Function at 0x406b90
Capabilities:
Check for time delay via gettickcount
Check os version

Disassembly:
push ebp
sub esp, 0x94
lea ebp, [esp - 4]
mov eax, dword [0x425630]
xor eax, ebp
mov dword [ebp + 0x94], eax
push 0x1c
mov eax, 0x41cc2f
call fcn.0040d80d
mov ebx, dword [ebp + 0xa0]
push dword [ebx + 4]
mov eax, dword [0x4254b0]
mov edi, str.CServiceModule::DeviceArrval__
push edi
mov dword [ebp - 0x20], ecx
mov ecx, dword [eax]
push str._s_dbch_devicetype:_d
push eax
call dword [ecx + 4]
add esp, 0x10
cmp dword [ebx + 4], 5
jne 0x406e12
mov esi, dword [0x4269c0]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [0x4254b0]
mov ecx, dword [eax]
push str._s_dwTickCountOldUDRun:_d
push eax
call dword [ecx + 4]
push dword [ebp - 0x14]
mov eax, dword [0x4254b0]
mov ecx, dword [eax]
push edi
push str._s_dwTickCountNowUDRun:_d
push eax
call dword [ecx + 4]
mov eax, dword [ebp - 0x14]
add esp, 0x20
cmp eax, esi
jb 0x406c36
sub eax, esi
cmp eax, 0xbb8
jae 0x406c36
push edi
push str._s_UD_has_already_been_executed.
jmp 0x406e18
mov esi, 0x427bf0
push esi
lea ecx, [ebp - 0x1c]
call fcn.00403187
and dword [ebp - 4], 0
add ebx, 0x1c
push ebx
lea ecx, [ebp - 0x1c]
call fcn.00406874
push esi
lea ecx, [ebp - 0x10]
call fcn.00403187
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00405aba
push dword [ebp - 0x10]
mov eax, dword [0x4254b0]
mov ecx, dword [eax]
push edi
push str._s_pDevInterface__dbcc_name__s_
push eax
call dword [ecx + 4]
push dword [ebp - 0x10]
mov eax, dword [0x4254b0]
mov ecx, dword [eax]
push edi
push str._s_Chk_DevName:_s
push eax
call dword [ecx + 4]
mov ebx, dword [ebp - 0x20]
add esp, 0x20
push dword [ebp - 0x10]
mov ecx, ebx
call fcn.00401aac
test al, al
je 0x406dfa
push esi
lea ecx, [ebp - 0x18]
call fcn.00403187
lea eax, [ebp - 0x18]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall7650F538_6274_44EA_8F50_843479073333
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.00408e4c
push esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x20], eax
call fcn.00403187
push esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.00403187
push esi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 4
call fcn.00403187
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push str._sEMP_UD.exe
push eax
mov byte [ebp - 4], 5
call fcn.00405d75
push dword [ebp - 0x18]
lea eax, [ebp - 0x28]
push str._sEMP_UDAD.exe
push eax
call fcn.00405d75
add esp, 0x18
push str._DEV_ARRVAL
lea ecx, [ebp - 0x24]
call fcn.00405bd4
mov esi, 0x94
push esi
lea eax, [ebp]
push 0
push eax
call fcn.0040d0d0
add esp, 0xc
lea eax, [ebp]
push eax
mov dword [ebp], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov esi, 0x41ebfd
test eax, eax
je 0x406d8b
cmp dword [ebp + 4], 6
jb 0x406d8b
cmp dword [ebp - 0x20], 0
je 0x406dce
mov eax, dword [0x4254b0]
mov ecx, dword [eax]
push edi
push str._s_Call_RunApplication_UDAD_
push eax
call dword [ecx + 4]
add esp, 0xc
push dword [ebp - 0x18]
mov ecx, ebx
push esi
push dword [ebp - 0x28]
call fcn.004088f0
mov eax, dword [0x4254b0]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 4]
pop ecx
pop ecx
cmp dword [ebp - 0x20], 0
je 0x406dce
mov eax, dword [0x4254b0]
mov ecx, dword [eax]
push edi
push str._s_Call_RunApplication_UD_
push eax
call dword [ecx + 4]
add esp, 0xc
push dword [ebp - 0x18]
mov ecx, ebx
push dword [ebp - 0x24]
push dword [ebp - 0x14]
call fcn.004088f0
mov eax, dword [0x4254b0]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 4]
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4269c0], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.004025f9
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.004025f9
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004025f9
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004025f9
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004025f9
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.004025f9
jmp 0x406e26
push edi
push str._s_Type_Unknown
mov eax, dword [0x4254b0]
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.0040d418
add ebp, 0x98
leave
ret 4