Function at 0x40bfcc
Capabilities:
Print debug messages
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28c
push ebx
push esi
push edi
push 0xc6
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 7
pop esi
push str.dq6uwmso
push str.q3kt0cxp
call edi
sub esi, 1
jne 0x40bff5
push str.XML9vw7tb7w
xor ebx, ebx
inc ebx
push ebx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.log:_jwxxc6h3
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
push 0x10c8
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push str.5njns8rz
push str.gfu5tad4
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.ev_ar3ri44x
push 0
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0x148]
push eax
push str.s_1au3kkar
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.MTX4iecetx2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
test eax, eax
je 0x40c0b6
call esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call esi
jmp 0x40c0dd
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.reg9mhygd5g
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.jl2wnk5d
push str.1e5n230f
call edi
call esi
push dword [0x416360]
and dword [ebp - 4], 0
push dword [ebp + 8]
call dword [0x416190]
mov edi, eax
test edi, edi
jne 0x40c100
or eax, 0xffffffff
jmp 0x40c274
push dword [0x41620c]
add edi, 0x10
push edi
call dword [0x416190]
test eax, eax
je 0x40c12d
mov esi, eax
sub esi, edi
sar esi, 1
mov dword [ebp - 4], esi
jns 0x40c127
push 0xfffffffffffffffe
pop eax
jmp 0x40c274
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
push str.log:_tm28qsdk
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.WTMR_2jh82m64
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x40c153
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
call esi
push str.ev_sg0ereri
push 0
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x7d4
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x288]
push eax
push str.s_uwba0cek
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.SMPHR_odi4ss1s
push ebx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x40c1c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.WTMR_b5zmkx6r
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.log:_hqzn6zpa
mov esi, eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.MTXc748hk1f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x40c22a
lea eax, [ebp + 8]
push eax
push 0x20019
push 0
push str.regu0aamxdx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.918wzvuf
push str.998n6id8
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push edi
call dword [0x416090]
add eax, eax
push eax
push 0x40
call dword [0x41604c]
push dword [ebp - 4]
lea edx, [ebp + 8]
mov dword [ebp + 8], eax
push 0
mov ecx, edi
call fcn.0040ef52
pop ecx
pop ecx
test eax, eax
jne 0x40c259
push 0xfffffffffffffffd
pop ebx
jmp 0x40c269
mov esi, dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call dword [0x416144]
mov dword [esi], eax
push dword [ebp + 8]
call dword [0x4160cc]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 8