Function at 0x417690
Capabilities:
Create thread
Get system information on windows
Resolve function by parsing pe exports
Timestomp file
Write file on windows

Disassembly:
mov eax, 0x20368
call fcn.00442530
push ebx
push ebp
mov ebp, dword [esp + 0x20374]
mov ecx, dword [ebp + 0x10cc080]
lea eax, [ebp + 0x10969f8]
mov dword [esp + 0x4c], eax
mov eax, dword [ebp + 0x10cc07c]
mov edx, dword [eax + 0xe0]
mov eax, dword [eax + 0xe4]
push esi
mov esi, dword [ecx + 0xe0]
mov ecx, dword [ecx + 0xe4]
cmp eax, ecx
push edi
jg 0x4176e7
jl 0x4176dd
cmp edx, esi
jae 0x4176e7
mov edi, edx
mov ebx, eax
mov edx, esi
mov eax, ecx
jmp 0x4176eb
mov edi, esi
mov ebx, ecx
cmp edi, edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], edi
jne 0x417707
cmp ebx, eax
je 0x418200
mov ecx, dword [esp + 0x30]
sub ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
sbb edx, dword [esp + 0x3c]
mov eax, dword [ebp + 0x10cbf38]
mov ebx, dword [ebp + 0x10cbbb4]
mov dword [esp + 0x58], ecx
mov ecx, dword [ebp + 0x10cbf3c]
mov dword [esp + 0x5c], edx
fild qword [esp + 0x58]
mov edx, dword [0x489b08]
mov dword [esp + 0x40], ecx
push 0x100
fstp qword [esp + 0x64]
shl edx, 9
fld qword [ebp + 0x10cbf40]
add edx, 0x488b08
fstp qword [esp + 0x5c]
push edx
fld qword [ebp + 0x10cbf48]
mov dword [esp + 0x28], eax
mov eax, dword [0x488a6c]
fstp qword [esp + 0x90]
fld qword [0x479668]
mov ecx, 0x3e
fstp qword [esp + 0x258]
lea esi, [esp + 0x258]
fld qword [0x479660]
lea edi, [esp + 0x260]
rep movsd dword es:[edi], dword [esi]
fstp qword [esp + 0xd8]
push 0xcc
mov ecx, 0x3e
lea esi, [esp + 0xdc]
lea edi, [esp + 0xe4]
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.USER32.dll_LoadStringW]
mov eax, dword [0x489b08]
lea ecx, [eax + 1]
and ecx, reloc.OLEAUT32.dll_VariantInit
jns 0x4177d7
dec ecx
or ecx, 0xfffffff8
inc ecx
mov edx, dword [ebp + 0x1097a10]
shl eax, 9
add eax, 0x488b08
push eax
push 2
push 0x400
push edx
mov dword [0x489b08], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [esp + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
imul esi, ebx
add esi, esi
add esi, esi
add esi, esi
push esi
push 0x40
call edi
push eax
mov dword [esp + 0x74], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push 0x40
mov dword [esp + 0x2c], eax
call edi
push eax
mov dword [esp + 0x70], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push 0x40
mov dword [esp + 0x58], eax
call edi
push eax
mov dword [esp + 0x88], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, dword [esp + 0x30]
sub edi, dword [esp + 0x38]
mov dword [esp + 0x44], eax
imul edi, ebx
add edi, edi
add edi, edi
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [esp + 0x6c], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x54]
push 0
push eax
call fcn.0043e710
mov ecx, dword [esp + 0x30]
add esp, 0xc
push esi
push 0
push ecx
call fcn.0043e710
mov edx, dword [esp + 0x50]
add esp, 0xc
push esi
push 0
push edx
call fcn.0043e710
mov eax, dword [esp + 0x28]
add esp, 0xc
push edi
push 0
push eax
call fcn.0043e710
mov ecx, dword [ebp + 0x10cc078]
fld dword [ecx + 0x4ff0]
xor esi, esi
fdivr qword [esp + 0x6c]
add esp, 0xc
cmp dword [esp + 0x20], esi
mov dword [esp + 0x14], esi
fst qword [esp + 0xb0]
fld qword [0x479478]
jle 0x41794d
mov edi, dword [esp + 0x20]
fld st(1)
fadd st(0), st(0)
fld qword [esp + 0x88]
fld qword [esp + 0x58]
fsub st(1), st(0)
fild dword [esp + 0x20]
fild dword [esp + 0x14]
fmul st(3)
fdiv st(1)
fadd st(2)
fdivr st(5)
fdivr st(4)
call fcn.00441ca0
mov edx, eax
and edx, 0x80000001
jns 0x417917
dec edx
or edx, 0xfffffffe
inc edx
cdq
je 0x417923
sub eax, edx
sar eax, 1
add eax, 1
jmp 0x417927
sub eax, edx
sar eax, 1
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
add esi, 1
cmp esi, edi
mov dword [esp + 0x14], esi
fmul st(5)
fdiv st(6)
fstp qword [esp + esi*8 + 0x10370]
jl 0x4178f5
fstp st(3)
fstp st(1)
fstp st(1)
fstp st(0)
mov eax, dword [esp + 0x38]
fstp st(1)
mov dword [esp + 0x48], eax
fstp st(0)
mov eax, dword [esp + 0x3c]
cmp eax, dword [esp + 0x34]
mov dword [esp + 0x4c], eax
jg 0x417a42
jl 0x417980
mov ecx, dword [esp + 0x30]
cmp dword [esp + 0x38], ecx
jae 0x417a42
jmp 0x417980
mov eax, dword [esp + 0x48]
sub eax, dword [esp + 0x38]
test ebx, ebx
mov dword [esp + 0x14], eax
jle 0x417a18
mov edx, eax
mov eax, dword [esp + 0x1c]
imul edx, ebx
lea edi, [eax + edx*4]
lea esi, [ebp + 0x10cbc38]
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x40], 4
ja 0x4179dc
fld qword [esp + 0x60]
mov ecx, dword [esp + 0x14]
sub esp, 0x10
test ecx, ecx
fstp qword [esp + 8]
fild dword [esp + 0x24]
jge 0x4179ce
fadd qword [0x479558]
mov eax, dword [esp + 0x50]
fstp qword [esp]
call fcn.00417280
jmp 0x4179de
fldz
mov edx, dword [esp + 0x4c]
fstp qword [esp + 0x28]
mov ecx, dword [esp + 0x48]
mov eax, dword [esi]
push edx
push ecx
mov ecx, dword [ebp + 0x10cc078]
sub eax, 1
call fcn.00402de0
fld qword [esp + 0x28]
fstp dword [esp + 0x28]
add esi, 4
add edi, 4
sub dword [esp + 0x18], 1
fmul dword [esp + 0x28]
fstp dword [edi - 4]
jne 0x4179aa
add dword [esp + 0x48], 1
mov eax, dword [esp + 0x4c]
adc eax, 0
cmp eax, dword [esp + 0x34]
mov dword [esp + 0x4c], eax
jl 0x417980
jg 0x417a42
mov edx, dword [esp + 0x48]
cmp edx, dword [esp + 0x30]
jb 0x417980
mov eax, dword [ebp + 0x1097a10]
push 2
push 1
push 0x400
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0x354]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x24]
mov dword [ebp + 0x10cbf54], eax
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x38]
mov dword [ebp + 0x10cbf60], eax
mov eax, dword [esp + 0x34]
mov dword [ebp + 0x10cbf6c], eax
mov ecx, dword [esp + 0x50]
lea edx, [esp + 0x10378]
mov dword [ebp + 0x10cbf50], edx
mov edx, dword [esp + 0x1c]
mov dword [ebp + 0x10cbf5c], edx
mov edx, dword [esp + 0x30]
mov dword [ebp + 0x10cbf68], edx
mov dword [ebp + 0x10cbf58], ecx
mov ecx, dword [esp + 0x3c]
mov eax, edi
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cbf64], ecx
mov dword [ebp + 0x10cc010], edi
xor esi, esi
mov dword [ebp + 0x10cbff0], esi
mov dword [ebp + 0x10cbff4], eax
lea eax, [edi + edi]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cbff8], eax
lea eax, [edi + edi*2]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cbffc], eax
lea eax, [edi*4]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cc000], eax
lea eax, [edi + edi*4]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cc004], eax
lea eax, [edi + edi*2]
add eax, eax
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cc008], eax
lea eax, [edi*8]
sub eax, edi
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cc00c], eax
lea ecx, [esp + 0x1d0]
lea eax, [ebp + 0x10cbf70]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], eax
lea esp, [esp]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
push 0
push 0
push eax
push 0x4171e0
push 0
push 0
mov dword [edx], 0
mov dword [eax], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xfffffffffffffffe
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, 4
add dword [esp + 0x1c], eax
add dword [esp + 0x14], eax
add esi, 1
cmp esi, 8
jl 0x417b70
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp + 0x10cbf80]
add esi, dword [ebp + 0x10cbf88]
add esi, dword [ebp + 0x10cbf78]
add esi, dword [ebp + 0x10cbf84]
add esi, dword [ebp + 0x10cbf74]
add esi, dword [ebp + 0x10cbf70]
add esi, dword [ebp + 0x10cbf8c]
add esi, dword [ebp + 0x10cbf7c]
mov eax, esi
cdq
and edx, 7
add eax, edx
sar eax, 3
push eax
mov eax, dword [ebp + 0x1097a10]
push 1
push 0x400
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp esi, 0x320
jl 0x417bb2
mov ecx, dword [ebp + 0x10cc078]
xor eax, eax
cmp edi, eax
mov dword [esp + 0x1d0], eax
mov dword [esp + 0x1d4], eax
mov dword [esp + 0x1d8], eax
mov dword [esp + 0x1dc], eax
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], eax
mov dword [esp + 0x1e8], eax
mov dword [esp + 0x1ec], eax
fld dword [ecx + 0x4ff0]
fdivr qword [0x4794f0]
mov dword [esp + 0x14], eax
fst qword [esp + 0x48]
fld qword [0x479670]
fstp qword [esp + 0x60]
fld qword [0x479590]
jle 0x417daf
mov edx, dword [esp + 0x50]
mov dword [esp + 0x1c], edx
xor esi, esi
test ebx, ebx
jle 0x417d8f
mov eax, dword [esp + 0x50]
fstp st(0)
mov ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
sub ecx, eax
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x44]
sub ecx, eax
mov dword [esp + 0x40], ecx
jmp 0x417cb9
fstp st(0)
fld qword [esp + 0x48]
mov eax, dword [esp + 0x28]
fld qword [eax + edi]
fmul st(1)
fld qword [esp + 0xb0]
fdiv st(1), st(0)
fxch st(1)
fst qword [esp + 0x30]
fld qword [edi]
fmulp st(3)
fxch st(2)
fdivrp st(1)
fst qword [esp + 0xa8]
fmul st(0), st(0)
fld st(1)
fmulp st(2)
faddp st(1)
call fcn.0046a110
fst qword [esp + 0xb8]
call fcn.0046a240
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
mov ecx, dword [esp + 0x40]
fld qword [0x479590]
fmul st(1), st(0)
fxch st(1)
fst qword [ecx + edi]
fcom qword [esp + esi*8 + 0xd0]
fnstsw ax
test ah, 5
jp 0x417d27
fst qword [esp + esi*8 + 0xd0]
fcom qword [esp + esi*8 + 0x250]
fnstsw ax
test ah, 0x41
jne 0x417d3e
fstp qword [esp + esi*8 + 0x250]
jmp 0x417d40
fstp st(0)
mov eax, dword [esp + 0x14]
fld qword [esp + 0x30]
fstp qword [esp + eax*8 + 0x378]
fld qword [esp + 0xa8]
fstp qword [esp + eax*8 + 0x8378]
fld qword [esp + 0x60]
fld qword [esp + 0xb8]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x417d79
fstp qword [esp + 0x60]
jmp 0x417d7b
fstp st(0)
add esi, 1
add edi, 8
cmp esi, ebx
jl 0x417cb3
fld qword [esp + 0x48]
fxch st(1)
mov eax, dword [esp + 0x14]
add eax, 1
lea ecx, [ebx*8]
add dword [esp + 0x1c], ecx
cmp eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
jl 0x417c89
xor eax, eax
fstp st(1)
cmp ebx, 4
jl 0x417e16
lea ecx, [ebx - 3]
fld qword [esp + eax*8 + 0xd0]
add eax, 4
cmp eax, ecx
fsub qword [esp + eax*8 + 0x230]
fstp qword [esp + eax*8 + 0xb0]
fld qword [esp + eax*8 + 0xb8]
fsub qword [esp + eax*8 + 0x238]
fstp qword [esp + eax*8 + 0xb8]
fld qword [esp + eax*8 + 0xc0]
fsub qword [esp + eax*8 + 0x240]
fstp qword [esp + eax*8 + 0xc0]
fld qword [esp + eax*8 + 0xc8]
fsub qword [esp + eax*8 + 0x248]
fstp qword [esp + eax*8 + 0xc8]
jl 0x417dbb
cmp eax, ebx
jge 0x417e36
fld qword [esp + eax*8 + 0xd0]
add eax, 1
cmp eax, ebx
fsub qword [esp + eax*8 + 0x248]
fstp qword [esp + eax*8 + 0xc8]
jl 0x417e1a
mov eax, dword [esp + 0x20]
test eax, eax
jle 0x417ecb
mov edi, dword [esp + 0x44]
xor esi, esi
mov dword [esp + 0x18], eax
xor eax, eax
cmp ebx, 4
jl 0x417e95
lea edx, [ebx - 3]
mov ecx, edi
fld qword [ecx]
add eax, 4
fsub qword [esp + eax*8 + 0x230]
add ecx, 0x20
cmp eax, edx
fstp qword [ecx - 0x20]
fld qword [ecx - 0x18]
fsub qword [esp + eax*8 + 0x238]
fstp qword [ecx - 0x18]
fld qword [ecx - 0x10]
fsub qword [esp + eax*8 + 0x240]
fstp qword [ecx - 0x10]
fld qword [ecx - 8]
fsub qword [esp + eax*8 + 0x248]
fstp qword [ecx - 8]
jl 0x417e58
cmp eax, ebx
jge 0x417eb9
mov ecx, dword [esp + 0x44]
lea edx, [esi + eax]
lea ecx, [ecx + edx*8]
fld qword [ecx]
add eax, 1
fsub qword [esp + eax*8 + 0x248]
add ecx, 8
cmp eax, ebx
fstp qword [ecx - 8]
jl 0x417ea3
lea eax, [ebx*8]
add esi, ebx
add edi, eax
sub dword [esp + 0x18], 1
jne 0x417e4c
xor esi, esi
test ebx, ebx
jle 0x417f12
fldz
lea edi, [ebp + 0x10cbcb8]
fst dword [edi + 0x80]
fld qword [esp + esi*8 + 0xd0]
fabs
fdiv st(2)
call fcn.00441ca0
or ecx, 0xffffffff
sub ecx, eax
lea edx, [ecx + ecx*4]
add edx, edx
add edx, edx
mov dword [esp + 0x28], edx
fild dword [esp + 0x28]
add esi, 1
add edi, 4
cmp esi, ebx
fstp dword [edi - 4]
jl 0x417ed9
fstp st(1)
fstp st(0)
mov edi, dword [esp + 0x54]
fild dword [esp + 0x20]
mov esi, dword [ebp + 0x10cc078]
push ecx
lea eax, [ebp + 0x10cbbb4]
fmul qword [0x479478]
fld qword [esp + 0x8c]
fsub qword [esp + 0x5c]
fdivp st(1)
fstp dword [esp + 0x2c]
fld dword [esp + 0x2c]
fstp dword [esp]
push edi
call fcn.00403750
push 0
push 0x20
push 3
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x417f97
mov eax, dword [ebp + 0x1097a10]
push 0x64
push 1
push 0x400
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp + 0x1097a10], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20368
ret 4
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x20]
test eax, eax
jle 0x418059
mov ecx, dword [esp + 0x44]
xor edi, edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], eax
xor eax, eax
cmp ebx, 4
jl 0x418001
mov ecx, dword [esp + 0x24]
lea edx, [ebx - 3]
lea esp, [esp]
fld qword [ecx]
add eax, 4
fstp dword [esp + eax*4 + 0xc0]
add ecx, 0x20
cmp eax, edx
fld qword [ecx - 0x18]
fstp dword [esp + eax*4 + 0xc4]
fld qword [ecx - 0x10]
fstp dword [esp + eax*4 + 0xc8]
fld qword [ecx - 8]
fstp dword [esp + eax*4 + 0xcc]
jl 0x417fd0
cmp eax, ebx
jge 0x418023
mov ecx, dword [esp + 0x44]
lea edx, [edi + eax]
lea ecx, [ecx + edx*8]
nop
fld qword [ecx]
add eax, 1
fstp dword [esp + eax*4 + 0xcc]
add ecx, 8
cmp eax, ebx
jl 0x418010
push 0
lea edx, [esp + 0x2c]
push edx
lea eax, [ebx*4]
push eax
lea eax, [esp + 0xdc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebx*8]
add dword [esp + 0x24], eax
add edi, ebx
sub dword [esp + 0x18], 1
jne 0x417fbe
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push ecx
push edx
mov ebx, esi
mov ecx, ebp
call fcn.00416ef0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea ecx, [esp + 0xc0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [esp + 0x7c]
movzx esi, word [esp + 0xc8]
mov eax, dword [esp + 0x54]
push 0
push 0
push 3
push 0
push 0
push 0x40000000
push eax
sub esi, edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ecx, [esp + 0xa0]
push ecx
mov ebx, eax
lea edx, [esp + 0x9c]
push edx
lea eax, [esp + 0x98]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
cmp ebx, 0xffffffff
je 0x418162
fld qword [esp + 0x58]
mov edi, 0x18
fdiv qword [0x479478]
sub edi, esi
call fcn.00441ca0
cdq
mov ecx, 0x3c
idiv ecx
lea esi, [esp + 0x90]
mov dword [esp + 0x18], 3
mov dword [esp + 0x40], edx
mov dword [esp + 0x28], eax
lea edx, [esp + 0x74]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ax, word [esp + 0x28]
mov cx, word [esp + 0x40]
push esi
lea edx, [esp + 0x78]
push edx
mov word [esp + 0x84], di
mov word [esp + 0x86], ax
mov word [esp + 0x88], cx
mov word [esp + 0x8a], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
add esi, 8
sub dword [esp + 0x18], 1
jne 0x418114
lea eax, [esp + 0xa0]
push eax
lea ecx, [esp + 0x9c]
push ecx
lea edx, [esp + 0x98]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x68]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
call ebx
mov edi, dword [esp + 0x84]
push edi
call esi
push edi
call ebx
mov edi, dword [esp + 0x70]
push edi
call esi
push edi
call ebx
mov edi, dword [esp + 0x6c]
push edi
call esi
push edi
call ebx
mov eax, dword [ebp + 0x1097a10]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x64
push 1
push 0x400
push eax
mov dword [ebp + 0x1097a30], 1
call esi
mov ecx, dword [esp + 0x54]
mov edx, dword [0x488ae4]
push ecx
push 1
push 0x400
push edx
mov dword [ebp + 0x1097a10], 0
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20368
ret 4