Function at 0x10002b84
Capabilities:
Check for time delay via gettickcount
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
push edi
mov dword [ebp - 0x14], 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x10008134
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
xor eax, dword [ebp - 0xc]
mov dword [0x10009368], eax
mov eax, dword [ebp + 0xc]
xor eax, dword [ebp - 0xc]
mov dword [0x1000936c], eax
mov eax, dword [ebp + 0x10]
xor eax, dword [ebp - 0xc]
mov dword [0x10009370], eax
mov eax, dword [ebp + 0x14]
xor eax, dword [ebp - 0xc]
mov dword [0x10009374], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x10], eax
cmp dword [0x10008148], 0xffffffff
je 0x10002c9a
cmp dword [ebp + 8], 0xffffffff
jne 0x10002c29
cmp dword [ebp - 0x14], 0
jne 0x10002c24
mov eax, dword [0x10008148]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x10008148], 0xffffffff
mov dword [ebp - 0x14], 1
jmp 0x10002eeb
push 0
lea eax, [ebp - 0x11c]
push eax
push 8
push 0x10009378
push 0x10
push 0x10009368
push 0x160010
mov eax, dword [0x10008148]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
je 0x10002c7f
mov eax, dword [0x1000937c]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x10009378]
jmp 0x10002f05
mov eax, dword [0x10008148]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x10008148], 0xffffffff
jmp 0x10002eeb
cmp dword [0x10008150], 0
je 0x10002cdd
cmp dword [ebp + 8], 0xffffffff
jne 0x10002cc0
mov dword [0x10008150], 0
jmp 0x10002eeb
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call 0x10001020
add esp, 0x10
jmp 0x10002f05
mov dword [0x1000814c], 0
mov eax, dword [ebp - 0x10]
not eax
test eax, 0x80000000
je 0x10002dc7
push str..PARCLASS0
push 0x10008170
lea eax, [ebp - 0x118]
push eax
call fcn.100033c0
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call fcn.10003340
add esp, 4
lea eax, [ebp + eax - 0x119]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 1
jmp 0x10002d38
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jg 0x10002dc2
mov eax, dword [ebp - 4]
add eax, 0x30
mov ecx, dword [ebp - 8]
mov byte [ecx], al
push pe_nt_image_headers32
push 0x10009378
push 0x10009368
lea eax, [ebp - 0x118]
push eax
call fcn.10002f0c
add esp, 0x10
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
je 0x10002d94
mov eax, dword [0x1000937c]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x10009378]
jmp 0x10002f05
cmp dword [0x1000937c], 5
jne 0x10002dab
mov dword [0x1000814c], 1
cmp dword [0x1000937c], 2
jne 0x10002dbd
jmp 0x10002dc2
jmp 0x10002d35
jmp 0x10002ed3
xor eax, eax
mov al, byte [ebp - 0x10]
cmp eax, 4
jl 0x10002e93
push 0x4000000
push 0x10009378
push 0x10009368
push str..PARCLASS.VXD
call fcn.10002f0c
add esp, 0x10
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
je 0x10002e1a
mov eax, dword [0x1000937c]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x10009378]
jmp 0x10002f05
cmp dword [0x1000937c], 5
jne 0x10002e31
mov dword [0x1000814c], 1
cmp dword [0x1000937c], 2
jne 0x10002e8e
mov eax, dword [0x10009374]
push eax
mov eax, dword [0x10009370]
push eax
mov eax, dword [0x1000936c]
push eax
mov eax, dword [0x10009368]
push eax
call 0x10001020
add esp, 0x10
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
je 0x10002e8e
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [0x10008150], 1
mov eax, dword [ebp - 0x120]
jmp 0x10002f05
jmp 0x10002ed3
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call 0x10001020
add esp, 0x10
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
je 0x10002ed3
mov dword [0x10008150], 1
mov eax, dword [ebp - 0x120]
jmp 0x10002f05
cmp dword [0x1000814c], 1
sbb eax, eax
and eax, 0x1ffffffc
add eax, 5
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
not ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
imul ebx, eax
mov eax, ebx
jmp 0x10002f05
pop edi
pop esi
pop ebx
leave
ret 0x10