Function at 0x415670
Capabilities:
Create thread
Get system information on windows
Resolve function by parsing pe exports
Timestomp file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x20360
call fcn.0041c820
push ebx
mov ebx, ecx
mov ecx, dword [ebx + 0x10cc07c]
mov edx, dword [ecx + 0xe0]
lea eax, [ebx + 0x10969f8]
push ebp
mov dword [esp + 0x4c], eax
mov eax, dword [ecx + 0xe4]
mov ecx, dword [ebx + 0x10cc080]
push esi
mov esi, dword [ecx + 0xe0]
mov ecx, dword [ecx + 0xe4]
cmp eax, ecx
push edi
jg 0x4156c8
jl 0x4156be
cmp edx, esi
jae 0x4156c8
mov edi, edx
mov ebp, eax
mov edx, esi
mov eax, ecx
jmp 0x4156cc
mov edi, esi
mov ebp, ecx
cmp edi, edx
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], ebp
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
jne 0x4156e8
cmp ebp, eax
je 0x4161da
mov edi, dword [esp + 0x30]
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x24]
mov ecx, dword [ebx + 0x10cbf38]
mov ebp, dword [ebx + 0x10cbbb4]
sub edx, edi
sbb eax, esi
mov dword [esp + 0x58], edx
mov edx, dword [ebx + 0x10cbf3c]
mov dword [esp + 0x5c], eax
fild qword [esp + 0x58]
mov dword [esp + 0x2c], ecx
mov ecx, 0x3e
lea esi, [esp + 0x248]
fstp qword [esp + 0x68]
lea edi, [esp + 0x250]
fld qword [ebx + 0x10cbf40]
push 0xcc
fstp qword [esp + 0x74]
mov dword [esp + 0x50], ebp
fld qword [ebx + 0x10cbf48]
mov dword [esp + 0x64], edx
fstp qword [esp + 0x9c]
fld qword [0x431b10]
fstp qword [esp + 0x24c]
rep movsd dword es:[edi], dword [esi]
fld qword [0x431b08]
fstp qword [esp + 0xcc]
mov ecx, 0x3e
lea esi, [esp + 0xcc]
lea edi, [esp + 0xd4]
rep movsd dword es:[edi], dword [esi]
call fcn.00416d90
add esp, 4
push eax
mov eax, dword [ebx + 0x1097a10]
push 2
push 0x400
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [esp + 0x2c]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
imul esi, ebp
shl esi, 3
push esi
push 0x40
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
mov dword [esp + 0x98], eax
call ebp
push esi
push 0x40
mov dword [esp + 0x1c], eax
call edi
push eax
mov dword [esp + 0x94], eax
call ebp
push esi
push 0x40
mov dword [esp + 0x58], eax
call edi
push eax
mov dword [esp + 0x8c], eax
call ebp
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x3c], eax
sub ebp, dword [esp + 0x30]
imul ebp, dword [esp + 0x4c]
shl ebp, 2
push ebp
push 0x40
call edi
push eax
mov dword [esp + 0x90], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [esp + 0x28], eax
mov ecx, esi
xor eax, eax
mov edi, dword [esp + 0x50]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x14]
xor eax, eax
mov ecx, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x3c]
xor eax, eax
mov ecx, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x28]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 0x10cc078]
xor esi, esi
mov dword [esp + 0x10], esi
fld dword [eax + 0x4ff0]
mov eax, dword [esp + 0x2c]
test eax, eax
fdivr qword [esp + 0x68]
mov edi, eax
fstp qword [esp + 0x58]
jle 0x415910
fld qword [esp + 0x98]
fsub qword [esp + 0x70]
fild dword [esp + 0x2c]
fld qword [0x4318d8]
fdiv qword [esp + 0x58]
mov edi, edi
fild dword [esp + 0x10]
fmul st(3)
fdiv st(2)
fadd qword [esp + 0x70]
fdivr qword [0x430a00]
fdivr qword [esp + 0x58]
fadd st(0), st(0)
call fcn.0041bcd8
mov ecx, eax
and ecx, 0x80000001
jns 0x4158dc
dec ecx
or ecx, 0xfffffffe
inc ecx
cdq
je 0x4158e6
sub eax, edx
sar eax, 1
inc eax
jmp 0x4158ea
sub eax, edx
sar eax, 1
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
inc esi
cmp esi, edi
mov dword [esp + 0x10], esi
fmul st(1)
fmul qword [0x430a00]
fstp qword [esp + esi*8 + 0x10368]
jl 0x4158b0
fstp st(0)
fstp st(0)
fstp st(0)
mov eax, dword [esp + 0x34]
cmp eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], eax
jg 0x415a0d
jl 0x415936
cmp ecx, dword [esp + 0x20]
jae 0x415a0d
mov ebp, dword [esp + 0x4c]
lea ebx, [ebx]
mov edx, dword [esp + 0x40]
sub edx, dword [esp + 0x30]
test ebp, ebp
jle 0x4159d9
fld qword [esp + 0x68]
sub esp, 0x10
test edx, edx
fstp qword [esp + 8]
mov dword [esp + 0x28], edx
fild dword [esp + 0x28]
jge 0x41596d
fadd qword [0x430740]
mov eax, dword [esp + 0x70]
fstp qword [esp]
push eax
mov ecx, ebx
call fcn.00414e20
imul edx, ebp
fstp dword [esp + 0x18]
mov ecx, dword [esp + 0x28]
lea edx, [ecx + edx*4]
mov dword [esp + 0x10], edx
lea esi, [ebx + 0x10cbc38]
mov dword [esp + 0x1c], ebp
jmp 0x4159a0
mov eax, dword [esi]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
dec eax
push eax
push ecx
mov ecx, dword [ebx + 0x10cc078]
push edx
call fcn.00401840
fmul dword [esp + 0x18]
mov eax, dword [esp + 0x10]
add eax, 4
fstp dword [eax - 4]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
add esi, 4
dec eax
mov dword [esp + 0x1c], eax
jne 0x4159a0
mov esi, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x24]
add esi, 1
adc eax, 0
cmp eax, ecx
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], eax
jl 0x415940
jg 0x415a11
mov eax, dword [esp + 0x20]
mov ecx, esi
cmp ecx, eax
jb 0x415940
jmp 0x415a11
mov ebp, dword [esp + 0x4c]
mov ecx, dword [ebx + 0x1097a10]
push 2
push 1
push 0x400
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
lea edx, [esp + 0x34c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [esp + 0x50]
mov ecx, dword [esp + 0x14]
mov dword [ebx + 0x10cbf58], edx
mov edx, dword [esp + 0x34]
mov dword [ebx + 0x10cbf64], edx
lea eax, [esp + 0x10370]
mov dword [ebx + 0x10cbf50], eax
mov eax, dword [esp + 0x28]
mov dword [ebx + 0x10cbf5c], eax
mov eax, dword [esp + 0x20]
mov dword [ebx + 0x10cbf68], eax
mov dword [ebx + 0x10cbf54], ecx
mov ecx, dword [esp + 0x30]
mov dword [ebx + 0x10cbf60], ecx
mov ecx, dword [esp + 0x24]
mov eax, edi
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebx + 0x10cbf6c], ecx
mov dword [ebx + 0x10cc010], edi
xor esi, esi
mov dword [ebx + 0x10cbff0], esi
mov dword [ebx + 0x10cbff4], eax
lea eax, [edi + edi]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebx + 0x10cbff8], eax
lea eax, [edi + edi*2]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebx + 0x10cbffc], eax
lea eax, [edi*4]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebx + 0x10cc000], eax
lea eax, [edi + edi*4]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebx + 0x10cc004], eax
lea eax, [edi + edi*2]
shl eax, 1
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebx + 0x10cc008], eax
mov eax, edi
imul eax, eax, 7
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebx + 0x10cc00c], eax
lea edx, [esp + 0x1c8]
lea eax, [ebx + 0x10cbf70]
mov dword [esp + 0x10], edx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
push 0
push 0
mov dword [eax], 0
mov eax, dword [esp + 0x18]
push eax
push 0x415620
push 0
push 0
mov dword [eax], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xfffffffffffffffe
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x10]
mov eax, 4
inc esi
add edx, eax
add ecx, eax
cmp esi, 8
mov dword [esp + 0x28], edx
mov dword [esp + 0x10], ecx
jl 0x415b30
lea esp, [esp]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebx + 0x10cbf74]
mov esi, dword [ebx + 0x10cbf84]
mov ecx, dword [ebx + 0x10cbf70]
mov eax, dword [ebx + 0x10cbf8c]
add esi, edx
mov edx, dword [ebx + 0x10cbf7c]
add esi, ecx
mov ecx, dword [ebx + 0x10cbf80]
add esi, eax
mov eax, dword [ebx + 0x10cbf88]
add esi, edx
mov edx, dword [ebx + 0x10cbf78]
add esi, ecx
mov ecx, dword [ebx + 0x1097a10]
add esi, eax
add esi, edx
mov eax, esi
cdq
and edx, 7
add eax, edx
sar eax, 3
push eax
push 1
push 0x400
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp esi, 0x320
jl 0x415b80
mov edx, dword [ebx + 0x10cc078]
xor esi, esi
cmp edi, esi
mov dword [esp + 0x1c8], esi
mov dword [esp + 0x1cc], esi
mov dword [esp + 0x1d0], esi
mov dword [esp + 0x1d4], esi
mov dword [esp + 0x1d8], esi
mov dword [esp + 0x1dc], esi
mov dword [esp + 0x1e0], esi
mov dword [esp + 0x1e4], esi
fld dword [edx + 0x4ff0]
fdivr qword [0x430818]
fstp qword [esp + 0x20]
fld qword [0x431b10]
fstp qword [esp + 0x60]
jle 0x415d4c
lea eax, [ebp*8]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x10], eax
xor edx, edx
test ebp, ebp
jle 0x415d35
fld qword [0x4318d8]
mov edi, dword [esp + 0x14]
fdiv qword [esp + 0x58]
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x10]
sub edi, eax
sub ebp, eax
fstp qword [esp + 0x68]
jmp 0x415c92
fstp st(0)
fld qword [esp + 0x68]
fmul qword [edi + ecx]
fmul qword [esp + 0x20]
fld qword [esp + 0x68]
fmul qword [ecx]
fmul qword [esp + 0x20]
fst qword [esp + 0x40]
fmul qword [esp + 0x40]
fld st(1)
fmul st(2)
faddp st(1)
fsqrt
fld st(0)
fldlg2
fxch st(1)
fyl2x
fmul dword [0x431b00]
fcom qword [esp + edx*8 + 0xc8]
fst qword [ecx + ebp]
fnstsw ax
test ah, 5
jp 0x415cdd
fst qword [esp + edx*8 + 0xc8]
fcom qword [esp + edx*8 + 0x248]
fnstsw ax
test ah, 0x41
jne 0x415cf4
fstp qword [esp + edx*8 + 0x248]
jmp 0x415cf6
fstp st(0)
fcom qword [esp + 0x60]
fnstsw ax
test ah, 0x41
jne 0x415d07
fstp qword [esp + 0x60]
jmp 0x415d09
fstp st(0)
mov eax, dword [esp + 0x4c]
inc edx
add ecx, 8
cmp edx, eax
jl 0x415c90
mov edi, dword [esp + 0x2c]
fstp qword [esp + esi*8 + 0x370]
fld qword [esp + 0x40]
mov ebp, eax
mov eax, dword [esp + 0x50]
fstp qword [esp + esi*8 + 0x8370]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
inc esi
add edx, ecx
cmp esi, edi
mov dword [esp + 0x10], edx
jl 0x415c66
xor eax, eax
cmp ebp, 4
jl 0x415dbb
lea ecx, [ebp - 3]
jmp 0x415d60
fld qword [esp + eax*8 + 0xc8]
add eax, 4
cmp eax, ecx
fsub qword [esp + eax*8 + 0x228]
fstp qword [esp + eax*8 + 0xa8]
fld qword [esp + eax*8 + 0xb0]
fsub qword [esp + eax*8 + 0x230]
fstp qword [esp + eax*8 + 0xb0]
fld qword [esp + eax*8 + 0xb8]
fsub qword [esp + eax*8 + 0x238]
fstp qword [esp + eax*8 + 0xb8]
fld qword [esp + eax*8 + 0xc0]
fsub qword [esp + eax*8 + 0x240]
fstp qword [esp + eax*8 + 0xc0]
jl 0x415d60
cmp eax, ebp
jge 0x415dda
nop
fld qword [esp + eax*8 + 0xc8]
inc eax
cmp eax, ebp
fsub qword [esp + eax*8 + 0x240]
fstp qword [esp + eax*8 + 0xc0]
jl 0x415dc0
test edi, edi
jle 0x415e86
mov eax, dword [esp + 0x3c]
xor edx, edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], edi
xor ecx, ecx
cmp ebp, 4
jl 0x415e3d
mov eax, dword [esp + 0x14]
lea esi, [ebp - 3]
mov edi, edi
fld qword [eax]
add ecx, 4
fsub qword [esp + ecx*8 + 0x228]
add eax, 0x20
cmp ecx, esi
fstp qword [eax - 0x20]
fld qword [eax - 0x18]
fsub qword [esp + ecx*8 + 0x230]
fstp qword [eax - 0x18]
fld qword [eax - 0x10]
fsub qword [esp + ecx*8 + 0x238]
fstp qword [eax - 0x10]
fld qword [eax - 8]
fsub qword [esp + ecx*8 + 0x240]
fstp qword [eax - 8]
jl 0x415e00
cmp ecx, ebp
jge 0x415e64
mov esi, dword [esp + 0x3c]
lea eax, [edx + ecx]
lea eax, [esi + eax*8]
jmp 0x415e50
fld qword [eax]
inc ecx
fsub qword [esp + ecx*8 + 0x240]
add eax, 8
cmp ecx, ebp
fstp qword [eax - 8]
jl 0x415e50
mov ecx, dword [esp + 0x14]
lea eax, [ebp*8]
add ecx, eax
mov eax, dword [esp + 0x1c]
add edx, ebp
dec eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], eax
jne 0x415df0
xor esi, esi
test ebp, ebp
jle 0x415ee7
lea ecx, [ebx + 0x10cbcb8]
mov dword [esp + 0x14], ecx
jmp 0x415ea0
fld qword [esp + esi*8 + 0xc8]
mov edx, dword [esp + 0x14]
fabs
mov dword [edx + 0x80], 0
fmul qword [0x431af8]
call fcn.0041bcd8
or ecx, 0xffffffff
sub ecx, eax
lea eax, [ecx + ecx*4]
shl eax, 2
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
mov eax, dword [esp + 0x14]
inc esi
fstp dword [eax]
add eax, 4
cmp esi, ebp
mov dword [esp + 0x14], eax
jl 0x415ea0
fild dword [esp + 0x2c]
mov esi, dword [esp + 0x54]
push ecx
mov ecx, dword [ebx + 0x10cc078]
fmul qword [0x430a00]
lea eax, [ebx + 0x10cbbb4]
fld qword [esp + 0x9c]
fsub qword [esp + 0x74]
fdivp st(1)
fstp dword [esp]
push eax
push esi
call fcn.004021d0
push 0
push 0x20
push 3
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x415f5e
mov ecx, dword [ebx + 0x1097a10]
push 0x64
push 1
push 0x400
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebx + 0x1097a10], 0
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test edi, edi
jle 0x416024
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], edx
xor eax, eax
cmp ebp, 4
jl 0x415fc2
mov ecx, dword [esp + 0x10]
lea edx, [ebp - 3]
fld qword [ecx]
add eax, 4
fstp dword [esp + eax*4 + 0xb8]
add ecx, 0x20
cmp eax, edx
fld qword [ecx - 0x18]
fstp dword [esp + eax*4 + 0xbc]
fld qword [ecx - 0x10]
fstp dword [esp + eax*4 + 0xc0]
fld qword [ecx - 8]
fstp dword [esp + eax*4 + 0xc4]
jl 0x415f91
cmp eax, ebp
jge 0x415fe4
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x3c]
add ecx, eax
lea ecx, [edx + ecx*8]
fld qword [ecx]
inc eax
fstp dword [esp + eax*4 + 0xc4]
add ecx, 8
cmp eax, ebp
jl 0x415fd3
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [ebp*4]
push eax
lea ecx, [esp + 0xd4]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
lea eax, [ebp*8]
add edx, ebp
add ecx, eax
dec edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
jne 0x415f83
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
push edx
push eax
push esi
mov ecx, ebx
call fcn.00412df0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x78]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea edx, [esp + 0xb8]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x80]
movzx edi, word [esp + 0xc0]
mov ecx, dword [esp + 0x54]
push 0
push 0
push 3
push 0
push 0
push 0x40000000
push ecx
sub edi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
lea edx, [esp + 0xb0]
push edx
lea eax, [esp + 0xac]
push eax
lea ecx, [esp + 0xa8]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileTime]
cmp ebp, 0xffffffff
je 0x416133
fld qword [esp + 0x70]
mov esi, 0x18
fmul qword [0x431af0]
sub esi, edi
call fcn.0041bcd8
cdq
mov ecx, 0x3c
idiv ecx
lea edi, [esp + 0xa0]
mov dword [esp + 0x1c], 3
mov dword [esp + 0x60], edx
mov dword [esp + 0x18], eax
lea edx, [esp + 0x78]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ax, word [esp + 0x18]
mov cx, word [esp + 0x60]
push edi
lea edx, [esp + 0x7c]
push edx
mov word [esp + 0x88], si
mov word [esp + 0x8a], ax
mov word [esp + 0x8c], cx
mov word [esp + 0x8e], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [esp + 0x1c]
add edi, 8
dec eax
mov dword [esp + 0x1c], eax
jne 0x4160e1
lea eax, [esp + 0xb0]
push eax
lea ecx, [esp + 0xac]
push ecx
lea edx, [esp + 0xa8]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x8c]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call ebp
mov esi, dword [esp + 0x88]
push esi
call edi
push esi
call ebp
mov esi, dword [esp + 0x94]
push esi
call edi
push esi
call ebp
mov esi, dword [esp + 0x90]
push esi
call edi
push esi
call ebp
mov eax, dword [ebx + 0x1097a10]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x64
push 1
push 0x400
push eax
mov dword [ebx + 0x1097a30], 1
call esi
mov ecx, dword [esp + 0x54]
push ecx
push 1
mov dword [ebx + 0x1097a10], 0
mov edx, dword [0x4425b4]
push 0x400
push edx
call esi
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret