Function at 0xb11640
Capabilities:
Get common file path
Timestomp file

Disassembly:
sub esp, 0x2d0
mov dword [esp + 0x28], edx
push ebx
mov dword [esp + 0x30], ecx
push esi
lea eax, [esp + 0x48]
push edi
mov dword [esp + 0x14], 0x18
mov dword [esp + 0x18], 0
push ebp
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0xb11683
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x2d0
ret
lea edi, [esp + 0x50]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x154]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0xb14484
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x50]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x3e90
and ecx, 3
push 0x42
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
jne 0xb11704
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x2d0
ret
lea eax, [esp + 0x154]
push ebx
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
call ebp
cmp eax, 0xffffffff
je 0xb1172c
mov edx, dword [ebx + 0x18]
lea eax, [ebx + 0x14]
mov ecx, dword [eax]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
jmp 0xb11741
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [esp + 0x2c]
mov ebp, dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push eax
push ebx
call ebp
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x48], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x44], ecx
lea eax, [esp + 0x258]
push 0x4000
lea ecx, [esp + 0x54]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_OpenFile]
cmp eax, 0xffffffff
jne 0xb117ee
lea eax, [esp + 0x50]
push 6
push eax
call dword [sym.imp.KERNEL32.dll__lcreat]
mov ebp, eax
push 4
mov dword [esp + 0x20], 0x14
mov dword [esp + 0x18], 0
lea eax, [esp + 0x18]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll__lwrite]
lea eax, [esp + 0x1c]
push 4
push eax
push ebp
call dword [sym.imp.KERNEL32.dll__lwrite]
push 4
push 0xb16c0c
push ebp
call dword [sym.imp.KERNEL32.dll__lwrite]
lea eax, [esp + 0x18]
push 4
push eax
push ebp
call dword [sym.imp.KERNEL32.dll__lwrite]
lea eax, [esp + 0x14]
push 4
push eax
push ebp
call dword [sym.imp.KERNEL32.dll__lwrite]
lea eax, [esp + 0x14]
push 4
push eax
push ebp
call dword [sym.imp.KERNEL32.dll__lwrite]
jmp 0xb1189c
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
lea eax, [esp + 0x50]
push 0
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov ebp, eax
push 4
lea eax, [esp + 0x18]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
cmp dword [esp + 0x14], 0
jne 0xb1187a
lea eax, [esp + 0x1c]
push 4
push eax
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
cmp dword [esp + 0x1c], 0x14
jne 0xb11852
push 4
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
lea eax, [esp + 0x18]
push 4
push eax
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
push 8
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
jmp 0xb1189c
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll__llseek]
push 0xc
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
cmp byte [ebx], 0x7b
jne 0xb1197c
cmp byte [ebx + 0xb], 0x7d
jne 0xb1197c
push 2
push 0
push ebp
call dword [sym.imp.KERNEL32.dll__llseek]
mov dword [esp + 0x18], eax
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll__llseek]
mov dword [esp + 0x1c], 0xa
cmp ebp, 0xffffffff
je 0xb119aa
cmp dword [esp + 0x1c], 0x14
mov dword [esp + 0x10], 0x18
je 0xb118bc
mov dword [esp + 0x10], 4
push 0x10
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
mov dword [esp + 0x34], 0
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x10]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
cmp eax, dword [esp + 0x18]
jge 0xb119e0
lea eax, [ebx + 0xc]
mov dword [esp + 0x24], eax
cmp dword [eax], 0x3e80
jg 0xb11947
cmp byte [ebx], 0x7b
jne 0xb11947
mov ecx, 0xc
mov esi, dword [0xb16b24]
mov edi, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0xb119b7
push 1
mov ecx, dword [eax]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll__llseek]
mov ecx, dword [esp + 0x24]
push 0x10
push ebx
push ebp
mov eax, dword [ecx]
add eax, dword [esp + 0x34]
add dword [esp + 0x1c], eax
mov eax, dword [ecx]
add eax, 0x10
add dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll__lread]
mov dword [esp + 0x28], eax
jmp 0xb118dd
push ebp
call dword [sym.imp.KERNEL32.dll__lclose]
lea ecx, [esp + 0x50]
mov edx, dword [esp + 0x10]
call fcn.00b11430
test eax, eax
jne 0xb119c1
lea eax, [esp + 0x258]
push 0x200
lea ecx, [esp + 0x54]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_OpenFile]
jmp 0xb11759
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll__lclose]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x2d0
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x2d0
ret
mov dword [esp + 0x34], 1
jmp 0xb119e0
lea eax, [esp + 0x50]
push 0
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov dword [esp + 0x28], 0
mov ebp, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x154]
push eax
push 0x1a3
lea eax, [esp + 0x15c]
push 0xb1448c
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea ecx, [esp + 0x154]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll__lcreat]
cmp eax, 0xffffffff
mov esi, eax
jne 0xb11a45
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll__lclose]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x2d0
ret
cmp dword [esp + 0x34], 0
je 0xb11a5e
mov ecx, dword [ebx + 0xc]
mov edi, dword [esp + 0x28]
add ecx, dword [esp + 0x10]
push 0
add edi, ecx
push edi
jmp 0xb11a69
mov edi, dword [esp + 0x18]
push 0
mov eax, dword [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll__llseek]
mov eax, dword [esp + 0x18]
sub eax, edi
mov edi, 0x3e80
mov dword [esp + 0x14], eax
cmp eax, edi
jl 0xb11aa3
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll__lwrite]
sub dword [esp + 0x14], 0x3e80
cmp dword [esp + 0x14], edi
jge 0xb11a83
mov eax, dword [esp + 0x14]
push eax
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
mov eax, dword [esp + 0x14]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll__lwrite]
push ebp
call dword [sym.imp.KERNEL32.dll__lclose]
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
lea eax, [esp + 0x154]
push 0
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov esi, eax
push 1
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
cmp dword [esp + 0x34], 0
mov edi, eax
jne 0xb11afb
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll__llseek]
push 0xc
mov eax, dword [0xb16b24]
push eax
push edi
call dword [sym.imp.KERNEL32.dll__lwrite]
lea eax, [esp + 0x38]
push 4
push eax
push edi
call dword [sym.imp.KERNEL32.dll__lwrite]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll__lwrite]
mov dword [esp + 0x14], eax
push 0
add eax, 0x10
push 0
add dword [esp + 0x18], eax
push esi
call dword [sym.imp.KERNEL32.dll__llseek]
push 0x3e80
push ebx
push esi
call dword [sym.imp.KERNEL32.dll__lread]
cmp eax, 0x3e80
mov ebp, eax
jne 0xb11b8e
push 0x3e80
push ebx
push edi
call dword [sym.imp.KERNEL32.dll__lwrite]
add dword [esp + 0x10], 0x3e80
push 0x3e80
push ebx
push esi
call dword [sym.imp.KERNEL32.dll__lread]
cmp eax, 0x3e80
mov ebp, eax
je 0xb11b63
push ebp
push ebx
push edi
call dword [sym.imp.KERNEL32.dll__lwrite]
add dword [esp + 0x10], ebp
cmp dword [esp + 0x1c], 0x14
jne 0xb11c48
push 0
push 0xc
push edi
call dword [sym.imp.KERNEL32.dll__llseek]
lea eax, [esp + 0x10]
push 4
push eax
push edi
call dword [sym.imp.KERNEL32.dll__lwrite]
mov eax, dword [esp + 0x10]
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll__llseek]
mov ecx, 0x1800
mov eax, dword [esp + 0x10]
cdq
idiv ecx
mov ebp, ecx
mov eax, 0x3e80
mov dword [esp + 0x10], 0
sub ecx, edx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x10]
mov byte [ecx + ebx], 0x55
inc dword [esp + 0x10]
cmp dword [esp + 0x10], eax
jl 0xb11bee
cmp dword [esp + 0x20], 0x3e80
jl 0xb11c3b
mov ecx, 0x3e80
mov eax, dword [esp + 0x20]
sub edx, edx
div ecx
mov ebp, eax
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
lea eax, [ecx + ecx*4]
shl eax, 7
neg eax
add dword [esp + 0x20], eax
push 0x3e80
push ebx
push edi
call dword [sym.imp.KERNEL32.dll__lwrite]
dec ebp
jne 0xb11c2b
mov eax, dword [esp + 0x20]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll__lwrite]
push edi
call dword [sym.imp.KERNEL32.dll__lclose]
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
lea eax, [esp + 0x258]
push 0x200
lea ecx, [esp + 0x158]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_OpenFile]
lea ecx, [esp + 0x50]
push 0
push 0x80
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 3
push 0
push 3
push 0xc0000000
push ecx
call ebp
mov esi, eax
lea ecx, [esp + 0x40]
lea eax, [esp + 0x2c]
lea edx, [esp + 0x48]
push eax
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebp
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x38]
cmp dword [esp + 0x14], eax
mov eax, 0
jl 0xb11cdf
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x2d0
ret