Function at 0x404b50
Capabilities:
Gather firefox profile information
Print debug messages
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf34
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push edi
push str.XMLu4fdevhq
push 1
xor esi, esi
push esi
push esi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push esi
push 1
push eax
call edi
push str.MTXq1n7w3bt
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push esi
push 0xc3
push esi
push 4
push esi
push 0xffffffffffffffff
mov dword [0x4152d8], 0x4117f4
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.reg0l6t893i
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.ev_h08jrwbj
push 0
push 1
push 0
mov dword [0x41550c], 0x411808
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea eax, [ebp - 0x170]
push eax
push str.s_bcfre8zh
mov dword [0x4154ec], 0x41181c
call esi
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.MTXqtzx8hp7
push 0
push 0
mov dword [0x4152bc], 0x411830
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x404c3e
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x404c59
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.regiwldu3lh
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.SMPHR_bbz60kxw
push 1
push 0
push 0
mov dword [0x41557c], 0x411850
call ebx
push 0
push 1
push eax
call edi
test eax, eax
je 0x404c81
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov dword [0x4154dc], 0x411868
push eax
push 0xba0
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
lea eax, [ebp - 0x2b0]
mov dword [0x4154f4], 0x411880
push eax
push str.s_zlpk6fi9
call esi
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.ev_tc91xtzg
push 0
push 1
push 0
mov dword [0x41531c], 0x4118a4
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.ev_bvya3woa
push 0
push 1
push 0
mov dword [0x4155a4], 0x4118bc
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x37f
push 0
mov dword [0x41530c], 0x4118d8
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
push 0x68a
push 0
mov dword [0x4154c8], 0x4118e4
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.SMPHR_iysbipi4
push 1
xor esi, esi
mov dword [0x4152b0], 0x4118f4
push esi
push esi
call ebx
push esi
push 1
push eax
call edi
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test eax, eax
je 0x404d8c
push str.tsv0hbria
call edi
jmp 0x404d9c
push str.4yz9begi
push str.iaat1l8d
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.WTMR_68zl9c6n
push 1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov dword [0x415538], 0x411950
call esi
push str.vq8nojgl
push str.c6nxfun9
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov eax, dword [ebp - 4]
test eax, eax
je 0x404dd7
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.WTMR_0n85vc3v
push 1
push 0
mov dword [0x4154f8], 0x411990
call esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.WTMR_tkqhivt6
push 1
push 0
mov dword [0x415564], 0x4119a4
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push str.regpnezg2ar
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.SMPHR_ahhs9tdw
push 1
push 0
push 0
mov dword [0x4152f4], 0x4119d8
call ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push 0x1d3
push 0
mov dword [0x4153c8], 0x411a00
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.tl1wdo764
call edi
push str.WTMR_bn76k1pi
push 1
push 0
mov dword [0x415500], 0x411a24
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.tzuizwazx
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.hr1ql1ui
push str.87039vfe
mov dword [0x415384], 0x411a54
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov esi, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.WTMR_kzkrrc42
push 1
push 0
mov dword [0x415578], 0x411a70
call esi
push str.t8x0ufnff
mov dword [ebp - 4], eax
call edi
mov eax, dword [ebp - 4]
test eax, eax
je 0x404efd
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea eax, [ebp - 0x3f0]
mov dword [0x415430], 0x411a90
push eax
push str.s_chnzpjge
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.MTXfk5pbuec
push 0
push 0
mov dword [0x4154d0], 0x411aa0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x404f44
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
mov dword [0x41535c], 0x411ab0
push eax
push 0x497
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.tixn00umv
call edi
push 0xa
mov dword [0x415574], 0x411ac0
pop ebx
push str.ty46st8d5
call edi
sub ebx, 1
jne 0x404f7d
push str.WTMR_biq7qqp8
push 1
push ebx
mov dword [0x4152ec], 0x411ad0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.MTXdjgl1lda
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push str.WTMR_gxvpoqaz
push 1
push ebx
mov dword [0x41528c], 0x411af0
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
test eax, eax
je 0x404fe6
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.ajncq7cv
push str.ny8b8dyz
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
xor eax, eax
mov dword [0x4153f0], 0x411b1c
push eax
push 0x52a
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.MTX1foxa753
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push str.WTMR_l9vi7zsm
push 1
push 0
mov dword [0x41529c], 0x411b2c
call esi
push str.t374uhtn
push str.ppmrnxtn
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
call esi
push str.WTMR_upnz1jee
push 1
push 0
mov dword [0x4152b8], 0x411b58
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.t811wbm0h
mov dword [ebp - 4], eax
call edi
mov eax, dword [ebp - 4]
test eax, eax
je 0x405079
push eax
call esi
jmp 0x40507f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.8ch0b0dd
push str.evp5wksa
mov dword [0x4154d8], 0x411b80
call esi
push str.fz8ld49v
push str.ohpcw67a
mov dword [0x415508], 0x411ba8
call esi
xor eax, eax
mov dword [0x41552c], 0x411bd0
push eax
push 0xdd9
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push str.bilwyweo
push str.p8hh1gs2
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x530]
mov dword [0x41549c], 0x411bf8
push eax
push str.s_b2q4tb82
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.SMPHR_c6rtxn2e
push 1
push 0
push 0
mov dword [0x41554c], 0x411c08
call ebx
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push str.reg9vp9wahe
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0
push 1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call esi
push str.MTXeuk0bqyk
push 0
push 0
mov dword [0x415474], 0x411c28
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 4], eax
test eax, eax
je 0x405184
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.th2xy09eh
call edi
jmp 0x40519f
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.regnw0xpzk8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.WTMR_nrrqvpp8
push 1
push 0
mov dword [0x4154bc], 0x411c50
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x4051c5
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
jmp 0x4051d5
push str.gi25app2
push str.6pms62xl
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.SMPHR_jttod3t8
push 1
push 0
push 0
mov dword [0x415504], 0x411cb8
call ebx
push 0
push 1
push eax
call esi
test eax, eax
jne 0x405212
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.reg77ah2op2
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.XMLx4yqw1al
push 1
push 0
push 0
mov dword [0x41547c], 0x411d04
call ebx
push 0
push 1
push eax
call esi
push str.tspltdjl
push str.ouljkvyw
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.WTMR_4245xtfp
push 1
xor esi, esi
mov dword [0x415520], 0x411d44
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea eax, [ebp - 0x14]
push eax
push 0x20019
push esi
push str.regh037c70m
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.SMPHR_hkoaqvuo
push 1
push esi
push esi
mov dword [0x4153b8], 0x411d6c
call ebx
push str.t9lthrm9u
mov esi, eax
call edi
push 0
push 1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call esi
xor eax, eax
mov dword [0x415598], 0x411d90
push eax
push 0x10e
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.WTMR_2lwdmtng
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.SMPHR_5rwhgvw3
push 1
push 0
push 0
mov dword [0x4154a8], 0x411da8
call ebx
push 0
push 1
push eax
call esi
xor esi, esi
test eax, eax
je 0x405318
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push str.reggwktxg2i
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x670]
mov dword [0x415544], 0x411dcc
push eax
push str.s_fh9hh7uu
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.MTXawf1ae1n
push esi
push esi
mov dword [0x4154a0], 0x411de4
mov dword [0x4154ac], 0x411df0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x40536e
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.tqpzwpfbx
jmp 0x40538d
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push str.regiepztbw6
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.tw54zebwr
call edi
push esi
push 0x7ba
push esi
push 4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push 0xffffffffffffffff
mov dword [0x415490], 0x411e28
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [0x415278], 0x411e34
push eax
push 0xb2d
push eax
push 4
push eax
push 0xffffffffffffffff
call esi
mov esi, eax
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
push str.regh57c5y01
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1c3
xor esi, esi
mov dword [0x41558c], 0x411e4c
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.MTXa8cu8u0k
push esi
push esi
mov dword [0x415340], 0x411e7c
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x405445
push str.tgnaptnne
call edi
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.qvmmqy34
push str.i32zb19a
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.WTMR_g0k9fdn1
push 1
push 0
mov dword [0x41533c], 0x411eb4
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.t8mzisows
mov esi, eax
call edi
test esi, esi
je 0x405472
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.XMLyoo3iq38
push 1
xor esi, esi
mov dword [0x4153d0], 0x411edc
push esi
push esi
call ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push 1
push eax
call esi
push str.tntjlvy28
call edi
push str.XMLea771d1v
push 1
push 0
push 0
mov dword [0x415424], 0x411f00
call ebx
push 0
push 1
push eax
call esi
lea eax, [ebp - 0x1c]
xor esi, esi
push eax
push 0x20019
push esi
push str.regkukujc1n
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.MTXukdk5rol
push esi
push esi
mov dword [0x4151c8], 0x411f24
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x4054f8
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 0x9f5
push esi
mov dword [0x415220], 0x411f44
mov dword [0x415238], 0x411f54
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push 0x20019
push 0
push str.regbssywy3j
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [0x415274], 0x411f70
push eax
push 0x2ef
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
lea eax, [ebp - 0x24]
push eax
push 0x20019
push 0
push str.regon8lhjmk
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.ev_mkv5p20y
push 0
push 1
push 0
mov dword [0x4151ec], 0x411f8c
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.MTX659bq5ml
xor esi, esi
mov dword [0x4151c4], 0x411fac
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x4055cf
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x4055e6
push str.tqmqpycwx
call edi
push str.jneak3tj
push str.y0t5yda9
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.SMPHR_d0ezvgky
push 1
push esi
push esi
mov dword [0x415260], 0x411ff4
call ebx
push str.tht6hiwda
mov esi, eax
call edi
push 0
push 1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call esi
lea eax, [ebp - 4]
mov dword [0x4151b4], 0x412028
push eax
push 0x20019
push 0
push str.regnmhit5i7
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.SMPHR_7zytb0ri
push 1
push 0
push 0
mov dword [0x415224], 0x412048
call ebx
push 0
push 1
push eax
call esi
test eax, eax
je 0x405675
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.regk6y32ko4
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x40567b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.XMLfg0ub50n
push 1
push 0
push 0
mov dword [0x41524c], 0x4120a8
call ebx
push 0
push 1
push eax
call esi
push str.WTMR_zas83zwj
push 1
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push esi
push 0x777
push esi
push 4
push esi
push 0xffffffffffffffff
mov dword [0x4151f8], 0x412118
mov dword [0x415388], 0x41213c
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push str.t60xwhd9g
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.SMPHR_942zrjhx
push 1
xor esi, esi
mov dword [0x415378], 0x412150
push esi
push esi
call ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push 1
push eax
call esi
push str.WTMR_l82rdxkg
push 1
push 0
mov dword [0x415494], 0x412168
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.93s4eclk
push str.ldop5nfk
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov eax, dword [ebp - 4]
test eax, eax
je 0x405745
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.t1f98jrxw
call edi
jmp 0x405760
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.regkj50vwml
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.WTMR_08qed3dz
push 1
push 0
mov dword [0x41527c], 0x4121ec
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x40578c
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4057a7
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.regso4yxzed
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x7b0]
mov dword [0x415300], 0x412238
push eax
push str.s_0rhtpalp
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.WTMR_rv9lsjh5
push 1
push 0
mov dword [0x4152c0], 0x412254
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 4]
test eax, eax
je 0x4057fc
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
jmp 0x405803
push str.tkcq1j60r
call edi
push str.MTX34s52bf3
push 0
push 0
mov dword [0x415454], 0x41227c
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x405827
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.XMLit26gd8c
push 1
push 0
push 0
mov dword [0x4153a4], 0x412294
call ebx
push 0
push 1
push eax
call esi
push 0x221
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
lea eax, [ebp - 0x8f0]
mov dword [0x4154b8], 0x4122b4
push eax
push str.s_eutb36gm
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.MTXrulvz4cj
push esi
push esi
mov dword [0x4154e4], 0x4122d4
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x4058bc
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.regcybb0am7
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.tabqa92dv
jmp 0x4058c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.tlsubx3d4
call edi
push str.SMPHR_llytb8bk
push 1
push 0
push 0
mov dword [0x415554], 0x412328
call ebx
push str.tgwabdohg
mov esi, eax
call edi
xor edi, edi
push edi
push 1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call esi
push str.MTXj7l6ka3u
push edi
push edi
mov dword [0x415510], 0x41237c
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x40591b
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x405935
lea eax, [ebp - 4]
push eax
push 0x20019
push edi
push str.regfaerruq6
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 2
mov dword [0x415428], 0x412398
pop edi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.regjj3pi0uk
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub edi, 1
jne 0x405942
push str.XMLrxdfmajw
push 1
push edi
push edi
mov dword [0x4152e0], 0x4123ac
call ebx
push edi
push 1
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.WTMR_8q2mlbb1
push 1
push edi
mov dword [0x4154c4], 0x4123bc
mov dword [0x415594], 0x4123c8
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.ev_2yigbh0u
push edi
push 1
push edi
mov dword [0x4153dc], 0x4123e4
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.XML796zf9ly
push 1
push edi
push edi
mov dword [0x4152cc], 0x4123fc
call ebx
push edi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 4
pop esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub esi, 1
jne 0x4059f6
push str.WTMR_yjyspzjz
push 1
push esi
mov dword [0x415464], 0x412414
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.t177nyisu
mov esi, eax
call edi
test esi, esi
je 0x405a39
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.ro27ovri
push str.5lg5ej3x
jmp 0x405a43
push str.gtks8w9w
push str.h3srciic
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.ev_mf0tns34
push 0
push 1
push 0
mov dword [0x415290], 0x412470
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.XMLdv4yvvx2
push 1
xor esi, esi
mov dword [0x415298], 0x412490
push esi
push esi
call ebx
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.tw931ljur
call edi
push esi
mov esi, 0x37b
mov dword [0x4154b0], 0x4124c0
push esi
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.ev_1yp16plg
push esi
push 1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x415420], 0x4124dc
call esi
push str.ev_vo68bl08
push 0
push 1
push 0
mov dword [0x415370], 0x412504
call esi
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor eax, eax
mov dword [0x4153f4], 0x412524
push eax
push 0x999
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.XMLz9za5ea8
push 1
xor esi, esi
mov dword [0x415450], 0x41252c
push esi
push esi
mov dword [0x415350], 0x412544
call ebx
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.q7t7v6a8
push str.krdqzy7f
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.ev_83ghue7f
push esi
push 1
push esi
mov dword [0x415400], 0x41257c
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.SMPHR_8yh5ft3y
push 1
push 0
push 0
mov dword [0x41559c], 0x412598
call ebx
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x20019
push 0
push str.regfwav6hjm
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov dword [0x415314], 0x4125c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
mov dword [0x415550], 0x4125d0
push esi
push 0x852
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.m6wsuix9
push str.288qh91m
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.ev_bhdojfck
push esi
push 1
push esi
mov dword [0x415410], 0x4125fc
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor eax, eax
mov dword [0x4151dc], 0x412618
push eax
push 0x630
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 7
mov dword [0x415250], 0x412678
pop esi
push str.jyawzxle
push str.7mhzuiqy
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
sub esi, 1
jne 0x405c7e
push str.XMLdav1qxqb
push 1
push esi
push esi
mov dword [0x415444], 0x4126c4
mov dword [0x4153f8], 0x4126cc
call ebx
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp - 0x2c]
push eax
push 0x20019
push esi
push str.regjwczwiv1
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.ev_4yh9mboq
push esi
push 1
push esi
mov dword [0x4153e8], 0x4126f4
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.XMLvl2yucl5
push 1
xor esi, esi
mov dword [0x4153ec], 0x41271c
push esi
push esi
call ebx
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.tk49ljafb
call edi
push str.SMPHR_jfnhvoos
push 1
push esi
push esi
mov dword [0x4153e0], 0x41274c
call ebx
push str.txmwu9rge
mov esi, eax
call edi
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov dword [0x415338], 0x412770
mov dword [0x4154d4], 0x41277c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.WTMR_2tpf3k9u
push 1
push 0
mov dword [0x415518], 0x41278c
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.u6m5ltiw
push str.vqbq3kvg
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test esi, esi
je 0x405da2
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
jmp 0x405dbd
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.reg4t533bzq
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor eax, eax
mov dword [0x41543c], 0x4127d8
push eax
push 0x1180
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push str.ynm9y2h9
push str.nser2o02
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [0x415530], 0x412800
push eax
push 0x654
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.SMPHR_jbdif3fc
push 1
push 0
push 0
mov dword [0x415584], 0x412814
call ebx
push str.vgko7r23
push str.c82yqntn
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp - 0xa30]
mov dword [0x4152d4], 0x41284c
push eax
push str.s_34kdzx3i
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor esi, esi
mov dword [0x41546c], 0x41286c
push esi
push 0x11fb
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.WTMR_1b5rxocf
push 1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
call esi
mov dword [0x41545c], 0x412888
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.WTMR_ywqblgmo
push 1
push 0
mov dword [0x415360], 0x412898
call esi
test eax, eax
je 0x405eed
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.ap1varzm
push str.pd3ssdbv
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 3
mov dword [0x4153d8], 0x4128d8
pop esi
push str.tov5q26c7
call edi
sub esi, 1
jne 0x405efa
lea eax, [ebp - 0xb70]
mov dword [0x415460], 0x4128fc
push eax
push str.s_lbbp44mn
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov dword [0x41532c], 0x412914
push eax
push 0xc0a
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push str.t00dnerjm
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.tz5kl8u5q
mov dword [0x41555c], 0x41292c
call edi
push str.ev_9cfo1p3l
push 0
push 1
push 0
mov dword [0x4152a4], 0x41293c
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.WTMR_tes47dmi
push 1
xor esi, esi
mov dword [0x415438], 0x41294c
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x405fbf
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.tqpd21biq
call edi
push str.XMLt0k88dpd
push 1
push esi
push esi
mov dword [0x415264], 0x412974
call ebx
push esi
push 0x674
push esi
push 4
push esi
push 0xffffffffffffffff
mov dword [0x415368], 0x412984
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push str.tp9vj0b43
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x906
push 0
mov dword [0x415318], 0x412994
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.gqnuu3oi
push str.p6xpux7o
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.XML0vwx5qqa
push 1
xor esi, esi
mov dword [0x4153fc], 0x4129b4
push esi
push esi
call ebx
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push 0xd50
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
call esi
xor eax, eax
mov dword [0x415390], 0x4129cc
push eax
push 0xc6
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x379
push 0
call esi
push str.SMPHR_65h3azn8
push 1
push 0
push 0
mov dword [0x415484], 0x4129d8
call ebx
push str.c6qmvpwn
push str.q61o789w
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.ev_5k43o4b3
push 0
push 1
push 0
mov dword [0x41553c], 0x412a08
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.XMLlr84ct8q
push 1
xor esi, esi
mov dword [0x4154cc], 0x412a20
push esi
push esi
call ebx
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push 5
pop esi
push str.tm7gm98q4
call edi
sub esi, 1
jne 0x406110
push str.WTMR_3ulozhve
push 1
push esi
mov dword [0x415394], 0x412a48
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x406157
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.3ctj9t2x
push str.6okdm1tu
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x5b0
push 0
mov dword [0x415280], 0x412a74
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.tiklkzfzv
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.WTMR_efiowg0u
push 1
push 0
mov dword [0x4154a4], 0x412a8c
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.tb5ozaklm
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push 0x1ed
xor esi, esi
mov dword [0x415354], 0x412ab0
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.XMLqrpms3fl
push 1
push esi
push esi
mov dword [0x415560], 0x412ad0
call ebx
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.t0yhzp32e
call edi
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea eax, [ebp - 0xcb0]
push eax
push str.s_nxlib5zf
mov dword [0x415590], 0x412af0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0xdf0]
mov dword [0x415404], 0x412b04
push eax
push str.s_aor9vzq7
call esi
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.ev_tk2vs67b
push 0
push 1
push 0
mov dword [0x415324], 0x412b14
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x415
push 0
mov dword [0x4153c0], 0x412b30
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea eax, [ebp - 0x30]
push eax
push 0x20019
push 0
push str.reg48zflry0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [0x415588], 0x412b5c
push eax
push 0x685
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push str.9r1zhjkf
push str.09eaw99e
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 5
mov dword [0x415498], 0x412ba8
pop esi
push str.ti9nukpkj
call edi
sub esi, 1
jne 0x4062da
push str.XMLayaqc7kz
push 1
push esi
push esi
mov dword [0x4153b0], 0x412bc0
call ebx
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.trirngqb4
call edi
lea eax, [ebp - 0xf30]
mov dword [0x415470], 0x412be8
push eax
push str.s_3y8eqp1f
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.WTMR_rnsjk8ck
push 1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov dword [0x4152c4], 0x412bfc
call esi
push str.txko6u6fs
mov dword [ebp - 4], eax
call edi
mov eax, dword [ebp - 4]
test eax, eax
je 0x406361
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.MTXy9bs4nx7
push 0
push 0
mov dword [0x4152f8], 0x412c28
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 4], eax
test eax, eax
je 0x406399
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.tci9y5j5y
call edi
jmp 0x4063b4
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.regthvs75y8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.WTMR_ijgum66z
push 1
push 0
mov dword [0x415334], 0x412c50
call esi
push str.ly2md7as
push str.srjxnyfw
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov eax, dword [ebp - 4]
test eax, eax
je 0x4063f3
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.trxhpga6b
call edi
jmp 0x406403
push str.qr8khxdr
push str.xjzuu3oe
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.WTMR_9u1av0rn
push 1
push 0
mov dword [0x4153c4], 0x412ca8
call esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 4]
test eax, eax
je 0x406437
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40643e
push str.tzsphikyt
call edi
push str.WTMR_7eoqtgja
push 1
push 0
mov dword [0x415364], 0x412cc8
call esi
push str.ta3z71hy7
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
xor esi, esi
mov dword [0x41551c], 0x412ce8
push esi
push 0x9ee
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.WTMR_024nomth
push 1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
call esi
push str.XMLyeif1yte
push 1
push 0
push 0
mov dword [0x415468], 0x412d04
call ebx
xor ebx, ebx
push ebx
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.MTX39bzbsag
push ebx
push ebx
mov dword [0x4153a8], 0x412d18
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x4064ff
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push str.regec2n4lmn
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x406516
push str.z8zbvgpl
push str.dwl78fay
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.tvkat4fjq
call edi
push ebx
push 0x1114
push ebx
push 4
push ebx
push 0xffffffffffffffff
mov dword [0x415568], 0x412d5c
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.cb2ooln2
push str.kq2xlkz9
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.WTMR_zxk5sggz
push 1
push ebx
mov dword [0x41556c], 0x412d7c
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.ev_jddhpv9y
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [0x4152d8]
mov dword [0x415528], 0x412da0
call fcn.0040ed79
mov ecx, dword [0x41550c]
mov dword [0x4152e8], eax
call fcn.0040ed79
mov ecx, dword [0x41557c]
mov dword [0x415374], eax
call fcn.0040ed79
mov ecx, dword [0x4154ec]
mov dword [0x415480], eax
call fcn.0040ed79
mov ecx, dword [0x4154ac]
mov dword [0x4151ac], eax
call fcn.0040ed79
mov ecx, dword [0x4154dc]
mov dword [0x415514], eax
call fcn.0040ed79
mov ecx, dword [0x4152f4]
mov dword [0x415258], eax
call fcn.0040ed79
mov ecx, dword [0x41531c]
mov dword [0x4153d4], eax
call fcn.0040ed79
mov ecx, dword [0x4152bc]
mov dword [0x4152c8], eax
call fcn.0040ed79
mov ecx, dword [0x4153c8]
mov dword [0x4152a0], eax
call fcn.0040ed79
mov ecx, dword [0x4155a4]
mov dword [0x41539c], eax
call fcn.0040ed79
mov ecx, dword [0x4154f4]
mov dword [0x4155a0], eax
call fcn.0040ed79
mov ecx, dword [0x41530c]
mov dword [0x4151a8], eax
call fcn.0040ed79
mov ecx, dword [0x4154c8]
mov dword [0x4153e4], eax
call fcn.0040ed79
mov ecx, dword [0x4152b0]
mov dword [0x4152fc], eax
call fcn.0040ed79
mov ecx, dword [0x415538]
mov dword [0x415398], eax
call fcn.0040ed79
mov ecx, dword [0x4154f8]
mov dword [0x41534c], eax
call fcn.0040ed79
mov ecx, dword [0x415564]
mov dword [0x415308], eax
call fcn.0040ed79
mov ecx, dword [0x415500]
mov dword [0x415380], eax
call fcn.0040ed79
mov ecx, dword [0x415384]
mov dword [0x4152e4], eax
call fcn.0040ed79
mov ecx, dword [0x415578]
mov dword [0x4154c0], eax
call fcn.0040ed79
mov ecx, dword [0x415430]
mov dword [0x4152a8], eax
call fcn.0040ed79
mov ecx, dword [0x4154d0]
mov dword [0x415268], eax
call fcn.0040ed79
mov ecx, dword [0x41535c]
mov dword [0x41541c], eax
call fcn.0040ed79
mov ecx, dword [0x415574]
mov dword [0x415210], eax
call fcn.0040ed79
mov ecx, dword [0x4152ec]
mov dword [0x415434], eax
call fcn.0040ed79
mov ecx, dword [0x41528c]
mov dword [0x415200], eax
call fcn.0040ed79
mov ecx, dword [0x4153f0]
mov dword [0x41520c], eax
call fcn.0040ed79
mov ecx, dword [0x4152b8]
mov dword [0x41523c], eax
call fcn.0040ed79
mov ecx, dword [0x41529c]
mov dword [0x4153b4], eax
call fcn.0040ed79
mov ecx, dword [0x4154d8]
mov dword [0x4151d8], eax
call fcn.0040ed79
mov ecx, dword [0x415508]
mov dword [0x415270], eax
call fcn.0040ed79
mov ecx, dword [0x41552c]
mov dword [0x41525c], eax
call fcn.0040ed79
mov ecx, dword [0x41549c]
mov dword [0x4151e0], eax
call fcn.0040ed79
mov ecx, dword [0x41554c]
mov dword [0x4151bc], eax
call fcn.0040ed79
mov ecx, dword [0x415474]
mov dword [0x4154f0], eax
call fcn.0040ed79
mov ecx, dword [0x4154bc]
mov dword [0x415234], eax
call fcn.0040ed79
mov ecx, dword [0x415504]
mov dword [0x4153cc], eax
call fcn.0040ed79
mov ecx, dword [0x415520]
mov dword [0x415240], eax
call fcn.0040ed79
mov ecx, dword [0x4153b8]
mov dword [0x4151e8], eax
call fcn.0040ed79
mov ecx, dword [0x415598]
mov dword [0x4151b8], eax
call fcn.0040ed79
mov ecx, dword [0x4154a8]
mov dword [0x415310], eax
call fcn.0040ed79
mov ecx, dword [0x415544]
mov dword [0x415488], eax
call fcn.0040ed79
mov ecx, dword [0x4154a0]
mov dword [0x41536c], eax
call fcn.0040ed79
mov ecx, dword [0x41547c]
mov dword [0x415534], eax
call fcn.0040ed79
mov ecx, dword [0x415490]
mov dword [0x41544c], eax
call fcn.0040ed79
mov ecx, dword [0x415278]
mov dword [0x415448], eax
call fcn.0040ed79
mov ecx, dword [0x41558c]
mov dword [0x415570], eax
call fcn.0040ed79
mov ecx, dword [0x415340]
mov dword [0x415304], eax
call fcn.0040ed79
mov ecx, dword [0x41533c]
mov dword [0x41537c], eax
call fcn.0040ed79
mov ecx, dword [0x415388]
mov dword [0x415558], eax
call fcn.0040ed79
mov ecx, dword [0x415378]
mov dword [0x4151b0], eax
call fcn.0040ed79
mov ecx, dword [0x4153d0]
mov dword [0x4151d0], eax
call fcn.0040ed79
mov ecx, dword [0x415424]
mov dword [0x4151c0], eax
call fcn.0040ed79
mov ecx, dword [0x415300]
mov dword [0x4151f0], eax
call fcn.0040ed79
mov ecx, dword [0x4152c0]
mov dword [0x415288], eax
call fcn.0040ed79
mov ecx, dword [0x415454]
mov dword [0x415414], eax
call fcn.0040ed79
mov ecx, dword [0x4153a4]
mov dword [0x4153bc], eax
call fcn.0040ed79
mov ecx, dword [0x4154b8]
mov dword [0x415214], eax
call fcn.0040ed79
mov ecx, dword [0x4154e4]
mov dword [0x415230], eax
call fcn.0040ed79
mov ecx, dword [0x415554]
mov dword [0x41542c], eax
call fcn.0040ed79
mov ecx, dword [0x415510]
mov dword [0x415408], eax
call fcn.0040ed79
mov ecx, dword [0x415428]
mov dword [0x415524], eax
call fcn.0040ed79
mov ecx, dword [0x4152e0]
mov dword [0x4152ac], eax
call fcn.0040ed79
mov ecx, dword [0x4154c4]
mov dword [0x4154b4], eax
call fcn.0040ed79
mov ecx, dword [0x415594]
mov dword [0x4152d0], eax
call fcn.0040ed79
mov ecx, dword [0x4153dc]
mov dword [0x415418], eax
call fcn.0040ed79
mov ecx, dword [0x4152cc]
mov dword [0x41548c], eax
call fcn.0040ed79
mov ecx, dword [0x415464]
mov dword [0x41538c], eax
call fcn.0040ed79
mov ecx, dword [0x415290]
call fcn.0040ed79
mov ecx, dword [0x415298]
call fcn.0040ed79
mov ecx, dword [0x4154b0]
call fcn.0040ed79
mov ecx, dword [0x415420]
call fcn.0040ed79
mov ecx, dword [0x415370]
call fcn.0040ed79
mov ecx, dword [0x4153f4]
call fcn.0040ed79
mov ecx, dword [0x415450]
call fcn.0040ed79
mov ecx, dword [0x415350]
call fcn.0040ed79
mov ecx, dword [0x415400]
call fcn.0040ed79
mov ecx, dword [0x41559c]
call fcn.0040ed79
mov ecx, dword [0x415314]
call fcn.0040ed79
mov ecx, dword [0x415550]
call fcn.0040ed79
mov ecx, dword [0x415410]
call fcn.0040ed79
mov ecx, dword [0x4151dc]
call fcn.0040ed79
mov ecx, dword [0x4153e8]
call fcn.0040ed79
mov ecx, dword [0x4153e0]
mov dword [0x4151cc], eax
call fcn.0040ed79
mov ecx, dword [0x415338]
mov dword [0x415248], eax
call fcn.0040ed79
mov ecx, dword [0x4154d4]
call fcn.0040ed79
mov ecx, dword [0x415518]
call fcn.0040ed79
mov ecx, dword [0x41543c]
call fcn.0040ed79
mov ecx, dword [0x415530]
call fcn.0040ed79
mov ecx, dword [0x415584]
call fcn.0040ed79
mov ecx, dword [0x4152d4]
call fcn.0040ed79
mov ecx, dword [0x41546c]
call fcn.0040ed79
mov ecx, dword [0x41545c]
call fcn.0040ed79
mov ecx, dword [0x415360]
call fcn.0040ed79
mov ecx, dword [0x4153d8]
call fcn.0040ed79
mov ecx, dword [0x415460]
call fcn.0040ed79
mov ecx, dword [0x41532c]
call fcn.0040ed79
mov ecx, dword [0x41555c]
mov dword [0x415478], eax
call fcn.0040ed79
mov ecx, dword [0x4152a4]
mov dword [0x4154e0], eax
call fcn.0040ed79
mov ecx, dword [0x415438]
call fcn.0040ed79
mov ecx, dword [0x415264]
mov dword [0x415580], eax
call fcn.0040ed79
mov ecx, dword [0x415368]
call fcn.0040ed79
mov ecx, dword [0x415318]
mov dword [0x415294], eax
call fcn.0040ed79
mov ecx, dword [0x4153fc]
mov dword [0x41521c], eax
call fcn.0040ed79
mov ecx, dword [0x415390]
mov dword [0x4151f4], eax
call fcn.0040ed79
mov ecx, dword [0x415484]
mov dword [0x41526c], eax
call fcn.0040ed79
mov ecx, dword [0x41553c]
mov dword [0x415218], eax
call fcn.0040ed79
mov ecx, dword [0x4154cc]
mov dword [0x415540], eax
call fcn.0040ed79
mov dword [0x415344], eax
mov ecx, dword [0x415394]
call fcn.0040ed79
mov ecx, dword [0x415280]
mov dword [0x415284], eax
call fcn.0040ed79
mov ecx, dword [0x4154a4]
mov dword [0x4153ac], eax
call fcn.0040ed79
mov ecx, dword [0x415354]
mov dword [0x4152b4], eax
call fcn.0040ed79
mov ecx, dword [0x415560]
call fcn.0040ed79
mov ecx, dword [0x415590]
mov dword [0x415244], eax
call fcn.0040ed79
mov ecx, dword [0x415404]
mov dword [0x415208], eax
call fcn.0040ed79
mov ecx, dword [0x415324]
mov dword [0x4151e4], eax
call fcn.0040ed79
mov ecx, dword [0x4153c0]
mov dword [0x415548], eax
call fcn.0040ed79
mov ecx, dword [0x415588]
mov dword [0x4153a0], eax
call fcn.0040ed79
mov ecx, dword [0x415498]
mov dword [0x415440], eax
call fcn.0040ed79
mov ecx, dword [0x4153b0]
mov dword [0x415320], eax
call fcn.0040ed79
mov ecx, dword [0x415470]
mov dword [0x4152f0], eax
call fcn.0040ed79
mov ecx, dword [0x4152c4]
mov dword [0x415358], eax
call fcn.0040ed79
mov ecx, dword [0x4152f8]
mov dword [0x415330], eax
call fcn.0040ed79
mov ecx, dword [0x415444]
mov dword [0x415458], eax
call fcn.0040ed79
mov ecx, dword [0x4153f8]
mov dword [0x4151fc], eax
call fcn.0040ed79
mov ecx, dword [0x415334]
mov dword [0x415228], eax
call fcn.0040ed79
mov ecx, dword [0x4153c4]
mov dword [0x41522c], eax
call fcn.0040ed79
mov ecx, dword [0x415364]
mov dword [0x4151d4], eax
call fcn.0040ed79
mov ecx, dword [0x41551c]
mov dword [0x4154fc], eax
call fcn.0040ed79
mov ecx, dword [0x415468]
mov dword [0x41540c], eax
call fcn.0040ed79
mov ecx, dword [0x4153a8]
mov dword [0x415348], eax
call fcn.0040ed79
mov ecx, dword [0x415568]
mov dword [0x4154e8], eax
call fcn.0040ed79
mov ecx, dword [0x41556c]
mov dword [0x415328], eax
call fcn.0040ed79
mov ecx, dword [0x4153ec]
mov dword [0x4152dc], eax
call fcn.0040ed79
mov ecx, dword [0x415528]
mov dword [0x415254], eax
call fcn.0040ed79
mov dword [0x415204], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret