Function at 0x4156e0
Capabilities:
Create thread
Get system information on windows
Resolve function by parsing pe exports
Timestomp file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x20360
call fcn.0041c890
push ebx
mov ebx, ecx
mov ecx, dword [ebx + 0x10cc07c]
mov edx, dword [ecx + 0xe0]
lea eax, [ebx + 0x10969f8]
push ebp
mov dword [esp + 0x4c], eax
mov eax, dword [ecx + 0xe4]
mov ecx, dword [ebx + 0x10cc080]
push esi
mov esi, dword [ecx + 0xe0]
mov ecx, dword [ecx + 0xe4]
cmp eax, ecx
push edi
jg 0x415738
jl 0x41572e
cmp edx, esi
jae 0x415738
mov edi, edx
mov ebp, eax
mov edx, esi
mov eax, ecx
jmp 0x41573c
mov edi, esi
mov ebp, ecx
cmp edi, edx
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], ebp
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
jne 0x415758
cmp ebp, eax
je 0x41624a
mov edi, dword [esp + 0x30]
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x24]
mov ecx, dword [ebx + 0x10cbf38]
mov ebp, dword [ebx + 0x10cbbb4]
sub edx, edi
sbb eax, esi
mov dword [esp + 0x58], edx
mov edx, dword [ebx + 0x10cbf3c]
mov dword [esp + 0x5c], eax
fild qword [esp + 0x58]
mov dword [esp + 0x2c], ecx
mov ecx, 0x3e
lea esi, [esp + 0x248]
fstp qword [esp + 0x68]
lea edi, [esp + 0x250]
fld qword [ebx + 0x10cbf40]
push 0xcc
fstp qword [esp + 0x74]
mov dword [esp + 0x50], ebp
fld qword [ebx + 0x10cbf48]
mov dword [esp + 0x64], edx
fstp qword [esp + 0x9c]
fld qword [0x431b10]
fstp qword [esp + 0x24c]
rep movsd dword es:[edi], dword [esi]
fld qword [0x431b08]
fstp qword [esp + 0xcc]
mov ecx, 0x3e
lea esi, [esp + 0xcc]
lea edi, [esp + 0xd4]
rep movsd dword es:[edi], dword [esi]
call fcn.00416e00
add esp, 4
push eax
mov eax, dword [ebx + 0x1097a10]
push 2
push 0x400
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [esp + 0x2c]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
imul esi, ebp
shl esi, 3
push esi
push 0x40
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
mov dword [esp + 0x98], eax
call ebp
push esi
push 0x40
mov dword [esp + 0x1c], eax
call edi
push eax
mov dword [esp + 0x94], eax
call ebp
push esi
push 0x40
mov dword [esp + 0x58], eax
call edi
push eax
mov dword [esp + 0x8c], eax
call ebp
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x3c], eax
sub ebp, dword [esp + 0x30]
imul ebp, dword [esp + 0x4c]
shl ebp, 2
push ebp
push 0x40
call edi
push eax
mov dword [esp + 0x90], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [esp + 0x28], eax
mov ecx, esi
xor eax, eax
mov edi, dword [esp + 0x50]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x14]
xor eax, eax
mov ecx, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x3c]
xor eax, eax
mov ecx, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x28]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 0x10cc078]
xor esi, esi
mov dword [esp + 0x10], esi
fld dword [eax + 0x4ff0]
mov eax, dword [esp + 0x2c]
test eax, eax
fdivr qword [esp + 0x68]
mov edi, eax
fstp qword [esp + 0x58]
jle 0x415980
fld qword [esp + 0x98]
fsub qword [esp + 0x70]
fild dword [esp + 0x2c]
fld qword [0x4318d8]
fdiv qword [esp + 0x58]
mov edi, edi
fild dword [esp + 0x10]
fmul st(3)
fdiv st(2)
fadd qword [esp + 0x70]
fdivr qword [0x430a00]
fdivr qword [esp + 0x58]
fadd st(0), st(0)
call fcn.0041bd48
mov ecx, eax
and ecx, 0x80000001
jns 0x41594c
dec ecx
or ecx, 0xfffffffe
inc ecx
cdq
je 0x415956
sub eax, edx
sar eax, 1
inc eax
jmp 0x41595a
sub eax, edx
sar eax, 1
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
inc esi
cmp esi, edi
mov dword [esp + 0x10], esi
fmul st(1)
fmul qword [0x430a00]
fstp qword [esp + esi*8 + 0x10368]
jl 0x415920
fstp st(0)
fstp st(0)
fstp st(0)
mov eax, dword [esp + 0x34]
cmp eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], eax
jg 0x415a7d
jl 0x4159a6
cmp ecx, dword [esp + 0x20]
jae 0x415a7d
mov ebp, dword [esp + 0x4c]
lea ebx, [ebx]
mov edx, dword [esp + 0x40]
sub edx, dword [esp + 0x30]
test ebp, ebp
jle 0x415a49
fld qword [esp + 0x68]
sub esp, 0x10
test edx, edx
fstp qword [esp + 8]
mov dword [esp + 0x28], edx
fild dword [esp + 0x28]
jge 0x4159dd
fadd qword [0x430740]
mov eax, dword [esp + 0x70]
fstp qword [esp]
push eax
mov ecx, ebx
call fcn.00414e90
imul edx, ebp
fstp dword [esp + 0x18]
mov ecx, dword [esp + 0x28]
lea edx, [ecx + edx*4]
mov dword [esp + 0x10], edx
lea esi, [ebx + 0x10cbc38]
mov dword [esp + 0x1c], ebp
jmp 0x415a10
mov eax, dword [esi]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
dec eax
push eax
push ecx
mov ecx, dword [ebx + 0x10cc078]
push edx
call fcn.00401840
fmul dword [esp + 0x18]
mov eax, dword [esp + 0x10]
add eax, 4
fstp dword [eax - 4]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
add esi, 4
dec eax
mov dword [esp + 0x1c], eax
jne 0x415a10
mov esi, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x24]
add esi, 1
adc eax, 0
cmp eax, ecx
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], eax
jl 0x4159b0
jg 0x415a81
mov eax, dword [esp + 0x20]
mov ecx, esi
cmp ecx, eax
jb 0x4159b0
jmp 0x415a81
mov ebp, dword [esp + 0x4c]
mov ecx, dword [ebx + 0x1097a10]
push 2
push 1
push 0x400
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
lea edx, [esp + 0x34c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [esp + 0x50]
mov ecx, dword [esp + 0x14]
mov dword [ebx + 0x10cbf58], edx
mov edx, dword [esp + 0x34]
mov dword [ebx + 0x10cbf64], edx
lea eax, [esp + 0x10370]
mov dword [ebx + 0x10cbf50], eax
mov eax, dword [esp + 0x28]
mov dword [ebx + 0x10cbf5c], eax
mov eax, dword [esp + 0x20]
mov dword [ebx + 0x10cbf68], eax
mov dword [ebx + 0x10cbf54], ecx
mov ecx, dword [esp + 0x30]
mov dword [ebx + 0x10cbf60], ecx
mov ecx, dword [esp + 0x24]
mov eax, edi
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebx + 0x10cbf6c], ecx
mov dword [ebx + 0x10cc010], edi
xor esi, esi
mov dword [ebx + 0x10cbff0], esi
mov dword [ebx + 0x10cbff4], eax
lea eax, [edi + edi]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebx + 0x10cbff8], eax
lea eax, [edi + edi*2]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebx + 0x10cbffc], eax
lea eax, [edi*4]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebx + 0x10cc000], eax
lea eax, [edi + edi*4]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebx + 0x10cc004], eax
lea eax, [edi + edi*2]
shl eax, 1
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebx + 0x10cc008], eax
mov eax, edi
imul eax, eax, 7
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebx + 0x10cc00c], eax
lea edx, [esp + 0x1c8]
lea eax, [ebx + 0x10cbf70]
mov dword [esp + 0x10], edx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
push 0
push 0
mov dword [eax], 0
mov eax, dword [esp + 0x18]
push eax
push 0x415690
push 0
push 0
mov dword [eax], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xfffffffffffffffe
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x10]
mov eax, 4
inc esi
add edx, eax
add ecx, eax
cmp esi, 8
mov dword [esp + 0x28], edx
mov dword [esp + 0x10], ecx
jl 0x415ba0
lea esp, [esp]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebx + 0x10cbf74]
mov esi, dword [ebx + 0x10cbf84]
mov ecx, dword [ebx + 0x10cbf70]
mov eax, dword [ebx + 0x10cbf8c]
add esi, edx
mov edx, dword [ebx + 0x10cbf7c]
add esi, ecx
mov ecx, dword [ebx + 0x10cbf80]
add esi, eax
mov eax, dword [ebx + 0x10cbf88]
add esi, edx
mov edx, dword [ebx + 0x10cbf78]
add esi, ecx
mov ecx, dword [ebx + 0x1097a10]
add esi, eax
add esi, edx
mov eax, esi
cdq
and edx, 7
add eax, edx
sar eax, 3
push eax
push 1
push 0x400
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp esi, 0x320
jl 0x415bf0
mov edx, dword [ebx + 0x10cc078]
xor esi, esi
cmp edi, esi
mov dword [esp + 0x1c8], esi
mov dword [esp + 0x1cc], esi
mov dword [esp + 0x1d0], esi
mov dword [esp + 0x1d4], esi
mov dword [esp + 0x1d8], esi
mov dword [esp + 0x1dc], esi
mov dword [esp + 0x1e0], esi
mov dword [esp + 0x1e4], esi
fld dword [edx + 0x4ff0]
fdivr qword [0x430818]
fstp qword [esp + 0x20]
fld qword [0x431b10]
fstp qword [esp + 0x60]
jle 0x415dbc
lea eax, [ebp*8]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x10], eax
xor edx, edx
test ebp, ebp
jle 0x415da5
fld qword [0x4318d8]
mov edi, dword [esp + 0x14]
fdiv qword [esp + 0x58]
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x10]
sub edi, eax
sub ebp, eax
fstp qword [esp + 0x68]
jmp 0x415d02
fstp st(0)
fld qword [esp + 0x68]
fmul qword [edi + ecx]
fmul qword [esp + 0x20]
fld qword [esp + 0x68]
fmul qword [ecx]
fmul qword [esp + 0x20]
fst qword [esp + 0x40]
fmul qword [esp + 0x40]
fld st(1)
fmul st(2)
faddp st(1)
fsqrt
fld st(0)
fldlg2
fxch st(1)
fyl2x
fmul dword [0x431b00]
fcom qword [esp + edx*8 + 0xc8]
fst qword [ecx + ebp]
fnstsw ax
test ah, 5
jp 0x415d4d
fst qword [esp + edx*8 + 0xc8]
fcom qword [esp + edx*8 + 0x248]
fnstsw ax
test ah, 0x41
jne 0x415d64
fstp qword [esp + edx*8 + 0x248]
jmp 0x415d66
fstp st(0)
fcom qword [esp + 0x60]
fnstsw ax
test ah, 0x41
jne 0x415d77
fstp qword [esp + 0x60]
jmp 0x415d79
fstp st(0)
mov eax, dword [esp + 0x4c]
inc edx
add ecx, 8
cmp edx, eax
jl 0x415d00
mov edi, dword [esp + 0x2c]
fstp qword [esp + esi*8 + 0x370]
fld qword [esp + 0x40]
mov ebp, eax
mov eax, dword [esp + 0x50]
fstp qword [esp + esi*8 + 0x8370]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
inc esi
add edx, ecx
cmp esi, edi
mov dword [esp + 0x10], edx
jl 0x415cd6
xor eax, eax
cmp ebp, 4
jl 0x415e2b
lea ecx, [ebp - 3]
jmp 0x415dd0
fld qword [esp + eax*8 + 0xc8]
add eax, 4
cmp eax, ecx
fsub qword [esp + eax*8 + 0x228]
fstp qword [esp + eax*8 + 0xa8]
fld qword [esp + eax*8 + 0xb0]
fsub qword [esp + eax*8 + 0x230]
fstp qword [esp + eax*8 + 0xb0]
fld qword [esp + eax*8 + 0xb8]
fsub qword [esp + eax*8 + 0x238]
fstp qword [esp + eax*8 + 0xb8]
fld qword [esp + eax*8 + 0xc0]
fsub qword [esp + eax*8 + 0x240]
fstp qword [esp + eax*8 + 0xc0]
jl 0x415dd0
cmp eax, ebp
jge 0x415e4a
nop
fld qword [esp + eax*8 + 0xc8]
inc eax
cmp eax, ebp
fsub qword [esp + eax*8 + 0x240]
fstp qword [esp + eax*8 + 0xc0]
jl 0x415e30
test edi, edi
jle 0x415ef6
mov eax, dword [esp + 0x3c]
xor edx, edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], edi
xor ecx, ecx
cmp ebp, 4
jl 0x415ead
mov eax, dword [esp + 0x14]
lea esi, [ebp - 3]
mov edi, edi
fld qword [eax]
add ecx, 4
fsub qword [esp + ecx*8 + 0x228]
add eax, 0x20
cmp ecx, esi
fstp qword [eax - 0x20]
fld qword [eax - 0x18]
fsub qword [esp + ecx*8 + 0x230]
fstp qword [eax - 0x18]
fld qword [eax - 0x10]
fsub qword [esp + ecx*8 + 0x238]
fstp qword [eax - 0x10]
fld qword [eax - 8]
fsub qword [esp + ecx*8 + 0x240]
fstp qword [eax - 8]
jl 0x415e70
cmp ecx, ebp
jge 0x415ed4
mov esi, dword [esp + 0x3c]
lea eax, [edx + ecx]
lea eax, [esi + eax*8]
jmp 0x415ec0
fld qword [eax]
inc ecx
fsub qword [esp + ecx*8 + 0x240]
add eax, 8
cmp ecx, ebp
fstp qword [eax - 8]
jl 0x415ec0
mov ecx, dword [esp + 0x14]
lea eax, [ebp*8]
add ecx, eax
mov eax, dword [esp + 0x1c]
add edx, ebp
dec eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], eax
jne 0x415e60
xor esi, esi
test ebp, ebp
jle 0x415f57
lea ecx, [ebx + 0x10cbcb8]
mov dword [esp + 0x14], ecx
jmp 0x415f10
fld qword [esp + esi*8 + 0xc8]
mov edx, dword [esp + 0x14]
fabs
mov dword [edx + 0x80], 0
fmul qword [0x431af8]
call fcn.0041bd48
or ecx, 0xffffffff
sub ecx, eax
lea eax, [ecx + ecx*4]
shl eax, 2
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
mov eax, dword [esp + 0x14]
inc esi
fstp dword [eax]
add eax, 4
cmp esi, ebp
mov dword [esp + 0x14], eax
jl 0x415f10
fild dword [esp + 0x2c]
mov esi, dword [esp + 0x54]
push ecx
mov ecx, dword [ebx + 0x10cc078]
fmul qword [0x430a00]
lea eax, [ebx + 0x10cbbb4]
fld qword [esp + 0x9c]
fsub qword [esp + 0x74]
fdivp st(1)
fstp dword [esp]
push eax
push esi
call fcn.004021d0
push 0
push 0x20
push 3
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x415fce
mov ecx, dword [ebx + 0x1097a10]
push 0x64
push 1
push 0x400
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebx + 0x1097a10], 0
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test edi, edi
jle 0x416094
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], edx
xor eax, eax
cmp ebp, 4
jl 0x416032
mov ecx, dword [esp + 0x10]
lea edx, [ebp - 3]
fld qword [ecx]
add eax, 4
fstp dword [esp + eax*4 + 0xb8]
add ecx, 0x20
cmp eax, edx
fld qword [ecx - 0x18]
fstp dword [esp + eax*4 + 0xbc]
fld qword [ecx - 0x10]
fstp dword [esp + eax*4 + 0xc0]
fld qword [ecx - 8]
fstp dword [esp + eax*4 + 0xc4]
jl 0x416001
cmp eax, ebp
jge 0x416054
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x3c]
add ecx, eax
lea ecx, [edx + ecx*8]
fld qword [ecx]
inc eax
fstp dword [esp + eax*4 + 0xc4]
add ecx, 8
cmp eax, ebp
jl 0x416043
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [ebp*4]
push eax
lea ecx, [esp + 0xd4]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
lea eax, [ebp*8]
add edx, ebp
add ecx, eax
dec edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
jne 0x415ff3
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
push edx
push eax
push esi
mov ecx, ebx
call fcn.00412e60
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x78]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea edx, [esp + 0xb8]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x80]
movzx edi, word [esp + 0xc0]
mov ecx, dword [esp + 0x54]
push 0
push 0
push 3
push 0
push 0
push 0x40000000
push ecx
sub edi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
lea edx, [esp + 0xb0]
push edx
lea eax, [esp + 0xac]
push eax
lea ecx, [esp + 0xa8]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileTime]
cmp ebp, 0xffffffff
je 0x4161a3
fld qword [esp + 0x70]
mov esi, 0x18
fmul qword [0x431af0]
sub esi, edi
call fcn.0041bd48
cdq
mov ecx, 0x3c
idiv ecx
lea edi, [esp + 0xa0]
mov dword [esp + 0x1c], 3
mov dword [esp + 0x60], edx
mov dword [esp + 0x18], eax
lea edx, [esp + 0x78]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ax, word [esp + 0x18]
mov cx, word [esp + 0x60]
push edi
lea edx, [esp + 0x7c]
push edx
mov word [esp + 0x88], si
mov word [esp + 0x8a], ax
mov word [esp + 0x8c], cx
mov word [esp + 0x8e], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [esp + 0x1c]
add edi, 8
dec eax
mov dword [esp + 0x1c], eax
jne 0x416151
lea eax, [esp + 0xb0]
push eax
lea ecx, [esp + 0xac]
push ecx
lea edx, [esp + 0xa8]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x8c]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call ebp
mov esi, dword [esp + 0x88]
push esi
call edi
push esi
call ebp
mov esi, dword [esp + 0x94]
push esi
call edi
push esi
call ebp
mov esi, dword [esp + 0x90]
push esi
call edi
push esi
call ebp
mov eax, dword [ebx + 0x1097a10]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x64
push 1
push 0x400
push eax
mov dword [ebx + 0x1097a30], 1
call esi
mov ecx, dword [esp + 0x54]
push ecx
push 1
mov dword [ebx + 0x1097a10], 0
mov edx, dword [0x4425b4]
push 0x400
push edx
call esi
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret