Function at 0x4177d0
Capabilities:
Create thread
Get system information on windows
Resolve function by parsing pe exports
Timestomp file
Write file on windows

Disassembly:
mov eax, 0x20368
call fcn.00442670
push ebx
push ebp
mov ebp, dword [esp + 0x20374]
mov ecx, dword [ebp + 0x10cc080]
lea eax, [ebp + 0x10969f8]
mov dword [esp + 0x4c], eax
mov eax, dword [ebp + 0x10cc07c]
mov edx, dword [eax + 0xe0]
mov eax, dword [eax + 0xe4]
push esi
mov esi, dword [ecx + 0xe0]
mov ecx, dword [ecx + 0xe4]
cmp eax, ecx
push edi
jg 0x417827
jl 0x41781d
cmp edx, esi
jae 0x417827
mov edi, edx
mov ebx, eax
mov edx, esi
mov eax, ecx
jmp 0x41782b
mov edi, esi
mov ebx, ecx
cmp edi, edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], edi
jne 0x417847
cmp ebx, eax
je 0x418340
mov ecx, dword [esp + 0x30]
sub ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
sbb edx, dword [esp + 0x3c]
mov eax, dword [ebp + 0x10cbf38]
mov ebx, dword [ebp + 0x10cbbb4]
mov dword [esp + 0x58], ecx
mov ecx, dword [ebp + 0x10cbf3c]
mov dword [esp + 0x5c], edx
fild qword [esp + 0x58]
mov edx, dword [0x489b08]
mov dword [esp + 0x40], ecx
push 0x100
fstp qword [esp + 0x64]
shl edx, 9
fld qword [ebp + 0x10cbf40]
add edx, 0x488b08
fstp qword [esp + 0x5c]
push edx
fld qword [ebp + 0x10cbf48]
mov dword [esp + 0x28], eax
mov eax, dword [0x488a6c]
fstp qword [esp + 0x90]
fld qword [0x479680]
mov ecx, 0x3e
fstp qword [esp + 0x258]
lea esi, [esp + 0x258]
fld qword [0x479678]
lea edi, [esp + 0x260]
rep movsd dword es:[edi], dword [esi]
fstp qword [esp + 0xd8]
push 0xcc
mov ecx, 0x3e
lea esi, [esp + 0xdc]
lea edi, [esp + 0xe4]
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.USER32.dll_LoadStringW]
mov eax, dword [0x489b08]
lea ecx, [eax + 1]
and ecx, reloc.OLEAUT32.dll_VariantInit
jns 0x417917
dec ecx
or ecx, 0xfffffff8
inc ecx
mov edx, dword [ebp + 0x1097a10]
shl eax, 9
add eax, 0x488b08
push eax
push 2
push 0x400
push edx
mov dword [0x489b08], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [esp + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
imul esi, ebx
add esi, esi
add esi, esi
add esi, esi
push esi
push 0x40
call edi
push eax
mov dword [esp + 0x74], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push 0x40
mov dword [esp + 0x2c], eax
call edi
push eax
mov dword [esp + 0x70], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push 0x40
mov dword [esp + 0x58], eax
call edi
push eax
mov dword [esp + 0x88], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, dword [esp + 0x30]
sub edi, dword [esp + 0x38]
mov dword [esp + 0x44], eax
imul edi, ebx
add edi, edi
add edi, edi
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [esp + 0x6c], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x54]
push 0
push eax
call fcn.0043e850
mov ecx, dword [esp + 0x30]
add esp, 0xc
push esi
push 0
push ecx
call fcn.0043e850
mov edx, dword [esp + 0x50]
add esp, 0xc
push esi
push 0
push edx
call fcn.0043e850
mov eax, dword [esp + 0x28]
add esp, 0xc
push edi
push 0
push eax
call fcn.0043e850
mov ecx, dword [ebp + 0x10cc078]
fld dword [ecx + 0x4ff0]
xor esi, esi
fdivr qword [esp + 0x6c]
add esp, 0xc
cmp dword [esp + 0x20], esi
mov dword [esp + 0x14], esi
fst qword [esp + 0xb0]
fld qword [0x479498]
jle 0x417a8d
mov edi, dword [esp + 0x20]
fld st(1)
fadd st(0), st(0)
fld qword [esp + 0x88]
fld qword [esp + 0x58]
fsub st(1), st(0)
fild dword [esp + 0x20]
fild dword [esp + 0x14]
fmul st(3)
fdiv st(1)
fadd st(2)
fdivr st(5)
fdivr st(4)
call fcn.00441de0
mov edx, eax
and edx, 0x80000001
jns 0x417a57
dec edx
or edx, 0xfffffffe
inc edx
cdq
je 0x417a63
sub eax, edx
sar eax, 1
add eax, 1
jmp 0x417a67
sub eax, edx
sar eax, 1
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
add esi, 1
cmp esi, edi
mov dword [esp + 0x14], esi
fmul st(5)
fdiv st(6)
fstp qword [esp + esi*8 + 0x10370]
jl 0x417a35
fstp st(3)
fstp st(1)
fstp st(1)
fstp st(0)
mov eax, dword [esp + 0x38]
fstp st(1)
mov dword [esp + 0x48], eax
fstp st(0)
mov eax, dword [esp + 0x3c]
cmp eax, dword [esp + 0x34]
mov dword [esp + 0x4c], eax
jg 0x417b82
jl 0x417ac0
mov ecx, dword [esp + 0x30]
cmp dword [esp + 0x38], ecx
jae 0x417b82
jmp 0x417ac0
mov eax, dword [esp + 0x48]
sub eax, dword [esp + 0x38]
test ebx, ebx
mov dword [esp + 0x14], eax
jle 0x417b58
mov edx, eax
mov eax, dword [esp + 0x1c]
imul edx, ebx
lea edi, [eax + edx*4]
lea esi, [ebp + 0x10cbc38]
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x40], 4
ja 0x417b1c
fld qword [esp + 0x60]
mov ecx, dword [esp + 0x14]
sub esp, 0x10
test ecx, ecx
fstp qword [esp + 8]
fild dword [esp + 0x24]
jge 0x417b0e
fadd qword [0x479570]
mov eax, dword [esp + 0x50]
fstp qword [esp]
call fcn.004173c0
jmp 0x417b1e
fldz
mov edx, dword [esp + 0x4c]
fstp qword [esp + 0x28]
mov ecx, dword [esp + 0x48]
mov eax, dword [esi]
push edx
push ecx
mov ecx, dword [ebp + 0x10cc078]
sub eax, 1
call fcn.00402de0
fld qword [esp + 0x28]
fstp dword [esp + 0x28]
add esi, 4
add edi, 4
sub dword [esp + 0x18], 1
fmul dword [esp + 0x28]
fstp dword [edi - 4]
jne 0x417aea
add dword [esp + 0x48], 1
mov eax, dword [esp + 0x4c]
adc eax, 0
cmp eax, dword [esp + 0x34]
mov dword [esp + 0x4c], eax
jl 0x417ac0
jg 0x417b82
mov edx, dword [esp + 0x48]
cmp edx, dword [esp + 0x30]
jb 0x417ac0
mov eax, dword [ebp + 0x1097a10]
push 2
push 1
push 0x400
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0x354]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x24]
mov dword [ebp + 0x10cbf54], eax
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x38]
mov dword [ebp + 0x10cbf60], eax
mov eax, dword [esp + 0x34]
mov dword [ebp + 0x10cbf6c], eax
mov ecx, dword [esp + 0x50]
lea edx, [esp + 0x10378]
mov dword [ebp + 0x10cbf50], edx
mov edx, dword [esp + 0x1c]
mov dword [ebp + 0x10cbf5c], edx
mov edx, dword [esp + 0x30]
mov dword [ebp + 0x10cbf68], edx
mov dword [ebp + 0x10cbf58], ecx
mov ecx, dword [esp + 0x3c]
mov eax, edi
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cbf64], ecx
mov dword [ebp + 0x10cc010], edi
xor esi, esi
mov dword [ebp + 0x10cbff0], esi
mov dword [ebp + 0x10cbff4], eax
lea eax, [edi + edi]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cbff8], eax
lea eax, [edi + edi*2]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cbffc], eax
lea eax, [edi*4]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cc000], eax
lea eax, [edi + edi*4]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cc004], eax
lea eax, [edi + edi*2]
add eax, eax
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cc008], eax
lea eax, [edi*8]
sub eax, edi
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0x10cc00c], eax
lea ecx, [esp + 0x1d0]
lea eax, [ebp + 0x10cbf70]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], eax
lea esp, [esp]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
push 0
push 0
push eax
push 0x417320
push 0
push 0
mov dword [edx], 0
mov dword [eax], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xfffffffffffffffe
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, 4
add dword [esp + 0x1c], eax
add dword [esp + 0x14], eax
add esi, 1
cmp esi, 8
jl 0x417cb0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp + 0x10cbf80]
add esi, dword [ebp + 0x10cbf88]
add esi, dword [ebp + 0x10cbf78]
add esi, dword [ebp + 0x10cbf84]
add esi, dword [ebp + 0x10cbf74]
add esi, dword [ebp + 0x10cbf70]
add esi, dword [ebp + 0x10cbf8c]
add esi, dword [ebp + 0x10cbf7c]
mov eax, esi
cdq
and edx, 7
add eax, edx
sar eax, 3
push eax
mov eax, dword [ebp + 0x1097a10]
push 1
push 0x400
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp esi, 0x320
jl 0x417cf2
mov ecx, dword [ebp + 0x10cc078]
xor eax, eax
cmp edi, eax
mov dword [esp + 0x1d0], eax
mov dword [esp + 0x1d4], eax
mov dword [esp + 0x1d8], eax
mov dword [esp + 0x1dc], eax
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], eax
mov dword [esp + 0x1e8], eax
mov dword [esp + 0x1ec], eax
fld dword [ecx + 0x4ff0]
fdivr qword [0x479508]
mov dword [esp + 0x14], eax
fst qword [esp + 0x48]
fld qword [0x479688]
fstp qword [esp + 0x60]
fld qword [0x4795a8]
jle 0x417eef
mov edx, dword [esp + 0x50]
mov dword [esp + 0x1c], edx
xor esi, esi
test ebx, ebx
jle 0x417ecf
mov eax, dword [esp + 0x50]
fstp st(0)
mov ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
sub ecx, eax
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x44]
sub ecx, eax
mov dword [esp + 0x40], ecx
jmp 0x417df9
fstp st(0)
fld qword [esp + 0x48]
mov eax, dword [esp + 0x28]
fld qword [eax + edi]
fmul st(1)
fld qword [esp + 0xb0]
fdiv st(1), st(0)
fxch st(1)
fst qword [esp + 0x30]
fld qword [edi]
fmulp st(3)
fxch st(2)
fdivrp st(1)
fst qword [esp + 0xa8]
fmul st(0), st(0)
fld st(1)
fmulp st(2)
faddp st(1)
call fcn.0046a250
fst qword [esp + 0xb8]
call fcn.0046a380
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
mov ecx, dword [esp + 0x40]
fld qword [0x4795a8]
fmul st(1), st(0)
fxch st(1)
fst qword [ecx + edi]
fcom qword [esp + esi*8 + 0xd0]
fnstsw ax
test ah, 5
jp 0x417e67
fst qword [esp + esi*8 + 0xd0]
fcom qword [esp + esi*8 + 0x250]
fnstsw ax
test ah, 0x41
jne 0x417e7e
fstp qword [esp + esi*8 + 0x250]
jmp 0x417e80
fstp st(0)
mov eax, dword [esp + 0x14]
fld qword [esp + 0x30]
fstp qword [esp + eax*8 + 0x378]
fld qword [esp + 0xa8]
fstp qword [esp + eax*8 + 0x8378]
fld qword [esp + 0x60]
fld qword [esp + 0xb8]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x417eb9
fstp qword [esp + 0x60]
jmp 0x417ebb
fstp st(0)
add esi, 1
add edi, 8
cmp esi, ebx
jl 0x417df3
fld qword [esp + 0x48]
fxch st(1)
mov eax, dword [esp + 0x14]
add eax, 1
lea ecx, [ebx*8]
add dword [esp + 0x1c], ecx
cmp eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
jl 0x417dc9
xor eax, eax
fstp st(1)
cmp ebx, 4
jl 0x417f56
lea ecx, [ebx - 3]
fld qword [esp + eax*8 + 0xd0]
add eax, 4
cmp eax, ecx
fsub qword [esp + eax*8 + 0x230]
fstp qword [esp + eax*8 + 0xb0]
fld qword [esp + eax*8 + 0xb8]
fsub qword [esp + eax*8 + 0x238]
fstp qword [esp + eax*8 + 0xb8]
fld qword [esp + eax*8 + 0xc0]
fsub qword [esp + eax*8 + 0x240]
fstp qword [esp + eax*8 + 0xc0]
fld qword [esp + eax*8 + 0xc8]
fsub qword [esp + eax*8 + 0x248]
fstp qword [esp + eax*8 + 0xc8]
jl 0x417efb
cmp eax, ebx
jge 0x417f76
fld qword [esp + eax*8 + 0xd0]
add eax, 1
cmp eax, ebx
fsub qword [esp + eax*8 + 0x248]
fstp qword [esp + eax*8 + 0xc8]
jl 0x417f5a
mov eax, dword [esp + 0x20]
test eax, eax
jle 0x41800b
mov edi, dword [esp + 0x44]
xor esi, esi
mov dword [esp + 0x18], eax
xor eax, eax
cmp ebx, 4
jl 0x417fd5
lea edx, [ebx - 3]
mov ecx, edi
fld qword [ecx]
add eax, 4
fsub qword [esp + eax*8 + 0x230]
add ecx, 0x20
cmp eax, edx
fstp qword [ecx - 0x20]
fld qword [ecx - 0x18]
fsub qword [esp + eax*8 + 0x238]
fstp qword [ecx - 0x18]
fld qword [ecx - 0x10]
fsub qword [esp + eax*8 + 0x240]
fstp qword [ecx - 0x10]
fld qword [ecx - 8]
fsub qword [esp + eax*8 + 0x248]
fstp qword [ecx - 8]
jl 0x417f98
cmp eax, ebx
jge 0x417ff9
mov ecx, dword [esp + 0x44]
lea edx, [esi + eax]
lea ecx, [ecx + edx*8]
fld qword [ecx]
add eax, 1
fsub qword [esp + eax*8 + 0x248]
add ecx, 8
cmp eax, ebx
fstp qword [ecx - 8]
jl 0x417fe3
lea eax, [ebx*8]
add esi, ebx
add edi, eax
sub dword [esp + 0x18], 1
jne 0x417f8c
xor esi, esi
test ebx, ebx
jle 0x418052
fldz
lea edi, [ebp + 0x10cbcb8]
fst dword [edi + 0x80]
fld qword [esp + esi*8 + 0xd0]
fabs
fdiv st(2)
call fcn.00441de0
or ecx, 0xffffffff
sub ecx, eax
lea edx, [ecx + ecx*4]
add edx, edx
add edx, edx
mov dword [esp + 0x28], edx
fild dword [esp + 0x28]
add esi, 1
add edi, 4
cmp esi, ebx
fstp dword [edi - 4]
jl 0x418019
fstp st(1)
fstp st(0)
mov edi, dword [esp + 0x54]
fild dword [esp + 0x20]
mov esi, dword [ebp + 0x10cc078]
push ecx
lea eax, [ebp + 0x10cbbb4]
fmul qword [0x479498]
fld qword [esp + 0x8c]
fsub qword [esp + 0x5c]
fdivp st(1)
fstp dword [esp + 0x2c]
fld dword [esp + 0x2c]
fstp dword [esp]
push edi
call fcn.00403750
push 0
push 0x20
push 3
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4180d7
mov eax, dword [ebp + 0x1097a10]
push 0x64
push 1
push 0x400
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp + 0x1097a10], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20368
ret 4
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x20]
test eax, eax
jle 0x418199
mov ecx, dword [esp + 0x44]
xor edi, edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], eax
xor eax, eax
cmp ebx, 4
jl 0x418141
mov ecx, dword [esp + 0x24]
lea edx, [ebx - 3]
lea esp, [esp]
fld qword [ecx]
add eax, 4
fstp dword [esp + eax*4 + 0xc0]
add ecx, 0x20
cmp eax, edx
fld qword [ecx - 0x18]
fstp dword [esp + eax*4 + 0xc4]
fld qword [ecx - 0x10]
fstp dword [esp + eax*4 + 0xc8]
fld qword [ecx - 8]
fstp dword [esp + eax*4 + 0xcc]
jl 0x418110
cmp eax, ebx
jge 0x418163
mov ecx, dword [esp + 0x44]
lea edx, [edi + eax]
lea ecx, [ecx + edx*8]
nop
fld qword [ecx]
add eax, 1
fstp dword [esp + eax*4 + 0xcc]
add ecx, 8
cmp eax, ebx
jl 0x418150
push 0
lea edx, [esp + 0x2c]
push edx
lea eax, [ebx*4]
push eax
lea eax, [esp + 0xdc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebx*8]
add dword [esp + 0x24], eax
add edi, ebx
sub dword [esp + 0x18], 1
jne 0x4180fe
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push ecx
push edx
mov ebx, esi
mov ecx, ebp
call fcn.00417030
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea ecx, [esp + 0xc0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [esp + 0x7c]
movzx esi, word [esp + 0xc8]
mov eax, dword [esp + 0x54]
push 0
push 0
push 3
push 0
push 0
push 0x40000000
push eax
sub esi, edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ecx, [esp + 0xa0]
push ecx
mov ebx, eax
lea edx, [esp + 0x9c]
push edx
lea eax, [esp + 0x98]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
cmp ebx, 0xffffffff
je 0x4182a2
fld qword [esp + 0x58]
mov edi, 0x18
fdiv qword [0x479498]
sub edi, esi
call fcn.00441de0
cdq
mov ecx, 0x3c
idiv ecx
lea esi, [esp + 0x90]
mov dword [esp + 0x18], 3
mov dword [esp + 0x40], edx
mov dword [esp + 0x28], eax
lea edx, [esp + 0x74]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ax, word [esp + 0x28]
mov cx, word [esp + 0x40]
push esi
lea edx, [esp + 0x78]
push edx
mov word [esp + 0x84], di
mov word [esp + 0x86], ax
mov word [esp + 0x88], cx
mov word [esp + 0x8a], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
add esi, 8
sub dword [esp + 0x18], 1
jne 0x418254
lea eax, [esp + 0xa0]
push eax
lea ecx, [esp + 0x9c]
push ecx
lea edx, [esp + 0x98]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x68]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
call ebx
mov edi, dword [esp + 0x84]
push edi
call esi
push edi
call ebx
mov edi, dword [esp + 0x70]
push edi
call esi
push edi
call ebx
mov edi, dword [esp + 0x6c]
push edi
call esi
push edi
call ebx
mov eax, dword [ebp + 0x1097a10]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x64
push 1
push 0x400
push eax
mov dword [ebp + 0x1097a30], 1
call esi
mov ecx, dword [esp + 0x54]
mov edx, dword [0x488ae4]
push ecx
push 1
push 0x400
push edx
mov dword [ebp + 0x1097a10], 0
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20368
ret 4