Function at 0x10027aba
Capabilities:
Check for time delay via gettickcount
Create thread
Get common file path

Disassembly:
sub esp, 0x40c
mov eax, dword [0x10074bac]
xor eax, esp
mov dword [esp + 0x408], eax
push ebx
push esi
xor ebx, ebx
push ebx
push str.tc_Log
push str.SOFTWARETrojanCut_tc_Env
push reloc.WS2_32.dll_bind
call fcn.1003d897
add esp, 0x10
push 0x10064f70
mov dword [0x101434ac], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp + 0xc], eax
call fcn.1002a688
mov esi, eax
cmp esi, ebx
je 0x10027b67
push 0x200
lea eax, [esp + 0x14]
push eax
push 0x8f
push dword [0x102bc550]
call dword [sym.imp.USER32.dll_LoadStringA]
push esi
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x218]
push str._s_Stack_Size__d_Bytes
push eax
call fcn.10040b98
push 0x1005ce9d
lea eax, [esp + 0x224]
push eax
push 0x10142448
push 2
push 0x10000
call fcn.10019161
add esp, 0x24
mov eax, 0x23785289
jmp 0x10027f86
push ebp
push edi
mov esi, 0x400
push esi
mov ebp, 0x10144088
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, 0x10143c88
push edi
push ebx
push ebx
push 0x25
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
push 0x4100
push 0x101386e0
call fcn.100074a5
mov eax, dword [0x101434ac]
pop ecx
pop ecx
cmp eax, ebx
je 0x10027bb5
push eax
push str.StartUp...g_bLog_0x_08x_
push ebx
call fcn.1003dfed
add esp, 0xc
push 0x10142448
call fcn.1002bde9
pop ecx
test al, al
je 0x10027bda
cmp dword [0x101434ac], ebx
je 0x10027f7f
push str.isDefaultStaticWhite_OK_NOBHKOK
jmp 0x10027f77
push 0x10142c48
push 0x10142448
call fcn.1003d031
push 0x200
push 0x10142848
call fcn.10042432
push 0x200
push 0x10142c48
call fcn.10042432
push esi
push edi
call fcn.10042432
push esi
push ebp
call fcn.10042432
add esp, 0x28
xor eax, eax
mov cl, byte [eax + 0x10142c48]
mov byte [eax + 0x10142e48], cl
inc eax
cmp cl, bl
jne 0x10027c1a
push 0x10142e48
call fcn.10040b28
pop ecx
call fcn.1000c9f4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x2800
push ebx
push 0x10168388
mov dword [0x1016e468], eax
call fcn.10040850
push 0x1000
push ebx
push 0x1016ab90
call fcn.10040850
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push str.EXPLORER.EXEIEXPLORE.EXECHROME.EXEWHALE.EXESWING.EXEOutLook.EXEALZIP.EXEBandiZip.EXEbreadzip.EXE7z.EXEALZIP.EXEWinRAR.EXEWinZip.EXEWLMAIL.EXEMSIMN.EXEMicrosoftEdge.EXEMicrosoftEdgeCP.EXEfirefox.EXEOPERA.EXESafari.EXEWebKit2WebProcess.EXEwscript.execscript.exeConhost.exeCMD.exePowerShell.exepowershell_ise.exeUCBrowser.exeSpark.exe
mov dword [0x1013ec54], eax
call fcn.1002a5cb
mov dword [esp], str.SERVICES.EXE
call fcn.10011b3c
mov dword [0x101400f8], eax
mov dword [esp], str.Explorer.exe
call fcn.10011b3c
push dword [0x1016e468]
mov dword [0x101400fc], eax
call fcn.10029134
push eax
mov dword [0x1016e46c], eax
call fcn.10029134
push eax
mov dword [0x1016e470], eax
call fcn.10029134
push eax
mov dword [0x1016e474], eax
call fcn.10029134
add esp, 0x14
mov dword [0x1016e478], eax
cmp dword [0x10140b10], ebx
je 0x10027d30
mov ecx, 0x10140b10
cmp ecx, 0x10140b88
jge 0x10027d30
mov eax, dword [ecx]
cmp eax, ebx
je 0x10027d30
cmp eax, dword [0x1016e46c]
jne 0x10027d0b
mov dword [0x1016e46c], ebx
mov dword [0x1016e470], ebx
mov dword [0x1016e474], ebx
jmp 0x10027d23
cmp eax, dword [0x1016e470]
je 0x10027cfd
cmp eax, dword [0x1016e474]
je 0x10027d03
cmp eax, dword [0x1016e478]
jne 0x10027d29
mov dword [0x1016e478], ebx
add ecx, 4
cmp dword [ecx], ebx
jne 0x10027ce1
mov esi, dword [sym.imp.USER32.dll_FindWindowA]
mov edi, 0x1005d094
push edi
push ebx
call esi
mov dword [0x10141c30], eax
mov ebp, str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
cmp eax, ebx
jne 0x10027d73
push edi
push ebx
call esi
mov dword [0x10141c30], eax
cmp eax, ebx
jne 0x10027d73
push ebx
push str.tc_hnd
push ebp
push reloc.WS2_32.dll_bind
call fcn.1003d897
add esp, 0x10
mov dword [0x10141c30], eax
or dword [0x10136ed4], 0xffffffff
push 0x200
push ebx
push 0x10144cc0
call fcn.10007496
push ebx
push str.tc_SSL
push ebp
push reloc.WS2_32.dll_bind
call fcn.1003d897
add esp, 0x1c
test eax, eax
setne al
mov byte [0x10144f0d], al
cmp dword [esp + 0x14], ebx
je 0x10027f6a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10144f04], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
push esi
call fcn.100291b0
test eax, eax
pop ecx
setne al
push esi
mov byte [0x1013eeb5], al
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
cmp dword [str.TrojanCut.exe], ebx
je 0x10027e22
mov esi, 0x10074320
cmp esi, 0x1007439c
jge 0x10027e22
mov eax, dword [esi]
cmp byte [eax], bl
je 0x10027e1b
push eax
mov ebp, 0x10142448
push ebp
call edi
test eax, eax
je 0x10027e1b
push 0x100617cc
push ebp
call edi
test eax, eax
jne 0x10027f5b
add esi, 4
cmp dword [esi], ebx
jne 0x10027df0
mov eax, dword [0x10072cd8]
and eax, 0xf0000
mov dword [0x10144f08], eax
xor eax, eax
mov word [0x10072cda], ax
call fcn.1000f833
call fcn.1001ed22
test al, al
je 0x10027f7f
cmp dword [0x101434ac], ebx
je 0x10027e93
push dword [0x1016e468]
push dword [0x1016e46c]
push dword [0x1016e470]
push dword [0x1016e474]
push dword [0x1016e478]
push 0x10142048
push 0x10142c48
push 0x10142448
push 0x10142848
push str.CInjectAPI_Start_g_szMyExeName__s___g_szMyExeFullPath__s___g_szMyExePath__s___g_szDllPath__s_ParentID__d___d___d___d___d_
push ebx
call fcn.1003dfed
add esp, 0x2c
call fcn.1002db4f
test eax, eax
je 0x10027f7f
push str..scr
push 0x10142848
call edi
test eax, eax
je 0x10027ec9
push 1
push str.tc_Scr
push str.SOFTWARETrojanCut_tc_Env
push reloc.WS2_32.dll_bind
call fcn.1003e718
add esp, 0x10
cmp dword [0x10144edc], ebx
je 0x10027edc
push 0x10103a88
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
cmp dword [0x10144ed4], ebx
je 0x10027eef
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1013dc20], eax
cmp byte [0x1013dc01], bl
jne 0x10027f08
cmp byte [0x10144ec0], bl
je 0x10027f29
test byte [0x1013ee8c], 0x10
jne 0x10027f29
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
push 0x1000cdf3
push ebx
push ebx
mov byte [0x1013ee5d], bl
call fcn.10041127
add esp, 0x18
mov dword [0x1013eea0], eax
test dword [0x101446a0], 0x80000000
jne 0x10027f54
cmp dword [0x10144694], 2
je 0x10027f54
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
push 0x10019320
push ebx
push ebx
call fcn.10041127
add esp, 0x18
mov eax, 0x89578da3
jmp 0x10027f84
cmp dword [0x101434ac], ebx
je 0x10027f7f
push str.OK_NOBHKOK_Except_Hook2
jmp 0x10027f77
cmp dword [0x101434ac], ebx
je 0x10027f7f
push str.OK_NOBHKOK_StartUp_hMod_error
push ebx
call fcn.1003dfed
pop ecx
pop ecx
mov eax, 0x23785289
pop edi
pop ebp
mov ecx, dword [esp + 0x410]
pop esi
pop ebx
xor ecx, esp
call fcn.1004083f
add esp, 0x40c
ret