Function at 0x8b28b0
Capabilities:
Check for time delay via gettickcount
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0xb14a48
push 0xa847a0
mov eax, dword fs:[0]
push eax
sub esp, 0x62c
mov eax, dword [0xb196ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov byte [ebp - 0x634], bl
push 0x40f
push ebx
lea eax, [ebp - 0x633]
push eax
call fcn.00a7ffb0
mov byte [ebp - 0x224], bl
push 0x103
push ebx
lea ecx, [ebp - 0x223]
push ecx
call fcn.00a7ffb0
add esp, 0x18
mov edi, 0x80004005
mov dword [ebp - 0x63c], edi
mov dword [ebp - 0x638], 0xffffffff
push 0xb52450
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0xbd4ad8], ebx
je 0x8b295c
cmp dword [0xbd4adc], ebx
je 0x8b295c
push 2
push 1
xor ecx, ecx
call fcn.008a3370
add esp, 8
mov dword [ebp - 4], ebx
call dword [0xb8dad4]
mov esi, eax
mov dword [ebp - 0x638], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x8b29ab
cmp esi, ebx
jge 0x8b2a2d
mov byte [ebp - 0x120], bl
push 0x103
push ebx
lea edx, [ebp - 0x11f]
push edx
call fcn.00a7ffb0
push esi
lea edx, [ebp - 0x120]
call fcn.008aaa40
add esp, 0x10
cmp byte [ebp - 0x120], bl
jne 0x8b29ed
push esi
push str.Error:_Monitor_Cannot_Be_Disabled._Reason:_0x_x
lea eax, [ebp - 0x634]
push eax
jmp 0x8b2a00
lea ecx, [ebp - 0x120]
push ecx
push str.Error:_Monitor_Cannot_Be_Disabled._Reason:__s
lea edx, [ebp - 0x634]
push edx
call fcn.00a78f30
add esp, 0xc
push ebx
push 1
lea eax, [ebp - 0x634]
push eax
push 0xb54ce8
call fcn.008808e0
push 0xd
mov esi, 3
call fcn.008be990
add esp, 0x14
jmp 0x8b2a39
mov dword [0xbd0b20], 1
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0xb8da58], eax
cmp edi, ebx
jl 0x8b2cc6
push 0xe
mov esi, 2
call fcn.008be990
push ebx
mov esi, 1
push esi
push str._BDCACHE__Invalidate__UnLoadMon_
push 0xb54ce8
call fcn.008808e0
call fcn.008b2850
push ebx
push esi
push str._BDCACHE__Removing_Cache_Trees...
push 0xb54ce8
call fcn.008808e0
mov ecx, dword [0xbe46b4]
push ecx
call fcn.00956c20
add esp, 0x28
mov ecx, 0xbe4648
call fcn.0097f8c0
mov edx, dword [0xbe487c]
push edx
call fcn.00956c20
add esp, 4
mov ecx, 0xbe4810
call fcn.0097f8c0
mov eax, dword [0xbe4304]
push eax
call fcn.00956c20
add esp, 4
mov ecx, 0xbe4298
call fcn.0097f8c0
mov ecx, dword [0xbe461c]
push ecx
call fcn.00956c20
add esp, 4
mov ecx, 0xbe45b0
call fcn.0097f8c0
mov edx, dword [0xbe4434]
push edx
call fcn.00956c20
add esp, 4
mov ecx, 0xbe43c8
call fcn.0097f8c0
push ebx
push esi
push str._BDCACHE__Removed_Cache_Trees.
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [0xbd589c], esi
mov eax, dword [0xb8dbf4]
cmp eax, ebx
je 0x8b2b32
push eax
call fcn.00a78fec
add esp, 4
mov dword [0xb8dbf4], ebx
mov eax, dword [0xb8e204]
cmp eax, ebx
je 0x8b2b4a
push eax
call fcn.00a78fec
add esp, 4
mov dword [0xb8e204], ebx
mov eax, dword [0xb8e20c]
cmp eax, ebx
je 0x8b2b62
push eax
call fcn.00a78fec
add esp, 4
mov dword [0xb8e20c], ebx
mov eax, dword [0xb8e208]
cmp eax, ebx
je 0x8b2b7a
push eax
call fcn.00a78fec
add esp, 4
mov dword [0xb8e208], ebx
mov eax, dword [0xb8e210]
cmp eax, ebx
je 0x8b2b92
push eax
call fcn.00a78fec
add esp, 4
mov dword [0xb8e210], ebx
cmp dword [0xbd04ec], ebx
je 0x8b2bba
push 0xbd04ec
call fcn.00985290
test eax, eax
jne 0x8b2baa
xor esi, esi
mov dword [0xbd04ec], ebx
cmp esi, ebx
je 0x8b2bba
mov dword [0xbd04ec], ebx
push ebx
push 1
push str._BDCACHE__Notifying_Server...
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
push 0xb55918
push 0x410
lea eax, [ebp - 0x634]
push eax
push 0xab3780
push 0xab91c4
push str.Prompt
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
call esi
xor eax, eax
lea esp, [esp]
mov cl, byte [ebp + eax - 0x634]
mov byte [ebp + eax - 0x224], cl
inc eax
cmp cl, bl
jne 0x8b2c00
push 0xb55918
push 0x410
lea ecx, [ebp - 0x634]
push ecx
push str.eScan_Anti_Virus_Monitor_is_unloaded
push 0xab91c4
push str.STATISTICITEMS
call esi
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.eScan_Monitor
lea edx, [ebp - 0x224]
push edx
lea eax, [ebp - 0x634]
push eax
push 0xaa154c
push 3
push 0x99
mov ecx, str.eScan_Monitor
call fcn.00982e00
push ebx
push 1
push str._BDCACHE__Finishing_remaining_tasks...
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
xor eax, eax
jmp 0x8b2c80
mov cl, byte [ebp + eax - 0x224]
mov byte [eax + 0xbd18d0], cl
inc eax
cmp cl, bl
jne 0x8b2c80
xor eax, eax
jmp 0x8b2ca0
mov cl, byte [ebp + eax - 0x634]
mov byte [eax + str.eScan_monitor_successfully_loaded__5DH.0.0.0___9.0.2.1669_], cl
inc eax
cmp cl, bl
jne 0x8b2ca0
mov dword [0xbd18cc], 0x99
mov dword [0xbd19d4], 3
push 0xb52450
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret