joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404390
Capabilities:
Get file version info

Disassembly:
sub esp, 8
push ebp
push esi
push str.UninstCommandClass::CheckForUpdate_n
call fcn.00403da0
mov ebp, dword [esp + 0x18]
add esp, 4
lea eax, [esp + 8]
push eax
push ebp
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x4043c1
pop esi
mov al, 1
pop ebp
add esp, 8
ret 0xc
push ebx
push edi
push esi
xor bl, bl
call fcn.0040b5ab
mov ecx, dword [esp + 0x14]
add esp, 4
mov edi, eax
push edi
push esi
push ecx
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x404414
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x20]
push eax
push 0x41bd9c
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x404414
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 8]
mov ecx, dword [esp + 0x20]
cmp eax, ecx
jb 0x404414
jne 0x404416
mov ecx, dword [edx + 0xc]
cmp ecx, dword [esp + 0x24]
jae 0x404416
mov bl, 1
push edi
call fcn.0040b615
add esp, 4
pop edi
mov al, bl
pop ebx
pop esi
pop ebp
add esp, 8
ret 0xc

Function at 0x404750
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne bl
test bl, bl
mov eax, str.TRUE
jne 0x404771
mov eax, str.FALSE
push eax
push esi
push str.UninstCommandClass::NvFileExists__s____s_n
call fcn.00403da0
add esp, 0xc
pop esi
mov al, bl
pop ebx
ret 4

Function at 0x404790
Capabilities:
Move file
Set file attributes

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
push esi
push edi
mov edi, ecx
mov ecx, ebx
jne 0x4047a4
mov ecx, str.NULL
mov esi, dword [esp + 0x10]
test esi, esi
mov eax, esi
jne 0x4047b3
mov eax, str.NULL
push ecx
push eax
push str.UninstCommandClass::NvReplaceFileOnReboot__s__s__n
call fcn.00403da0
add esp, 0xc
push esi
mov ecx, edi
call fcn.00404750
test al, al
mov edi, dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
jne 0x4047f0
push esi
call edi
test eax, eax
jne 0x4047f0
push str.UninstCommandClass::NvReplaceFileOnReboot___File_does_not_exist_n
call fcn.00403da0
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
ret 8
push esi
call edi
test eax, eax
je 0x404810
test ebx, ebx
je 0x404810
push str.UninstCommandClass::NvReplaceFileOnReboot___Invaid_path_parameter_instead_of_file_n
call fcn.00403da0
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
ret 8
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 4
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
cmp eax, 1
sete bl
test bl, bl
mov eax, str.Succeeded
jne 0x40483a
mov eax, str.Failed
push eax
push str.UninstCommandClass::NvReplaceFileOnReboot____s_n
call fcn.00403da0
add esp, 8
pop edi
pop esi
mov al, bl
pop ebx
ret 8
Function at 0x404f50
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x21c
mov eax, dword [0x4243c0]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
mov ebx, dword [esp + 0x22c]
test ebx, ebx
push ebp
mov ebp, dword [esp + 0x228]
push esi
mov esi, dword [esp + 0x230]
mov dword [esp + 0x14], ecx
push edi
mov ecx, ebx
jne 0x404f8c
mov ecx, str.NULL
test esi, esi
mov eax, esi
jne 0x404f97
mov eax, str.NULL
push ecx
push eax
push str.UninstCommandClass::NvRegEnumAndDeleteSubKeys_HKEY__s__s__n
call fcn.00403da0
lea edx, [esp + 0x34]
add esp, 0xc
mov dword [esp + 0x10], 0
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x404fb6
lea edi, [esp + 0x28]
add edi, 0xffffffff
lea esp, [esp]
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x404fd0
mov ax, word [0x41bd9c]
mov word [edi], ax
mov eax, ebx
mov ecx, ebx
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x404fe7
lea edi, [esp + 0x28]
sub eax, ecx
mov esi, ecx
add edi, 0xffffffff
jmp 0x405000
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x405000
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
push 0xf003f
push 0
lea edx, [esp + 0x34]
push edx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4050e7
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x4050dc
cmp dword [esp + 0x10], eax
jbe 0x4050dc
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edi, 0xff
lea ebx, [ebx]
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x14]
push 0
push 0
push 0
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x13c]
push edx
add eax, 0xffffffff
push eax
push ecx
mov dword [esp + 0x3c], edi
call esi
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x128]
push edx
lea eax, [esp + 0x2c]
push eax
push ebp
call fcn.00404f50
test eax, eax
jne 0x4050d5
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x128]
push ecx
push edx
call ebx
sub dword [esp + 0x10], 1
jne 0x405080
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x228]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040b9d2
add esp, 0x21c
ret 0xc
Function at 0x405110
Capabilities:
Delete registry key
Delete registry value

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
push str.UninstCommandClass::NvRegDeleteKeyNT_n
mov edi, ecx
call fcn.00403da0
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
add esp, 4
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push ebx
mov esi, 1
push ebp
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4051a6
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x405197
mov edx, dword [esp + 0x10]
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x405197
push esi
push ebx
push ebp
mov ecx, edi
call fcn.00404f50
mov eax, dword [esp + 0x10]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x405197
xor esi, esi
jmp 0x40519b
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x4054f0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
sub esp, 0x28
push ebx
push esi
push edi
mov esi, ecx
push str.UninstCommandClass::UninstallService_n
mov dword [esp + 0x18], esi
call fcn.00403da0
add esp, 4
xor edi, edi
push 0xf003f
push edi
push edi
mov dword [esp + 0x18], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
cmp ebx, edi
mov dword [esp + 0x10], ebx
je 0x405633
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x38]
push 0xf01ff
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
cmp esi, edi
je 0x40560a
lea ecx, [esp + 0x18]
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
je 0x4055c4
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov ebx, 0x64
sub ebx, 1
cmp dword [esp + 0x20], 1
je 0x405595
push 0x64
call edi
lea edx, [esp + 0x1c]
push edx
push esi
call ebp
test eax, eax
je 0x40558e
test ebx, ebx
jne 0x405570
cmp dword [esp + 0x20], 1
jne 0x40559e
push 0x3e8
call edi
jmp 0x4055bf
mov eax, dword [esp + 0x3c]
mov ebx, dword [esp + 0x18]
push eax
push 8
mov ecx, ebx
call fcn.00401000
push eax
push str.Error:
push ebx
call fcn.00401660
add esp, 0x10
mov ebx, dword [esp + 0x14]
pop ebp
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x4055ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x430
mov dword [esp + 0xc], eax
jne 0x4055ef
push 0x3e8
call edi
mov dword [esp + 0xc], 0
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 0x28
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
mov dword [esp + 0xc], eax
jne 0x40561f
mov dword [esp + 0xc], edi
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 0x28
ret 4
mov ecx, dword [esp + 0x38]
push ecx
mov ecx, esi
call fcn.00401720
pop edi
pop esi
mov eax, 0x427
pop ebx
add esp, 0x28
ret 4
Function at 0x405650
Capabilities:
Query service status

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
push str.UninstCommandClass::StopServiceCallBack_n
mov esi, ecx
call fcn.00403da0
mov ebx, dword [esp + 0x34]
push ebx
push str.Service_Name:__s_n
call fcn.00403da0
mov ebp, dword [esp + 0x40]
push ebp
push str.Service_Stop_Code:__d._n
call fcn.00403da0
add esp, 0x14
push 0xf003f
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test eax, eax
mov dword [esp + 0x34], eax
je 0x4057c3
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x34]
push 0xf01ff
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x40578d
push ebx
push str.Attempting_to_stop_service__s._n
call fcn.00403da0
add esp, 8
lea ecx, [esp + 0x10]
push ecx
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x40576f
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebp, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [esp + 0x30], 0x28
jmp 0x405700
mov eax, 1
sub dword [esp + 0x30], eax
cmp dword [esp + 0x14], eax
je 0x405730
push 0x1f4
call edi
lea edx, [esp + 0x10]
push edx
push esi
call ebp
test eax, eax
je 0x405729
cmp dword [esp + 0x30], 0
jne 0x405700
cmp dword [esp + 0x14], 1
jne 0x40575e
push ebx
push str.Service__s_stopped._n
call fcn.00403da0
add esp, 8
push esi
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [esp + 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 8
push ebx
push str.Failed_to_stop_service__s._n
call fcn.00403da0
add esp, 8
or edi, 0xffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [esp + 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0x424
jne 0x4057ac
push str.Service_does_not_exist._n
call fcn.00403da0
add esp, 4
xor edi, edi
mov eax, dword [esp + 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 8
push ebx
mov ecx, esi
call fcn.00401720
pop edi
pop esi
pop ebp
mov eax, 0x427
pop ebx
add esp, 0x1c
ret 8
Function at 0x4074f0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x350
mov eax, dword [0x4243c0]
xor eax, esp
mov dword [esp + 0x34c], eax
push ebp
mov ebp, dword [esp + 0x358]
push esi
push edi
push str.UninstCommandClass::GetProcessId_n
mov edi, ecx
call fcn.00403da0
push 0x124
lea eax, [esp + 0x18]
push 0
push eax
mov dword [esp + 0x1c], 0
call fcn.0040b620
add esp, 0x10
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x4075d8
lea ecx, [esp + 0xc]
push ecx
push esi
mov dword [esp + 0x14], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4075d1
push 0x220
lea edx, [esp + 0x13c]
push 0
push edx
mov dword [esp + 0x140], 0
call fcn.0040b620
add esp, 0xc
jmp 0x407590
mov ecx, dword [esp + 0x14]
push 0x224
lea eax, [esp + 0x138]
push eax
push ecx
mov ecx, edi
call fcn.00407440
test eax, eax
je 0x4075c2
lea edx, [esp + 0x154]
push edx
push ebp
call fcn.0040b53a
add esp, 8
test eax, eax
je 0x4075f4
lea eax, [esp + 0xc]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x407590
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x358]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0040b9d2
add esp, 0x350
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
jmp 0x4075da

Function at 0x407610
Capabilities:
Terminate process

Disassembly:
push esi
push edi
push str.UninstCommandClass::KillApp_n
mov esi, ecx
call fcn.00403da0
mov edi, dword [esp + 0x10]
add esp, 4
push edi
mov ecx, esi
call fcn.004074f0
test eax, eax
je 0x407655
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
mov ecx, esi
call fcn.00407610
pop edi
xor eax, eax
pop esi
ret 4

Function at 0x407cd0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x104
mov eax, dword [0x4243c0]
xor eax, esp
mov dword [esp + 0x100], eax
push esi
mov esi, dword [esp + 0x10c]
push edi
push str.UninstCommandClass::IsNvDisplayInf_n
call fcn.00403da0
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add esp, 4
push esi
push 0x80
lea eax, [esp + 0x10]
push eax
push str._error_
push str.Class
push str.Version
call edi
push esi
push 0x80
lea ecx, [esp + 0x90]
push ecx
push str._error_
push 0x41d6fc
push str.Version
call edi
lea edx, [esp + 8]
push str.Display
push edx
call fcn.0040b53a
add esp, 8
test eax, eax
pop edi
pop esi
jne 0x407d88
lea eax, [esp + 0x80]
push str._NVidia_
push eax
call fcn.0040b53a
add esp, 8
test eax, eax
jne 0x407d88
mov eax, 1
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0040b9d2
add esp, 0x104
ret 4
mov ecx, dword [esp + 0x100]
xor ecx, esp
xor eax, eax
call fcn.0040b9d2
add esp, 0x104
ret 4
Function at 0x407db0
Capabilities:
Get common file path
Get file version info

Disassembly:
sub esp, 0x134
mov eax, dword [0x4243c0]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push ebp
mov ebp, dword [esp + 0x144]
push esi
push edi
mov edi, dword [esp + 0x148]
push str.UninstCommandClass::IsGreater_n
mov dword [esp + 0x18], ebp
call fcn.00403da0
xor ebx, ebx
add esp, 4
push 0x104
lea eax, [esp + 0x40]
push eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x34], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x18]
push ecx
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
je 0x407ea1
push esi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x407e8d
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebp, eax
push ebp
push esi
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x407e8d
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x38]
push eax
push 0x41bd9c
push ebp
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x407e8d
mov eax, dword [esp + 0x34]
movzx ecx, word [eax + 0xc]
mov dword [esp + 0x18], ecx
movzx edx, word [eax + 0xe]
movzx ecx, word [eax + 8]
mov dword [esp + 0x24], edx
movzx edx, word [eax + 0xa]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x30], edx
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ebp, dword [esp + 0x14]
xor ebx, ebx
lea eax, [esp + 0x10]
push eax
push ebp
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
cmp edi, ebx
je 0x407f23
push edi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
cmp esi, ebx
je 0x407f15
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
push ebx
push edi
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x407f15
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x18]
push edx
push 0x41bd9c
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x407f15
mov eax, dword [esp + 0x14]
movzx ecx, word [eax + 0xc]
mov dword [esp + 0x10], ecx
movzx edx, word [eax + 0xe]
movzx ecx, word [eax + 8]
mov dword [esp + 0x20], edx
movzx edx, word [eax + 0xa]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x2c], edx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
cmp eax, ecx
pop edi
pop esi
pop ebp
pop ebx
je 0x407f4e
sbb eax, eax
neg eax
mov ecx, dword [esp + 0x130]
xor ecx, esp
call fcn.0040b9d2
add esp, 0x134
ret 8
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
cmp eax, ecx
jne 0x407f33
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cmp eax, ecx
jne 0x407f33
mov eax, dword [esp + 8]
mov ecx, dword [esp]
cmp ecx, eax
jne 0x407f33
mov ecx, dword [esp + 0x130]
xor ecx, esp
xor eax, eax
call fcn.0040b9d2
add esp, 0x134
ret 8
Function at 0x407fe0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
sub esp, 8
push edi
push str.ConnectToNamespace_n
call fcn.00403da0
add esp, 4
lea eax, [esp + 4]
push eax
push 0x41fe30
xor edi, edi
push 1
push edi
push 0x41ff00
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edi
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, edi
je 0x40801e
xor eax, eax
pop edi
add esp, 8
ret
push ebp
push 0xffffffffffffffff
push str.RootWMI
call fcn.00407f90
add esp, 8
mov ebp, eax
push ebp
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x40808b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
lea edx, [esp + 0x14]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push ebp
push eax
mov eax, dword [ecx + 0xc]
call eax
mov esi, eax
test esi, esi
je 0x40807e
cmp esi, 0x8007041f
jne 0x40807e
push 0x3e8
call ebx
add edi, 1
cmp edi, 0x1e
jl 0x408043
push ebp
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test esi, esi
pop esi
pop ebx
je 0x40809f
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
pop ebp
xor eax, eax
pop edi
add esp, 8
ret
mov eax, dword [esp + 0xc]
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
je 0x4080dc
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
pop ebp
xor eax, eax
pop edi
add esp, 8
ret
mov eax, dword [esp + 0xc]
pop ebp
pop edi
add esp, 8
ret
Function at 0x40a1b0
Capabilities:
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
push edi
mov edi, ecx
mov eax, esi
jne 0x40a1c3
mov eax, str.NULL
push eax
push str.UninstCommandClass::NvDeleteFile__s__n
call fcn.00403da0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0x10
push esi
jne 0x40a214
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
cmp eax, 1
jne 0x40a200
push str.Directory_deleted_n
call fcn.00403da0
add esp, 4
pop edi
mov eax, 1
pop esi
ret 4
push str.Failure_deleting_directory_n
call fcn.00403da0
add esp, 4
pop edi
xor eax, eax
pop esi
ret 4
mov ecx, edi
call fcn.00404750
test al, al
je 0x40a20d
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
push esi
jne 0x40a267
push str.File___s__queued_for_delete_at_reboot_n
call fcn.00403da0
push esi
call fcn.0040d045
mov dword [esp + 0x18], eax
add esp, 0xc
lea eax, [esp + 0xc]
push eax
mov ecx, 0x429a3c
call fcn.0040a170
pop edi
mov eax, 1
pop esi
ret 4
push str.File___s__deleted_n
call fcn.00403da0
add esp, 8
pop edi
mov eax, 1
pop esi
ret 4
Function at 0x40b9d2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4243c0]
jne 0x40b9dc
repz ret
jmp fcn.00410d4e
Function at 0x413273
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x424f88]
je 0x41328e
inc edi
cmp edi, 0x17
jb 0x41327f
cmp edi, 0x17
jae 0x41340e
push ebp
push 3
call fcn.0041958f
cmp eax, 1
pop ecx
je 0x4133da
push 3
call fcn.0041958f
test eax, eax
pop ecx
jne 0x4132c2
cmp dword [0x4243e0], 1
je 0x4133da
cmp ebx, 0xfc
je 0x41340d
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x42a0b8
push ebp
call fcn.00411187
add esp, 0xc
test eax, eax
je 0x4132f8
push esi
push esi
push esi
push esi
push esi
call fcn.0040ee18
add esp, 0x14
push 0x104
mov esi, 0x42a0d1
push esi
push 0
mov byte [0x42a1d5], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41333c
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00411187
add esp, 0xc
test eax, eax
je 0x41333c
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0040ee18
add esp, 0x14
push esi
call fcn.0040f170
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x413381
push esi
call fcn.0040f170
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x42a3cc
push 0x42077c
sub ecx, eax
push ecx
push eax
call fcn.00416d9d
add esp, 0x14
test eax, eax
je 0x413381
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0040ee18
add esp, 0x14
jmp 0x413383
xor esi, esi
push 0x420778
push ebx
push ebp
call fcn.00411116
add esp, 0xc
test eax, eax
je 0x4133a3
push esi
push esi
push esi
push esi
push esi
call fcn.0040ee18
add esp, 0x14
push dword [edi*8 + 0x424f8c]
push ebx
push ebp
call fcn.00411116
add esp, 0xc
test eax, eax
je 0x4133c5
push esi
push esi
push esi
push esi
push esi
call fcn.0040ee18
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.004193d2
add esp, 0xc
jmp 0x41340d
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x41340d
cmp ebp, 0xffffffff
je 0x41340d
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x424f8c]
push dword [esi]
call fcn.0040f170
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret