Function at 0x100b1cf
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x101000c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0xeb00
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x58], eax
je 0x100b4ee
push esi
push edi
xor edi, edi
mov esi, 0x80000000
cmp dword [0x101042c], edi
je 0x100b24e
mov al, byte [0x1010430]
cmp al, 4
jae 0x100b212
test al, al
jne 0x100b24e
mov ecx, dword [0x101041c]
and ecx, esi
xor eax, eax
or eax, ecx
je 0x100b24e
mov ecx, dword [0x1010424]
mov eax, ecx
xor edx, edx
and eax, esi
cmp edx, dword [0x1010420]
jne 0x100b24e
cmp eax, ecx
jne 0x100b24e
push 0x10061b0
push dword [0x1010404]
push dword [0x1010400]
call fcn.0100ad3f
push 0x100682c
push edi
call fcn.010096fc
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
push 1
push 1
mov dword [ebp - 0x5c], eax
call fcn.0100b62c
call fcn.0100b0fd
push edi
push 1
push edi
call fcn.0100b62c
call dword [sym.imp.USERENV.dll_Ordinal_206]
cmp eax, edi
jge 0x100b296
push eax
push 0x10067c8
push 2
call fcn.010096fc
add esp, 0xc
push ebx
push 0x10067b0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp ebx, edi
je 0x100b2ec
push 0x10067a0
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x100b2e5
push edi
push edi
call eax
test eax, eax
je 0x100b2cf
push 0x1006738
push edi
call fcn.010096fc
pop ecx
pop ecx
jmp 0x100b2e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10066c8
push 2
call fcn.010096fc
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp + 0xc], edi
jne 0x100b3c3
lea eax, [ebp - 0x50]
push eax
push 2
push edi
mov dword [ebp - 0x50], edi
call sub.NETAPI32.dll_NetUserModalsGet
test eax, eax
jne 0x100b3ac
mov eax, dword [ebp - 0x50]
cmp eax, edi
je 0x100b3ac
push dword [eax + 4]
mov edi, dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
call edi
mov al, byte [eax]
movzx ebx, al
inc bl
mov byte [ebp - 0x49], al
push ebx
call dword [sym.imp.ADVAPI32.dll_GetSidLengthRequired]
cmp eax, 0x44
ja 0x100b3a2
mov ecx, dword [ebp - 0x50]
push dword [ecx + 4]
lea ecx, [ebp - 0x48]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x100b3a2
movzx eax, byte [ebp - 0x49]
push eax
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov dword [eax], 0x1f4
lea eax, [ebp - 0x48]
push eax
call edi
mov byte [eax], bl
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test eax, eax
je 0x100b399
xor edi, edi
push edi
push edi
push dword [ebp - 0x54]
call dword [sym.imp.USERENV.dll_DeleteProfileW]
test eax, eax
je 0x100b399
push 0x1006670
push edi
call fcn.010096fc
pop ecx
pop ecx
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x50]
call sub.NETAPI32.dll_NetApiBufferFree
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x5c]
push eax
push 0x1483
push dword [ebp - 0x58]
call sub.ntdll.dll_WinSqmSetDWORD
cmp dword [ebp + 0x10], edi
jne 0x100b489
cmp dword [0x101042c], edi
je 0x100b41d
mov al, byte [0x1010430]
cmp al, 4
jae 0x100b3e1
test al, al
jne 0x100b41d
mov ecx, dword [0x101041c]
and ecx, esi
xor eax, eax
or eax, ecx
je 0x100b41d
mov ecx, dword [0x1010424]
mov eax, ecx
xor edx, edx
and eax, esi
cmp edx, dword [0x1010420]
jne 0x100b41d
cmp eax, ecx
jne 0x100b41d
push 0x10061d0
push dword [0x1010404]
push dword [0x1010400]
call fcn.0100ad3f
push 1
call fcn.0100be79
mov ebx, eax
cmp dword [0x101042c], edi
je 0x100b477
mov al, byte [0x1010430]
cmp al, 4
jae 0x100b43b
test al, al
jne 0x100b477
mov ecx, dword [0x101041c]
and ecx, esi
xor eax, eax
or eax, ecx
je 0x100b477
mov ecx, dword [0x1010424]
mov eax, ecx
xor edx, edx
and eax, esi
cmp edx, dword [0x1010420]
jne 0x100b477
cmp eax, ecx
jne 0x100b477
push 0x10061e0
push dword [0x1010404]
push dword [0x1010400]
call fcn.0100ad3f
cmp ebx, edi
jge 0x100b489
push 0x1006608
push 2
call fcn.010096fc
pop ecx
pop ecx
push dword [ebp + 8]
push 0x10065c0
push edi
call fcn.010096fc
add esp, 0xc
pop ebx
cmp dword [0x101042c], edi
je 0x100b4ec
mov al, byte [0x1010430]
cmp al, 4
jae 0x100b4b0
test al, al
jne 0x100b4ec
mov ecx, dword [0x101041c]
and ecx, esi
xor eax, eax
or eax, ecx
je 0x100b4ec
mov ecx, dword [0x1010424]
mov eax, ecx
xor edx, edx
and eax, esi
cmp edx, dword [0x1010420]
jne 0x100b4ec
cmp eax, ecx
jne 0x100b4ec
push 0x10061c0
push dword [0x1010404]
push dword [0x1010400]
call fcn.0100ad3f
pop edi
pop esi
call fcn.0100b506
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100909d
leave
ret 0x10