Function at 0x40e849
Capabilities:
Print debug messages
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
push ebx
push esi
push edi
push 6
mov dword [ebp - 8], ecx
pop esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub esi, 1
jne 0x40e85b
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
xor ebx, ebx
push str.SMPHR_cxz9k8fz
push 1
push ebx
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push ebx
push 1
push eax
call edi
push str.MTXcxx5af3u
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x40e8a4
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.log:_cfndlttc
jmp 0x40e8a9
push str.log:_xxl1az6n
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call ebx
push str.XMLszpx5up4
push 1
push 0
push 0
call esi
xor esi, esi
push esi
push 1
push eax
call edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.WTMR_xe7t9qv0
push 1
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.ev_iin1jkk0
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.regrc9ftyc5
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x20a
push 0x40
call dword [0x41604c]
push str.WTMR_2on4l4wi
push 1
push 0
mov dword [ebp - 4], eax
call edi
push str.log:_d9cvxn9j
mov esi, eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test esi, esi
je 0x40e96a
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea eax, [ebp - 0xc]
xor esi, esi
push eax
push 0x20019
push esi
push str.reg8lsf9pm3
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x40e978
push str.86raftol
push str.v13zrsaj
call edi
xor esi, esi
push str.MTX7krgpwfg
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x40e992
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x40e9a4
push str.89zrxuo6
push str.vytpzpvu
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x150]
push eax
push str.s_k0hgluxv
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.ev_h437k413
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor esi, esi
push esi
push 0xff9
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.WTMR_r8hkev8q
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.5bq9os61
push str.cyq8ajjk
call edi
mov esi, dword [ebp - 4]
xor eax, eax
push esi
push eax
push eax
push 0x1c
push eax
call dword [0x416198]
test eax, eax
js 0x40eb9b
push str.WTMR_0vblmzrm
push 1
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.SMPHR_lbzja6mf
push 1
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.ihgzkq5e
push str.180btrqy
mov esi, eax
call edi
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x40ea82
push str.72i6wqjf
push str.nh2nd1uv
call edi
jmp 0x40ea89
push str.log:_rve1rl8c
call ebx
xor eax, eax
push eax
push 0xace
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push str.regqnzngasx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x290]
push eax
push str.s_0a30h06m
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x790
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.log:_qw55xh0e
mov esi, eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
push 0x20019
push ebx
push str.regh9jblxki
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.ev_bc9gtawy
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.WTMR_7f6qywdm
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.nnjspqw3
push str.nf5664yj
mov esi, eax
call edi
test esi, esi
je 0x40eb65
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.yidb4w94
push str.5qrd5gm7
jmp 0x40eb6f
push str.v1tqcijr
push str.bhe4txyg
call edi
mov edx, dword [0x4164a4]
mov ecx, dword [ebp - 4]
call fcn.0040f304
mov edi, dword [ebp - 8]
mov esi, eax
push esi
push dword [edi]
call dword [0x416144]
push esi
mov dword [edi], eax
call dword [0x4160cc]
xor eax, eax
inc eax
jmp 0x40eba8
test esi, esi
je 0x40eba6
push esi
call dword [0x4160cc]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret