Function at 0x4142b0
Capabilities:
Create thread
Get system information on windows
Resolve function by parsing pe exports
Timestomp file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x20360
call fcn.0041b460
push ebx
mov ebx, ecx
mov ecx, dword [ebx + 0x10cc07c]
mov edx, dword [ecx + 0xe0]
lea eax, [ebx + 0x10969f8]
push ebp
mov dword [esp + 0x4c], eax
mov eax, dword [ecx + 0xe4]
mov ecx, dword [ebx + 0x10cc080]
push esi
mov esi, dword [ecx + 0xe0]
mov ecx, dword [ecx + 0xe4]
cmp eax, ecx
push edi
jg 0x414308
jl 0x4142fe
cmp edx, esi
jae 0x414308
mov edi, edx
mov ebp, eax
mov edx, esi
mov eax, ecx
jmp 0x41430c
mov edi, esi
mov ebp, ecx
cmp edi, edx
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], ebp
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
jne 0x414328
cmp ebp, eax
je 0x414e1a
mov edi, dword [esp + 0x30]
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x24]
mov ecx, dword [ebx + 0x10cbf38]
mov ebp, dword [ebx + 0x10cbbb4]
sub edx, edi
sbb eax, esi
mov dword [esp + 0x58], edx
mov edx, dword [ebx + 0x10cbf3c]
mov dword [esp + 0x5c], eax
fild qword [esp + 0x58]
mov dword [esp + 0x2c], ecx
mov ecx, 0x3e
lea esi, [esp + 0x248]
fstp qword [esp + 0x68]
lea edi, [esp + 0x250]
fld qword [ebx + 0x10cbf40]
push 0xcc
fstp qword [esp + 0x74]
mov dword [esp + 0x50], ebp
fld qword [ebx + 0x10cbf48]
mov dword [esp + 0x64], edx
fstp qword [esp + 0x9c]
fld qword [0x4308e8]
fstp qword [esp + 0x24c]
rep movsd dword es:[edi], dword [esi]
fld qword [0x4308e0]
fstp qword [esp + 0xcc]
mov ecx, 0x3e
lea esi, [esp + 0xcc]
lea edi, [esp + 0xd4]
rep movsd dword es:[edi], dword [esi]
call fcn.004159d0
add esp, 4
push eax
mov eax, dword [ebx + 0x1097a10]
push 2
push 0x400
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [esp + 0x2c]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
imul esi, ebp
shl esi, 3
push esi
push 0x40
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
mov dword [esp + 0x98], eax
call ebp
push esi
push 0x40
mov dword [esp + 0x1c], eax
call edi
push eax
mov dword [esp + 0x94], eax
call ebp
push esi
push 0x40
mov dword [esp + 0x58], eax
call edi
push eax
mov dword [esp + 0x8c], eax
call ebp
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x3c], eax
sub ebp, dword [esp + 0x30]
imul ebp, dword [esp + 0x4c]
shl ebp, 2
push ebp
push 0x40
call edi
push eax
mov dword [esp + 0x90], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [esp + 0x28], eax
mov ecx, esi
xor eax, eax
mov edi, dword [esp + 0x50]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x14]
xor eax, eax
mov ecx, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x3c]
xor eax, eax
mov ecx, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x28]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 0x10cc078]
xor esi, esi
mov dword [esp + 0x10], esi
fld dword [eax + 0x4ff0]
mov eax, dword [esp + 0x2c]
test eax, eax
fdivr qword [esp + 0x68]
mov edi, eax
fstp qword [esp + 0x58]
jle 0x414550
fld qword [esp + 0x98]
fsub qword [esp + 0x70]
fild dword [esp + 0x2c]
fld qword [0x4307c8]
fdiv qword [esp + 0x58]
mov edi, edi
fild dword [esp + 0x10]
fmul st(3)
fdiv st(2)
fadd qword [esp + 0x70]
fdivr qword [0x42f9c8]
fdivr qword [esp + 0x58]
fadd st(0), st(0)
call fcn.0041a7f8
mov ecx, eax
and ecx, 0x80000001
jns 0x41451c
dec ecx
or ecx, 0xfffffffe
inc ecx
cdq
je 0x414526
sub eax, edx
sar eax, 1
inc eax
jmp 0x41452a
sub eax, edx
sar eax, 1
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
inc esi
cmp esi, edi
mov dword [esp + 0x10], esi
fmul st(1)
fmul qword [0x42f9c8]
fstp qword [esp + esi*8 + 0x10368]
jl 0x4144f0
fstp st(0)
fstp st(0)
fstp st(0)
mov eax, dword [esp + 0x34]
cmp eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], eax
jg 0x41464d
jl 0x414576
cmp ecx, dword [esp + 0x20]
jae 0x41464d
mov ebp, dword [esp + 0x4c]
lea ebx, [ebx]
mov edx, dword [esp + 0x40]
sub edx, dword [esp + 0x30]
test ebp, ebp
jle 0x414619
fld qword [esp + 0x68]
sub esp, 0x10
test edx, edx
fstp qword [esp + 8]
mov dword [esp + 0x28], edx
fild dword [esp + 0x28]
jge 0x4145ad
fadd qword [0x42f708]
mov eax, dword [esp + 0x70]
fstp qword [esp]
push eax
mov ecx, ebx
call fcn.00413a60
imul edx, ebp
fstp dword [esp + 0x18]
mov ecx, dword [esp + 0x28]
lea edx, [ecx + edx*4]
mov dword [esp + 0x10], edx
lea esi, [ebx + 0x10cbc38]
mov dword [esp + 0x1c], ebp
jmp 0x4145e0
mov eax, dword [esi]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
dec eax
push eax
push ecx
mov ecx, dword [ebx + 0x10cc078]
push edx
call fcn.004014c0
fmul dword [esp + 0x18]
mov eax, dword [esp + 0x10]
add eax, 4
fstp dword [eax - 4]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
add esi, 4
dec eax
mov dword [esp + 0x1c], eax
jne 0x4145e0
mov esi, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x24]
add esi, 1
adc eax, 0
cmp eax, ecx
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], eax
jl 0x414580
jg 0x414651
mov eax, dword [esp + 0x20]
mov ecx, esi
cmp ecx, eax
jb 0x414580
jmp 0x414651
mov ebp, dword [esp + 0x4c]
mov ecx, dword [ebx + 0x1097a10]
push 2
push 1
push 0x400
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
lea edx, [esp + 0x34c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [esp + 0x50]
mov ecx, dword [esp + 0x14]
mov dword [ebx + 0x10cbf58], edx
mov edx, dword [esp + 0x34]
mov dword [ebx + 0x10cbf64], edx
lea eax, [esp + 0x10370]
mov dword [ebx + 0x10cbf50], eax
mov eax, dword [esp + 0x28]
mov dword [ebx + 0x10cbf5c], eax
mov eax, dword [esp + 0x20]
mov dword [ebx + 0x10cbf68], eax
mov dword [ebx + 0x10cbf54], ecx
mov ecx, dword [esp + 0x30]
mov dword [ebx + 0x10cbf60], ecx
mov ecx, dword [esp + 0x24]
mov eax, edi
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebx + 0x10cbf6c], ecx
mov dword [ebx + 0x10cc010], edi
xor esi, esi
mov dword [ebx + 0x10cbff0], esi
mov dword [ebx + 0x10cbff4], eax
lea eax, [edi + edi]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebx + 0x10cbff8], eax
lea eax, [edi + edi*2]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebx + 0x10cbffc], eax
lea eax, [edi*4]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebx + 0x10cc000], eax
lea eax, [edi + edi*4]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebx + 0x10cc004], eax
lea eax, [edi + edi*2]
shl eax, 1
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebx + 0x10cc008], eax
mov eax, edi
imul eax, eax, 7
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebx + 0x10cc00c], eax
lea edx, [esp + 0x1c8]
lea eax, [ebx + 0x10cbf70]
mov dword [esp + 0x10], edx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
push 0
push 0
mov dword [eax], 0
mov eax, dword [esp + 0x18]
push eax
push 0x414260
push 0
push 0
mov dword [eax], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xfffffffffffffffe
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x10]
mov eax, 4
inc esi
add edx, eax
add ecx, eax
cmp esi, 8
mov dword [esp + 0x28], edx
mov dword [esp + 0x10], ecx
jl 0x414770
lea esp, [esp]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebx + 0x10cbf74]
mov esi, dword [ebx + 0x10cbf84]
mov ecx, dword [ebx + 0x10cbf70]
mov eax, dword [ebx + 0x10cbf8c]
add esi, edx
mov edx, dword [ebx + 0x10cbf7c]
add esi, ecx
mov ecx, dword [ebx + 0x10cbf80]
add esi, eax
mov eax, dword [ebx + 0x10cbf88]
add esi, edx
mov edx, dword [ebx + 0x10cbf78]
add esi, ecx
mov ecx, dword [ebx + 0x1097a10]
add esi, eax
add esi, edx
mov eax, esi
cdq
and edx, 7
add eax, edx
sar eax, 3
push eax
push 1
push 0x400
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp esi, 0x320
jl 0x4147c0
mov edx, dword [ebx + 0x10cc078]
xor esi, esi
cmp edi, esi
mov dword [esp + 0x1c8], esi
mov dword [esp + 0x1cc], esi
mov dword [esp + 0x1d0], esi
mov dword [esp + 0x1d4], esi
mov dword [esp + 0x1d8], esi
mov dword [esp + 0x1dc], esi
mov dword [esp + 0x1e0], esi
mov dword [esp + 0x1e4], esi
fld dword [edx + 0x4ff0]
fdivr qword [0x42f7e0]
fstp qword [esp + 0x20]
fld qword [0x4308e8]
fstp qword [esp + 0x60]
jle 0x41498c
lea eax, [ebp*8]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x10], eax
xor edx, edx
test ebp, ebp
jle 0x414975
fld qword [0x4307c8]
mov edi, dword [esp + 0x14]
fdiv qword [esp + 0x58]
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x10]
sub edi, eax
sub ebp, eax
fstp qword [esp + 0x68]
jmp 0x4148d2
fstp st(0)
fld qword [esp + 0x68]
fmul qword [edi + ecx]
fmul qword [esp + 0x20]
fld qword [esp + 0x68]
fmul qword [ecx]
fmul qword [esp + 0x20]
fst qword [esp + 0x40]
fmul qword [esp + 0x40]
fld st(1)
fmul st(2)
faddp st(1)
fsqrt
fld st(0)
fldlg2
fxch st(1)
fyl2x
fmul dword [0x4308d8]
fcom qword [esp + edx*8 + 0xc8]
fst qword [ecx + ebp]
fnstsw ax
test ah, 5
jp 0x41491d
fst qword [esp + edx*8 + 0xc8]
fcom qword [esp + edx*8 + 0x248]
fnstsw ax
test ah, 0x41
jne 0x414934
fstp qword [esp + edx*8 + 0x248]
jmp 0x414936
fstp st(0)
fcom qword [esp + 0x60]
fnstsw ax
test ah, 0x41
jne 0x414947
fstp qword [esp + 0x60]
jmp 0x414949
fstp st(0)
mov eax, dword [esp + 0x4c]
inc edx
add ecx, 8
cmp edx, eax
jl 0x4148d0
mov edi, dword [esp + 0x2c]
fstp qword [esp + esi*8 + 0x370]
fld qword [esp + 0x40]
mov ebp, eax
mov eax, dword [esp + 0x50]
fstp qword [esp + esi*8 + 0x8370]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
inc esi
add edx, ecx
cmp esi, edi
mov dword [esp + 0x10], edx
jl 0x4148a6
xor eax, eax
cmp ebp, 4
jl 0x4149fb
lea ecx, [ebp - 3]
jmp 0x4149a0
fld qword [esp + eax*8 + 0xc8]
add eax, 4
cmp eax, ecx
fsub qword [esp + eax*8 + 0x228]
fstp qword [esp + eax*8 + 0xa8]
fld qword [esp + eax*8 + 0xb0]
fsub qword [esp + eax*8 + 0x230]
fstp qword [esp + eax*8 + 0xb0]
fld qword [esp + eax*8 + 0xb8]
fsub qword [esp + eax*8 + 0x238]
fstp qword [esp + eax*8 + 0xb8]
fld qword [esp + eax*8 + 0xc0]
fsub qword [esp + eax*8 + 0x240]
fstp qword [esp + eax*8 + 0xc0]
jl 0x4149a0
cmp eax, ebp
jge 0x414a1a
nop
fld qword [esp + eax*8 + 0xc8]
inc eax
cmp eax, ebp
fsub qword [esp + eax*8 + 0x240]
fstp qword [esp + eax*8 + 0xc0]
jl 0x414a00
test edi, edi
jle 0x414ac6
mov eax, dword [esp + 0x3c]
xor edx, edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], edi
xor ecx, ecx
cmp ebp, 4
jl 0x414a7d
mov eax, dword [esp + 0x14]
lea esi, [ebp - 3]
mov edi, edi
fld qword [eax]
add ecx, 4
fsub qword [esp + ecx*8 + 0x228]
add eax, 0x20
cmp ecx, esi
fstp qword [eax - 0x20]
fld qword [eax - 0x18]
fsub qword [esp + ecx*8 + 0x230]
fstp qword [eax - 0x18]
fld qword [eax - 0x10]
fsub qword [esp + ecx*8 + 0x238]
fstp qword [eax - 0x10]
fld qword [eax - 8]
fsub qword [esp + ecx*8 + 0x240]
fstp qword [eax - 8]
jl 0x414a40
cmp ecx, ebp
jge 0x414aa4
mov esi, dword [esp + 0x3c]
lea eax, [edx + ecx]
lea eax, [esi + eax*8]
jmp 0x414a90
fld qword [eax]
inc ecx
fsub qword [esp + ecx*8 + 0x240]
add eax, 8
cmp ecx, ebp
fstp qword [eax - 8]
jl 0x414a90
mov ecx, dword [esp + 0x14]
lea eax, [ebp*8]
add ecx, eax
mov eax, dword [esp + 0x1c]
add edx, ebp
dec eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], eax
jne 0x414a30
xor esi, esi
test ebp, ebp
jle 0x414b27
lea ecx, [ebx + 0x10cbcb8]
mov dword [esp + 0x14], ecx
jmp 0x414ae0
fld qword [esp + esi*8 + 0xc8]
mov edx, dword [esp + 0x14]
fabs
mov dword [edx + 0x80], 0
fmul qword [0x4308d0]
call fcn.0041a7f8
or ecx, 0xffffffff
sub ecx, eax
lea eax, [ecx + ecx*4]
shl eax, 2
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
mov eax, dword [esp + 0x14]
inc esi
fstp dword [eax]
add eax, 4
cmp esi, ebp
mov dword [esp + 0x14], eax
jl 0x414ae0
fild dword [esp + 0x2c]
mov esi, dword [esp + 0x54]
push ecx
mov ecx, dword [ebx + 0x10cc078]
fmul qword [0x42f9c8]
lea eax, [ebx + 0x10cbbb4]
fld qword [esp + 0x9c]
fsub qword [esp + 0x74]
fdivp st(1)
fstp dword [esp]
push eax
push esi
call fcn.00401e50
push 0
push 0x20
push 3
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x414b9e
mov ecx, dword [ebx + 0x1097a10]
push 0x64
push 1
push 0x400
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebx + 0x1097a10], 0
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test edi, edi
jle 0x414c64
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], edx
xor eax, eax
cmp ebp, 4
jl 0x414c02
mov ecx, dword [esp + 0x10]
lea edx, [ebp - 3]
fld qword [ecx]
add eax, 4
fstp dword [esp + eax*4 + 0xb8]
add ecx, 0x20
cmp eax, edx
fld qword [ecx - 0x18]
fstp dword [esp + eax*4 + 0xbc]
fld qword [ecx - 0x10]
fstp dword [esp + eax*4 + 0xc0]
fld qword [ecx - 8]
fstp dword [esp + eax*4 + 0xc4]
jl 0x414bd1
cmp eax, ebp
jge 0x414c24
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x3c]
add ecx, eax
lea ecx, [edx + ecx*8]
fld qword [ecx]
inc eax
fstp dword [esp + eax*4 + 0xc4]
add ecx, 8
cmp eax, ebp
jl 0x414c13
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [ebp*4]
push eax
lea ecx, [esp + 0xd4]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
lea eax, [ebp*8]
add edx, ebp
add ecx, eax
dec edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
jne 0x414bc3
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
push edx
push eax
push esi
mov ecx, ebx
call fcn.00411a40
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x78]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea edx, [esp + 0xb8]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x80]
movzx edi, word [esp + 0xc0]
mov ecx, dword [esp + 0x54]
push 0
push 0
push 3
push 0
push 0
push 0x40000000
push ecx
sub edi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
lea edx, [esp + 0xb0]
push edx
lea eax, [esp + 0xac]
push eax
lea ecx, [esp + 0xa8]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileTime]
cmp ebp, 0xffffffff
je 0x414d73
fld qword [esp + 0x70]
mov esi, 0x18
fmul qword [0x4308c8]
sub esi, edi
call fcn.0041a7f8
cdq
mov ecx, 0x3c
idiv ecx
lea edi, [esp + 0xa0]
mov dword [esp + 0x1c], 3
mov dword [esp + 0x60], edx
mov dword [esp + 0x18], eax
lea edx, [esp + 0x78]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ax, word [esp + 0x18]
mov cx, word [esp + 0x60]
push edi
lea edx, [esp + 0x7c]
push edx
mov word [esp + 0x88], si
mov word [esp + 0x8a], ax
mov word [esp + 0x8c], cx
mov word [esp + 0x8e], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [esp + 0x1c]
add edi, 8
dec eax
mov dword [esp + 0x1c], eax
jne 0x414d21
lea eax, [esp + 0xb0]
push eax
lea ecx, [esp + 0xac]
push ecx
lea edx, [esp + 0xa8]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x8c]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call ebp
mov esi, dword [esp + 0x88]
push esi
call edi
push esi
call ebp
mov esi, dword [esp + 0x94]
push esi
call edi
push esi
call ebp
mov esi, dword [esp + 0x90]
push esi
call edi
push esi
call ebp
mov eax, dword [ebx + 0x1097a10]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x64
push 1
push 0x400
push eax
mov dword [ebx + 0x1097a30], 1
call esi
mov ecx, dword [esp + 0x54]
push ecx
push 1
mov dword [ebx + 0x1097a10], 0
mov edx, dword [0x4405b4]
push 0x400
push edx
call esi
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret