Function at 0x40517e
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x42e7e8]
xor ecx, ecx
push ebx
push esi
mov dword [ebp - 0x30], eax
mov ebx, ecx
mov eax, dword [0x42e7e4]
push edi
mov dword [ebp - 0x2c], eax
mov edi, ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ecx
push str.D:_A__GA___SY__A__GA___BA_
push eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x20], edi
mov dword [ebp - 4], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], ecx
call fcn.0040de8d
mov esi, eax
pop ecx
pop ecx
test esi, esi
js 0x4054b1
lea eax, [ebp - 0x14]
push str.D:_A__GA___SY__A__GA___BA__A__0x80100000___BU_
push eax
call fcn.0040de8d
mov esi, eax
pop ecx
pop ecx
test esi, esi
js 0x4054b1
mov eax, dword [ebp - 0x18]
and dword [ebp - 0x34], ebx
push str.GlobalOfficeSourceEngineMutex
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x3c]
push edi
push eax
mov dword [ebp - 0x3c], 0xc
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x405235
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x4054b1
mov eax, dword [ebp - 0x10]
push 0x2710
push eax
call fcn.00410333
mov esi, eax
cmp esi, 0x80070102
je 0x4054b1
test esi, esi
js 0x4054b1
mov eax, dword [ebp - 0x14]
xor esi, esi
push str.GlobalOfficeSourceEngineRunning
xor ebx, ebx
mov dword [ebp - 0x38], eax
push esi
inc ebx
mov dword [ebp - 0x3c], 0xc
push ebx
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x34], esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x4052a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x4054b1
xor esi, esi
push esi
push esi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 8], eax
test eax, eax
jne 0x4052d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x4054b1
mov eax, dword [ebp - 8]
push 0x42e888
push eax
call fcn.004024a8
mov esi, eax
test esi, esi
js 0x4054b1
push 0x425a34
push 2
lea eax, [ebp - 0x30]
push eax
push str.HeavyH2O_SourceEngine_V1_0
call fcn.00411264
mov esi, eax
test esi, esi
js 0x4054b1
cmp dword [ebp + 8], edi
je 0x405345
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x405345
and dword [eax + 0xc], edi
push eax
push dword [ebp + 8]
mov dword [eax + 4], 4
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
test eax, eax
jne 0x405345
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x405499
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push ebx
push ebx
call fcn.0040e925
mov esi, eax
test esi, esi
js 0x405499
xor esi, esi
mov dword [ebp - 0x1c], ebx
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, eax
mov dword [ebp - 0x20], edi
test edi, edi
jne 0x4053a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x405499
xor esi, esi
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4053cd
push esi
lea eax, [ebp - 4]
push eax
push esi
push 0x20019
push esi
push esi
push esi
push str.SOFTWAREMicrosoftOfficeDeliverySourceEngineSettings
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov eax, dword [ebp - 4]
test eax, eax
je 0x4053e6
push 0x42e884
push eax
call fcn.00404e80
push ebx
push edi
push 4
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x42e8b0], eax
mov esi, ebx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x28], eax
mov dword [ebp + 8], esi
test edi, edi
je 0x405409
push 2
pop esi
mov dword [ebp - 0x24], edi
mov dword [ebp + 8], esi
push ebx
push 0xea60
push 0
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
mov ecx, eax
cmp ecx, 0xc0
je 0x405409
cmp ecx, 0x102
jne 0x405451
call dword [sym.imp.KERNEL32.dll_GetTickCount]
imul ecx, dword [0x42e890], 0xea60
mov edx, eax
mov esi, dword [0x42e8b0]
sub edx, esi
cmp edx, ecx
jae 0x405486
mov esi, dword [ebp + 8]
jmp 0x405409
test ecx, ecx
je 0x405497
cmp ecx, 0x80
je 0x405497
test edi, edi
je 0x405409
lea eax, [esi - 1]
cmp eax, ecx
jne 0x405409
push 0x42e884
push dword [ebp - 4]
call fcn.00404e80
push ebx
push edi
push 4
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
jmp 0x405409
sub eax, esi
push eax
push str.Shutting_down__timed_out_after__d_ticks
push ebx
call fcn.00410f0b
add esp, 0xc
xor esi, esi
push 0
push 2
lea eax, [ebp - 0x30]
push eax
call fcn.004112f2
cmp dword [ebp - 0x1c], 0
je 0x4054b1
call fcn.0040e95d
mov ecx, dword [0x42e888]
test ecx, ecx
je 0x4054df
mov eax, dword [ecx]
push ecx
call dword [eax + 0x28]
mov ecx, dword [0x42e888]
mov eax, dword [ecx + 4]
add ecx, 4
mov eax, dword [eax + 4]
add eax, ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
and dword [0x42e888], 0
cmp dword [ebp - 4], 0
je 0x4054ee
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4054fd
push dword [ebp - 0x20]
call edi
mov eax, dword [ebp - 8]
test eax, eax
je 0x405507
push eax
call edi
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x40551b
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [ebp - 0xc]
push eax
call edi
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x405533
test ebx, ebx
je 0x405530
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [ebp - 0x10]
push eax
call edi
cmp dword [ebp - 0x14], 0
je 0x405541
push dword [ebp - 0x14]
call fcn.0040df44
cmp dword [ebp - 0x18], 0
je 0x40554f
push dword [ebp - 0x18]
call fcn.0040df44
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8