Function at 0x4595e0
Capabilities:
Delete file
Read file on windows
Timestomp file
Unmount volume via ioctl
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x12c]
sub esp, 0x12c
push 0xffffffffffffffff
push 0x4afe6e
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x4ecba0]
xor eax, ebp
mov dword [ebp + 0x128], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], 1
call fcn.004778a9
mov eax, dword [ebp + 0x134]
xor edi, edi
push 1
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x20], esp
mov esi, esp
push eax
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp], edi
mov dword [ebp + 4], edi
mov dword [ebp + 8], edi
mov dword [ebp + 0xc], edi
mov dword [ebp + 0x10], edi
mov dword [ebp + 0x14], edi
mov byte [ebp - 4], 3
call fcn.00409450
add eax, 0x10
add esp, 4
mov ecx, ebx
mov dword [esi], eax
call fcn.004592d0
fnstcw word [ebp - 0x12]
movzx eax, word [ebp - 0x12]
or eax, 0xc00
mov dword [ebp - 0x20], eax
push edi
push ecx
fldcw word [ebp - 0x20]
mov dword [ebp - 0x2c], esp
mov esi, esp
fistp qword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x138]
fldcw word [ebp - 0x12]
add eax, 0xfffffff0
push eax
call fcn.00409450
add eax, 0x10
add esp, 4
mov ecx, ebx
mov dword [esi], eax
call fcn.004583c0
test al, al
je 0x4596cb
mov ecx, dword [ebp + 0x138]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp + 0x134]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
push edi
push 0x8000000
push 3
push edi
push 1
push SysReAllocString
push edx
call ebx
mov esi, eax
mov dword [ebp - 0x2c], esi
cmp esi, 0xffffffff
jne 0x459780
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp + 0x134]
push eax
push 0x6b4
push str.CUSBUtility::CopyFileMem
push str._s:_d:__INVALID_HANDLE_VALUE_Fail____file1__s____dwErrorCode__d
call fcn.0044b650
add esp, 0x14
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.004779c2
mov eax, dword [ebp + 0x134]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45974e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 0x138]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x459c39
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x459c39
mov ecx, dword [ebp + 0x138]
push edi
push 0x8000080
push 4
push edi
push 2
push 0x40000000
push ecx
call ebx
mov dword [ebp - 0x24], eax
cmp eax, 0xffffffff
jne 0x459839
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 0x138]
push eax
push edx
push 0x6bc
push str.CUSBUtility::CopyFileMem
push str._s:_d:__INVALID_HANDLE_VALUE_Fail____file2__s____dwErrorCode__d
call fcn.0044b7f0
add esp, 0x14
cmp esi, edi
je 0x4597d5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.004779c2
mov eax, dword [ebp + 0x134]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x459807
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 0x138]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x459c39
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x459c39
mov eax, dword [ebp - 0x20]
xor ebx, ebx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ebx
jmp 0x45984e
mov eax, dword [ebp - 0x38]
mov ebx, dword [ebp - 0x34]
xor edi, edi
cmp ebx, edi
ja 0x459859
cmp eax, 0x4000000
jbe 0x459860
mov esi, 0x4000000
jmp 0x459862
mov esi, eax
cmp dword [ebp - 0x30], edi
jne 0x45986f
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
jmp 0x459882
mov ecx, dword [ebp - 0x20]
xor edx, edx
sub ecx, dword [ebp - 0x1c]
sbb edx, dword [ebp - 0x18]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], edx
xor edi, edi
sub eax, esi
mov dword [ebp - 0x1c], eax
mov eax, ebx
sbb eax, edi
push esi
mov dword [ebp - 0x18], eax
call fcn.00490201
mov ebx, eax
add esp, 4
mov dword [ebp - 0x3c], ebx
test ebx, ebx
jne 0x45992d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x134]
push eax
push esi
push ecx
push 0x6d3
push str.CUSBUtility::CopyFileMem
push str._s:_d:_File__memory_allocated_Fail___:_File1:_s___dwSizeFile1___lld__dwErrorCode__d
call fcn.0044b650
add esp, 0x18
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.004779c2
mov eax, dword [ebp + 0x134]
add eax, 0xfffffff0
mov byte [ebp - 4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4598fb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 0x138]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x459c39
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x459c39
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x40]
push 0
lea edx, [ebp - 0x48]
push edx
mov dword [ebx], 0
push eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x2c]
push eax
mov dword [ebp - 0x48], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [ebp - 0x2c]
push 0
lea ecx, [ebp - 0x28]
push ecx
push esi
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x45999d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp + 0x134]
push esi
push eax
push 0x6de
push str.CUSBUtility::CopyFileMem
push str._s:_d:_CompareFiles:_vReadFile__s__Len__d__Fail__dwError_d
call fcn.0044b650
add esp, 0x18
xor eax, eax
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
jmp 0x459a67
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x24]
push 0
lea ecx, [ebp - 0x48]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [ebp - 0x24]
push 0
lea ecx, [ebp - 0x28]
push ecx
push 0
push 0
push 0
push 0
push 0x90018
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [ebp - 0x24]
push 0
lea eax, [ebp - 0x28]
push eax
push esi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov byte [ebp - 0x11], al
cmp al, 1
je 0x459a20
cmp dword [ebp - 0x28], esi
jne 0x459a20
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 0x138]
push eax
push esi
push edx
push 0x6e9
push str.CUSBUtility::CopyFileMem
push str._s:_d:_CopyFileMem:_vWriteFile__s__Len__d__Fail__dwError_d
call fcn.0044b650
add esp, 0x18
xor eax, eax
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
jmp 0x459a67
movzx eax, byte [esi + ebx - 1]
mov edx, dword [ebp + 0x138]
push eax
mov eax, dword [ebp - 0x30]
mov ecx, esi
add ecx, dword [ebp - 0x44]
adc edi, dword [ebp - 0x40]
add ecx, 0xffffffff
adc edi, 0xffffffff
push edi
push ecx
push edx
push eax
push 0x6ee
push str.CUSBUtility::CopyFileMem
push str._s:_d:_ucReadCount_d__file2__s___buf__lld__x
call fcn.0044b650
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
add esp, 0x20
inc dword [ebp - 0x30]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], edx
test esi, esi
je 0x459a7b
push ebx
call fcn.00490330
add esp, 4
mov dword [ebp - 0x3c], 0
cmp dword [ebp - 0x18], 0
ja 0x459846
jb 0x459a91
cmp dword [ebp - 0x1c], 0
ja 0x459846
mov esi, dword [ebp - 0x24]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp eax, 1
je 0x459abe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x6fb
push str.CUSBUtility::CopyFileMem
push str._s:_d:_vWriteFile:_Flush_Buffer_Failed...___dwErrorCode__d
call fcn.0044b650
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
cmp eax, 1
je 0x459ae8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x700
push str.CUSBUtility::CopyFileMem
push str._s:_d:_vWriteFile:_Flush_Buffer_Failed...___dwErrorCode__d
call fcn.0044b650
add esp, 0x10
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0
lea eax, [ebp - 0x28]
push eax
push 0
push 0
push 0
push 0
push 0x90020
push esi
call edi
push 0
lea ecx, [ebp - 0x28]
push ecx
push 0
push 0
push 0
push 0
push 0x9001c
push esi
call edi
mov edi, dword [ebp - 0x2c]
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test esi, esi
je 0x459b4e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x459b59
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x134]
lea edx, [ebp]
push edx
push eax
call fcn.0047b70f
mov edx, dword [ebp + 0x138]
lea ecx, [ebp]
push ecx
push edx
call fcn.0047b8e5
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], 1
call fcn.004779c2
mov eax, dword [ebp + 0x134]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x459bae
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 0x138]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x459bd7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, byte [ebp - 0x11]
jmp 0x459c3b
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x128]
xor ecx, ebp
call fcn.0048f35c
add ebp, 0x12c
mov esp, ebp
pop ebp
ret 8