Function at 0x10001a90
Capabilities:
Contain obfuscated stackstrings
Delete file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x514
mov eax, dword [0x10043330]
xor eax, esp
mov dword [esp + 0x510], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x206
lea eax, [esp + 0x316]
push ebx
push eax
mov word [esp + 0x31c], bx
call fcn.1002fb20
mov edx, dword [0x10044c18]
add esp, 0xc
push 0x104
lea ecx, [esp + 0x314]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, 0x103
mov edi, 0x5c
cmp word [esp + eax*2 + 0x310], di
je 0x10001b02
sub eax, 1
jns 0x10001af1
jmp 0x10001b0a
mov word [esp + eax*2 + 0x310], bx
mov esi, dword [ebp + 8]
cmp esi, 2
jne 0x10001b5d
lea eax, [esp + 0x310]
add eax, 0xfffffffe
lea esp, [esp]
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x10001b20
mov ecx, dword [str.Amct.dll]
mov edx, dword [0x1003dea8]
mov dword [eax], ecx
mov ecx, dword [0x1003deac]
mov dword [eax + 4], edx
mov edx, dword [0x1003deb0]
mov dword [eax + 8], ecx
mov ecx, dword [0x1003deb4]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
jmp 0x10001c31
cmp esi, 3
jne 0x10001bad
lea eax, [esp + 0x310]
add eax, 0xfffffffe
lea esp, [esp]
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x10001b70
mov edx, dword [0x1003deb8]
mov ecx, dword [0x1003debc]
mov dword [eax], edx
mov edx, dword [0x1003dec0]
mov dword [eax + 4], ecx
mov ecx, dword [0x1003dec4]
mov dword [eax + 8], edx
mov edx, dword [0x1003dec8]
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], edx
jmp 0x10001c31
cmp esi, 4
jne 0x10001be4
lea edi, [esp + 0x310]
add edi, 0xfffffffe
lea esp, [esp]
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x10001bc0
mov ecx, 8
mov esi, 0x1003decc
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, dword [ebp + 8]
mov edi, 0x5c
jmp 0x10001c31
lea eax, [esp + 0x310]
add eax, 0xfffffffe
mov edi, edi
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x10001bf0
mov ecx, dword [0x1003def0]
mov edx, dword [0x1003def4]
mov dword [eax], ecx
mov ecx, dword [0x1003def8]
mov dword [eax + 4], edx
mov edx, dword [0x1003defc]
mov dword [eax + 8], ecx
mov ecx, dword [0x1003df00]
mov dword [eax + 0xc], edx
mov edx, dword [0x1003df04]
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], edx
lea eax, [esp + 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x208
lea ecx, [esp + 0x314]
push ebx
push ecx
call fcn.1002fb20
add esp, 0xc
push 0x104
lea edx, [esp + 0x314]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, 0x103
mov edi, edi
cmp word [esp + eax*2 + 0x310], di
je 0x10001c81
sub eax, 1
jns 0x10001c70
jmp 0x10001c89
mov word [esp + eax*2 + 0x310], bx
cmp esi, 2
jne 0x10001cdd
lea eax, [esp + 0x310]
add eax, 0xfffffffe
jmp 0x10001ca0
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x10001ca0
mov ecx, dword [0x1003df08]
mov edx, dword [0x1003df0c]
mov dword [eax], ecx
mov ecx, dword [0x1003df10]
mov dword [eax + 4], edx
mov edx, dword [0x1003df14]
mov dword [eax + 8], ecx
mov ecx, dword [0x1003df18]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
jmp 0x10001d61
cmp esi, 4
jne 0x10001d0f
lea edi, [esp + 0x310]
add edi, 0xfffffffe
lea esp, [esp]
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x10001cf0
mov ecx, 8
mov esi, 0x1003decc
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, dword [ebp + 8]
jmp 0x10001d61
lea eax, [esp + 0x310]
add eax, 0xfffffffe
lea esp, [esp]
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x10001d20
mov edx, dword [0x1003def0]
mov ecx, dword [0x1003def4]
mov dword [eax], edx
mov edx, dword [0x1003def8]
mov dword [eax + 4], ecx
mov ecx, dword [0x1003defc]
mov dword [eax + 8], edx
mov edx, dword [0x1003df00]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x1003df04]
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], ecx
lea edx, [esp + 0x310]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test byte [0x10059a38], 1
mov al, 0x41
mov cl, 0x4d
mov dl, 0x45
mov byte [esp + 0xd8], al
mov byte [esp + 0xd9], cl
mov byte [esp + 0xda], 0x53
mov byte [esp + 0xdb], dl
mov byte [esp + 0xdc], bl
mov byte [esp + 0xe0], al
mov byte [esp + 0xe1], cl
mov byte [esp + 0xe2], 0x50
mov byte [esp + 0xe3], 0x52
mov byte [esp + 0xe4], bl
mov byte [esp + 0xf0], al
mov byte [esp + 0xf1], cl
mov byte [esp + 0xf2], dl
mov byte [esp + 0xf3], 0x4e
mov byte [esp + 0xf4], bl
mov byte [esp + 0xb8], al
mov byte [esp + 0xb9], cl
mov byte [esp + 0xba], 0x54
mov byte [esp + 0xbb], dl
mov byte [esp + 0xbc], bl
mov byte [esp + 0xe8], al
mov byte [esp + 0xe9], cl
mov byte [esp + 0xea], 0x48
mov byte [esp + 0xeb], dl
mov byte [esp + 0xec], bl
mov byte [esp + 0xa0], al
mov byte [esp + 0xa1], cl
mov byte [esp + 0xa2], 0x42
mov byte [esp + 0xa3], 0x54
mov byte [esp + 0xa4], bl
mov byte [esp + 0xa8], al
mov byte [esp + 0xa9], cl
mov byte [esp + 0xaa], 0x57
mov byte [esp + 0xab], 0x53
mov byte [esp + 0xac], bl
mov byte [esp + 0xc8], al
mov byte [esp + 0xc9], cl
mov byte [esp + 0xca], al
mov byte [esp + 0xcb], 0x50
mov byte [esp + 0xcc], bl
mov byte [esp + 0x100], al
mov byte [esp + 0x101], cl
mov byte [esp + 0x102], al
mov byte [esp + 0x103], 0x53
mov byte [esp + 0x104], bl
mov byte [esp + 0xf8], al
mov byte [esp + 0xf9], cl
mov byte [esp + 0xfa], 0x43
mov byte [esp + 0xfb], 0x46
mov byte [esp + 0xfc], bl
mov byte [esp + 0xb0], al
mov byte [esp + 0xb1], cl
mov byte [esp + 0xb2], 0x43
mov byte [esp + 0xb3], 0x50
mov byte [esp + 0xb4], bl
mov byte [esp + 0xc0], al
mov byte [esp + 0xc1], cl
mov byte [esp + 0xc2], 0x43
mov byte [esp + 0xc3], 0x53
mov byte [esp + 0xc4], bl
mov byte [esp + 0xd0], al
mov byte [esp + 0xd1], cl
mov byte [esp + 0xd2], 0x43
mov byte [esp + 0xd3], dl
mov byte [esp + 0xd4], bl
jne 0x10001f71
or dword [0x10059a38], 1
call fcn.100041c0
push 0x1003b6a0
call fcn.1002c011
add esp, 4
cmp esi, 2
jne 0x10001fa1
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.Amat
lea eax, [esp + 0x10c]
push eax
call esi
push str.Amat.dat
lea ecx, [esp + 0x18c]
push ecx
call esi
push str.Amat.dll
jmp 0x10001fff
cmp esi, 3
jne 0x10001fd1
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.Amcn
lea eax, [esp + 0x10c]
push eax
call esi
push str.Amcn.dat
lea ecx, [esp + 0x18c]
push ecx
call esi
push str.Amcn.dll
jmp 0x10001fff
cmp esi, 4
jne 0x10002031
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.ProgramDataClone
lea eax, [esp + 0x10c]
push eax
call esi
push str.AmcloneCore.dll
lea ecx, [esp + 0x18c]
push ecx
call esi
push str.winsevrclone.dat
lea edx, [esp + 0x20c]
push edx
call esi
mov eax, dword [0x10059420]
mov edx, dword [eax + 0x20]
sub esp, 0x180
mov edi, esp
mov ecx, 0x60
lea esi, [esp + 0x288]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x10059420
call edx
mov esi, dword [ebp + 8]
push 0x88
lea eax, [esp + 0x1c]
push ebx
push eax
call fcn.1002fb20
mov edx, dword [0x10059420]
mov eax, dword [edx + 8]
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
