Function at 0x100b2d1
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x101000c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0xeb00
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x58], eax
je 0x100b5f0
push esi
push edi
xor edi, edi
mov esi, 0x80000000
cmp dword [0x101042c], edi
je 0x100b350
mov al, byte [0x1010430]
cmp al, 4
jae 0x100b314
test al, al
jne 0x100b350
mov ecx, dword [0x101041c]
and ecx, esi
xor eax, eax
or eax, ecx
je 0x100b350
mov ecx, dword [0x1010424]
mov eax, ecx
xor edx, edx
and eax, esi
cmp edx, dword [0x1010420]
jne 0x100b350
cmp eax, ecx
jne 0x100b350
push 0x1006270
push dword [0x1010404]
push dword [0x1010400]
call fcn.0100ae3f
push 0x10068ec
push edi
call fcn.010097fc
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
push 1
push 1
mov dword [ebp - 0x5c], eax
call fcn.0100b72e
call fcn.0100b1ff
push edi
push 1
push edi
call fcn.0100b72e
call dword [sym.imp.USERENV.dll_Ordinal_206]
cmp eax, edi
jge 0x100b398
push eax
push 0x1006888
push 2
call fcn.010097fc
add esp, 0xc
push ebx
push 0x1006870
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp ebx, edi
je 0x100b3ee
push 0x1006860
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x100b3e7
push edi
push edi
call eax
test eax, eax
je 0x100b3d1
push 0x10067f8
push edi
call fcn.010097fc
pop ecx
pop ecx
jmp 0x100b3e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1006788
push 2
call fcn.010097fc
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp + 0xc], edi
jne 0x100b4c5
lea eax, [ebp - 0x50]
push eax
push 2
push edi
mov dword [ebp - 0x50], edi
call sub.NETAPI32.dll_NetUserModalsGet
test eax, eax
jne 0x100b4ae
mov eax, dword [ebp - 0x50]
cmp eax, edi
je 0x100b4ae
push dword [eax + 4]
mov edi, dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
call edi
mov al, byte [eax]
movzx ebx, al
inc bl
mov byte [ebp - 0x49], al
push ebx
call dword [sym.imp.ADVAPI32.dll_GetSidLengthRequired]
cmp eax, 0x44
ja 0x100b4a4
mov ecx, dword [ebp - 0x50]
push dword [ecx + 4]
lea ecx, [ebp - 0x48]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x100b4a4
movzx eax, byte [ebp - 0x49]
push eax
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov dword [eax], 0x1f4
lea eax, [ebp - 0x48]
push eax
call edi
mov byte [eax], bl
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test eax, eax
je 0x100b49b
xor edi, edi
push edi
push edi
push dword [ebp - 0x54]
call dword [sym.imp.USERENV.dll_DeleteProfileW]
test eax, eax
je 0x100b49b
push 0x1006730
push edi
call fcn.010097fc
pop ecx
pop ecx
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x50]
call sub.NETAPI32.dll_NetApiBufferFree
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x5c]
push eax
push 0x1483
push dword [ebp - 0x58]
call sub.ntdll.dll_WinSqmSetDWORD
cmp dword [ebp + 0x10], edi
jne 0x100b58b
cmp dword [0x101042c], edi
je 0x100b51f
mov al, byte [0x1010430]
cmp al, 4
jae 0x100b4e3
test al, al
jne 0x100b51f
mov ecx, dword [0x101041c]
and ecx, esi
xor eax, eax
or eax, ecx
je 0x100b51f
mov ecx, dword [0x1010424]
mov eax, ecx
xor edx, edx
and eax, esi
cmp edx, dword [0x1010420]
jne 0x100b51f
cmp eax, ecx
jne 0x100b51f
push 0x1006290
push dword [0x1010404]
push dword [0x1010400]
call fcn.0100ae3f
push 1
call fcn.0100bf7b
mov ebx, eax
cmp dword [0x101042c], edi
je 0x100b579
mov al, byte [0x1010430]
cmp al, 4
jae 0x100b53d
test al, al
jne 0x100b579
mov ecx, dword [0x101041c]
and ecx, esi
xor eax, eax
or eax, ecx
je 0x100b579
mov ecx, dword [0x1010424]
mov eax, ecx
xor edx, edx
and eax, esi
cmp edx, dword [0x1010420]
jne 0x100b579
cmp eax, ecx
jne 0x100b579
push 0x10062a0
push dword [0x1010404]
push dword [0x1010400]
call fcn.0100ae3f
cmp ebx, edi
jge 0x100b58b
push 0x10066c8
push 2
call fcn.010097fc
pop ecx
pop ecx
push dword [ebp + 8]
push 0x1006680
push edi
call fcn.010097fc
add esp, 0xc
pop ebx
cmp dword [0x101042c], edi
je 0x100b5ee
mov al, byte [0x1010430]
cmp al, 4
jae 0x100b5b2
test al, al
jne 0x100b5ee
mov ecx, dword [0x101041c]
and ecx, esi
xor eax, eax
or eax, ecx
je 0x100b5ee
mov ecx, dword [0x1010424]
mov eax, ecx
xor edx, edx
and eax, esi
cmp edx, dword [0x1010420]
jne 0x100b5ee
cmp eax, ecx
jne 0x100b5ee
push 0x1006280
push dword [0x1010404]
push dword [0x1010400]
call fcn.0100ae3f
pop edi
pop esi
call fcn.0100b608
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100919d
leave
ret 0x10