Function at 0x4068d8
Capabilities:
Check for time delay via gettickcount
Check os version

Disassembly:
push ebp
sub esp, 0x94
lea ebp, [esp - 4]
mov eax, dword [0x425630]
xor eax, ebp
mov dword [ebp + 0x94], eax
push 0x14
mov eax, 0x41cbd7
call fcn.0040d80d
push dword [ebp + 0xa4]
mov eax, dword [ebp + 0xa0]
mov edi, str.CServiceModule::PowerEventNotify__
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [0x4254b0]
mov ecx, dword [eax]
push str._s_evType:_d
push eax
call dword [ecx + 4]
add esp, 0x10
cmp dword [ebp + 0xa4], 7
jne 0x406b69
push str._t_WM_POWERBROADCAST_PBT_APMRESUMESUSPEND__n
push 0x4265c0
call fcn.0040d39b
mov eax, dword [0x4254b0]
mov ecx, dword [eax]
push edi
push str._s_WM_POWERBROADCAST_PBT_APMRESUMESUSPEND_
push eax
call dword [ecx + 4]
mov esi, dword [0x4269c0]
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
mov ebx, eax
mov eax, dword [0x4254b0]
mov ecx, dword [eax]
push str._s_dwTickCountOldUDRun:_d
push eax
call dword [ecx + 4]
mov eax, dword [0x4254b0]
mov ecx, dword [eax]
push ebx
push edi
push str._s_dwTickCountNowUDRun:_d
push eax
call dword [ecx + 4]
add esp, 0x20
cmp ebx, esi
jb 0x4069b0
sub ebx, esi
cmp ebx, 0xbb8
jae 0x4069b0
push edi
push str._s_UD_has_already_been_executed.
mov eax, dword [0x4254b0]
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
add esp, 0xc
jmp 0x406b69
xor esi, esi
inc esi
xor ebx, ebx
cmp ebx, 0xa
jg 0x4069eb
push str.GlobalEPSON_USB_Display_Mutex
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x4069d9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4069db
xor esi, esi
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
test esi, esi
jne 0x4069b5
mov ebx, dword [ebp - 0x14]
push 0
mov ecx, ebx
call fcn.00401aac
test al, al
jne 0x406a03
push edi
push str._s_UD_Not_Found.
jmp 0x40699d
mov esi, 0x427bf0
push esi
lea ecx, [ebp - 0x10]
call fcn.00403187
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall7650F538_6274_44EA_8F50_843479073333
mov ecx, ebx
call fcn.00408e4c
push esi
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x14], eax
call fcn.00403187
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00403187
push esi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.00403187
push dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push str._sEMP_UD.exe
push eax
mov byte [ebp - 4], 3
call fcn.00405d75
push dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push str._sEMP_UDAD.exe
push eax
call fcn.00405d75
add esp, 0x18
push str._UDCONNECT
lea ecx, [ebp - 0x1c]
call fcn.00405bd4
mov esi, 0x94
push esi
lea eax, [ebp]
push 0
push eax
call fcn.0040d0d0
add esp, 0xc
lea eax, [ebp]
push eax
mov dword [ebp], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov esi, 0x41ebfd
test eax, eax
je 0x406aeb
cmp dword [ebp + 4], 6
jb 0x406aeb
cmp dword [ebp - 0x14], 0
je 0x406b3d
mov eax, dword [0x4254b0]
mov ecx, dword [eax]
push edi
push str._s_Call_RunApplication_UDAD_
push eax
call dword [ecx + 4]
add esp, 0xc
push dword [ebp - 0x10]
mov ecx, ebx
push esi
push dword [ebp - 0x18]
call fcn.004088f0
mov eax, dword [0x4254b0]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 4]
pop ecx
pop ecx
cmp dword [ebp - 0x14], 0
je 0x406b3d
push str.UDApplicationRun_UD__Start._n
push 0x4265c0
call fcn.0040d39b
mov eax, dword [0x4254b0]
mov ecx, dword [eax]
push edi
push str._s_Call_RunApplication_UD_
push eax
call dword [ecx + 4]
add esp, 0x14
push dword [ebp - 0x10]
mov ecx, ebx
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call fcn.004088f0
mov eax, dword [0x4254b0]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 4]
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4269c0], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.004025f9
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004025f9
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.004025f9
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004025f9
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.0040d418
add ebp, 0x98
leave
ret 0x10