Function at 0x4163e0
Capabilities:
Create thread
Get system information on windows
Resolve function by parsing pe exports
Timestomp file
Write file on windows

Disassembly:
mov eax, 0x20368
call fcn.00427e90
push ebx
push ebp
mov ebp, dword [esp + 0x20374]
mov ecx, dword [ebp + 0x10cc080]
lea eax, [ebp + 0x10969f8]
mov dword [esp + 0x4c], eax
mov eax, dword [ebp + 0x10cc07c]
mov edx, dword [eax + 0xe0]
mov eax, dword [eax + 0xe4]
push esi
mov esi, dword [ecx + 0xe0]
mov ecx, dword [ecx + 0xe4]
cmp eax, ecx
push edi
jg 0x416437
jl 0x41642d
cmp edx, esi
jae 0x416437
mov edi, edx
mov ebx, eax
mov edx, esi
mov eax, ecx
jmp 0x41643b
mov edi, esi
mov ebx, ecx
cmp edi, edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], edi
jne 0x416457
cmp ebx, eax
je 0x416f50
mov ecx, dword [esp + 0x30]
sub ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
sbb edx, dword [esp + 0x3c]
mov eax, dword [ebp + 0x10cbf38]
mov ebx, dword [ebp + 0x10cbbb4]
mov dword [esp + 0x58], ecx
mov ecx, dword [ebp + 0x10cbf3c]
mov dword [esp + 0x5c], edx
fild qword [esp + 0x58]
mov edx, dword [0x450440]
mov dword [esp + 0x40], ecx
push 0x100
fstp qword [esp + 0x64]
shl edx, 9
fld qword [ebp + 0x10cbf40]
add edx, 0x44f440
fstp qword [esp + 0x5c]
push edx
fld qword [ebp + 0x10cbf48]
mov dword [esp + 0x28], eax
mov eax, dword [0x44f3ac]
fstp qword [esp + 0x90]
fld qword [0x4435a8]
mov ecx, 0x3e
fstp qword [esp + 0x258]
lea esi, [esp + 0x258]
fld qword [0x4435a0]
lea edi, [esp + 0x260]
rep movsd dword es:[edi], dword [esi]
fstp qword [esp + 0xd8]
push 0xcc
mov ecx, 0x3e
lea esi, [esp + 0xdc]
lea edi, [esp + 0xe4]
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.USER32.dll_LoadStringW]
mov eax, dword [0x450440]
lea ecx, [eax + 1]
and ecx, 0x80000007
jns 0x416527
dec ecx
or ecx, 0xfffffff8
inc ecx
mov edx, dword [ebp + 0x1097a10]
shl eax, 9
add eax, 0x44f440
push eax
push 2
push 0x400
push edx
mov dword [0x450440], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [esp + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
imul esi, ebx
add esi, esi
add esi, esi
add esi, esi
push esi
push 0x40
call edi
push eax
mov dword [esp + 0x74], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push 0x40
mov dword [esp + 0x2c], eax
call edi
push eax
mov dword [esp + 0x70], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push 0x40
mov dword [esp + 0x58], eax
call edi
push eax
mov dword [esp + 0x88], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, dword [esp + 0x30]
sub edi, dword [esp + 0x38]
mov dword [esp + 0x44], eax
imul edi, ebx
add edi, edi
add edi, edi
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [esp + 0x6c], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x54]
push 0
push eax
call fcn.00425d60
mov ecx, dword [esp + 0x30]
add esp, 0xc
push esi
push 0
push ecx
call fcn.00425d60
mov edx, dword [esp + 0x50]
add esp, 0xc
push esi
push 0
push edx
call fcn.00425d60
mov eax, dword [esp + 0x28]
add esp, 0xc
push edi
push 0
push eax
call fcn.00425d60
mov ecx, dword [ebp + 0x10cc078]
fld dword [ecx + 0x4ff0]
xor esi, esi
fdivr qword [esp + 0x6c]
add esp, 0xc
cmp dword [esp + 0x20], esi
mov dword [esp + 0x14], esi
fst qword [esp + 0xb0]
fld qword [0x4433c8]
jle 0x41669d
mov edi, dword [esp + 0x20]
fld st(1)
fadd st(0), st(0)
fld qword [esp + 0x88]
fld qword [esp + 0x58]
fsub st(1), st(0)
fild dword [esp + 0x20]
fild dword [esp + 0x14]
fmul st(3)
fdiv st(1)
fadd st(2)
fdivr st(5)
fdivr st(4)
call fcn.004278f0
mov edx, eax
and edx, 0x80000001
jns 0x416667
dec edx
or edx, 0xfffffffe
inc edx
cdq
je 0x416673
sub eax, edx
sar eax, 1
add eax, 1
jmp 0x416677
sub eax, edx
sar eax, 1
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
add esi, 1
cmp esi, edi
mov dword [esp + 0x14], esi
fmul st(5)
fdiv st(6)
fstp qword [esp + esi*8 + 0x10370]
jl 0x416645
fstp st(3)
fstp st(1)
fstp st(1)
fstp st(0)
mov eax, dword [esp + 0x38]
fstp st(1)
mov dword [esp + 0x48], eax
fstp st(0)
mov eax, dword [esp + 0x3c]
cmp eax, dword [esp + 0x34]
mov dword [esp + 0x4c], eax
jg 0x416792
jl 0x4166d0
mov ecx, dword [esp + 0x30]
cmp dword [esp + 0x38], ecx
jae 0x416792
jmp 0x4166d0
mov eax, dword [esp + 0x48]
sub eax, dword [esp + 0x38]
test ebx, ebx
mov dword [esp + 0x14], eax
jle 0x416768
mov edx, eax
mov eax, dword [esp + 0x1c]
imul edx, ebx
lea edi, [eax + edx*4]
lea esi, [ebp + 0x10cbc38]
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x40], 4
ja 0x41672c
fld qword [esp + 0x60]
mov ecx, dword [esp + 0x14]
sub esp, 0x10
test ecx, ecx
fstp qword [esp + 8]
fild dword [esp + 0x24]
jge 0x41671e
fadd qword [0x4434a0]
mov eax, dword [esp + 0x50]
fstp qword [esp]
call fcn.00415fd0
jmp 0x41672e
fldz
mov edx, dword [esp + 0x4c]
fstp qword [esp + 0x28]
mov ecx, dword [esp + 0x48]
mov eax, dword [esi]
push edx
push ecx
mov ecx, dword [ebp + 0x10cc078]
sub eax, 1
call fcn.00402c90
fld qword [esp + 0x28]
fstp dword [esp + 0x28]
add esi, 4
add edi, 4
sub dword [esp + 0x18], 1
fmul dword [esp + 0x28]
fstp dword [edi - 4]
jne 0x4166fa
add dword [esp + 0x48], 1
mov eax, dword [esp + 0x4c]
adc eax, 0
cmp eax, dword [esp + 0x34]
mov dword [esp + 0x4c], eax
jl 0x4166d0
jg 0x416792
mov edx, dword [esp + 0x48]
cmp edx, dword [esp + 0x30]
jb 0x4166d0
mov eax, dword [ebp + 0x1097a10]
push 2
push 1
push 0x400
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0x354]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x24]
mov dword [ebp + 0x10cbf54], eax
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x38]
mov dword [ebp + 0x10cbf60], eax
mov eax, dword [esp + 0x34]
mov dword [ebp + 0x10cbf6c], eax
mov ecx, dword [esp + 0x50]
lea edx, [esp + 0x10378]
mov dword [ebp + 0x10cbf50], edx
mov edx, dword [esp + 0x1c]
mov dword [ebp + 0x10cbf5c], edx
mov edx, dword [esp + 0x30]
mov dword [ebp + 0x10cbf68], edx
mov dword [ebp + 0x10cbf58], ecx
mov ecx, dword [esp + 0x3c]
mov eax, edi
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cbf64], ecx
mov dword [ebp + 0x10cc010], edi
xor esi, esi
mov dword [ebp + 0x10cbff0], esi
mov dword [ebp + 0x10cbff4], eax
lea eax, [edi + edi]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cbff8], eax
lea eax, [edi + edi*2]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cbffc], eax
lea eax, [edi*4]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cc000], eax
lea eax, [edi + edi*4]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cc004], eax
lea eax, [edi + edi*2]
add eax, eax
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cc008], eax
lea eax, [edi*8]
sub eax, edi
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cc00c], eax
lea ecx, [esp + 0x1d0]
lea eax, [ebp + 0x10cbf70]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], eax
lea esp, [esp]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
push 0
push 0
push eax
push 0x415f30
push 0
push 0
mov dword [edx], 0
mov dword [eax], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xfffffffffffffffe
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, 4
add dword [esp + 0x1c], eax
add dword [esp + 0x14], eax
add esi, 1
cmp esi, 8
jl 0x4168c0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp + 0x10cbf80]
add esi, dword [ebp + 0x10cbf88]
add esi, dword [ebp + 0x10cbf78]
add esi, dword [ebp + 0x10cbf84]
add esi, dword [ebp + 0x10cbf74]
add esi, dword [ebp + 0x10cbf70]
add esi, dword [ebp + 0x10cbf8c]
add esi, dword [ebp + 0x10cbf7c]
mov eax, esi
cdq
and edx, 7
add eax, edx
sar eax, 3
push eax
mov eax, dword [ebp + 0x1097a10]
push 1
push 0x400
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp esi, 0x320
jl 0x416902
mov ecx, dword [ebp + 0x10cc078]
xor eax, eax
cmp edi, eax
mov dword [esp + 0x1d0], eax
mov dword [esp + 0x1d4], eax
mov dword [esp + 0x1d8], eax
mov dword [esp + 0x1dc], eax
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], eax
mov dword [esp + 0x1e8], eax
mov dword [esp + 0x1ec], eax
fld dword [ecx + 0x4ff0]
fdivr qword [0x443440]
mov dword [esp + 0x14], eax
fst qword [esp + 0x48]
fld qword [0x4435b0]
fstp qword [esp + 0x60]
fld qword [0x4434d8]
jle 0x416aff
mov edx, dword [esp + 0x50]
mov dword [esp + 0x1c], edx
xor esi, esi
test ebx, ebx
jle 0x416adf
mov eax, dword [esp + 0x50]
fstp st(0)
mov ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
sub ecx, eax
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x44]
sub ecx, eax
mov dword [esp + 0x40], ecx
jmp 0x416a09
fstp st(0)
fld qword [esp + 0x48]
mov eax, dword [esp + 0x28]
fld qword [eax + edi]
fmul st(1)
fld qword [esp + 0xb0]
fdiv st(1), st(0)
fxch st(1)
fst qword [esp + 0x30]
fld qword [edi]
fmulp st(3)
fxch st(2)
fdivrp st(1)
fst qword [esp + 0xa8]
fmul st(0), st(0)
fld st(1)
fmulp st(2)
faddp st(1)
call fcn.0043b420
fst qword [esp + 0xb8]
call fcn.0043b680
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
mov ecx, dword [esp + 0x40]
fld qword [0x4434d8]
fmul st(1), st(0)
fxch st(1)
fst qword [ecx + edi]
fcom qword [esp + esi*8 + 0xd0]
fnstsw ax
test ah, 5
jp 0x416a77
fst qword [esp + esi*8 + 0xd0]
fcom qword [esp + esi*8 + 0x250]
fnstsw ax
test ah, 0x41
jne 0x416a8e
fstp qword [esp + esi*8 + 0x250]
jmp 0x416a90
fstp st(0)
mov eax, dword [esp + 0x14]
fld qword [esp + 0x30]
fstp qword [esp + eax*8 + 0x378]
fld qword [esp + 0xa8]
fstp qword [esp + eax*8 + 0x8378]
fld qword [esp + 0x60]
fld qword [esp + 0xb8]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x416ac9
fstp qword [esp + 0x60]
jmp 0x416acb
fstp st(0)
add esi, 1
add edi, 8
cmp esi, ebx
jl 0x416a03
fld qword [esp + 0x48]
fxch st(1)
mov eax, dword [esp + 0x14]
add eax, 1
lea ecx, [ebx*8]
add dword [esp + 0x1c], ecx
cmp eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
jl 0x4169d9
xor eax, eax
fstp st(1)
cmp ebx, 4
jl 0x416b66
lea ecx, [ebx - 3]
fld qword [esp + eax*8 + 0xd0]
add eax, 4
cmp eax, ecx
fsub qword [esp + eax*8 + 0x230]
fstp qword [esp + eax*8 + 0xb0]
fld qword [esp + eax*8 + 0xb8]
fsub qword [esp + eax*8 + 0x238]
fstp qword [esp + eax*8 + 0xb8]
fld qword [esp + eax*8 + 0xc0]
fsub qword [esp + eax*8 + 0x240]
fstp qword [esp + eax*8 + 0xc0]
fld qword [esp + eax*8 + 0xc8]
fsub qword [esp + eax*8 + 0x248]
fstp qword [esp + eax*8 + 0xc8]
jl 0x416b0b
cmp eax, ebx
jge 0x416b86
fld qword [esp + eax*8 + 0xd0]
add eax, 1
cmp eax, ebx
fsub qword [esp + eax*8 + 0x248]
fstp qword [esp + eax*8 + 0xc8]
jl 0x416b6a
mov eax, dword [esp + 0x20]
test eax, eax
jle 0x416c1b
mov edi, dword [esp + 0x44]
xor esi, esi
mov dword [esp + 0x18], eax
xor eax, eax
cmp ebx, 4
jl 0x416be5
lea edx, [ebx - 3]
mov ecx, edi
fld qword [ecx]
add eax, 4
fsub qword [esp + eax*8 + 0x230]
add ecx, 0x20
cmp eax, edx
fstp qword [ecx - 0x20]
fld qword [ecx - 0x18]
fsub qword [esp + eax*8 + 0x238]
fstp qword [ecx - 0x18]
fld qword [ecx - 0x10]
fsub qword [esp + eax*8 + 0x240]
fstp qword [ecx - 0x10]
fld qword [ecx - 8]
fsub qword [esp + eax*8 + 0x248]
fstp qword [ecx - 8]
jl 0x416ba8
cmp eax, ebx
jge 0x416c09
mov ecx, dword [esp + 0x44]
lea edx, [esi + eax]
lea ecx, [ecx + edx*8]
fld qword [ecx]
add eax, 1
fsub qword [esp + eax*8 + 0x248]
add ecx, 8
cmp eax, ebx
fstp qword [ecx - 8]
jl 0x416bf3
lea eax, [ebx*8]
add esi, ebx
add edi, eax
sub dword [esp + 0x18], 1
jne 0x416b9c
xor esi, esi
test ebx, ebx
jle 0x416c62
fldz
lea edi, [ebp + 0x10cbcb8]
fst dword [edi + 0x80]
fld qword [esp + esi*8 + 0xd0]
fabs
fdiv st(2)
call fcn.004278f0
or ecx, 0xffffffff
sub ecx, eax
lea edx, [ecx + ecx*4]
add edx, edx
add edx, edx
mov dword [esp + 0x28], edx
fild dword [esp + 0x28]
add esi, 1
add edi, 4
cmp esi, ebx
fstp dword [edi - 4]
jl 0x416c29
fstp st(1)
fstp st(0)
mov edi, dword [esp + 0x54]
fild dword [esp + 0x20]
mov esi, dword [ebp + 0x10cc078]
push ecx
lea eax, [ebp + 0x10cbbb4]
fmul qword [0x4433c8]
fld qword [esp + 0x8c]
fsub qword [esp + 0x5c]
fdivp st(1)
fstp dword [esp + 0x2c]
fld dword [esp + 0x2c]
fstp dword [esp]
push edi
call fcn.00403610
push 0
push 0x20
push 3
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x416ce7
mov eax, dword [ebp + 0x1097a10]
push 0x64
push 1
push 0x400
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp + 0x1097a10], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20368
ret 4
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x20]
test eax, eax
jle 0x416da9
mov ecx, dword [esp + 0x44]
xor edi, edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], eax
xor eax, eax
cmp ebx, 4
jl 0x416d51
mov ecx, dword [esp + 0x24]
lea edx, [ebx - 3]
lea esp, [esp]
fld qword [ecx]
add eax, 4
fstp dword [esp + eax*4 + 0xc0]
add ecx, 0x20
cmp eax, edx
fld qword [ecx - 0x18]
fstp dword [esp + eax*4 + 0xc4]
fld qword [ecx - 0x10]
fstp dword [esp + eax*4 + 0xc8]
fld qword [ecx - 8]
fstp dword [esp + eax*4 + 0xcc]
jl 0x416d20
cmp eax, ebx
jge 0x416d73
mov ecx, dword [esp + 0x44]
lea edx, [edi + eax]
lea ecx, [ecx + edx*8]
nop
fld qword [ecx]
add eax, 1
fstp dword [esp + eax*4 + 0xcc]
add ecx, 8
cmp eax, ebx
jl 0x416d60
push 0
lea edx, [esp + 0x2c]
push edx
lea eax, [ebx*4]
push eax
lea eax, [esp + 0xdc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebx*8]
add dword [esp + 0x24], eax
add edi, ebx
sub dword [esp + 0x18], 1
jne 0x416d0e
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push ecx
push edx
mov ebx, esi
mov ecx, ebp
call fcn.00415c60
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea ecx, [esp + 0xc0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [esp + 0x7c]
movzx esi, word [esp + 0xc8]
mov eax, dword [esp + 0x54]
push 0
push 0
push 3
push 0
push 0
push 0x40000000
push eax
sub esi, edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ecx, [esp + 0xa0]
push ecx
mov ebx, eax
lea edx, [esp + 0x9c]
push edx
lea eax, [esp + 0x98]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
cmp ebx, 0xffffffff
je 0x416eb2
fld qword [esp + 0x58]
mov edi, 0x18
fdiv qword [0x4433c8]
sub edi, esi
call fcn.004278f0
cdq
mov ecx, 0x3c
idiv ecx
lea esi, [esp + 0x90]
mov dword [esp + 0x18], 3
mov dword [esp + 0x40], edx
mov dword [esp + 0x28], eax
lea edx, [esp + 0x74]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ax, word [esp + 0x28]
mov cx, word [esp + 0x40]
push esi
lea edx, [esp + 0x78]
push edx
mov word [esp + 0x84], di
mov word [esp + 0x86], ax
mov word [esp + 0x88], cx
mov word [esp + 0x8a], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
add esi, 8
sub dword [esp + 0x18], 1
jne 0x416e64
lea eax, [esp + 0xa0]
push eax
lea ecx, [esp + 0x9c]
push ecx
lea edx, [esp + 0x98]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x68]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
call ebx
mov edi, dword [esp + 0x84]
push edi
call esi
push edi
call ebx
mov edi, dword [esp + 0x70]
push edi
call esi
push edi
call ebx
mov edi, dword [esp + 0x6c]
push edi
call esi
push edi
call ebx
mov eax, dword [ebp + 0x1097a10]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x64
push 1
push 0x400
push eax
mov dword [ebp + 0x1097a30], 1
call esi
mov ecx, dword [esp + 0x54]
mov edx, dword [0x44f420]
push ecx
push 1
push 0x400
push edx
mov dword [ebp + 0x1097a10], 0
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20368
ret 4