Function at 0x417210
Capabilities:
Get file size
Read file on windows
Timestomp file

Disassembly:
mov eax, 0x226f4
call fcn.0046a9e0
mov eax, dword [0x4b38b4]
xor eax, esp
mov dword [esp + 0x226f0], eax
push ebx
push ebp
mov ebp, dword [esp + 0x22700]
push esi
or eax, 0xffffffff
push edi
mov edi, dword [esp + 0x2270c]
lea esi, [eax + 2]
push esi
xor ebx, ebx
push ebp
push edi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x40], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], eax
mov dword [esp + 0x2c], ebx
call fcn.004466f0
dec eax
add esp, 0xc
cmp eax, esi
ja 0x417288
push str.RESTORE_HEADER_NOT_FOR_SYS_DEVICE
call fcn.00433210
add esp, 4
cmp eax, 6
jne 0x417281
call fcn.00416770
xor eax, eax
jmp 0x417a2f
push edi
call fcn.00440aa0
add esp, 4
test eax, eax
je 0x4172a9
push str.DISMOUNT_FIRST
call fcn.00432f40
add esp, 4
xor eax, eax
jmp 0x417a2f
push edi
call fcn.0043e980
add esp, 4
test eax, eax
jne 0x4172c6
push ebp
call fcn.00433e20
add esp, 4
xor eax, eax
jmp 0x417a2f
lea eax, [esp + 0x4c]
push ebx
push eax
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], str.HEADER_RESTORE_EXTERNAL_INTERNAL
mov dword [esp + 0x5c], str.HEADER_RESTORE_INTERNAL
mov dword [esp + 0x60], str.HEADER_RESTORE_EXTERNAL
mov dword [esp + 0x64], str.IDCANCEL
mov dword [esp + 0x68], ebx
call fcn.00435ba0
add esp, 8
sub eax, 1
je 0x417310
sub eax, 1
jne 0x417281
mov dword [esp + 0x28], ebx
jmp 0x417314
mov dword [esp + 0x28], esi
mov dword [esp + 0x98], ebx
call fcn.004309a0
cmp dword [esp + 0x28], ebx
je 0x41749d
lea ebx, [ebx]
push 0x104
push edi
push 0x4b8868
call fcn.0046adb0
mov ecx, dword [0x4dc3d0]
add esp, 0xc
push 0x4b85d0
push 0x4155e0
push ebp
push 0x68
push ecx
mov dword [0x4b87f8], ebx
mov dword [0x4b4e20], 1
call dword [sym.imp.USER32.dll_DialogBoxParamW]
cmp eax, 1
jne 0x4173e0
call fcn.004309a0
cmp dword [0x4dc3a4], ebx
je 0x417396
mov eax, dword [0x4dc3a8]
cmp eax, ebx
je 0x417396
push eax
push 0x4b85d0
call fcn.004493b0
add esp, 8
mov edx, dword [0x4b1188]
push 1
push edx
push 1
push 0x4b85d0
lea eax, [esp + 0xa8]
push edi
push eax
call fcn.00435bf0
add esp, 0x18
mov esi, eax
call fcn.00433ac0
cmp esi, ebx
je 0x41740e
cmp esi, 3
jne 0x41793f
mov ebp, dword [esp + 0x1c]
push esi
push ebp
call fcn.0043c5a0
add esp, 8
xor ebx, ebx
jmp 0x417330
mov edx, 0x4b8814
mov ecx, 0x48
mov dword [0x4b85d0], ebx
mov esi, ecx
mov eax, edx
mov byte [eax], 0
inc eax
sub esi, 1
jne 0x4173f4
lea ecx, [ecx]
dec ecx
mov byte [edx], 0
inc edx
cmp ecx, ebx
jne 0x417400
jmp 0x41793d
mov eax, dword [esp + 0x9c]
cmp dword [eax + 0x443c], ebx
je 0x41742c
push str.VOLUME_HAS_NO_BACKUP_HEADER
call fcn.00432fe0
jmp 0x41793a
push ebx
push 0x4b85d0
push eax
lea ecx, [esp + 0x50c]
push ebx
push ecx
call fcn.00435fe0
mov esi, eax
add esp, 0x14
cmp esi, ebx
jne 0x41793f
mov edx, dword [esp + 0x9c]
mov eax, dword [edx + 0x29a0]
neg eax
sbb eax, eax
push 0
and eax, 0x10000
cdq
push 0
push edx
push eax
mov eax, dword [esp + 0xb4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x417929
mov edx, dword [esp + 0xa4]
mov eax, dword [esp + 0xa0]
lea ecx, [esp + 0x500]
push ecx
push edx
jmp 0x41791c
push edi
push str.CONFIRM_VOL_HEADER_RESTORE
call fcn.0044ab30
add esp, 4
push eax
lea ecx, [esp + 0x708]
push ecx
call fcn.00409e10
mov edx, dword [0x4dc368]
add esp, 0xc
push 0x134
push edx
lea eax, [esp + 0x708]
push eax
push ebp
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
je 0x41793d
mov ecx, dword [0x4dc37c]
push 0
push 0
push ecx
lea edx, [esp + 0x408]
push edx
push str.OPEN_TITLE
push ebp
call fcn.00439b30
add esp, 0x18
test eax, eax
je 0x41793d
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0
push 3
push 0
push 1
push SysReAllocStringLen
lea eax, [esp + 0x414]
push eax
call ebx
mov dword [esp + 0x2c], eax
cmp eax, 0xffffffff
je 0x41793f
lea ecx, [esp + 0x44]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x41793f
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0xf4]
push edi
push eax
call fcn.0042fc30
add esp, 0xc
cmp dword [esp + 0x24], 0
jne 0x417585
xor eax, eax
jmp 0x417570
mov cl, byte [esp + eax + 0xf0]
mov byte [esp + eax + 0x1f4], cl
inc eax
test cl, cl
jne 0x417570
jmp 0x4175b3
push 0
lea ecx, [esp + 0x1f8]
push ecx
lea edx, [esp + 0x300]
push edx
lea eax, [esp + 0xfc]
push eax
call fcn.0042fc90
add esp, 0x10
mov dword [esp + 0x34], eax
test eax, eax
jne 0x41793f
push 0
push 0
push 3
push 0
push 1
push 0xc0000000
lea ecx, [esp + 0x20c]
push ecx
call ebx
mov ebx, eax
mov dword [esp + 0x18], ebx
cmp ebx, 0xffffffff
je 0x41793f
cmp dword [esp + 0x24], 0
je 0x41767a
lea edx, [esp + 0xd0]
push edx
push edi
call fcn.004325d0
add esp, 8
test eax, eax
je 0x41760b
mov eax, dword [esp + 0xd8]
mov edx, dword [esp + 0xdc]
jmp 0x417666
push 0
lea ecx, [esp + 0x70]
push ecx
push 0x18
lea edx, [esp + 0x7c]
push edx
push 0
push 0
push 0x70000
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x41793f
mov eax, dword [esp + 0x7c]
mul dword [esp + 0x80]
mov ecx, dword [esp + 0x84]
push 0
push ecx
push edx
push eax
call fcn.0046b780
mov ecx, dword [esp + 0x74]
push ecx
mov ecx, dword [esp + 0x74]
push ecx
push edx
push eax
call fcn.0046b780
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
or eax, edx
mov dword [esp + 0x14], edx
jne 0x41769e
lea esi, [eax + 7]
jmp 0x41793f
lea ecx, [esp + 0x3c]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x41793f
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
cmp dword [esp + 0x24], 0
jne 0x4176d4
cmp dword [0x4b1188], 0
je 0x4176d4
lea ecx, [esp + 0x64]
push ecx
lea edx, [esp + 0x94]
push edx
lea eax, [esp + 0x90]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x2c]
push 0
lea ecx, [esp + 0x3c]
push ecx
push 0x20000
lea edx, [esp + 0x270c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41793f
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x44]
xor ecx, ecx
cmp eax, edx
jne 0x417711
mov eax, dword [esp + 0x48]
cmp ecx, eax
je 0x41771b
mov esi, 7
jmp 0x41793f
cmp edx, 0x400
jne 0x417727
test eax, eax
je 0x417746
cmp edx, 0x20000
jne 0x417733
test eax, eax
je 0x417742
push str.HEADER_BACKUP_SIZE_INCORRECT
call fcn.00432fe0
jmp 0x41793a
xor bl, bl
jmp 0x417748
mov bl, 1
push 0
mov eax, str.ENTER_HEADER_BACKUP_PASSWORD
mov ecx, 0x4b85d0
mov edx, ebp
call fcn.004161e0
add esp, 4
test eax, eax
je 0x41793d
invalid
invalid
movsb byte es:[edi], byte [esi]