Function at 0x595ab5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60f251
mov eax, dword fs:[0]
push eax
sub esp, 0x180
mov eax, dword [0x697bc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xa4], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xac], eax
push str._Show
lea ecx, [ebp - 0x28]
call fcn.004ef370
mov dword [ebp - 4], 0
push 0x622bdc
lea ecx, [ebp - 0x40]
call fcn.004eea50
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0xa4]
movzx edx, byte [ecx + 0x2cb]
test edx, edx
je 0x595941
cmp dword [ebp - 0xac], 1
jne 0x595941
movzx eax, byte [0x68f4cd]
test eax, eax
je 0x595941
mov byte [0x68f4cd], 0
movzx ecx, byte [0x68f4cc]
test ecx, ecx
jne 0x595911
mov ecx, dword [ebp - 0xa4]
call fcn.005a6dd0
mov dword [ebp - 0xe8], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004eeb60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004ef480
mov eax, dword [ebp - 0xe8]
jmp 0x596177
mov edx, dword [ebp - 0xa4]
movzx eax, byte [edx + 0x2cb]
test eax, eax
je 0x5959b3
cmp dword [ebp - 0xac], 2
jne 0x5959b3
movzx ecx, byte [0x68f4cc]
test ecx, ecx
je 0x5959b3
mov byte [0x68f4cc], 0
movzx edx, byte [0x68f4cd]
test edx, edx
jne 0x595983
mov ecx, dword [ebp - 0xa4]
call fcn.005a6dd0
mov dword [ebp - 0x104], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004eeb60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004ef480
mov eax, dword [ebp - 0x104]
jmp 0x596177
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xbc], eax
mov ecx, dword [ebp - 0xbc]
sub ecx, 1
mov dword [ebp - 0xbc], ecx
cmp dword [ebp - 0xbc], 7
ja case.default.0x5959e1
mov edx, dword [ebp - 0xbc]
jmp dword [edx*4 + 0x596194]
push 0x622ddc
lea ecx, [ebp - 0x28]
call fcn.004ef4d0
push 0x622e00
lea ecx, [ebp - 0x40]
call fcn.004eebb0
jmp case.default.0x5959e1
push str._FlashShow
lea ecx, [ebp - 0x28]
call fcn.004ef4d0
push str.tips
lea ecx, [ebp - 0x40]
call fcn.004eebb0
jmp case.default.0x5959e1
push str._embupdate
lea ecx, [ebp - 0x28]
call fcn.004ef4d0
push str.ebmupdate
lea ecx, [ebp - 0x40]
call fcn.004eebb0
jmp case.default.0x5959e1
push str._fpshow
lea ecx, [ebp - 0x28]
call fcn.004ef4d0
push str.fpshow
lea ecx, [ebp - 0x40]
call fcn.004eebb0
jmp case.default.0x5959e1
push str._fptips
lea ecx, [ebp - 0x28]
call fcn.004ef4d0
push str.fptips
lea ecx, [ebp - 0x40]
call fcn.004eebb0
jmp case.default.0x5959e1
push str._TrayBootup
lea ecx, [ebp - 0x28]
call fcn.004ef4d0
push str.TrayBootup
lea ecx, [ebp - 0x40]
call fcn.004eebb0
jmp case.default.0x5959e1
push str._fashow
lea ecx, [ebp - 0x28]
call fcn.004ef4d0
push str.fashow
lea ecx, [ebp - 0x40]
call fcn.004eebb0
jmp case.default.0x5959e1
push str._faoffer
lea ecx, [ebp - 0x28]
call fcn.004ef4d0
push str.faoffer
lea ecx, [ebp - 0x40]
call fcn.004eebb0
push 0xc0
call fcn.005c442b
add esp, 4
mov dword [ebp - 0xc0], eax
mov byte [ebp - 4], 2
cmp dword [ebp - 0xc0], 0
je 0x595b02
mov ecx, dword [ebp - 0xc0]
call fcn.005b53b0
mov dword [ebp - 0xd4], eax
jmp 0x595b0c
mov dword [ebp - 0xd4], 0
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0xe0], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0xe0]
mov dword [ebp - 0xa8], ecx
push 0xc0
push 0
mov edx, dword [ebp - 0xa8]
push edx
call fcn.005c63d0
add esp, 0xc
push str.mini
mov ecx, dword [ebp - 0xa8]
call fcn.004eebb0
mov eax, dword [ebp - 0xa4]
add eax, 0x2f0
push eax
mov ecx, dword [ebp - 0xa8]
add ecx, 0x18
call fcn.004eeb90
mov ecx, dword [ebp - 0xa4]
add ecx, 0x2d8
push ecx
mov ecx, dword [ebp - 0xa8]
add ecx, 0x30
call fcn.004eeb90
mov edx, dword [ebp - 0xa4]
add edx, 0x308
push edx
mov ecx, dword [ebp - 0xa8]
add ecx, 0x48
call fcn.004eeb90
lea eax, [ebp - 0x174]
push eax
call fcn.004e72e0
add esp, 4
mov dword [ebp - 0xdc], eax
mov ecx, dword [ebp - 0xdc]
mov dword [ebp - 0xf0], ecx
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0xf0]
call fcn.004ef850
push eax
lea edx, [ebp - 0x15c]
push edx
call fcn.004e2fe0
add esp, 8
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0xa8]
add ecx, 0x78
call fcn.004eeb20
lea ecx, [ebp - 0x15c]
call fcn.004eeb60
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x174]
call fcn.004ef480
lea ecx, [ebp - 0x40]
push ecx
mov ecx, dword [ebp - 0xa8]
add ecx, 0x90
call fcn.004eeb90
mov edx, dword [ebp - 0xa4]
add edx, 0x32c
push edx
mov ecx, dword [ebp - 0xa8]
add ecx, 0x60
call fcn.004eeb90
lea eax, [ebp - 0x58]
push eax
call fcn.004e4860
add esp, 4
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x28]
call fcn.004ef850
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x114], esp
push eax
call fcn.004ef370
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0xa4]
call fcn.0059b370
cmp dword [ebp - 0xac], 1
je 0x595cae
cmp dword [ebp - 0xac], 2
je 0x595cae
cmp dword [ebp - 0xac], 4
je 0x595cae
cmp dword [ebp - 0xac], 5
je 0x595cae
cmp dword [ebp - 0xac], 6
jne 0x595e35
lea ecx, [ebp - 0x88]
push ecx
call fcn.004e9430
add esp, 4
mov byte [ebp - 4], 5
push 0x623504
lea ecx, [ebp - 0x88]
call fcn.004ef940
test eax, eax
jne 0x595d30
lea ecx, [ebp - 0x28]
call fcn.004ef850
push eax
lea ecx, [ebp - 0x58]
call fcn.004ef850
push eax
call fcn.004e8b50
add esp, 8
mov byte [ebp - 0xb0], al
movzx edx, byte [ebp - 0xb0]
test edx, edx
je 0x595d0c
mov dword [ebp - 0xcc], 0x62353c
jmp 0x595d16
mov dword [ebp - 0xcc], 0x62355c
mov eax, dword [ebp - 0xcc]
push eax
mov ecx, dword [ebp - 0xa8]
add ecx, 0xa8
call fcn.004eebb0
jmp 0x595d8b
push 0
lea ecx, [ebp - 0x28]
call fcn.004ef850
push eax
lea ecx, [ebp - 0x58]
call fcn.004ef850
push eax
call fcn.004e8cd0
add esp, 0xc
mov byte [ebp - 0xb2], al
movzx ecx, byte [ebp - 0xb2]
test ecx, ecx
je 0x595d69
mov dword [ebp - 0xc4], 0x6235c8
jmp 0x595d73
mov dword [ebp - 0xc4], 0x6235cc
mov edx, dword [ebp - 0xc4]
push edx
mov ecx, dword [ebp - 0xa8]
add ecx, 0xa8
call fcn.004eebb0
push 0x623804
mov eax, dword [ebp - 0xa8]
add eax, 0xa8
push eax
call fcn.004fd6d0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x595e19
push 0
push 0
mov edx, dword [ebp - 0xa4]
push edx
push 0x5a0f10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xac], 2
jne 0x595e19
lea ecx, [ebp - 0x18c]
push ecx
call fcn.004e72e0
add esp, 4
mov dword [ebp - 0xe4], eax
mov edx, dword [ebp - 0xe4]
push edx
mov ecx, dword [ebp - 0xa4]
add ecx, 0x368
call fcn.004ef440
lea ecx, [ebp - 0x18c]
call fcn.004ef480
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x88]
call fcn.004ef480
xor eax, eax
jne 0x595cae
jmp 0x5960c9
cmp dword [ebp - 0xac], 3
jne 0x595fda
push str.CDM_NAMEPIPE2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp - 0xa4]
mov dword [ecx + 0x21c], eax
push 0
push 0
mov edx, dword [ebp - 0xa4]
push edx
push 0x5a0f40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xf8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x70]
push ecx
call fcn.004e9430
add esp, 4
mov byte [ebp - 4], 6
push 0x62386c
lea ecx, [ebp - 0x70]
call fcn.004ef940
test eax, eax
jne 0x595f6e
lea ecx, [ebp - 0x28]
call fcn.004ef850
push eax
lea ecx, [ebp - 0x144]
call fcn.004ef370
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x58]
call fcn.004ef850
push eax
lea ecx, [ebp - 0x12c]
call fcn.004ef370
mov byte [ebp - 4], 8
lea edx, [ebp - 0x144]
push edx
lea eax, [ebp - 0x12c]
push eax
call fcn.004e8d50
add esp, 8
test eax, eax
je 0x595f02
mov byte [ebp - 0xad], 1
jmp 0x595f09
mov byte [ebp - 0xad], 0
mov cl, byte [ebp - 0xad]
mov byte [ebp - 0xb1], cl
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x12c]
call fcn.004ef480
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x144]
call fcn.004ef480
movzx edx, byte [ebp - 0xb1]
test edx, edx
je 0x595f4a
mov dword [ebp - 0xc8], 0x623918
jmp 0x595f54
mov dword [ebp - 0xc8], 0x623924
mov eax, dword [ebp - 0xc8]
push eax
mov ecx, dword [ebp - 0xa8]
add ecx, 0xa8
call fcn.004eebb0
jmp 0x595fc9
push 0
lea ecx, [ebp - 0x28]
call fcn.004ef850
push eax
lea ecx, [ebp - 0x58]
call fcn.004ef850
push eax
call fcn.004e8cd0
add esp, 0xc
mov byte [ebp - 0xaf], al
movzx ecx, byte [ebp - 0xaf]
test ecx, ecx
je 0x595fa7
mov dword [ebp - 0xd0], 0x623988
jmp 0x595fb1
mov dword [ebp - 0xd0], 0x62398c
mov edx, dword [ebp - 0xd0]
push edx
mov ecx, dword [ebp - 0xa8]
add ecx, 0xa8
call fcn.004eebb0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x70]
call fcn.004ef480
jmp 0x5960c9
cmp dword [ebp - 0xac], 7
je 0x595ff0
cmp dword [ebp - 0xac], 8
jne 0x5960c9
push 0x623990
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp - 0xa4]
mov dword [ecx + 0x21c], eax
push 0
push 0
mov edx, dword [ebp - 0xa4]
push edx
push 0x5a0f40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0xec]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xa0]
push ecx
call fcn.004e9430
add esp, 4
mov byte [ebp - 4], 9
push 0x6239b4
lea ecx, [ebp - 0xa0]
call fcn.004ef940
test eax, eax
je 0x5960ba
push 0
lea ecx, [ebp - 0x28]
call fcn.004ef850
push eax
lea ecx, [ebp - 0x58]
call fcn.004ef850
push eax
call fcn.004e8cd0
add esp, 0xc
mov byte [ebp - 0xae], al
movzx edx, byte [ebp - 0xae]
test edx, edx
je 0x596098
mov dword [ebp - 0xd8], 0x6239e0
jmp 0x5960a2
mov dword [ebp - 0xd8], 0x6239e4
mov eax, dword [ebp - 0xd8]
push eax
mov ecx, dword [ebp - 0xa8]
add ecx, 0xa8
call fcn.004eebb0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa0]
call fcn.004ef480
push 8
call fcn.005c442b
add esp, 4
mov dword [ebp - 0xfc], eax
mov ecx, dword [ebp - 0xfc]
mov dword [ebp - 0xb8], ecx
push 8
push 0
mov edx, dword [ebp - 0xb8]
push edx
call fcn.005c63d0
add esp, 0xc
mov eax, dword [ebp - 0xb8]
mov dword [eax], 7
mov ecx, dword [ebp - 0xb8]
mov edx, dword [ebp - 0xa8]
mov dword [ecx + 4], edx
push 0
push 0
mov eax, dword [ebp - 0xb8]
push eax
push 0x5b3040
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xf4], eax
mov ecx, dword [ebp - 0xf4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10c], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
call fcn.004ef480
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004eeb60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004ef480
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6c09
mov esp, ebp
pop ebp
ret 0x10