Function at 0x40fc1e
Capabilities:
Print debug messages
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38c
push ebx
push esi
push edi
push str.XMLdjh5epvm
xor esi, esi
mov dword [ebp - 0xc], ecx
xor ebx, ebx
inc esi
push esi
push ebx
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x10]
push eax
push 0x20019
push ebx
push str.reg1lftjymb
push 0x80000001
call edi
push ebx
push 0xe35
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov esi, eax
push str.fob2sj9z
push str.qhgw1ab5
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.regwvuepiu9
push 0x80000001
call edi
push 0x903
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push str.reg4rnlrcg8
push 0x80000001
call edi
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.ev_26mp3425
xor edi, edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.MTX34yeuucm
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x40fd1d
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.tbbtvgtkq
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.WTMR_ggohtyic
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.r6nn23zx
push str.j5a1a2f9
mov esi, eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x40fd4c
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
jmp 0x40fd4e
call edi
mov eax, dword [0x41509c]
push 0
push 2
call eax
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40ffe0
push str.WTMR_6qtqds15
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x40fd89
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.tgnyhn0oi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.bxo6mn3y
push str.lyaei9tw
call esi
push str.XML7xheqgqb
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.txmor20l9
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebp - 0x388]
push eax
push str.s_c8bvephs
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.MTXtn7gp4y9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x40fdf7
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x40fe03
push str.opmncyih
push str.tfcibijy
call esi
push str.ev_k6twxvbe
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.SMPHR_feehg3ui
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov esi, eax
call edi
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x40fe65
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.regfzrc44xo
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x40fe70
push str.t4tbns3gr
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x415070]
mov dword [ebp - 0x248], 0x22c
jmp 0x40ffc7
push dword [ebp - 0xc]
mov eax, dword [0x41511c]
lea ecx, [ebp - 0x224]
push ecx
call eax
test eax, eax
jne 0x40ffc2
push str.ev_u9fx75f5
push eax
inc eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.XMLpyjh0tf2
xor eax, eax
xor esi, esi
inc eax
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push 0x2e2
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.td0wujnth
mov esi, eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.regkfn324ta
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor eax, eax
push str.WTMR_3j4hshlg
inc eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, eax
call edi
test esi, esi
je 0x40ff37
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
call edi
xor eax, eax
push str.WTMR_ytpu5f65
inc eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.t01toqzbx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
call edi
push str.MTX45e7ahhl
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x40ff7a
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x40ff8c
call edi
push str.96hl8dlz
push str.4oplm0pt
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push dword [ebp - 0x240]
mov eax, dword [0x415060]
push esi
push 1
call eax
mov esi, eax
test esi, esi
je 0x40ffc2
mov ecx, dword [0x415118]
push 0
push esi
call ecx
mov ecx, dword [ebp - 4]
test eax, eax
push 1
pop eax
cmovne ecx, eax
push esi
mov dword [ebp - 4], ecx
call dword [0x4150c0]
mov eax, dword [0x41500c]
lea ecx, [ebp - 0x248]
push ecx
push ebx
call eax
test eax, eax
jne 0x40fe84
push ebx
call dword [0x4150c0]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret