Function at 0x10019e90
Capabilities:
Check for time delay via gettickcount
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2c68
call fcn.1003e980
mov eax, dword [0x10067bf0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
movzx eax, byte [0x10120b5e]
test eax, eax
jne 0x10019eb8
jmp 0x1001a847
cmp dword [ebp + 8], 0
je 0x10019ecf
mov ecx, dword [ebp + 8]
push ecx
call fcn.1003e400
add esp, 4
cmp eax, 5
jae 0x10019ed4
jmp 0x1001a847
mov edx, dword [0x1011c7dc]
and edx, 0x2000
jne 0x10019f0c
mov eax, dword [0x1011c7dc]
and eax, 0x4000
je 0x10019f0e
movsx ecx, byte [0x1011fe50]
test ecx, ecx
je 0x10019f0e
push 0x1011fe50
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10019f0e
jmp 0x10019f13
jmp 0x1001a847
push str.setup
push 0x1011f118
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x10019f9f
push str.temp
push 0x1011f118
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x10019f9f
push str.install
push 0x1011f118
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x10019f9f
push 0x1005b150
push 0x1011f118
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x10019f9f
push str.msiexec.exe
push 0x1011f118
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x10019f9f
push str.update
push 0x1011f118
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x10019f9f
push str.patch
push 0x1011f118
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10019fa4
jmp 0x1001a847
push 0x1005b170
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x10019fca
push str..lnk
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10019fcf
jmp 0x1001a847
cmp dword [0x1011fd7c], 0x55
jne 0x10019fef
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
push str.MyBack_start:___s__s
push 1
call fcn.1003b780
add esp, 0x10
cmp dword [0x10067500], 0x1f2e3d4c
je 0x1001a000
jmp 0x1001a847
cmp dword [0x10121394], 0
je 0x1001a02c
movsx ecx, byte [0x10115c70]
test ecx, ecx
je 0x1001a02c
push 0x10115c70
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1001a02c
jmp 0x1001a847
cmp dword [0x101213a0], 0
je 0x1001a0c4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101213a4]
mov dword [ebp - 0x2864], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x101213a4]
jmp 0x1001a070
cmp dword [ebp - 0x2864], 0x2710
jae 0x1001a0c4
mov eax, dword [0x101213a4]
sub eax, 0x1388
mov dword [0x101213a4], eax
cmp dword [0x1011fd7c], 0x88
je 0x1001a0a9
cmp dword [0x1011fd7c], 0x44
je 0x1001a0a9
cmp dword [0x1011fd7c], 0x55
jne 0x1001a0bf
mov ecx, dword [ebp - 0x2864]
push ecx
push str.MyBack_cancel__d_
push 0
call fcn.1003b780
add esp, 0xc
jmp 0x1001a847
cmp dword [0x1012139c], 4
jne 0x1001a0ee
push 0x1005b1ac
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1001a0ee
mov byte [0x10120b5c], 1
jmp 0x1001a847
mov byte [0x10120b5c], 0
push 0x200
lea eax, [ebp - 0x1a08]
push eax
call fcn.100083d0
add esp, 8
push 0x200
lea ecx, [ebp - 0x2458]
push ecx
call fcn.100083d0
add esp, 8
mov edx, dword [ebp + 8]
movsx eax, byte [edx + 1]
cmp eax, 0x3a
jne 0x1001a141
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x1a08]
push edx
call fcn.10008420
add esp, 8
jmp 0x1001a2c8
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
cmp ecx, 0x5c
je 0x1001a158
mov edx, dword [ebp + 8]
movsx eax, byte [edx + 1]
cmp eax, 0x3f
jne 0x1001a17f
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + 4]
cmp edx, 0x3a
jne 0x1001a17f
mov eax, dword [ebp + 8]
add eax, 3
push eax
lea ecx, [ebp - 0x1a08]
push ecx
call fcn.10008420
add esp, 8
jmp 0x1001a2c8
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
cmp eax, 0x5c
je 0x1001a1a2
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + 1]
cmp edx, 0x5c
je 0x1001a1a2
mov eax, dword [ebp + 8]
movsx ecx, byte [eax + 2]
cmp ecx, 0x3f
jne 0x1001a1c9
mov edx, dword [ebp + 8]
movsx eax, byte [edx + 5]
cmp eax, 0x3a
jne 0x1001a1c9
mov ecx, dword [ebp + 8]
add ecx, 4
push ecx
lea edx, [ebp - 0x1a08]
push edx
call fcn.10008420
add esp, 8
jmp 0x1001a2c8
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
cmp ecx, 0x5c
je 0x1001a1ec
mov edx, dword [ebp + 8]
movsx eax, byte [edx + 1]
cmp eax, 0x3f
je 0x1001a1ec
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + 2]
cmp edx, 0x3f
jne 0x1001a213
mov eax, dword [ebp + 8]
movsx ecx, byte [eax + 5]
cmp ecx, 0x3a
jne 0x1001a213
mov edx, dword [ebp + 8]
add edx, 4
push edx
lea eax, [ebp - 0x1a08]
push eax
call fcn.10008420
add esp, 8
jmp 0x1001a2c8
mov byte [ebp - 0x2a68], 0
push 0x1ff
push 0
lea ecx, [ebp - 0x2a67]
push ecx
call fcn.1003e4a0
add esp, 0xc
lea edx, [ebp - 0x2a68]
push edx
push 0x200
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
cmp ecx, 0x2e
jne 0x1001a27d
mov edx, dword [ebp + 8]
movsx eax, byte [edx + 1]
cmp eax, 0x5c
jne 0x1001a27d
mov ecx, dword [ebp + 8]
add ecx, 2
push ecx
lea edx, [ebp - 0x2a68]
push edx
push 0x1005b1b4
lea eax, [ebp - 0x1a08]
push eax
call fcn.1003e8fe
add esp, 0x10
jmp 0x1001a2c8
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
cmp edx, 0x5c
jne 0x1001a2a9
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x2a68]
push ecx
push 0x1005b1bc
lea edx, [ebp - 0x1a08]
push edx
call fcn.1003e8fe
add esp, 0x10
jmp 0x1001a2c8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x2a68]
push ecx
push 0x1005b1c4
lea edx, [ebp - 0x1a08]
push edx
call fcn.1003e8fe
add esp, 0x10
cmp dword [ebp + 0x10], 0
je 0x1001a303
mov eax, dword [ebp + 0x10]
push eax
call fcn.1003e400
add esp, 4
cmp eax, 1
jbe 0x1001a303
mov ecx, dword [ebp + 0x10]
movsx edx, byte [ecx + 1]
cmp edx, 0x3a
jne 0x1001a303
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x2458]
push ecx
call fcn.10008420
add esp, 8
jmp 0x1001a4a9
cmp dword [ebp + 0x10], 0
je 0x1001a4a9
mov edx, dword [ebp + 0x10]
push edx
call fcn.1003e400
add esp, 4
cmp eax, 5
jbe 0x1001a4a9
mov eax, dword [ebp + 0x10]
movsx ecx, byte [eax]
cmp ecx, 0x5c
je 0x1001a339
mov edx, dword [ebp + 0x10]
movsx eax, byte [edx + 1]
cmp eax, 0x3f
jne 0x1001a360
mov ecx, dword [ebp + 0x10]
movsx edx, byte [ecx + 4]
cmp edx, 0x3a
jne 0x1001a360
mov eax, dword [ebp + 0x10]
add eax, 3
push eax
lea ecx, [ebp - 0x2458]
push ecx
call fcn.10008420
add esp, 8
jmp 0x1001a4a9
mov edx, dword [ebp + 0x10]
movsx eax, byte [edx]
cmp eax, 0x5c
je 0x1001a383
mov ecx, dword [ebp + 0x10]
movsx edx, byte [ecx + 1]
cmp edx, 0x5c
je 0x1001a383
mov eax, dword [ebp + 0x10]
movsx ecx, byte [eax + 2]
cmp ecx, 0x3f
jne 0x1001a3aa
mov edx, dword [ebp + 0x10]
movsx eax, byte [edx + 5]
cmp eax, 0x3a
jne 0x1001a3aa
mov ecx, dword [ebp + 0x10]
add ecx, 4
push ecx
lea edx, [ebp - 0x2458]
push edx
call fcn.10008420
add esp, 8
jmp 0x1001a4a9
mov eax, dword [ebp + 0x10]
movsx ecx, byte [eax]
cmp ecx, 0x5c
je 0x1001a3cd
mov edx, dword [ebp + 0x10]
movsx eax, byte [edx + 1]
cmp eax, 0x3f
je 0x1001a3cd
mov ecx, dword [ebp + 0x10]
movsx edx, byte [ecx + 2]
cmp edx, 0x3f
jne 0x1001a3f4
mov eax, dword [ebp + 0x10]
movsx ecx, byte [eax + 5]
cmp ecx, 0x3a
jne 0x1001a3f4
mov edx, dword [ebp + 0x10]
add edx, 4
push edx
lea eax, [ebp - 0x2458]
push eax
call fcn.10008420
add esp, 8
jmp 0x1001a4a9
mov byte [ebp - 0x2c68], 0
push 0x1ff
push 0
lea ecx, [ebp - 0x2c67]
push ecx
call fcn.1003e4a0
add esp, 0xc
lea edx, [ebp - 0x2c68]
push edx
push 0x200
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, dword [ebp + 0x10]
movsx ecx, byte [eax]
cmp ecx, 0x2e
jne 0x1001a45e
mov edx, dword [ebp + 0x10]
movsx eax, byte [edx + 1]
cmp eax, 0x5c
jne 0x1001a45e
mov ecx, dword [ebp + 0x10]
add ecx, 2
push ecx
lea edx, [ebp - 0x2c68]
push edx
push 0x1005b1cc
lea eax, [ebp - 0x2458]
push eax
call fcn.1003e8fe
add esp, 0x10
jmp 0x1001a4a9
mov ecx, dword [ebp + 0x10]
movsx edx, byte [ecx]
cmp edx, 0x5c
jne 0x1001a48a
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x2c68]
push ecx
push 0x1005b1d4
lea edx, [ebp - 0x2458]
push edx
call fcn.1003e8fe
add esp, 0x10
jmp 0x1001a4a9
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x2c68]
push ecx
push 0x1005b1dc
lea edx, [ebp - 0x2458]
push edx
call fcn.1003e8fe
add esp, 0x10
cmp dword [0x1011fd7c], 0x55
jne 0x1001a4cd
lea eax, [ebp - 0x1a08]
push eax
movzx ecx, byte [ebp + 0x14]
push ecx
push str.MyBack_bChkisTargetRansom:___d__s
push 1
call fcn.1003b780
add esp, 0x10
movzx edx, byte [ebp + 0x14]
test edx, edx
je 0x1001a4ef
push 1
lea eax, [ebp - 0x1a08]
push eax
call fcn.1002ec70
add esp, 8
test eax, eax
jne 0x1001a4ef
jmp 0x1001a847
cmp dword [0x1012139c], 0
jne 0x1001a503
movzx ecx, byte [0x10120f85]
test ecx, ecx
je 0x1001a52e
push 0x1005b208
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1001a529
push 0x1005b20c
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1001a52e
jmp 0x1001a847
mov byte [ebp - 0x2860], 0
push 0x1ff
push 0
lea ecx, [ebp - 0x285f]
push ecx
call fcn.1003e4a0
add esp, 0xc
mov byte [ebp - 0x1808], 0
push 0x3ff
push 0
lea edx, [ebp - 0x1807]
push edx
call fcn.1003e4a0
add esp, 0xc
mov byte [ebp - 0x1408], 0
push 0x13ff
push 0
lea eax, [ebp - 0x1407]
push eax
call fcn.1003e4a0
add esp, 0xc
push 0x10059773
lea ecx, [ebp - 0x2860]
push ecx
call fcn.1003e8fe
add esp, 8
mov eax, dword [0x10261c18]
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0x64
mov dword [ebp - 0x2254], edx
mov edx, dword [0x10261c18]
add edx, 1
mov dword [0x10261c18], edx
mov eax, dword [ebp - 0x2254]
push eax
push 0x1005b210
lea ecx, [ebp - 0x1808]
push ecx
call fcn.1003e8fe
add esp, 0xc
mov byte [ebp - 0x2658], 0
push 0x1ff
push 0
lea edx, [ebp - 0x2657]
push edx
call fcn.1003e4a0
add esp, 0xc
lea eax, [ebp - 0x2250]
push eax
call fcn.10011820
add esp, 4
lea ecx, [ebp - 0x2250]
push ecx
call fcn.10011800
add esp, 4
mov dword [ebp - 0x1a1c], eax
cmp dword [ebp - 0x1a1c], 0
je 0x1001a645
mov edx, dword [ebp - 0x1a1c]
push edx
push 0x1005b214
push 0x200
lea eax, [ebp - 0x2658]
push eax
call fcn.1003f433
add esp, 0x10
jmp 0x1001a659
push 0x1005b228
lea ecx, [ebp - 0x2658]
push ecx
call fcn.10008420
add esp, 8
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x265c], edx
cmp dword [0x1012139c], 4
jne 0x1001a67a
mov eax, dword [ebp - 0x265c]
or eax, 0x10
mov dword [ebp - 0x265c], eax
mov dword [ebp - 0x2244], 0
xor ecx, ecx
mov dword [ebp - 0x2240], ecx
mov dword [ebp - 0x223c], ecx
mov dword [ebp - 0x2238], ecx
mov dword [ebp - 0x2234], ecx
mov dword [ebp - 0x2230], ecx
mov dword [ebp - 0x222c], ecx
mov dword [ebp - 0x2228], ecx
mov dword [ebp - 0x2224], ecx
lea edx, [ebp - 0x2244]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
mov ecx, dword [ebp - 0x2228]
xor edx, edx
push 1
push 0
push edx
push ecx
call fcn.1003f820
mov ecx, dword [ebp - 0x2224]
xor esi, esi
add eax, ecx
adc edx, esi
mov dword [ebp - 0x1a18], eax
mov dword [ebp - 0x1a14], edx
mov edx, dword [ebp - 0x1a18]
or edx, dword [ebp - 0x1a14]
jne 0x1001a743
lea eax, [ebp - 0x2244]
push eax
push 0
lea ecx, [ebp - 0x1a08]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
mov edx, dword [ebp - 0x2228]
xor eax, eax
push 1
push 0
push eax
push edx
call fcn.1003f820
mov ecx, dword [ebp - 0x2224]
xor esi, esi
add eax, ecx
adc edx, esi
mov dword [ebp - 0x1a18], eax
mov dword [ebp - 0x1a14], edx
push 0x1011f518
mov edx, dword [ebp - 0x1a14]
push edx
mov eax, dword [ebp - 0x1a18]
push eax
lea ecx, [ebp - 0x1a08]
push ecx
mov edx, dword [ebp - 0x265c]
push edx
push 0x200
lea eax, [ebp - 0x2658]
push eax
push str._s_d_d_s_I64d_s
lea ecx, [ebp - 0x1408]
push ecx
call fcn.1003e8fe
add esp, 0x24
lea edx, [ebp - 0x1408]
push edx
lea eax, [ebp - 0x1808]
push eax
lea ecx, [ebp - 0x2860]
push ecx
push reloc.WS2_32.dll_bind
call fcn.1003dba0
add esp, 0x10
cmp dword [0x1011fd7c], 0x55
jne 0x1001a7cc
lea edx, [ebp - 0x1408]
push edx
lea eax, [ebp - 0x1808]
push eax
push str.MyBack_GoGo:___s__s
push 1
call fcn.1003b780
add esp, 0x10
push 0x10059781
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1a0c], eax
cmp dword [ebp - 0x1a0c], 0
jne 0x1001a7fb
push 0x10059782
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1a0c], eax
cmp dword [ebp - 0x1a0c], 0
jne 0x1001a823
push 0
push 0x1005b25c
push 0x10059783
push reloc.WS2_32.dll_bind
call fcn.1003d020
add esp, 0x10
mov dword [ebp - 0x1a0c], eax
cmp dword [ebp - 0x1a0c], 0
je 0x1001a847
push 0
mov ecx, dword [ebp - 0x2254]
push ecx
push 0xd02
mov edx, dword [ebp - 0x1a0c]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003e48b
mov esp, ebp
pop ebp
ret