Function at 0x41066d
Capabilities:
Check mutex on windows
Print debug messages
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a8
push ebx
push esi
push edi
push str.WTMR_utbk5bhz
push 1
xor edi, edi
mov dword [ebp - 0x14], edx
push edi
mov dword [ebp - 0x10], ecx
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x41069a
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xa
pop esi
call ebx
sub esi, 1
jne 0x4106a3
lea eax, [ebp - 0x164]
push eax
push str.s_1mlqia48
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.SMPHR_7isg65yu
push 1
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov esi, eax
lea eax, [ebp - 0x18]
push eax
push 0x20019
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.reg8o2h0ozg
push 0x80000001
call edi
push 0
push 1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call esi
push str.XMLne2uw9o3
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call esi
push 0x341
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.ev_nfl978ko
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.WTMR_3flvbpc7
push 1
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push esi
push str.regqgu9f276
push 0x80000001
call edi
push str.MTXqpge760m
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x410797
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call ebx
jmp 0x4107b8
push str.log:_vvbbu72p
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebp - 0xc]
push eax
push 0x20019
push esi
push str.regmygs0yvo
push 0x80000001
call edi
push esi
push 0x1210
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push 0x20019
push 0
push str.regvcmx2xtr
push 0x80000001
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.dqc51wuv
push str.yw5vlaxr
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
call ebx
mov eax, dword [0x41a1bc]
mov esi, dword [ebp - 0x10]
push esi
mov dword [ebp - 0xc], eax
call dword [0x41a090]
lea eax, [eax*2 + 0x100]
push eax
push 0x40
call dword [0x41a04c]
push 2
mov ebx, eax
xor edi, edi
cmp word [esi], 0x5c
pop eax
push str.WTMR_kx9c2d4d
push 1
cmove edi, eax
push 0
add edi, esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
call esi
mov eax, dword [ebp - 8]
test eax, eax
je 0x410871
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.regwnro6cjh
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.XML5wzf9jce
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.WTMR_7zvzzmru
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
call esi
xor esi, esi
push esi
push 0xd29
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.ev_t3cnxbvu
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0x2a4]
push eax
push str.s_46tud6x0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.SMPHR_jmuxk6ox
push 1
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x410931
lea eax, [ebp - 8]
push eax
push 0x20019
push esi
push str.regqh75nufy
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0xfd3
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.log:_97v3zggk
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.MTXcs4xv154
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 8], eax
test eax, eax
je 0x410994
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.1cutskri
push str.b12vwgxn
call esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.xumk44vd
push str.lnpd9qvr
jmp 0x4109be
lea eax, [ebp - 8]
push eax
push 0x20019
push esi
push str.reghrgypzn8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.fy4if1zv
push str.xo7uqz9d
call esi
push str.log:_4w08eko5
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebp - 0x24]
push eax
push 0x20019
push 0
push str.regzp7uuz44
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.gujjb5vo
push str.plucyhav
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x410abf
push dword [ebp - 0x10]
call dword [0x41a090]
lea eax, [eax*2 + 0x100]
push eax
push 0x40
call dword [0x41a04c]
push dword [0x41a29c]
mov dword [ebp - 8], eax
push edi
call dword [0x41a190]
mov esi, eax
test esi, esi
je 0x410a61
sub esi, edi
lea edx, [ebp - 8]
sar esi, 1
mov ecx, edi
push esi
push 0
call fcn.00410ae4
pop ecx
pop ecx
test eax, eax
je 0x410a59
mov edx, dword [ebp - 0xc]
mov ecx, ebx
call fcn.004110ef
mov edx, dword [ebp - 8]
mov ecx, eax
call fcn.004110ef
mov ebx, eax
lea edi, [edi + esi*2]
add edi, 2
jmp 0x410ab6
cmp dword [ebp + 8], 0
je 0x410a76
mov edx, dword [ebp - 0xc]
mov ecx, ebx
call fcn.004110ef
mov edx, dword [ebp + 8]
jmp 0x410a9d
push edi
call dword [0x41a090]
push eax
push 0
lea edx, [ebp - 8]
mov ecx, edi
call fcn.00410ae4
pop ecx
pop ecx
test eax, eax
je 0x410aa6
mov edx, dword [ebp - 0xc]
mov ecx, ebx
call fcn.004110ef
mov edx, dword [ebp - 8]
mov ecx, eax
call fcn.004110ef
mov ebx, eax
mov esi, dword [ebp - 0x14]
push ebx
push dword [esi]
call dword [0x41a144]
mov dword [esi], eax
xor edi, edi
push dword [ebp - 8]
call dword [0x41a0cc]
test edi, edi
jne 0x4109fd
mov esi, dword [ebp - 0x14]
push ebx
push dword [esi]
call dword [0x41a144]
push ebx
mov dword [esi], eax
call dword [0x41a0cc]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret