Function at 0x1000e7b2
Capabilities:
Check for time delay via gettickcount
Get common file path
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x21c0]
mov eax, 0x2240
call fcn.10040c40
mov eax, dword [0x10074bac]
xor eax, ebp
mov dword [ebp + 0x21bc], eax
cmp dword [0x101434ac], 0x55
mov eax, dword [ebp + 0x21d0]
push ebx
push esi
mov esi, dword [ebp + 0x21c8]
push edi
mov dword [ebp - 0x50], eax
jne 0x1000e7fd
push eax
push esi
push str.MyBack_start_0:___s__s
push 1
call fcn.1003dfed
add esp, 0x10
push 0x1005f540
push esi
mov ebx, esi
mov dword [ebp - 0x54], esi
call fcn.10040c70
pop ecx
pop ecx
cmp eax, esi
jne 0x1000e819
lea ebx, [esi + 4]
mov dword [ebp - 0x54], ebx
cmp dword [0x10144ed4], 4
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
jne 0x1000e85c
push str..tmp
push ebx
call edi
test eax, eax
je 0x1000e85c
cmp dword [0x101434ac], 0x55
jne 0x1000e850
push dword [ebp - 0x50]
push ebx
push str.MyBack_OFFICE_PPT_1:___s__s
push 1
call fcn.1003dfed
add esp, 0x10
mov byte [0x10144690], 1
jmp 0x1000efc5
mov byte [0x10144690], 0
test ebx, ebx
je 0x1000efc5
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000e870
sub eax, edx
cmp eax, 5
jb 0x1000efc5
cmp dword [ebp - 0x50], 0
mov esi, 0x1005f690
je 0x1000e89b
push esi
push dword [ebp - 0x50]
call edi
test eax, eax
jne 0x1000efc5
push esi
push ebx
call edi
test eax, eax
jne 0x1000efc5
mov esi, 0x1005f688
cmp dword [ebp - 0x50], eax
je 0x1000e8bf
push esi
push dword [ebp - 0x50]
call edi
test eax, eax
jne 0x1000efc5
push esi
push ebx
call edi
test eax, eax
jne 0x1000efc5
mov esi, str.cache_
cmp dword [ebp - 0x50], eax
je 0x1000e8e3
push esi
push dword [ebp - 0x50]
call edi
test eax, eax
jne 0x1000efc5
push esi
push ebx
call edi
test eax, eax
jne 0x1000efc5
mov eax, dword [0x1013ee8c]
test eax, 0x2000
jne 0x1000e923
test eax, 0x4000
je 0x1000efc5
cmp byte [0x10143580], 0
je 0x1000efc5
push 0x10143580
push ebx
call edi
test eax, eax
je 0x1000efc5
push str.setup
mov esi, 0x10142448
push esi
call edi
test eax, eax
jne 0x1000efc5
push 0x1005f670
push esi
call edi
test eax, eax
jne 0x1000efc5
push str.install
push esi
call edi
test eax, eax
jne 0x1000efc5
push 0x1005f664
push esi
call edi
test eax, eax
jne 0x1000efc5
push 0x1005f658
push esi
call edi
test eax, eax
jne 0x1000efc5
push str.update
push esi
call edi
test eax, eax
jne 0x1000efc5
push str.patch
push esi
call edi
test eax, eax
jne 0x1000efc5
push str..tmp
push ebx
call edi
test eax, eax
je 0x1000e9b1
cmp dword [0x10144ed4], 4
jne 0x1000efc5
push str..lnk
push ebx
call edi
test eax, eax
jne 0x1000efc5
cmp dword [0x101434ac], 0x55
jne 0x1000e9dd
push dword [ebp - 0x50]
push ebx
push str.MyBack_start:___s__s
push 1
call fcn.1003dfed
add esp, 0x10
call fcn.1000e21f
cmp dword [0x100724a8], 0x1f2e3d4c
je 0x1000ea13
cmp dword [0x101434ac], 0x55
jne 0x1000efc5
push dword [ebp - 0x50]
push ebx
push str.MyBack_No_Mouse_Cancel:___s__s
push 1
call fcn.1003dfed
add esp, 0x10
jmp 0x1000efc5
cmp byte [ebx], 0
je 0x1000ea3a
cmp dword [0x10144ecc], 0
je 0x1000ea3a
cmp byte [0x101368d0], 0
je 0x1000ea3a
push 0x101368d0
push ebx
call edi
test eax, eax
jne 0x1000efc5
cmp dword [0x10144ee0], 0
je 0x1000ea99
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ebx, eax
sub ebx, dword [0x10144ee4]
call esi
cmp ebx, 0x2710
jae 0x1000ea96
mov eax, dword [0x101434ac]
sub dword [0x10144ee4], 0x1388
cmp eax, 0x88
je 0x1000ea81
cmp eax, 0x44
je 0x1000ea81
cmp eax, 0x55
jne 0x1000efc5
push ebx
push str.MyBack_cancel__d_
push 0
call fcn.1003dfed
add esp, 0xc
jmp 0x1000efc5
mov ebx, dword [ebp - 0x54]
cmp dword [0x101434ac], 0x55
jne 0x1000eab5
push dword [ebp - 0x50]
push ebx
push str.MyBack_start_1:___s__s
push 1
call fcn.1003dfed
add esp, 0x10
mov ebx, 0x200
lea eax, [ebp + 0x1fb4]
push ebx
push eax
call fcn.100074a5
lea eax, [ebp + 0x1bb4]
push ebx
push eax
call fcn.100074a5
mov esi, dword [ebp - 0x54]
mov al, byte [esi + 1]
add esp, 0x10
cmp al, 0x3a
je 0x1000eb24
mov cl, byte [esi]
cmp cl, 0x5c
je 0x1000eaec
cmp al, 0x3f
jne 0x1000eaf7
cmp byte [esi + 4], 0x3a
jne 0x1000eaf7
add esi, 3
jmp 0x1000eb24
cmp cl, 0x5c
je 0x1000eb06
cmp al, 0x5c
je 0x1000eb06
cmp byte [esi + 2], 0x3f
jne 0x1000eb0c
cmp byte [esi + 5], 0x3a
je 0x1000eb21
cmp cl, 0x5c
je 0x1000eb1b
cmp al, 0x3f
je 0x1000eb1b
cmp byte [esi + 2], 0x3f
jne 0x1000eb35
cmp byte [esi + 5], 0x3a
jne 0x1000eb35
add esi, 4
lea eax, [ebp + 0x1fb4]
push esi
push eax
call fcn.100074d8
pop ecx
pop ecx
jmp 0x1000eb8b
push 0x1ff
lea eax, [ebp + 0x1db5]
push 0
push eax
mov byte [ebp + 0x1db4], 0
call fcn.10040850
add esp, 0xc
lea eax, [ebp + 0x1db4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov al, byte [esi]
cmp al, 0x2e
jne 0x1000ebb2
cmp byte [esi + 1], 0x5c
jne 0x1000ebb2
add esi, 2
push esi
lea eax, [ebp + 0x1db4]
push eax
push str._s_s
lea eax, [ebp + 0x1fb4]
push eax
call fcn.10040b98
add esp, 0x10
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x1000ec91
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000eb9b
sub eax, edx
cmp eax, 1
jbe 0x1000ebc5
cmp byte [esi + 1], 0x3a
jne 0x1000ebc5
push esi
jmp 0x1000ec23
cmp al, 0x5c
jne 0x1000eb6f
push esi
lea eax, [ebp + 0x1db4]
push eax
push 0x1005eaf4
jmp 0x1000eb7c
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000ebca
sub eax, edx
cmp eax, 5
jbe 0x1000ec91
mov al, byte [esi]
cmp al, 0x5c
je 0x1000ebe8
cmp byte [esi + 1], 0x3f
jne 0x1000ebf3
cmp byte [esi + 4], 0x3a
jne 0x1000ebf3
lea eax, [esi + 3]
jmp 0x1000ec22
cmp al, 0x5c
je 0x1000ec03
cmp byte [esi + 1], 0x5c
je 0x1000ec03
cmp byte [esi + 2], 0x3f
jne 0x1000ec09
cmp byte [esi + 5], 0x3a
je 0x1000ec1f
cmp al, 0x5c
je 0x1000ec19
cmp byte [esi + 1], 0x3f
je 0x1000ec19
cmp byte [esi + 2], 0x3f
jne 0x1000ec33
cmp byte [esi + 5], 0x3a
jne 0x1000ec33
lea eax, [esi + 4]
push eax
lea eax, [ebp + 0x1bb4]
push eax
call fcn.100074d8
pop ecx
pop ecx
jmp 0x1000ec91
push 0x1ff
lea eax, [ebp + 0x1db5]
push 0
push eax
mov byte [ebp + 0x1db4], 0
call fcn.10040850
add esp, 0xc
lea eax, [ebp + 0x1db4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov al, byte [esi]
cmp al, 0x2e
jne 0x1000ee5b
cmp byte [esi + 1], 0x5c
jne 0x1000ee5b
lea eax, [esi + 2]
push eax
lea eax, [ebp + 0x1db4]
push eax
push str._s_s
lea eax, [ebp + 0x1bb4]
push eax
call fcn.10040b98
add esp, 0x10
cmp dword [0x101434ac], 0x55
jne 0x1000ecb8
lea eax, [ebp + 0x1fb4]
push eax
movzx eax, byte [ebp + 0x21d4]
push eax
push str.MyBack_bChkisTargetRansom:___d__s
push 1
call fcn.1003dfed
add esp, 0x10
cmp byte [ebp + 0x21d4], 0
je 0x1000ecd9
lea eax, [ebp + 0x1fb4]
push 1
push eax
call fcn.10031371
pop ecx
pop ecx
test eax, eax
je 0x1000efc5
cmp dword [0x10144ed4], 0
jne 0x1000eceb
cmp byte [0x10144ec0], 0
je 0x1000ed0d
push 0x1005f5b4
push dword [ebp - 0x54]
call edi
test eax, eax
jne 0x1000efc5
push 0x1005f5b4
push esi
call edi
test eax, eax
jne 0x1000efc5
test dword [0x1013ee8c], 0x200000
jne 0x1000ed70
push 0x1005f5b0
push dword [ebp - 0x54]
call fcn.10040c70
pop ecx
pop ecx
test eax, eax
jne 0x1000efc5
mov byte [ebp + 0x21b4], al
lea edi, [ebp + 0x21b5]
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp - 0x54]
movsx eax, byte [eax]
push eax
lea eax, [ebp + 0x21b4]
push str._c:_
push eax
call fcn.10040b98
add esp, 0xc
lea eax, [ebp + 0x21b4]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 4
je 0x1000efc5
cmp dword [0x101434ac], 0x55
jne 0x1000ed8c
push esi
push dword [ebp - 0x54]
push str.MyBack_end_:___s__s
push 1
call fcn.1003dfed
add esp, 0x10
mov esi, 0x1ff
push esi
xor edi, edi
lea eax, [ebp + 0x17b5]
push edi
push eax
mov byte [ebp + 0x17b4], 0
call fcn.10040850
push 0x3ff
lea eax, [ebp + 0x13b5]
push edi
push eax
mov byte [ebp + 0x13b4], 0
call fcn.10040850
push 0x13ff
lea eax, [ebp - 0x4b]
push edi
push eax
mov byte [ebp - 0x4c], 0
call fcn.10040850
lea eax, [ebp + 0x17b4]
push str.SoftWareTrojanCut_tc_FileB
push eax
call fcn.10040b98
mov eax, dword [0x1029e3fc]
cdq
mov ecx, 0xea60
idiv ecx
lea eax, [ebp + 0x13b4]
add edx, 0x64
inc dword [0x1029e3fc]
push edx
push 0x1005d13c
push eax
mov dword [ebp + 0x21b4], edx
call fcn.10040b98
push esi
lea eax, [ebp + 0x19b5]
push edi
push eax
mov byte [ebp + 0x19b4], 0
call fcn.10040850
lea eax, [ebp - 0x5c]
add esp, 0x44
push eax
call fcn.10040fd5
lea eax, [ebp - 0x5c]
push eax
call fcn.10040fae
pop ecx
pop ecx
cmp eax, edi
je 0x1000ee75
push eax
push str._Y__m__d__H:_M:_S
lea eax, [ebp + 0x19b4]
push ebx
push eax
call fcn.10041c5f
add esp, 0x10
jmp 0x1000ee88
push esi
cmp al, 0x5c
jne 0x1000ec76
lea eax, [ebp + 0x1db4]
push eax
push 0x1005eaf4
jmp 0x1000ec82
lea eax, [ebp + 0x19b4]
push str.0000
push eax
call fcn.100074d8
pop ecx
pop ecx
cmp dword [0x10144ed4], 4
mov eax, dword [ebp + 0x21cc]
mov dword [ebp - 0x54], eax
jne 0x1000eea0
or eax, 0x10
mov dword [ebp - 0x54], eax
and dword [ebp - 0x80], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
push eax
push 0
push dword [ebp - 0x50]
call esi
push 1
push 0
push 0
push dword [ebp - 0x64]
call fcn.10043420
mov ecx, dword [ebp - 0x60]
xor edi, edi
add eax, ecx
adc edx, edi
mov ecx, eax
or ecx, edx
jne 0x1000eeff
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp + 0x1fb4]
push eax
call esi
push 1
push edi
push edi
push dword [ebp - 0x64]
call fcn.10043420
mov ecx, dword [ebp - 0x60]
xor esi, esi
add eax, ecx
adc edx, esi
cmp byte [0x1029dff0], 0
je 0x1000ef0f
push 0x1029dff0
jmp 0x1000ef14
push 0x10142848
push edx
push eax
lea eax, [ebp + 0x1fb4]
push eax
push dword [ebp - 0x54]
lea eax, [ebp + 0x19b4]
push ebx
push eax
lea eax, [ebp - 0x4c]
push str._s_d_d_s_I64d_s
push eax
call fcn.10040b98
add esp, 0x24
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp + 0x13b4]
push eax
lea eax, [ebp + 0x17b4]
push eax
push reloc.WS2_32.dll_bind
call fcn.1003ef27
add esp, 0x10
cmp dword [0x101434ac], 0x55
jne 0x1000ef7b
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp + 0x13b4]
push eax
push str.MyBack_GoGo:___s__s
push 1
call fcn.1003dfed
add esp, 0x10
mov esi, dword [sym.imp.USER32.dll_FindWindowA]
mov ebx, 0x1005d094
push ebx
push edi
call esi
cmp eax, edi
jne 0x1000efb2
push ebx
push edi
call esi
cmp eax, edi
jne 0x1000efb2
push edi
push str.tc_hnd
push str.SOFTWARETrojanCutTC_Env_tc_COMMUNICATION
push reloc.WS2_32.dll_bind
call fcn.1003d897
add esp, 0x10
cmp eax, edi
je 0x1000efc5
push edi
push dword [ebp + 0x21b4]
push 0xd02
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov ecx, dword [ebp + 0x21bc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004083f
add ebp, 0x21c0
leave
ret