
lea rdi, [rbp + 0x31a0]
lea rax, [rbp + 0x2f90]
mov edx, 0x104
sub rdi, rax
lea rcx, [rbp + 0x2f90]
nop dword [rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x1400034cd
movzx eax, word [rcx + rdi]
test ax, ax
je 0x1400034cd
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x1400034a0
mov edi, dword [rbp - 0x40]
sub rcx, 2
mov word [rcx], bx
jmp 0x140003516
test rdx, rdx
jne 0x1400034d6
sub rcx, 2
mov edi, dword [rbp - 0x40]
mov word [rcx], bx
jmp 0x140003516
lea r9, [rbp + 0x2f90]
lea rdx, [rbp + 0x33b0]
lea rcx, [rbp + 0x31a0]
mov r8d, 0x208
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], 0x208
call fcn.14001cb10
mov dword [rbp - 0x3c], eax
test eax, eax
jne 0x1400040f4
mov ecx, 3
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ecx
mov r8d, ecx
lea rcx, [rbp + 0x2f90]
xor r9d, r9d
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
mov qword [rbp - 0x78], rax
cmp rax, 0xffffffffffffffff
je 0x1400040f4
cmp dword [rbp - 0x60], ebx
jne 0x14000360a
cmp dword [0x1401482e4], ebx
je 0x1400035c8
lea r8, [rbp - 0x30]
xor r9d, r9d
xor edx, edx
mov rcx, rax
mov qword [rbp - 0x30], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_SetFileTime]
lea r9, [rbp + 8]
lea r8, [rbp - 0x30]
lea rdx, [rbp + 0x10]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x1400035bf
lea rcx, str.GETFILETIME_FAILED_PW
mov dword [rbp - 0x54], ebx
call fcn.14003a7b0
mov r8, qword [0x140196ee8]
mov r9d, 0x30
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1400035c3
mov dword [rbp - 0x54], r13d
cmp dword [rbp - 0x60], ebx
jne 0x14000360a
lea rdx, [rbp]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400040f4
mov rsi, qword [rbp]
mov r15d, 0x200
call fcn.14003f860
test eax, eax
je 0x14000374d
cmp dword [0x1401a6c58], ebx
mov r12d, ebx
setne r12b
add r12d, 0x23
jmp 0x1400040f4
lea rdx, [rbp + 0x58]
mov rcx, r15
call fcn.14001efa0
test eax, eax
je 0x140003629
mov rsi, qword [rbp + 0x60]
mov r15d, 0x200
jmp 0x14000373b
mov qword [rsp + 0x38], rbx
lea rax, [rbp - 0x50]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x2e90]
xor r8d, r8d
mov edx, 0x700a0
mov rcx, r14
mov dword [rsp + 0x28], pe_nt_image_headers64
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14000372d
mov qword [rsp + 0x38], rbx
lea rax, [rbp - 0x50]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x40]
xor r8d, r8d
mov edx, 0x70000
mov rcx, r14
mov dword [rsp + 0x28], 0x18
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1400040f4
mov eax, dword [rbp + 0x4c]
mov r15d, dword [rbp + 0x54]
mov esi, r15d
imul rsi, rax
mov eax, dword [rbp + 0x50]
imul rsi, rax
imul rsi, qword [rbp + 0x40]
cmp dword [0x140196f30], 6
jl 0x14000373b
xor eax, eax
mov qword [rsp + 0x38], rbx
xor r9d, r9d
mov qword [rbp + 0x24], rax
mov qword [rbp + 0x2c], rax
mov qword [rbp + 0x34], rax
mov dword [rbp + 0x3c], eax
lea rax, [rbp - 0x50]
xor r8d, r8d
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x20]
mov edx, 0x2d5140
mov rcx, r14
mov dword [rsp + 0x28], 0x20
mov dword [rbp + 0x20], 0x20
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x24], 0x20
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x14000373b
cmp dword [rbp - 0x50], 0x20
jb 0x14000373b
cmp dword [rbp + 0x24], 0x20
jne 0x14000373b
mov rsi, qword [rbp + 0x38]
jmp 0x14000373b
mov rsi, qword [rbp + 0x2ea8]
mov r15d, dword [rbp + 0x2ea4]
test rsi, rsi
jne 0x1400035e7
lea r12d, [rsi + 7]
jmp 0x1400040f4
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400040f4
lea rdx, [rbp + 0x2c90]
mov r8d, 0x200
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll__lread]
cmp eax, 0x200
je 0x140003798
lea rcx, [rbp + 0x2c90]
xor edx, edx
mov r8d, 0x200
call fcn.1400a4ea0
mov r9d, dword [rbp - 0x4c]
mov r8, qword [rbp - 0x28]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
mov eax, dword [rbp + 0x3640]
lea rdx, [rbp + 0x2c90]
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
call fcn.140049730
mov r12d, eax
cmp eax, 0x12
je 0x1400037da
test eax, eax
jne 0x1400040f0
test edi, edi
je 0x1400037f3
mov rcx, qword [rbp - 0x68]
call fcn.140015280
mov rcx, qword [rbp - 0x68]
mov rdx, rax
call fcn.140015290
mov rdi, qword [rbp - 0x68]
test byte [rdi + 0x2c00], r13b
je 0x14000380b
mov r12d, 0x1f
jmp 0x1400040f4
mov r8d, dword [rbp - 0x60]
mov r13, qword [rbp + 0x3648]
test r8d, r8d
je 0x140003822
test r13, r13
cmove r13, rsi
mov ecx, dword [rdi + 0x2be0]
xor edx, edx
mov rax, r13
div rcx
test rdx, rdx
jne 0x1400040ea
movabs rax, 0x4000000000000
cmp r13, rax
ja 0x1400040ea
test r8d, r8d
je 0x14000385a
cmp r13, rsi
ja 0x1400040ea
mov ecx, dword [rdi + 0x2bdc]
mov edx, 0x40000
mov r10d, 0x200
test ecx, ecx
mov eax, edx
cmovne eax, r10d
cmp r13, rax
jae 0x14000387d
mov r9, rbx
jmp 0x140003883
mov r9, r13
sub r9, rax
mov qword [rbp - 0x70], r9
test ecx, ecx
je 0x1400038bf
test r8d, r8d
je 0x1400038a5
cmp dword [rbp + 0x3650], ebx
jne 0x1400040ea
lea rax, [r9 - 0x10000]
jmp 0x1400038b4
mov rax, rbx
cmp rsi, r10
jb 0x1400038b4
lea rax, [rsi - 0x200]
mov qword [rdi + 0x2be8], rax
mov rdi, qword [rbp - 0x68]
cmp dword [rdi + 0x2bdc], ebx
mov rax, qword [rdi + 0x2be8]
cmovne rdx, r10
lea rcx, [rax + rdx]
add rax, 0x10000
mov qword [rbp - 0x18], rcx
cmp r9, rax
jb 0x1400040ea
mov rdx, rcx
mov r12d, 1
xor r9d, r9d
xor r8d, r8d
mov rcx, r13
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], ebx
call fcn.14003d380
mov edx, dword [0x14014fb88]
test edx, edx
je 0x140003927
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14d, 0x21
mov r12d, r14d
jmp 0x1400040fa
mov edi, dword [rbp - 0x60]
test edi, edi
jne 0x1400039b7
xor r9d, r9d
xor r8d, r8d
mov rcx, r14
cmp rsi, r13
je 0x1400039a4
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400040f4
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x1400040f4
cmp dword [rbp + 0x3658], ebx
je 0x14000398a
mov rdx, r13
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
test eax, eax
jne 0x14000398a
mov rcx, qword [rbp - 0x80]
lea rdx, str.Warning:_Failed_to_perform_Quick_Expand._Continuing_with_standard_expanding..._r_n
call fcn.1400011e0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x1400039b4
jmp 0x1400040f4
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
jne 0x1400040f4
mov edi, dword [rbp - 0x60]
cmp dword [rbp + 0x3650], ebx
je 0x140003ab7
mov rax, qword [rbp - 0x18]
xor edx, edx
mov ecx, r15d
div rcx
xor edx, edx
mov r14, rax
mov rax, r13
div rcx
mov r12, rax
sub r12, r14
test edi, edi
je 0x1400039f8
call fcn.1400043e0
test eax, eax
jne 0x1400039f8
mov r12d, 1
jmp 0x1400040f4
mov rdi, qword [rbp - 0x80]
lea rdx, str.Writing_random_data_to_new_space_..._r_n
mov rcx, rdi
call fcn.1400011e0
mov ecx, r15d
call fcn.1400042e0
mov rax, qword [rbp - 0x68]
mov r15, qword [rbp - 0x78]
mov r9, r15
mov r8, r12
mov rdx, r14
mov rcx, rdi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call fcn.1400046b0
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.1400044f0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r12d, r12d
je 0x140003ac1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13, qword [rbp - 0x80]
lea rdx, str.Error:_failed_to_write_random_data_..._r_n
mov rcx, r13
mov edi, eax
call fcn.1400011e0
cmp dword [rbp - 0x60], ebx
jne 0x140003aa4
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140003a95
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140003aa4
lea rdx, str.Warning:_failed_to_restore_original_size_of_the_container_file_r_n
mov rcx, r13
call fcn.1400011e0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14d, 0x21
jmp 0x140004102
mov rcx, r13
call fcn.14003da70
jmp 0x140003acb
mov r14, qword [rbp - 0x78]
mov r12d, 1
mov rax, qword [rbp - 0x68]
mov ecx, dword [rax + 8]
call fcn.14003dbe0
mov rax, qword [rbp - 0x68]
lea rsi, [r13 - 0x20000]
movsxd r13, dword [rbp - 0x40]
mov r15d, r12d
cmp dword [rax + 0x2bdc], ebx
jne 0x140003ec0
nop word [rax + rax]
mov r12, qword [rbp - 0x80]
lea rdx, str.Writing_re_encrypted_backup_header_..._r_n
mov rcx, r12
test r15d, r15d
jne 0x140003b1a
lea rdx, str.Writing_re_encrypted_primary_header_..._r_n
call fcn.1400011e0
test r13, r13
je 0x140003b7b
lea rcx, [rbp + 0x80]
mov edx, 0x2c10
call qword [sym.imp.KERNEL32.dll_VirtualLock]
mov rdi, qword [rbp - 0x68]
lea rcx, [rbp + 0x80]
mov rdx, rdi
mov r8d, 0x2c10
call fcn.1400a4990
mov rcx, rdi
call fcn.140015280
lea rcx, [rbp + 0x80]
mov rdx, rax
call fcn.140015290
mov rax, qword [rbp - 0x68]
lea rdx, [rbp + 0x80]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x68], rdx
jmp 0x140003b7f
mov rdx, qword [rbp - 0x68]
mov eax, dword [rdx + 0x2be0]
mov rdi, qword [rbp - 0x70]
mov r9d, dword [rdx]
mov dword [rsp + 0x88], ebx
mov dword [rsp + 0x80], eax
mov eax, dword [rdx + 0x2c00]
mov dword [rsp + 0x78], eax
movzx eax, word [rdx + 0x2bd8]
lea rcx, [rdx + 0x2990]
mov word [rsp + 0x70], ax
mov rax, qword [rdx + 0x2bf0]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rdi
lea rax, [rbp - 0x20]
lea r8, [rbp + 0x2c90]
mov qword [rsp + 0x48], rax
mov eax, dword [rbp + 0x3640]
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], eax
mov eax, dword [rdx + 8]
mov rcx, r12
mov dword [rsp + 0x30], eax
mov rax, qword [rbp - 0x28]
mov qword [rsp + 0x28], rax
mov eax, dword [rdx + 4]
xor edx, edx
mov dword [rsp + 0x20], eax
call fcn.14004a280
mov r12d, eax
test r13, r13
je 0x140003c5c
mov rax, qword [rbp - 0x38]
mov r8d, 0x2c10
lea rdi, [rbp + 0x80]
mov qword [rbp - 0x68], rax
mov ecx, r8d
xor eax, eax
rep stosb byte [rdi], al
lea rdx, [rbp + 0x80]
nop dword [rax]
mov byte [rdx], al
inc rdx
dec r8
jne 0x140003c40
lea rcx, [rbp + 0x80]
mov edx, 0x2c10
call qword [sym.imp.KERNEL32.dll_VirtualUnlock]
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140003c6a
call fcn.140014bd0
test r12d, r12d
jne 0x1400040f4
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400039ed
mov ecx, dword [rbp - 0x60]
lea r8, [rbp + 0x2c90]
mov rdx, r14
call fcn.14004ab90
test eax, eax
je 0x1400039ed
mov r8, qword [rbp - 0x68]
test r15d, r15d
je 0x140003cb8
cmp dword [rbp + 0x3650], ebx
je 0x140003d04
cmp dword [rbp - 0x60], ebx
je 0x140003e9c
cmp dword [r8 + 0x2bdc], ebx
jne 0x140003e9c
cmp dword [r8 + 0x297c], ebx
jne 0x140003e9c
cmp word [r8 + 0x2980], 4
jne 0x140003e9c
mov eax, dword [r8 + 0x2c00]
test al, 2
je 0x140003e9c
test eax, 0xfffffffd
jne 0x140003e9c
mov qword [rbp - 0x10], rbx
test r13, r13
je 0x140003d64
lea rcx, [rbp + 0x80]
mov edx, 0x2c10
call qword [sym.imp.KERNEL32.dll_VirtualLock]
mov rdi, qword [rbp - 0x68]
lea rcx, [rbp + 0x80]
mov rdx, rdi
mov r8d, 0x2c10
call fcn.1400a4990
mov rcx, rdi
call fcn.140015280
lea rcx, [rbp + 0x80]
mov rdx, rax
call fcn.140015290
mov rdi, qword [rbp - 0x68]
lea r8, [rbp + 0x80]
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x68], r8
jmp 0x140003d68
mov rdi, qword [rbp - 0x38]
mov r9, qword [rbp - 0x70]
mov rcx, qword [rbp - 0x80]
mov eax, ebx
test r15d, r15d
mov rdx, r14
mov dword [rsp + 0x28], r15d
sete al
mov dword [rsp + 0x20], eax
call fcn.14004ad40
mov r12d, eax
test r13, r13
je 0x140003dcc
mov qword [rbp - 0x68], rdi
mov r8d, 0x2c10
lea rdi, [rbp + 0x80]
xor eax, eax
mov ecx, r8d
lea rdx, [rbp + 0x80]
rep stosb byte [rdi], al
mov byte [rdx], al
inc rdx
dec r8
jne 0x140003db0
lea rcx, [rbp + 0x80]
mov edx, 0x2c10
call qword [sym.imp.KERNEL32.dll_VirtualUnlock]
test r12d, r12d
jne 0x1400040f4
mov rcx, qword [rbp - 0x68]
mov dword [rsp + 0x88], ebx
lea rdi, [rsi + 0x10000]
mov eax, dword [rcx + 0x2be0]
mov rsi, qword [rbp - 0x70]
mov r9d, dword [rcx]
mov dword [rsp + 0x80], eax
mov eax, dword [rcx + 0x2c00]
lea r8, [rbp + 0x2c90]
mov dword [rsp + 0x78], eax
movzx eax, word [rcx + 0x2bd8]
xor edx, edx
mov word [rsp + 0x70], ax
mov rax, qword [rcx + 0x2bf0]
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
lea rax, [rbp - 0x10]
mov qword [rsp + 0x48], rax
mov eax, dword [rcx + 4]
mov rcx, qword [rbp - 0x80]
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], eax
call fcn.14004a280
mov r12d, eax
test eax, eax
jne 0x140003ee1
mov rcx, qword [rbp - 0x10]
call fcn.140014bd0
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140003edb
mov ecx, dword [rbp - 0x60]
lea r8, [rbp + 0x2c90]
mov rdx, r14
call fcn.14004ab90
test eax, eax
je 0x140003edb
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test r15d, r15d
je 0x140003ec0
mov rax, qword [rbp - 0x68]
mov r15d, ebx
mov rsi, rbx
cmp dword [rax + 0x2bdc], ebx
je 0x140003b00
mov eax, dword [0x14014fb88]
mov r12d, ebx
test eax, eax
je 0x140003ef4
mov r14d, 0x21
mov r12d, r14d
jmp 0x1400040fa
mov r12d, 1
mov r15, qword [rbp - 0x78]
mov r13, qword [rbp - 0x80]
mov r14d, 0x21
jmp 0x140004106
mov rax, qword [rbp - 0x68]
cmp dword [rax + 0x2bdc], ebx
jne 0x1400040f4
mov rdi, qword [rbp - 0x80]
mov r13d, 1
mov r15d, 3
lea rdx, [rbp - 0x58]
mov rcx, rdi
mov r9d, r13d
mov r8d, r15d
call fcn.14003f870
test eax, eax
je 0x1400040dc
lea rdx, [rbp - 0x5c]
mov r9d, r13d
mov r8d, r15d
mov rcx, rdi
call fcn.14003f870
test eax, eax
je 0x1400040dc
lea rdx, str.Wiping_old_backup_header_..._r_n
mov rcx, rdi
call fcn.1400011e0
mov ecx, 0x20000
call fcn.1400a4fcc
mov qword [rbp - 0x48], rax
test rax, rax
jne 0x140003f7c
lea r12d, [r13 + 1]
mov r13, rdi
mov r14d, 0x21
jmp 0x1400040fe
mov rdi, qword [rbp - 0x18]
mov ecx, 0xdac
movzx esi, r13b
add rdi, 0xfffffffffffe0000
mov qword [rbp + 0x18], rdi
call fcn.14004b170
cmp eax, r13d
jl 0x14000409b
nop word [rax + rax]
mov r9, qword [rbp - 0x48]
lea rdx, [rbp - 0x58]
mov r8d, r13d
mov ecx, 0xdac
mov qword [rsp + 0x20], 0x20000
call fcn.14004b1c0
mov r13, qword [rbp - 0x48]
test eax, eax
jne 0x14000400f
mov r8d, 0x20000
movzx edx, sil
mov rcx, r13
call fcn.1400a4ea0
mov r9, qword [rbp - 0x68]
lea rdx, [rbp + 0x18]
mov r8d, pe_nt_image_headers64
mov rcx, r13
call fcn.140014dc0
movzx eax, word [r13]
mov word [rbp - 0x5c], ax
movzx eax, byte [r13 + 2]
mov byte [rbp - 0x5a], al
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140004047
mov r8d, 0x20000
mov rdx, r13
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll__lwrite]
cmp eax, 0xffffffff
je 0x140004047
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
jmp 0x140004081
mov r13, qword [rbp - 0x80]
lea rdx, str.Warning:_Failed_to_wipe_old_backup_header_r_n
mov rcx, r13
call fcn.1400011e0
mov r8, qword [0x140196ee8]
lea rdx, str.WARNING:_Failed_to_wipe_old_backup_header__n_nIt_may_be_possible_to_use_the_current_volume_password_to_decrypt_the_old_backup_header_even_after_a_future_password_change._n
mov r9d, 0x30
mov rcx, r13
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp sil, 1
jne 0x140003f71
inc sil
mov ecx, 0xdac
movzx r13d, sil
call fcn.14004b170
cmp r13d, eax
jle 0x140003fb0
lea rdi, [rbp - 0x58]
xor eax, eax
mov rcx, r15
lea rdx, [rbp - 0x58]
mov r8, r15
rep stosb byte [rdi], al
nop dword [rax]
mov byte [rdx], al
inc rdx
dec r8
jne 0x1400040b0
lea rdi, [rbp - 0x5c]
mov rcx, r15
lea rdx, [rbp - 0x5c]
rep stosb byte [rdi], al
nop word [rax + rax]
mov byte [rdx], al
inc rdx
dec r15
jne 0x1400040d0
jmp 0x1400040f4
mov r12d, r13d
mov r14d, 0x21
mov r13, rdi
jmp 0x1400040fe
mov r12d, 0x1e
mov qword [rbp - 0x68], rbx
mov r14d, 0x21
mov r13, qword [rbp - 0x80]
mov r15, qword [rbp - 0x78]
mov rsi, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9, qword [rbp - 0x48]
mov ebx, eax
test r9, r9
je 0x140004142
mov r8d, 0x20000
mov rdi, r9
xor eax, eax
mov ecx, r8d
mov rdx, r9
rep stosb byte [rdi], al
nop word [rax + rax]
mov byte [rdx], al
inc rdx
dec r8
jne 0x140004130
mov rcx, r9
call fcn.1400a4f8c
mov r8d, 0x200
lea rdi, [rbp + 0x2c90]
xor eax, eax
mov ecx, r8d
lea rdx, [rbp + 0x2c90]
rep stosb byte [rdi], al
nop dword [rax]
mov byte [rdx], al
inc rdx
dec r8
jne 0x140004160
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x140004178
call fcn.140014bd0
cmp dword [rbp - 0x54], 0
je 0x1400041bc
lea r9, [rbp + 8]
lea r8, [rbp - 0x30]
lea rdx, [rbp + 0x10]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x1400041bc
lea rcx, str.SETFILETIME_FAILED_PW
call fcn.14003a7b0
mov r8, qword [0x140196ee8]
mov r9d, 0x30
mov rdx, rax
mov rcx, r13
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp r15, 0xffffffffffffffff
je 0x1400041cb
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbp - 0x3c], 0
jne 0x1400041e4
lea rdx, [rbp + 0x33b0]
lea rcx, [rbp + 0x31a0]
call fcn.1400188a0
xor ecx, ecx
call fcn.14003da80
mov eax, dword [0x14014fb88]
mov ecx, ebx
test eax, eax
cmovne r12d, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r12d, r12d
jne 0x14000422a
mov eax, dword [rbp + 0x3640]
mov r9d, dword [rbp - 0x4c]
mov r8, qword [rbp - 0x28]
mov rdx, qword [rbp - 8]
mov rcx, r13
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
call fcn.140003180
mov r12d, eax
mov eax, r12d
mov rcx, qword [rbp + 0x35c0]
xor rcx, rsp
call fcn.1400a4e70
add rsp, 0x36e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret