Function at 0x410d4a
Capabilities:
Print debug messages
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ac
push ebx
push esi
mov eax, ecx
push edi
push eax
mov dword [ebp - 4], eax
call dword [0x41a19c]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x168]
push eax
push str.s_6cno3xmy
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x104
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.wws45in3
push str.us6sauvg
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x10]
push eax
push 0x20019
push ebx
push str.regf05lg35g
push 0x80000001
call edi
push str.WTMR_sff1cal1
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
call ebx
push str.MTXxfgaaxgh
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x410e00
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call ebx
jmp 0x410e16
lea eax, [ebp - 8]
push eax
push 0x20019
push esi
push str.regkej58ght
push 0x80000001
call edi
push str.XML8840hgsa
push 1
push esi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
call esi
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call ebx
push str.SMPHR_d9p7sx3o
push 1
push 0
push 0
call esi
xor esi, esi
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.ev_xlqp92af
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor esi, esi
push esi
push 0x3a3
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push str.WTMR_fq4j6xha
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x410eba
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea eax, [ebp - 8]
push eax
push 0x20019
push esi
push str.regsxfz7knt
push 0x80000001
call edi
jmp 0x410ebc
call ebx
push str.log:_r9rd34ht
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.66vvr4kj
push str.pbx77lau
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 0x14]
push eax
push 0x20019
push esi
push str.reg0svtlujl
push 0x80000001
call edi
call ebx
mov esi, dword [ebp - 0xc]
lea eax, [esi*2 + 0x10]
push eax
push 0x40
call dword [0x41a04c]
push esi
push eax
push 0xffffffffffffffff
push dword [ebp - 4]
xor esi, esi
mov dword [ebp - 8], eax
push esi
push 0xfde9
call dword [0x41a0b0]
push str.MTXy9evm3gm
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x410f4d
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.regwlfi6qpe
push 0x80000001
call edi
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x410f4f
call ebx
lea eax, [ebp - 0x2a8]
push eax
push str.s_nw5uw4r6
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.XMLyp256qh1
push 1
push 0
push 0
call esi
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.SMPHR_91ux43w8
push 1
push 0
push 0
call esi
mov esi, eax
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
push str.regyiqzc70a
push 0x80000001
call edi
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
jne 0x410fcb
push str.2dxbedzp
push str.94hfpb4j
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0xbbd
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push esi
push str.regwx0g7foq
push 0x80000001
call edi
push str.WTMR_6wjht7v1
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
call ebx
push 8
pop esi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.regvryi50b4
push 0x80000001
call edi
sub esi, 1
jne 0x411010
push str.WTMR_x9c35cgk
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x411047
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
jmp 0x411057
push str.f173bjrg
push str.w02rik27
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.ev_macu3rtr
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor eax, eax
push eax
push 0xaf4
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push 0x20019
push 0
push str.regf6c2mfrb
push 0x80000001
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.log:_tsh7llhh
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call ebx
lea eax, [ebp - 0x24]
push eax
push 0x20019
push 0
push str.reg9ntilkgt
push 0x80000001
call edi
push str.rvxakh1y
push str.kj2js4ea
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov word [eax + ecx*2], dx
leave
ret