Function at 0x413592
Capabilities:
Create thread
Get system information on windows
Timestomp file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20390
call fcn.00424e40
push ebx
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + 0x10cc080]
lea eax, [ebx + 0x10969f8]
mov dword [ebp - 0x44], eax
mov eax, dword [ebx + 0x10cc07c]
mov edx, dword [eax + 0xe0]
mov eax, dword [eax + 0xe4]
push esi
mov esi, dword [ecx + 0xe0]
mov ecx, dword [ecx + 0xe4]
cmp eax, ecx
push edi
jg 0x4135ea
jl 0x4135dc
cmp edx, esi
jae 0x4135ea
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], ecx
jmp 0x4135f6
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x34], eax
jne 0x41360a
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x30], eax
je 0x413e5e
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x20]
sbb ecx, dword [ebp - 0x30]
mov dword [ebp - 0x54], eax
mov eax, dword [ebx + 0x10cbbb4]
mov dword [ebp - 0x50], ecx
fild qword [ebp - 0x54]
push 0x3e
pop ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebx + 0x10cbf38]
fstp qword [ebp - 0x54]
fld qword [ebx + 0x10cbf40]
lea esi, [ebp - 0x1e4]
fstp qword [ebp - 0x74]
lea edi, [ebp - 0x1dc]
fld qword [ebx + 0x10cbf48]
push 0x3e
fstp qword [ebp - 0xbc]
mov dword [ebp - 0x14], eax
fld qword [0x4417c8]
mov eax, dword [ebx + 0x10cbf3c]
fstp qword [ebp - 0x1e4]
rep movsd dword es:[edi], dword [esi]
fld qword [0x4417c0]
fstp qword [ebp - 0x30c]
pop ecx
lea esi, [ebp - 0x30c]
lea edi, [ebp - 0x304]
push 0xcc
mov dword [ebp - 0x10], eax
rep movsd dword es:[edi], dword [esi]
call fcn.0041482f
pop ecx
push eax
push 2
push 0x400
push dword [ebx + 0x1097a10]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
shl eax, 3
push eax
push 0x40
mov dword [ebp - 0xc], eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
mov dword [ebp - 0x68], eax
call esi
push dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
push 0x40
call edi
push eax
mov dword [ebp - 0x5c], eax
call esi
push dword [ebp - 0xc]
mov dword [ebp - 0x40], eax
push 0x40
call edi
push eax
mov dword [ebp - 0x60], eax
call esi
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x28]
shl eax, 2
push eax
push 0x40
mov dword [ebp - 8], eax
call edi
push eax
mov dword [ebp - 0x64], eax
call esi
push dword [ebp - 0xc]
mov edi, eax
xor esi, esi
push esi
push dword [ebp - 0x40]
call fcn.004204c0
add esp, 0xc
push dword [ebp - 0xc]
push esi
push dword [ebp - 0x18]
call fcn.004204c0
add esp, 0xc
push dword [ebp - 0xc]
push esi
push dword [ebp - 0x48]
call fcn.004204c0
add esp, 0xc
push dword [ebp - 8]
push esi
push edi
call fcn.004204c0
mov eax, dword [ebx + 0x10cc078]
fld dword [eax + 0x4ff0]
add esp, 0xc
cmp dword [ebp - 0x14], esi
fdivr qword [ebp - 0x54]
mov dword [ebp - 0xc], esi
fstp qword [ebp - 0x84]
fld qword [0x4415e0]
jle 0x4137da
fld qword [ebp - 0x84]
fadd st(0), st(0)
fld qword [ebp - 0xbc]
fsub qword [ebp - 0x74]
fild dword [ebp - 0x14]
fild dword [ebp - 0xc]
fmul st(2)
fdiv st(1)
fadd qword [ebp - 0x74]
fld st(4)
fdivrp st(1)
fld st(3)
fdivrp st(1)
call fcn.004248a0
mov ecx, eax
and ecx, 0x80000001
jns 0x4137a8
dec ecx
or ecx, 0xfffffffe
inc ecx
cdq
je 0x4137b2
sub eax, edx
sar eax, 1
inc eax
jmp 0x4137b6
sub eax, edx
sar eax, 1
mov dword [ebp - 8], eax
fild dword [ebp - 8]
inc esi
cmp esi, dword [ebp - 0x14]
mov dword [ebp - 0xc], esi
fmul st(4)
fdiv qword [ebp - 0x84]
fstp qword [ebp + esi*8 - 0x20394]
jl 0x413782
fstp st(3)
fstp st(1)
fstp st(0)
mov eax, dword [ebp - 0x30]
fstp st(0)
cmp eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], eax
jg 0x4138a3
jl 0x4137fc
cmp ecx, dword [ebp - 0x24]
jae 0x4138a3
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x34]
cmp dword [ebp - 0x28], 0
jle 0x413881
mov ecx, eax
test ecx, ecx
mov dword [ebp - 0x1c], ecx
fild dword [ebp - 0x1c]
jge 0x41381a
fadd qword [0x4416b8]
mov ecx, dword [ebp - 0x28]
fstp qword [ebp - 0x7c]
imul eax, ecx
lea eax, [edi + eax*4]
mov dword [ebp - 0xc], eax
lea esi, [ebx + 0x10cbc38]
mov dword [ebp - 8], ecx
push dword [ebp - 0x38]
mov eax, dword [esi]
push dword [ebp - 0x3c]
mov ecx, dword [ebx + 0x10cc078]
dec eax
call fcn.004024f3
fstp qword [ebp - 0x8c]
fld qword [ebp - 0x54]
mov eax, dword [ebp - 0x10]
sub esp, 0x10
fstp qword [esp + 8]
fld qword [ebp - 0x7c]
fstp qword [esp]
call fcn.004131ba
mov eax, dword [ebp - 0xc]
fstp dword [ebp - 0x58]
fld dword [ebp - 0x58]
add dword [ebp - 0xc], 4
fmul qword [ebp - 0x8c]
add esi, 4
dec dword [ebp - 8]
fstp dword [eax]
jne 0x413832
add dword [ebp - 0x3c], 1
adc dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x20]
jl 0x4137fc
jg 0x4138a3
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x3c], eax
jb 0x4137fc
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 2
push 1
push 0x400
push dword [ebx + 0x1097a10]
call esi
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
and dword [ebx + 0x10cbff0], 0
lea eax, [ebp - 0x2038c]
mov dword [ebx + 0x10cbf50], eax
mov eax, dword [ebp - 0x18]
mov dword [ebx + 0x10cbf54], eax
mov eax, dword [ebp - 0x40]
mov dword [ebx + 0x10cbf58], eax
mov eax, dword [ebp - 0x34]
mov dword [ebx + 0x10cbf60], eax
mov eax, dword [ebp - 0x30]
mov dword [ebx + 0x10cbf64], eax
mov eax, dword [ebp - 0x24]
mov dword [ebx + 0x10cbf68], eax
mov eax, dword [ebp - 0x20]
mov dword [ebx + 0x10cbf6c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x10cbf5c], edi
mov dword [ebx + 0x10cc010], eax
mov edi, eax
lea ecx, [ebx + 0x10cbff4]
mov dword [ebp - 8], 7
mov eax, edi
add edi, dword [ebp - 0x14]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ecx], eax
add ecx, 4
dec dword [ebp - 8]
jne 0x41392e
and dword [ebp - 0x10], 0
lea eax, [ebx + 0x10cbf70]
lea edi, [ebp - 0x38c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
xor eax, eax
push eax
push eax
push edi
push 0x413185
mov dword [ecx], eax
mov ecx, dword [ebp - 0x10]
push eax
push eax
mov dword [edi], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xfffffffffffffffe
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
inc dword [ebp - 0x10]
add dword [ebp - 0xc], 4
add edi, 4
cmp dword [ebp - 0x10], 8
jl 0x413959
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 8
xor edi, edi
lea eax, [ebx + 0x10cbf70]
pop ecx
add edi, dword [eax]
add eax, 4
dec ecx
jne 0x4139a4
mov eax, edi
cdq
and edx, 7
add eax, edx
sar eax, 3
push eax
push 1
push 0x400
push dword [ebx + 0x1097a10]
call esi
cmp edi, 0x320
jl 0x41398e
push 8
xor eax, eax
pop ecx
lea edi, [ebp - 0x38c]
rep stosd dword es:[edi], eax
mov eax, dword [ebx + 0x10cc078]
and dword [ebp - 0xc], 0
cmp dword [ebp - 0x14], 0
fld dword [eax + 0x4ff0]
fdivr qword [0x441658]
fstp qword [ebp - 0x8c]
fld qword [0x4417d0]
fstp qword [ebp - 0x7c]
jle 0x413b5f
mov eax, dword [ebp - 0x28]
shl eax, 3
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 8], eax
and dword [ebp - 0x10], 0
cmp dword [ebp - 0x28], 0
jle 0x413b4a
mov eax, dword [ebp - 0xc]
mov edi, dword [ebp - 0x18]
sub edi, dword [ebp - 0x40]
mov esi, dword [ebp - 8]
shl eax, 3
lea ecx, [ebp + eax - 0x838c]
lea eax, [ebp + eax - 0x1038c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x40]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0xb0], eax
fld qword [edi + esi]
push ecx
fmul qword [ebp - 0x8c]
push ecx
fdiv qword [ebp - 0x84]
fstp qword [ebp - 0xac]
fld qword [ebp - 0x8c]
fmul qword [esi]
fdiv qword [ebp - 0x84]
fstp qword [ebp - 0x94]
fld qword [ebp - 0x94]
fmul qword [ebp - 0x94]
fld qword [ebp - 0xac]
fmul qword [ebp - 0xac]
faddp st(1)
fstp qword [ebp - 0x54]
fld qword [ebp - 0x54]
fstp qword [esp]
call fcn.00421b74
fstp qword [esp]
call fcn.00421d50
mov edx, dword [ebp - 0x10]
fstp dword [ebp - 0x58]
fld dword [ebp - 0x58]
mov eax, dword [ebp - 0xb0]
fmul qword [0x4416f0]
pop ecx
shl edx, 3
pop ecx
fst qword [eax + esi]
lea ecx, [ebp + edx - 0x30c]
fcom qword [ecx]
fnstsw ax
test ah, 5
jp 0x413ae1
fst qword [ecx]
lea ecx, [ebp + edx - 0x1e4]
fcom qword [ecx]
fnstsw ax
test ah, 0x41
jne 0x413af5
fstp qword [ecx]
jmp 0x413af7
fstp st(0)
mov eax, dword [ebp - 0x38]
fld qword [ebp - 0xac]
fstp qword [eax]
mov eax, dword [ebp - 0x20]
fld qword [ebp - 0x94]
push ecx
fstp qword [eax]
push ecx
fld qword [ebp - 0x54]
fstp qword [esp]
call fcn.00421b74
fcomp qword [ebp - 0x7c]
pop ecx
pop ecx
fnstsw ax
test ah, 0x41
jne 0x413b38
fld qword [ebp - 0x54]
push ecx
push ecx
fstp qword [esp]
call fcn.00421b74
pop ecx
fstp qword [ebp - 0x7c]
pop ecx
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add esi, 8
cmp eax, dword [ebp - 0x28]
jl 0x413a57
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0xc]
add dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jl 0x413a1a
mov edi, dword [ebp - 0x28]
xor ecx, ecx
test edi, edi
jle 0x413b7f
lea eax, [ebp + ecx*8 - 0x30c]
fld qword [eax]
inc ecx
cmp ecx, edi
fsub qword [ebp + ecx*8 - 0x1ec]
fstp qword [eax]
jl 0x413b68
mov eax, dword [ebp - 0x14]
test eax, eax
jle 0x413bb3
mov esi, dword [ebp - 0x48]
mov edx, edi
shl edx, 3
mov dword [ebp - 8], eax
xor ecx, ecx
test edi, edi
jle 0x413bac
mov eax, esi
fld qword [eax]
inc ecx
fsub qword [ebp + ecx*8 - 0x1ec]
fstp qword [eax]
add eax, 8
cmp ecx, edi
jl 0x413b99
add esi, edx
dec dword [ebp - 8]
jne 0x413b91
and dword [ebp - 0x10], 0
test edi, edi
jle 0x413c05
lea esi, [ebx + 0x10cbcb8]
fldz
mov eax, dword [ebp - 0x10]
fstp dword [esi + 0x80]
push ecx
fld qword [ebp + eax*8 - 0x30c]
push ecx
fstp qword [esp]
call fcn.00421a9e
fdiv qword [0x4416f0]
pop ecx
pop ecx
call fcn.004248a0
or ecx, 0xffffffff
sub ecx, eax
imul ecx, ecx, 0x14
inc dword [ebp - 0x10]
mov dword [ebp - 0x1c], ecx
fild dword [ebp - 0x1c]
fstp dword [esi]
add esi, 4
cmp dword [ebp - 0x10], edi
jl 0x413bc1
fild dword [ebp - 0x14]
mov esi, dword [ebx + 0x10cc078]
push ecx
lea eax, [ebx + 0x10cbbb4]
fmul qword [0x4415e0]
fld qword [ebp - 0xbc]
fsub qword [ebp - 0x74]
fdivp st(1)
fstp dword [ebp - 0x1c]
fld dword [ebp - 0x1c]
fstp dword [esp]
push dword [ebp - 0x44]
call fcn.00402d29
xor eax, eax
push eax
push 0x20
push 3
push eax
push eax
push 0x40000000
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x413c76
push 0x64
push 1
push 0x400
push dword [ebx + 0x1097a10]
call dword [sym.imp.USER32.dll_SendMessageW]
and dword [ebx + 0x1097a10], 0
jmp 0x413e5e
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 0x14]
test eax, eax
jle 0x413cd4
mov ecx, dword [ebp - 0x48]
mov ebx, edi
shl ebx, 2
mov dword [ebp - 8], ecx
mov dword [ebp - 0x18], eax
xor eax, eax
test edi, edi
jle 0x413cb2
mov ecx, dword [ebp - 8]
fld qword [ecx]
inc eax
fstp dword [ebp + eax*4 - 0x168]
add ecx, 8
cmp eax, edi
jl 0x413ca1
push 0
lea eax, [ebp - 0x1c]
push eax
push ebx
lea eax, [ebp - 0x164]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, edi
shl eax, 3
add dword [ebp - 8], eax
dec dword [ebp - 0x18]
jne 0x413c98
push dword [ebp - 0x30]
mov edi, dword [ebp + 8]
push dword [ebp - 0x34]
mov ebx, esi
mov ecx, edi
call fcn.00412eeb
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0xe4]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x9c]
movzx esi, word [ebp - 0xdc]
sub esi, eax
xor eax, eax
push eax
push eax
push 3
push eax
push eax
push 0x40000000
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ecx, [ebp - 0xc4]
push ecx
lea ecx, [ebp - 0xcc]
push ecx
lea ecx, [ebp - 0xd4]
push ecx
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
cmp dword [ebp - 8], 0xffffffff
je 0x413dd2
fld qword [ebp - 0x74]
mov dword [ebp + 8], 0x18
fdiv qword [0x4415e0]
sub dword [ebp + 8], esi
call fcn.004248a0
push 0x3c
cdq
pop ecx
idiv ecx
lea esi, [ebp - 0xd4]
mov dword [ebp - 0x18], 3
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0xa4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ax, word [ebp + 8]
and word [ebp - 0x96], 0
mov word [ebp - 0x9c], ax
mov ax, word [ebp - 0x1c]
mov word [ebp - 0x9a], ax
mov ax, word [ebp - 0x20]
mov word [ebp - 0x98], ax
push esi
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
add esi, 8
dec dword [ebp - 0x18]
jne 0x413d85
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0xd4]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push dword [ebp - 8]
call ebx
push dword [ebp - 0x64]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call esi
push dword [ebp - 0x64]
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
call ebx
push dword [ebp - 0x60]
call esi
push dword [ebp - 0x60]
call ebx
push dword [ebp - 0x68]
call esi
push dword [ebp - 0x68]
call ebx
push dword [ebp - 0x5c]
call esi
push dword [ebp - 0x5c]
call ebx
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
push 0x64
inc eax
push eax
mov ebx, 0x400
push ebx
push dword [edi + 0x1097a10]
mov dword [edi + 0x1097a30], eax
call esi
push dword [ebp - 0x44]
and dword [edi + 0x1097a10], 0
push 1
push ebx
push dword [0x44b424]
call esi
pop edi
pop esi
pop ebx
leave
ret 4