Function at 0x1001da90
Capabilities:
Check for time delay via gettickcount
Check os version
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1016f8a0
push 0x10118480
mov eax, dword fs:[0]
push eax
sub esp, 0x318
mov eax, dword [0x1017455c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
xor ebx, ebx
xor edi, edi
mov byte [ebp - 0x328], bl
push 0x103
push ebx
lea eax, [ebp - 0x327]
push eax
call fcn.10116880
mov byte [ebp - 0x120], bl
push 0x103
push ebx
lea ecx, [ebp - 0x11f]
push ecx
call fcn.10116880
add esp, 0x18
mov eax, dword [ebp + 0xc]
sub eax, ebx
je 0x1001df71
sub eax, 1
jne 0x1001e042
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0x1f40
push 0x1018ef34
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x1001db3d
push 0x1018ef34
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x10191cb0
push str.UPDATER_DEBUG
mov ecx, str.SoftwareMicroWorld
mov edx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.10031670
push 0x10191cb4
push str.DLLDebug
mov ecx, str.SoftwareMicroWorld
mov edx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.10031670
cmp dword [0x1019e748], ebx
jne 0x1001dba5
mov dword [0x1019e748], 1
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x1001dba5
cmp al, 6
jb 0x1001dba5
mov dword [0x1019e74c], 1
mov dword [0x1018ef4c], 1
jmp 0x1001dbbf
cmp dword [0x1019e74c], ebx
je 0x1001dbb9
mov dword [0x1018ef4c], 1
jmp 0x1001dbbf
mov dword [0x1018ef4c], ebx
cmp byte [0x10192418], bl
jne 0x1001dc8e
mov dword [0x1018ef14], 0x65
mov dword [0x1018ef10], 0x66
mov dword [0x1019251c], esi
mov dword [0x10192414], esi
push 0x103
push 0x10192418
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call esi
cmp dword [0x10191cb4], ebx
je 0x1001dc19
push 0x10192418
push str._DLL__ENCDEC.DLL__Load_DLL___s_
push ebx
call fcn.10053700
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x10192520
push 0x10192418
call sym.EncDec.dll_GetVersionInformation
cmp byte [0x10192418], bl
je 0x1001dc70
push str.mwunzip
mov ecx, 0x10192418
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
jne 0x1001dc70
push 0x1014c40c
mov ecx, 0x10192418
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
je 0x1001dc70
mov edi, 1
push 0x104
lea edx, [ebp - 0x120]
push edx
push ebx
call esi
call fcn.1008ed40
push ebx
push ebx
call fcn.10053700
add esp, 8
cmp dword [0x10191cb0], ebx
je 0x1001dd11
mov byte [ebp - 0x224], bl
push 0x103
push ebx
lea eax, [ebp - 0x223]
push eax
call fcn.10116880
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x120]
push edx
call sym.EncDec.dll_GetVersionInformation
push 0x10192520
push 0x10192418
cmp dword [ebp + 0x10], ebx
jne 0x1001dce7
push str._EncDec__DLL_PROCESS_ATTACH__DLL_:__s___s___LoadLibrary_Called_
jmp 0x1001dcec
push str._EncDec__DLL_PROCESS_ATTACH__DLL_:__s___s___Static:_On_Process_Start_
push ebx
call fcn.10053700
add esp, 0x10
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x120]
push ecx
push str._EncDec__DLL_PROCESS_ATTACH__EXE_:__s___s_
push ebx
call fcn.10053700
add esp, 0x10
cmp byte [0x10192200], bl
jne 0x1001e042
cmp byte [ebp - 0x120], bl
je 0x1001e042
push 0x10192200
lea ecx, [ebp - 0x120]
call fcn.10045a10
add esp, 4
cmp edi, ebx
je 0x1001e042
push str.httpd.exe
push 0x10192200
call fcn.1011c280
add esp, 8
test eax, eax
jne 0x1001e042
mov eax, 0x10191ee8
call fcn.10039e00
test eax, eax
je 0x1001df5a
mov ecx, 0x10191ee8
call fcn.10049c40
push 0x10191ee8
push 0x10191de0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call esi
push str.eUpdate.ini
push 0x10191de0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
call ebx
mov ecx, 0x10191de0
call fcn.10044360
test eax, eax
je 0x1001dde9
push 0x10191de0
push str.Config
mov edi, 0x10191cd8
mov edx, 0x1013fc40
mov ecx, str.IpOnly
call fcn.100573b0
push edi
call fcn.1010dbef
add esp, 0xc
mov dword [0x10191ccc], eax
cmp dword [0x10191cb0], 0
je 0x1001de06
push eax
push str._EncDec__IsItIpOnly_:__u
jmp 0x1001ddfc
cmp dword [0x10191cb0], 0
je 0x1001de06
push 0x10191de0
push str._EncDec__Failed_to_Find___s_
push 0
call fcn.10053700
add esp, 0xc
push 0x10191ee8
push 0x10191de0
call esi
push str.eServ.ini
push 0x10191de0
call ebx
mov ecx, 0x10191de0
call fcn.10044360
test eax, eax
je 0x1001df34
push 0x10191de0
push str.General
mov edi, 0x10191ff0
mov edx, 0x1013f817
mov ecx, str.FTPDownloadDir
call fcn.100573b0
add esp, 8
mov esi, 0x1018ef1c
call fcn.10056c50
cmp dword [0x10191cb0], 0
je 0x1001de73
push str._EncDec__Entering_CRITI_A
push 0
call fcn.10053700
add esp, 8
push 0x1018ef1c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, str.FromDLL
lea ecx, [ebp - 0x328]
call fcn.1001fb30
test eax, eax
jne 0x1001deaf
cmp dword [0x10191cb0], eax
je 0x1001deaf
lea edx, [ebp - 0x328]
push edx
push str._EncDec__DllMain_BuildAvsMap_failed___szErrMsg_:__s_
push eax
call fcn.10053700
add esp, 0xc
push 0x1018ef1c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x10191cb0], 0
je 0x1001ded2
push str._EncDec__Leaving_CRITI_A
push 0
call fcn.10053700
add esp, 8
push 0
push 0
push 0x10020070
call fcn.1010d93f
add esp, 0xc
cmp eax, 0xffffffff
jne 0x1001df1b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_FileNotifThreadProc_beginthread___fails_with_error__d
lea eax, [ebp - 0x224]
push eax
call fcn.1010d6a8
lea ecx, [ebp - 0x224]
push ecx
push 0x1013fb04
push 0
call fcn.10053700
add esp, 0x18
jmp 0x1001e042
cmp dword [0x10191cb0], 0
je 0x1001e042
mov esi, eax
call fcn.1001d9e0
jmp 0x1001e042
cmp dword [0x10191cb0], 0
je 0x1001e042
push 0x10191de0
push str._EncDec__Failed_to_Find___s_
push 0
call fcn.10053700
add esp, 0xc
jmp 0x1001e042
cmp dword [0x10191cb0], ebx
je 0x1001e042
push str._EncDec__GeteScanPath___failed..
push ebx
jmp 0x1001e03a
mov dword [ebp - 4], ebx
cmp dword [0x10191cb4], ebx
je 0x1001df8a
push str._DLL__ENCDEC.DLL__Unload_DLL
push ebx
call fcn.10053700
add esp, 8
cmp dword [0x10191cb0], ebx
je 0x1001dfac
cmp dword [ebp + 0x10], ebx
jne 0x1001df9e
push str._EncDec__DLL_PROCESS_DETACH_Called__FreeLibrary_Called_
jmp 0x1001dfa3
push str._EncDec__DLL_PROCESS_DETACH_Called__Process_Exiting_
push ebx
call fcn.10053700
add esp, 8
cmp dword [ebp + 0x10], ebx
jne 0x1001dfea
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov edi, eax
mov dword [0x10191ddc], 1
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1001dfd0
cmp dword [0x10191ee4], 0
je 0x1001dfea
call esi
sub eax, edi
cmp eax, 0x1388
jae 0x1001dfea
push 0x64
call ebx
jmp 0x1001dfd0
cmp dword [0x10191cb0], 0
je 0x1001e002
push str._EncDec__DeIniting_IPL_DB...
push 0
call fcn.10053700
add esp, 8
call fcn.10019020
cmp dword [0x10191cb0], 0
je 0x1001e02f
push str._EncDec__DLL_PROCESS_DETACH_breaking...
jmp 0x1001e025
push 0
call fcn.10053700
add esp, 8
mov dword [ebp - 4], 0xfffffffe
push 0
push 0xffffffffffffffff
call fcn.10053700
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1010d699
mov esp, ebp
pop ebp
ret 0xc