Function at 0x1002d2b0
Capabilities:
Check for time delay via gettickcount
Get hostname

Disassembly:
push 0xffffffffffffffff
push 0x10088cd9
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x258], eax
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x268]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x40], edi
cmp dword [edi + 0x114], 0
jne 0x1002d41b
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov edi, eax
mov eax, 0x51eb851f
mul edi
mov dword [esp + 0x50], edi
shr edx, 5
imul ecx, edx, 0x64
mov edx, edi
sub edx, ecx
je 0x1002d35a
call esi
mov edi, eax
sub eax, dword [esp + 0x50]
cmp eax, 0x1388
ja 0x1002d35a
lea esp, [esp]
mov eax, 0x51eb851f
mov ecx, edi
mul edi
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
je 0x1002d35a
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
call esi
mov edi, eax
sub eax, dword [esp + 0x50]
cmp eax, 0x1388
jbe 0x1002d330
lea eax, [esp + 0x44]
xorps xmm0, xmm0
push eax
movlpd qword [esp + 0x48], xmm0
call dword [sym.imp.MSVCR120.dll__time64]
add esp, 4
push 0
push 0x3e8
push dword [esp + 0x50]
push dword [esp + 0x50]
call fcn.10082b20
mov ecx, eax
mov esi, edx
sub ecx, edi
mov eax, 0x10624dd3
push 0
sbb esi, 0
mul edi
push 0x3e8
shr edx, 6
imul eax, edx, 0x3e8
sub edi, eax
xor eax, eax
add edi, ecx
adc eax, esi
push eax
push edi
call fcn.10082a70
mov dword [esp + 0x44], eax
xorps xmm0, xmm0
lea eax, [esp + 0x44]
mov dword [esp + 0x48], edx
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
movdqu xmmword [esp + 0x28], xmm0
movdqu xmmword [esp + 0x38], xmm0
call dword [sym.imp.MSVCR120.dll__localtime64_s]
push dword [esp + 0x24]
mov eax, dword [esp + 0x38]
push dword [esp + 0x2c]
mov edi, dword [esp + 0x50]
inc eax
push dword [esp + 0x34]
push dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x4c]
add eax, 0x76c
push eax
lea eax, [edi + 0x104]
push str._04d_02d_02d_02d_02d_02d
push eax
call fcn.1000a7d0
add esp, 0x28
cmp dword [edi + 0x12c], 0
jne 0x1002d655
push 0xc
xor eax, eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
lea ecx, [esp + 0x2c]
push str.Advapi32.dll
mov dword [esp + 0x20], 0
mov dword [esp + 0x48], 4
mov dword [esp + 0x58], 0
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], 0
mov word [esp + 0x30], ax
call fcn.10003000
mov dword [esp + 0x270], 0
mov eax, dword [0x100b084c]
test al, 1
jne 0x1002d4bf
or eax, 1
mov dword [0x100b084c], eax
mov byte [esp + 0x270], 1
mov dword [0x100b0848], 0
call fcn.1001b590
push 0x10092b30
call fcn.10081c88
add esp, 4
mov byte [esp + 0x270], 0
lea eax, [esp + 0x28]
mov ecx, 0x100b0848
push eax
call fcn.1001b760
mov esi, eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x270], 0xffffffff
cmp dword [esp + 0x3c], 8
jb 0x1002d4f3
push dword [esp + 0x28]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], 0
mov word [esp + 0x28], ax
test esi, esi
je 0x1002d5e6
push str.RegOpenKeyExW
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
push str.RegQueryValueExW
push dword [esp + 0x18]
mov dword [esp + 0x18], eax
call esi
push str.RegCloseKey
push dword [esp + 0x18]
mov dword [esp + 0x50], eax
call esi
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], eax
test ecx, ecx
je 0x1002d5e6
mov esi, dword [esp + 0x48]
test esi, esi
je 0x1002d5e6
test eax, eax
je 0x1002d5e6
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call ecx
test eax, eax
jne 0x1002d59f
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x54]
push eax
push 0
push 0
push str.InstallDate
push dword [esp + 0x2c]
call esi
push dword [esp + 0x18]
call dword [esp + 0x18]
mov eax, dword [esp + 0x50]
test eax, eax
jne 0x1002d5ee
lea eax, [esp + 0x18]
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [esp + 0x24]
test eax, eax
jne 0x1002d5e6
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x54]
push eax
push 0
push 0
push str.InstallDate
push dword [esp + 0x2c]
call esi
push dword [esp + 0x18]
call dword [esp + 0x18]
mov eax, dword [esp + 0x50]
test eax, eax
je 0x1002d655
mov dword [esp + 0x44], eax
xorps xmm0, xmm0
lea eax, [esp + 0x44]
mov dword [esp + 0x48], 0
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
movdqu xmmword [esp + 0x28], xmm0
movdqu xmmword [esp + 0x38], xmm0
call dword [sym.imp.MSVCR120.dll__localtime64_s]
push dword [esp + 0x24]
mov eax, dword [esp + 0x38]
push dword [esp + 0x2c]
inc eax
push dword [esp + 0x34]
push dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x4c]
add eax, 0x76c
push eax
lea eax, [edi + 0x11c]
push str._04d_02d_02d_02d_02d_02d
push eax
call fcn.1000a7d0
add esp, 0x28
cmp dword [edi + 0x144], 0
jne 0x1002d719
xor eax, eax
push 0x208
push eax
mov word [esp + 0x5c], ax
lea eax, [esp + 0x5e]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [esp + 0x48], 0x104
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
xor eax, eax
mov word [esp + 0x25a], ax
cmp word [esp + 0x54], ax
jne 0x1002d6a9
xor ecx, ecx
jmp 0x1002d6bf
lea ecx, [esp + 0x54]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002d6b0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x58]
lea esi, [edi + 0x134]
push eax
mov ecx, esi
call fcn.10003000
mov edx, 0x10093f80
mov ecx, esi
call fcn.1000a3a0
mov edx, 0x10093f80
mov ecx, esi
call fcn.1000a410
push 0x2d
mov edx, 0x2c
mov ecx, esi
call fcn.1000a350
add esp, 4
mov edx, 0xd
push 0x2d
call fcn.1000a350
add esp, 4
mov edx, 0xa
push 0x2d
call fcn.1000a350
add esp, 4
cmp dword [edi + 0x15c], 0
jne 0x1002d742
lea eax, [esp + 0x28]
mov ecx, edi
push eax
call fcn.1002f410
cmp dword [esp + 0x3c], 0x10
jb 0x1002d742
push dword [esp + 0x28]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov ecx, dword [esp + 0x268]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x258]
xor ecx, esp
call fcn.10081b94
add esp, 0x268
ret