Function at 0x1000fe0c
Capabilities:
Check for time delay via gettickcount
Get common file path
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x21c0]
mov eax, 0x2240
call fcn.10044f70
mov eax, dword [0x10083adc]
xor eax, ebp
mov dword [ebp + 0x21bc], eax
cmp dword [0x1015568c], 0x55
push ebx
push esi
mov esi, dword [ebp + 0x21c8]
push edi
mov edi, dword [ebp + 0x21d0]
mov dword [ebp - 0x54], edi
mov ebx, 0x10060ec9
jne 0x1000fe64
mov eax, edi
test edi, edi
jne 0x1000fe53
mov eax, ebx
push eax
push esi
push str.MyBack_start_0:___s__s
push 1
call fcn.1004122a
add esp, 0x10
push 0x100639e0
push esi
mov dword [ebp - 0x50], esi
call fcn.10044fa0
pop ecx
pop ecx
cmp eax, esi
jne 0x1000fe7e
add esi, 4
mov dword [ebp - 0x50], esi
cmp dword [0x101570b8], 4
jne 0x1000fec8
push str..tmp
push dword [ebp - 0x50]
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x1000fec8
cmp dword [0x1015568c], 0x55
jne 0x1000febc
test edi, edi
jne 0x1000fea9
mov edi, ebx
push edi
push dword [ebp - 0x50]
push str.MyBack_OFFICE_PPT_1:___s__s
push 1
call fcn.1004122a
add esp, 0x10
mov byte [0x1015686a], 1
jmp 0x100106b5
mov eax, dword [ebp - 0x50]
mov byte [0x1015686a], 0
test eax, eax
je 0x100106b5
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000fedd
sub eax, edx
cmp eax, 5
jb 0x100106b5
mov esi, 0x10063b2c
test edi, edi
je 0x1000ff09
push esi
push edi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x100106b5
push esi
push dword [ebp - 0x50]
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x100106b5
mov esi, 0x10063b24
test edi, edi
je 0x1000ff36
push esi
push edi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x100106b5
push esi
push dword [ebp - 0x50]
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x100106b5
mov esi, str.cache_
test edi, edi
je 0x1000ff63
push esi
push edi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x100106b5
push esi
push dword [ebp - 0x50]
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x100106b5
mov eax, dword [0x10150864]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, 0x2000
jne 0x1000ffb2
test eax, 0x4000
je 0x100106b5
cmp byte [0x10155760], 0
je 0x100106b5
push 0x10155760
push dword [ebp - 0x50]
call ebx
test eax, eax
je 0x100106b5
push 0x10063b14
mov esi, 0x10154428
push esi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x100106b5
push 0x10063b0c
push esi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x100106b5
push str.install
push esi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x100106b5
push 0x10063b00
push esi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x100106b5
push str.msiexec.exe
push esi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x100106b5
push str.update
push esi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x100106b5
push str.patch
push esi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x100106b5
mov esi, dword [ebp - 0x50]
push str..tmp
push esi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x1001006b
cmp dword [0x101570b8], 4
jne 0x100106b5
push str..lnk
push esi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x100106b5
cmp dword [0x1015568c], 0x55
jne 0x100100a5
mov eax, edi
test edi, edi
jne 0x10010094
mov eax, 0x10060ec9
push eax
push esi
push str.MyBack_start:___s__s
push 1
call fcn.1004122a
add esp, 0x10
call fcn.1000f879
cmp dword [0x100774a8], 0x1f2e3d4c
je 0x100100e2
cmp dword [0x1015568c], 0x55
jne 0x100106b5
test edi, edi
jne 0x100100cc
mov edi, 0x10060ec9
push edi
push esi
push str.MyBack_No_Mouse_Cancel:___s__s
push 1
call fcn.1004122a
add esp, 0x10
jmp 0x100106b5
cmp byte [esi], 0
je 0x10010109
cmp dword [0x101570ac], 0
je 0x10010109
cmp byte [0x101471e0], 0
je 0x10010109
push 0x101471e0
push esi
call ebx
test eax, eax
jne 0x100106b5
cmp dword [0x101570c4], 0
je 0x10010165
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ebx, eax
sub ebx, dword [0x101570cc]
call esi
cmp ebx, 0x2710
jae 0x10010165
mov eax, dword [0x1015568c]
sub dword [0x101570cc], 0x1388
cmp eax, 0x88
je 0x10010150
cmp eax, 0x44
je 0x10010150
cmp eax, 0x55
jne 0x100106b5
push ebx
push str.MyBack_cancel__d_
push 0
call fcn.1004122a
add esp, 0xc
jmp 0x100106b5
cmp dword [0x1015568c], 0x55
jne 0x1001018c
mov eax, edi
test edi, edi
jne 0x10010179
mov eax, 0x10060ec9
push eax
push dword [ebp - 0x50]
push str.MyBack_start_1:___s__s
push 1
call fcn.1004122a
add esp, 0x10
mov ebx, 0x200
lea eax, [ebp + 0x1fb4]
push ebx
push eax
call fcn.10007867
lea eax, [ebp + 0x1bb4]
push ebx
push eax
call fcn.10007867
mov esi, dword [ebp - 0x50]
mov al, byte [esi + 1]
add esp, 0x10
cmp al, 0x3a
jne 0x100101bb
push esi
jmp 0x100101ff
mov cl, byte [esi]
cmp cl, 0x5c
je 0x100101c6
cmp al, 0x3f
jne 0x100101d1
cmp byte [esi + 4], 0x3a
jne 0x100101d1
lea eax, [esi + 3]
jmp 0x100101fe
cmp cl, 0x5c
je 0x100101e0
cmp al, 0x5c
je 0x100101e0
cmp byte [esi + 2], 0x3f
jne 0x100101e6
cmp byte [esi + 5], 0x3a
je 0x100101fb
cmp cl, 0x5c
je 0x100101f5
cmp al, 0x3f
je 0x100101f5
cmp byte [esi + 2], 0x3f
jne 0x1001020f
cmp byte [esi + 5], 0x3a
jne 0x1001020f
lea eax, [esi + 4]
push eax
lea eax, [ebp + 0x1fb4]
push eax
call fcn.1000789a
pop ecx
pop ecx
jmp 0x10010265
push 0x1ff
lea eax, [ebp + 0x1db5]
push 0
push eax
mov byte [ebp + 0x1db4], 0
call fcn.10044b80
add esp, 0xc
lea eax, [ebp + 0x1db4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov al, byte [esi]
cmp al, 0x2e
jne 0x10010289
cmp byte [esi + 1], 0x5c
jne 0x10010289
lea eax, [esi + 2]
push eax
lea eax, [ebp + 0x1db4]
push eax
push str._s_s
lea eax, [ebp + 0x1fb4]
push eax
call fcn.10044ec8
add esp, 0x10
test edi, edi
je 0x10010368
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10010272
sub eax, edx
cmp eax, 1
jbe 0x1001029c
cmp byte [edi + 1], 0x3a
jne 0x1001029c
push edi
jmp 0x100102fa
push esi
cmp al, 0x5c
jne 0x1001024a
lea eax, [ebp + 0x1db4]
push eax
push 0x10062ca4
jmp 0x10010256
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100102a1
sub eax, edx
cmp eax, 5
jbe 0x10010368
mov al, byte [edi]
cmp al, 0x5c
je 0x100102bf
cmp byte [edi + 1], 0x3f
jne 0x100102ca
cmp byte [edi + 4], 0x3a
jne 0x100102ca
lea eax, [edi + 3]
jmp 0x100102f9
cmp al, 0x5c
je 0x100102da
cmp byte [edi + 1], 0x5c
je 0x100102da
cmp byte [edi + 2], 0x3f
jne 0x100102e0
cmp byte [edi + 5], 0x3a
je 0x100102f6
cmp al, 0x5c
je 0x100102f0
cmp byte [edi + 1], 0x3f
je 0x100102f0
cmp byte [edi + 2], 0x3f
jne 0x1001030a
cmp byte [edi + 5], 0x3a
jne 0x1001030a
lea eax, [edi + 4]
push eax
lea eax, [ebp + 0x1bb4]
push eax
call fcn.1000789a
pop ecx
pop ecx
jmp 0x10010368
push 0x1ff
lea eax, [ebp + 0x1db5]
push 0
push eax
mov byte [ebp + 0x1db4], 0
call fcn.10044b80
add esp, 0xc
lea eax, [ebp + 0x1db4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov al, byte [edi]
cmp al, 0x2e
jne 0x10010544
cmp byte [edi + 1], 0x5c
jne 0x10010544
lea eax, [edi + 2]
push eax
lea eax, [ebp + 0x1db4]
push eax
push str._s_s
lea eax, [ebp + 0x1bb4]
push eax
call fcn.10044ec8
add esp, 0x10
cmp dword [0x1015568c], 0x55
jne 0x1001038f
lea eax, [ebp + 0x1fb4]
push eax
movzx eax, byte [ebp + 0x21d4]
push eax
push str.MyBack_bChkisTargetRansom:___d__s
push 1
call fcn.1004122a
add esp, 0x10
cmp byte [ebp + 0x21d4], 0
je 0x100103b0
lea eax, [ebp + 0x1fb4]
push 1
push eax
call fcn.10033316
pop ecx
pop ecx
test eax, eax
je 0x100106b5
cmp dword [0x101570b8], 0
jne 0x100103c2
cmp byte [0x1015688a], 0
je 0x100103ea
push 0x24
push esi
call fcn.10044a60
pop ecx
pop ecx
test eax, eax
jne 0x100106b5
test edi, edi
je 0x100103ea
push 0x24
push edi
call fcn.10044a60
pop ecx
pop ecx
test eax, eax
jne 0x100106b5
test dword [0x10150864], 0x200000
jne 0x1001044d
push 0x10063a50
push dword [ebp - 0x50]
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x100106b5
mov byte [ebp + 0x21b4], al
lea edi, [ebp + 0x21b5]
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp - 0x50]
movsx eax, byte [eax]
push eax
lea eax, [ebp + 0x21b4]
push str._c:_
push eax
call fcn.10044ec8
add esp, 0xc
lea eax, [ebp + 0x21b4]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 4
je 0x100106b5
cmp dword [0x1015568c], 0x55
jne 0x10010475
mov eax, dword [ebp - 0x54]
test eax, eax
jne 0x10010462
mov eax, 0x10060ec9
push eax
push dword [ebp - 0x50]
push str.MyBack_end_:___s__s
push 1
call fcn.1004122a
add esp, 0x10
mov esi, 0x1ff
push esi
xor edi, edi
lea eax, [ebp + 0x17b5]
push edi
push eax
mov byte [ebp + 0x17b4], 0
call fcn.10044b80
push 0x3ff
lea eax, [ebp + 0x13b5]
push edi
push eax
mov byte [ebp + 0x13b4], 0
call fcn.10044b80
push 0x13ff
lea eax, [ebp - 0x4b]
push edi
push eax
mov byte [ebp - 0x4c], 0
call fcn.10044b80
lea eax, [ebp + 0x17b4]
push str.SoftWare_trueEP_tc_FileB
push eax
call fcn.10044ec8
mov eax, dword [0x102b4a40]
cdq
mov ecx, 0xea60
idiv ecx
lea eax, [ebp + 0x13b4]
add edx, 0x64
inc dword [0x102b4a40]
push edx
push 0x10061178
push eax
mov dword [ebp + 0x21b4], edx
call fcn.10044ec8
push esi
lea eax, [ebp + 0x19b5]
push edi
push eax
mov byte [ebp + 0x19b4], 0
call fcn.10044b80
lea eax, [ebp - 0x5c]
add esp, 0x44
push eax
call fcn.1004532b
lea eax, [ebp - 0x5c]
push eax
call fcn.10045304
pop ecx
pop ecx
cmp eax, edi
je 0x1001055e
push eax
push str._Y__m__d__H:_M:_S
lea eax, [ebp + 0x19b4]
push ebx
push eax
call fcn.10045fb5
add esp, 0x10
jmp 0x10010571
push edi
cmp al, 0x5c
jne 0x1001034d
lea eax, [ebp + 0x1db4]
push eax
push 0x10062ca4
jmp 0x10010359
lea eax, [ebp + 0x19b4]
push str.0000
push eax
call fcn.1000789a
pop ecx
pop ecx
cmp dword [0x101570b8], 4
mov eax, dword [ebp + 0x21cc]
mov dword [ebp - 0x50], eax
jne 0x10010589
or eax, 0x10
mov dword [ebp - 0x50], eax
and dword [ebp - 0x80], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
push 8
xor eax, eax
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
cmp dword [ebp - 0x54], eax
je 0x100105ad
lea eax, [ebp - 0x80]
push eax
push 0
push dword [ebp - 0x54]
call esi
push 1
push 0
push 0
push dword [ebp - 0x64]
call fcn.10047a50
mov ecx, dword [ebp - 0x60]
xor edi, edi
add eax, ecx
adc edx, edi
mov ecx, eax
or ecx, edx
jne 0x100105ed
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp + 0x1fb4]
push eax
call esi
push 1
push edi
push edi
push dword [ebp - 0x64]
call fcn.10047a50
mov ecx, dword [ebp - 0x60]
xor esi, esi
add eax, ecx
adc edx, esi
cmp byte [0x102b4630], 0
je 0x100105fd
push 0x102b4630
jmp 0x10010602
push 0x10154a28
push edx
push eax
lea eax, [ebp + 0x1fb4]
push eax
push dword [ebp - 0x50]
lea eax, [ebp + 0x19b4]
push ebx
push eax
lea eax, [ebp - 0x4c]
push str._s_d_d_s_I64d_s
push eax
call fcn.10044ec8
add esp, 0x24
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp + 0x13b4]
push eax
lea eax, [ebp + 0x17b4]
push eax
push reloc.WS2_32.dll_bind
call fcn.10042219
add esp, 0x10
cmp dword [0x1015568c], 0x55
jne 0x10010669
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp + 0x13b4]
push eax
push str.MyBack_GoGo:___s__s
push 1
call fcn.1004122a
add esp, 0x10
mov esi, dword [sym.imp.USER32.dll_FindWindowA]
mov edi, 0x100610d8
push edi
xor ebx, ebx
push ebx
call esi
cmp eax, ebx
jne 0x100106a2
push edi
push ebx
call esi
cmp eax, ebx
jne 0x100106a2
push ebx
push str.tc_hnd
push str.SOFTWARE_trueEPTC_Env_tc_COMMUNICATION
push reloc.WS2_32.dll_bind
call fcn.10040c17
add esp, 0x10
cmp eax, ebx
je 0x100106b5
push ebx
push dword [ebp + 0x21b4]
push 0xd02
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov ecx, dword [ebp + 0x21bc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10044b6f
add ebp, 0x21c0
leave
ret