Function at 0x40fc62
Capabilities:
Print debug messages
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
push ebx
push esi
push edi
push str.WTMR_exxfq6cy
xor edi, edi
inc edi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push 0xb80
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.SMPHR_2vh7utn9
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.log:_o6n5nlrk
mov esi, eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
jne 0x40fcdf
push str.s4gu81mi
push str.3xd4r473
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.WTMR_df9y0gcb
push edi
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x40fd13
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push str.reg5fx5kqgq
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 7
pop esi
call ebx
sub esi, 1
jne 0x40fd16
push str.ev_gywl7ljm
push esi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0x150]
push eax
push str.s_atw38u4w
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.MTX5s35ludd
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x40fd8b
push str.log:_7cn6zcfc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.umrgrf1z
push str.qxoqb0x2
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
xor esi, esi
push esi
push 0xa8e
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push str.XMLcnxtgvjp
push edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call ebx
lea eax, [ebp - 8]
mov dword [ebp - 4], esi
push eax
push 8
call dword [0x41a048]
push eax
call dword [0x41a128]
test eax, eax
je 0x40fe53
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push esi
push edi
push dword [ebp - 8]
call dword [0x41a030]
test eax, eax
jne 0x40fdfc
call dword [0x41a0b8]
cmp eax, 0x7a
jne 0x40fe53
push dword [ebp - 4]
push 0x40
call dword [0x41a098]
mov esi, eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push esi
push edi
push dword [ebp - 8]
call dword [0x41a030]
test eax, eax
je 0x40fe53
and dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push dword [esi]
call dword [0x41a05c]
test eax, eax
je 0x40fe53
push dword [ebp - 0xc]
push dword [0x41a56c]
call dword [0x41a11c]
test eax, eax
je 0x40fe48
xor edi, edi
push esi
call dword [0x41a0e0]
mov eax, edi
jmp 0x40fe55
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret