Function at 0x421330
Capabilities:
Get disk information
Timestomp file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x205a0
call fcn.0046a970
push esi
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x6cc], 0xffffffff
mov dword [ebp - 0x4ac], 0
mov dword [ebp - 0x384], 0
mov byte [ebp - 0x168], 0
push 0x103
push 0
lea eax, [ebp - 0x167]
push eax
call fcn.00469be0
add esp, 0xc
mov byte [ebp - 0x4a0], 0
push 0x103
push 0
lea ecx, [ebp - 0x49f]
push ecx
call fcn.00469be0
add esp, 0xc
mov dword [ebp - 0x5c], 0xffffffff
mov dword [ebp - 0x4c4], 0
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
je 0x4213e4
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
sub ecx, 0x20000
sbb edx, 0
mov eax, dword [ebp + 8]
mov esi, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
sub ecx, esi
sbb edx, eax
mov dword [ebp - 0x398], ecx
mov dword [ebp - 0x394], edx
jmp 0x42142e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
mov eax, dword [ecx + 0x14]
mov dword [ebp - 0x20578], edx
mov dword [ebp - 0x20574], eax
cmp dword [ebp - 0x20574], 0
ja 0x42141a
jb 0x421410
cmp dword [ebp - 0x20578], 0x40000
ja 0x42141a
mov eax, 7
jmp 0x421e47
mov dword [ebp - 0x398], 0x20000
mov dword [ebp - 0x394], 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x14]
push edx
mov eax, dword [ecx + 0x10]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
call fcn.004212b0
add esp, 0xc
mov dword [ebp - 0x390], eax
mov dword [ebp - 0x38c], edx
push 0
push 0x200
mov eax, dword [ebp - 0x38c]
push eax
mov ecx, dword [ebp - 0x390]
push ecx
call fcn.0046d4f0
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
mov edx, dword [ebp + 8]
cmp dword [edx], 0
je 0x4214b3
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
lea edx, [ebp - 0x378]
push edx
call fcn.0046ccc0
add esp, 8
lea eax, [ebp - 0x378]
push eax
call fcn.004246f0
add esp, 4
lea ecx, [ebp - 0x378]
push ecx
call fcn.00426390
add esp, 4
mov dword [ebp - 0x5c], eax
push 0x200
lea edx, [ebp - 0x6c8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualLock]
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
je 0x4214e8
mov ecx, dword [ebp - 0x390]
mov dword [ebp - 0x20580], ecx
mov edx, dword [ebp - 0x38c]
mov dword [ebp - 0x2057c], edx
jmp 0x4214fc
mov dword [ebp - 0x20580], 0
mov dword [ebp - 0x2057c], 0
push 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
push ecx
push 0
mov edx, dword [ebp - 0x38c]
push edx
mov eax, dword [ebp - 0x390]
push eax
mov ecx, dword [ebp - 0x394]
push ecx
mov edx, dword [ebp - 0x398]
push edx
mov eax, dword [ebp - 0x2057c]
push eax
mov ecx, dword [ebp - 0x20580]
push ecx
mov edx, dword [ebp - 0x38c]
push edx
mov eax, dword [ebp - 0x390]
push eax
lea ecx, [ebp - 0x4c]
push ecx
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x24]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x40]
push edx
push 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
push ecx
lea edx, [ebp - 0x6c8]
push edx
push 0
call fcn.0043d520
add esp, 0x4c
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0
je 0x4215fa
lea eax, [ebp - 0x6c8]
mov dword [ebp - 0x6d4], eax
mov dword [ebp - 0x6d0], 0x200
push 0x200
lea ecx, [ebp - 0x6c8]
push ecx
call fcn.004025c0
add esp, 8
mov edx, dword [ebp - 0x6d0]
mov eax, dword [ebp - 0x6d0]
sub eax, 1
mov dword [ebp - 0x6d0], eax
test edx, edx
je 0x4215d9
mov ecx, dword [ebp - 0x6d4]
mov byte [ecx], 0
mov edx, dword [ebp - 0x6d4]
add edx, 1
mov dword [ebp - 0x6d4], edx
jmp 0x4215a6
xor eax, eax
jne 0x42157c
push 0x200
lea ecx, [ebp - 0x6c8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualUnlock]
mov eax, dword [ebp - 0x16c]
jmp 0x421e47
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x421758
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
jne 0x421624
cmp dword [ebp - 0x384], 0
jne 0x421624
mov dword [ebp - 0x20584], 2
jmp 0x42162e
mov dword [ebp - 0x20584], 3
push 0
push 0
mov ecx, dword [ebp - 0x20584]
push ecx
push 0
push 3
push 0xc0000000
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x6cc], eax
cmp dword [ebp - 0x6cc], 0xffffffff
jne 0x42166d
mov dword [ebp - 0x16c], 1
jmp 0x421b20
mov ecx, dword [ebp - 0x6cc]
push ecx
call fcn.00427c70
add esp, 4
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
jne 0x421758
cmp dword [ebp - 0x384], 0
jne 0x421758
mov eax, dword [ebp - 0x390]
add eax, 0x20000
mov ecx, dword [ebp - 0x38c]
adc ecx, 0
mov dword [ebp - 0x6e0], eax
mov dword [ebp - 0x6dc], ecx
mov edx, dword [ebp + 8]
cmp dword [edx + 0x34], 0
je 0x4216fe
mov eax, dword [ebp + 8]
cmp dword [eax + 0x38], 0
je 0x4216fe
push 0
lea ecx, [ebp - 0x6e4]
push ecx
push 0
push 0
push 0
push 0
push 0x900c4
mov edx, dword [ebp - 0x6cc]
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x4216fe
mov dword [ebp - 0x16c], 1
jmp 0x421b20
push 0
push 0
mov eax, dword [ebp - 0x6dc]
push eax
mov ecx, dword [ebp - 0x6e0]
push ecx
mov edx, dword [ebp - 0x6cc]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x421749
mov eax, dword [ebp - 0x6cc]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x421749
push 0
push 0
push 0
mov ecx, dword [ebp - 0x6cc]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x421758
mov dword [ebp - 0x16c], 1
jmp 0x421b20
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
je 0x4217ae
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x4217ae
cmp dword [0x4c2ccc], 0
je 0x4217ae
lea ecx, [ebp - 0x4a8]
push ecx
lea edx, [ebp - 0x4b4]
push edx
lea eax, [ebp - 0x4c0]
push eax
mov ecx, dword [ebp - 0x6cc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x4217a4
mov dword [ebp - 0x4ac], 0
jmp 0x4217ae
mov dword [ebp - 0x4ac], 1
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
je 0x42186b
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
mov dword [ebp - 0x2058c], ecx
mov dword [ebp - 0x20588], edx
cmp dword [ebp - 0x20588], 0
ja 0x4217e5
cmp dword [ebp - 0x2058c], 0x4c400
jb 0x421814
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
mov dword [ebp - 0x20594], ecx
mov dword [ebp - 0x20590], edx
cmp dword [ebp - 0x20590], 0x7fff
jb 0x421823
ja 0x421814
cmp dword [ebp - 0x20594], 0xfffc0000
jbe 0x421823
mov dword [ebp - 0x16c], 7
jmp 0x421b20
mov dword [ebp - 0x6f0], 0x10000
mov dword [ebp - 0x6ec], 0
push 0
push 0
mov eax, dword [ebp - 0x6ec]
push eax
mov ecx, dword [ebp - 0x6f0]
push ecx
mov edx, dword [ebp - 0x6cc]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x421869
mov dword [ebp - 0x16c], 1
jmp 0x421b20
jmp 0x4218ba
cmp dword [ebp - 0x384], 0
je 0x4218ba
mov dword [ebp - 0x6f8], 0x20000
mov dword [ebp - 0x6f4], 0
push 0
push 0
mov eax, dword [ebp - 0x6f4]
push eax
mov ecx, dword [ebp - 0x6f8]
push ecx
mov edx, dword [ebp - 0x6cc]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x4218ba
mov dword [ebp - 0x16c], 1
jmp 0x421b20
cmp dword [ebp - 0x384], 0
jne 0x42193c
push 0x200
lea eax, [ebp - 0x6c8]
push eax
mov ecx, dword [ebp - 0x6cc]
push ecx
call dword [sym.imp.KERNEL32.dll__lwrite]
cmp eax, 0xffffffff
jne 0x4218f0
mov dword [ebp - 0x16c], 1
jmp 0x421b20
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
jne 0x42193c
push 0x1fe00
push 0
lea eax, [ebp - 0x204f8]
push eax
call fcn.00469be0
add esp, 0xc
push 0x1fe00
lea ecx, [ebp - 0x204f8]
push ecx
mov edx, dword [ebp - 0x6cc]
push edx
call dword [sym.imp.KERNEL32.dll__lwrite]
cmp eax, 0xffffffff
jne 0x42193c
mov dword [ebp - 0x16c], 1
jmp 0x421b20
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
je 0x4219ad
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x398]
mov dword [ecx + 0x4418], edx
mov eax, dword [ebp - 0x394]
mov dword [ecx + 0x441c], eax
push 0
push 0x200
mov ecx, dword [ebp - 0x394]
push ecx
mov edx, dword [ebp - 0x398]
push edx
call fcn.0046d470
mov dword [ebp - 0x2059c], eax
mov dword [ebp - 0x20598], edx
mov eax, dword [ebp - 0x2059c]
or eax, dword [ebp - 0x20598]
je 0x4219a3
mov dword [ebp - 0x16c], 7
jmp 0x421b20
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x38], 1
push 0
push 0x200
mov edx, dword [ebp - 0x394]
push edx
mov eax, dword [ebp - 0x398]
push eax
call fcn.0046d4f0
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x2c]
mov dword [ebp - 0x205a0], edx
cmp dword [ebp - 0x205a0], 0
je 0x4219f9
cmp dword [ebp - 0x205a0], 1
je 0x421a5b
cmp dword [ebp - 0x205a0], 2
je 0x4219f9
jmp 0x421b0a
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x421a19
call fcn.004224f0
test eax, eax
jne 0x421a19
mov dword [ebp - 0x16c], 1
jmp 0x421b20
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x38]
push edx
mov eax, dword [ebp - 0x4c]
push eax
mov ecx, dword [ebp - 0x6cc]
push ecx
mov edx, dword [ebp - 0x44]
push edx
mov eax, dword [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0x54]
push ecx
mov edx, dword [ebp - 0x58]
push edx
call fcn.00421e50
add esp, 0x1c
mov dword [ebp - 0x16c], eax
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x421a56
call fcn.004226e0
jmp 0x421b16
cmp dword [ebp - 0x44], 0
ja 0x421a67
cmp dword [ebp - 0x48], 0xffffffff
jbe 0x421a76
mov dword [ebp - 0x16c], 7
jmp 0x421b20
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x1c], eax
push 0xb
push str.NO_NAME
lea ecx, [ebp - 0x40]
push ecx
call fcn.00469d40
add esp, 0xc
lea edx, [ebp - 0x40]
push edx
call fcn.00422890
add esp, 4
mov eax, dword [ebp - 0x1c]
shl eax, 9
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3c]
mov dword [edx], eax
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x421acf
call fcn.004224f0
test eax, eax
jne 0x421acf
mov dword [ebp - 0x16c], 1
jmp 0x421b20
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x38]
push edx
mov eax, dword [ebp - 0x4c]
push eax
mov ecx, dword [ebp - 0x6cc]
push ecx
lea edx, [ebp - 0x40]
push edx
mov eax, dword [ebp - 0x54]
push eax
mov ecx, dword [ebp - 0x58]
push ecx
call fcn.004230b0
add esp, 0x18
mov dword [ebp - 0x16c], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
je 0x421b08
call fcn.004226e0
jmp 0x421b16
mov dword [ebp - 0x16c], 0x1e
jmp 0x421b20
mov dword [0x4c6724], 0
mov dword [0x4c6724], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x4b8], eax
lea eax, [ebp - 0x6c8]
mov dword [ebp - 0x20500], eax
mov dword [ebp - 0x204fc], 0x200
push 0x200
lea ecx, [ebp - 0x6c8]
push ecx
call fcn.004025c0
add esp, 8
mov edx, dword [ebp - 0x204fc]
mov eax, dword [ebp - 0x204fc]
sub eax, 1
mov dword [ebp - 0x204fc], eax
test edx, edx
je 0x421b93
mov ecx, dword [ebp - 0x20500]
mov byte [ecx], 0
mov edx, dword [ebp - 0x20500]
add edx, 1
mov dword [ebp - 0x20500], edx
jmp 0x421b60
xor eax, eax
jne 0x421b36
push 0x200
lea ecx, [ebp - 0x6c8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualUnlock]
cmp dword [ebp - 0x6cc], 0xffffffff
je 0x421c64
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x421bf4
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
jne 0x421bf4
cmp dword [ebp - 0x16c], 0
je 0x421bf4
push 0
push 0
push 0
mov ecx, dword [ebp - 0x6cc]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
jne 0x421bf4
mov edx, dword [ebp - 0x6cc]
push edx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, dword [ebp - 0x6cc]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
cmp dword [ebp - 0x4ac], 0
je 0x421c2c
lea ecx, [ebp - 0x4a8]
push ecx
lea edx, [ebp - 0x4b4]
push edx
lea eax, [ebp - 0x4c0]
push eax
mov ecx, dword [ebp - 0x6cc]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov edx, dword [ebp + 8]
cmp dword [edx + 0x2c], 2
jne 0x421c4e
mov eax, dword [ebp - 0x6cc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4c6720], 0
jmp 0x421c5a
mov ecx, dword [ebp - 0x6cc]
mov dword [0x4c6720], ecx
mov dword [ebp - 0x6cc], 0xffffffff
cmp dword [ebp - 0x16c], 0
je 0x421c7f
mov edx, dword [ebp - 0x4b8]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x421dfb
mov eax, dword [ebp + 8]
cmp dword [eax + 0x2c], 2
jne 0x421dfb
call fcn.00425d00
mov dword [ebp - 0x2056c], eax
push 0x64
push 0
lea ecx, [ebp - 0x20568]
push ecx
call fcn.00469be0
add esp, 0xc
cmp dword [ebp - 0x2056c], 0xffffffff
jne 0x421cc2
mov dword [ebp - 0x16c], 0x16
jmp 0x421dfb
mov dword [ebp - 0x20568], 0
mov dword [ebp - 0x20564], 0
mov dword [ebp - 0x20560], 0
mov edx, dword [0x4c2ccc]
mov dword [ebp - 0x2055c], edx
mov dword [ebp - 0x20558], 0
mov dword [ebp - 0x2050c], 0
push 1
push 0
lea eax, [ebp - 0x20568]
push eax
push 1
push 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x40]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp - 0x2056c]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x44]
push ecx
call fcn.00438bb0
add esp, 0x24
cmp eax, 1
jge 0x421d47
mov dword [ebp - 0x16c], 0x18
jmp 0x421dfb
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x30]
push eax
mov ecx, dword [ebp - 0x2056c]
push ecx
call fcn.00422380
add esp, 8
mov dword [ebp - 0x20570], eax
cmp dword [ebp - 0x20570], 1
je 0x421de3
push 0
mov edx, dword [ebp - 0x2056c]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x44]
push ecx
call fcn.0042c1b0
add esp, 0xc
cmp dword [ebp - 0x38c], 0x200
ja 0x421dca
jb 0x421d9b
cmp dword [ebp - 0x390], 0
ja 0x421dca
mov edx, dword [ebp + 8]
mov dword [edx + 0x2c], 1
mov dword [ebp - 0x384], 1
mov eax, dword [ebp + 8]
mov dword [eax + 0x38], 1
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x30], 0
jmp 0x4215fa
push str.FORMAT_NTFS_FAILED
call fcn.00427040
add esp, 4
mov dword [ebp - 0x16c], 0x1c
jmp 0x421dfb
push 0
mov edx, dword [ebp - 0x2056c]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x44]
push ecx
call fcn.0042c1b0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x4b8], eax
movsx edx, byte [ebp - 0x168]
test edx, edx
je 0x421e28
lea eax, [ebp - 0x168]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
call fcn.00424290
add esp, 8
mov eax, dword [ebp - 0x4c]
push eax
call fcn.0043aa30
add esp, 4
mov ecx, dword [ebp - 0x4b8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x16c]
pop esi
mov esp, ebp
pop ebp
ret