Function at 0x504394
Capabilities:
Get common file path
Get session user name

Disassembly:
mov eax, 0x5adb2d
call fcn.00591b5c
sub esp, 0xa70
mov eax, dword [0x6c0bc0]
xor eax, dword [ebp + 4]
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0xa7c], ecx
mov eax, dword [ebp + 0x14]
and dword [eax], 0
mov eax, dword [ebp + 0x18]
and dword [eax], 0
mov eax, dword [ebp + 0x1c]
and dword [eax], 0
cmp dword [ebp + 0xc], 0
je 0x5043da
push 1
mov ecx, dword [ebp + 0xc]
call fcn.004da7ff
mov byte [ebp - 0xd6], 1
mov ecx, dword [ebp - 0xa7c]
call fcn.00502605
movzx eax, al
test eax, eax
jne 0x5043fa
xor al, al
jmp 0x504ff9
xor eax, eax
cmp dword [ebp + 0x10], 0
sete al
mov byte [ebp - 0xd7], al
movzx eax, byte [ebp - 0xd7]
test eax, eax
je 0x50447d
lea ecx, [ebp - 0x140]
call fcn.004fed56
and dword [ebp - 4], 0
mov eax, dword [ebp - 0xa7c]
add eax, 8
push eax
mov ecx, dword [ebp - 0xa7c]
add ecx, 0x154
call fcn.0055420c
push eax
call fcn.004d620f
pop ecx
pop ecx
movzx eax, al
test eax, eax
jne 0x50446e
and byte [ebp - 0xa71], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x140]
call fcn.004d61fd
mov al, byte [ebp - 0xa71]
jmp 0x504ff9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x140]
call fcn.004d61fd
and byte [ebp - 0xd5], 0
mov eax, dword [ebp - 0xa7c]
cmp dword [eax + 0x110], 0
je 0x5046c4
mov eax, dword [ebp - 0xa7c]
cmp dword [eax + 0x110], 4
je 0x5046c4
mov eax, dword [ebp - 0xa7c]
cmp dword [eax + 0x114], 0x80
je 0x504501
mov eax, dword [ebp - 0xa7c]
cmp dword [eax + 0x114], 0xc0
je 0x504501
mov eax, dword [ebp - 0xa7c]
cmp dword [eax + 0x114], 0x100
je 0x504501
push str.The_key_length_for_encrypted_Zips_must_be_128__192__or_256
mov ecx, dword [ebp - 0xa7c]
add ecx, 8
mov eax, dword [ebp - 0xa7c]
mov eax, dword [eax + 8]
call dword [eax + 0x10]
xor al, al
jmp 0x504ff9
mov ecx, dword [ebp - 0xa7c]
add ecx, 0x134
call fcn.004ccbf8
test eax, eax
jne 0x504537
push str.A_password_must_be_specified_for_encrypted_Zips.
mov ecx, dword [ebp - 0xa7c]
add ecx, 8
mov eax, dword [ebp - 0xa7c]
mov eax, dword [eax + 8]
call dword [eax + 0x10]
xor al, al
jmp 0x504ff9
lea ecx, [ebp - 0x174]
call fcn.004cde9c
mov dword [ebp - 4], 1
push dword [0x670644]
lea ecx, [ebp - 0x174]
call fcn.004cd951
push 0x62a8b0
lea ecx, [ebp - 0x174]
call fcn.004cd951
lea ecx, [ebp - 0x198]
call fcn.004cde9c
mov byte [ebp - 4], 2
push str.0123456789ABCDEF0123456789ABCDEF
lea ecx, [ebp - 0x198]
call fcn.004cd951
lea ecx, [ebp - 0x158]
call fcn.004d17b0
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0xa7c]
add eax, 8
push eax
lea eax, [ebp - 0x158]
push eax
lea ecx, [ebp - 0x198]
call fcn.004ccbf8
push eax
lea ecx, [ebp - 0x198]
call fcn.0055420c
push eax
mov ecx, dword [ebp - 0xa7c]
add ecx, 0x134
call fcn.0055420c
push eax
push 0x100
push 3
call fcn.0052b518
add esp, 0x1c
lea ecx, [ebp - 0x198]
call fcn.004cd0cb
lea ecx, [ebp - 0x17c]
call fcn.004e456a
mov byte [ebp - 4], 4
lea eax, [ebp - 0x198]
push eax
lea ecx, [ebp - 0x158]
call fcn.004d1628
push eax
lea ecx, [ebp - 0x158]
call fcn.0055420c
push eax
lea ecx, [ebp - 0x17c]
call fcn.004e4882
lea eax, [ebp - 0x198]
push eax
lea ecx, [ebp - 0x174]
call fcn.004cf7bb
push 0x61fd20
lea ecx, [ebp - 0x174]
call fcn.004cd951
lea ecx, [ebp - 0x174]
call fcn.0055420c
push eax
mov ecx, dword [ebp - 0xa7c]
add ecx, 0x74
call fcn.004cf872
lea ecx, [ebp - 0x174]
call fcn.0055420c
push eax
push str.EncryptComment
mov ecx, dword [ebp - 0xa7c]
add ecx, 8
mov eax, dword [ebp - 0xa7c]
mov eax, dword [eax + 8]
call dword [eax + 0x28]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x17c]
call fcn.004d61fd
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x158]
call fcn.004d283f
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x198]
call fcn.004ce1b7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x174]
call fcn.004ce1b7
push 0x61cd08
mov ecx, dword [ebp - 0xa7c]
add ecx, 0x190
call fcn.004cfed4
movzx eax, al
test eax, eax
je 0x5048e6
mov dword [ebp - 0x5c0], 0x190
lea eax, [ebp - 0x5c0]
push eax
lea eax, [ebp - 0x5bc]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0x404]
push eax
push 0x258
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
and byte [ebp - 0x199], 0
lea ecx, [ebp - 0x420]
call fcn.004cde9c
mov dword [ebp - 4], 5
lea eax, [ebp - 0x404]
push eax
lea ecx, [ebp - 0x420]
call fcn.004cd951
lea ecx, [ebp - 0x420]
call fcn.004cf636
push str.windows_system32
lea ecx, [ebp - 0x420]
call fcn.004cfc30
movzx eax, al
test eax, eax
jne 0x504779
push str.winnt_system32
lea ecx, [ebp - 0x420]
call fcn.004cfc30
movzx eax, al
test eax, eax
je 0x504780
mov byte [ebp - 0x199], 1
movzx eax, byte [ebp - 0x199]
test eax, eax
jne 0x504811
lea ecx, [ebp - 0x5dc]
call fcn.004cde9c
mov byte [ebp - 4], 6
lea eax, [ebp - 0x5bc]
push eax
lea ecx, [ebp - 0x5dc]
call fcn.004cd951
push str.ASPNET
lea ecx, [ebp - 0x5dc]
call fcn.004cfed4
movzx eax, al
test eax, eax
jne 0x5047fb
push 5
push str.IWAM_
lea eax, [ebp - 0x5bc]
push eax
call fcn.005908d3
add esp, 0xc
test eax, eax
je 0x5047fb
push 5
push str.IUSR_
lea eax, [ebp - 0x5bc]
push eax
call fcn.005908d3
add esp, 0xc
test eax, eax
jne 0x504802
mov byte [ebp - 0x199], 1
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x5dc]
call fcn.004ce1b7
movzx eax, byte [ebp - 0x199]
test eax, eax
je 0x5048d7
mov ecx, dword [ebp - 0xa7c]
add ecx, 0x154
call fcn.0055420c
mov dword [ebp - 0x5e0], eax
push 0x5c
push dword [ebp - 0x5e0]
call fcn.00591f10
pop ecx
pop ecx
mov dword [ebp - 0x5e4], eax
cmp dword [ebp - 0x5e4], 0
jne 0x50486a
push 0x2f
push dword [ebp - 0x5e0]
call fcn.00591f10
pop ecx
pop ecx
mov dword [ebp - 0x5e4], eax
cmp dword [ebp - 0x5e4], 0
je 0x5048d7
push str.Using_temp_directory_where_target_Zip_is_located.
mov ecx, dword [ebp - 0xa7c]
add ecx, 8
mov eax, dword [ebp - 0xa7c]
mov eax, dword [eax + 8]
call dword [eax + 0x10]
mov ecx, dword [ebp - 0xa7c]
add ecx, 0x190
call fcn.004cd0cb
mov eax, dword [ebp - 0x5e4]
sub eax, dword [ebp - 0x5e0]
push eax
push dword [ebp - 0x5e0]
mov ecx, dword [ebp - 0xa7c]
add ecx, 0x190
call fcn.004cdb7e
push 0x2f
push 0x5c
mov ecx, dword [ebp - 0xa7c]
add ecx, 0x190
call fcn.004ccf9f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x420]
call fcn.004ce1b7
lea ecx, [ebp - 0x13c]
call fcn.004d00b6
mov dword [ebp - 4], 7
lea ecx, [ebp - 0xd4]
call fcn.004d00b6
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x6c]
call fcn.004d00b6
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0xa7c]
add ecx, 0x190
call fcn.0055420c
push eax
lea ecx, [ebp - 0x13c]
call fcn.004d0448
push 0x609804
lea ecx, [ebp - 0xd4]
call fcn.004d0448
movzx eax, byte [ebp - 0xd7]
test eax, eax
je 0x504a71
mov dword [ebp - 0x9e8], 0x190
lea eax, [ebp - 0x9e8]
push eax
lea eax, [ebp - 0x9e4]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0x844]
push eax
push 0x258
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, dword [ebp - 0xa7c]
add eax, 8
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.004d4fca
add esp, 0x10
mov byte [ebp - 0x845], al
movzx eax, byte [ebp - 0x845]
test eax, eax
jne 0x504a0a
push str.Failed_to_get_temporary_filename__A_
mov ecx, dword [ebp - 0xa7c]
add ecx, 8
mov eax, dword [ebp - 0xa7c]
mov eax, dword [eax + 8]
call dword [eax + 0x10]
and byte [ebp - 0xa72], 0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x6c]
call fcn.004d018e
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xd4]
call fcn.004d018e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.004d018e
mov al, byte [ebp - 0xa72]
jmp 0x504ff9
lea ecx, [ebp - 0x6c]
call fcn.004d0c2d
push eax
push str.tempFile
mov ecx, dword [ebp - 0xa7c]
add ecx, 8
mov eax, dword [ebp - 0xa7c]
mov eax, dword [eax + 8]
call dword [eax + 0x28]
lea eax, [ebp - 0x9e4]
push eax
push str.loggedOnUser
mov ecx, dword [ebp - 0xa7c]
add ecx, 8
mov eax, dword [ebp - 0xa7c]
mov eax, dword [eax + 8]
call dword [eax + 0x28]
lea eax, [ebp - 0x844]
push eax
push str.curDir
mov ecx, dword [ebp - 0xa7c]
add ecx, 8
mov eax, dword [ebp - 0xa7c]
mov eax, dword [eax + 8]
call dword [eax + 0x28]
jmp 0x504a7e
push str.____.____
lea ecx, [ebp - 0x6c]
call fcn.004d03d5
or dword [ebp - 0x70], 0xffffffff
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
lea eax, [ebp - 0xd6]
push eax
push dword [ebp + 0xc]
mov al, byte [0x6c4279]
push eax
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [ebp - 0xa7c]
call fcn.00505099
mov dword [ebp - 0x70], eax
movzx eax, byte [ebp - 0xd7]
test eax, eax
je 0x504bba
cmp dword [ebp - 0x70], 0xfffffffe
jne 0x504bba
lea ecx, [ebp - 0x6c]
call fcn.004d0334
push str.ckz2
lea ecx, [ebp - 0xd4]
call fcn.004d0448
mov eax, dword [ebp - 0xa7c]
add eax, 8
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.004d4fca
add esp, 0x10
mov byte [ebp - 0x9e9], al
movzx eax, byte [ebp - 0x9e9]
test eax, eax
jne 0x504b6f
push str.Failed_to_get_temporary_filename__B_
mov ecx, dword [ebp - 0xa7c]
add ecx, 8
mov eax, dword [ebp - 0xa7c]
mov eax, dword [eax + 8]
call dword [eax + 0x10]
and byte [ebp - 0xa73], 0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x6c]
call fcn.004d018e
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xd4]
call fcn.004d018e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.004d018e
mov al, byte [ebp - 0xa73]
jmp 0x504ff9
push str.Retrying_with_a_new_temp_filename
mov ecx, dword [ebp - 0xa7c]
add ecx, 8
mov eax, dword [ebp - 0xa7c]
mov eax, dword [eax + 8]
call dword [eax + 0x14]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
lea eax, [ebp - 0xd6]
push eax
push dword [ebp + 0xc]
mov al, byte [0x6c4279]
push eax
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [ebp - 0xa7c]
call fcn.00505099
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0xfffffffe
jne 0x504c39
lea ecx, [ebp - 0x6c]
call fcn.004d0c2d
push eax
push str.tempFileName
mov ecx, dword [ebp - 0xa7c]
add ecx, 8
mov eax, dword [ebp - 0xa7c]
mov eax, dword [eax + 8]
call dword [eax + 0x28]
push str.Cannot_open_temporary_file
mov ecx, dword [ebp - 0xa7c]
add ecx, 8
mov eax, dword [ebp - 0xa7c]
mov eax, dword [eax + 8]
call dword [eax + 0x10]
and byte [ebp - 0xa74], 0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x6c]
call fcn.004d018e
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xd4]
call fcn.004d018e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.004d018e
mov al, byte [ebp - 0xa74]
jmp 0x504ff9
cmp dword [ebp - 0x70], 0
jge 0x504cb8
lea ecx, [ebp - 0x6c]
call fcn.004d0c2d
push eax
push str.tempFileName
mov ecx, dword [ebp - 0xa7c]
add ecx, 8
mov eax, dword [ebp - 0xa7c]
mov eax, dword [eax + 8]
call dword [eax + 0x28]
push str.Cannot_write_temporary_zip.
mov ecx, dword [ebp - 0xa7c]
add ecx, 8
mov eax, dword [ebp - 0xa7c]
mov eax, dword [eax + 8]
call dword [eax + 0x10]
and byte [ebp - 0xa75], 0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x6c]
call fcn.004d018e
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xd4]
call fcn.004d018e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.004d018e
mov al, byte [ebp - 0xa75]
jmp 0x504ff9
movzx eax, byte [ebp - 0xd7]
test eax, eax
je 0x504fab
mov ecx, dword [ebp - 0xa7c]
call fcn.00501f78
and dword [ebp - 0x9f0], 0
lea eax, [ebp - 0x9f0]
push eax
mov ecx, dword [ebp - 0xa7c]
add ecx, 0x154
call fcn.0055420c
push eax
call fcn.004d6973
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x504d84
mov eax, dword [ebp - 0xa7c]
add eax, 8
push eax
mov ecx, dword [ebp - 0xa7c]
add ecx, 0x154
call fcn.0055420c
push eax
call fcn.004d712d
pop ecx
pop ecx
movzx eax, al
test eax, eax
jne 0x504d84
push str.Failed_to_delete_existing_Zip_file
mov ecx, dword [ebp - 0xa7c]
add ecx, 8
mov eax, dword [ebp - 0xa7c]
mov eax, dword [eax + 8]
call dword [eax + 0x10]
and byte [ebp - 0xa76], 0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x6c]
call fcn.004d018e
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xd4]
call fcn.004d018e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.004d018e
mov al, byte [ebp - 0xa76]
jmp 0x504ff9
lea ecx, [ebp - 0xa70]
call fcn.004cde9c
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0xa7c]
add eax, 8
push eax
lea eax, [ebp - 0xa70]
push eax
mov ecx, dword [ebp - 0xa7c]
add ecx, 0x154
call fcn.0055420c
push eax
call fcn.004e96c4
add esp, 0xc
movzx eax, al
test eax, eax
jne 0x504e0b
push str.Unable_to_create_Zip_file
mov ecx, dword [ebp - 0xa7c]
add ecx, 8
mov eax, dword [ebp - 0xa7c]
mov eax, dword [eax + 8]
call dword [eax + 0x10]
mov ecx, dword [ebp - 0xa7c]
add ecx, 0x154
call fcn.0055420c
push eax
push str.filename
mov ecx, dword [ebp - 0xa7c]
add ecx, 8
mov eax, dword [ebp - 0xa7c]
mov eax, dword [eax + 8]
call dword [eax + 0x28]
lea ecx, [ebp - 0xa54]
call fcn.004d00b6
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0xa7c]
add ecx, 0x154
call fcn.0055420c
push eax
lea ecx, [ebp - 0xa54]
call fcn.004d0448
mov eax, dword [ebp - 0xa7c]
add eax, 8
push eax
lea eax, [ebp - 0xa54]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.004d5122
add esp, 0xc
movzx eax, al
test eax, eax
jne 0x504f69
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0xa54]
push eax
call fcn.004d5477
pop ecx
mov eax, dword [ebp - 0xa7c]
add eax, 8
push eax
lea eax, [ebp - 0xa54]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.004d5122
add esp, 0xc
movzx eax, al
test eax, eax
jne 0x504f69
lea eax, [ebp - 0x6c]
push eax
call fcn.004d5477
pop ecx
lea ecx, [ebp - 0x6c]
call fcn.004d0c2d
push eax
push str.from_filename
mov ecx, dword [ebp - 0xa7c]
add ecx, 8
mov eax, dword [ebp - 0xa7c]
mov eax, dword [eax + 8]
call dword [eax + 0x28]
mov ecx, dword [ebp - 0xa7c]
add ecx, 0x154
call fcn.0055420c
push eax
push str.to_filename
mov ecx, dword [ebp - 0xa7c]
add ecx, 8
mov eax, dword [ebp - 0xa7c]
mov eax, dword [eax + 8]
call dword [eax + 0x28]
push str.Failed_to_move_Zip_file
mov ecx, dword [ebp - 0xa7c]
add ecx, 8
mov eax, dword [ebp - 0xa7c]
mov eax, dword [eax + 8]
call dword [eax + 0x10]
and byte [ebp - 0xa77], 0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xa54]
call fcn.004d018e
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xa70]
call fcn.004ce1b7
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x6c]
call fcn.004d018e
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xd4]
call fcn.004d018e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.004d018e
mov al, byte [ebp - 0xa77]
jmp 0x504ff9
movzx eax, byte [ebp + 8]
test eax, eax
je 0x504f84
mov ecx, dword [ebp - 0xa7c]
call fcn.00503444
mov byte [ebp - 0xd5], al
jmp 0x504f8b
mov byte [ebp - 0xd5], 1
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xa54]
call fcn.004d018e
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xa70]
call fcn.004ce1b7
jmp 0x504fb2
mov byte [ebp - 0xd5], 1
movzx eax, byte [ebp - 0xd5]
neg eax
sbb al, al
and eax, dword [ebp - 0xd6]
mov byte [ebp - 0xa78], al
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x6c]
call fcn.004d018e
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xd4]
call fcn.004d018e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.004d018e
mov al, byte [ebp - 0xa78]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x1a0]
xor ecx, dword [ebp + 4]
call fcn.0058cc82
leave
ret 0x1c