Function at 0x4029b0
Capabilities:
Get file size
Timestomp file

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rsi
mov qword [r11 + 0x10], rdi
mov qword [r11 + 0x18], r12
mov qword [r11 + 0x20], r13
push r14
sub rsp, 0x340
mov rax, qword [0x00407100]
xor rax, rsp
mov qword [rsp + 0x330], rax
mov r9, qword [0x00407a20]
mov qword [rsp + 0x50], r9
mov rcx, qword [0x00408e40]
mov qword [rsp + 0x30], rcx
mov r8, qword [0x00408e60]
mov qword [rsp + 0x48], r8
mov edx, dword [0x00408e68]
mov dword [rsp + 0x3c], edx
mov dword [rsp + 0x44], edx
xor esi, esi
xor r12d, r12d
mov dword [rsp + 0x58], edx
mov al, dl
not al
and al, 1
mov byte [rsp + 0x5d], al
mov r14b, dl
shr r14b, 1
and r14b, 1
mov byte [rsp + 0x5c], r14b
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], r9
lea rax, [0x00401eb0]
mov qword [rsp + 0x78], rax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
lea rdi, [r11 - 0x2a8]
mov qword [r11 - 0x2c0], rdi
xor edx, edx
lea r8d, [rsi + 0x58]
lea rcx, [r11 - 0x2a8]
call sub.msvcrt.dll_memset
movzx r11d, r14b
mov dword [rsp + 0x20], r11d
lea r9d, [rsi + 1]
lea r8, [rsp + 0xa0]
mov r14, qword [rsp + 0x30]
mov rdx, r14
mov rcx, qword [rsp + 0x48]
call fcn.0040465c
test eax, eax
je 0x402e65
mov r13, qword [rsp + 0x48]
mov qword [rsp + 0xa0], r13
mov rax, qword [rsp + 0xb8]
test rax, rax
je 0x402e5a
test byte [rsp + 0x3c], 4
jne 0x402ad7
cmp byte [rsp + 0xdc], r12b
jne 0x402e5a
add rax, 0x18
cmp word [rax], 0x10b
jne 0x402af4
mov rsi, rax
mov qword [rsp + 0x30], rax
xor r12d, r12d
mov qword [rsp + 0x30], r12
jmp 0x402b0a
cmp word [rax], 0x20b
jne 0x402b0a
mov r12, rax
mov qword [rsp + 0x30], rax
xor esi, esi
mov qword [rsp + 0x30], rsi
test rsi, rsi
je 0x402b15
movzx eax, word [rsi + 0x46]
jmp 0x402b24
test r12, r12
je 0x402b22
movzx eax, word [r12 + 0x46]
jmp 0x402b24
xor eax, eax
bt eax, 0xb
jb 0x402e5a
lea r9, [rsp + 0x30]
mov r8w, 4
xor edx, edx
mov rcx, qword [rsp + 0xb0]
call sub.imagehlp.dll_ImageDirectoryEntryToData
test rax, rax
jne 0x402e5a
cmp dword [rsp + 0x30], eax
jne 0x402e5a
lea r9, [rsp + 0x30]
mov r8w, 0xe
xor edx, edx
mov rcx, qword [rsp + 0xb0]
call sub.imagehlp.dll_ImageDirectoryEntryToData
test rax, rax
jne 0x402b7e
cmp dword [rsp + 0x30], eax
je 0x402b92
test byte [rax + 0x10], 8
jne 0x402e5a
test byte [rax + 0x10], 1
jne 0x402e5a
lea r9, [rsp + 0x30]
mov r8, r14
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x58]
call fcn.004036e8
cmp byte [rsp + 0x5c], 0
jne 0x402e5a
cmp dword [rsp + 0x30], 0
je 0x402e5a
cmp qword [rsp + 0xa8], 0xffffffffffffffff
je 0x402e5a
mov rcx, qword [rsp + 0xb8]
lea rax, [rcx + 0x18]
cmp word [rax], 0x10b
jne 0x402bf6
mov rsi, rax
mov qword [rsp + 0x30], rax
xor r12d, r12d
mov qword [rsp + 0x30], r12
jmp 0x402c0c
cmp word [rax], 0x20b
jne 0x402c0c
mov r12, rax
mov qword [rsp + 0x30], rax
xor esi, esi
mov qword [rsp + 0x30], rsi
bt word [rcx + 0x16], 9
jae 0x402cde
cmp qword [rsp + 0x50], 0
je 0x402cde
mov r14d, 1
mov r8, r13
mov r13d, 0x104
mov rdx, r13
lea rcx, [rsp + 0x110]
call fcn.004056c8
lea r9, [rsp + 0x30]
mov r8w, 6
xor edx, edx
mov rcx, qword [rsp + 0xb0]
call sub.imagehlp.dll_ImageDirectoryEntryToData
mov r11, rax
mov qword [rsp + 0x98], rax
test rax, rax
je 0x402ce1
mov r9d, dword [rsp + 0x30]
cmp r9d, 0x1c
jb 0x402ce1
movabs rax, 0x2492492492492493
mul r9
mov rcx, r9
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 4
imul rcx, rcx, 0x1c
cmp r9, rcx
jne 0x402ce1
test r9d, r9d
je 0x402ce1
cmp dword [r11 + 0xc], 4
jne 0x402cc7
mov r8d, dword [r11 + 0x18]
add r8, qword [rdi + 0x10]
add r8, 0xc
mov rdx, r13
lea rcx, [rsp + 0x110]
call fcn.004056c8
jmp 0x402ce1
add r11, 0x1c
mov qword [rsp + 0x98], r11
sub r9, 0x1c
mov dword [rsp + 0x30], r9d
jmp 0x402c9d
xor r14d, r14d
test rsi, rsi
je 0x402cec
mov r13d, dword [rsi + 0x40]
jmp 0x402cfb
test r12, r12
je 0x402cf8
mov r13d, dword [r12 + 0x40]
jmp 0x402cfb
xor r13d, r13d
xor edx, edx
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, eax
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x90]
mov rcx, qword [rdi + 0x10]
call sub.imagehlp.dll_CheckSumMappedFile
lea rax, [rsi + 0x40]
lea r8, [r12 + 0x40]
test rsi, rsi
cmovne r8, rax
mov eax, dword [rsp + 0x40]
mov dword [r8], eax
mov edx, dword [rdi + 0x50]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
test r14d, r14d
je 0x402e1b
mov dword [rsp + 0x20], r13d
mov r9, qword [rdi + 0x18]
lea r8, [rsp + 0x220]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call sub.imagehlp.dll_UpdateDebugInfoFileEx
test eax, eax
je 0x402dd0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xd
jne 0x402e1b
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x402e1b
test byte [rsp + 0x58], 0x10
je 0x402db2
lea rcx, [rsp + 0x110]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rdi]
lea ecx, [r9 + 0xc]
call rax
jmp 0x402e1b
lea rcx, [rsp + 0x110]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rdi]
lea ecx, [r9 + 0xc]
call rax
jmp 0x402e1b
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x402e1b
test byte [rsp + 0x58], 0x10
je 0x402dff
lea rcx, [rsp + 0x110]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rdi]
lea ecx, [r9 + 0xd]
call rax
jmp 0x402e1b
lea rcx, [rsp + 0x110]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rdi]
lea ecx, [r9 + 0xd]
call rax
lea rcx, [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x402e5a
lea r9, [rsp + 0x80]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov r13d, 1
mov dword [rsp + 0x38], r13d
mov esi, dword [rsp + 0x3c]
jmp 0x402e7c
cmp qword [rdi + 0x10], 0
je 0x402e8d
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp qword [rdi + 8], 0xffffffffffffffff
je 0x402e9e
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test sil, 8
jne 0x402ed8
cmp byte [0x00407a08], 0
je 0x402ed8
mov rdi, qword [0x00408e50]
lea rsi, [0x00408e50]
cmp rdi, rsi
je 0x402ed1
lea rcx, [rdi - 0x40]
mov rdi, qword [rdi]
call fcn.00404e38
cmp rdi, rsi
jne 0x402ec0
mov byte [0x00407a08], 0
mov eax, r13d
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.004051c0
lea r11, [rsp + 0x340]
mov rsi, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov r13, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret