Function at 0x417830
Capabilities:
Create thread
Get system information on windows
Resolve function by parsing pe exports
Timestomp file
Write file on windows

Disassembly:
mov eax, 0x20368
call fcn.00443630
push ebx
push ebp
mov ebp, dword [esp + 0x20374]
mov ecx, dword [ebp + 0x10cc080]
lea eax, [ebp + 0x10969f8]
mov dword [esp + 0x4c], eax
mov eax, dword [ebp + 0x10cc07c]
mov edx, dword [eax + 0xe0]
mov eax, dword [eax + 0xe4]
push esi
mov esi, dword [ecx + 0xe0]
mov ecx, dword [ecx + 0xe4]
cmp eax, ecx
push edi
jg 0x417887
jl 0x41787d
cmp edx, esi
jae 0x417887
mov edi, edx
mov ebx, eax
mov edx, esi
mov eax, ecx
jmp 0x41788b
mov edi, esi
mov ebx, ecx
cmp edi, edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], edi
jne 0x4178a7
cmp ebx, eax
je 0x4183a0
mov ecx, dword [esp + 0x30]
sub ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
sbb edx, dword [esp + 0x3c]
mov eax, dword [ebp + 0x10cbf38]
mov ebx, dword [ebp + 0x10cbbb4]
mov dword [esp + 0x58], ecx
mov ecx, dword [ebp + 0x10cbf3c]
mov dword [esp + 0x5c], edx
fild qword [esp + 0x58]
mov edx, dword [0x48cb08]
mov dword [esp + 0x40], ecx
push 0x100
fstp qword [esp + 0x64]
shl edx, 9
fld qword [ebp + 0x10cbf40]
add edx, 0x48bb08
fstp qword [esp + 0x5c]
push edx
fld qword [ebp + 0x10cbf48]
mov dword [esp + 0x28], eax
mov eax, dword [0x48ba6c]
fstp qword [esp + 0x90]
fld qword [0x47b820]
mov ecx, 0x3e
fstp qword [esp + 0x258]
lea esi, [esp + 0x258]
fld qword [0x47b818]
lea edi, [esp + 0x260]
rep movsd dword es:[edi], dword [esi]
fstp qword [esp + 0xd8]
push 0xcc
mov ecx, 0x3e
lea esi, [esp + 0xdc]
lea edi, [esp + 0xe4]
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.USER32.dll_LoadStringW]
mov eax, dword [0x48cb08]
lea ecx, [eax + 1]
and ecx, reloc.OLEAUT32.dll_VariantInit
jns 0x417977
dec ecx
or ecx, 0xfffffff8
inc ecx
mov edx, dword [ebp + 0x1097a10]
shl eax, 9
add eax, 0x48bb08
push eax
push 2
push 0x400
push edx
mov dword [0x48cb08], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [esp + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
imul esi, ebx
add esi, esi
add esi, esi
add esi, esi
push esi
push 0x40
call edi
push eax
mov dword [esp + 0x74], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push 0x40
mov dword [esp + 0x2c], eax
call edi
push eax
mov dword [esp + 0x70], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push 0x40
mov dword [esp + 0x58], eax
call edi
push eax
mov dword [esp + 0x88], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, dword [esp + 0x30]
sub edi, dword [esp + 0x38]
mov dword [esp + 0x44], eax
imul edi, ebx
add edi, edi
add edi, edi
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [esp + 0x6c], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x54]
push 0
push eax
call fcn.0043f810
mov ecx, dword [esp + 0x30]
add esp, 0xc
push esi
push 0
push ecx
call fcn.0043f810
mov edx, dword [esp + 0x50]
add esp, 0xc
push esi
push 0
push edx
call fcn.0043f810
mov eax, dword [esp + 0x28]
add esp, 0xc
push edi
push 0
push eax
call fcn.0043f810
mov ecx, dword [ebp + 0x10cc078]
fld dword [ecx + 0x4ff0]
xor esi, esi
fdivr qword [esp + 0x6c]
add esp, 0xc
cmp dword [esp + 0x20], esi
mov dword [esp + 0x14], esi
fst qword [esp + 0xb0]
fld qword [0x47b630]
jle 0x417aed
mov edi, dword [esp + 0x20]
fld st(1)
fadd st(0), st(0)
fld qword [esp + 0x88]
fld qword [esp + 0x58]
fsub st(1), st(0)
fild dword [esp + 0x20]
fild dword [esp + 0x14]
fmul st(3)
fdiv st(1)
fadd st(2)
fdivr st(5)
fdivr st(4)
call fcn.00442da0
mov edx, eax
and edx, 0x80000001
jns 0x417ab7
dec edx
or edx, 0xfffffffe
inc edx
cdq
je 0x417ac3
sub eax, edx
sar eax, 1
add eax, 1
jmp 0x417ac7
sub eax, edx
sar eax, 1
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
add esi, 1
cmp esi, edi
mov dword [esp + 0x14], esi
fmul st(5)
fdiv st(6)
fstp qword [esp + esi*8 + 0x10370]
jl 0x417a95
fstp st(3)
fstp st(1)
fstp st(1)
fstp st(0)
mov eax, dword [esp + 0x38]
fstp st(1)
mov dword [esp + 0x48], eax
fstp st(0)
mov eax, dword [esp + 0x3c]
cmp eax, dword [esp + 0x34]
mov dword [esp + 0x4c], eax
jg 0x417be2
jl 0x417b20
mov ecx, dword [esp + 0x30]
cmp dword [esp + 0x38], ecx
jae 0x417be2
jmp 0x417b20
mov eax, dword [esp + 0x48]
sub eax, dword [esp + 0x38]
test ebx, ebx
mov dword [esp + 0x14], eax
jle 0x417bb8
mov edx, eax
mov eax, dword [esp + 0x1c]
imul edx, ebx
lea edi, [eax + edx*4]
lea esi, [ebp + 0x10cbc38]
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x40], 4
ja 0x417b7c
fld qword [esp + 0x60]
mov ecx, dword [esp + 0x14]
sub esp, 0x10
test ecx, ecx
fstp qword [esp + 8]
fild dword [esp + 0x24]
jge 0x417b6e
fadd qword [0x47b710]
mov eax, dword [esp + 0x50]
fstp qword [esp]
call fcn.00417420
jmp 0x417b7e
fldz
mov edx, dword [esp + 0x4c]
fstp qword [esp + 0x28]
mov ecx, dword [esp + 0x48]
mov eax, dword [esi]
push edx
push ecx
mov ecx, dword [ebp + 0x10cc078]
sub eax, 1
call fcn.00402df0
fld qword [esp + 0x28]
fstp dword [esp + 0x28]
add esi, 4
add edi, 4
sub dword [esp + 0x18], 1
fmul dword [esp + 0x28]
fstp dword [edi - 4]
jne 0x417b4a
add dword [esp + 0x48], 1
mov eax, dword [esp + 0x4c]
adc eax, 0
cmp eax, dword [esp + 0x34]
mov dword [esp + 0x4c], eax
jl 0x417b20
jg 0x417be2
mov edx, dword [esp + 0x48]
cmp edx, dword [esp + 0x30]
jb 0x417b20
mov eax, dword [ebp + 0x1097a10]
push 2
push 1
push 0x400
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0x354]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x24]
mov dword [ebp + 0x10cbf54], eax
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x38]
mov dword [ebp + 0x10cbf60], eax
mov eax, dword [esp + 0x34]
mov dword [ebp + 0x10cbf6c], eax
mov ecx, dword [esp + 0x50]
lea edx, [esp + 0x10378]
mov dword [ebp + 0x10cbf50], edx
mov edx, dword [esp + 0x1c]
mov dword [ebp + 0x10cbf5c], edx
mov edx, dword [esp + 0x30]
mov dword [ebp + 0x10cbf68], edx
mov dword [ebp + 0x10cbf58], ecx
mov ecx, dword [esp + 0x3c]
mov eax, edi
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cbf64], ecx
mov dword [ebp + 0x10cc010], edi
xor esi, esi
mov dword [ebp + 0x10cbff0], esi
mov dword [ebp + 0x10cbff4], eax
lea eax, [edi + edi]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cbff8], eax
lea eax, [edi + edi*2]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cbffc], eax
lea eax, [edi*4]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cc000], eax
lea eax, [edi + edi*4]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cc004], eax
lea eax, [edi + edi*2]
add eax, eax
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cc008], eax
lea eax, [edi*8]
sub eax, edi
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cc00c], eax
lea ecx, [esp + 0x1d0]
lea eax, [ebp + 0x10cbf70]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], eax
lea esp, [esp]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
push 0
push 0
push eax
push 0x417380
push 0
push 0
mov dword [edx], 0
mov dword [eax], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xfffffffffffffffe
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, 4
add dword [esp + 0x1c], eax
add dword [esp + 0x14], eax
add esi, 1
cmp esi, 8
jl 0x417d10
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp + 0x10cbf80]
add esi, dword [ebp + 0x10cbf88]
add esi, dword [ebp + 0x10cbf78]
add esi, dword [ebp + 0x10cbf84]
add esi, dword [ebp + 0x10cbf74]
add esi, dword [ebp + 0x10cbf70]
add esi, dword [ebp + 0x10cbf8c]
add esi, dword [ebp + 0x10cbf7c]
mov eax, esi
cdq
and edx, 7
add eax, edx
sar eax, 3
push eax
mov eax, dword [ebp + 0x1097a10]
push 1
push 0x400
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp esi, 0x320
jl 0x417d52
mov ecx, dword [ebp + 0x10cc078]
xor eax, eax
cmp edi, eax
mov dword [esp + 0x1d0], eax
mov dword [esp + 0x1d4], eax
mov dword [esp + 0x1d8], eax
mov dword [esp + 0x1dc], eax
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], eax
mov dword [esp + 0x1e8], eax
mov dword [esp + 0x1ec], eax
fld dword [ecx + 0x4ff0]
fdivr qword [0x47b6a8]
mov dword [esp + 0x14], eax
fst qword [esp + 0x48]
fld qword [0x47b828]
fstp qword [esp + 0x60]
fld qword [0x47b748]
jle 0x417f4f
mov edx, dword [esp + 0x50]
mov dword [esp + 0x1c], edx
xor esi, esi
test ebx, ebx
jle 0x417f2f
mov eax, dword [esp + 0x50]
fstp st(0)
mov ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
sub ecx, eax
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x44]
sub ecx, eax
mov dword [esp + 0x40], ecx
jmp 0x417e59
fstp st(0)
fld qword [esp + 0x48]
mov eax, dword [esp + 0x28]
fld qword [eax + edi]
fmul st(1)
fld qword [esp + 0xb0]
fdiv st(1), st(0)
fxch st(1)
fst qword [esp + 0x30]
fld qword [edi]
fmulp st(3)
fxch st(2)
fdivrp st(1)
fst qword [esp + 0xa8]
fmul st(0), st(0)
fld st(1)
fmulp st(2)
faddp st(1)
call fcn.0046b7e0
fst qword [esp + 0xb8]
call fcn.0046b910
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
mov ecx, dword [esp + 0x40]
fld qword [0x47b748]
fmul st(1), st(0)
fxch st(1)
fst qword [ecx + edi]
fcom qword [esp + esi*8 + 0xd0]
fnstsw ax
test ah, 5
jp 0x417ec7
fst qword [esp + esi*8 + 0xd0]
fcom qword [esp + esi*8 + 0x250]
fnstsw ax
test ah, 0x41
jne 0x417ede
fstp qword [esp + esi*8 + 0x250]
jmp 0x417ee0
fstp st(0)
mov eax, dword [esp + 0x14]
fld qword [esp + 0x30]
fstp qword [esp + eax*8 + 0x378]
fld qword [esp + 0xa8]
fstp qword [esp + eax*8 + 0x8378]
fld qword [esp + 0x60]
fld qword [esp + 0xb8]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x417f19
fstp qword [esp + 0x60]
jmp 0x417f1b
fstp st(0)
add esi, 1
add edi, 8
cmp esi, ebx
jl 0x417e53
fld qword [esp + 0x48]
fxch st(1)
mov eax, dword [esp + 0x14]
add eax, 1
lea ecx, [ebx*8]
add dword [esp + 0x1c], ecx
cmp eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
jl 0x417e29
xor eax, eax
fstp st(1)
cmp ebx, 4
jl 0x417fb6
lea ecx, [ebx - 3]
fld qword [esp + eax*8 + 0xd0]
add eax, 4
cmp eax, ecx
fsub qword [esp + eax*8 + 0x230]
fstp qword [esp + eax*8 + 0xb0]
fld qword [esp + eax*8 + 0xb8]
fsub qword [esp + eax*8 + 0x238]
fstp qword [esp + eax*8 + 0xb8]
fld qword [esp + eax*8 + 0xc0]
fsub qword [esp + eax*8 + 0x240]
fstp qword [esp + eax*8 + 0xc0]
fld qword [esp + eax*8 + 0xc8]
fsub qword [esp + eax*8 + 0x248]
fstp qword [esp + eax*8 + 0xc8]
jl 0x417f5b
cmp eax, ebx
jge 0x417fd6
fld qword [esp + eax*8 + 0xd0]
add eax, 1
cmp eax, ebx
fsub qword [esp + eax*8 + 0x248]
fstp qword [esp + eax*8 + 0xc8]
jl 0x417fba
mov eax, dword [esp + 0x20]
test eax, eax
jle 0x41806b
mov edi, dword [esp + 0x44]
xor esi, esi
mov dword [esp + 0x18], eax
xor eax, eax
cmp ebx, 4
jl 0x418035
lea edx, [ebx - 3]
mov ecx, edi
fld qword [ecx]
add eax, 4
fsub qword [esp + eax*8 + 0x230]
add ecx, 0x20
cmp eax, edx
fstp qword [ecx - 0x20]
fld qword [ecx - 0x18]
fsub qword [esp + eax*8 + 0x238]
fstp qword [ecx - 0x18]
fld qword [ecx - 0x10]
fsub qword [esp + eax*8 + 0x240]
fstp qword [ecx - 0x10]
fld qword [ecx - 8]
fsub qword [esp + eax*8 + 0x248]
fstp qword [ecx - 8]
jl 0x417ff8
cmp eax, ebx
jge 0x418059
mov ecx, dword [esp + 0x44]
lea edx, [esi + eax]
lea ecx, [ecx + edx*8]
fld qword [ecx]
add eax, 1
fsub qword [esp + eax*8 + 0x248]
add ecx, 8
cmp eax, ebx
fstp qword [ecx - 8]
jl 0x418043
lea eax, [ebx*8]
add esi, ebx
add edi, eax
sub dword [esp + 0x18], 1
jne 0x417fec
xor esi, esi
test ebx, ebx
jle 0x4180b2
fldz
lea edi, [ebp + 0x10cbcb8]
fst dword [edi + 0x80]
fld qword [esp + esi*8 + 0xd0]
fabs
fdiv st(2)
call fcn.00442da0
or ecx, 0xffffffff
sub ecx, eax
lea edx, [ecx + ecx*4]
add edx, edx
add edx, edx
mov dword [esp + 0x28], edx
fild dword [esp + 0x28]
add esi, 1
add edi, 4
cmp esi, ebx
fstp dword [edi - 4]
jl 0x418079
fstp st(1)
fstp st(0)
mov edi, dword [esp + 0x54]
fild dword [esp + 0x20]
mov esi, dword [ebp + 0x10cc078]
push ecx
lea eax, [ebp + 0x10cbbb4]
fmul qword [0x47b630]
fld qword [esp + 0x8c]
fsub qword [esp + 0x5c]
fdivp st(1)
fstp dword [esp + 0x2c]
fld dword [esp + 0x2c]
fstp dword [esp]
push edi
call fcn.00403760
push 0
push 0x20
push 3
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x418137
mov eax, dword [ebp + 0x1097a10]
push 0x64
push 1
push 0x400
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp + 0x1097a10], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20368
ret 4
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x20]
test eax, eax
jle 0x4181f9
mov ecx, dword [esp + 0x44]
xor edi, edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], eax
xor eax, eax
cmp ebx, 4
jl 0x4181a1
mov ecx, dword [esp + 0x24]
lea edx, [ebx - 3]
lea esp, [esp]
fld qword [ecx]
add eax, 4
fstp dword [esp + eax*4 + 0xc0]
add ecx, 0x20
cmp eax, edx
fld qword [ecx - 0x18]
fstp dword [esp + eax*4 + 0xc4]
fld qword [ecx - 0x10]
fstp dword [esp + eax*4 + 0xc8]
fld qword [ecx - 8]
fstp dword [esp + eax*4 + 0xcc]
jl 0x418170
cmp eax, ebx
jge 0x4181c3
mov ecx, dword [esp + 0x44]
lea edx, [edi + eax]
lea ecx, [ecx + edx*8]
nop
fld qword [ecx]
add eax, 1
fstp dword [esp + eax*4 + 0xcc]
add ecx, 8
cmp eax, ebx
jl 0x4181b0
push 0
lea edx, [esp + 0x2c]
push edx
lea eax, [ebx*4]
push eax
lea eax, [esp + 0xdc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebx*8]
add dword [esp + 0x24], eax
add edi, ebx
sub dword [esp + 0x18], 1
jne 0x41815e
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push ecx
push edx
mov ebx, esi
mov ecx, ebp
call fcn.00417090
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea ecx, [esp + 0xc0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [esp + 0x7c]
movzx esi, word [esp + 0xc8]
mov eax, dword [esp + 0x54]
push 0
push 0
push 3
push 0
push 0
push 0x40000000
push eax
sub esi, edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ecx, [esp + 0xa0]
push ecx
mov ebx, eax
lea edx, [esp + 0x9c]
push edx
lea eax, [esp + 0x98]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
cmp ebx, 0xffffffff
je 0x418302
fld qword [esp + 0x58]
mov edi, 0x18
fdiv qword [0x47b630]
sub edi, esi
call fcn.00442da0
cdq
mov ecx, 0x3c
idiv ecx
lea esi, [esp + 0x90]
mov dword [esp + 0x18], 3
mov dword [esp + 0x40], edx
mov dword [esp + 0x28], eax
lea edx, [esp + 0x74]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ax, word [esp + 0x28]
mov cx, word [esp + 0x40]
push esi
lea edx, [esp + 0x78]
push edx
mov word [esp + 0x84], di
mov word [esp + 0x86], ax
mov word [esp + 0x88], cx
mov word [esp + 0x8a], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
add esi, 8
sub dword [esp + 0x18], 1
jne 0x4182b4
lea eax, [esp + 0xa0]
push eax
lea ecx, [esp + 0x9c]
push ecx
lea edx, [esp + 0x98]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x68]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
call ebx
mov edi, dword [esp + 0x84]
push edi
call esi
push edi
call ebx
mov edi, dword [esp + 0x70]
push edi
call esi
push edi
call ebx
mov edi, dword [esp + 0x6c]
push edi
call esi
push edi
call ebx
mov eax, dword [ebp + 0x1097a10]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x64
push 1
push 0x400
push eax
mov dword [ebp + 0x1097a30], 1
call esi
mov ecx, dword [esp + 0x54]
mov edx, dword [0x48bae4]
push ecx
push 1
push 0x400
push edx
mov dword [ebp + 0x1097a10], 0
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20368
ret 4