Function at 0x100ac4b0
Capabilities:
Get common file path
Read .ini file
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1d1c
call fcn.10140530
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0x1d18], eax
cmp byte [0x101ccf40], 0
push ebx
push esi
push edi
mov ebx, ecx
jne 0x100ac521
push 0x101ccf40
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, 0x101cd048
call fcn.1005d0a0
push 0x1f40
push 0x101a76ac
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x100ac515
push 0x101a76ac
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x101ba62c], 1
jmp 0x100ac52e
cmp dword [0x101ba62c], 0
je 0x100ac5f6
push 0x103
lea eax, [esp + 0x135]
push 0
push eax
mov byte [esp + 0x13c], 0
call fcn.1012e060
add esp, 0xc
xor eax, eax
nop
mov cl, byte [eax + 0x101cd048]
mov byte [esp + eax + 0x130], cl
inc eax
test cl, cl
jne 0x100ac550
cmp byte [esp + 0x130], cl
je 0x100ac59b
lea eax, [esp + 0x130]
inc eax
cmp byte [eax], 0
jne 0x100ac572
lea ecx, [esp + 0x130]
sub eax, ecx
je 0x100ac59b
cmp byte [esp + eax + 0x12f], 0x5c
je 0x100ac59b
push 0x10158184
mov edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x130]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x100ac5a3
mov ecx, dword [str.verinfo.ini]
mov edx, dword [0x10156880]
mov dword [eax], ecx
mov ecx, dword [0x10156884]
mov dword [eax + 4], edx
lea edx, [esp + 0x130]
push edx
push 0x104
push 0x101cd150
push 0x1014d5e3
push str.Version
push 0x10156244
mov dword [eax + 8], ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [0x101ba62c], 0
test ebx, ebx
je 0x100ad04d
cmp byte [ebx], 0
je 0x100ad04d
push 0x103
lea eax, [esp + 0x33d]
push 0
push eax
mov byte [esp + 0x344], 0
call fcn.1012e060
add esp, 0xc
lea ecx, [esp + 0x338]
push ecx
push 0
push 0x1015faf0
push 0x101ccf40
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea edx, [esp + 0x338]
push 0x2e
push edx
call fcn.10129030
mov esi, eax
add esp, 8
test esi, esi
je 0x100ac670
lea eax, [esp + 0x338]
call fcn.1005ad10
push str..json
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x103
lea eax, [esp + 0x655]
push 0
push eax
mov byte [esp + 0x65c], 0
call fcn.1012e060
xor eax, eax
add esp, 0xc
lea edx, [esp + 0x14]
xor ecx, ecx
push edx
mov word [esp + 0x18], cx
mov dword [esp + 0x1a], eax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov word [esp + 0x26], ax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [esp + 0x22]
movzx ecx, word [esp + 0x20]
movzx edx, word [esp + 0x1e]
push eax
movzx eax, word [esp + 0x20]
push ecx
movzx ecx, word [esp + 0x22]
push edx
movzx edx, word [esp + 0x22]
push eax
movzx eax, word [esp + 0x24]
push ecx
push edx
push eax
lea ecx, [esp + 0x66c]
push str._04u__02u__02uT_02u:_02u:_02u._uZ
push ecx
call fcn.10127dc0
add esp, 0x24
push 1
push 0x3b
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x554]
push eax
xor cl, cl
mov edx, ebx
mov dword [esp + 0x20], 0
call fcn.10061f00
push 1
lea ecx, [esp + 0x24]
push 0x3b
push ecx
lea edx, [esp + 0x564]
push edx
xor cl, cl
mov edx, ebx
call fcn.10061f00
push 1
push 0x3b
lea eax, [esp + 0x38]
lea ecx, [esp + 0x1018]
push eax
push ecx
xor cl, cl
mov edx, ebx
call fcn.10061f00
push 1
push 0x3b
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0x1444]
push eax
xor cl, cl
mov edx, ebx
call fcn.10061f00
add esp, 0x40
push 1
push 0x3b
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x130c]
push edx
xor cl, cl
mov edx, ebx
call fcn.10061f00
push 1
push 0x3b
lea eax, [esp + 0x28]
lea ecx, [esp + 0x560]
push eax
push ecx
xor cl, cl
mov edx, ebx
call fcn.10061f00
lea edx, [esp + 0x568]
push edx
call fcn.10128238
add esp, 0x24
push 1
push 0x3b
lea eax, [esp + 0x18]
lea ecx, [esp + 0x1200]
push eax
push ecx
xor cl, cl
mov edx, ebx
call fcn.10061f00
push 1
push 0x3b
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x564]
push eax
xor cl, cl
mov edx, ebx
call fcn.10061f00
lea ecx, [esp + 0x568]
push ecx
call fcn.10128238
add esp, 0x24
push 1
push 0x3b
lea edx, [esp + 0x18]
mov esi, eax
push edx
lea eax, [esp + 0xef4]
push eax
xor cl, cl
mov edx, ebx
call fcn.10061f00
push 1
lea ecx, [esp + 0x24]
push 0x3b
push ecx
lea edx, [esp + 0xb04]
push edx
xor cl, cl
mov edx, ebx
call fcn.10061f00
add esp, 0x20
cmp byte [esp + 0xae8], 0
je 0x100ac85c
lea eax, [esp + 0xae8]
lea edx, [eax + 1]
jmp 0x100ac840
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100ac840
sub eax, edx
cmp byte [esp + eax + 0xae7], 0x2e
lea eax, [esp + eax + 0xae7]
jne 0x100ac85c
mov byte [eax], cl
push 1
push 0x3b
lea eax, [esp + 0x18]
lea ecx, [esp + 0x9e8]
push eax
push ecx
xor cl, cl
mov edx, ebx
call fcn.10061f00
push 1
push 0x3b
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x152c]
push eax
xor cl, cl
mov edx, ebx
call fcn.10061f00
push 0x80
push 4
push 1
push 0x40000000
lea edi, [esp + 0x368]
call fcn.1005aa40
mov ebx, eax
add esp, 0x30
mov dword [esp + 0x24], ebx
cmp ebx, 0xffffffff
jne 0x100ac937
push 0x207
lea ecx, [esp + 0x75d]
push 0
push ecx
mov byte [esp + 0x764], 0
call fcn.1012e060
add esp, 0xc
push 0x103
lea edx, [esp + 0x135]
push 0
push edx
mov byte [esp + 0x13c], 0
call fcn.1012e060
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x104
mov edi, eax
lea esi, [esp + 0x134]
call fcn.100652a0
add esp, 4
mov eax, esi
push eax
lea ecx, [esp + 0x33c]
push ecx
lea edx, [esp + 0x760]
push str.Unable_to_open_file__s__Reason:__s
push edx
call fcn.10127dc0
add esp, 0x10
jmp 0x100ad041
push 0x103
lea eax, [esp + 0x2d]
push 0
push eax
mov byte [esp + 0x34], 0
call fcn.1012e060
add esp, 0xc
push 0
mov edx, 0x10175e08
mov edi, 0x1014d5e3
mov ecx, ebx
call fcn.100ac310
add esp, 4
push 0
mov edx, 0x10175e0c
mov ecx, ebx
call fcn.100ac310
add esp, 4
push 1
mov edx, 0x101a9f68
mov edi, str.AwsAccountId
mov ecx, ebx
call fcn.100ac310
add esp, 4
push 0
mov edx, 0x10175e0c
mov edi, str.Compliance
mov ecx, ebx
call fcn.100ac310
add esp, 4
push 0
mov edx, str.FAILED
mov edi, str.Status
mov ecx, ebx
call fcn.100ac310
add esp, 4
push 1
mov edx, 0x10175e24
mov edi, 0x1014d5e3
mov ecx, ebx
call fcn.100ac310
add esp, 4
push 1
lea edx, [esp + 0x654]
mov edi, str.CreatedAt
mov ecx, ebx
call fcn.100ac310
add esp, 4
mov dword [esp + 0x10], 0
cmp esi, 3
jne 0x100ac9fe
mov dword [esp + 0x10], 0x64
jmp 0x100aca0b
cmp esi, 2
jne 0x100aca0b
mov dword [esp + 0x10], 0x4b
mov edi, dword [esp + 0x10]
push 1
mov edx, str.Criticality
mov ecx, ebx
call fcn.100ac260
add esp, 4
push 1
lea edx, [esp + 0xaec]
mov edi, str.Description
mov ecx, ebx
call fcn.100ac310
add esp, 4
push 1
mov edx, str.eScan_1
mov edi, str.GeneratorId
mov ecx, ebx
call fcn.100ac310
add esp, 4
push 0x103
lea ecx, [esp + 0x445]
push 0
push ecx
mov byte [esp + 0x44c], 0
call fcn.1012e060
lea eax, [esp + 0x44c]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100aca77
sub eax, edx
cmp eax, 0x18
jae 0x100acaef
call fcn.1005be60
push eax
lea edx, [esp + 0x964]
push 0x1016b638
push edx
call fcn.10127dc0
lea eax, [esp + 0x96c]
add esp, 0xc
mov esi, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100acab0
lea edi, [esp + 0x440]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x100acac1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x440]
rep movsb byte es:[edi], byte [esi]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100acae1
sub eax, edx
cmp eax, 0x18
jb 0x100aca85
lea eax, [esp + 0x440]
push eax
push 0x101a9f68
push 0x101aa070
lea ecx, [esp + 0x34]
push str._s__s__s
push ecx
mov byte [esp + 0x468], 0
call fcn.10127dc0
add esp, 0x14
push 1
lea edx, [esp + 0x2c]
mov edi, 0x10175e60
mov ecx, ebx
call fcn.100ac310
add esp, 4
push 0
mov edx, 0x10175e08
mov edi, str.Malware
mov ecx, ebx
call fcn.100ac310
add esp, 4
push 0
mov edx, 0x10175e0c
mov edi, 0x1014d5e3
mov ecx, ebx
call fcn.100ac310
add esp, 4
lea edx, [esp + 0xae8]
push edx
lea eax, [esp + 0x2c]
push 0x1014d8cc
push eax
call fcn.10127dc0
add esp, 0xc
lea ecx, [esp + 0x28]
push 0x3a
push ecx
call fcn.10128490
add esp, 8
test eax, eax
je 0x100acbc7
inc eax
lea edx, [esp + 0x130]
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x100acb93
lea edx, [esp + 0x130]
push edx
call fcn.10061df0
add esp, 4
lea eax, [esp + 0x130]
push eax
lea ecx, [esp + 0x2c]
push str.Virus:_s
push ecx
call fcn.10127dc0
add esp, 0xc
push 1
lea edx, [esp + 0x2c]
mov edi, 0x1015d91c
mov ecx, ebx
call fcn.100ac310
add esp, 4
lea edx, [esp + 0x1510]
push edx
lea eax, [esp + 0x2c]
push str.file:_s
push eax
call fcn.10127dc0
add esp, 0xc
push 0x10158684
lea ecx, [esp + 0x2c]
push 0x10158184
push ecx
call fcn.10064100
add esp, 0xc
push 1
lea edx, [esp + 0x2c]
mov edi, str.Path
mov ecx, ebx
call fcn.100ac310
add esp, 4
push 1
mov edx, str.OBSERVED
mov edi, str.State
mov ecx, ebx
call fcn.100ac310
add esp, 4
push 0
mov edx, str.VIRUS
mov edi, str.Type
mov ecx, ebx
call fcn.100ac310
add esp, 4
push 0
mov edx, 0x10175e24
mov edi, 0x1014d5e3
mov ecx, ebx
call fcn.100ac310
add esp, 4
push 1
mov edx, 0x101581cc
mov ecx, ebx
call fcn.100ac310
add esp, 4
push 0x101a9f68
push 0x101a9f68
push 0x101aa070
lea edx, [esp + 0x34]
push str.arn:aws:securityhub:_s:_s:product__s_default
push edx
call fcn.10127dc0
add esp, 0x14
push 1
lea edx, [esp + 0x2c]
mov edi, str.ProductArn
mov ecx, ebx
call fcn.100ac310
add esp, 4
push 0
mov edx, 0x10175e0c
mov edi, str.ProductFields
mov ecx, ebx
call fcn.100ac310
add esp, 4
cmp byte [0x101cd150], 0
push 1
mov edi, str.eScan_Version
mov ecx, ebx
mov edx, str.14.0.1400.2228
je 0x100accdd
mov edx, 0x101cd150
call fcn.100ac310
add esp, 4
push 1
lea edx, [esp + 0x9e4]
mov edi, str.eScan_Action_Result
mov ecx, ebx
call fcn.100ac310
add esp, 4
push 0
mov edx, str.No_additional_actions_required
mov edi, str.eScan_User_Result
mov ecx, ebx
call fcn.100ac310
add esp, 4
push 1
mov edx, 0x10175e24
mov edi, 0x1014d5e3
mov ecx, ebx
call fcn.100ac310
add esp, 4
push 0
mov edx, 0x10175e08
mov edi, str.Resources
mov ecx, ebx
call fcn.100ac310
add esp, 4
push 0
mov edx, 0x10175e0c
mov edi, 0x1014d5e3
mov ecx, ebx
call fcn.100ac310
add esp, 4
push 1
mov edx, str.Other
mov edi, str.Type
mov ecx, ebx
call fcn.100ac310
add esp, 4
xor eax, eax
lea ecx, [ecx]
mov cl, byte [esp + eax + 0xff0]
mov byte [esp + eax + 0x28], cl
inc eax
test cl, cl
jne 0x100acd70
push 0x10158684
lea eax, [esp + 0x2c]
push 0x10158184
push eax
call fcn.10064100
add esp, 0xc
push 0
lea edx, [esp + 0x2c]
mov edi, 0x10175e60
mov ecx, ebx
call fcn.100ac310
add esp, 4
push 0
mov edx, 0x10175e24
mov edi, 0x1014d5e3
mov ecx, ebx
call fcn.100ac310
add esp, 4
push 1
mov edx, 0x101581cc
mov ecx, ebx
call fcn.100ac310
add esp, 4
push 1
mov edx, str.2018_10_08
mov edi, str.SchemaVersion
mov ecx, ebx
call fcn.100ac310
add esp, 4
push 0
mov edx, 0x10175e0c
mov edi, str.Severity
mov ecx, ebx
call fcn.100ac310
mov edi, dword [esp + 0x14]
add esp, 4
push 0
mov edx, str.Normalized
mov ecx, ebx
call fcn.100ac260
add esp, 4
push 1
mov edx, 0x10175e24
mov edi, 0x1014d5e3
mov ecx, ebx
call fcn.100ac310
add esp, 4
push 1
mov edx, str.eScan_Generated_AFF
mov edi, str.Title
mov ecx, ebx
call fcn.100ac310
add esp, 4
push 0
mov edx, 0x10175e08
mov edi, str.Types
mov ecx, ebx
call fcn.100ac310
add esp, 4
push 0
mov edx, 0x1014d5e3
mov edi, str.Unusual_Behaviors_Process
mov ecx, ebx
call fcn.100ac310
add esp, 4
push 1
mov edx, 0x101581cc
mov edi, 0x1014d5e3
mov ecx, ebx
call fcn.100ac310
add esp, 4
push 0
lea edx, [esp + 0x654]
mov edi, str.UpdatedAt
mov ecx, ebx
call fcn.100ac310
add esp, 4
push 0
mov edx, 0x10175e24
mov edi, 0x1014d5e3
mov ecx, ebx
call fcn.100ac310
add esp, 4
push 0
mov edx, 0x101581cc
mov ecx, ebx
call fcn.100ac310
add esp, 4
lea ecx, [esp + 0x24]
push ecx
call fcn.10082e10
cmp byte [0x101aa388], 0
je 0x100ad041
cmp byte [0x101a9f68], 0
je 0x100ad041
cmp byte [0x101aa070], 0
je 0x100ad041
cmp byte [0x101aa178], 0
je 0x100ad041
cmp byte [0x101aa280], 0
je 0x100ad041
push 0x101a76ac
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x207
lea edx, [esp + 0x75d]
push 0
push edx
mov byte [esp + 0x764], 0
call fcn.1012e060
add esp, 0xc
push 0x207
lea eax, [esp + 0x135]
push 0
push eax
mov byte [esp + 0x13c], 0
call fcn.1012e060
add esp, 0xc
lea ecx, [esp + 0x758]
push ecx
push 0x208
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x7e
push 0x101cd048
call fcn.10128490
add esp, 8
test eax, eax
je 0x100acf96
push 0x208
lea ebx, [esp + 0x134]
mov esi, 0x101cd048
call fcn.1005f230
add esp, 4
jmp 0x100acfa9
push 0x101cd048
lea edx, [esp + 0x134]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x130]
call fcn.10065200
lea edi, [esp + 0x130]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100acfc0
mov eax, dword [0x10175fd4]
lea ecx, [esp + 0x130]
mov dword [edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push ecx
call edi
lea edx, [esp + 0x338]
push edx
push 0x101aa280
push 0x101aa178
push 0x101aa070
push 0x101aa388
mov esi, eax
lea eax, [esp + 0x1924]
push str._s__r__s__a__s__k__s__f___s_
push eax
call fcn.10127dc0
add esp, 0x1c
lea edx, [esp + 0x1910]
call fcn.10063a50
test esi, esi
je 0x100ad036
cmp byte [esp + 0x758], 0
je 0x100ad036
lea ecx, [esp + 0x758]
push ecx
call edi
push 0x101a76ac
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [esp + 0x338]
call fcn.1005ad10
mov ecx, dword [esp + 0x1d24]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10127db1
mov esp, ebp
pop ebp
ret