Function at 0x14009a460
Capabilities:
Set file attributes
Timestomp file

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xa0
mov qword [rsp + 0x98], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov r10, r8
mov r13, rcx
movzx eax, word [rdx]
test ax, ax
je 0x14009a4c8
mov ecx, 0x20
mov r8d, 9
cmp r8w, ax
ja 0x14009a4af
cmp ax, 0xd
jbe 0x14009a4c8
cmp cx, ax
je 0x14009a4c8
add rdx, 2
mov qword [rsp + 0xd8], rdx
mov ax, word [rdx]
test ax, ax
jne 0x14009a4a3
lea rcx, [rsp + 0xd8]
call fcn.14005b560
mov ecx, 0x3f
mov rdx, qword [rsp + 0xd8]
cmp cx, word [rdx]
jne 0x14009a4fe
add rdx, 2
mov r9b, 2
mov r8, r10
mov rcx, r13
call fcn.14008c5a0
jmp 0x14009aabc
lea rcx, [rsp + 0xd8]
call fcn.14005b560
lea rcx, [rsp + 0x48]
call fcn.140063500
nop
lea rcx, [rsp + 0x40]
call fcn.140063500
nop
mov esi, 0x2c
mov r8d, esi
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0xd8]
call fcn.140066780
mov rcx, qword [rsp + 0x48]
call fcn.14002e004
mov r14, rax
mov rcx, qword [rsp + 0xd8]
cmp si, word [rcx]
jne 0x14009a576
add rcx, 2
mov qword [rsp + 0xd8], rcx
mov r8d, esi
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xd8]
call fcn.140066780
cmp word [r14], 0
je 0x14009aaa2
mov rbx, qword [rsp + 0x40]
cmp word [rbx], 0
je 0x14009aaa2
mov r8d, 6
mov rdx, r14
lea rcx, str.touch
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x14009a89c
xor edi, edi
mov rcx, rbx
call fcn.14002e004
mov rbx, rax
lea rcx, [rsp + 0x50]
call fcn.140063500
nop
mov rcx, qword [rsp + 0xd8]
cmp si, word [rcx]
jne 0x14009a5f4
add rcx, 2
mov qword [rsp + 0xd8], rcx
mov r8d, esi
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xd8]
call fcn.140066780
mov dword [rsp + 0xe8], edi
xor eax, eax
mov dword [rsp + 0xec], eax
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x5c], eax
mov rsi, rdi
mov rbp, rdi
mov r12, rdi
mov word [rsp + 0x60], di
mov qword [rsp + 0x62], rax
mov dword [rsp + 0x6a], eax
mov word [rsp + 0x6e], ax
lea rax, [r14 + 0xc]
mov qword [rsp + 0xd8], rax
lea rcx, [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov r11, qword [rsp + 0xd8]
movzx eax, word [r11]
mov ecx, 0x2a
lea r14d, [rcx - 0x29]
cmp cx, ax
je 0x14009a6d3
mov ecx, 0x3a
cmp cx, ax
jne 0x14009a7f8
add r11, 2
mov qword [rsp + 0xd8], r11
movzx eax, word [r11]
or ax, 0x20
cmp ax, 0x63
je 0x14009a68a
cmp ax, 0x72
jne 0x14009a696
add r11, 2
mov qword [rsp + 0xd8], r11
cmp ax, 0x63
jne 0x14009a6a6
lea rsi, [rsp + 0xe8]
jmp 0x14009a6be
cmp ax, 0x72
jne 0x14009a6b6
lea rbp, [rsp + 0xe8]
jmp 0x14009a6be
lea r12, [rsp + 0xe8]
lea rcx, [rsp + 0xd8]
call fcn.14005b560
mov r11, qword [rsp + 0xd8]
mov r8d, 8
mov rdx, r11
lea rcx, str.local0:
call fcn.14005c510
test al, al
je 0x14009a6f4
mov edx, r14d
jmp 0x14009a79f
mov r8d, 7
mov rdx, r11
lea rcx, str.local:
call fcn.14005c510
test al, al
je 0x14009a714
mov edx, edi
jmp 0x14009a79f
mov r8d, 6
mov rdx, r11
lea rcx, str.sys0:
call fcn.14005c510
test al, al
je 0x14009a732
mov edx, r14d
jmp 0x14009a74d
mov r8d, 5
mov rdx, r11
lea rcx, str.sys:
call fcn.14005c510
test al, al
je 0x14009a798
mov edx, edi
lea eax, [rdx + 5]
movsxd rcx, eax
lea rax, [r11 + rcx*2]
mov qword [rsp + 0xd8], rax
movzx r8d, dl
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xd8]
call fcn.14007cec0
test eax, eax
jg 0x14009a783
mov edi, 0x80070057
jmp 0x14009a865
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
jmp 0x14009a7f8
mov edx, r14d
sub r11, 0x10
lea eax, [rdx + 7]
movsxd rcx, eax
lea rax, [r11 + rcx*2]
mov qword [rsp + 0xd8], rax
movzx r8d, dl
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xd8]
call fcn.14007cec0
test eax, eax
jg 0x14009a7d5
mov edi, 0x80070057
jmp 0x14009a865
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x100
lea r8d, [r9 + 7]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14009a857
test rax, rax
je 0x14009a857
mov r9, r12
mov r8, rbp
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov esi, eax
cmp rbx, 0xffffffffffffffff
je 0x14009a853
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x14009a865
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
cmove eax, r14d
mov edi, eax
mov r8, qword [rsp + 0x50]
mov edx, edi
mov rcx, r13
call fcn.140065f20
nop
lea rcx, [rsp + 0x50]
call fcn.14005b520
nop
lea rcx, [rsp + 0x40]
call fcn.14005b520
nop
lea rcx, [rsp + 0x48]
call fcn.14005b520
mov eax, edi
jmp 0x14009aabc
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov qword [rsp + 0xd8], rbx
cmp word [rbx], 0
je 0x14009aa77
mov r10d, dword [rsp + 0x70]
nop word [rax + rax]
mov r8d, 2
mov rdx, rbx
lea rcx, [0x140151de4]
call fcn.14005c510
test al, al
je 0x14009a900
add rbx, 4
mov qword [rsp + 0xd8], rbx
or r10d, 0x20
mov dword [rsp + 0x70], r10d
jmp 0x14009a92e
mov r8d, 2
mov rdx, rbx
lea rcx, [0x140151de0]
call fcn.14005c510
test al, al
je 0x14009a92e
add rbx, 4
mov qword [rsp + 0xd8], rbx
and r10d, 0xffffffdf
mov dword [rsp + 0x70], r10d
mov r8d, 2
mov rdx, rbx
lea rcx, [0x140151ddc]
call fcn.14005c510
test al, al
je 0x14009a95e
add rbx, 4
mov qword [rsp + 0xd8], rbx
or r10d, 2
mov dword [rsp + 0x70], r10d
jmp 0x14009a98c
mov r8d, 2
mov rdx, rbx
lea rcx, [0x140151dd8]
call fcn.14005c510
test al, al
je 0x14009a98c
add rbx, 4
mov qword [rsp + 0xd8], rbx
and r10d, 0xfffffffd
mov dword [rsp + 0x70], r10d
mov r8d, 2
mov rdx, rbx
lea rcx, [0x140151dd4]
call fcn.14005c510
test al, al
je 0x14009a9bc
add rbx, 4
mov qword [rsp + 0xd8], rbx
or r10d, 1
mov dword [rsp + 0x70], r10d
jmp 0x14009a9ea
mov r8d, 2
mov rdx, rbx
lea rcx, [0x140151dd0]
call fcn.14005c510
test al, al
je 0x14009a9ea
add rbx, 4
mov qword [rsp + 0xd8], rbx
and r10d, 0xfffffffe
mov dword [rsp + 0x70], r10d
mov r8d, 2
mov rdx, rbx
lea rcx, [0x140151dcc]
call fcn.14005c510
test al, al
je 0x14009aa1a
add rbx, 4
mov qword [rsp + 0xd8], rbx
or r10d, 4
mov dword [rsp + 0x70], r10d
jmp 0x14009aa56
mov r8d, 2
mov rdx, rbx
lea rcx, [0x140151dc8]
call fcn.14005c510
test al, al
je 0x14009aa4a
add rbx, 4
mov qword [rsp + 0xd8], rbx
and r10d, 0xfffffffb
mov dword [rsp + 0x70], r10d
jmp 0x14009aa56
add rbx, 2
mov qword [rsp + 0xd8], rbx
lea rcx, [rsp + 0xd8]
call fcn.14005b560
mov rbx, qword [rsp + 0xd8]
cmp word [rbx], 0
jne 0x14009a8d0
jmp 0x14009aa7c
mov r10d, dword [rsp + 0x70]
mov edx, r10d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
nop
lea rcx, [rsp + 0x40]
call fcn.14005b520
nop
lea rcx, [rsp + 0x48]
call fcn.14005b520
xor eax, eax
jmp 0x14009aabc
lea rcx, [rsp + 0x40]
call fcn.14005b520
nop
lea rcx, [rsp + 0x48]
call fcn.14005b520
mov eax, 0x80070057
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret