joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10036f70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1009b026
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x100e6018]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
push esi
push edi
mov eax, dword [0x100e6018]
xor eax, esp
push eax
lea eax, [esp + 0x278]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
push 1
xor eax, eax
push 0x100b3c24
lea ecx, [esp + 0x54]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], 0
mov dword [esp + 0x68], 7
mov dword [esp + 0x64], 0
mov word [esp + 0x54], ax
call fcn.100089b0
xor eax, eax
push 0x206
mov dword [esp + 0x284], 0
push eax
mov word [esp + 0x6c], ax
lea eax, [esp + 0x6e]
push eax
call sub.MSVCR110.dll_memset
lea eax, [esp + 0x70]
push 0x104
push eax
call sym.iImportLib.dll_int___cdecl_elex::func::GetSelfBasePath_wchar_t___unsigned_long_int_
add esp, 0x14
test eax, eax
jne 0x10037035
lea eax, [esp + 0x4c]
push eax
mov ecx, esi
call fcn.1000f9e0
jmp 0x1003714b
cmp dword [edi + 0x14], 8
jb 0x1003703f
mov eax, dword [edi]
jmp 0x10037041
mov eax, edi
push str..exe
push eax
lea eax, [esp + 0x6c]
push eax
push str._s_s_s
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_swprintf_s]
add esp, 0x18
cmp word [esp + 0x64], 0
je 0x1003713f
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1003713f
xor eax, eax
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], ax
lea edx, [esp + 0x34]
mov ecx, ebx
mov byte [esp + 0x280], 1
call fcn.10036e40
push 0xe
push str.99991020182042
push dword [esp + 0x4c]
push ecx
lea ecx, [esp + 0x44]
call fcn.10010100
mov ebx, dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
test eax, eax
jne 0x100370fd
cmp dword [edi + 0x14], 8
jb 0x100370d1
mov edi, dword [edi]
push edi
push dword [esp + 0x18]
lea eax, [esp + 0x24]
push eax
call sym.iImportLib.dll_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_elex::uphlp::DB_GetEFileVersion_unsigned_long_int__wchar_t_const__
add esp, 0xc
lea ecx, [esp + 0x34]
push eax
call fcn.1000d090
cmp dword [esp + 0x30], 8
jb 0x100370fd
push dword [esp + 0x1c]
call ebx
add esp, 4
lea eax, [esp + 0x34]
push eax
mov ecx, esi
call fcn.1000f9e0
cmp dword [esp + 0x48], 8
jb 0x10037119
push dword [esp + 0x34]
call ebx
add esp, 4
xor eax, eax
cmp dword [esp + 0x60], 8
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], ax
jb 0x1003715f
push dword [esp + 0x4c]
call ebx
jmp 0x1003715c
push str.99991020182042
mov ecx, esi
call fcn.10008550
cmp dword [esp + 0x60], 8
jb 0x1003715f
push dword [esp + 0x4c]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x278]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.100947be
mov esp, ebp
pop ebp
ret
Function at 0x10037190
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x100e6018]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.MSVCR110.dll_memset
push 0
lea ecx, [ebp - 0x20c]
call fcn.10035610
add esp, 0x10
mov dword [ebp - 0x418], eax
test eax, eax
jne 0x100371eb
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100947be
mov esp, ebp
pop ebp
ret
push ebx
push esi
lea eax, [ebp - 0x20c]
push eax
push 0
push str.ComponentCount
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebx, eax
xor esi, esi
test ebx, ebx
je 0x1003726b
mov edi, edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call sub.MSVCR110.dll_memset
push esi
push str.Component_u
lea eax, [ebp - 0x414]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_swprintf_s]
add esp, 0x1c
lea eax, [ebp - 0x20c]
push eax
push 0
push str.ComponentId
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [ebp + 8], eax
je 0x10037282
inc esi
cmp esi, ebx
jb 0x10037210
mov eax, dword [ebp - 0x418]
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100947be
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x14], 8
jb 0x1003728a
mov edi, dword [edi]
lea eax, [ebp - 0x20c]
push eax
push edi
push str.Version
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 4]
pop esi
pop ebx
xor ecx, ebp
mov eax, 1
pop edi
call fcn.100947be
mov esp, ebp
pop ebp
ret
Function at 0x10037920
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009ad69
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x100e6018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 8
jb 0x1003795b
mov eax, dword [esi]
jmp 0x1003795d
mov eax, esi
test eax, eax
je 0x10037a08
cmp word [eax], 0
je 0x10037a08
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10037a08
xor eax, eax
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x28], 0
mov word [ebp - 0x38], ax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call dword [sym.imp.sqlite3.dll_public:_void___thiscall_CppSQLite3DB::constructor_void_]
push 0xfde9
lea eax, [ebp - 0x50]
push esi
push eax
mov byte [ebp - 4], 2
call sym.iImportLib.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_elex::strings::ws2s_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___unsigned_int_
add esp, 0xc
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 0x10
jb 0x100379c5
mov eax, dword [eax]
push 1
push 0xe
push str.z8rf_x_5_QAZ_
push 0
push 0
push eax
lea ecx, [ebp - 0x20]
call dword [sym.imp.sqlite3.dll_public:_void___thiscall_CppSQLite3DB::open_char_const___void_const___int__void_const___int__bool_]
mov byte [ebp - 4], 2
cmp dword [ebp - 0x3c], 0x10
jb 0x100379f2
push dword [ebp - 0x50]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
lea ecx, [ebp - 0x20]
call dword [sym.imp.sqlite3.dll_public:_void___thiscall_CppSQLite3DB::close_void_]
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call dword [sym.imp.sqlite3.dll_public_virtual:_void___thiscall_CppSQLite3DB::destructor_void_]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100947be
mov esp, ebp
pop ebp
ret
Function at 0x10038c70
Capabilities:
Check for sandbox and av modules
Check for sandbox username or hostname
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100e6018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x10038caa
push str._vim
push eax
call dword [sym.imp.MSVCR110.dll_wcsstr]
add esp, 8
test eax, eax
je 0x10038caa
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100947be
mov esp, ebp
pop ebp
ret
call fcn.10038080
test eax, eax
jne 0x10038cc3
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100947be
mov esp, ebp
pop ebp
ret
push str.sbiedll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x10038cb3
lea eax, [ebp - 8]
push eax
push 0x100ebb58
mov dword [ebp - 8], 0x400
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x10038cb3
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
push str.CurrentUser
push 0x100ebb58
call esi
test eax, eax
je 0x10038e2a
push str.Sandbox
push 0x100ebb58
call esi
test eax, eax
je 0x10038e2a
lea eax, [ebp - 8]
push eax
push 0x100ebb58
mov dword [ebp - 8], 0x400
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x10038e2a
push str.SANDBOX
push 0x100ebb58
call esi
test eax, eax
je 0x10038e2a
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea eax, [ebp - 0xc]
push eax
push str.HARDWAREDESCRIPTIONSystem
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], 0
call esi
test eax, eax
jne 0x10038e2a
lea edx, [ebp - 0xc]
mov ecx, str.SystemBiosVersion
call fcn.100380e0
test al, al
je 0x10038e2a
mov ecx, str.VBOX
call fcn.10038390
test al, al
jne 0x10038e2a
lea eax, [ebp - 0xc]
push eax
push str.HARDWAREDESCRIPTIONSystem
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], 0
call esi
test eax, eax
jne 0x10038e2a
lea edx, [ebp - 0xc]
mov ecx, str.VideoBiosVersion
call fcn.100380e0
test al, al
je 0x10038e2a
mov ecx, str.VirtualBox
call fcn.10038390
test al, al
jne 0x10038e2a
lea eax, [ebp - 0xc]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], 0
call esi
test eax, eax
jne 0x10038e2a
lea edx, [ebp - 0xc]
mov ecx, str.SystemBiosVersion
call fcn.100380e0
test al, al
je 0x10038e2a
call fcn.10038f50
test al, al
jne 0x10038e2a
call fcn.10038ea0
test al, al
jne 0x10038e2a
call fcn.10038e40
test al, al
setne al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100947be
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
pop esi
call fcn.100947be
mov esp, ebp
pop ebp
ret
Function at 0x10039660
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009b228
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100e6018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0
push 0
push 0
push 3
push 4
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x100396b1
cmp eax, 0x80010119
jne 0x10039748
lea esi, [edi + 0xc]
push esi
push 0x100a2064
push 1
push 0
push 0x100a2134
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x10039748
mov ebx, dword [esi]
push 0x100b5c80
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
jne 0x100396ed
push 0x8007000e
call fcn.1001df70
lea ecx, [edi + 8]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [ebp - 4], 0
mov eax, dword [ebx]
push esi
push ebx
mov dword [ebp - 0x10], ecx
call dword [eax + 0xc]
push esi
mov edi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
jns 0x1003972f
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [eax]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10039ac0
Capabilities:
Create directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x100e6018]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
test esi, esi
je 0x10039bb3
cmp byte [ebp + 8], 0
je 0x10039bc7
cmp byte [ebp + 0x10], 0
je 0x10039b05
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x214]
push esi
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_wcscpy_s]
add esp, 0xc
lea eax, [ebp - 0x214]
push 0x5c
push eax
call dword [sym.imp.MSVCR110.dll_wcsrchr]
mov esi, eax
add esp, 8
test esi, esi
je 0x10039b6c
xor eax, eax
push eax
mov word [esi], ax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, 0x5c
mov word [esi], ax
lea eax, [ebp - 0x214]
push 0x2e
push eax
call dword [sym.imp.MSVCR110.dll_wcsrchr]
add esp, 8
test eax, eax
jne 0x10039b9c
push str..zip
lea eax, [ebp - 0x214]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_wcscat_s]
add esp, 0xc
push 0
push ecx
lea ecx, [ebp - 0x214]
call fcn.10066030
add esp, 8
mov dword [edi], eax
test eax, eax
jne 0x10039bee
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.100947be
mov esp, ebp
pop ebp
ret 0xc
push 0
push ecx
mov ecx, esi
call fcn.10061ba0
add esp, 8
mov dword [edi], eax
test eax, eax
jne 0x10039bee
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.100947be
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.100947be
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10039c50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, ecx
test esi, esi
je 0x10039ca6
mov edx, esi
lea edi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10039c64
sub edx, edi
sar edx, 1
je 0x10039ca6
cmp word [esi], ax
je 0x10039ca6
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10039ca6
push esi
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov ecx, dword [ebx]
mov edx, eax
call fcn.10066190
add esp, 4
test eax, eax
sete al
pop edi
pop esi
pop ebx
pop ebp
ret 4
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 4
Function at 0x10039cb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x100e6018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test esi, esi
je 0x10039dce
mov ecx, esi
lea edx, [ecx + 2]
jmp 0x10039ce0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10039ce0
sub ecx, edx
sar ecx, 1
je 0x10039dce
cmp word [esi], ax
je 0x10039dce
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10039dce
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.MSVCR110.dll_memset
push esi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_wcscpy_s]
lea ecx, [ebp - 0x20c]
add esp, 0x18
lea edx, [ecx + 2]
jmp 0x10039d50
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10039d50
sub ecx, edx
sar ecx, 1
cmp word [ebp + ecx*2 - 0x20e], 0x5c
je 0x10039d84
push 0x100a21f4
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_wcscat_s]
add esp, 0xc
lea edx, [ebp - 0x20c]
lea esi, [edx + 2]
lea ecx, [ecx]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10039d90
sub edx, esi
sar edx, 1
push edx
push ebx
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call sym.iImportLib.dll_private:_int___thiscall_zipHelper::DirectoryList_wchar_t_const___wchar_t_const___unsigned_long_int_
cmp byte [ebp + 0x10], 0
jne 0x10039db9
test eax, eax
je 0x10039dce
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100947be
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.100947be
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10039df0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test esi, esi
jne 0x10039e06
pop edi
xor al, al
pop esi
pop ebp
ret 8
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10039dfe
mov ecx, edi
test al, 0x10
je 0x10039e29
push dword [ebp + 0xc]
push 0
push esi
call sym.iImportLib.dll_public:_bool___thiscall_zipHelper::zipFolder_wchar_t_const___wchar_t_const___bool_
pop edi
pop esi
pop ebp
ret 8
push esi
call sym.iImportLib.dll_public:_bool___thiscall_zipHelper::zipFile_wchar_t_const__
pop edi
pop esi
pop ebp
ret 8
Function at 0x10039e40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [edx]
mov edx, dword [edx + 4]
sub edx, esi
mov eax, 0x2aaaaaab
imul edx
sar edx, 2
mov eax, edx
mov dword [ebp - 8], ecx
xor ecx, ecx
shr eax, 0x1f
push edi
mov dword [ebp - 4], ecx
add eax, edx
je 0x10039f23
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
lea ebx, [ebx]
add esi, ebx
cmp dword [esi + 0x14], 8
jb 0x10039e8a
mov esi, dword [esi]
test esi, esi
je 0x10039f2e
push esi
call edi
cmp eax, 0xffffffff
je 0x10039f2e
test al, 0x10
je 0x10039eb2
push dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
push 0
push esi
call sym.iImportLib.dll_public:_bool___thiscall_zipHelper::zipFolder_wchar_t_const___wchar_t_const___bool_
jmp 0x10039ef5
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10039eb7
sub eax, edx
sar eax, 1
je 0x10039ef3
cmp word [esi], cx
je 0x10039ef3
push esi
call edi
cmp eax, 0xffffffff
je 0x10039ef3
push esi
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call fcn.10066190
add esp, 4
test eax, eax
sete al
jmp 0x10039ef5
xor al, al
test al, al
je 0x10039f2e
mov eax, dword [ebp + 8]
inc dword [ebp - 4]
mov esi, dword [eax]
mov ecx, dword [eax + 4]
sub ecx, esi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
add ebx, 0x18
cmp dword [ebp - 4], eax
jb 0x10039e80
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1003ae40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test esi, esi
jne 0x1003ae56
pop edi
xor al, al
pop esi
pop ebp
ret 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1003ae4e
mov ecx, edi
test al, 0x10
je 0x1003ae7c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push esi
call sym.iImportLib.dll_public:_bool___thiscall_zipHelper::zipFolder_Level_wchar_t_const___wchar_t_const___int__bool_
pop edi
pop esi
pop ebp
ret 0xc
push esi
call sym.iImportLib.dll_public:_bool___thiscall_zipHelper::zipFile_wchar_t_const__
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x1003ae90
Capabilities:
Create directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1009b2e6
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x100e6018]
xor eax, esp
mov dword [esp + 0x240], eax
push ebx
push esi
push edi
mov eax, dword [0x100e6018]
xor eax, esp
push eax
lea eax, [esp + 0x258]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
xor eax, eax
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], 0
mov word [esp + 0x2c], ax
cmp word [edx], ax
jne 0x1003aef8
xor ecx, ecx
jmp 0x1003af0f
mov ecx, edx
lea edi, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003af00
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0x34]
call fcn.100089b0
push 0xfde9
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x26c], 0
call sym.iImportLib.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_elex::strings::ws2s_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___unsigned_int_
add esp, 0xc
mov byte [esp + 0x260], 1
test esi, esi
je 0x1003b01c
cmp byte [ebp + 8], 0
je 0x1003b081
cmp byte [ebp + 0x10], 0
je 0x1003af6f
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
push 0x206
push eax
mov word [esp + 0x4c], ax
lea eax, [esp + 0x4e]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x44]
push esi
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_wcscpy_s]
mov edi, dword [sym.imp.MSVCR110.dll_wcsrchr]
add esp, 0xc
lea eax, [esp + 0x44]
push 0x5c
push eax
call edi
mov esi, eax
add esp, 8
test esi, esi
je 0x1003afce
xor eax, eax
push eax
mov word [esi], ax
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, 0x5c
mov word [esi], ax
lea eax, [esp + 0x44]
push 0x2e
push eax
call edi
add esp, 8
test eax, eax
jne 0x1003aff6
push str..zip
lea eax, [esp + 0x48]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_wcscat_s]
add esp, 0xc
cmp dword [esp + 0x28], 0x10
lea eax, [esp + 0x14]
cmovae eax, dword [esp + 0x14]
push eax
push ecx
lea ecx, [esp + 0x4c]
call fcn.10066030
add esp, 8
mov dword [ebx], eax
test eax, eax
jne 0x1003b0a5
xor bl, bl
cmp dword [esp + 0x28], 0x10
mov esi, dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
jb 0x1003b034
push dword [esp + 0x14]
call esi
add esp, 4
cmp dword [esp + 0x40], 8
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
jb 0x1003b059
push dword [esp + 0x2c]
call esi
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x258]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x240]
xor ecx, esp
call fcn.100947be
mov esp, ebp
pop ebp
ret 0x10
cmp dword [esp + 0x28], 0x10
lea eax, [esp + 0x14]
cmovae eax, dword [esp + 0x14]
push eax
push ecx
mov ecx, esi
call fcn.10061ba0
add esp, 8
mov dword [ebx], eax
test eax, eax
je 0x1003b01c
mov bl, 1
jmp 0x1003b01e
Function at 0x1003b0b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x100e6018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test esi, esi
je 0x1003b283
mov ecx, esi
lea edx, [ecx + 2]
jmp 0x1003b0e0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003b0e0
sub ecx, edx
sar ecx, 1
je 0x1003b283
cmp word [esi], ax
je 0x1003b283
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1003b283
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.MSVCR110.dll_memset
push esi
mov esi, dword [sym.imp.MSVCR110.dll_wcscpy_s]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call esi
lea ecx, [ebp - 0x20c]
add esp, 0x18
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003b150
sub ecx, edx
sar ecx, 1
cmp word [ebp + ecx*2 - 0x20e], 0x5c
je 0x1003b184
push 0x100a21f4
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_wcscat_s]
add esp, 0xc
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call sub.MSVCR110.dll_memset
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call esi
lea ecx, [ebp - 0x414]
add esp, 0x18
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003b1c0
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 - 2]
cmp ecx, 0x208
jae 0x1003b298
xor eax, eax
mov word [ebp + ecx - 0x414], ax
lea eax, [ebp - 0x414]
push 0x5c
push eax
call dword [sym.imp.MSVCR110.dll_wcsrchr]
mov ecx, eax
add esp, 8
test ecx, ecx
jne 0x1003b21d
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003b210
jmp 0x1003b22b
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003b220
sub ecx, edx
lea edx, [ebp - 0x20c]
sar ecx, 1
lea esi, [edx + 2]
jmp 0x1003b240
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x1003b240
push dword [ebp + 0x10]
sub edx, esi
sar edx, 1
sub edx, ecx
push edx
push ebx
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call sym.iImportLib.dll_private:_int___thiscall_zipHelper::DirectoryList_Level_wchar_t_const___wchar_t_const___unsigned_long_int__int_
cmp byte [ebp + 0x14], 0
jne 0x1003b26e
test eax, eax
je 0x1003b283
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100947be
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.100947be
mov esp, ebp
pop ebp
ret 0x10
call fcn.10094b3c
int3