mov ecx, 0x10059420
call eax
test al, al
lea edx, [esp + 0x18]
jne 0x100021d5
lea ecx, [esp + 0xa0]
push ecx
push edx
mov byte [esp + 0x9f], bl
call fcn.1002b940
lea ecx, [esp + 0x20]
add esp, 8
cmp eax, ecx
je 0x100021b9
cmp dword [esp + 0x98], 1
je 0x100021b9
push 0x206
lea edx, [esp + 0x10e]
push ebx
push edx
mov word [esp + 0x114], bx
call fcn.1002fb20
add esp, 0xc
cmp esi, 4
lea edi, [esp + 0x108]
jne 0x10002114
call fcn.100013c0
test al, al
je 0x1000219d
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x100020d3
sub eax, edx
sar eax, 1
add eax, 0xc
cmp eax, 0x104
jae 0x1000219d
push str.Version.ini
lea eax, [esp + 0x10c]
push 0x104
push eax
call fcn.1002b784
add esp, 0xc
lea ecx, [esp + 0x108]
push ecx
jmp 0x1000216b
call fcn.10001220
test al, al
je 0x1000219d
lea eax, [esp + 0x108]
lea edx, [eax + 2]
jmp 0x10002130
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10002130
sub eax, edx
sar eax, 1
add eax, 0xc
cmp eax, 0x104
jae 0x1000219d
push str.Version.ini
lea edx, [esp + 0x10c]
push 0x104
push edx
call fcn.1002b784
add esp, 0xc
lea eax, [esp + 0x108]
push eax
push ebx
push 0x1003e008
push 0x1003e00c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 0xa
jne 0x1000219d
mov eax, 0xa
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x510]
xor ecx, esp
call fcn.1002b6af
mov esp, ebp
pop ebp
ret 4
mov eax, 7
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x510]
xor ecx, esp
call fcn.1002b6af
mov esp, ebp
pop ebp
ret 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x510]
xor ecx, esp
call fcn.1002b6af
mov esp, ebp
pop ebp
ret 4
lea ecx, [esp + 0xd8]
push ecx
push edx
call fcn.1002b940
lea ecx, [esp + 0x20]
add esp, 8
cmp eax, ecx
je 0x10002699
cmp dword [esp + 0x98], 4
je 0x10002699
lea edx, [esp + 0xe0]
push edx
mov eax, ecx
push eax
call fcn.1002b940
lea ecx, [esp + 0x20]
add esp, 8
cmp eax, ecx
je 0x1000267d
cmp dword [esp + 0x98], 3
je 0x1000267d
lea edx, [esp + 0xf0]
push edx
mov eax, ecx
push eax
call fcn.1002b940
lea ecx, [esp + 0x20]
add esp, 8
cmp eax, ecx
je 0x10002547
mov eax, dword [esp + 0x98]
cmp eax, 5
je 0x10002547
cmp eax, 6
je 0x10002547
lea edx, [esp + 0xb8]
push edx
mov eax, ecx
push eax
call fcn.1002b940
lea ecx, [esp + 0x20]
add esp, 8
cmp eax, ecx
mov eax, dword [esp + 0x98]
je 0x1000250c
cmp eax, 7
je 0x1000250c
cmp eax, 8
je 0x1000250c
lea edx, [esp + 0xe8]
push edx
mov eax, ecx
push eax
call fcn.1002b940
lea ecx, [esp + 0x20]
add esp, 8
cmp eax, ecx
je 0x100024f0
cmp dword [esp + 0x98], 2
je 0x100024f0
lea edx, [esp + 0xc8]
push edx
mov eax, ecx
push eax
call fcn.1002b940
lea ecx, [esp + 0x20]
add esp, 8
cmp eax, ecx
je 0x10002181
cmp dword [esp + 0x98], 0xa
je 0x10002181
lea edx, [esp + 0x100]
push edx
mov eax, ecx
push eax
call fcn.1002b940
lea ecx, [esp + 0x20]
add esp, 8
cmp eax, ecx
je 0x100024d4
cmp dword [esp + 0x98], 0xb
je 0x100024d4
lea edx, [esp + 0xa0]
push edx
mov eax, ecx
push eax
call fcn.1002b940
lea ecx, [esp + 0x20]
add esp, 8
cmp eax, ecx
je 0x100021b9
cmp dword [esp + 0x98], 1
je 0x100021b9
lea edx, [esp + 0xa8]
push edx
mov eax, ecx
push eax
call fcn.1002b940
lea ecx, [esp + 0x20]
add esp, 8
cmp eax, ecx
je 0x100024b8
cmp dword [esp + 0x98], 9
je 0x100024b8
lea edx, [esp + 0xf8]
push edx
mov eax, ecx
push eax
call fcn.1002b940
lea ecx, [esp + 0x20]
add esp, 8
cmp eax, ecx
je 0x1000249c
cmp dword [esp + 0x98], 0xc
je 0x1000249c
lea edx, [esp + 0xb0]
push edx
mov eax, ecx
push eax
call fcn.1002b940
lea ecx, [esp + 0x20]
add esp, 8
cmp eax, ecx
je 0x10002480
cmp dword [esp + 0x98], 0xd
je 0x10002480
lea edx, [esp + 0xc0]
push edx
mov eax, ecx
push eax
call fcn.1002b940
lea ecx, [esp + 0x20]
add esp, 8
cmp eax, ecx
je 0x10002464
cmp dword [esp + 0x98], 0xe
je 0x10002464
lea edx, [esp + 0xd0]
push edx
mov eax, ecx
push eax
call fcn.1002b940
lea ecx, [esp + 0x20]
add esp, 8
cmp eax, ecx
je 0x10002448
mov eax, dword [esp + 0x98]
cmp eax, 0xf
je 0x10002448
sub eax, 0x10
neg eax
sbb eax, eax
and eax, 0xfffffff7
add eax, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x510]
xor ecx, esp
call fcn.1002b6af
mov esp, ebp
pop ebp
ret 4
mov eax, 0xf
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x510]
xor ecx, esp
call fcn.1002b6af
mov esp, ebp
pop ebp
ret 4
mov eax, 0xe
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x510]
xor ecx, esp
call fcn.1002b6af
mov esp, ebp
pop ebp
ret 4
mov eax, 0xd
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x510]
xor ecx, esp
call fcn.1002b6af
mov esp, ebp
pop ebp
ret 4
mov eax, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x510]
xor ecx, esp
call fcn.1002b6af
mov esp, ebp
pop ebp
ret 4
mov eax, 9
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x510]
xor ecx, esp
call fcn.1002b6af
mov esp, ebp
pop ebp
ret 4
mov eax, 0xb
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x510]
xor ecx, esp
call fcn.1002b6af
mov esp, ebp
pop ebp
ret 4
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x510]
xor ecx, esp
call fcn.1002b6af
mov esp, ebp
pop ebp
ret 4
mov edi, str.AMTE_W8467_Z70T1_SPW02
lea esi, [esp + 0x18]
mov ecx, 0x17
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1000219d
cmp eax, 8
je 0x1000219d
lea eax, [edx + 8]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x510]
xor ecx, esp
call fcn.1002b6af
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0x9c]
mov edx, dword [0x10059420]
lea eax, [esp + 0x10]
push eax
mov eax, dword [edx + 0xc]
push ecx
mov ecx, 0x10059420
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call eax
push 0x206
lea ecx, [esp + 0x10e]
push ebx
push ecx
mov word [esp + 0x114], bx
call fcn.1002fb20
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, 5
je 0x1000269e
cmp eax, 6
je 0x1000269e
lea edi, [esp + 0x108]
call fcn.10001220
cmp esi, 4
jne 0x10002601
test al, al
je 0x10002661
mov eax, edi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x100025c0
sub eax, edx
sar eax, 1
add eax, 0xc
cmp eax, 0x104
jae 0x10002661
push str.Version.ini
lea edx, [esp + 0x10c]
push 0x104
push edx
call fcn.1002b784
add esp, 0xc
lea eax, [esp + 0x108]
push eax
jmp 0x1000264b
test al, al
je 0x10002661
lea eax, [esp + 0x108]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10002610
sub eax, edx
sar eax, 1
add eax, 0xc
cmp eax, 0x104
jae 0x10002661
push str.Version.ini
lea ecx, [esp + 0x10c]
push 0x104
push ecx
call fcn.1002b784
add esp, 0xc
lea edx, [esp + 0x108]
push edx
push ebx
push str.versionCode
push str.VersionInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 6
je 0x1000269e
mov eax, 5
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x510]
xor ecx, esp
call fcn.1002b6af
mov esp, ebp
pop ebp
ret 4
mov eax, 3
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x510]
xor ecx, esp
call fcn.1002b6af
mov esp, ebp
pop ebp
ret 4
mov eax, 4
mov ecx, dword [esp + 0x51c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1002b6af
mov esp, ebp
pop ebp
ret 4