Function at 0x40c6b4
Capabilities:
Print debug messages
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push edi
push str.SMPHR_meca1nbj
xor edi, edi
inc edi
push edi
push 0
push 0
call ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.ev_18tg4uqv
push 0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0xdc6
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 8]
push eax
push 0x20019
push esi
push str.regkqkfvk6c
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.XMLkb6th7mu
push edi
push esi
push esi
call ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.WTMR_zkc1mvqr
push edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push eax
call ebx
lea eax, [ebp - 0x148]
push eax
push str.s_oivhvbxk
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.WTMR_dfh8gmaf
push edi
push 0
call esi
push str.log:_kr1rb5p8
mov esi, eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test esi, esi
je 0x40c79a
push esi
call ebx
jmp 0x40c7a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x417360]
and dword [ebp - 4], 0
push dword [ebp + 8]
call dword [0x417190]
mov ebx, eax
test ebx, ebx
jne 0x40c7c1
or eax, 0xffffffff
jmp 0x40c926
push dword [0x41720c]
add ebx, 0x10
push ebx
call dword [0x417190]
test eax, eax
je 0x40c7e8
mov esi, eax
sub esi, ebx
sar esi, 1
mov dword [ebp - 4], esi
jns 0x40c7e8
push 0xfffffffffffffffe
pop eax
jmp 0x40c926
push 0x9ec
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.MTXwqcngbmi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x40c82a
push str.1kqihaqh
push str.zg1ukjef
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x40c83e
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.log:_qy2z6ptd
call esi
push str.log:_48j86lzl
call esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.WTMR_5gkn4rxo
push edi
push 0
call esi
test eax, eax
je 0x40c859
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.WTMR_57my9t7r
push edi
push 0
call esi
push str.w0vng15x
push str.872lhffk
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.XMLpoiqhfu4
push edi
push 0
push 0
call esi
push 0
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.26eiq9q4
push str.6ywwxdw5
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.SMPHR_3xsp4nal
push edi
push 0
push 0
call esi
xor esi, esi
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x40c8dd
lea eax, [ebp + 8]
push eax
push 0x20019
push esi
push str.regeviqws1u
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ebx
call dword [0x417090]
add eax, eax
push eax
push 0x40
call dword [0x41704c]
push dword [ebp - 4]
lea edx, [ebp + 8]
mov dword [ebp + 8], eax
push esi
mov ecx, ebx
call fcn.0040f7fa
pop ecx
pop ecx
test eax, eax
jne 0x40c90b
push 0xfffffffffffffffd
pop edi
jmp 0x40c91b
mov esi, dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call dword [0x417144]
mov dword [esi], eax
push dword [ebp + 8]
call dword [0x4170cc]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8