Function at 0x45e6f0
Capabilities:
Get disk information
Timestomp file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x209d4
call fcn.004e1f60
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
or esi, 0xffffffff
mov dword [ebp - 0x209b4], eax
mov dword [ebp - 0x20980], esi
lea eax, [ebp - 0xb08]
mov dword [ebp - 0x20994], esi
xor esi, esi
push 0x802
push esi
push eax
mov dword [ebp - 0x2097c], 0
mov dword [ebp - 0x209b0], 0
call fcn.004e46b0
mov ecx, dword [ebx + 0x83c]
add esp, 0xc
cmp ecx, 0x200
jl 0x45f1c8
cmp ecx, 0x1000
jg 0x45f1c8
mov eax, ecx
and eax, 0x800001ff
jns 0x45e77d
dec eax
or eax, 0xfffffe00
inc eax
jne 0x45f1c8
push edi
mov edi, dword [ebx + 4]
test edi, edi
jne 0x45e811
mov eax, dword [ebx + 0x810]
mov dword [ebp - 0x20990], eax
mov eax, dword [ebx + 0x814]
mov dword [ebp - 0x2098c], eax
mov eax, ecx
cdq
mov ecx, edx
mov dword [ebp - 0x20988], 0x20000
push ecx
push eax
push edi
push 0x20000
mov dword [ebp - 0x20984], esi
mov dword [ebp - 0x20998], eax
mov dword [ebp - 0x209ac], ecx
call fcn.004e2420
or eax, edx
jne 0x45f0cf
cmp dword [ebp - 0x2098c], esi
ja 0x45e8a3
jb 0x45e7fb
cmp dword [ebp - 0x20990], 0x40000
ja 0x45e8a3
pop edi
pop esi
mov eax, 7
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0x818]
mov edx, dword [ebx + 0x81c]
mov dword [ebp - 0x20990], eax
sub eax, dword [ebx + 0x810]
mov dword [ebp - 0x2098c], edx
sbb edx, dword [ebx + 0x814]
add eax, 0xfffe0000
mov dword [ebp - 0x20988], eax
mov eax, ecx
adc edx, 0xffffffff
mov dword [ebp - 0x20984], edx
cdq
mov ecx, edx
mov dword [ebp - 0x20998], eax
push ecx
push eax
push dword [ebp - 0x20984]
mov dword [ebp - 0x209ac], ecx
push dword [ebp - 0x20988]
call fcn.004e2420
or eax, edx
jne 0x45f0cf
mov ecx, dword [ebp - 0x20990]
mov eax, dword [ebp - 0x2098c]
add ecx, 0xfffab000
adc eax, 0xffffffff
cmp eax, 0x7fff
ja 0x45f0cf
jb 0x45e8a3
cmp ecx, 0xfff6b000
ja 0x45f0cf
push dword [ebx + 0x814]
push dword [ebx + 0x810]
push edi
call fcn.004604f0
mov ecx, eax
mov dword [ebp - 0x209a4], edx
mov eax, dword [ebp - 0x20998]
add esp, 0xc
cmp dword [ebx + 0x82c], 1
mov dword [ebp - 0x209a8], ecx
jne 0x45e8e7
cmp edx, eax
jb 0x45e8e7
ja 0x45e7fb
test ecx, ecx
jne 0x45e7fb
push dword [ebp - 0x209ac]
push eax
push edx
push ecx
call fcn.004e2b80
mov dword [ebp - 0x20998], eax
lea eax, [ebp - 0x204]
push 0x200
push eax
mov dword [ebp - 0x209ac], edx
call dword [sym.imp.KERNEL32.DLL_VirtualLock]
lea eax, [ebp - 0x20994]
push eax
lea eax, [ebp - 0xb08]
push eax
push 0
push ebx
call fcn.00460540
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x45efe1
nop word [eax + eax]
mov edi, dword [ebp - 0x20994]
mov dword [ebp - 0x20980], edi
test esi, esi
jne 0x45eacc
cmp dword [ebx + 4], 0
je 0x45e9a2
cmp dword [ebx], 0
jne 0x45e98a
cmp dword [ebx + 0x888], 0
je 0x45e98a
lea eax, [ebp - 0x209c4]
push eax
lea eax, [ebp - 0x209cc]
push eax
lea eax, [ebp - 0x209d4]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileTime]
mov dword [ebp - 0x209b0], eax
cmp dword [ebx + 4], 0
je 0x45e9a2
mov eax, dword [ebp - 0x209a8]
mov edx, eax
mov esi, dword [ebp - 0x209a4]
mov ecx, esi
jmp 0x45e9c5
mov eax, dword [ebp - 0x209a8]
xorps xmm0, xmm0
mov esi, dword [ebp - 0x209a4]
movlpd qword [ebp - 0x209a0], xmm0
mov ecx, dword [ebp - 0x2099c]
mov edx, dword [ebp - 0x209a0]
push 0
push 0
push dword [ebx + 0x83c]
push dword [ebx + 0x828]
push 0
push esi
push eax
push dword [ebp - 0x20984]
push dword [ebp - 0x20988]
push ecx
push edx
push esi
push eax
lea eax, [ebp - 0x2097c]
push eax
push 0
push dword [ebx + 0x824]
lea eax, [ebx + 0x840]
push eax
push 1
push dword [ebx + 0x820]
lea eax, [ebp - 0x204]
push eax
push 0
call fcn.004c8570
add esp, 0x54
mov dword [ebp - 0x2099c], eax
test eax, eax
jne 0x45f006
cmp dword [ebx + 4], eax
jne 0x45ea44
xorps xmm0, xmm0
movlpd qword [ebp - 0x209a0], xmm0
mov edx, dword [ebp - 0x2099c]
mov eax, dword [ebp - 0x209a0]
jmp 0x45ea4b
mov eax, 0x10000
xor edx, edx
mov ecx, dword [ebx + 0x8b8]
add ecx, eax
mov eax, dword [ebx + 0x8bc]
adc eax, edx
lea edx, [ebp - 0x204]
push edx
push eax
push ecx
push edi
push dword [ebx]
call fcn.004c9640
add esp, 0x14
test eax, eax
je 0x45effc
cmp dword [ebx], 0
jne 0x45eacc
cmp dword [ebx + 4], 0
jne 0x45ead2
push 0x1fe00
lea eax, [ebp - 0x20908]
push 0
push eax
call fcn.004e46b0
add esp, 0xc
lea eax, [ebp - 0x209bc]
push 0
push eax
push 0x1fe00
lea eax, [ebp - 0x20908]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x45effc
cmp dword [ebp - 0x209bc], 0x1fe00
jne 0x45eff2
cmp dword [ebx + 4], 0
je 0x45eafa
mov eax, dword [ebp - 0x2097c]
mov ecx, dword [ebp - 0x20988]
mov dword [eax + 0x4418], ecx
mov ecx, dword [ebp - 0x20984]
mov dword [eax + 0x441c], ecx
mov dword [ebx + 0x838], 1
mov esi, dword [ebx + 0x83c]
mov eax, esi
cdq
push edx
push eax
push dword [ebp - 0x20984]
push dword [ebp - 0x20988]
call fcn.004e2b80
push dword [ebp - 0x209b4]
mov ecx, edx
mov dword [ebp - 0x2099c], eax
push esi
push ecx
push eax
push dword [ebx + 0x8bc]
mov dword [ebp - 0x209b8], ecx
push dword [ebx + 0x8b8]
push edi
push dword [ebx]
call fcn.0042ce20
add esp, 0x20
test eax, eax
je 0x45effc
mov eax, dword [ebx + 0x82c]
sub eax, 0
je 0x45eb69
sub eax, 1
je 0x45ebf6
sub eax, 1
jne 0x45eff2
push dword [ebx + 0x838]
push dword [ebp - 0x2097c]
push dword [ebx + 0x83c]
push dword [ebp - 0x209ac]
push dword [ebp - 0x20998]
push dword [ebp - 0x209b8]
push dword [ebp - 0x2099c]
call fcn.0045f410
add esp, 0x1c
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
call fcn.0042d000
test edi, edi
jne 0x45f0c6
mov eax, dword [ebp - 0x2097c]
lea edi, [ebp - 0x304]
mov ecx, 0x40
push eax
lea esi, [eax + 0x41a8]
rep movsd dword es:[edi], dword [esi]
call fcn.004b8120
mov esi, dword [ebp - 0x209a8]
add esp, 4
cmp dword [ebx + 4], 0
mov edi, dword [ebp - 0x209a4]
mov dword [ebp - 0x2097c], 0
je 0x45ec33
mov ecx, esi
mov eax, edi
jmp 0x45ec4a
push dword [ebx + 0x838]
push dword [ebp - 0x2097c]
push dword [ebx + 0x830]
push dword [ebx + 0x83c]
push dword [ebp - 0x209ac]
push dword [ebp - 0x20998]
push dword [ebp - 0x209b8]
push dword [ebp - 0x2099c]
call fcn.0045aa80
add esp, 0x20
jmp 0x45eb9b
xorps xmm0, xmm0
movlpd qword [ebp - 0x209a0], xmm0
mov eax, dword [ebp - 0x2099c]
mov ecx, dword [ebp - 0x209a0]
push 0
push 0
push dword [ebx + 0x83c]
lea edx, [ebx + 0x840]
push dword [ebx + 0x828]
push 0
push edi
push esi
push dword [ebp - 0x20984]
push dword [ebp - 0x20988]
push eax
push ecx
push edi
push esi
lea eax, [ebp - 0x2097c]
push eax
lea eax, [ebp - 0x304]
push eax
push dword [ebx + 0x824]
lea eax, [ebp - 0x204]
push edx
push 1
push dword [ebx + 0x820]
push eax
push 0
call fcn.004c8570
mov edx, dword [ebp - 0x2098c]
add esp, 0x54
cmp dword [ebx + 4], 0
mov edi, eax
mov eax, dword [ebp - 0x20990]
jne 0x45ecbd
add eax, 0xfffe0000
jmp 0x45ecc2
add eax, 0xffff0000
mov ecx, dword [ebx + 0x8b8]
adc edx, 0xffffffff
mov esi, dword [ebp - 0x20980]
add ecx, eax
mov eax, dword [ebx + 0x8bc]
adc eax, edx
lea edx, [ebp - 0x204]
push edx
push eax
push ecx
push esi
push dword [ebx]
call fcn.004c9640
add esp, 0x14
test eax, eax
je 0x45effc
cmp dword [ebx + 4], 0
jne 0x45ed32
push 0
push 0
push dword [ebp - 0x2098c]
push dword [ebp - 0x20990]
push dword [ebx + 0x8bc]
push dword [ebx + 0x8b8]
push dword [ebp - 0x2097c]
push esi
call fcn.004c97b0
mov edi, eax
add esp, 0x20
test edi, edi
jne 0x45f0d4
cmp dword [ebx + 0x838], 0
je 0x45ed4f
cmp dword [ebx + 0x82c], 2
je 0x45ed4f
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea ecx, [ebp - 0x204]
mov edx, 0x200
mov esi, edx
mov eax, ecx
nop
mov byte [eax], 0
lea eax, [eax + 1]
sub esi, 1
jne 0x45ed60
nop dword [eax + eax]
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub edx, 1
jne 0x45ed70
push 0x200
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualUnlock]
mov esi, dword [ebp - 0x20980]
push esi
call dword [sym.imp.KERNEL32.DLL_FlushFileBuffers]
cmp dword [ebp - 0x209b0], 0
je 0x45edbf
lea eax, [ebp - 0x209c4]
push eax
lea eax, [ebp - 0x209cc]
push eax
lea eax, [ebp - 0x209d4]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
or eax, 0xffffffff
cmp word [ebp - 0xb08], 0
mov dword [ebp - 0x20980], eax
mov dword [ebp - 0x20994], eax
je 0x45ee0b
lea eax, [ebp - 0xb08]
push eax
lea eax, [ebx + 8]
push eax
call fcn.0042aae0
add esp, 8
xor ecx, ecx
movzx eax, word [ecx + 0x516968]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0xb0a], ax
test ax, ax
jne 0x45edf4
cmp dword [ebx + 0x82c], 2
jne 0x45f0d4
push 0x70
lea eax, [ebp - 0x20978]
push 0
push eax
call fcn.004e46b0
add esp, 0xc
call fcn.00428b90
mov esi, eax
cmp esi, 0xffffffff
je 0x45f09c
mov ecx, dword [ebx + 0x888]
mov edx, dword [ebx + 0x8b8]
mov eax, edx
mov dword [ebp - 0x20970], ecx
mov ecx, dword [ebx + 0x8bc]
or eax, ecx
mov dword [ebp - 0x20978], 0
mov dword [ebp - 0x20974], 0
mov dword [ebp - 0x2095c], 0
mov dword [ebp - 0x2096c], 0
mov dword [ebp - 0x20968], 0
mov dword [ebp - 0x20960], 0
mov dword [ebp - 0x2090c], 1
jne 0x45eea9
mov dword [ebp - 0x2090c], 0
push dword [ebx + 0x8c4]
lea eax, [ebp - 0x20978]
push dword [ebx + 0x8c0]
push ecx
push edx
push 1
push 0
push eax
push 1
lea eax, [ebx + 0x840]
push eax
lea eax, [ebx + 8]
push eax
push esi
push dword [ebx + 0x88c]
call fcn.004cb090
add esp, 0x30
cmp eax, 1
jl 0x45f08f
call sub.SHELL32.dll_IsUserAnAdmin
test eax, eax
jne 0x45ef18
call fcn.0041c240
test eax, eax
je 0x45ef18
push dword [ebx + 0x83c]
push dword [ebx + 0x830]
push 2
push esi
push dword [ebx + 0x88c]
call fcn.004a5530
add esp, 0x14
jmp 0x45ef2f
push dword [ebx + 0x83c]
push dword [ebx + 0x830]
push 2
push esi
call fcn.00460b20
add esp, 0x10
push 0
push esi
push dword [ebx + 0x88c]
test eax, eax
jne 0x45f06e
call fcn.004cba20
add esp, 0xc
test eax, eax
jne 0x45ef5f
push dword [ebx + 0x88c]
push str.CANT_DISMOUNT_VOLUME
call fcn.00419a00
add esp, 8
mov eax, dword [ebx + 0x83c]
cdq
cmp dword [ebp - 0x209a4], eax
ja 0x45f054
jb 0x45ef82
mov ecx, dword [ebp - 0x209a8]
test ecx, ecx
jne 0x45f054
push dword [ebx + 0x88c]
push str.FORMAT_NTFS_FAILED_ASK_FAT
call fcn.00419440
add esp, 8
cmp eax, 6
jne 0x45f0bf
lea esi, [eax - 5]
mov dword [ebx + 0x82c], 1
lea eax, [ebp - 0x20994]
mov dword [ebx + 0x838], 1
push eax
lea eax, [ebp - 0xb08]
mov dword [ebx + 0x830], 0
push eax
push esi
push ebx
call fcn.00460540
mov edi, eax
add esp, 0x10
test edi, edi
je 0x45e940
mov esi, dword [ebp - 0x20994]
mov dword [ebp - 0x20980], esi
jmp 0x45f0d4
mov edi, 0x1e
jmp 0x45f0d4
mov edi, 1
jmp 0x45f0d4
lea eax, [ebp - 0x204]
mov ecx, 0x200
mov esi, ecx
mov edx, eax
mov byte [edx], 0
lea edx, [edx + 1]
sub esi, 1
jne 0x45f015
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x45f020
push 0x200
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualUnlock]
mov eax, dword [ebp - 0x2099c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
push dword [ebx + 0x88c]
push str.FORMAT_NTFS_FAILED
call fcn.00419a00
add esp, 8
mov edi, 0x1c
jmp 0x45f0d4
call fcn.004cba20
add esp, 0xc
test eax, eax
jne 0x45f0d4
push dword [ebx + 0x88c]
push str.CANT_DISMOUNT_VOLUME
call fcn.00419a00
add esp, 8
jmp 0x45f0d4
push dword [ebx + 0x88c]
push str.CANT_MOUNT_VOLUME
jmp 0x45f0a7
push dword [ebx + 0x88c]
push str.ERR_NO_FREE_DRIVES
call fcn.00419a00
push dword [ebx + 0x88c]
push str.FORMAT_NTFS_STOP
call fcn.00419a00
add esp, 0x10
mov edi, 0x1c
jmp 0x45f0d4
push esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
jmp 0x45f0d4
mov edi, 7
call dword [sym.imp.KERNEL32.DLL_GetLastError]
lea ecx, [ebp - 0x204]
mov dword [ebp - 0x209b4], eax
mov edx, 0x200
mov esi, ecx
mov eax, edx
nop
mov byte [esi], 0
lea esi, [esi + 1]
sub eax, 1
jne 0x45f0f0
nop dword [eax + eax]
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub edx, 1
jne 0x45f100
push 0x200
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualUnlock]
mov esi, dword [ebp - 0x20980]
cmp esi, 0xffffffff
je 0x45f17e
cmp dword [ebx], 0
jne 0x45f14b
cmp dword [ebx + 4], 0
jne 0x45f14b
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
test eax, eax
jne 0x45f14b
push esi
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.DLL_FlushFileBuffers]
cmp dword [ebp - 0x209b0], 0
je 0x45f177
lea eax, [ebp - 0x209c4]
push eax
lea eax, [ebp - 0x209cc]
push eax
lea eax, [ebp - 0x209d4]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp word [ebp - 0xb08], 0
je 0x45f19b
lea eax, [ebp - 0xb08]
add ebx, 8
push eax
push ebx
call fcn.0042aae0
add esp, 8
push dword [ebp - 0x2097c]
call fcn.004b8120
add esp, 4
push dword [ebp - 0x209b4]
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
push dword [ebx + 0x88c]
push str.SECTOR_SIZE_UNSUPPORTED
call fcn.00419a00
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
mov eax, 0x1c
pop esi
pop ebx
call fcn.004e1f40
mov esp, ebp
pop ebp
ret