Function at 0x464b80
Capabilities:
Get file size
Read file on windows
Timestomp file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4058
call fcn.004e1f60
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_CreateFileW]
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0
push 3
push 0
push 3
push SysReAllocString
push eax
mov dword [ebp - 0x402c], 0
mov dword [ebp - 0x4018], 0
mov dword [ebp - 0x4020], 0
call esi
mov ebx, eax
mov dword [ebp - 0x401c], ebx
cmp ebx, 0xffffffff
je 0x464f49
lea eax, [ebp - 0x4028]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
test eax, eax
je 0x464f49
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push edi
call esi
mov esi, eax
mov dword [ebp - 0x4020], esi
cmp esi, 0xffffffff
je 0x464f49
mov edi, dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
lea eax, [ebp - 0x4050]
push 0
push eax
push 0
push 0
push 0
push 0
push 0x900c4
push esi
call edi
test eax, eax
je 0x464f49
push 0
push 0
push dword [ebp - 0x4024]
push dword [ebp - 0x4028]
push esi
call dword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
test eax, eax
je 0x464f49
push esi
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
test eax, eax
je 0x464f49
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
test eax, eax
jne 0x464f49
push 0x10000
call fcn.004f1588
add esp, 4
mov dword [ebp - 0x402c], eax
test eax, eax
je 0x464f49
push dword [ebp - 0x4024]
push dword [ebp - 0x4028]
call fcn.00459cb0
mov eax, dword [ebp - 0x4028]
xorps xmm0, xmm0
mov dword [ebp - 0x400c], eax
add esp, 8
mov eax, dword [ebp - 0x4024]
movlpd qword [ebp - 0x4014], xmm0
mov dword [ebp - 0x4008], eax
nop dword [eax]
push 0
lea eax, [ebp - 0x4040]
push eax
push 0x4000
lea eax, [ebp - 0x4004]
push eax
push 0x10
lea eax, [ebp - 0x4014]
push eax
push 0x940cf
push ebx
call edi
mov dword [ebp - 0x404c], eax
test eax, eax
jne 0x464d21
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xea
jne 0x464ee1
mov ecx, dword [ebp - 0x4040]
shr ecx, 4
mov dword [ebp - 0x4034], ecx
mov dword [ebp - 0x4038], 0
test ecx, ecx
je 0x464ed8
lea esi, [ebp - 0x3ffc]
mov dword [ebp - 0x403c], esi
nop
mov edx, dword [esi]
mov edi, dword [esi - 8]
add edx, edi
mov ebx, dword [esi - 4]
mov esi, dword [esi + 4]
adc esi, ebx
mov dword [ebp - 0x4030], edx
mov dword [ebp - 0x4048], esi
cmp ebx, esi
jg 0x464e5d
jl 0x464d80
cmp edi, edx
jae 0x464e5d
nop dword [eax]
mov ecx, edi
mov eax, ebx
add ecx, 0x10000
adc eax, 0
cmp eax, esi
jl 0x464d9d
jg 0x464d97
cmp ecx, edx
jbe 0x464d9d
mov esi, edx
sub esi, edi
jmp 0x464da2
mov esi, 0x10000
push 0
push 0
push ebx
push edi
push dword [ebp - 0x401c]
call dword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
test eax, eax
je 0x464f43
push 0
lea eax, [ebp - 0x4044]
push eax
push esi
push dword [ebp - 0x402c]
push dword [ebp - 0x401c]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x464f43
push 0
push 0
push ebx
push edi
push dword [ebp - 0x4020]
call dword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
test eax, eax
je 0x464f43
push 0
lea eax, [ebp - 0x4044]
push eax
push esi
push dword [ebp - 0x402c]
push dword [ebp - 0x4020]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x464f43
add edi, esi
adc ebx, 0
push ebx
push edi
call fcn.00459cd0
mov eax, dword [ebp + 0x10]
add esp, 8
cmp dword [eax], 0
jne 0x464f31
mov esi, dword [ebp - 0x4048]
mov edx, dword [ebp - 0x4030]
cmp ebx, esi
jl 0x464d80
jg 0x464e57
cmp edi, edx
jb 0x464d80
mov ecx, dword [ebp - 0x4034]
mov edx, dword [ebp - 0x4038]
mov esi, dword [ebp - 0x403c]
inc edx
add esi, 0x10
mov dword [ebp - 0x4038], edx
mov dword [ebp - 0x403c], esi
cmp edx, ecx
jb 0x464d50
mov ebx, dword [ebp - 0x401c]
mov edi, dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test ecx, ecx
je 0x464ed8
shl ecx, 4
mov eax, dword [ebp + ecx - 0x400c]
add eax, dword [ebp + ecx - 0x4014]
mov edx, dword [ebp + ecx - 0x4008]
adc edx, dword [ebp + ecx - 0x4010]
mov ecx, dword [ebp - 0x4028]
sub ecx, eax
mov dword [ebp - 0x4014], eax
mov eax, dword [ebp - 0x4024]
sbb eax, edx
mov dword [ebp - 0x4010], edx
mov dword [ebp - 0x400c], ecx
mov dword [ebp - 0x4008], eax
cmp dword [ebp - 0x404c], 0
jne 0x464ef2
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xea
je 0x464ce0
push dword [ebp - 0x4024]
push dword [ebp - 0x4028]
call fcn.00459c90
add esp, 8
lea eax, [ebp - 0x4058]
push eax
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_GetFileTime]
lea eax, [ebp - 0x4058]
push eax
push 0
push 0
push dword [ebp - 0x4020]
call dword [sym.imp.KERNEL32.DLL_SetFileTime]
jmp 0x464f53
mov ebx, dword [ebp - 0x401c]
mov dword [ebp - 0x4018], 0x21
jmp 0x464f53
mov ebx, dword [ebp - 0x401c]
mov dword [ebp - 0x4018], 1
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edi, eax
push ebx
call esi
push dword [ebp - 0x4020]
call esi
push dword [ebp - 0x402c]
call fcn.004ec0b7
add esp, 4
push edi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x4018]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004e1f40
mov esp, ebp
pop ebp
ret