Function at 0x1000ff4c
Capabilities:
Check for time delay via gettickcount
Get common file path
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x21c0]
mov eax, 0x2240
call fcn.10045420
mov eax, dword [0x10084adc]
xor eax, ebp
mov dword [ebp + 0x21bc], eax
cmp dword [0x1015668c], 0x55
push ebx
push esi
mov esi, dword [ebp + 0x21c8]
push edi
mov edi, dword [ebp + 0x21d0]
mov dword [ebp - 0x54], edi
mov ebx, 0x10060ec9
jne 0x1000ffa4
mov eax, edi
test edi, edi
jne 0x1000ff93
mov eax, ebx
push eax
push esi
push str.MyBack_start_0:___s__s
push 1
call fcn.100412e2
add esp, 0x10
push 0x10063a50
push esi
mov dword [ebp - 0x50], esi
call fcn.10045450
pop ecx
pop ecx
cmp eax, esi
jne 0x1000ffbe
add esi, 4
mov dword [ebp - 0x50], esi
cmp dword [0x101580b8], 4
jne 0x10010008
push str..tmp
push dword [ebp - 0x50]
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x10010008
cmp dword [0x1015668c], 0x55
jne 0x1000fffc
test edi, edi
jne 0x1000ffe9
mov edi, ebx
push edi
push dword [ebp - 0x50]
push str.MyBack_OFFICE_PPT_1:___s__s
push 1
call fcn.100412e2
add esp, 0x10
mov byte [0x1015786a], 1
jmp 0x100107f5
mov eax, dword [ebp - 0x50]
mov byte [0x1015786a], 0
test eax, eax
je 0x100107f5
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001001d
sub eax, edx
cmp eax, 5
jb 0x100107f5
mov esi, 0x10063b9c
test edi, edi
je 0x10010049
push esi
push edi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x100107f5
push esi
push dword [ebp - 0x50]
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x100107f5
mov esi, 0x10063b94
test edi, edi
je 0x10010076
push esi
push edi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x100107f5
push esi
push dword [ebp - 0x50]
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x100107f5
mov esi, str.cache_
test edi, edi
je 0x100100a3
push esi
push edi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x100107f5
push esi
push dword [ebp - 0x50]
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x100107f5
mov eax, dword [0x10151864]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, 0x2000
jne 0x100100f2
test eax, 0x4000
je 0x100107f5
cmp byte [0x10156760], 0
je 0x100107f5
push 0x10156760
push dword [ebp - 0x50]
call ebx
test eax, eax
je 0x100107f5
push 0x10063b84
mov esi, 0x10155428
push esi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x100107f5
push 0x10063b7c
push esi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x100107f5
push str.install
push esi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x100107f5
push 0x10063b70
push esi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x100107f5
push str.msiexec.exe
push esi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x100107f5
push str.update
push esi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x100107f5
push str.patch
push esi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x100107f5
mov esi, dword [ebp - 0x50]
push str..tmp
push esi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x100101ab
cmp dword [0x101580b8], 4
jne 0x100107f5
push str..lnk
push esi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x100107f5
cmp dword [0x1015668c], 0x55
jne 0x100101e5
mov eax, edi
test edi, edi
jne 0x100101d4
mov eax, 0x10060ec9
push eax
push esi
push str.MyBack_start:___s__s
push 1
call fcn.100412e2
add esp, 0x10
call fcn.1000f9b9
cmp dword [0x100784a8], 0x1f2e3d4c
je 0x10010222
cmp dword [0x1015668c], 0x55
jne 0x100107f5
test edi, edi
jne 0x1001020c
mov edi, 0x10060ec9
push edi
push esi
push str.MyBack_No_Mouse_Cancel:___s__s
push 1
call fcn.100412e2
add esp, 0x10
jmp 0x100107f5
cmp byte [esi], 0
je 0x10010249
cmp dword [0x101580ac], 0
je 0x10010249
cmp byte [0x101481e0], 0
je 0x10010249
push 0x101481e0
push esi
call ebx
test eax, eax
jne 0x100107f5
cmp dword [0x101580c4], 0
je 0x100102a5
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ebx, eax
sub ebx, dword [0x101580cc]
call esi
cmp ebx, 0x2710
jae 0x100102a5
mov eax, dword [0x1015668c]
sub dword [0x101580cc], 0x1388
cmp eax, 0x88
je 0x10010290
cmp eax, 0x44
je 0x10010290
cmp eax, 0x55
jne 0x100107f5
push ebx
push str.MyBack_cancel__d_
push 0
call fcn.100412e2
add esp, 0xc
jmp 0x100107f5
cmp dword [0x1015668c], 0x55
jne 0x100102cc
mov eax, edi
test edi, edi
jne 0x100102b9
mov eax, 0x10060ec9
push eax
push dword [ebp - 0x50]
push str.MyBack_start_1:___s__s
push 1
call fcn.100412e2
add esp, 0x10
mov ebx, 0x200
lea eax, [ebp + 0x1fb4]
push ebx
push eax
call fcn.10007867
lea eax, [ebp + 0x1bb4]
push ebx
push eax
call fcn.10007867
mov esi, dword [ebp - 0x50]
mov al, byte [esi + 1]
add esp, 0x10
cmp al, 0x3a
jne 0x100102fb
push esi
jmp 0x1001033f
mov cl, byte [esi]
cmp cl, 0x5c
je 0x10010306
cmp al, 0x3f
jne 0x10010311
cmp byte [esi + 4], 0x3a
jne 0x10010311
lea eax, [esi + 3]
jmp 0x1001033e
cmp cl, 0x5c
je 0x10010320
cmp al, 0x5c
je 0x10010320
cmp byte [esi + 2], 0x3f
jne 0x10010326
cmp byte [esi + 5], 0x3a
je 0x1001033b
cmp cl, 0x5c
je 0x10010335
cmp al, 0x3f
je 0x10010335
cmp byte [esi + 2], 0x3f
jne 0x1001034f
cmp byte [esi + 5], 0x3a
jne 0x1001034f
lea eax, [esi + 4]
push eax
lea eax, [ebp + 0x1fb4]
push eax
call fcn.1000789a
pop ecx
pop ecx
jmp 0x100103a5
push 0x1ff
lea eax, [ebp + 0x1db5]
push 0
push eax
mov byte [ebp + 0x1db4], 0
call fcn.10045030
add esp, 0xc
lea eax, [ebp + 0x1db4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov al, byte [esi]
cmp al, 0x2e
jne 0x100103c9
cmp byte [esi + 1], 0x5c
jne 0x100103c9
lea eax, [esi + 2]
push eax
lea eax, [ebp + 0x1db4]
push eax
push str._s_s
lea eax, [ebp + 0x1fb4]
push eax
call fcn.10045378
add esp, 0x10
test edi, edi
je 0x100104a8
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100103b2
sub eax, edx
cmp eax, 1
jbe 0x100103dc
cmp byte [edi + 1], 0x3a
jne 0x100103dc
push edi
jmp 0x1001043a
push esi
cmp al, 0x5c
jne 0x1001038a
lea eax, [ebp + 0x1db4]
push eax
push 0x10062cb4
jmp 0x10010396
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100103e1
sub eax, edx
cmp eax, 5
jbe 0x100104a8
mov al, byte [edi]
cmp al, 0x5c
je 0x100103ff
cmp byte [edi + 1], 0x3f
jne 0x1001040a
cmp byte [edi + 4], 0x3a
jne 0x1001040a
lea eax, [edi + 3]
jmp 0x10010439
cmp al, 0x5c
je 0x1001041a
cmp byte [edi + 1], 0x5c
je 0x1001041a
cmp byte [edi + 2], 0x3f
jne 0x10010420
cmp byte [edi + 5], 0x3a
je 0x10010436
cmp al, 0x5c
je 0x10010430
cmp byte [edi + 1], 0x3f
je 0x10010430
cmp byte [edi + 2], 0x3f
jne 0x1001044a
cmp byte [edi + 5], 0x3a
jne 0x1001044a
lea eax, [edi + 4]
push eax
lea eax, [ebp + 0x1bb4]
push eax
call fcn.1000789a
pop ecx
pop ecx
jmp 0x100104a8
push 0x1ff
lea eax, [ebp + 0x1db5]
push 0
push eax
mov byte [ebp + 0x1db4], 0
call fcn.10045030
add esp, 0xc
lea eax, [ebp + 0x1db4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov al, byte [edi]
cmp al, 0x2e
jne 0x10010684
cmp byte [edi + 1], 0x5c
jne 0x10010684
lea eax, [edi + 2]
push eax
lea eax, [ebp + 0x1db4]
push eax
push str._s_s
lea eax, [ebp + 0x1bb4]
push eax
call fcn.10045378
add esp, 0x10
cmp dword [0x1015668c], 0x55
jne 0x100104cf
lea eax, [ebp + 0x1fb4]
push eax
movzx eax, byte [ebp + 0x21d4]
push eax
push str.MyBack_bChkisTargetRansom:___d__s
push 1
call fcn.100412e2
add esp, 0x10
cmp byte [ebp + 0x21d4], 0
je 0x100104f0
lea eax, [ebp + 0x1fb4]
push 1
push eax
call fcn.1003349c
pop ecx
pop ecx
test eax, eax
je 0x100107f5
cmp dword [0x101580b8], 0
jne 0x10010502
cmp byte [0x1015788a], 0
je 0x1001052a
push 0x24
push esi
call fcn.10044f10
pop ecx
pop ecx
test eax, eax
jne 0x100107f5
test edi, edi
je 0x1001052a
push 0x24
push edi
call fcn.10044f10
pop ecx
pop ecx
test eax, eax
jne 0x100107f5
test dword [0x10151864], 0x200000
jne 0x1001058d
push 0x10063ac0
push dword [ebp - 0x50]
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x100107f5
mov byte [ebp + 0x21b4], al
lea edi, [ebp + 0x21b5]
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp - 0x50]
movsx eax, byte [eax]
push eax
lea eax, [ebp + 0x21b4]
push str._c:_
push eax
call fcn.10045378
add esp, 0xc
lea eax, [ebp + 0x21b4]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 4
je 0x100107f5
cmp dword [0x1015668c], 0x55
jne 0x100105b5
mov eax, dword [ebp - 0x54]
test eax, eax
jne 0x100105a2
mov eax, 0x10060ec9
push eax
push dword [ebp - 0x50]
push str.MyBack_end_:___s__s
push 1
call fcn.100412e2
add esp, 0x10
mov esi, 0x1ff
push esi
xor edi, edi
lea eax, [ebp + 0x17b5]
push edi
push eax
mov byte [ebp + 0x17b4], 0
call fcn.10045030
push 0x3ff
lea eax, [ebp + 0x13b5]
push edi
push eax
mov byte [ebp + 0x13b4], 0
call fcn.10045030
push 0x13ff
lea eax, [ebp - 0x4b]
push edi
push eax
mov byte [ebp - 0x4c], 0
call fcn.10045030
lea eax, [ebp + 0x17b4]
push str.SoftWareTrojanCut_tc_FileB
push eax
call fcn.10045378
mov eax, dword [0x102b5a40]
cdq
mov ecx, 0xea60
idiv ecx
lea eax, [ebp + 0x13b4]
add edx, 0x64
inc dword [0x102b5a40]
push edx
push 0x10061188
push eax
mov dword [ebp + 0x21b4], edx
call fcn.10045378
push esi
lea eax, [ebp + 0x19b5]
push edi
push eax
mov byte [ebp + 0x19b4], 0
call fcn.10045030
lea eax, [ebp - 0x5c]
add esp, 0x44
push eax
call fcn.100457db
lea eax, [ebp - 0x5c]
push eax
call fcn.100457b4
pop ecx
pop ecx
cmp eax, edi
je 0x1001069e
push eax
push str._Y__m__d__H:_M:_S
lea eax, [ebp + 0x19b4]
push ebx
push eax
call fcn.10046465
add esp, 0x10
jmp 0x100106b1
push edi
cmp al, 0x5c
jne 0x1001048d
lea eax, [ebp + 0x1db4]
push eax
push 0x10062cb4
jmp 0x10010499
lea eax, [ebp + 0x19b4]
push str.0000
push eax
call fcn.1000789a
pop ecx
pop ecx
cmp dword [0x101580b8], 4
mov eax, dword [ebp + 0x21cc]
mov dword [ebp - 0x50], eax
jne 0x100106c9
or eax, 0x10
mov dword [ebp - 0x50], eax
and dword [ebp - 0x80], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
push 8
xor eax, eax
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
cmp dword [ebp - 0x54], eax
je 0x100106ed
lea eax, [ebp - 0x80]
push eax
push 0
push dword [ebp - 0x54]
call esi
push 1
push 0
push 0
push dword [ebp - 0x64]
call fcn.10047f00
mov ecx, dword [ebp - 0x60]
xor edi, edi
add eax, ecx
adc edx, edi
mov ecx, eax
or ecx, edx
jne 0x1001072d
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp + 0x1fb4]
push eax
call esi
push 1
push edi
push edi
push dword [ebp - 0x64]
call fcn.10047f00
mov ecx, dword [ebp - 0x60]
xor esi, esi
add eax, ecx
adc edx, esi
cmp byte [0x102b5630], 0
je 0x1001073d
push 0x102b5630
jmp 0x10010742
push 0x10155a28
push edx
push eax
lea eax, [ebp + 0x1fb4]
push eax
push dword [ebp - 0x50]
lea eax, [ebp + 0x19b4]
push ebx
push eax
lea eax, [ebp - 0x4c]
push str._s_d_d_s_I64d_s
push eax
call fcn.10045378
add esp, 0x24
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp + 0x13b4]
push eax
lea eax, [ebp + 0x17b4]
push eax
push reloc.WS2_32.dll_bind
call fcn.100422d1
add esp, 0x10
cmp dword [0x1015668c], 0x55
jne 0x100107a9
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp + 0x13b4]
push eax
push str.MyBack_GoGo:___s__s
push 1
call fcn.100412e2
add esp, 0x10
mov esi, dword [sym.imp.USER32.dll_FindWindowA]
mov edi, 0x100610e0
push edi
xor ebx, ebx
push ebx
call esi
cmp eax, ebx
jne 0x100107e2
push edi
push ebx
call esi
cmp eax, ebx
jne 0x100107e2
push ebx
push str.tc_hnd
push str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push reloc.WS2_32.dll_bind
call fcn.10040ccf
add esp, 0x10
cmp eax, ebx
je 0x100107f5
push ebx
push dword [ebp + 0x21b4]
push 0xd02
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov ecx, dword [ebp + 0x21bc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004501f
add ebp, 0x21c0
leave
ret