Function at 0x416930
Capabilities:
Create thread
Get system information on windows
Resolve function by parsing pe exports
Timestomp file
Write file on windows

Disassembly:
mov eax, 0x20368
call fcn.00428580
push ebx
push ebp
mov ebp, dword [esp + 0x20374]
mov ecx, dword [ebp + 0x10cc080]
lea eax, [ebp + 0x10969f8]
mov dword [esp + 0x4c], eax
mov eax, dword [ebp + 0x10cc07c]
mov edx, dword [eax + 0xe0]
mov eax, dword [eax + 0xe4]
push esi
mov esi, dword [ecx + 0xe0]
mov ecx, dword [ecx + 0xe4]
cmp eax, ecx
push edi
jg 0x416987
jl 0x41697d
cmp edx, esi
jae 0x416987
mov edi, edx
mov ebx, eax
mov edx, esi
mov eax, ecx
jmp 0x41698b
mov edi, esi
mov ebx, ecx
cmp edi, edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], edi
jne 0x4169a7
cmp ebx, eax
je 0x4174a0
mov ecx, dword [esp + 0x30]
sub ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
sbb edx, dword [esp + 0x3c]
mov eax, dword [ebp + 0x10cbf38]
mov ebx, dword [ebp + 0x10cbbb4]
mov dword [esp + 0x58], ecx
mov ecx, dword [ebp + 0x10cbf3c]
mov dword [esp + 0x5c], edx
fild qword [esp + 0x58]
mov edx, dword [0x450440]
mov dword [esp + 0x40], ecx
push 0x100
fstp qword [esp + 0x64]
shl edx, 9
fld qword [ebp + 0x10cbf40]
add edx, 0x44f440
fstp qword [esp + 0x5c]
push edx
fld qword [ebp + 0x10cbf48]
mov dword [esp + 0x28], eax
mov eax, dword [0x44f3ac]
fstp qword [esp + 0x90]
fld qword [0x443618]
mov ecx, 0x3e
fstp qword [esp + 0x258]
lea esi, [esp + 0x258]
fld qword [0x443610]
lea edi, [esp + 0x260]
rep movsd dword es:[edi], dword [esi]
fstp qword [esp + 0xd8]
push 0xcc
mov ecx, 0x3e
lea esi, [esp + 0xdc]
lea edi, [esp + 0xe4]
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.USER32.dll_LoadStringW]
mov eax, dword [0x450440]
lea ecx, [eax + 1]
and ecx, 0x80000007
jns 0x416a77
dec ecx
or ecx, 0xfffffff8
inc ecx
mov edx, dword [ebp + 0x1097a10]
shl eax, 9
add eax, 0x44f440
push eax
push 2
push 0x400
push edx
mov dword [0x450440], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [esp + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
imul esi, ebx
add esi, esi
add esi, esi
add esi, esi
push esi
push 0x40
call edi
push eax
mov dword [esp + 0x74], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push 0x40
mov dword [esp + 0x2c], eax
call edi
push eax
mov dword [esp + 0x70], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push 0x40
mov dword [esp + 0x58], eax
call edi
push eax
mov dword [esp + 0x88], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, dword [esp + 0x30]
sub edi, dword [esp + 0x38]
mov dword [esp + 0x44], eax
imul edi, ebx
add edi, edi
add edi, edi
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [esp + 0x6c], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x54]
push 0
push eax
call fcn.004263e0
mov ecx, dword [esp + 0x30]
add esp, 0xc
push esi
push 0
push ecx
call fcn.004263e0
mov edx, dword [esp + 0x50]
add esp, 0xc
push esi
push 0
push edx
call fcn.004263e0
mov eax, dword [esp + 0x28]
add esp, 0xc
push edi
push 0
push eax
call fcn.004263e0
mov ecx, dword [ebp + 0x10cc078]
fld dword [ecx + 0x4ff0]
xor esi, esi
fdivr qword [esp + 0x6c]
add esp, 0xc
cmp dword [esp + 0x20], esi
mov dword [esp + 0x14], esi
fst qword [esp + 0xb0]
fld qword [0x443438]
jle 0x416bed
mov edi, dword [esp + 0x20]
fld st(1)
fadd st(0), st(0)
fld qword [esp + 0x88]
fld qword [esp + 0x58]
fsub st(1), st(0)
fild dword [esp + 0x20]
fild dword [esp + 0x14]
fmul st(3)
fdiv st(1)
fadd st(2)
fdivr st(5)
fdivr st(4)
call fcn.00427fe0
mov edx, eax
and edx, 0x80000001
jns 0x416bb7
dec edx
or edx, 0xfffffffe
inc edx
cdq
je 0x416bc3
sub eax, edx
sar eax, 1
add eax, 1
jmp 0x416bc7
sub eax, edx
sar eax, 1
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
add esi, 1
cmp esi, edi
mov dword [esp + 0x14], esi
fmul st(5)
fdiv st(6)
fstp qword [esp + esi*8 + 0x10370]
jl 0x416b95
fstp st(3)
fstp st(1)
fstp st(1)
fstp st(0)
mov eax, dword [esp + 0x38]
fstp st(1)
mov dword [esp + 0x48], eax
fstp st(0)
mov eax, dword [esp + 0x3c]
cmp eax, dword [esp + 0x34]
mov dword [esp + 0x4c], eax
jg 0x416ce2
jl 0x416c20
mov ecx, dword [esp + 0x30]
cmp dword [esp + 0x38], ecx
jae 0x416ce2
jmp 0x416c20
mov eax, dword [esp + 0x48]
sub eax, dword [esp + 0x38]
test ebx, ebx
mov dword [esp + 0x14], eax
jle 0x416cb8
mov edx, eax
mov eax, dword [esp + 0x1c]
imul edx, ebx
lea edi, [eax + edx*4]
lea esi, [ebp + 0x10cbc38]
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x40], 4
ja 0x416c7c
fld qword [esp + 0x60]
mov ecx, dword [esp + 0x14]
sub esp, 0x10
test ecx, ecx
fstp qword [esp + 8]
fild dword [esp + 0x24]
jge 0x416c6e
fadd qword [0x443510]
mov eax, dword [esp + 0x50]
fstp qword [esp]
call fcn.00416520
jmp 0x416c7e
fldz
mov edx, dword [esp + 0x4c]
fstp qword [esp + 0x28]
mov ecx, dword [esp + 0x48]
mov eax, dword [esi]
push edx
push ecx
mov ecx, dword [ebp + 0x10cc078]
sub eax, 1
call fcn.00402c20
fld qword [esp + 0x28]
fstp dword [esp + 0x28]
add esi, 4
add edi, 4
sub dword [esp + 0x18], 1
fmul dword [esp + 0x28]
fstp dword [edi - 4]
jne 0x416c4a
add dword [esp + 0x48], 1
mov eax, dword [esp + 0x4c]
adc eax, 0
cmp eax, dword [esp + 0x34]
mov dword [esp + 0x4c], eax
jl 0x416c20
jg 0x416ce2
mov edx, dword [esp + 0x48]
cmp edx, dword [esp + 0x30]
jb 0x416c20
mov eax, dword [ebp + 0x1097a10]
push 2
push 1
push 0x400
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0x354]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x24]
mov dword [ebp + 0x10cbf54], eax
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x38]
mov dword [ebp + 0x10cbf60], eax
mov eax, dword [esp + 0x34]
mov dword [ebp + 0x10cbf6c], eax
mov ecx, dword [esp + 0x50]
lea edx, [esp + 0x10378]
mov dword [ebp + 0x10cbf50], edx
mov edx, dword [esp + 0x1c]
mov dword [ebp + 0x10cbf5c], edx
mov edx, dword [esp + 0x30]
mov dword [ebp + 0x10cbf68], edx
mov dword [ebp + 0x10cbf58], ecx
mov ecx, dword [esp + 0x3c]
mov eax, edi
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cbf64], ecx
mov dword [ebp + 0x10cc010], edi
xor esi, esi
mov dword [ebp + 0x10cbff0], esi
mov dword [ebp + 0x10cbff4], eax
lea eax, [edi + edi]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cbff8], eax
lea eax, [edi + edi*2]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cbffc], eax
lea eax, [edi*4]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cc000], eax
lea eax, [edi + edi*4]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cc004], eax
lea eax, [edi + edi*2]
add eax, eax
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cc008], eax
lea eax, [edi*8]
sub eax, edi
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cc00c], eax
lea ecx, [esp + 0x1d0]
lea eax, [ebp + 0x10cbf70]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], eax
lea esp, [esp]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
push 0
push 0
push eax
push 0x416480
push 0
push 0
mov dword [edx], 0
mov dword [eax], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xfffffffffffffffe
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, 4
add dword [esp + 0x1c], eax
add dword [esp + 0x14], eax
add esi, 1
cmp esi, 8
jl 0x416e10
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp + 0x10cbf80]
add esi, dword [ebp + 0x10cbf88]
add esi, dword [ebp + 0x10cbf78]
add esi, dword [ebp + 0x10cbf84]
add esi, dword [ebp + 0x10cbf74]
add esi, dword [ebp + 0x10cbf70]
add esi, dword [ebp + 0x10cbf8c]
add esi, dword [ebp + 0x10cbf7c]
mov eax, esi
cdq
and edx, 7
add eax, edx
sar eax, 3
push eax
mov eax, dword [ebp + 0x1097a10]
push 1
push 0x400
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp esi, 0x320
jl 0x416e52
mov ecx, dword [ebp + 0x10cc078]
xor eax, eax
cmp edi, eax
mov dword [esp + 0x1d0], eax
mov dword [esp + 0x1d4], eax
mov dword [esp + 0x1d8], eax
mov dword [esp + 0x1dc], eax
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], eax
mov dword [esp + 0x1e8], eax
mov dword [esp + 0x1ec], eax
fld dword [ecx + 0x4ff0]
fdivr qword [0x4434b0]
mov dword [esp + 0x14], eax
fst qword [esp + 0x48]
fld qword [0x443620]
fstp qword [esp + 0x60]
fld qword [0x443548]
jle 0x41704f
mov edx, dword [esp + 0x50]
mov dword [esp + 0x1c], edx
xor esi, esi
test ebx, ebx
jle 0x41702f
mov eax, dword [esp + 0x50]
fstp st(0)
mov ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
sub ecx, eax
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x44]
sub ecx, eax
mov dword [esp + 0x40], ecx
jmp 0x416f59
fstp st(0)
fld qword [esp + 0x48]
mov eax, dword [esp + 0x28]
fld qword [eax + edi]
fmul st(1)
fld qword [esp + 0xb0]
fdiv st(1), st(0)
fxch st(1)
fst qword [esp + 0x30]
fld qword [edi]
fmulp st(3)
fxch st(2)
fdivrp st(1)
fst qword [esp + 0xa8]
fmul st(0), st(0)
fld st(1)
fmulp st(2)
faddp st(1)
call fcn.0043b030
fst qword [esp + 0xb8]
call fcn.0043b160
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
mov ecx, dword [esp + 0x40]
fld qword [0x443548]
fmul st(1), st(0)
fxch st(1)
fst qword [ecx + edi]
fcom qword [esp + esi*8 + 0xd0]
fnstsw ax
test ah, 5
jp 0x416fc7
fst qword [esp + esi*8 + 0xd0]
fcom qword [esp + esi*8 + 0x250]
fnstsw ax
test ah, 0x41
jne 0x416fde
fstp qword [esp + esi*8 + 0x250]
jmp 0x416fe0
fstp st(0)
mov eax, dword [esp + 0x14]
fld qword [esp + 0x30]
fstp qword [esp + eax*8 + 0x378]
fld qword [esp + 0xa8]
fstp qword [esp + eax*8 + 0x8378]
fld qword [esp + 0x60]
fld qword [esp + 0xb8]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x417019
fstp qword [esp + 0x60]
jmp 0x41701b
fstp st(0)
add esi, 1
add edi, 8
cmp esi, ebx
jl 0x416f53
fld qword [esp + 0x48]
fxch st(1)
mov eax, dword [esp + 0x14]
add eax, 1
lea ecx, [ebx*8]
add dword [esp + 0x1c], ecx
cmp eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
jl 0x416f29
xor eax, eax
fstp st(1)
cmp ebx, 4
jl 0x4170b6
lea ecx, [ebx - 3]
fld qword [esp + eax*8 + 0xd0]
add eax, 4
cmp eax, ecx
fsub qword [esp + eax*8 + 0x230]
fstp qword [esp + eax*8 + 0xb0]
fld qword [esp + eax*8 + 0xb8]
fsub qword [esp + eax*8 + 0x238]
fstp qword [esp + eax*8 + 0xb8]
fld qword [esp + eax*8 + 0xc0]
fsub qword [esp + eax*8 + 0x240]
fstp qword [esp + eax*8 + 0xc0]
fld qword [esp + eax*8 + 0xc8]
fsub qword [esp + eax*8 + 0x248]
fstp qword [esp + eax*8 + 0xc8]
jl 0x41705b
cmp eax, ebx
jge 0x4170d6
fld qword [esp + eax*8 + 0xd0]
add eax, 1
cmp eax, ebx
fsub qword [esp + eax*8 + 0x248]
fstp qword [esp + eax*8 + 0xc8]
jl 0x4170ba
mov eax, dword [esp + 0x20]
test eax, eax
jle 0x41716b
mov edi, dword [esp + 0x44]
xor esi, esi
mov dword [esp + 0x18], eax
xor eax, eax
cmp ebx, 4
jl 0x417135
lea edx, [ebx - 3]
mov ecx, edi
fld qword [ecx]
add eax, 4
fsub qword [esp + eax*8 + 0x230]
add ecx, 0x20
cmp eax, edx
fstp qword [ecx - 0x20]
fld qword [ecx - 0x18]
fsub qword [esp + eax*8 + 0x238]
fstp qword [ecx - 0x18]
fld qword [ecx - 0x10]
fsub qword [esp + eax*8 + 0x240]
fstp qword [ecx - 0x10]
fld qword [ecx - 8]
fsub qword [esp + eax*8 + 0x248]
fstp qword [ecx - 8]
jl 0x4170f8
cmp eax, ebx
jge 0x417159
mov ecx, dword [esp + 0x44]
lea edx, [esi + eax]
lea ecx, [ecx + edx*8]
fld qword [ecx]
add eax, 1
fsub qword [esp + eax*8 + 0x248]
add ecx, 8
cmp eax, ebx
fstp qword [ecx - 8]
jl 0x417143
lea eax, [ebx*8]
add esi, ebx
add edi, eax
sub dword [esp + 0x18], 1
jne 0x4170ec
xor esi, esi
test ebx, ebx
jle 0x4171b2
fldz
lea edi, [ebp + 0x10cbcb8]
fst dword [edi + 0x80]
fld qword [esp + esi*8 + 0xd0]
fabs
fdiv st(2)
call fcn.00427fe0
or ecx, 0xffffffff
sub ecx, eax
lea edx, [ecx + ecx*4]
add edx, edx
add edx, edx
mov dword [esp + 0x28], edx
fild dword [esp + 0x28]
add esi, 1
add edi, 4
cmp esi, ebx
fstp dword [edi - 4]
jl 0x417179
fstp st(1)
fstp st(0)
mov edi, dword [esp + 0x54]
fild dword [esp + 0x20]
mov esi, dword [ebp + 0x10cc078]
push ecx
lea eax, [ebp + 0x10cbbb4]
fmul qword [0x443438]
fld qword [esp + 0x8c]
fsub qword [esp + 0x5c]
fdivp st(1)
fstp dword [esp + 0x2c]
fld dword [esp + 0x2c]
fstp dword [esp]
push edi
call fcn.00403590
push 0
push 0x20
push 3
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x417237
mov eax, dword [ebp + 0x1097a10]
push 0x64
push 1
push 0x400
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp + 0x1097a10], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20368
ret 4
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x20]
test eax, eax
jle 0x4172f9
mov ecx, dword [esp + 0x44]
xor edi, edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], eax
xor eax, eax
cmp ebx, 4
jl 0x4172a1
mov ecx, dword [esp + 0x24]
lea edx, [ebx - 3]
lea esp, [esp]
fld qword [ecx]
add eax, 4
fstp dword [esp + eax*4 + 0xc0]
add ecx, 0x20
cmp eax, edx
fld qword [ecx - 0x18]
fstp dword [esp + eax*4 + 0xc4]
fld qword [ecx - 0x10]
fstp dword [esp + eax*4 + 0xc8]
fld qword [ecx - 8]
fstp dword [esp + eax*4 + 0xcc]
jl 0x417270
cmp eax, ebx
jge 0x4172c3
mov ecx, dword [esp + 0x44]
lea edx, [edi + eax]
lea ecx, [ecx + edx*8]
nop
fld qword [ecx]
add eax, 1
fstp dword [esp + eax*4 + 0xcc]
add ecx, 8
cmp eax, ebx
jl 0x4172b0
push 0
lea edx, [esp + 0x2c]
push edx
lea eax, [ebx*4]
push eax
lea eax, [esp + 0xdc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebx*8]
add dword [esp + 0x24], eax
add edi, ebx
sub dword [esp + 0x18], 1
jne 0x41725e
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push ecx
push edx
mov ebx, esi
mov ecx, ebp
call fcn.004161b0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea ecx, [esp + 0xc0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [esp + 0x7c]
movzx esi, word [esp + 0xc8]
mov eax, dword [esp + 0x54]
push 0
push 0
push 3
push 0
push 0
push 0x40000000
push eax
sub esi, edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ecx, [esp + 0xa0]
push ecx
mov ebx, eax
lea edx, [esp + 0x9c]
push edx
lea eax, [esp + 0x98]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
cmp ebx, 0xffffffff
je 0x417402
fld qword [esp + 0x58]
mov edi, 0x18
fdiv qword [0x443438]
sub edi, esi
call fcn.00427fe0
cdq
mov ecx, 0x3c
idiv ecx
lea esi, [esp + 0x90]
mov dword [esp + 0x18], 3
mov dword [esp + 0x40], edx
mov dword [esp + 0x28], eax
lea edx, [esp + 0x74]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ax, word [esp + 0x28]
mov cx, word [esp + 0x40]
push esi
lea edx, [esp + 0x78]
push edx
mov word [esp + 0x84], di
mov word [esp + 0x86], ax
mov word [esp + 0x88], cx
mov word [esp + 0x8a], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
add esi, 8
sub dword [esp + 0x18], 1
jne 0x4173b4
lea eax, [esp + 0xa0]
push eax
lea ecx, [esp + 0x9c]
push ecx
lea edx, [esp + 0x98]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x68]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
call ebx
mov edi, dword [esp + 0x84]
push edi
call esi
push edi
call ebx
mov edi, dword [esp + 0x70]
push edi
call esi
push edi
call ebx
mov edi, dword [esp + 0x6c]
push edi
call esi
push edi
call ebx
mov eax, dword [ebp + 0x1097a10]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x64
push 1
push 0x400
push eax
mov dword [ebp + 0x1097a30], 1
call esi
mov ecx, dword [esp + 0x54]
mov edx, dword [0x44f420]
push ecx
push 1
push 0x400
push edx
mov dword [ebp + 0x1097a10], 0
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20368
ret 4