Function at 0x100e0ef6
Capabilities:
Timestomp file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6c
mov eax, dword [0x1010e2b0]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
cmp esi, 0xfffffffe
jne 0x100e0fea
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, dword [0x1010e2c0]
or ebx, 0xffffffff
mov esi, eax
cmp ecx, ebx
je 0x100e0f5d
call fcn.10029fa0
mov edi, eax
test edi, edi
je 0x100e0f57
cmp edi, ebx
jne 0x100e0fbc
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, 0x1010eac0
mov dword [eax], 9
jmp 0x100e1054
mov ecx, dword [0x1010e2c0]
mov edx, ebx
call fcn.10032a89
test eax, eax
je 0x100e0f40
push 0x364
push 2
call sym.ucrtbase.dll__calloc_base
pop ecx
mov edi, eax
pop ecx
mov ecx, dword [0x1010e2c0]
test edi, edi
jne 0x100e0f92
xor edx, edx
call fcn.10032a89
push edi
call sym.ucrtbase.dll__free_base
pop ecx
jmp 0x100e0f40
mov edx, edi
call fcn.10032a89
test eax, eax
jne 0x100e0fad
mov ecx, dword [0x1010e2c0]
xor edx, edx
call fcn.10032a89
push edi
jmp 0x100e0f8a
mov ecx, edi
call fcn.10031ad6
push 0
call sym.ucrtbase.dll__free_base
pop ecx
test edi, edi
je 0x100e0f40
mov ecx, dword [0x1010e2c4]
call fcn.10029fa0
imul eax, eax, 0x364
push esi
add edi, eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
test edi, edi
je 0x100e0f47
lea eax, [edi + 0x10]
jmp 0x100e0f4c
test esi, esi
js 0x100e1015
cmp esi, dword [0x1010f330]
jae 0x100e1015
mov eax, esi
mov edx, esi
and eax, 0x3f
sar edx, 6
imul ecx, eax, 0x30
mov eax, dword [edx*4 + 0x1010f130]
test byte [eax + ecx + 0x28], 1
jne 0x100e10b9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, dword [0x1010e2c0]
or ebx, 0xffffffff
mov esi, eax
cmp ecx, ebx
je 0x100e106e
call fcn.10029fa0
mov edi, eax
test edi, edi
je 0x100e1068
cmp edi, ebx
jne 0x100e133e
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, 0x1010eac0
mov dword [eax], 9
call sym.ucrtbase.dll__invalid_parameter_noinfo
mov eax, ebx
mov ecx, dword [esp + 0x74]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1005cc20
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x1010e2c0]
mov edx, ebx
call fcn.10032a89
test eax, eax
je 0x100e103d
push 0x364
push 2
call sym.ucrtbase.dll__calloc_base
pop ecx
mov edi, eax
pop ecx
mov ecx, dword [0x1010e2c0]
test edi, edi
je 0x100e131b
mov edx, edi
call fcn.10032a89
test eax, eax
jne 0x100e132f
mov ecx, dword [0x1010e2c0]
xor edx, edx
call fcn.10032a89
push edi
jmp 0x100e1324
or ebx, 0xffffffff
test edi, edi
jne 0x100e10fd
xor eax, eax
lea edi, [esp + 0x30]
stosd dword es:[edi], eax
lea ecx, [esp + 0x30]
xor edx, edx
inc edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.100e0371
cmp eax, 1
je 0x100e10e1
mov eax, ebx
mov ecx, ebx
jmp 0x100e10e9
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x38], eax
lea edi, [esp + 0x30]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
lea edx, [edi + 8]
lea ecx, [esp + 0x40]
call fcn.10044e7a
test eax, eax
je 0x100e11b3
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, dword [0x1010e2c0]
mov esi, eax
cmp ecx, ebx
je 0x100e12e9
call fcn.10029fa0
mov edi, eax
test edi, edi
je 0x100e12e3
cmp edi, ebx
jne 0x100e118c
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, 0x1010eac0
mov dword [eax], 0x16
jmp 0x100e1054
xor edx, edx
call fcn.10032a89
push 0
call sym.ucrtbase.dll__free_base
pop ecx
jmp 0x100e113a
mov edx, edi
call fcn.10032a89
test eax, eax
jne 0x100e117d
mov ecx, dword [0x1010e2c0]
xor edx, edx
call fcn.10032a89
push edi
jmp 0x100e115a
mov ecx, edi
call fcn.10031ad6
push 0
call sym.ucrtbase.dll__free_base
pop ecx
test edi, edi
je 0x100e113a
mov ecx, dword [0x1010e2c4]
call fcn.10029fa0
imul eax, eax, 0x364
push esi
add edi, eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
test edi, edi
je 0x100e1141
lea eax, [edi + 0x10]
jmp 0x100e1146
mov eax, dword [esp + 0x54]
add eax, 0x76c
mov word [esp + 0x20], ax
mov eax, dword [esp + 0x50]
inc eax
mov word [esp + 0x22], ax
mov ax, word [esp + 0x4c]
mov word [esp + 0x26], ax
mov ax, word [esp + 0x48]
mov word [esp + 0x28], ax
mov ax, word [esp + 0x44]
mov word [esp + 0x2a], ax
mov ax, word [esp + 0x40]
mov word [esp + 0x2c], ax
xor eax, eax
mov word [esp + 0x2e], ax
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x24]
push eax
push 0
call dword [sym.imp.api_ms_win_core_timezone_l1_1_0.dll_TzSpecificLocalTimeToSystemTime]
test eax, eax
je 0x100e1111
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.api_ms_win_core_timezone_l1_1_0.dll_SystemTimeToFileTime]
test eax, eax
je 0x100e1111
mov edx, edi
lea ecx, [esp + 0x40]
call fcn.10044e7a
test eax, eax
jne 0x100e1111
mov eax, dword [esp + 0x54]
add eax, 0x76c
mov word [esp + 0x20], ax
mov eax, dword [esp + 0x50]
inc eax
mov word [esp + 0x22], ax
mov ax, word [esp + 0x4c]
mov word [esp + 0x26], ax
mov ax, word [esp + 0x48]
mov word [esp + 0x28], ax
mov ax, word [esp + 0x44]
mov word [esp + 0x2a], ax
mov ax, word [esp + 0x40]
mov word [esp + 0x2c], ax
xor eax, eax
mov word [esp + 0x2e], ax
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x24]
push eax
push 0
call dword [sym.imp.api_ms_win_core_timezone_l1_1_0.dll_TzSpecificLocalTimeToSystemTime]
test eax, eax
je 0x100e1111
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.api_ms_win_core_timezone_l1_1_0.dll_SystemTimeToFileTime]
test eax, eax
je 0x100e1111
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push ecx
push esi
call sym.ucrtbase.dll__get_osfhandle
pop ecx
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileTime]
test eax, eax
je 0x100e1111
xor eax, eax
jmp 0x100e1056
mov ecx, dword [0x1010e2c0]
mov edx, ebx
call fcn.10032a89
test eax, eax
je 0x100e113a
push 0x364
push 2
call sym.ucrtbase.dll__calloc_base
pop ecx
mov edi, eax
pop ecx
mov ecx, dword [0x1010e2c0]
test edi, edi
je 0x100e1151
jmp 0x100e1162
xor edx, edx
call fcn.10032a89
push 0
call sym.ucrtbase.dll__free_base
pop ecx
jmp 0x100e103d
mov ecx, edi
call fcn.10031ad6
push 0
call sym.ucrtbase.dll__free_base
pop ecx
test edi, edi
je 0x100e103d
mov ecx, dword [0x1010e2c4]
call fcn.10029fa0
imul eax, eax, 0x364
push esi
add edi, eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
test edi, edi
je 0x100e1044
lea eax, [edi + 0x10]
jmp 0x100e1049