Function at 0x408b09
Capabilities:
Print debug messages
Resolve function by parsing pe exports
Set environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa74
push ebx
push esi
push edi
push str.ev_4zxibhcj
xor ebx, ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.WTMR_641ihq4b
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push esi
call ebx
xor esi, esi
push esi
push 0xf0d
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x816
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.WTMR_7w81ebxx
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x408b9f
push eax
call ebx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.SMPHR_3eruvbfe
push 1
push esi
push esi
call ebx
mov esi, eax
lea eax, [esp + 0x58]
push eax
push 0x20019
push 0
push str.reg99sv4bwf
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0
push 1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push str.XML8m3i4sg9
push 1
push 0
push 0
call ebx
xor ebx, ebx
push ebx
push 1
push eax
call esi
push str.jr4rl31w
push str.grutegk3
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [esp + 0x80]
push eax
push str.s_oed7ei7m
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.ev_pl29hhwl
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.MTXv2akp1fm
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x408c60
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.log:_v779pulf
jmp 0x408c65
push str.log:_tbphm4tl
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.SMPHR_q3sxd3xv
push 1
push 0
push 0
call esi
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x408c91
call edi
push str.MTX83tgvgin
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x408cab
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call edi
push str.SMPHR_0uffiuta
push 1
push 0
push 0
call esi
mov esi, eax
call edi
push 0
push 1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call esi
test eax, eax
je 0x408ced
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.regh8j6ib4l
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x408cfd
push str.qpcz3rl8
push str.xysnbwjj
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.XMLhg7s8d68
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call esi
lea eax, [esp + 0x1c0]
push eax
push str.s_1ncmpwev
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.ev_czq9c7yp
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.WTMR_rzir4fkx
push 1
push 0
call esi
call section..text
push str.WTMR_p787jt46
push 1
push 0
call esi
test eax, eax
je 0x408d7e
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push 0x2f3
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.ev_633lj5vu
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 4
pop esi
push str.log:_9wxnp156
call ebx
sub esi, 1
jne 0x408db5
push str.XML55mp1gq2
push 1
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.MTXb9mwk13v
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x408e04
push str.log:_bgvvdo05
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.log:_1yly6pc5
call ebx
jmp 0x408e14
push str.zylwf2bf
push str.1a53vrt3
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
xor eax, eax
push eax
push 0xe47
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
lea eax, [esp + 0x5c]
push eax
push 0x20019
push 0
push str.regkvju7jrx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.log:_mildr80f
call ebx
push str.WTMR_hp2qok68
push 1
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, eax
call edi
mov edi, dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push esi
call edi
call fcn.0040e2ab
test eax, eax
jne 0x408e81
push ebx
call dword [0x41602c]
mov ecx, str.f2dbcb9d18b96f7f026294ef43835a06
call fcn.0040f12e
push ebx
push 0x6c4
push ebx
push 4
push ebx
push 0xffffffffffffffff
mov dword [esp + 0x40], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
lea eax, [esp + 0x60]
push eax
push 0x20019
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.reg7rkofxio
push 0x80000001
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x64]
xor esi, esi
push eax
push 0x20019
push esi
push str.regfbgpmm3h
push 0x80000001
call ebx
push str.MTXz0rqqc1u
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x408f0a
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.k1de1i7r
push str.cj4ebpin
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x408f21
lea eax, [esp + 0x18]
push eax
push 0x20019
push esi
push str.regb17hm1n5
push 0x80000001
call ebx
push str.ev_lv48q8rk
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
xor esi, esi
push str.WTMR_huw3shtb
inc esi
push esi
push 0
call ebx
push eax
call edi
push str.WTMR_l4dc6m3n
push esi
push 0
call ebx
test eax, eax
je 0x408f67
push eax
call edi
push str.XMLkib5d46g
push esi
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call fcn.0040520f
call fcn.0040e3a5
test eax, eax
je 0x408f93
call fcn.0040e75a
push ecx
mov ecx, 0x412af8
call fcn.0040e1dd
mov ecx, 0x412b40
mov edi, eax
call fcn.0040e1dd
mov ecx, 0x412b88
mov esi, eax
call fcn.0040e1dd
mov ecx, 0x412bd0
mov dword [esp + 0x48], edi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], eax
call fcn.0040e1dd
mov ecx, str.
mov dword [esp + 0x54], eax
call fcn.0040e1dd
mov dword [esp + 0x58], eax
mov eax, dword [0x4163c0]
pop ecx
mov dword [esp + 0x34], eax
lea ecx, [esp + 0x34]
mov eax, dword [0x416230]
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ebx
call fcn.0040b9c1
push 0x1000
push 0x40
mov dword [esp + 0x34], eax
call dword [0x41604c]
push 0x618
push 0x40
mov dword [esp + 0x24], eax
call dword [0x41604c]
mov esi, eax
call fcn.0040f787
mov edi, eax
call fcn.0040fa08
push dword [0x416404]
mov ebx, eax
push esi
call dword [0x416144]
mov edx, edi
mov ecx, eax
call fcn.0040f304
mov edx, dword [0x416238]
mov ecx, eax
call fcn.0040f304
mov edx, ebx
mov ecx, eax
call fcn.0040f304
mov edx, dword [0x4163b0]
mov ecx, eax
call fcn.0040f304
mov edx, dword [esp + 0x28]
mov ecx, eax
call fcn.0040f304
mov esi, eax
push esi
push dword [esp + 0x20]
call dword [0x416144]
push esi
mov dword [esp + 0x20], eax
call dword [0x4160cc]
push 0x800
push 0x40
call dword [0x41604c]
push str.ev_eq4blbjv
xor edi, edi
mov dword [esp + 0x24], eax
push edi
xor ebx, ebx
inc ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov esi, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.WTMR_k9xh3ekc
push ebx
push edi
call esi
test eax, eax
je 0x4090fb
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea eax, [esp + 0x18]
push eax
push 0x20019
push edi
push str.regitio96fy
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x40910b
push str.79wg3q9y
push str.vx5hmner
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [esp + 0x300]
push eax
push str.s_dogdil5z
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.XML4gjfme6o
push ebx
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push 0x243
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push str.MTXkpcgxr61
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
test edi, edi
je 0x409173
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.WTMR_s66xsa5v
push 1
xor edi, edi
push edi
call esi
mov esi, eax
lea eax, [esp + 0x68]
push eax
push 0x20019
push edi
push str.regl0pf1n3w
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push edi
push 0xe7a
push edi
push 4
push edi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push str.w2cw419u
push str.dqibiekq
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + eax*4 + 0x44]
call fcn.0040f12e
mov esi, eax
push esi
mov dword [esp + 0x14], esi
call dword [0x416090]
cmp word [esi + eax*2 - 2], 0x2f
je 0x40920b
mov edx, dword [0x416288]
mov ecx, esi
call fcn.0040f304
mov esi, eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x3c]
xor edx, edx
push eax
push dword [esp + 0x30]
inc edx
mov ecx, esi
push dword [esp + 0x24]
call fcn.00409d31
add esp, 0xc
mov dword [esp + 0x24], eax
push str.WTMR_dbyxxzv5
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.vdtmfley
push str.770g1jzg
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
xor eax, eax
push eax
push 0x9ce
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push str.log:_7q164k5b
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push 0x264
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.log:_orlm351s
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
call ebx
push str.XML32vnlswv
push 1
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.WTMR_zyhdiujv
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.sltonddx
push str.1j09h1pl
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test esi, esi
je 0x4092de
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
call ebx
push str.MTXeszywhcx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x409303
push str.log:_ipd9mrf5
call edi
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x40930a
push str.log:_v35lj336
call edi
mov esi, dword [esp + 0x24]
push esi
call dword [0x416090]
cmp eax, 0x40
jge 0x409343
push dword [esp + 0x10]
call dword [0x4160cc]
test esi, esi
jne 0x40932f
push esi
call dword [0x4160cc]
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, 5
jl 0x4091da
jmp 0x40935d
mov esi, dword [esp + 0x10]
push esi
push dword [esp + 0x24]
call dword [0x416144]
push esi
mov dword [esp + 0x24], eax
call dword [0x4160cc]
lea eax, [esp + 0x440]
push eax
push str.s_zm6e7qyr
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 6
pop esi
push str.log:_e1jac8hu
call edi
sub esi, 1
jne 0x40937a
push str.ev_e13kzwr1
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x285
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.log:_nat9chmf
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x6c]
push eax
push 0x20019
push 0
push str.reg1mjz1qye
push 0x80000001
call esi
push str.MTXtigix833
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x4093fc
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x40940e
call ebx
push str.fl5y2o9y
push str.6thejav9
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.XML5cd519g6
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.log:_u8gaqhk1
call edi
push str.WTMR_6z2kt6i2
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.log:_l27q69y1
call edi
push str.SMPHR_og8j5w5k
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push dword [esp + 0x2c]
call dword [0x4160cc]
push dword [esp + 0x1c]
call dword [0x4160cc]
push 0x208
push 0x40
call dword [0x41604c]
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], eax
call fcn.0040e849
cmp dword [esp + 0x24], 0
je 0x409d16
lea eax, [esp + 0x580]
push eax
push str.s_vgljbzme
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.MTXkin6tev5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esp + 0x28], eax
test eax, eax
je 0x4094f3
call ebx
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.regnm8mflvd
jmp 0x409504
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.regnl6q192h
push 0x80000001
call esi
push str.log:_re6e1pyh
call edi
push str.ev_dmrqca75
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.WTMR_43fq86je
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea eax, [esp + 0x70]
push eax
push 0x20019
push 0
push str.regdjkwp0dn
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 4
pop esi
push str.bfxhcls5
push str.k50pkrdi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
sub esi, 1
jne 0x409568
push 0xff7
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.SMPHR_3bn10q0x
push 1
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov esi, dword [esp + 0x24]
mov ecx, esi
mov edx, dword [esp + 0x10]
call fcn.0040ba02
push dword [0x416504]
and dword [esp + 0x20], 0
push esi
call dword [0x416190]
test eax, eax
je 0x4095d8
sub eax, esi
sar eax, 1
mov dword [esp + 0x1c], eax
jmp 0x4095e0
push 0xffffffffffffffff
call dword [0x41602c]
push 0x100
push 0x40
call dword [0x41604c]
push esi
mov dword [esp + 0x18], eax
call dword [0x416090]
push eax
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x18]
add eax, 6
mov ecx, esi
push eax
call fcn.0040ef52
pop ecx
pop ecx
test eax, eax
jne 0x40961a
push 0xfffffffffffffffe
call dword [0x41602c]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
call fcn.0040f304
push dword [esp + 0x14]
mov dword [esp + 0x24], eax
call dword [0x4160cc]
mov esi, 0x208
push esi
push 0x40
call dword [0x41604c]
push dword [esp + 0x10]
push eax
call dword [0x416144]
mov edx, dword [0x41629c]
mov ecx, eax
call fcn.0040f304
mov edx, dword [0x416438]
mov ecx, eax
call fcn.0040f304
push esi
push 0x40
mov dword [esp + 0x24], eax
call dword [0x41604c]
push dword [esp + 0x10]
push eax
call dword [0x416144]
mov edx, dword [0x41629c]
mov ecx, eax
call fcn.0040f304
mov edx, dword [0x41655c]
mov ecx, eax
call fcn.0040f304
push dword [esp + 0x10]
mov dword [esp + 0x2c], eax
call dword [0x4160dc]
push 0x5000
push 0x40
call dword [0x41604c]
push 0x2800
mov esi, eax
push esi
push dword [0x416370]
call dword [0x416164]
mov edx, dword [0x416200]
mov ecx, esi
call fcn.0040f304
mov edx, dword [esp + 0x10]
mov ecx, eax
call fcn.0040f304
mov esi, eax
push esi
push dword [0x416370]
call dword [0x416168]
push esi
call dword [0x4160cc]
push dword [esp + 0x20]
push dword [esp + 0x28]
call fcn.0040dbb4
push dword [esp + 0x28]
call dword [0x41603c]
mov dword [esp + 0x2c], eax
test eax, eax
je 0x409b02
push str.MTX8kqewsq1
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x409736
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x409751
lea eax, [esp + 0x18]
push eax
push 0x20019
push esi
push str.regoahtkp54
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.WTMR_dbrndbr0
push 1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
call esi
test eax, eax
je 0x409788
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.reguw2stq3o
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x6c0]
push eax
push str.s_48rpi219
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.WTMR_99s57yio
push 1
push 0
call esi
mov esi, eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.p5hjnmv2
push str.c3blh91r
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
call ebx
push 0xdd6
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call ebx
push esi
push 0xcee
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, dword [esp + 0x24]
call fcn.004050e9
push str.WTMR_pbd85x3t
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, eax
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.reg6g8jk436
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
call ebx
lea eax, [esp + 0x800]
push eax
push str.s_t2t0rkzl
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.log:_psku1brj
call edi
push 0x438
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.ev_5df4vouq
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.WTMR_ieyrauze
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.sa9utps7
push str.7xyy8qxf
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test esi, esi
je 0x4098b2
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.MTXeb4y8v5f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x4098d2
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x4098f5
push str.log:_o2pyvecg
call edi
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.regs9na090n
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor eax, eax
push eax
push 0xeb
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push str.fekzn5dr
push str.mglflnyu
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x74]
push eax
push 0x20019
push 0
push str.regmspd4ly6
push 0x80000001
call esi
push str.SMPHR_eos82dv1
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x409964
call ebx
jmp 0x40997c
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.regzj7dopw1
push 0x80000001
call esi
push str.MTX17d53oi7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x40999a
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call ebx
jmp 0x4099b2
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.reg47s16w9d
push 0x80000001
call esi
push str.ev_g3c40uco
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [esp + 0x940]
push eax
push str.s_kqpb3l3t
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x412
push 0
call esi
push str.log:_i8r6zit6
call edi
push dword [esp + 0x20]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
call fcn.00405061
mov dword [esp], 0x703
push 0
call esi
push str.log:_t4huwgjw
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esp + 0x78]
xor esi, esi
push eax
push 0x20019
push esi
push str.reglv7dsuwz
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.ev_osli8du8
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.XMLmjsqdkvr
push 1
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call ebx
push str.WTMR_heg8eyl0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.ssgzlugc
push str.dd14ddms
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea eax, [esp + 0x7c]
xor esi, esi
push eax
push 0x20019
push esi
push str.regx77vx0hb
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call ebx
push str.MTX37gwsbeb
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x409af1
push str.log:_2vghv1bl
call edi
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x409af3
call ebx
push str.WTMR_m2m9ufnh
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push dword [esp + 0x1c]
call dword [0x41603c]
mov esi, eax
mov dword [esp + 0x18], esi
test esi, esi
je 0x409b57
push 0x208
push 0x40
call dword [0x41604c]
push 0
push 0x1a
mov edi, eax
push edi
push 0
call dword [0x4160c8]
mov ecx, esi
call fcn.004074d3
test eax, eax
je 0x409b50
push 0
push esi
push dword [esp + 0x28]
mov edx, edi
mov ecx, edi
call fcn.00407254
add esp, 0xc
push edi
call dword [0x4160cc]
mov esi, dword [esp + 0x20]
mov edx, esi
mov edi, dword [esp + 0x24]
mov ecx, edi
call fcn.004101e7
mov edx, esi
mov ecx, edi
call fcn.004105aa
mov edx, esi
mov ecx, edi
call fcn.00406586
push esi
push edi
call fcn.0040cd6f
mov edx, esi
mov ecx, edi
call fcn.0040de5f
mov edx, esi
mov ecx, edi
call fcn.00405f95
push edi
call dword [0x416090]
add eax, eax
push eax
push 0x40
call dword [0x41604c]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push edi
call fcn.0040bfcc
test eax, eax
jle 0x409bc6
push esi
push dword [esp + 0x18]
lea ecx, [esp + 0x3b]
call fcn.0040c27b
push dword [esp + 0x14]
call dword [0x4160cc]
push str.ev_o0x96oip
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.MTXoysmae2a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x409c1f
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.zkw8rd4t
push str.b446grjy
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.XMLqmh77qhv
push 1
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push 5
pop edi
call ebx
sub edi, 1
jne 0x409c3d
push edi
push 0x54d
push edi
push 4
push edi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
lea eax, [esp + 0x34]
push eax
push 0x20019
push edi
push str.regtuqxyrrj
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.SMPHR_3caimroj
push 1
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov esi, eax
call ebx
push edi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.WTMR_1mp48q8l
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x409cb2
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
jmp 0x409cc2
push str.7c085ak0
push str.ehfb85su
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov edi, dword [esp + 0x24]
mov ecx, edi
call fcn.0040878d
mov eax, dword [esp + 0x18]
test eax, eax
je 0x409cdc
push eax
call dword [0x416148]
mov ebx, dword [esp + 0x1c]
push ebx
call dword [0x4160f8]
push ebx
call dword [0x4160cc]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x409cfd
push eax
call dword [0x416148]
mov ebx, dword [esp + 0x28]
push ebx
call dword [0x4160f8]
push ebx
call dword [0x4160cc]
push edi
call dword [0x4160cc]
push dword [esp + 0x10]
call dword [0x4160cc]
push dword [esp + 0x20]
call dword [0x4160cc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret