Function at 0x465ee0
Capabilities:
Create thread
Get file attributes
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x6707f0
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x4084
call fcn.005e00d0
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x4024], ebx
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x401c], esi
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3fe4], eax
mov dword [ebp - 0x3fc8], 1
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x4080], edi
mov dword [ebp - 0x3fe0], 0xffffffff
mov dword [ebp - 0x406c], edi
mov dword [ebp - 0x4064], edi
xor eax, eax
mov dword [ebp - 0x4060], eax
mov dword [ebp - 0x405c], eax
mov dword [ebp - 0x4058], eax
mov dword [ebp - 0x4054], eax
mov dword [ebp - 0x4030], edi
mov byte [ebp - 0x394], al
push 0x103
push edi
lea ecx, [ebp - 0x393]
push ecx
call fcn.005dfd60
mov byte [ebp - 0xfc4], 0
push 0x103
push edi
lea edx, [ebp - 0xfc3]
push edx
call fcn.005dfd60
mov byte [ebp - 0xec0], 0
push 0x103
push edi
lea eax, [ebp - 0xebf]
push eax
call fcn.005dfd60
add esp, 0x24
mov dword [ebp - 0x4048], edi
cmp dword [ebp - 0x3fe4], edi
je 0x465fea
mov ecx, dword [ebp - 0x3fe4]
mov byte [ecx], 0
push 0xabcd
lea edx, [ebp - 0xec0]
push edx
push ebx
call fcn.004f24a0
add esp, 0xc
mov dword [ebp - 0x3fc8], 2
push edi
push 1
lea eax, [ebp - 0xec0]
push eax
push edi
push 1
push edi
call fcn.00507af0
mov dword [ebp - 0x4054], eax
cmp eax, edi
jne 0x46605f
push 0x104
lea ecx, [ebp - 0x394]
push ecx
call fcn.004d8c20
add esp, 8
mov eax, dword [ebp - 0x3fe4]
cmp eax, edi
je 0x4673de
lea edx, [ebp - 0x394]
push edx
push str.Error_Creating_Event__Reason:__s
push eax
call fcn.005dfb23
jmp 0x4673db
mov dword [ebp - 0x3fc8], 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4660a4
cmp dword [0x72bcb8], 1
jne 0x466093
push ebx
push esi
push str._DCH__MONITOR__Already_Monitoring__s___s_
push 0x6b1620
call fcn.004f0f30
add esp, 0x10
lea eax, [ebp - 0x4054]
push eax
call fcn.004dca10
jmp 0x4673de
mov al, byte [0x6b08d8]
mov cl, al
sub cl, 0x61
cmp cl, 0x19
movsx ecx, al
ja 0x4660b9
sub ecx, 0x20
mov al, byte [ebx]
cmp al, 0x61
jl 0x4660cb
cmp al, 0x7a
jg 0x4660cb
movsx eax, al
sub eax, 0x20
jmp 0x4660ce
movsx eax, al
mov esi, 1
cmp ecx, eax
jne 0x4660dd
mov dword [ebp - 0x4048], esi
mov dword [ebp - 0x3fc8], 5
push 0x6af8c8
push 0x104
lea edx, [ebp - 0xfc4]
push edx
push str.No_Action
push 0x61d148
push str.Prompt
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push edi
push 0x42000000
push 3
push edi
push 7
push esi
push ebx
call fcn.004e0400
add esp, 0x1c
mov dword [ebp - 0x3fe0], eax
cmp eax, 0xffffffff
jne 0x466172
push 0x104
lea eax, [ebp - 0x394]
push eax
call fcn.004d8c20
add esp, 8
mov eax, dword [ebp - 0x3fe4]
cmp eax, edi
je 0x466161
lea ecx, [ebp - 0x394]
push ecx
push ebx
push str.Error_in_MyCreateFileA_of__s__Reason:__s
push eax
call fcn.005dfb23
add esp, 0x10
lea edx, [ebp - 0x4054]
push edx
call fcn.004dca10
jmp 0x4673de
cmp dword [ebp + 0x14], esi
jne 0x4661cb
mov dword [ebp - 0x3fc8], 6
lea ecx, [ebp - 0x4080]
push ecx
mov edx, dword [0x752b1c]
push edx
push eax
call fcn.0052d510
add esp, 0xc
test eax, eax
jne 0x4661b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str._RDI__RegisterForDeviceHandle___s__failed__Err:__u
push edi
call fcn.004f0f30
add esp, 0x10
jmp 0x4661cb
cmp dword [0x72bcb8], esi
jb 0x4661cb
push ebx
push str._RDI__RegisterForDeviceHandle___s__Success_
push edi
call fcn.004f0f30
add esp, 0xc
mov dword [ebp - 0x3fc8], 7
push 0x4000
call fcn.004d9470
add esp, 4
mov esi, eax
mov dword [ebp - 0x400c], esi
cmp esi, edi
jne 0x46620b
lea eax, [ebp - 0x4054]
push eax
call fcn.004dca10
lea ecx, [ebp - 0x3fe0]
push ecx
call fcn.004dca10
jmp 0x4673de
mov dword [ebp - 0x403c], edi
mov dword [ebp - 0x4044], edi
mov dword [ebp - 0x4038], edi
mov dword [ebp - 0x404c], edi
mov dword [ebp - 0x402c], edi
lea edx, [ebp - 0x403c]
push edx
push str.LogFilesCopiedWatchDirChange
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
lea eax, [ebp - 0x4044]
push eax
push str.LogFilesCopiedWatchAttribChange
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
lea ecx, [ebp - 0x4038]
push ecx
push str.LogFilesCopiedWatchSizeChange
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
lea edx, [ebp - 0x404c]
push edx
push str.LogFilesCopiedWatchLastAccessChange
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
lea eax, [ebp - 0x402c]
push eax
push str.LogFilesCopiedWatchLastSecurityChange
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
mov dword [ebp - 0x3fd0], 0x51
cmp dword [ebp - 0x403c], edi
je 0x4662cc
mov dword [ebp - 0x3fd0], 0x53
cmp dword [ebp - 0x4044], edi
je 0x4662db
or dword [ebp - 0x3fd0], 4
cmp dword [ebp - 0x4038], edi
je 0x4662ea
or dword [ebp - 0x3fd0], 8
cmp dword [ebp - 0x404c], edi
je 0x4662f9
or dword [ebp - 0x3fd0], 0x20
cmp dword [ebp - 0x402c], edi
je 0x46630b
or dword [ebp - 0x3fd0], 0x100
mov dword [ebp - 0x3fc8], 8
mov eax, dword [ebp - 0x3fe0]
jmp 0x466320
mov dword [ebp - 0x3fc8], 9
push edi
lea ecx, [ebp - 0x4064]
push ecx
lea edx, [ebp - 0x406c]
push edx
mov ecx, dword [ebp - 0x3fd0]
push ecx
push 1
push 0x4000
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
cmp eax, edi
je 0x4672b4
mov eax, dword [0x7330e4]
push 0x927c0
cmp eax, edi
jne 0x466376
mov edx, dword [ebp - 0x4054]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
jmp 0x4663b0
mov ecx, dword [ebp - 0x4054]
mov dword [ebp - 0x409c], ecx
mov dword [ebp - 0x4098], eax
push edi
lea edx, [ebp - 0x409c]
push edx
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov esi, eax
cmp esi, 1
jne 0x4663b0
mov esi, 0x102
mov eax, dword [0x7330e4]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [ebp - 0x3fc8], 0xa
cmp esi, edi
jne 0x4671f5
mov esi, dword [ebp - 0x400c]
mov dword [ebp - 0x4004], esi
mov edi, edi
xor ecx, ecx
mov word [ebp - 0x2fc4], cx
push 0x1ffe
push edi
lea edx, [ebp - 0x2fc2]
push edx
call fcn.005dfd60
xor eax, eax
mov word [ebp - 0x88], ax
push 0x3e
push edi
lea ecx, [ebp - 0x86]
push ecx
call fcn.005dfd60
mov dword [ebp - 0x3fd4], edi
mov byte [ebp - 0x18c], 0
push 0x103
push edi
lea edx, [ebp - 0x18b]
push edx
call fcn.005dfd60
mov dword [ebp - 0x4028], 0xffffffff
mov dword [ebp - 0x3ff8], edi
mov dword [ebp - 0x4008], edi
mov dword [ebp - 0x4000], edi
mov dword [ebp - 0x3fe8], edi
mov dword [ebp - 0x3fd8], edi
mov dword [ebp - 0x3fc8], 0xb
push ebx
call fcn.004dd6c0
add esp, 0x28
mov ecx, dword [esi + 8]
lea edx, [ebp - 0x2fc4]
shr ecx, 1
cmp byte [eax + ebx - 1], 0x5c
lea eax, [esi + 0xc]
push eax
push ecx
push ebx
jne 0x46647c
push str._S_.s
jmp 0x466481
push 0x62dcec
push 0xfff
push edx
call fcn.005e3c29
add esp, 0x18
mov dword [ebp - 0x3fc8], 0xd
mov ebx, dword [esi + 4]
mov dword [ebp - 0x3fec], ebx
mov eax, dword [0x740474]
push eax
push 0x740370
lea ecx, [ebp - 0x3fe8]
push ecx
lea edx, [ebp - 0x18c]
push edx
push ebx
call fcn.00440480
add esp, 0x14
mov dword [ebp - 0x3ffc], eax
mov dword [ebp - 0x3fc8], 0xe
cmp dword [ebp - 0x3fe8], edi
je 0x4664e7
mov ebx, 1
mov dword [ebp - 0x3fec], ebx
mov dword [ebp - 0x3fc8], 0xf
mov eax, dword [0x72d014]
push eax
mov ecx, dword [0x6861e8]
push ecx
lea edx, [ebp - 0x88]
push edx
lea eax, [ebp - 0x2fc4]
push eax
call fcn.005d8b80
add esp, 0x10
mov edi, eax
mov dword [ebp - 0x4040], edi
cmp word [ebp - 0x88], 0
je 0x46674a
xor esi, esi
mov dword [ebp - 0x4034], esi
test edi, edi
jne 0x46664d
push 0x6e8bc0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x72c234]
test eax, eax
je 0x466601
cmp byte [eax], 0
je 0x466601
mov byte [ebp - 0x7a4], 0
push 0x103
push esi
lea ecx, [ebp - 0x7a3]
push ecx
call fcn.005dfd60
mov dword [ebp - 0x4018], esi
mov byte [ebp - 0x6a1], 0
lea edx, [ebp - 0x88]
push edx
push 0x610bcc
push 0x103
lea eax, [ebp - 0x7a4]
push eax
call fcn.005e3b7a
push 1
push esi
push 0x2c
lea ecx, [ebp - 0x4018]
push ecx
lea edx, [ebp - 0x290]
push edx
mov eax, dword [0x72c234]
push eax
call fcn.004e1380
add esp, 0x34
nop
cmp dword [ebp - 0x4018], 0xffffffff
je 0x466601
lea ecx, [ebp - 0x7a4]
push ecx
lea edx, [ebp - 0x290]
push edx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x466625
cmp dword [0x72bcb8], eax
je 0x4665f6
mov esi, 1
mov dword [ebp - 0x4034], esi
mov edi, 2
mov dword [ebp - 0x4040], edi
push 0x6e8bc0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x46674a
lea eax, [ebp - 0x2fc4]
push eax
push str._DCH__Force_Excluding__S
jmp 0x46673d
push 1
push 0
push 0x2c
lea eax, [ebp - 0x4018]
push eax
lea ecx, [ebp - 0x290]
push ecx
mov edx, dword [0x72c234]
push edx
call fcn.004e1380
add esp, 0x18
jmp 0x4665c0
jbe 0x46674a
push 0x6e8bc0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x72c230]
test eax, eax
je 0x466722
cmp byte [eax], 0
je 0x466722
mov byte [ebp - 0x8a8], 0
push 0x103
push 0
lea ecx, [ebp - 0x8a7]
push ecx
call fcn.005dfd60
mov dword [ebp - 0x4014], 0
mov byte [ebp - 0x7a5], 0
lea edx, [ebp - 0x88]
push edx
push 0x610bcc
push 0x103
lea eax, [ebp - 0x8a8]
push eax
call fcn.005e3b7a
push 1
push 0
push 0x2c
lea ecx, [ebp - 0x4014]
push ecx
lea edx, [ebp - 0x290]
push edx
mov eax, dword [0x72c230]
push eax
call fcn.004e1380
add esp, 0x34
mov edi, edi
cmp dword [ebp - 0x4014], 0xffffffff
je 0x466722
lea ecx, [ebp - 0x8a8]
push ecx
lea edx, [ebp - 0x290]
push edx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x466796
cmp dword [0x72bcb8], eax
je 0x46671a
mov esi, 1
mov dword [ebp - 0x4034], esi
xor edi, edi
mov dword [ebp - 0x4040], edi
push 0x6e8bc0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x46674a
lea eax, [ebp - 0x2fc4]
push eax
push str._DCH__Force_Including__S
push 0x6b1620
call fcn.004f0f30
add esp, 0xc
test edi, edi
je 0x4667e3
cmp edi, 2
jb 0x4671bb
cmp dword [0x72bcb8], 1
jb 0x4671bb
cmp dword [ebp - 0x3fe8], 0
je 0x4667be
lea ecx, [ebp - 0x2fc4]
push ecx
lea edx, [ebp - 0x18c]
push edx
push str._DCH_ReadCh:__s______S____IGNORED_EXTN
push 0x6b1620
call fcn.004f0f30
add esp, 0x10
jmp 0x4671bb
push 1
push 0
push 0x2c
lea eax, [ebp - 0x4014]
push eax
lea ecx, [ebp - 0x290]
push ecx
mov edx, dword [0x72c230]
push edx
call fcn.004e1380
add esp, 0x18
jmp 0x4666e0
lea eax, [ebp - 0x2fc4]
push eax
lea ecx, [ebp - 0x18c]
push ecx
push str._DCH_ReadCh:__s___S____IGNORED_EXTN
push 0x6b1620
call fcn.004f0f30
add esp, 0x10
jmp 0x4671bb
mov dword [ebp - 0x3fc8], 0x10
lea edx, [ebp - 0x3fd4]
push edx
lea eax, [ebp - 0x2fc4]
push eax
call fcn.004da960
add esp, 8
cmp ebx, 2
je 0x466822
cmp ebx, 4
je 0x466822
lea ecx, [ebp - 0x2fc4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x4028], eax
jmp 0x466828
mov eax, dword [ebp - 0x4028]
cmp eax, 0xffffffff
je 0x46683b
test al, 0x10
je 0x46683b
mov dword [ebp - 0x3ff8], 1
mov eax, dword [ebp - 0x3fd4]
xor edi, edi
cmp eax, edi
je 0x46687c
cmp byte [eax], 0
je 0x46687c
push 0x5c
push eax
call fcn.005e0a00
add esp, 8
mov esi, eax
mov dword [ebp - 0x4008], esi
mov eax, dword [ebp - 0x3fd4]
cmp esi, edi
je 0x466872
inc esi
mov dword [ebp - 0x4008], esi
jmp 0x466882
mov esi, eax
mov dword [ebp - 0x4008], esi
jmp 0x466882
mov esi, dword [ebp - 0x4008]
mov dword [ebp - 0x3fc8], 0x11
cmp ebx, 1
je 0x46689b
cmp ebx, 3
je 0x46689b
cmp ebx, 2
jne 0x4668e1
cmp dword [0x72bcb8], 1
jb 0x4668d7
cmp ebx, 1
je 0x4668ae
cmp ebx, 3
jne 0x4668d7
mov dword [ebp - 0x4070], edi
lea edx, [ebp - 0x4070]
push edx
lea eax, [ebp - 0x3fd8]
push eax
lea ecx, [ebp - 0x2fc4]
push ecx
call fcn.0043ff70
add esp, 0xc
mov eax, dword [ebp - 0x3fd4]
mov dword [ebp - 0x4000], 1
mov dword [ebp - 0x3fc8], 0x12
push 0x6b07d0
push 0x6af6c0
push 0x6af4b8
mov edx, dword [ebp - 0x4000]
push edx
mov ecx, dword [ebp - 0x3ff8]
push ecx
push esi
push eax
call fcn.005d2770
add esp, 0x1c
test eax, eax
je 0x466996
cmp dword [0x72bcb8], 1
jb 0x46719e
cmp dword [ebp - 0x3fe8], 0
je 0x466963
mov edx, dword [ebp - 0x4000]
push edx
mov eax, dword [ebp - 0x3ff8]
push eax
lea ecx, [ebp - 0x2fc4]
push ecx
lea edx, [ebp - 0x18c]
push edx
push str._DCH_ReadCh:__s______S____IGNORED_PATHFN__Dir:_u__LA:_u_
push 0x6b1620
call fcn.004f0f30
add esp, 0x18
jmp 0x46719e
mov eax, dword [ebp - 0x4000]
push eax
mov ecx, dword [ebp - 0x3ff8]
push ecx
lea edx, [ebp - 0x2fc4]
push edx
lea eax, [ebp - 0x18c]
push eax
push str._DCH_ReadCh:__s___S____IGNORED_PATHFN__Dir:_u__LA:_u_
push 0x6b1620
call fcn.004f0f30
add esp, 0x18
jmp 0x46719e
mov dword [ebp - 0x3fdc], edi
mov byte [ebp - 0x3fc9], 0
mov dword [ebp - 0x4050], edi
mov dword [ebp - 0x4020], edi
mov dword [ebp - 0x3fc8], 0x13
mov ecx, dword [ebp - 0x3fd4]
cmp byte [ecx], 0x5c
jne 0x4669f8
cmp byte [ecx + 1], 0x5c
jne 0x4669f8
push str.DRIVE_NETWORK
lea ecx, [ebp - 0x48]
push ecx
call fcn.005dfb23
add esp, 8
test byte [0x6e91c4], 4
je 0x466bac
mov edi, 1
mov dword [ebp - 0x3fdc], edi
jmp 0x466bb0
mov byte [ebp - 0x28], 0
xor eax, eax
mov dword [ebp - 0x27], eax
mov dword [ebp - 0x23], eax
mov byte [ebp - 0x1f], al
mov bl, byte [ecx]
movsx edx, bl
push edx
push 0x61fff0
lea eax, [ebp - 0x28]
push eax
call fcn.005dfb23
add esp, 0xc
lea ecx, [ebp - 0x28]
push ecx
call fcn.004e9b10
mov esi, eax
lea edx, [ebp - 0x48]
push edx
push esi
call fcn.0045d720
add esp, 8
mov al, byte [0x6e91c4]
test al, 1
je 0x466a60
cmp esi, 2
je 0x466a49
cmp esi, 5
jne 0x466a60
mov byte [ebp - 0x3fc9], bl
mov edi, 1
mov dword [ebp - 0x3fdc], edi
mov dword [ebp - 0x4050], edi
test al, 2
je 0x466a74
cmp esi, 3
jne 0x466a74
mov edi, 1
mov dword [ebp - 0x3fdc], edi
test al, 4
je 0x466a85
mov edi, 1
mov dword [ebp - 0x3fdc], edi
jmp 0x466a8d
test edi, edi
je 0x466b36
cmp dword [0x6861e4], 1
jne 0x466bac
cmp dword [ebp - 0x4048], 0
je 0x466bac
xor esi, esi
mov dword [ebp - 0x407c], esi
push 0x6e8bc0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x72c238]
test eax, eax
je 0x466b1f
cmp byte [eax], 0
je 0x466b1f
mov dword [ebp - 0x4010], esi
push 1
push esi
push 0x2c
lea ecx, [ebp - 0x4010]
push ecx
lea edx, [ebp - 0x6a0]
push edx
push eax
call fcn.004e1380
add esp, 0x18
or ebx, 0xffffffff
lea ecx, [ecx]
cmp dword [ebp - 0x4010], ebx
je 0x466b1f
push 0
lea eax, [ebp - 0x6a0]
push eax
mov ecx, dword [ebp - 0x3fd4]
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, ebx
je 0x466b84
mov esi, 1
mov dword [ebp - 0x407c], esi
push 0x6e8bc0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
jne 0x466bac
xor edi, edi
mov dword [ebp - 0x3fdc], edi
mov ebx, dword [ebp - 0x3fec]
mov dword [ebp - 0x3fc8], 0x14
cmp dword [0x72bcb8], 1
jb 0x466c3a
cmp dword [ebp - 0x3fe8], 0
je 0x466c0e
mov edx, dword [ebp - 0x3fd8]
push edx
lea eax, [ebp - 0x48]
push eax
push edi
lea ecx, [ebp - 0x2fc4]
push ecx
lea edx, [ebp - 0x18c]
push edx
push str._DCH_ReadCh:__s______S____LOGIT_u___s__fSize:_u_
jmp 0x466c2d
push 1
push 0
push 0x2c
lea edx, [ebp - 0x4010]
push edx
lea eax, [ebp - 0x6a0]
push eax
mov ecx, dword [0x72c238]
push ecx
call fcn.004e1380
add esp, 0x18
jmp 0x466af0
test edi, edi
je 0x466b36
mov ebx, dword [ebp - 0x3fec]
cmp ebx, 1
je 0x466bc4
cmp ebx, 3
jne 0x466b3c
mov dword [ebp - 0x4084], 0
lea edx, [ebp - 0x4084]
push edx
lea eax, [ebp - 0x3fd8]
push eax
lea ecx, [ebp - 0x2fc4]
push ecx
call fcn.0043ff70
add esp, 0xc
test eax, eax
jne 0x466b3c
cmp dword [ebp - 0x3fd8], eax
jne 0x466b3c
mov dword [ebp - 0x4020], 1
jmp 0x466b3c
mov eax, dword [ebp - 0x3fd8]
push eax
lea ecx, [ebp - 0x48]
push ecx
push edi
lea edx, [ebp - 0x2fc4]
push edx
lea eax, [ebp - 0x18c]
push eax
push str._DCH_ReadCh:__s___S____LOGIT_u___s__fSize:_u_
push 0x6b1620
call fcn.004f0f30
add esp, 0x1c
test edi, edi
je 0x466c49
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x73320c], eax
mov dword [ebp - 0x3fc8], 0x16
test edi, edi
je 0x466fee
cmp ebx, 1
je 0x466c6e
cmp ebx, 3
je 0x466c6e
cmp ebx, 2
jne 0x466fee
mov byte [ebp - 0x498], 0
push 0x103
push 0
lea ecx, [ebp - 0x497]
push ecx
call fcn.005dfd60
add esp, 0xc
cmp ebx, 2
jne 0x466cfc
mov edx, dword [ebp - 0x3fd8]
push edx
mov eax, dword [0x740474]
push eax
push 0x740370
lea ecx, [ebp - 0x18c]
push ecx
mov edx, dword [ebp - 0x3ffc]
push edx
push ebx
lea eax, [ebp - 0x498]
push eax
push 1
lea ecx, [ebp - 0x2fc4]
push ecx
call fcn.00542c20
add esp, 0x24
mov esi, eax
cmp dword [0x72bcb8], 1
jne 0x466cee
push esi
lea edx, [ebp - 0x2fc4]
push edx
push str._DCH__DEL_UPD__FN:_S__rvx_u_
push 0x6b1620
call fcn.004f0f30
add esp, 0x10
cmp esi, 1
jne 0x466fee
jmp 0x466fe6
mov byte [ebp - 0xcb8], 0
push 0x103
push 0
lea eax, [ebp - 0xcb7]
push eax
call fcn.005dfd60
mov byte [ebp - 0x9ac], 0
push 0x103
push 0
lea ecx, [ebp - 0x9ab]
push ecx
call fcn.005dfd60
mov byte [ebp - 0xdbc], 0
push 0x103
push 0
lea edx, [ebp - 0xdbb]
push edx
call fcn.005dfd60
add esp, 0x24
mov eax, 0x104
mov dword [ebp - 0x408c], eax
mov dword [ebp - 0x4094], eax
mov dword [ebp - 0x3ff0], 0
mov dword [ebp - 0x3fc8], 0x17
mov al, byte [ebp - 0x3fc9]
test al, al
je 0x466e09
movsx eax, al
push eax
push str.SoftwareMicroWorldDeviceControlUSBDevices_c
lea ecx, [ebp - 0xdbc]
push ecx
call fcn.005dfb23
lea edx, [ebp - 0x3ff0]
push edx
push 1
push 0
lea eax, [ebp - 0xdbc]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004dc0a0
add esp, 0x20
test eax, eax
jne 0x466e09
lea ecx, [ebp - 0x408c]
push ecx
lea edx, [ebp - 0xcb8]
push edx
push eax
push eax
push str.SerialNo
mov eax, dword [ebp - 0x3ff0]
push eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call esi
lea ecx, [ebp - 0x4094]
push ecx
lea edx, [ebp - 0x9ac]
push edx
push 0
push 0
push str.FriendlyName
mov eax, dword [ebp - 0x3ff0]
push eax
call esi
mov ecx, dword [ebp - 0x3ff0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x3fc8], 0x18
mov edi, dword [ebp - 0x3fd8]
push edi
mov edx, dword [0x740474]
push edx
push 0x740370
lea eax, [ebp - 0x18c]
push eax
mov ecx, dword [ebp - 0x3ffc]
push ecx
push ebx
lea edx, [ebp - 0x498]
push edx
push 0
lea eax, [ebp - 0x2fc4]
push eax
call fcn.00542c20
add esp, 0x24
mov esi, eax
cmp dword [0x72bcb8], 1
jne 0x466e72
push esi
lea ecx, [ebp - 0x2fc4]
push ecx
push str._DCH__MOD_UPD__FN:_S__rvx_u_
push 0x6b1620
call fcn.004f0f30
add esp, 0x10
test esi, esi
jne 0x466ef4
mov dword [ebp - 0x4078], 1
mov dword [ebp - 0x3fc8], 0x19
cmp ebx, 3
jne 0x466eb5
lea edx, [ebp - 0x88]
push edx
lea eax, [ebp - 0x2fc4]
push eax
call fcn.00464980
add esp, 8
test eax, eax
je 0x466eb5
mov dword [ebp - 0x4078], esi
jmp 0x466ef4
push edi
mov ecx, dword [ebp - 0x4020]
push ecx
lea edx, [ebp - 0x498]
push edx
mov eax, dword [ebp - 0x3ffc]
push eax
lea ecx, [ebp - 0x18c]
push ecx
lea edx, [ebp - 0x48]
push edx
lea eax, [ebp - 0x9ac]
push eax
lea ecx, [ebp - 0xcb8]
push ecx
push ebx
lea edx, [ebp - 0x2fc4]
push edx
call fcn.00545a10
add esp, 0x28
mov dword [ebp - 0x3fc8], 0x1a
cmp dword [ebp - 0x4050], 0
je 0x466fe6
cmp ebx, 1
jne 0x466fe6
cmp dword [0x72d358], 0
je 0x466fe6
cmp byte [0x72d360], 0
je 0x466fe6
xor eax, eax
mov word [ebp - 0x3fc4], ax
push 0xffe
push eax
lea ecx, [ebp - 0x3fc2]
push ecx
call fcn.005dfd60
add esp, 0xc
lea ecx, [ebp - 0x2fc4]
lea edx, [ebp - 0x3fc4]
jmp 0x466f60
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x466f60
lea edx, [ebp - 0x3fc4]
push edx
push 0
push 0x440090
call fcn.005e07ac
add esp, 0xc
mov esi, eax
cmp esi, 0xffffffff
jne 0x466fc0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_1w__fails_with_error__d
lea eax, [ebp - 0x59c]
push eax
call fcn.005dfb23
push 0
push 1
lea ecx, [ebp - 0x59c]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
jmp 0x466fe6
cmp word [ebp - 0x3fc4], 0
je 0x466fd6
push 5
call fcn.004d5a60
add esp, 4
jmp 0x466fc0
push 0
push esi
push str.CBD_4a
call fcn.00420720
add esp, 0xc
xor edi, edi
mov dword [ebp - 0x3fdc], edi
mov dword [ebp - 0x3fc8], 0x1b
test edi, edi
je 0x46719e
mov byte [ebp - 0x290], 0
push 0x103
xor esi, esi
push esi
lea edx, [ebp - 0x28f]
push edx
call fcn.005dfd60
mov byte [ebp - 0xbb4], 0
push 0x103
push esi
lea eax, [ebp - 0xbb3]
push eax
call fcn.005dfd60
mov byte [ebp - 0xab0], 0
push 0x103
push esi
lea ecx, [ebp - 0xaaf]
push ecx
call fcn.005dfd60
mov byte [ebp - 0x59c], 0
push 0x103
push esi
lea edx, [ebp - 0x59b]
push edx
call fcn.005dfd60
add esp, 0x30
mov eax, 0x104
mov dword [ebp - 0x4068], eax
mov dword [ebp - 0x4088], eax
mov dword [ebp - 0x3ff4], esi
mov dword [ebp - 0x4074], 1
mov dword [ebp - 0x3fc8], 0x1c
mov al, byte [ebp - 0x3fc9]
test al, al
je 0x467128
movsx eax, al
push eax
push str.SoftwareMicroWorldDeviceControlUSBDevices_c
lea ecx, [ebp - 0xab0]
push ecx
call fcn.005dfb23
lea edx, [ebp - 0x3ff4]
push edx
push 1
push esi
lea eax, [ebp - 0xab0]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004dc0a0
add esp, 0x20
test eax, eax
jne 0x467128
lea ecx, [ebp - 0x4068]
push ecx
lea edx, [ebp - 0x290]
push edx
push esi
push esi
push str.SerialNo
mov eax, dword [ebp - 0x3ff4]
push eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call edi
lea ecx, [ebp - 0x4088]
push ecx
lea edx, [ebp - 0xbb4]
push edx
push esi
push esi
push str.FriendlyName
mov eax, dword [ebp - 0x3ff4]
push eax
call edi
mov ecx, dword [ebp - 0x3ff4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x3fc8], 0x1d
cmp ebx, 3
jne 0x467159
lea edx, [ebp - 0x88]
push edx
lea eax, [ebp - 0x2fc4]
push eax
call fcn.00464980
add esp, 8
test eax, eax
je 0x467159
mov dword [ebp - 0x4074], esi
jmp 0x46719e
mov ecx, dword [ebp - 0x3fd8]
push ecx
mov edx, dword [ebp - 0x4020]
push edx
lea eax, [ebp - 0x59c]
push eax
mov ecx, dword [ebp - 0x3ffc]
push ecx
lea edx, [ebp - 0x18c]
push edx
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0xbb4]
push ecx
lea edx, [ebp - 0x290]
push edx
push ebx
lea eax, [ebp - 0x2fc4]
push eax
call fcn.00545a10
add esp, 0x28
mov eax, dword [ebp - 0x3fd4]
test eax, eax
je 0x4671bb
push eax
call fcn.005e0865
add esp, 4
mov dword [ebp - 0x3fd4], 0
mov ecx, dword [ebp - 0x4004]
mov eax, dword [ecx]
mov ebx, dword [ebp - 0x4024]
test eax, eax
jne 0x4671e2
mov edx, dword [ebp - 0x400c]
mov dword [edx], eax
xor edi, edi
mov esi, dword [ebp - 0x400c]
jmp 0x466315
add dword [ebp - 0x4004], eax
mov esi, dword [ebp - 0x4004]
xor edi, edi
jmp 0x4663d0
cmp esi, 0x102
jne 0x4672a1
mov dword [ebp - 0x3fc8], 0x1f
push edi
push 0x2000000
push 3
push edi
push 7
push 1
push ebx
call fcn.004e0400
add esp, 0x1c
mov dword [ebp - 0x4090], eax
cmp eax, 0xffffffff
jne 0x467236
mov eax, 2
jmp 0x467353
lea eax, [ebp - 0x4090]
push eax
call fcn.004dca10
mov dword [ebp - 0x3fc8], 0x20
cmp byte [ebx], 0x5c
jne 0x4671d7
cmp byte [ebx + 1], 0x5c
jne 0x4671d7
cmp dword [ebp - 0x401c], edi
je 0x4671d7
mov ecx, dword [ebp - 0x401c]
cmp byte [ecx], 0
je 0x4671d7
lea edx, [ebp - 0x6a0]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x467278
lea edx, [ebp - 0x6a0]
push edx
call fcn.004fb400
cmp eax, 1
je 0x4671d7
mov eax, 4
jmp 0x467353
cmp esi, 0xffffffff
jne 0x4671d7
mov eax, 5
jmp 0x467353
mov dword [ebp - 0x3fc8], 0x21
cmp dword [ebp - 0x4030], 0x40
je 0x46731a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x40
jne 0x46731a
mov dword [ebp - 0x3fc8], 0x22
mov dword [ebp - 0x4030], eax
lea eax, [ebp - 0x3fe0]
push eax
call fcn.004dca10
push edi
push 0x42000000
push 3
push edi
push 7
push 1
push ebx
call fcn.004e0400
add esp, 0x1c
mov dword [ebp - 0x3fe0], eax
cmp eax, 0xffffffff
jne 0x466320
mov eax, 6
jmp 0x467353
push 0x104
lea ecx, [ebp - 0x394]
push ecx
call fcn.004d8c20
add esp, 8
mov eax, dword [ebp - 0x3fe4]
cmp eax, edi
je 0x46734e
lea edx, [ebp - 0x394]
push edx
push ebx
push str.Error_in_ReadDirChanges_of___s___Reason:__s
push eax
call fcn.005dfb23
add esp, 0x10
mov eax, 7
mov dword [ebp - 0x3fc8], 0x23
push eax
push ebx
push str._DCH__Monitoring_finished___s___d_
push 0x6b1620
call fcn.004f0f30
mov dword [ebp - 0x3fc8], 0x24
mov eax, dword [ebp - 0x400c]
push eax
call fcn.005e0865
add esp, 0x14
mov dword [ebp - 0x3fc8], 0x25
lea ecx, [ebp - 0x4054]
push ecx
call fcn.004dca10
mov dword [ebp - 0x3fc8], 0x26
lea edx, [ebp - 0x3fe0]
push edx
call fcn.004dca10
mov dword [ebp - 0x3fc8], 0x31
jmp 0x4673de
add esp, 0xc
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret