Function at 0x4687f0
Capabilities:
Check for time delay via gettickcount
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x6708b0
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x62c
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov byte [ebp - 0x634], bl
push 0x40f
push ebx
lea eax, [ebp - 0x633]
push eax
call fcn.005dfd60
mov byte [ebp - 0x224], bl
push 0x103
push ebx
lea ecx, [ebp - 0x223]
push ecx
call fcn.005dfd60
add esp, 0x18
mov edi, 0x80004005
mov dword [ebp - 0x63c], edi
mov dword [ebp - 0x638], 0xffffffff
push 0x6e8c98
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x7302e0], ebx
je 0x46889b
cmp dword [0x7302e4], ebx
je 0x46889b
push 2
push 1
push ebx
call fcn.0044bee0
add esp, 0xc
mov dword [ebp - 4], ebx
call dword [0x6e9128]
mov esi, eax
mov dword [ebp - 0x638], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x4688ec
cmp esi, ebx
jge 0x46896c
mov byte [ebp - 0x120], bl
push 0x103
push ebx
lea edx, [ebp - 0x11f]
push edx
call fcn.005dfd60
lea eax, [ebp - 0x120]
push eax
push esi
call fcn.0044c900
add esp, 0x14
cmp byte [ebp - 0x120], bl
jne 0x46892f
push esi
push str.Error:_Monitor_Cannot_Be_Disabled._Reason:_0x_x
lea ecx, [ebp - 0x634]
push ecx
jmp 0x468942
lea edx, [ebp - 0x120]
push edx
push str.Error:_Monitor_Cannot_Be_Disabled._Reason:__s
lea eax, [ebp - 0x634]
push eax
call fcn.005dfb23
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0x634]
push ecx
push 0x6aec98
call fcn.004311c0
push 0xd
push 3
call fcn.00454fc0
add esp, 0x18
jmp 0x468978
mov dword [0x72c270], 1
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x6e9080], eax
cmp edi, ebx
jl 0x468b66
push 0xe
push 2
call fcn.00454fc0
call fcn.004501f0
push 0x733528
call fcn.005010c0
push 0x733710
call fcn.005010c0
push 0x733178
call fcn.005010c0
push 0x733490
call fcn.005010c0
push 0x7332a8
call fcn.005010c0
mov dword [0x732768], 1
push ebx
push 1
push ebx
push 0x2000d14
call dword [0x6e9118]
add esp, 0x2c
test eax, eax
jl 0x468a00
push ebx
push 1
push str.Previous_Exclude_File_Extensions_Successfully_Cleared
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov eax, dword [0x6e9264]
cmp eax, ebx
je 0x468a18
push eax
call fcn.005e0865
add esp, 4
mov dword [0x6e9264], ebx
mov eax, dword [0x6e9874]
cmp eax, ebx
je 0x468a30
push eax
call fcn.005e0865
add esp, 4
mov dword [0x6e9874], ebx
mov eax, dword [0x6e987c]
cmp eax, ebx
je 0x468a48
push eax
call fcn.005e0865
add esp, 4
mov dword [0x6e987c], ebx
mov eax, dword [0x6e9878]
cmp eax, ebx
je 0x468a60
push eax
call fcn.005e0865
add esp, 4
mov dword [0x6e9878], ebx
mov eax, dword [0x6e9880]
cmp eax, ebx
je 0x468a78
push eax
call fcn.005e0865
add esp, 4
mov dword [0x6e9880], ebx
cmp dword [0x72bb60], ebx
je 0x468a97
push 0x72bb60
call fcn.004e33b0
add esp, 4
test eax, eax
je 0x468a97
mov dword [0x72bb60], ebx
push 0x6af8c8
push 0x410
lea edx, [ebp - 0x634]
push edx
push str.No_Action
push 0x61d148
push str.Prompt
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
call esi
xor eax, eax
mov cl, byte [ebp + eax - 0x634]
mov byte [ebp + eax - 0x224], cl
inc eax
cmp cl, bl
jne 0x468ac1
push 0x6af8c8
push 0x410
lea eax, [ebp - 0x634]
push eax
push str.eScan_Anti_Virus_Monitor_is_unloaded
push 0x61d148
push str.STATISTICITEMS
call esi
push ebx
push str.eScan_Monitor
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x634]
push edx
push 0x60c810
push 3
push str.eScan_Monitor
push 0x99
call fcn.00513910
xor eax, eax
mov cl, byte [ebp + eax - 0x224]
mov byte [eax + 0x72d018], cl
inc eax
cmp cl, bl
jne 0x468b22
xor eax, eax
jmp 0x468b40
mov cl, byte [ebp + eax - 0x634]
mov byte [eax + 0x72d120], cl
inc eax
cmp cl, bl
jne 0x468b40
mov dword [0x72d11c], 0x99
mov dword [0x72d224], 3
push 0x6e8c98
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret