Function at 0x900ca0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0xb130d0
push 0xa847a0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x64f8
call fcn.00a91950
mov eax, dword [0xb196ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor esi, esi
mov dword [ebp - 0x64fc], esi
mov dword [ebp - 0x6500], esi
mov dword [ebp - 0x64d0], esi
mov dword [ebp - 0x64d4], esi
xor eax, eax
mov word [ebp - 0x1c88], ax
push 0x40e
push esi
lea ecx, [ebp - 0x1c86]
push ecx
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0x64f8], esi
mov byte [ebp - 0x1f8], 0
push 0x103
push esi
lea edx, [ebp - 0x1f7]
push edx
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 4], esi
push 1
mov ecx, str.MyChngHand
call fcn.00962f00
mov dword [ebp - 0x64d4], eax
cmp eax, esi
je 0x900d7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x900d7a
lea eax, [ebp - 0x64d4]
push eax
call fcn.00985290
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x901fab
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
mov byte [ebp - 0x1f8], 0
lea edx, [ebp - 0x1f8]
lea ecx, [ebp - 0x64d0]
call fcn.009abea0
mov edi, eax
cmp edi, esi
jne 0x900df3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x15f90
jae 0x900dbc
push 0x118
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x900d82
cmp edi, esi
jne 0x900df3
lea ecx, [ebp - 0x1f8]
push ecx
push str._DCH__NETWORK___s
push str.C:PROGRA2eScanLOGDirChng.log
call fcn.0096a780
add esp, 0xc
lea edx, [ebp - 0x64d4]
push edx
call fcn.00985290
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x901fab
mov byte [ebp - 0x1f8], 0
push 1
push 1
xor edx, edx
xor ecx, ecx
call fcn.00963200
mov dword [0xbd0520], eax
cmp eax, esi
je 0x901f34
cmp eax, 0xffffffff
je 0x901f34
push str.ChngNotifInfoEvent
push esi
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov dword [ebp - 0x6500], eax
cmp eax, esi
je 0x901efe
cmp eax, 0xffffffff
je 0x901efe
mov ecx, dword [0xbd0520]
mov dword [ebp - 0x6508], ecx
mov dword [ebp - 0x6504], eax
push str._DCH__NETWORK__Network_Change_Notification_Wait_Started...
push str.C:PROGRA2eScanLOGDirChng.log
call fcn.0096a780
add esp, 8
lea esp, [esp]
xor edx, edx
mov word [ebp - 0x64a8], dx
push 0x3ffe
push esi
lea eax, [ebp - 0x64a6]
push eax
call fcn.00a7ffb0
add esp, 0xc
push 0xffffffffffffffff
push esi
lea ecx, [ebp - 0x6508]
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0xffffffff
jne 0x900ec8
cmp dword [0xbd0664], esi
je 0x900f0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._CHNG__NETWORK__Wait_failed_with_Error__u__Exiting...
push str.C:PROGRA2eScanLOGDirChng.log
call fcn.0096a780
add esp, 0xc
jmp 0x900ef3
cmp eax, esi
jne 0x900f1c
mov edx, dword [ebp - 0x6508]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
cmp dword [0xbd0664], esi
je 0x900f0d
push str._CHNG__NETWORK__Shutdown_event_signaled..._Exiting___
push str.C:PROGRA2eScanLOGDirChng.log
call fcn.0096a780
add esp, 8
cmp dword [0xbd0664], esi
je 0x900f0d
push str._CHNG__NETWORK__Exiting_func.._GetChngInfo..
push str.C:PROGRA2eScanLOGDirChng.log
call fcn.0096a780
add esp, 8
mov dword [ebp - 0x64fc], 1
jmp 0x901f70
cmp eax, 1
jne 0x900e70
mov dword [ebp - 0x64ec], esi
mov eax, dword [ebp - 0x6504]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push esi
lea ecx, [ebp - 0x64ec]
push ecx
push 0x4000
lea edx, [ebp - 0x64a8]
push edx
push esi
push esi
push 0x2224c4
mov eax, dword [ebp - 0x64d0]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, esi
jne 0x900f8e
cmp dword [0xbd0664], esi
je 0x900e70
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._CHNG__NETWORK__DeviceIoctl_Failed_for_IOCTL_GET_CHNG_NOTIF_INFO__Error:__u
push str.C:PROGRA2eScanLOGDirChng.log
call fcn.0096a780
add esp, 0xc
jmp 0x900e70
mov dword [ebp - 0x64c8], esi
cmp dword [0xbd0664], esi
je 0x900fc0
mov ecx, dword [ebp - 0x64ec]
push ecx
push str._CHNG__NETWORK__Total_Event_Data_Recvd:__u_bytes
push str.C:PROGRA2eScanLOGDirChng.log
call fcn.0096a780
add esp, 0xc
jmp 0x900fc0
mov ebx, dword [ebp - 0x64c8]
cmp ebx, dword [ebp - 0x64ec]
jae 0x900e70
mov dword [ebp - 0x64bc], esi
xor edx, edx
mov word [ebp - 0x24a8], dx
push 0x40e
push esi
lea eax, [ebp - 0x24a6]
push eax
call fcn.00a7ffb0
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x2098], cx
push 0x40e
push esi
lea edx, [ebp - 0x2096]
push edx
call fcn.00a7ffb0
add esp, 0xc
xor eax, eax
mov word [ebp - 0xe38], ax
push 0x40e
push esi
lea ecx, [ebp - 0xe36]
push ecx
call fcn.00a7ffb0
add esp, 0xc
xor edx, edx
mov word [ebp - 0xa28], dx
push 0x40e
push esi
lea eax, [ebp - 0xa26]
push eax
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0x64c4], esi
mov dword [ebp - 0x64f4], esi
mov byte [ebp - 0x1350], 0
push 0x207
push esi
lea ecx, [ebp - 0x134f]
push ecx
call fcn.00a7ffb0
add esp, 0xc
xor edx, edx
mov word [ebp - 0xf0], dx
push 0x3e
push esi
lea eax, [ebp - 0xee]
push eax
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0xb0], 0
push 0x3f
push esi
lea ecx, [ebp - 0xaf]
push ecx
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0x64c0], esi
mov dword [ebp - 0x64b0], esi
mov dword [ebp - 0x64ac], esi
mov byte [ebp - 0x1148], 0
push 0x103
push esi
lea edx, [ebp - 0x1147]
push edx
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0x1040], 0
push 0x207
push esi
lea eax, [ebp - 0x103f]
push eax
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0x408], 0
push 0x103
push esi
lea ecx, [ebp - 0x407]
push ecx
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0x4c], 0
xor eax, eax
mov dword [ebp - 0x4b], eax
mov dword [ebp - 0x47], eax
mov dword [ebp - 0x43], eax
mov word [ebp - 0x3f], ax
mov byte [ebp - 0x3d], al
shr ebx, 1
add ebx, ebx
movzx eax, byte [ebp + ebx - 0x64a8]
mov ecx, eax
and ecx, 0xf
mov dword [ebp - 0x64b8], ecx
test al, 0x10
je 0x90114d
mov dword [ebp - 0x64c4], 1
lea edx, [ebp - 0x64c0]
push edx
mov eax, dword [ebp - 0x64b8]
push eax
lea edi, [ebp - 0xb0]
call fcn.00900a20
mov dword [ebp - 0x64c0], eax
movzx esi, byte [ebp + ebx - 0x64a6]
shl esi, 8
movzx ecx, byte [ebp + ebx - 0x64a4]
add esi, ecx
mov edi, esi
shr edi, 1
add edi, edi
push edi
lea edx, [ebp + ebx - 0x64a2]
push edx
lea eax, [ebp - 0xe38]
push eax
call fcn.00a828e0
add esp, 0x14
xor ecx, ecx
mov word [ebp + edi - 0xe36], cx
push 0x3a
lea edx, [ebp - 0xe38]
push edx
call fcn.00a7c507
add esp, 8
mov edi, eax
test edi, edi
je 0x9011d7
lea eax, [edi + 2]
push eax
call fcn.00a7c675
add esp, 4
mov dword [ebp - 0x64ac], eax
xor ecx, ecx
mov word [edi], cx
mov ebx, dword [ebp - 0x64ac]
cmp ebx, 4
jbe 0x90120b
push 0
lea edx, [ebp - 0x4c]
push edx
lea eax, [ebp - 0x408]
push eax
push 0x208
lea ecx, [ebp - 0x1148]
push ecx
lea edx, [ebp - 0x1040]
push edx
push ebx
call fcn.009bb790
add esp, 0x1c
mov eax, dword [ebp - 0x64c8]
lea edi, [eax + esi + 6]
mov dword [ebp - 0x64c8], edi
lea ecx, [ebp - 0xe38]
lea edx, [ebp - 0x24a8]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x901227
lea ecx, [ebp - 0xe38]
push ecx
call fcn.00972170
lea ecx, [ebp - 0xe38]
call fcn.00981ab0
mov esi, dword [ebp - 0x64b8]
cmp esi, 4
jne 0x901511
mov eax, edi
shr eax, 1
add eax, eax
movzx esi, byte [ebp + eax - 0x64a8]
shl esi, 8
movzx edx, byte [ebp + eax - 0x64a6]
add esi, edx
mov ebx, esi
shr ebx, 1
add ebx, ebx
push ebx
lea eax, [ebp + eax - 0x64a4]
push eax
lea ecx, [ebp - 0xa28]
push ecx
call fcn.00a828e0
add esp, 0xc
xor edx, edx
mov word [ebp + ebx - 0xa26], dx
lea ecx, [ebp - 0xa28]
lea edx, [ebp - 0x2098]
lea ecx, [ecx]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x9012b0
lea eax, [ebp - 0xa28]
push eax
call fcn.00972170
lea ecx, [ebp - 0xa28]
call fcn.009774b0
cmp word [ebp - 0xa28], 0x55
jne 0x901319
cmp word [ebp - 0xa26], 0x4e
jne 0x901319
cmp word [ebp - 0xa24], 0x43
jne 0x901319
cmp word [ebp - 0xa22], 0x5c
jne 0x901319
push 0xabd360
push 0xadd1e0
lea ecx, [ebp - 0xa28]
push ecx
call fcn.0095e290
add esp, 0xc
lea edx, [edi + esi + 4]
mov dword [ebp - 0x64c8], edx
push 0
push 0
push 0
lea edx, [ebp - 0x1350]
xor ecx, ecx
call fcn.009873e0
add esp, 0xc
mov ebx, eax
test ebx, ebx
jne 0x9014d9
lea ecx, [ebp - 0xa28]
call fcn.00981ab0
mov edi, dword [ebp - 0x64c4]
lea ecx, [ebp - 0xe38]
test edi, edi
je 0x90137c
call fcn.00959ec0
mov esi, eax
neg esi
sbb esi, esi
inc esi
lea ecx, [ebp - 0xa28]
call fcn.00959ec0
neg eax
sbb eax, eax
inc eax
jmp 0x90139d
push 0
call fcn.0095a000
add esp, 4
mov esi, eax
lea eax, [ebp - 0x64bc]
push eax
lea ecx, [ebp - 0xa28]
call fcn.0095a000
add esp, 4
cmp esi, 1
jne 0x9013b6
test eax, eax
jne 0x9013b6
mov dword [ebp - 0x64f4], esi
call fcn.00987380
jmp 0x90167f
cmp dword [0xbd0664], 0
je 0x9014cf
mov byte [ebp - 0x3c], 0
xor ecx, ecx
mov dword [ebp - 0x3b], ecx
mov dword [ebp - 0x37], ecx
mov dword [ebp - 0x33], ecx
mov word [ebp - 0x2f], cx
mov byte [ebp - 0x2d], cl
mov byte [ebp - 0x2c], cl
mov dword [ebp - 0x2b], ecx
mov dword [ebp - 0x27], ecx
mov dword [ebp - 0x23], ecx
mov word [ebp - 0x1f], cx
mov byte [ebp - 0x1d], cl
cmp esi, 1
jne 0x90140e
mov ecx, dword [str.FILE_ABSENT]
mov dword [ebp - 0x3c], ecx
mov edx, dword [0xadd1ec]
mov dword [ebp - 0x38], edx
mov ecx, dword [0xadd1f0]
mov dword [ebp - 0x34], ecx
jmp 0x901432
mov edx, dword [str.FILE_PRESENT]
mov dword [ebp - 0x3c], edx
mov ecx, dword [0xadd1f8]
mov dword [ebp - 0x38], ecx
mov edx, dword [0xadd1fc]
mov dword [ebp - 0x34], edx
mov cl, byte [0xadd200]
mov byte [ebp - 0x30], cl
cmp eax, 1
jne 0x90144d
mov edx, dword [str.FILE_ABSENT]
mov dword [ebp - 0x2c], edx
mov eax, dword [0xadd1ec]
mov ecx, dword [0xadd1f0]
jmp 0x90146a
mov edx, dword [str.FILE_PRESENT]
mov dword [ebp - 0x2c], edx
mov eax, dword [0xadd1f8]
mov ecx, dword [0xadd1fc]
mov dl, byte [0xadd200]
mov byte [ebp - 0x20], dl
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
test edi, edi
je 0x9014a0
push str.DIR_
push str.FILE_
lea eax, [ebp - 0x3c]
push eax
call fcn.0095e130
add esp, 0xc
push str.DIR_
push str.FILE_
lea ecx, [ebp - 0x2c]
push ecx
call fcn.0095e130
add esp, 0xc
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 0xa28]
push eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0xe38]
push edx
mov eax, dword [ebp - 0x64ac]
push eax
push str._CHNG__NETWORK__PID:_u__File_Rename_Opn_Fails__OrigFN:__S____s___NewFN:__S____s_
push str.C:PROGRA2eScanLOGDirChng.log
call fcn.0096a780
add esp, 0x1c
call fcn.00987380
jmp 0x90167f
mov esi, dword [ebp - 0x64b0]
inc esi
xor edi, edi
je 0x9014f7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x4e20
jbe 0x90167f
lea ecx, [ebp - 0x1350]
push ecx
push ebx
push esi
mov edx, dword [ebp - 0x64ac]
push edx
push str._CHNG__NETWORK__PID:_u__Impersonation_Failed_A__WarnCount:_u__ret:__d__Emsg:__s
jmp 0x90166c
cmp esi, 1
je 0x9015c2
cmp esi, 8
je 0x9015c2
cmp esi, 2
jne 0x90167f
cmp word [ebp - 0x1c88], 0
je 0x90158d
lea eax, [ebp - 0xe38]
push eax
lea ecx, [ebp - 0x1c88]
push ecx
call fcn.00a97a87
add esp, 8
test eax, eax
jne 0x90158d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x64f8]
cmp eax, 0x3e8
ja 0x90158d
cmp dword [0xbd0664], 0
je 0x901586
lea edx, [ebp - 0x1c88]
push edx
push ebx
push str._CHNG__PID:_u__Delete_Operation_Repeated_for__S
push str.C:PROGRA2eScanLOGDirChng.log
call fcn.0096a780
add esp, 0x10
xor esi, esi
jmp 0x900fc0
lea ecx, [ebp - 0xe38]
lea edx, [ebp - 0x1c88]
lea esp, [esp]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x9015a0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x64f8], eax
jmp 0x90167f
push 0
push 0
push 0
lea edx, [ebp - 0x1350]
xor ecx, ecx
call fcn.009873e0
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x90163d
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x64bc]
push eax
lea ecx, [ebp - 0xe38]
call fcn.0095a000
add esp, 4
cmp dword [0xbd0664], edi
je 0x901636
mov ecx, dword [ebp - 0x64bc]
lea edx, [ebp - 0xe38]
mov eax, dword [ebp - 0x64ac]
push ecx
push edx
push eax
cmp esi, 8
jne 0x901624
push str._CHNG__NETWORK__PID:_u__File_FILE_ACTION_ADDED__FN:__S____u_
jmp 0x901629
push str._CHNG__NETWORK__PID:_u__File_FILE_ACTION_MODIFIED__FN:__S____u_
push str.C:PROGRA2eScanLOGDirChng.log
call fcn.0096a780
add esp, 0x14
call fcn.00987380
jmp 0x90167f
mov esi, dword [ebp - 0x64b0]
inc esi
xor ebx, ebx
je 0x901657
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x4e20
jbe 0x90167f
lea ecx, [ebp - 0x1350]
push ecx
push edi
push esi
mov edx, dword [ebp - 0x64ac]
push edx
push str._CHNG__NETWORK__PID:_u__Impersonation_Failed_B__WarnCount:_u__ret:__d__Emsg:__s
push str.C:PROGRA2eScanLOGDirChng.log
call fcn.0096a780
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, dword [ebp - 0x64b8]
cmp eax, 4
jne 0x90169b
cmp dword [ebp - 0x64f4], 1
jne 0x901ef7
cmp eax, eax
je 0x9016b0
cmp eax, 8
je 0x9016b0
dec eax
neg eax
sbb eax, eax
add eax, 3
mov dword [ebp - 0x64b8], eax
jmp 0x9016ba
mov dword [ebp - 0x64b8], 1
xor edi, edi
cmp dword [0xbd0664], edi
je 0x901765
cmp dword [ebp - 0x64c4], edi
je 0x9016e3
mov eax, dword [str.NETWORK_DIR]
mov ecx, dword [0xadd3c4]
mov edx, dword [0xadd3c8]
jmp 0x9016f4
mov eax, dword [str.NETWORK_FIL]
mov ecx, dword [0xadd3d0]
mov edx, dword [0xadd3d4]
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x6c], eax
mov ebx, dword [ebp - 0x64bc]
push ebx
lea eax, [ebp - 0xe38]
push eax
lea ecx, [ebp - 0x24a8]
push ecx
lea edx, [ebp - 0xb0]
push edx
mov esi, dword [ebp - 0x64ac]
push esi
lea eax, [ebp - 0x6c]
push eax
push str._CHNG___s__PID:_u__Event_Type:__s__OrigFN:__S___ModFN:__S___fSize_u_
push str.C:PROGRA2eScanLOGDirChng.log
call fcn.0096a780
add esp, 0x20
cmp word [ebp - 0xa28], di
je 0x90177c
push ebx
lea ecx, [ebp - 0xa28]
push ecx
lea edx, [ebp - 0x2098]
push edx
push esi
lea eax, [ebp - 0x6c]
push eax
push str._CHNG___s__PID:_u__Renamed_File::_OrigFN:__S___ModFN:__S___fSize_u_
push str.C:PROGRA2eScanLOGDirChng.log
call fcn.0096a780
add esp, 0x1c
cmp word [ebp - 0xa28], di
je 0x90177c
lea ecx, [ebp - 0xa28]
mov dword [ebp - 0x64b0], ecx
jmp 0x901788
lea edx, [ebp - 0xe38]
mov dword [ebp - 0x64b0], edx
push 0x5c
lea eax, [ebp - 0xe38]
push eax
call fcn.00a7c507
add esp, 8
cmp eax, edi
je 0x901ef7
push str._srvsvc
push eax
call fcn.00a97a87
add esp, 8
test eax, eax
je 0x901ef7
cmp dword [ebp - 0x64c4], edi
jne 0x901ef7
mov dword [ebp - 0x64dc], edi
cmp dword [ebp - 0x64b8], 2
jne 0x9017dd
mov dword [ebp - 0x64dc], edi
jmp 0x901ad5
lea edx, [ebp - 0xf0]
mov ecx, dword [ebp - 0x64b0]
call fcn.00a636c0
mov dword [ebp - 0x64cc], eax
cmp word [ebp - 0xf0], di
je 0x901a23
xor esi, esi
mov dword [ebp - 0x64e0], esi
test eax, eax
jne 0x90191f
push 0xb52378
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0xbd0ae4]
test eax, eax
je 0x9018d1
cmp byte [eax], 0
je 0x9018d1
mov byte [ebp - 0x618], 0
push 0x103
push esi
lea ecx, [ebp - 0x617]
push ecx
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0x64e4], esi
mov byte [ebp - 0x515], 0
lea edx, [ebp - 0xf0]
push edx
push 0xaa8a0c
push 0x103
lea eax, [ebp - 0x618]
push eax
call fcn.00a7c458
lea ecx, [ebp - 0x64e4]
push ecx
mov edx, dword [0xbd0ae4]
push edx
mov bl, 0x2c
lea edi, [ebp - 0x300]
call fcn.0095ae80
add esp, 0x18
cmp dword [ebp - 0x64e4], 0xffffffff
je 0x9018d1
lea eax, [ebp - 0x618]
lea ecx, [ebp - 0x300]
call fcn.0094c330
test eax, eax
jne 0x9018fc
cmp dword [0xbd0664], eax
je 0x9018c7
mov esi, 1
mov dword [ebp - 0x64e0], esi
mov dword [ebp - 0x64cc], 2
push 0xb52378
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x901a23
mov edx, dword [ebp - 0x64b0]
push edx
mov eax, dword [ebp - 0x64ac]
push eax
push str._CHNG__PID:_u__Force_Excluding__S
jmp 0x901a16
lea eax, [ebp - 0x64e4]
push eax
mov ecx, dword [0xbd0ae4]
push ecx
mov bl, 0x2c
lea edi, [ebp - 0x300]
call fcn.0095ae80
add esp, 8
jmp 0x901896
jbe 0x901a23
push 0xb52378
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0xbd0ae0]
test eax, eax
je 0x9019ef
cmp byte [eax], 0
je 0x9019ef
mov byte [ebp - 0x510], 0
push 0x103
push 0
lea ecx, [ebp - 0x50f]
push ecx
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0x64d8], 0
mov byte [ebp - 0x40d], 0
lea edx, [ebp - 0xf0]
push edx
push 0xaa8a0c
push 0x103
lea eax, [ebp - 0x510]
push eax
call fcn.00a7c458
lea ecx, [ebp - 0x64d8]
push ecx
mov edx, dword [0xbd0ae0]
push edx
mov bl, 0x2c
lea edi, [ebp - 0x300]
call fcn.0095ae80
add esp, 0x18
or esi, 0xffffffff
cmp dword [ebp - 0x64d8], esi
je 0x9019ef
lea eax, [ebp - 0x510]
lea ecx, [ebp - 0x300]
call fcn.0094c330
test eax, eax
jne 0x901a6d
cmp dword [0xbd0664], eax
je 0x9019e5
mov dword [ebp - 0x64e0], 1
mov dword [ebp - 0x64cc], 0
push 0xb52378
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x64e0], 0
je 0x901a23
mov edx, dword [ebp - 0x64b0]
push edx
mov eax, dword [ebp - 0x64ac]
push eax
push str._CHNG__PID:_u__Force_Including__S
push str.C:PROGRA2eScanLOGDirChng.log
call fcn.0096a780
add esp, 0x10
mov eax, dword [ebp - 0x64cc]
test eax, eax
jne 0x901a39
cmp dword [ebp - 0x64bc], eax
jne 0x901ac8
mov ecx, 1
mov dword [ebp - 0x64dc], ecx
cmp eax, 2
jb 0x901a90
cmp dword [0xbd0664], ecx
jb 0x901ac8
mov ecx, dword [ebp - 0x64b0]
push ecx
lea edx, [ebp - 0xb0]
push edx
mov eax, dword [ebp - 0x64ac]
push eax
push str._CHNG__NETWORK__PID:_u_ReadCh:__s___S____IGNORED_EXTN
jmp 0x901abb
lea eax, [ebp - 0x64d8]
push eax
mov ecx, dword [0xbd0ae0]
push ecx
mov bl, 0x2c
lea edi, [ebp - 0x300]
call fcn.0095ae80
add esp, 8
jmp 0x9019b2
cmp dword [ebp - 0x64bc], 0
jne 0x901ac8
cmp dword [0xbd0664], ecx
jb 0x901ac8
mov ecx, dword [ebp - 0x64b0]
push ecx
lea edx, [ebp - 0xb0]
push edx
mov eax, dword [ebp - 0x64ac]
push eax
push str._CHNG__NETWORK__PID:_u_ReadCh:__s___S____IGNORED_ZERO_BYTES
push str.C:PROGRA2eScanLOGDirChng.log
call fcn.0096a780
add esp, 0x14
cmp dword [ebp - 0x64dc], 0
jne 0x901ef7
xor esi, esi
mov dword [ebp - 0x64b4], esi
mov dword [ebp - 0x64e8], esi
mov dword [ebp - 0x64f0], 1
mov edi, dword [ebp - 0x64b0]
push edi
lea ebx, [ebp - 0x64b4]
call fcn.00970520
add esp, 4
mov ebx, dword [ebp - 0x64b4]
test ebx, ebx
je 0x901b33
cmp byte [ebx], 0
je 0x901b33
push 0x5c
push ebx
call fcn.00a7aa50
add esp, 8
mov esi, eax
mov dword [ebp - 0x64e8], esi
test esi, esi
je 0x901b2b
inc esi
jmp 0x901b2d
mov esi, ebx
mov dword [ebp - 0x64e8], esi
test ebx, ebx
je 0x901eb6
cmp byte [ebx], 0
je 0x901eb6
cmp dword [ebp - 0x64c4], 0
jne 0x901eb6
cmp byte [esi], 0x7e
je 0x901eb6
mov eax, dword [0xbd0aec]
test eax, eax
je 0x901b9b
cmp byte [eax], 0
je 0x901b9b
push ebx
call fcn.00a63b20
add esp, 4
test eax, eax
je 0x901b9b
cmp dword [0xbd0664], 1
jb 0x901ee0
push edi
lea ecx, [ebp - 0xb0]
push ecx
mov edx, dword [ebp - 0x64ac]
push edx
push str._CHNG__NETWORK__PID:_u_ReadCh:__s___S____IGNORED_PATHFN_A
jmp 0x901ed3
push str.DRIVE_NETWORK
lea eax, [ebp - 0x6c]
push eax
call fcn.00a78f30
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0xbe432c], eax
mov esi, dword [ebp - 0x64b8]
cmp esi, 1
je 0x901bd0
cmp esi, 3
je 0x901bd0
cmp esi, 2
jne 0x901dc8
mov byte [ebp - 0x300], 0
push 0x103
push 0
lea ecx, [ebp - 0x2ff]
push ecx
call fcn.00a7ffb0
add esp, 0xc
cmp esi, 2
jne 0x901c7a
lea edx, [ebp - 0x4c]
push edx
lea eax, [ebp - 0x408]
push eax
lea ecx, [ebp - 0x1040]
push ecx
mov edx, dword [ebp - 0x64ac]
push edx
push 0
push 0
push 0
lea eax, [ebp - 0xb0]
push eax
mov ecx, dword [ebp - 0x64c0]
push ecx
push esi
lea edx, [ebp - 0x300]
push edx
push 1
push edi
call fcn.009bd750
add esp, 0x34
mov ebx, eax
cmp dword [0xbd0664], 1
jne 0x901c5c
push ebx
push edi
mov eax, dword [ebp - 0x64ac]
push eax
push str._CHNG__NETWORK__DEL_UPD__PID:_u__FN:__S___rvx_u_
push str.C:PROGRA2eScanLOGDirChng.log
call fcn.0096a780
add esp, 0x14
cmp ebx, 1
jne 0x901dc8
mov dword [ebp - 0x64f0], 0
mov ebx, dword [ebp - 0x64b4]
jmp 0x901ee0
mov byte [ebp - 0x1770], 0
push 0x103
push 0
lea ecx, [ebp - 0x176f]
push ecx
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0x1560], 0
push 0x103
push 0
lea edx, [ebp - 0x155f]
push edx
call fcn.00a7ffb0
add esp, 0xc
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x408]
push ecx
lea edx, [ebp - 0x1040]
push edx
mov eax, dword [ebp - 0x64ac]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0xb0]
push ecx
mov edx, dword [ebp - 0x64c0]
push edx
push esi
lea eax, [ebp - 0x300]
push eax
push 0
push edi
call fcn.009bd750
add esp, 0x34
mov ebx, eax
cmp dword [0xbd0664], 1
jne 0x901d1a
push ebx
push edi
mov ecx, dword [ebp - 0x64ac]
push ecx
push str._CHNG__NETWORK__MOD_UPD__PID:_u__FN:__S___rvx_u_
push str.C:PROGRA2eScanLOGDirChng.log
call fcn.0096a780
add esp, 0x14
test ebx, ebx
jne 0x901db3
mov dword [ebp - 0x650c], 1
cmp esi, 3
jne 0x901d63
lea esi, [ebp - 0xf0]
call fcn.00900bb0
test eax, eax
je 0x901d57
mov dword [ebp - 0x650c], ebx
mov dword [ebp - 0x64f0], ebx
mov ebx, dword [ebp - 0x64b4]
jmp 0x901ee0
mov edi, dword [ebp - 0x64b0]
mov esi, dword [ebp - 0x64b8]
push 0
lea edx, [ebp - 0x4c]
push edx
lea eax, [ebp - 0x408]
push eax
lea ecx, [ebp - 0x1040]
push ecx
mov edx, dword [ebp - 0x64ac]
push edx
push 0
push 0
mov eax, dword [ebp - 0x64c0]
push eax
lea ecx, [ebp - 0xb0]
push ecx
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x1560]
push eax
lea ecx, [ebp - 0x1770]
push ecx
push esi
lea edx, [ebp - 0x300]
mov ecx, edi
call fcn.009bd050
add esp, 0x34
mov dword [ebp - 0x64f0], 0
mov ebx, dword [ebp - 0x64b4]
jmp 0x901ee0
mov byte [ebp - 0x1878], 0
push 0x103
push 0
lea edx, [ebp - 0x1877]
push edx
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0x1458], 0
push 0x103
push 0
lea eax, [ebp - 0x1457]
push eax
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0x1668], 0
push 0x103
push 0
lea ecx, [ebp - 0x1667]
push ecx
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0x6510], 1
cmp esi, 3
jne 0x901e5e
lea esi, [ebp - 0xf0]
call fcn.00900bb0
test eax, eax
je 0x901e52
mov dword [ebp - 0x6510], 0
mov ebx, dword [ebp - 0x64b4]
jmp 0x901ee0
mov edi, dword [ebp - 0x64b0]
mov esi, dword [ebp - 0x64b8]
push 0
lea edx, [ebp - 0x4c]
push edx
lea eax, [ebp - 0x408]
push eax
lea ecx, [ebp - 0x1040]
push ecx
mov edx, dword [ebp - 0x64ac]
push edx
push 0
push 0
mov eax, dword [ebp - 0x64c0]
push eax
lea ecx, [ebp - 0xb0]
push ecx
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x1458]
push eax
lea ecx, [ebp - 0x1878]
push ecx
push esi
lea edx, [ebp - 0x1668]
mov ecx, edi
call fcn.009bd050
add esp, 0x34
mov ebx, dword [ebp - 0x64b4]
jmp 0x901ee0
cmp dword [0xbd0664], 1
jb 0x901ee0
push edi
lea edx, [ebp - 0xb0]
push edx
mov eax, dword [ebp - 0x64ac]
push eax
push str._CHNG__NETWORK__PID:_u_ReadCh:__s___S____IGNORED_PATHFN
push str.C:PROGRA2eScanLOGDirChng.log
call fcn.0096a780
add esp, 0x14
test ebx, ebx
je 0x901ef7
push ebx
call fcn.00a78fec
add esp, 4
mov dword [ebp - 0x64b4], 0
xor esi, esi
jmp 0x900fc0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenEvent___failed__Error:__u
lea ecx, [ebp - 0x1f8]
push ecx
call fcn.00a78f30
add esp, 0xc
lea edx, [ebp - 0x1f8]
push edx
push str._DCH__NETWORK___s
push str.C:PROGRA2eScanLOGDirChng.log
call fcn.0096a780
add esp, 0xc
jmp 0x901f70
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.MyCreateEvent___failed__Error:__u
lea eax, [ebp - 0x1f8]
push eax
call fcn.00a78f30
add esp, 0xc
lea ecx, [ebp - 0x1f8]
push ecx
jmp 0x901f20
mov dword [ebp - 4], 0xfffffffe
lea edx, [ebp - 0x6500]
push edx
call fcn.00985290
push 0xbd0520
call fcn.00985290
lea eax, [ebp - 0x64d0]
push eax
call fcn.00985290
lea ecx, [ebp - 0x64d4]
push ecx
call fcn.00985290
mov eax, dword [ebp - 0x64fc]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret