Function at 0x6640d850
Capabilities:
Check if file exists
Timestomp file

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x27c
mov eax, dword [eax + 0xa8]
mov dword [esp + 4], eax
movzx eax, word [esi + 0x98]
mov dword [esp], eax
call fcn.6642fb90
cmp bl, 8
ja case.default.0x6640d885
movzx ebx, bl
mov edx, eax
jmp dword [ebx*4 + 0x66448004]
cmp bl, 0xff
jne 0x6640e060
test edi, edi
jne 0x6640e060
cmp dword [esi + 0xb4], 0x5053
jne 0x6640e060
mov eax, dword [esi + 0xac]
movzx edx, al
cmp al, 0x39
je 0x6640e395
cmp edx, 0x56
je 0x6640e382
test byte [0x664447b0], 2
je 0x6640e04c
movzx edx, word [esi + 0x94]
movzx eax, ax
mov dword [esp + 0x34], edx
movzx edx, word [esi + 0x98]
mov dword [esp + 0x30], edx
movzx edx, word [esi + 0x9c]
mov dword [esp + 0x2c], edx
movzx edx, word [esi + 0xa0]
mov dword [esp + 0x28], edx
movzx edx, word [esi + 0xa8]
mov dword [esp + 0x24], edx
jmp 0x6640e0a7
movzx eax, byte [0x664447b0]
test edi, edi
je 0x6640e048
test al, 8
jne 0x6640e298
lea ebx, [ebp - 0x220]
mov dword [esp + 8], edx
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
sub esp, 0x18
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x40000000
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov edi, eax
cmp eax, 0xffffffff
je 0x6640e100
movzx eax, word [esi + 0xac]
lea ebx, [ebp - 0x228]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
movzx eax, word [esi + 0x9c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_DosDateTimeToFileTime]
sub esp, 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
jmp 0x6640ddc5
movzx eax, byte [0x664447b0]
test edi, edi
je 0x6640e048
test al, 8
jne 0x6640e318
lea ebx, [ebp - 0x220]
mov dword [esp + 8], edx
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
sub esp, 0x18
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov edi, eax
cmp eax, 0xffffffff
je 0x6640e100
lea edx, [ebp - 0x228]
mov dword [esp + 0xc], 0
mov dword [esp + 4], edx
mov dword [esp + 8], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetFileTime]
lea edx, [ebp - 0x228]
sub esp, 0x10
test eax, eax
mov ebx, eax
je 0x6640deaa
lea eax, [ebp - 0x22a]
mov dword [esp], edx
mov dword [esp + 8], eax
lea eax, [ebp - 0x22c]
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FileTimeToDosDateTime]
movzx eax, word [ebp - 0x22c]
and dword [esi + 0xa0], 0xffff0000
sub esp, 0xc
mov word [esi + 0x9c], ax
movzx eax, word [ebp - 0x22a]
mov word [esi + 0xac], ax
jmp 0x6640deaa
movzx eax, byte [0x664447b0]
test edi, edi
je 0x6640e048
test al, 8
jne 0x6640e2d8
lea ebx, [ebp - 0x220]
mov dword [esp + 8], edx
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
sub esp, 0x18
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x40000000
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov edi, eax
cmp eax, 0xffffffff
je 0x6640e100
movzx eax, word [esi + 0xac]
lea ebx, [ebp - 0x228]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
movzx eax, word [esi + 0x9c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_DosDateTimeToFileTime]
sub esp, 0xc
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0
jmp 0x6640ddc5
movzx eax, byte [0x664447b0]
test edi, edi
je 0x6640e048
test al, 8
jne 0x6640e258
lea ebx, [ebp - 0x220]
mov dword [esp + 8], edx
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
sub esp, 0x18
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov edi, eax
cmp eax, 0xffffffff
je 0x6640e100
lea edx, [ebp - 0x228]
mov dword [esp + 8], 0
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetFileTime]
lea edx, [ebp - 0x228]
sub esp, 0x10
test eax, eax
mov ebx, eax
je 0x6640deaa
lea eax, [ebp - 0x22a]
mov dword [esp], edx
mov dword [esp + 8], eax
lea eax, [ebp - 0x22c]
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FileTimeToDosDateTime]
movzx eax, word [ebp - 0x22c]
sub esp, 0xc
mov word [esi + 0x9c], ax
movzx eax, word [ebp - 0x22a]
mov word [esi + 0xac], ax
jmp 0x6640deaa
movzx eax, byte [0x664447b0]
test edi, edi
je 0x6640e048
test al, 8
jne 0x6640e1d8
lea ebx, [ebp - 0x220]
mov dword [esp + 8], edx
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
sub esp, 0x18
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x40000000
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov edi, eax
cmp eax, 0xffffffff
je 0x6640e100
movzx eax, word [esi + 0x9c]
lea ebx, [ebp - 0x228]
mov dword [esp + 4], 0
mov dword [esp + 8], ebx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_DosDateTimeToFileTime]
sub esp, 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_SetFileTime]
sub esp, 0x10
mov ebx, eax
jmp 0x6640deaa
movzx eax, byte [0x664447b0]
test edi, edi
je 0x6640e048
test al, 8
jne 0x6640e218
lea ebx, [ebp - 0x220]
mov dword [esp + 8], edx
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
sub esp, 0x18
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov edi, eax
cmp eax, 0xffffffff
je 0x6640e100
lea edx, [ebp - 0x228]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetFileTime]
lea edx, [ebp - 0x228]
sub esp, 0x10
test eax, eax
mov ebx, eax
jne 0x6640e351
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, ebx
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x664447b0], 8
jne 0x6640e190
mov dword [esp + 8], edx
lea ebx, [ebp - 0x220]
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
movzx eax, word [esi + 0xac]
sub esp, 0x18
mov dword [esp], ebx
xor ebx, ebx
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
sub esp, 8
test eax, eax
setne bl
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x664447b0], 8
jne 0x6640e150
mov dword [esp + 8], edx
lea ebx, [ebp - 0x220]
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
sub esp, 0x18
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetCompressedFileSizeW]
sub esp, 8
cmp eax, 0xffffffff
je 0x6640e100
mov word [esi + 0xb0], ax
shr eax, 0x10
mov ebx, 1
mov word [esi + 0xa8], ax
jmp 0x6640df21
test byte [0x664447b0], 8
jne 0x6640e110
mov dword [esp + 0x14], 0x104
lea ebx, [ebp - 0x220]
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
sub esp, 0x18
test eax, eax
je 0x6640e100
movzx eax, word [ebp + eax*2 - 0x222]
cmp ax, 0x2f
je 0x6640e100
cmp ax, 0x5c
je 0x6640e100
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
sub esp, 4
cmp eax, 0xffffffff
je 0x6640e100
movzx eax, ax
mov word [esi + 0xac], ax
test edi, edi
jne 0x6640e04c
mov word [esi + 0xb0], ax
jmp 0x6640e04c
test al, 2
jne 0x6640e069
lea esp, [ebp - 0xc]
mov ebx, 1
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x664447b0], 2
je 0x6640e04c
movzx eax, word [esi + 0x94]
mov dword [esp + 0x34], eax
movzx eax, word [esi + 0x98]
mov dword [esp + 0x30], eax
movzx eax, word [esi + 0x9c]
mov dword [esp + 0x2c], eax
movzx eax, word [esi + 0xa0]
mov dword [esp + 0x28], eax
movzx eax, word [esi + 0xa8]
mov dword [esp + 0x24], eax
movzx eax, word [esi + 0xac]
mov dword [esp + 0x20], eax
movzx eax, word [esi + 0xa4]
mov dword [esp + 0x14], 0x21
mov dword [esp + 0x10], 0x21
mov dword [esp + 0xc], 0x66447e88
mov dword [esp + 0x1c], eax
movzx eax, word [esi + 0xb0]
mov dword [esp + 8], str.INT21_FileAttributes
mov dword [esp + 4], 0x664447b0
mov dword [esp], 1
mov dword [esp + 0x18], eax
call fcn.6640d110
jmp 0x6640e04c
lea esp, [ebp - 0xc]
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.GET_FILE_ATTRIBUTES_for__s_n
mov dword [esp + 8], str.INT21_FileAttributes
mov dword [esp + 4], 0x664447b0
mov dword [esp], 3
mov dword [ebp - 0x23c], eax
call fcn.6640d110
mov edx, dword [ebp - 0x23c]
jmp 0x6640dfbd
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.GET_COMPRESSED_FILE_SIZE_for__s_n
mov dword [esp + 8], str.INT21_FileAttributes
mov dword [esp + 4], 0x664447b0
mov dword [esp], 3
mov dword [ebp - 0x23c], eax
call fcn.6640d110
mov edx, dword [ebp - 0x23c]
jmp 0x6640df3d
mov dword [esp + 0x14], eax
mov dword [ebp - 0x23c], eax
movzx eax, word [esi + 0xac]
mov dword [esp + 0xc], str.SET_FILE_ATTRIBUTES_0x_02x_for__s_n
mov dword [esp + 8], str.INT21_FileAttributes
mov dword [esp + 4], 0x664447b0
mov dword [esp + 0x10], eax
mov dword [esp], 3
call fcn.6640d110
mov edx, dword [ebp - 0x23c]
jmp 0x6640decd
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.SET_FILE_LAST_ACCESS_DATE__file__s_n
mov dword [esp + 8], str.INT21_FileAttributes
mov dword [esp + 4], 0x664447b0
mov dword [esp], 3
mov dword [ebp - 0x23c], edx
call fcn.6640d110
mov edx, dword [ebp - 0x23c]
jmp 0x6640dd0f
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.GET_FILE_LAST_ACCESS_DATE__file__s_n
mov dword [esp + 8], str.INT21_FileAttributes
mov dword [esp + 4], 0x664447b0
mov dword [esp], 3
mov dword [ebp - 0x23c], edx
call fcn.6640d110
mov edx, dword [ebp - 0x23c]
jmp 0x6640ddf7
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.GET_FILE_LAST_WRITTEN_DATE_AND_TIME__file__s_n
mov dword [esp + 8], str.INT21_FileAttributes
mov dword [esp + 4], 0x664447b0
mov dword [esp], 3
mov dword [ebp - 0x23c], edx
call fcn.6640d110
mov edx, dword [ebp - 0x23c]
jmp 0x6640dbff
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.SET_FILE_CREATION_DATE_AND_TIME__file__s_n
mov dword [esp + 8], str.INT21_FileAttributes
mov dword [esp + 4], 0x664447b0
mov dword [esp], 3
mov dword [ebp - 0x23c], edx
call fcn.6640d110
mov edx, dword [ebp - 0x23c]
jmp 0x6640d937
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.SET_FILE_LAST_WRITTEN_DATE_AND_TIME__file__s_n
mov dword [esp + 8], str.INT21_FileAttributes
mov dword [esp + 4], 0x664447b0
mov dword [esp], 3
mov dword [ebp - 0x23c], edx
call fcn.6640d110
mov edx, dword [ebp - 0x23c]
jmp 0x6640db27
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.GET_FILE_CREATION_DATE_AND_TIME__file__s_n
mov dword [esp + 8], str.INT21_FileAttributes
mov dword [esp + 4], 0x664447b0
mov dword [esp], 3
mov dword [ebp - 0x23c], edx
call fcn.6640d110
mov edx, dword [ebp - 0x23c]
jmp 0x6640da0f
lea eax, [ebp - 0x22c]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_FileTimeToDosDateTime]
movzx eax, word [ebp - 0x22c]
sub esp, 0xc
mov word [esi + 0x9c], ax
jmp 0x6640deaa
mov eax, esi
xor ebx, ebx
call fcn.6640d620
test eax, eax
setne bl
jmp 0x6640df21
mov eax, esi
xor ebx, ebx
call fcn.6640d740
test eax, eax
setne bl
jmp 0x6640df21