Function at 0x41b4e0
Capabilities:
Read file on windows
Timestomp file

Disassembly:
sub esp, 0x6c
mov ecx, dword [0x44eb90]
mov eax, dword [0x44eb8c]
mov edx, dword [0x44eb94]
push ebx
mov dword [esp + 0x20], ecx
mov cl, byte [0x44eb9c]
push ebp
push esi
push edi
mov byte [esp + 0x38], cl
mov dword [esp + 0x28], eax
mov eax, dword [0x44eb98]
mov ecx, 6
mov esi, 0x44eb74
lea edi, [esp + 0x3c]
mov dword [esp + 0x34], eax
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x30], edx
mov edx, dword [0x44eb70]
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 0x54]
or ebp, 0xffffffff
xor ebx, ebx
push 0x2000
rep stosd dword es:[edi], eax
push 0x40
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [esp + 0x10], eax
jne 0x41b598
mov edx, dword [esp + 0x8c]
test edx, edx
je 0x41b6e1
mov edi, 0x44eb5c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebp, [esp + 0x3c]
mov eax, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x41b69c
mov eax, dword [esp + 0x88]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 1
jne 0x41b6f2
xor esi, esi
mov ecx, dword [esp + 0x80]
push 0
push 0
push 3
push 0
push 1
push connect
push ecx
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x41b618
push 0
push 0x64
call fcn.0040b3a0
add esp, 8
inc esi
cmp esi, 0x32
jl 0x41b5b0
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x41b686
mov edi, 0x44eb34
or ecx, ebx
xor eax, eax
lea edx, [esp + 0x3c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x41b686
lea ecx, [esp + 0x20]
push ecx
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x41b6eb
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x41b661
lea edx, [esp + 0x3c]
mov edi, 0x44eb1c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
jl 0x41b675
push ebp
call fcn.0042111e
add esp, 4
mov eax, dword [esp + 0x14]
test eax, eax
jl 0x41b686
push eax
call fcn.0042111e
add esp, 4
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov edx, dword [esp + 0x8c]
mov ebx, dword [esp + 0x18]
test edx, edx
je 0x41b6e1
mov eax, dword [esp + 0x94]
lea ecx, [esp + 0x3c]
push eax
push ecx
mov ecx, dword [esp + 0x8c]
push eax
push ecx
lea ecx, [esp + 0x2c]
push eax
push ecx
mov ecx, dword [esp + 0x98]
push eax
push ecx
mov ecx, dword [esp + 0xb0]
push eax
lea eax, [esp + 0x4c]
push eax
push ecx
push 0x44eb04
push edx
call fcn.004205cb
add esp, 0x34
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x6c
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x80]
push 0x8000
push ecx
call fcn.004211fe
mov ebp, eax
add esp, 8
test ebp, ebp
jge 0x41b747
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x41b668
mov edi, 0x44eae8
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x3c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x41b668
mov ecx, dword [esp + 0x84]
push 0x180
push 0x8302
push ecx
call fcn.004211fe
mov ebx, eax
add esp, 0xc
test ebx, ebx
mov dword [esp + 0x14], ebx
jge 0x41b7a5
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x41b668
mov edi, 0x44eac4
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x3c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x41b668
mov ecx, dword [esp + 0x10]
push 0x2000
push ecx
push ebp
call fcn.00420ee0
mov esi, eax
add esp, 0xc
test esi, esi
jl 0x41b7ee
mov edx, dword [esp + 0x10]
push esi
push edx
push ebx
call fcn.00420c6f
add esp, 0xc
cmp eax, esi
jne 0x41b828
cmp esi, 0x2000
jne 0x41b856
mov eax, dword [esp + 0x10]
push esi
push eax
push ebp
call fcn.00420ee0
mov esi, eax
add esp, 0xc
test esi, esi
jge 0x41b7be
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x41b668
mov edi, 0x44eaa8
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x3c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x41b668
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x41b668
mov ecx, dword [esp + 0x94]
lea edx, [esp + 0x3c]
push ecx
push 0x44ea6c
push edx
call fcn.004205cb
add esp, 0xc
jmp 0x41b668
cmp dword [esp + 0x88], 1
jne 0x41b904
push ebp
call fcn.0042111e
push ebx
call fcn.0042111e
mov eax, dword [esp + 0x8c]
add esp, 8
push 0
push 0
push 3
push 0
push 1
push 0x40000000
push eax
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x41b8cc
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x41b668
mov edi, 0x44ea40
or ecx, ebx
xor eax, eax
lea edx, [esp + 0x3c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x41b668
lea ecx, [esp + 0x20]
push ecx
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x41b8fd
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x41b661
lea edx, [esp + 0x3c]
mov edi, 0x44ea28
jmp 0x41b644
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x18], 1
jmp 0x41b668