Function at 0x10001112
Capabilities:
Check for time delay via gettickcount
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp + 8]
mov dword [0x10007268], eax
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp + 0xc]
mov dword [0x1000726c], eax
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp + 0x10]
mov dword [0x10007270], eax
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp + 0x14]
mov dword [0x10007274], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x10], eax
cmp dword [0x10006030], 0xffffffff
je 0x10001258
cmp dword [ebp + 8], 0xffffffff
jne 0x100011a2
mov eax, dword [0x10006054]
push eax
call fcn.10001072
add esp, 4
mov eax, dword [0x10006030]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x10006030], 0xffffffff
jmp 0x10001494
cmp dword [ebp + 8], 0x30
jne 0x100011ca
mov eax, dword [0x10007270]
push eax
mov eax, dword [0x1000726c]
push eax
call fcn.100014b5
add esp, 8
jmp 0x100014ae
cmp dword [ebp + 8], 0x31
jne 0x100011e7
mov eax, dword [0x1000726c]
push eax
call fcn.10001072
add esp, 4
jmp 0x100014ae
push 0
lea eax, [ebp - 0x118]
push eax
push 8
push 0x10007278
push 0x10
push 0x10007268
push 0x160010
mov eax, dword [0x10006030]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
je 0x1000123d
mov eax, dword [0x1000727c]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x10007278]
jmp 0x100014ae
mov eax, dword [0x10006030]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x10006030], 0xffffffff
jmp 0x10001494
cmp dword [0x10006040], 0
je 0x10001298
cmp dword [ebp + 8], 0xffffffff
jne 0x1000127e
mov dword [0x10006040], 0
jmp 0x10001494
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
not ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
imul ebx, eax
mov eax, ebx
jmp 0x100014ae
mov dword [0x10006034], 0
mov eax, dword [ebp - 0x10]
not eax
test eax, 0x80000000
je 0x10001382
push str..PARCLASS0
push 0x10006070
lea eax, [ebp - 0x114]
push eax
call fcn.10001a70
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
call fcn.100019f0
add esp, 4
lea eax, [ebp + eax - 0x115]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 1
jmp 0x100012f3
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jg 0x1000137d
mov eax, dword [ebp - 4]
add eax, 0x30
mov ecx, dword [ebp - 8]
mov byte [ecx], al
push pe_nt_image_headers32
push 0x10007278
push 0x10007268
lea eax, [ebp - 0x114]
push eax
call fcn.10001616
add esp, 0x10
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
je 0x1000134f
mov eax, dword [0x1000727c]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x10007278]
jmp 0x100014ae
cmp dword [0x1000727c], 5
jne 0x10001366
mov dword [0x10006034], 1
cmp dword [0x1000727c], 2
jne 0x10001378
jmp 0x1000137d
jmp 0x100012f0
jmp 0x1000147c
xor eax, eax
mov al, byte [ebp - 0x10]
cmp eax, 4
jl 0x10001441
push 0x4000000
push 0x10007278
push 0x10007268
push str..PARCLASS.VXD
call fcn.10001616
add esp, 0x10
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
je 0x100013d5
mov eax, dword [0x1000727c]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x10007278]
jmp 0x100014ae
cmp dword [0x1000727c], 5
jne 0x100013ec
mov dword [0x10006034], 1
cmp dword [0x1000727c], 2
jne 0x1000143c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
not ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
imul ebx, eax
mov dword [ebp - 0x11c], ebx
cmp dword [ebp - 0x11c], 0
je 0x1000143c
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [0x10006040], 1
mov eax, dword [ebp - 0x11c]
jmp 0x100014ae
jmp 0x1000147c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
not ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
imul ebx, eax
mov dword [ebp - 0x11c], ebx
cmp dword [ebp - 0x11c], 0
je 0x1000147c
mov dword [0x10006040], 1
mov eax, dword [ebp - 0x11c]
jmp 0x100014ae
cmp dword [0x10006034], 1
sbb eax, eax
and eax, 0x1ffffffc
add eax, 5
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
not ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
imul ebx, eax
mov eax, ebx
jmp 0x100014ae
pop edi
pop esi
pop ebx
leave
ret 0x10