Function at 0x10019eb0
Capabilities:
Check for time delay via gettickcount
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2c68
call fcn.1003e9a0
mov eax, dword [0x10067bf0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
movzx eax, byte [0x10120b5e]
test eax, eax
jne 0x10019ed8
jmp 0x1001a867
cmp dword [ebp + 8], 0
je 0x10019eef
mov ecx, dword [ebp + 8]
push ecx
call fcn.1003e420
add esp, 4
cmp eax, 5
jae 0x10019ef4
jmp 0x1001a867
mov edx, dword [0x1011c7dc]
and edx, 0x2000
jne 0x10019f2c
mov eax, dword [0x1011c7dc]
and eax, 0x4000
je 0x10019f2e
movsx ecx, byte [0x1011fe50]
test ecx, ecx
je 0x10019f2e
push 0x1011fe50
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10019f2e
jmp 0x10019f33
jmp 0x1001a867
push str.setup
push 0x1011f118
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x10019fbf
push str.temp
push 0x1011f118
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x10019fbf
push str.install
push 0x1011f118
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x10019fbf
push 0x1005b150
push 0x1011f118
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x10019fbf
push str.msiexec.exe
push 0x1011f118
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x10019fbf
push str.update
push 0x1011f118
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x10019fbf
push str.patch
push 0x1011f118
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10019fc4
jmp 0x1001a867
push 0x1005b170
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x10019fea
push str..lnk
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10019fef
jmp 0x1001a867
cmp dword [0x1011fd7c], 0x55
jne 0x1001a00f
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
push str.MyBack_start:___s__s
push 1
call fcn.1003b7a0
add esp, 0x10
cmp dword [0x10067500], 0x1f2e3d4c
je 0x1001a020
jmp 0x1001a867
cmp dword [0x10121394], 0
je 0x1001a04c
movsx ecx, byte [0x10115c70]
test ecx, ecx
je 0x1001a04c
push 0x10115c70
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1001a04c
jmp 0x1001a867
cmp dword [0x101213a0], 0
je 0x1001a0e4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101213a4]
mov dword [ebp - 0x2864], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101213a4]
jmp 0x1001a090
cmp dword [ebp - 0x2864], 0x2710
jae 0x1001a0e4
mov eax, dword [0x101213a4]
sub eax, 0x1388
mov dword [0x101213a4], eax
cmp dword [0x1011fd7c], 0x88
je 0x1001a0c9
cmp dword [0x1011fd7c], 0x44
je 0x1001a0c9
cmp dword [0x1011fd7c], 0x55
jne 0x1001a0df
mov ecx, dword [ebp - 0x2864]
push ecx
push str.MyBack_cancel__d_
push 0
call fcn.1003b7a0
add esp, 0xc
jmp 0x1001a867
cmp dword [0x1012139c], 4
jne 0x1001a10e
push 0x1005b1ac
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1001a10e
mov byte [0x10120b5c], 1
jmp 0x1001a867
mov byte [0x10120b5c], 0
push 0x200
lea eax, [ebp - 0x1a08]
push eax
call fcn.100083d0
add esp, 8
push 0x200
lea ecx, [ebp - 0x2458]
push ecx
call fcn.100083d0
add esp, 8
mov edx, dword [ebp + 8]
movsx eax, byte [edx + 1]
cmp eax, 0x3a
jne 0x1001a161
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x1a08]
push edx
call fcn.10008420
add esp, 8
jmp 0x1001a2e8
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
cmp ecx, 0x5c
je 0x1001a178
mov edx, dword [ebp + 8]
movsx eax, byte [edx + 1]
cmp eax, 0x3f
jne 0x1001a19f
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + 4]
cmp edx, 0x3a
jne 0x1001a19f
mov eax, dword [ebp + 8]
add eax, 3
push eax
lea ecx, [ebp - 0x1a08]
push ecx
call fcn.10008420
add esp, 8
jmp 0x1001a2e8
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
cmp eax, 0x5c
je 0x1001a1c2
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + 1]
cmp edx, 0x5c
je 0x1001a1c2
mov eax, dword [ebp + 8]
movsx ecx, byte [eax + 2]
cmp ecx, 0x3f
jne 0x1001a1e9
mov edx, dword [ebp + 8]
movsx eax, byte [edx + 5]
cmp eax, 0x3a
jne 0x1001a1e9
mov ecx, dword [ebp + 8]
add ecx, 4
push ecx
lea edx, [ebp - 0x1a08]
push edx
call fcn.10008420
add esp, 8
jmp 0x1001a2e8
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
cmp ecx, 0x5c
je 0x1001a20c
mov edx, dword [ebp + 8]
movsx eax, byte [edx + 1]
cmp eax, 0x3f
je 0x1001a20c
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + 2]
cmp edx, 0x3f
jne 0x1001a233
mov eax, dword [ebp + 8]
movsx ecx, byte [eax + 5]
cmp ecx, 0x3a
jne 0x1001a233
mov edx, dword [ebp + 8]
add edx, 4
push edx
lea eax, [ebp - 0x1a08]
push eax
call fcn.10008420
add esp, 8
jmp 0x1001a2e8
mov byte [ebp - 0x2a68], 0
push 0x1ff
push 0
lea ecx, [ebp - 0x2a67]
push ecx
call fcn.1003e4c0
add esp, 0xc
lea edx, [ebp - 0x2a68]
push edx
push 0x200
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
cmp ecx, 0x2e
jne 0x1001a29d
mov edx, dword [ebp + 8]
movsx eax, byte [edx + 1]
cmp eax, 0x5c
jne 0x1001a29d
mov ecx, dword [ebp + 8]
add ecx, 2
push ecx
lea edx, [ebp - 0x2a68]
push edx
push 0x1005b1b4
lea eax, [ebp - 0x1a08]
push eax
call fcn.1003e91e
add esp, 0x10
jmp 0x1001a2e8
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
cmp edx, 0x5c
jne 0x1001a2c9
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x2a68]
push ecx
push 0x1005b1bc
lea edx, [ebp - 0x1a08]
push edx
call fcn.1003e91e
add esp, 0x10
jmp 0x1001a2e8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x2a68]
push ecx
push 0x1005b1c4
lea edx, [ebp - 0x1a08]
push edx
call fcn.1003e91e
add esp, 0x10
cmp dword [ebp + 0x10], 0
je 0x1001a323
mov eax, dword [ebp + 0x10]
push eax
call fcn.1003e420
add esp, 4
cmp eax, 1
jbe 0x1001a323
mov ecx, dword [ebp + 0x10]
movsx edx, byte [ecx + 1]
cmp edx, 0x3a
jne 0x1001a323
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x2458]
push ecx
call fcn.10008420
add esp, 8
jmp 0x1001a4c9
cmp dword [ebp + 0x10], 0
je 0x1001a4c9
mov edx, dword [ebp + 0x10]
push edx
call fcn.1003e420
add esp, 4
cmp eax, 5
jbe 0x1001a4c9
mov eax, dword [ebp + 0x10]
movsx ecx, byte [eax]
cmp ecx, 0x5c
je 0x1001a359
mov edx, dword [ebp + 0x10]
movsx eax, byte [edx + 1]
cmp eax, 0x3f
jne 0x1001a380
mov ecx, dword [ebp + 0x10]
movsx edx, byte [ecx + 4]
cmp edx, 0x3a
jne 0x1001a380
mov eax, dword [ebp + 0x10]
add eax, 3
push eax
lea ecx, [ebp - 0x2458]
push ecx
call fcn.10008420
add esp, 8
jmp 0x1001a4c9
mov edx, dword [ebp + 0x10]
movsx eax, byte [edx]
cmp eax, 0x5c
je 0x1001a3a3
mov ecx, dword [ebp + 0x10]
movsx edx, byte [ecx + 1]
cmp edx, 0x5c
je 0x1001a3a3
mov eax, dword [ebp + 0x10]
movsx ecx, byte [eax + 2]
cmp ecx, 0x3f
jne 0x1001a3ca
mov edx, dword [ebp + 0x10]
movsx eax, byte [edx + 5]
cmp eax, 0x3a
jne 0x1001a3ca
mov ecx, dword [ebp + 0x10]
add ecx, 4
push ecx
lea edx, [ebp - 0x2458]
push edx
call fcn.10008420
add esp, 8
jmp 0x1001a4c9
mov eax, dword [ebp + 0x10]
movsx ecx, byte [eax]
cmp ecx, 0x5c
je 0x1001a3ed
mov edx, dword [ebp + 0x10]
movsx eax, byte [edx + 1]
cmp eax, 0x3f
je 0x1001a3ed
mov ecx, dword [ebp + 0x10]
movsx edx, byte [ecx + 2]
cmp edx, 0x3f
jne 0x1001a414
mov eax, dword [ebp + 0x10]
movsx ecx, byte [eax + 5]
cmp ecx, 0x3a
jne 0x1001a414
mov edx, dword [ebp + 0x10]
add edx, 4
push edx
lea eax, [ebp - 0x2458]
push eax
call fcn.10008420
add esp, 8
jmp 0x1001a4c9
mov byte [ebp - 0x2c68], 0
push 0x1ff
push 0
lea ecx, [ebp - 0x2c67]
push ecx
call fcn.1003e4c0
add esp, 0xc
lea edx, [ebp - 0x2c68]
push edx
push 0x200
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, dword [ebp + 0x10]
movsx ecx, byte [eax]
cmp ecx, 0x2e
jne 0x1001a47e
mov edx, dword [ebp + 0x10]
movsx eax, byte [edx + 1]
cmp eax, 0x5c
jne 0x1001a47e
mov ecx, dword [ebp + 0x10]
add ecx, 2
push ecx
lea edx, [ebp - 0x2c68]
push edx
push 0x1005b1cc
lea eax, [ebp - 0x2458]
push eax
call fcn.1003e91e
add esp, 0x10
jmp 0x1001a4c9
mov ecx, dword [ebp + 0x10]
movsx edx, byte [ecx]
cmp edx, 0x5c
jne 0x1001a4aa
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x2c68]
push ecx
push 0x1005b1d4
lea edx, [ebp - 0x2458]
push edx
call fcn.1003e91e
add esp, 0x10
jmp 0x1001a4c9
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x2c68]
push ecx
push 0x1005b1dc
lea edx, [ebp - 0x2458]
push edx
call fcn.1003e91e
add esp, 0x10
cmp dword [0x1011fd7c], 0x55
jne 0x1001a4ed
lea eax, [ebp - 0x1a08]
push eax
movzx ecx, byte [ebp + 0x14]
push ecx
push str.MyBack_bChkisTargetRansom:___d__s
push 1
call fcn.1003b7a0
add esp, 0x10
movzx edx, byte [ebp + 0x14]
test edx, edx
je 0x1001a50f
push 1
lea eax, [ebp - 0x1a08]
push eax
call fcn.1002ec90
add esp, 8
test eax, eax
jne 0x1001a50f
jmp 0x1001a867
cmp dword [0x1012139c], 0
jne 0x1001a523
movzx ecx, byte [0x10120f85]
test ecx, ecx
je 0x1001a54e
push 0x1005b208
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1001a549
push 0x1005b20c
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1001a54e
jmp 0x1001a867
mov byte [ebp - 0x2860], 0
push 0x1ff
push 0
lea ecx, [ebp - 0x285f]
push ecx
call fcn.1003e4c0
add esp, 0xc
mov byte [ebp - 0x1808], 0
push 0x3ff
push 0
lea edx, [ebp - 0x1807]
push edx
call fcn.1003e4c0
add esp, 0xc
mov byte [ebp - 0x1408], 0
push 0x13ff
push 0
lea eax, [ebp - 0x1407]
push eax
call fcn.1003e4c0
add esp, 0xc
push 0x10059773
lea ecx, [ebp - 0x2860]
push ecx
call fcn.1003e91e
add esp, 8
mov eax, dword [0x10261c18]
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0x64
mov dword [ebp - 0x2254], edx
mov edx, dword [0x10261c18]
add edx, 1
mov dword [0x10261c18], edx
mov eax, dword [ebp - 0x2254]
push eax
push 0x1005b210
lea ecx, [ebp - 0x1808]
push ecx
call fcn.1003e91e
add esp, 0xc
mov byte [ebp - 0x2658], 0
push 0x1ff
push 0
lea edx, [ebp - 0x2657]
push edx
call fcn.1003e4c0
add esp, 0xc
lea eax, [ebp - 0x2250]
push eax
call fcn.10011840
add esp, 4
lea ecx, [ebp - 0x2250]
push ecx
call fcn.10011820
add esp, 4
mov dword [ebp - 0x1a1c], eax
cmp dword [ebp - 0x1a1c], 0
je 0x1001a665
mov edx, dword [ebp - 0x1a1c]
push edx
push 0x1005b214
push 0x200
lea eax, [ebp - 0x2658]
push eax
call fcn.1003f453
add esp, 0x10
jmp 0x1001a679
push 0x1005b228
lea ecx, [ebp - 0x2658]
push ecx
call fcn.10008420
add esp, 8
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x265c], edx
cmp dword [0x1012139c], 4
jne 0x1001a69a
mov eax, dword [ebp - 0x265c]
or eax, 0x10
mov dword [ebp - 0x265c], eax
mov dword [ebp - 0x2244], 0
xor ecx, ecx
mov dword [ebp - 0x2240], ecx
mov dword [ebp - 0x223c], ecx
mov dword [ebp - 0x2238], ecx
mov dword [ebp - 0x2234], ecx
mov dword [ebp - 0x2230], ecx
mov dword [ebp - 0x222c], ecx
mov dword [ebp - 0x2228], ecx
mov dword [ebp - 0x2224], ecx
lea edx, [ebp - 0x2244]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
mov ecx, dword [ebp - 0x2228]
xor edx, edx
push 1
push 0
push edx
push ecx
call fcn.1003f840
mov ecx, dword [ebp - 0x2224]
xor esi, esi
add eax, ecx
adc edx, esi
mov dword [ebp - 0x1a18], eax
mov dword [ebp - 0x1a14], edx
mov edx, dword [ebp - 0x1a18]
or edx, dword [ebp - 0x1a14]
jne 0x1001a763
lea eax, [ebp - 0x2244]
push eax
push 0
lea ecx, [ebp - 0x1a08]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
mov edx, dword [ebp - 0x2228]
xor eax, eax
push 1
push 0
push eax
push edx
call fcn.1003f840
mov ecx, dword [ebp - 0x2224]
xor esi, esi
add eax, ecx
adc edx, esi
mov dword [ebp - 0x1a18], eax
mov dword [ebp - 0x1a14], edx
push 0x1011f518
mov edx, dword [ebp - 0x1a14]
push edx
mov eax, dword [ebp - 0x1a18]
push eax
lea ecx, [ebp - 0x1a08]
push ecx
mov edx, dword [ebp - 0x265c]
push edx
push 0x200
lea eax, [ebp - 0x2658]
push eax
push str._s_d_d_s_I64d_s
lea ecx, [ebp - 0x1408]
push ecx
call fcn.1003e91e
add esp, 0x24
lea edx, [ebp - 0x1408]
push edx
lea eax, [ebp - 0x1808]
push eax
lea ecx, [ebp - 0x2860]
push ecx
push reloc.WS2_32.dll_bind
call fcn.1003dbc0
add esp, 0x10
cmp dword [0x1011fd7c], 0x55
jne 0x1001a7ec
lea edx, [ebp - 0x1408]
push edx
lea eax, [ebp - 0x1808]
push eax
push str.MyBack_GoGo:___s__s
push 1
call fcn.1003b7a0
add esp, 0x10
push 0x10059781
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1a0c], eax
cmp dword [ebp - 0x1a0c], 0
jne 0x1001a81b
push 0x10059782
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1a0c], eax
cmp dword [ebp - 0x1a0c], 0
jne 0x1001a843
push 0
push 0x1005b25c
push 0x10059783
push reloc.WS2_32.dll_bind
call fcn.1003d040
add esp, 0x10
mov dword [ebp - 0x1a0c], eax
cmp dword [ebp - 0x1a0c], 0
je 0x1001a867
push 0
mov ecx, dword [ebp - 0x2254]
push ecx
push 0xd02
mov edx, dword [ebp - 0x1a0c]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003e4ab
mov esp, ebp
pop ebp
ret