Function at 0x435c8b
Capabilities:
Timestomp file

Disassembly:
push 0x34
push 0x5c5e18
call fcn.0051bb70
mov dword [ebp - 0x28], edx
mov edi, ecx
mov dword [ebp - 0x3c], edi
mov ebx, dword [ebp + 8]
mov eax, dword [edi + 0xf4]
mov dword [ebp - 0x24], eax
mov esi, dword [ebx]
and esi, 8
test byte [ebx], 3
jne 0x435cca
mov ecx, 0x3ec
mov dword [edi + 0xf0], ecx
call fcn.00449d08
jmp 0x436c8e
cmp byte [ebx + 4], 0
je 0x435cd5
xor ecx, ecx
inc ecx
jmp 0x435cba
xor edx, edx
mov dword [ebp - 0x2c], edx
mov eax, dword [edi + 0x108]
test eax, eax
je 0x435cf7
mov ecx, dword [edi + 0x10c]
add edx, dword [ecx]
lea ecx, [ecx + 8]
sub eax, 1
jne 0x435cea
mov dword [ebp - 0x2c], edx
test edx, edx
jne 0x435d03
and dword [edi + 0x48], edx
jmp 0x436c91
test esi, esi
je 0x435d0f
mov esi, dword [ebx + 0x10]
mov ecx, dword [ebx + 0x14]
jmp 0x435d2d
mov esi, dword [edi + 0x110]
mov ecx, dword [edi + 0x114]
mov dword [ebp + 8], ecx
mov eax, esi
and eax, ecx
cmp eax, 0xffffffff
jne 0x435d30
mov esi, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x1c]
mov dword [ebp + 8], ecx
mov eax, edx
add eax, esi
mov dword [ebp - 0x1c], eax
push 0
pop edx
adc edx, ecx
mov dword [ebp - 0x20], edx
cmp edx, dword [ebx + 0x14]
jl 0x435dd9
jg 0x435d53
cmp eax, dword [ebx + 0x10]
jbe 0x435dd9
cmp dword [ebx + 8], 0xffffffff
je 0x435d68
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
push 0
push eax
push edx
push 4
push 0
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebx + 8], eax
test eax, eax
jne 0x435dc0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0xf0], eax
mov ecx, eax
call fcn.00449d08
mov dword [edi + 0x48], eax
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebx + 8], 0xffffffff
xor eax, eax
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], eax
mov edx, ebx
mov ecx, dword [ebp - 0x24]
call fcn.00433d83
jmp 0x436c91
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x20]
mov dword [ebx + 0x14], eax
mov edx, ebx
mov ecx, dword [ebp - 0x24]
call fcn.00433d83
mov ecx, dword [ebp + 8]
push 0
push dword [0x892c88]
push ecx
push esi
call fcn.0054e720
mov dword [ebp - 0x38], eax
sub esi, eax
mov edx, dword [ebp + 8]
sbb edx, 0
mov ecx, dword [ebp - 0x2c]
add ecx, eax
push ecx
push esi
push edx
push 2
pop esi
push esi
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp + 8], eax
test eax, eax
jne 0x435e22
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0xf0], eax
mov ecx, eax
jmp 0x435cc0
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], edx
cmp ecx, dword [edi + 0x108]
jae 0x436327
and dword [ebp - 0x34], 0
and dword [ebp - 4], 0
mov eax, dword [edi + 0x10c]
push dword [eax + ecx*8]
push dword [eax + ecx*8 + 4]
mov eax, dword [ebp + 8]
add eax, edx
add eax, dword [ebp - 0x38]
push eax
call fcn.0051c650
add esp, 0xc
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [edi + 0x10c]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
add edx, dword [eax + ecx*8]
inc ecx
jmp 0x435e26
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FlushViewOfFile]
test eax, eax
jne 0x4367bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0xf0], eax
test eax, eax
jle 0x4364b6
cmp eax, 0x17
jg 0x4363f1
je 0x4365c9
cmp eax, 8
jg 0x4363ba
je 0x4363b0
sub eax, 1
je 0x4363a6
sub eax, 1
je 0x4364b1
sub eax, 1
je 0x4364b1
sub eax, 1
je 0x436710
sub eax, 1
je 0x43639c
sub eax, 1
jne case.0x436747.10039
mov eax, 0xfffff00d
jmp 0x4364b6
mov eax, 0xfffff030
jmp 0x4364b6
mov eax, 0xfffff01c
jmp 0x4364b6
mov eax, 0xfffff027
jmp 0x4364b6
sub eax, 0xd
je case.0x436747.10046
sub eax, 1
je 0x4363b0
sub eax, 1
je 0x4364b1
sub eax, esi
je 0x4363e7
sub eax, esi
jne case.0x436747.10039
mov eax, 0xfffff035
jmp 0x4364b6
mov eax, 0xfffff03b
jmp 0x4364b6
mov ecx, 0x45d
cmp eax, ecx
jg 0x4365f5
je 0x4365c9
mov ecx, 0xcb
cmp eax, ecx
jg 0x436501
je 0x4364b1
cmp eax, 0x6e
jg 0x436489
je 0x4365c9
cmp eax, 0x40
jg 0x436460
je case.0x436747.10054
sub eax, 0x1f
je 0x4365c9
sub eax, 1
je 0x436541
sub eax, 1
je 0x436541
sub eax, 6
je 0x436482
sub eax, 0xb
jne case.0x436747.10039
mov eax, 0xfffff02f
jmp 0x4364b6
mov eax, 0xfffff013
jmp 0x4364b6
sub eax, 0x50
je 0x4364f3
sub eax, esi
je 0x436482
sub eax, 5
je case.0x436747.10046
sub eax, 0x16
jne case.0x436747.10039
mov eax, 0xfffff001
jmp 0x4364b6
mov eax, 0xfffff029
jmp 0x4364b6
cmp eax, 0x7e
jg 0x4364d5
je 0x4364b1
sub eax, 0x6f
je 0x43671a
sub eax, 1
je 0x436482
sub eax, 9
je case.0x436747.10060
sub eax, 1
je case.0x436747.10046
sub eax, 1
jne case.0x436747.10039
mov eax, 0xfffff026
mov dword [edi + 0x48], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x436c91
mov eax, 0xfffff019
jmp 0x4364b6
mov eax, 0xfffff039
jmp 0x4364b6
sub eax, 0x91
je 0x4364fa
sub eax, 0xb
je 0x4365c9
sub eax, 5
je 0x4364b1
sub eax, 0x16
jne case.0x436747.10039
mov eax, 0xfffff015
jmp 0x4364b6
mov eax, 0xfffff02d
jmp 0x4364b6
mov ecx, 0x3e3
cmp eax, ecx
jg 0x436597
je 0x4366cb
mov ecx, 0xe8
cmp eax, ecx
jg 0x436569
je case.0x436747.10058
sub eax, 0xcd
je 0x4365c9
sub eax, 1
je 0x43655f
sub eax, esi
je 0x436555
sub eax, 0x16
je case.0x436747.10058
sub eax, 1
jne case.0x436747.10039
mov eax, 0xfffff00e
jmp 0x4364b6
mov eax, 0xfffff031
jmp 0x4364b6
mov eax, 0xfffff003
jmp 0x4364b6
mov eax, 0xfffff020
jmp 0x4364b6
sub eax, 0xe9
je case.0x436747.10058
sub eax, 0x22
je 0x4364b1
sub eax, 0xa
je 0x436482
sub eax, 0x1cf
jne case.0x436747.10039
mov eax, 0xfffff004
jmp 0x4364b6
mov ecx, 0x44f
cmp eax, ecx
jg 0x4365d3
je 0x4365c9
sub eax, 0x3e6
je 0x43658d
sub eax, 6
je 0x436392
sub eax, 0x60
je 0x436482
sub eax, 1
je 0x4365c9
sub eax, 1
jne case.0x436747.10039
mov eax, 0xfffff01a
jmp 0x4364b6
sub eax, 0x450
je 0x4365c9
sub eax, esi
je 0x4365c9
sub eax, 5
je 0x4365c9
sub eax, esi
jne case.0x436747.10039
mov eax, 0xfffff010
jmp 0x4364b6
mov ecx, 0x2735
cmp eax, ecx
jg 0x43672e
je 0x436724
mov ecx, 0x5b8
cmp eax, ecx
jg 0x43668f
je case.0x436747.10046
mov ecx, 0x4cf
cmp eax, ecx
jg 0x43665e
je case.0x436747.10051
sub eax, 0x469
je 0x4365c9
sub eax, 0x24
je 0x4365c9
sub eax, 1
je 0x4365c9
sub eax, 0x3b
je case.0x436747.10061
sub eax, esi
jne case.0x436747.10039
mov eax, 0xfffff005
jmp 0x4364b6
mov eax, 0xfffff012
jmp 0x4364b6
mov eax, 0xfffff022
jmp 0x4364b6
sub eax, 0x4d0
je 0x436685
sub eax, 4
je case.0x436747.10053
sub eax, 0x4e
je 0x43639c
sub eax, 0x4f
jmp 0x4365c3
mov eax, 0xfffff011
jmp 0x4364b6
mov eax, 0xfffff017
jmp 0x4364b6
mov ecx, 0x271d
cmp eax, ecx
jg 0x4366e9
je 0x43658d
sub eax, 0x780
je 0x43658d
sub eax, 1
je 0x4366df
sub eax, 0x149
je case.0x436747.10057
sub eax, 0x85e
je 0x4364b1
sub eax, 0x15ec
jne case.0x436747.10039
mov eax, 0xfffff00f
jmp 0x4364b6
mov eax, 0xfffff02b
jmp 0x4364b6
mov eax, 0xfffff01d
jmp 0x4364b6
sub eax, 0x271e
je 0x43671a
sub eax, 8
je case.0x436747.10046
sub eax, esi
je 0x436710
sub eax, 0xb
jne case.0x436747.10039
mov eax, 0xfffff008
jmp 0x4364b6
mov eax, 0xfffff01e
jmp 0x4364b6
mov eax, 0xfffff016
jmp 0x4364b6
mov eax, 0xfffff00c
jmp 0x4364b6
mov ecx, 0x2751
cmp eax, ecx
jg 0x43679e
je 0x436685
add eax, 0xffffd8ca
cmp eax, 0x17
ja case.0x436747.10039
jmp dword [eax*4 + 0x436d03]
mov eax, 0xfffff006
jmp 0x4364b6
mov eax, 0xfffff007
jmp 0x4364b6
mov eax, 0xfffff01b
jmp 0x4364b6
mov eax, 0xfffff01f
jmp 0x4364b6
mov eax, 0xfffff024
jmp 0x4364b6
mov eax, 0xfffff02e
jmp 0x4364b6
mov eax, 0xfffff033
jmp 0x4364b6
mov eax, 0xfffff047
jmp 0x4364b6
sub eax, 0x2af9
je 0x4364b1
sub eax, 3
je 0x4364b1
mov eax, 0xfffff002
jmp 0x4364b6
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
jne 0x436c49
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0xf0], eax
test eax, eax
jle 0x436c8e
cmp eax, 0x17
jg 0x436884
je 0x436a68
cmp eax, 8
jg 0x43684d
je 0x436843
sub eax, 1
je 0x436839
sub eax, 1
je 0x436950
sub eax, 1
je 0x436950
sub eax, 1
je 0x436baf
sub eax, 1
je 0x43682f
sub eax, 1
jne case.0x436be6.10039
mov eax, 0xfffff00d
jmp 0x436c8e
mov eax, 0xfffff030
jmp 0x436c8e
mov eax, 0xfffff01c
jmp 0x436c8e
mov eax, 0xfffff027
jmp 0x436c8e
sub eax, 0xd
je case.0x436be6.10046
sub eax, 1
je 0x436843
sub eax, 1
je 0x436950
sub eax, esi
je 0x43687a
sub eax, esi
jne case.0x436be6.10039
mov eax, 0xfffff035
jmp 0x436c8e
mov eax, 0xfffff03b
jmp 0x436c8e
mov ecx, 0x45d
cmp eax, ecx
jg 0x436a94
je 0x436a68
mov ecx, 0xcb
cmp eax, ecx
jg 0x4369a0
je 0x436950
cmp eax, 0x6e
jg 0x436928
je 0x436a68
cmp eax, 0x40
jg 0x4368f9
je case.0x436be6.10054
sub eax, 0x1f
je 0x436a68
sub eax, 1
je 0x4369e0
sub eax, 1
je 0x4369e0
sub eax, 6
je 0x43691e
sub eax, 0xb
jne case.0x436be6.10039
mov eax, 0xfffff02f
jmp 0x436c8e
mov eax, 0xfffff013
jmp 0x436c8e
sub eax, 0x50
je 0x43698c
sub eax, esi
je 0x43691e
sub eax, 5
je case.0x436be6.10046
sub eax, 0x16
jne case.0x436be6.10039
mov eax, 0xfffff001
jmp 0x436c8e
mov eax, 0xfffff029
jmp 0x436c8e
cmp eax, 0x7e
jg 0x43696e
je 0x436950
sub eax, 0x6f
je 0x436bb9
sub eax, 1
je 0x43691e
sub eax, 9
je case.0x436be6.10060
sub eax, 1
je case.0x436be6.10046
sub eax, 1
jne case.0x436be6.10039
mov eax, 0xfffff026
jmp 0x436c8e
mov eax, 0xfffff019
jmp 0x436c8e
mov eax, 0xfffff039
jmp 0x436c8e
sub eax, 0x91
je 0x436996
sub eax, 0xb
je 0x436a68
sub eax, 5
je 0x436950
sub eax, 0x16
jne case.0x436be6.10039
mov eax, 0xfffff015
jmp 0x436c8e
mov eax, 0xfffff02d
jmp 0x436c8e
mov ecx, 0x3e3
cmp eax, ecx
jg 0x436a36
je 0x436b6a
mov ecx, 0xe8
cmp eax, ecx
jg 0x436a08
je case.0x436be6.10058
sub eax, 0xcd
je 0x436a68
sub eax, 1
je 0x4369fe
sub eax, esi
je 0x4369f4
sub eax, 0x16
je case.0x436be6.10058
sub eax, 1
jne case.0x436be6.10039
mov eax, 0xfffff00e
jmp 0x436c8e
mov eax, 0xfffff031
jmp 0x436c8e
mov eax, 0xfffff003
jmp 0x436c8e
mov eax, 0xfffff020
jmp 0x436c8e
sub eax, 0xe9
je case.0x436be6.10058
sub eax, 0x22
je 0x436950
sub eax, 0xa
je 0x43691e
sub eax, 0x1cf
jne case.0x436be6.10039
mov eax, 0xfffff004
jmp 0x436c8e
mov ecx, 0x44f
cmp eax, ecx
jg 0x436a72
je 0x436a68
sub eax, 0x3e6
je 0x436a2c
sub eax, 6
je 0x436825
sub eax, 0x60
je 0x43691e
sub eax, 1
je 0x436a68
sub eax, 1
jne case.0x436be6.10039
mov eax, 0xfffff01a
jmp 0x436c8e
sub eax, 0x450
je 0x436a68
sub eax, esi
je 0x436a68
sub eax, 5
je 0x436a68
sub eax, esi
jne case.0x436be6.10039
mov eax, 0xfffff010
jmp 0x436c8e
mov ecx, 0x2735
cmp eax, ecx
jg 0x436bcd
je 0x436bc3
mov ecx, 0x5b8
cmp eax, ecx
jg 0x436b2e
je case.0x436be6.10046
mov ecx, 0x4cf
cmp eax, ecx
jg 0x436afd
je case.0x436be6.10051
sub eax, 0x469
je 0x436a68
sub eax, 0x24
je 0x436a68
sub eax, 1
je 0x436a68
sub eax, 0x3b
je case.0x436be6.10061
sub eax, esi
jne case.0x436be6.10039
mov eax, 0xfffff005
jmp 0x436c8e
mov eax, 0xfffff012
jmp 0x436c8e
mov eax, 0xfffff022
jmp 0x436c8e
sub eax, 0x4d0
je 0x436b24
sub eax, 4
je case.0x436be6.10053
sub eax, 0x4e
je 0x43682f
sub eax, 0x4f
jmp 0x436a62
mov eax, 0xfffff011
jmp 0x436c8e
mov eax, 0xfffff017
jmp 0x436c8e
mov ecx, 0x271d
cmp eax, ecx
jg 0x436b88
je 0x436a2c
sub eax, 0x780
je 0x436a2c
sub eax, 1
je 0x436b7e
sub eax, 0x149
je case.0x436be6.10057
sub eax, 0x85e
je 0x436950
sub eax, 0x15ec
jne case.0x436be6.10039
mov eax, 0xfffff00f
jmp 0x436c8e
mov eax, 0xfffff02b
jmp 0x436c8e
mov eax, 0xfffff01d
jmp 0x436c8e
sub eax, 0x271e
je 0x436bb9
sub eax, 8
je case.0x436be6.10046
sub eax, esi
je 0x436baf
sub eax, 0xb
jne case.0x436be6.10039
mov eax, 0xfffff008
jmp 0x436c8e
mov eax, 0xfffff01e
jmp 0x436c8e
mov eax, 0xfffff016
jmp 0x436c8e
mov eax, 0xfffff00c
jmp 0x436c8e
mov ecx, 0x2751
cmp eax, ecx
jg 0x436c2e
je 0x436b24
add eax, 0xffffd8ca
cmp eax, 0x17
ja case.0x436be6.10039
jmp dword [eax*4 + 0x436d63]
mov eax, 0xfffff006
jmp 0x436c8e
mov eax, 0xfffff007
jmp 0x436c8e
mov eax, 0xfffff01b
jmp 0x436c8e
mov eax, 0xfffff01f
jmp 0x436c8e
mov eax, 0xfffff024
jmp 0x436c8e
mov eax, 0xfffff02e
jmp 0x436c8e
mov eax, 0xfffff033
jmp 0x436c8e
mov eax, 0xfffff047
jmp 0x436c8e
sub eax, 0x2af9
je 0x436950
sub eax, 3
je 0x436950
mov eax, 0xfffff002
jmp 0x436c8e
mov eax, dword [edi + 0x110]
and eax, dword [edi + 0x114]
cmp eax, 0xffffffff
jne 0x436c70
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [ebx + 0x1c], eax
mov edx, ebx
mov ecx, dword [ebp - 0x24]
call fcn.00433d83
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov eax, dword [ebp - 0x2c]
mov dword [edi + 0x48], eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret