joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404fd0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x42a0d0]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push ebp
push esi
push 0x23
push str.NVSTINST_INFO_:__d
call fcn.0040a7c0
push 0x104
lea eax, [esp + 0x19]
push 0
push eax
mov bl, 1
mov byte [esp + 0x20], 0
call fcn.0040d990
push 0x105
lea ecx, [esp + 0x24]
push ecx
push str.nvscpapisvr.exe
call fcn.00402b50
mov ebp, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
add esp, 0x20
test al, al
jne 0x405083
push 0x105
lea edx, [esp + 0x10]
push 0
push edx
call fcn.0040d990
add esp, 0xc
push 0x104
lea eax, [esp + 0x10]
push eax
call ebp
test eax, eax
je 0x405083
lea ecx, [esp + 0xc]
push 0x5c
push ecx
call fcn.0040d040
add esp, 8
mov esi, eax
call fcn.00401a80
test al, al
mov eax, str.Program_Files__x86_
jne 0x405074
mov eax, str.Program_Files
push eax
push str._sNVIDIA_Corporation3D_Vision_nvSCPAPISvr.exe
push esi
call fcn.0040d54d
add esp, 0xc
lea edx, [esp + 0xc]
push edx
call fcn.004010c0
add esp, 4
test al, al
je 0x405232
lea eax, [esp + 0xc]
push eax
call fcn.00401170
add esp, 4
cmp eax, 0x4844
jb 0x40522e
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x405205
push edi
push 0xf01ff
push 0x424b6c
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
je 0x4050f9
push 0x24
push str.NVSTINST_INFO_:__d
call fcn.0040a7c0
add esp, 8
push edi
call ebx
push esi
call ebx
push 0x25
push str.NVSTINST_INFO_:__d
call fcn.0040a7c0
add esp, 8
push 1
push 1
push 0x3fb
call fcn.00401990
add esp, 8
push eax
lea ecx, [esp + 0x18]
push str._uninstall
push ecx
call fcn.00401f80
add esp, 0x10
mov bl, al
pop edi
test bl, bl
jne 0x405201
push 0x12
push str.NVSTINST_ERROR_:__d
call fcn.0040a7c0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.WIN_ERROR_:__d
call fcn.0040a7c0
add esp, 8
cmp esi, 0x7b
jne 0x405241
push 0x103
lea edx, [esp + 0x119]
push 0
push edx
mov byte [esp + 0x120], 0
call fcn.0040d990
add esp, 0xc
push 0x104
lea eax, [esp + 0x118]
push eax
call ebp
test eax, eax
je 0x405241
lea ecx, [esp + 0x114]
push 0x5c
push ecx
call fcn.0040d040
add esp, 8
mov esi, eax
call fcn.00401a80
test al, al
mov eax, str.Program_Files__x86_
jne 0x4051c5
mov eax, str.Program_Files
push eax
push str._sNVIDIA_Corporation3D_Vision_nvSCPAPISvr.exe
push esi
call fcn.0040d54d
add esp, 0xc
push 1
push 1
push 0x3fb
call fcn.00401990
add esp, 8
push eax
lea edx, [esp + 0x11c]
push str._uninstall
push edx
call fcn.00401f80
mov bl, al
add esp, 0x10
test bl, bl
je 0x405241
push 0x26
jmp 0x405234
push 0x13
push str.NVSTINST_ERROR_:__d
call fcn.0040a7c0
push 0x27
push str.NVSTINST_INFO_:__d
call fcn.0040a7c0
push 0xffffffffffffffff
push str.nvscpapisvr.exe
call fcn.004032d0
add esp, 0x18
jmp 0x405241
push 0x28
jmp 0x405234
push 0x29
push str.NVSTINST_INFO_:__d
call fcn.0040a7c0
add esp, 8
mov ecx, dword [esp + 0x218]
pop esi
pop ebp
mov al, bl
pop ebx
xor ecx, esp
call fcn.0040d609
add esp, 0x210
ret
Function at 0x404fe7
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x42a0d0]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push ebp
push esi
push 0x23
push str.NVSTINST_INFO_:__d
call fcn.0040a7c0
push 0x104
lea eax, [esp + 0x19]
push 0
push eax
mov bl, 1
mov byte [esp + 0x20], 0
call fcn.0040d990
push 0x105
lea ecx, [esp + 0x24]
push ecx
push str.nvscpapisvr.exe
call fcn.00402b50
mov ebp, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
add esp, 0x20
test al, al
jne 0x405083
push 0x105
lea edx, [esp + 0x10]
push 0
push edx
call fcn.0040d990
add esp, 0xc
push 0x104
lea eax, [esp + 0x10]
push eax
call ebp
test eax, eax
je 0x405083
lea ecx, [esp + 0xc]
push 0x5c
push ecx
call fcn.0040d040
add esp, 8
mov esi, eax
call fcn.00401a80
test al, al
mov eax, str.Program_Files__x86_
jne 0x405074
mov eax, str.Program_Files
push eax
push str._sNVIDIA_Corporation3D_Vision_nvSCPAPISvr.exe
push esi
call fcn.0040d54d
add esp, 0xc
lea edx, [esp + 0xc]
push edx
call fcn.004010c0
add esp, 4
test al, al
je 0x405232
lea eax, [esp + 0xc]
push eax
call fcn.00401170
add esp, 4
cmp eax, 0x4844
jb 0x40522e
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x405205
push edi
push 0xf01ff
push 0x424b6c
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
je 0x4050f9
push 0x24
push str.NVSTINST_INFO_:__d
call fcn.0040a7c0
add esp, 8
push edi
call ebx
push esi
call ebx
push 0x25
push str.NVSTINST_INFO_:__d
call fcn.0040a7c0
add esp, 8
push 1
push 1
push 0x3fb
call fcn.00401990
add esp, 8
push eax
lea ecx, [esp + 0x18]
push str._uninstall
push ecx
call fcn.00401f80
add esp, 0x10
mov bl, al
pop edi
test bl, bl
jne 0x405201
push 0x12
push str.NVSTINST_ERROR_:__d
call fcn.0040a7c0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.WIN_ERROR_:__d
call fcn.0040a7c0
add esp, 8
cmp esi, 0x7b
jne 0x405241
push 0x103
lea edx, [esp + 0x119]
push 0
push edx
mov byte [esp + 0x120], 0
call fcn.0040d990
add esp, 0xc
push 0x104
lea eax, [esp + 0x118]
push eax
call ebp
test eax, eax
je 0x405241
lea ecx, [esp + 0x114]
push 0x5c
push ecx
call fcn.0040d040
add esp, 8
mov esi, eax
call fcn.00401a80
test al, al
mov eax, str.Program_Files__x86_
jne 0x4051c5
mov eax, str.Program_Files
push eax
push str._sNVIDIA_Corporation3D_Vision_nvSCPAPISvr.exe
push esi
call fcn.0040d54d
add esp, 0xc
push 1
push 1
push 0x3fb
call fcn.00401990
add esp, 8
push eax
lea edx, [esp + 0x11c]
push str._uninstall
push edx
call fcn.00401f80
mov bl, al
add esp, 0x10
test bl, bl
je 0x405241
push 0x26
jmp 0x405234
push 0x13
push str.NVSTINST_ERROR_:__d
call fcn.0040a7c0
push 0x27
push str.NVSTINST_INFO_:__d
call fcn.0040a7c0
push 0xffffffffffffffff
push str.nvscpapisvr.exe
call fcn.004032d0
add esp, 0x18
jmp 0x405241
push 0x28
jmp 0x405234
push 0x29
push str.NVSTINST_INFO_:__d
call fcn.0040a7c0
add esp, 8
mov ecx, dword [esp + 0x218]
pop esi
pop ebp
mov al, bl
pop ebx
xor ecx, esp
call fcn.0040d609
add esp, 0x210
ret
Function at 0x405260
Capabilities:
Delete registry key

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
xor bl, bl
test edi, edi
je 0x40532a
push edi
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
test eax, eax
je 0x40532f
push ebp
push esi
push 0x14
push str.NVSTINST_INFO_:__d
call fcn.0040a7c0
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 8
call ebp
push eax
push str.WIN_ERROR_:__d
call fcn.0040a7c0
push str.Advapi32.dll
call fcn.00401640
mov esi, eax
add esp, 0xc
test esi, esi
je 0x405328
push str.RegDeleteKeyExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x405321
push 0
push 0x300
push edi
push 0x80000002
call eax
test eax, eax
sete bl
test bl, bl
je 0x405302
push 0x2a
push str.NVSTINST_INFO_:__d
call fcn.0040a7c0
add esp, 8
push esi
mov bl, 1
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
pop ebp
pop edi
mov al, bl
pop ebx
ret
push 0x2b
push str.NVSTINST_INFO_:__d
call fcn.0040a7c0
add esp, 8
call ebp
push eax
push str.WIN_ERROR_:__d
call fcn.0040a7c0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
pop ebp
pop edi
mov al, bl
pop ebx
ret
push 0x2c
push str.NVSTINST_INFO_:__d
call fcn.0040a7c0
add esp, 8
pop edi
mov al, 1
pop ebx
ret

Function at 0x405350
Capabilities:
Delete service

Disassembly:
push ebx
push esi
push 0xf003f
push 0
push 0
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x405391
push 6
push str.NVSTINST_ERROR_:__d
call fcn.0040a7c0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WIN_ERROR_:__d
call fcn.0040a7c0
add esp, 8
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esp + 0xc]
push edi
push 0x10000
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x4053d9
push 7
push str.NVSTINST_ERROR_:__d
call fcn.0040a7c0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WIN_ERROR_:__d
call fcn.0040a7c0
add esp, 8
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
xor al, al
pop ebx
ret
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x405406
push 0x15
push str.NVSTINST_ERROR_:__d
call fcn.0040a7c0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WIN_ERROR_:__d
call fcn.0040a7c0
jmp 0x405414
push 0x2d
push str.NVSTINST_INFO_:__d
call fcn.0040a7c0
mov bl, 1
add esp, 8
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
pop edi
pop esi
mov al, bl
pop ebx
ret
Function at 0x405b80
Capabilities:
Set registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0xf003f
push 0
push str.SOFTWARENVIDIA_CorporationGlobalStereo3D
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405bf5
mov edx, dword [esp]
push esi
push 4
lea ecx, [esp + 0x10]
push ecx
push 4
push eax
push str.StereoModeState
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x405bfb
cmp dword [esp + 8], 0
je 0x405be4
push 0x53
push str.NVSTINST_INFO_:__d
call fcn.0040a7c0
add esp, 8
pop ecx
ret
push 0x52
push str.NVSTINST_INFO_:__d
call fcn.0040a7c0
add esp, 8
pop ecx
ret
cmp dword [esp], 0
je 0x405c0a
push 0x19
push str.NVSTINST_ERROR_:__d
call fcn.0040a7c0
add esp, 8
pop ecx
ret
Function at 0x406310
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x310
mov eax, dword [0x42a0d0]
xor eax, esp
mov dword [esp + 0x30c], eax
mov eax, dword [esp + 0x314]
push esi
push 0x424ecc
push eax
call fcn.0040d130
mov esi, eax
add esi, 7
add esp, 8
cmp byte [esi], 0x20
jne 0x40634a
inc esi
cmp byte [esi], 0x20
je 0x406344
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x5c
push esi
call fcn.0040d100
add esp, 8
test eax, eax
je 0x40638f
push esi
mov byte [eax], 0
call fcn.00402240
add esp, 4
test al, al
je 0x40638f
push 0x5c
push esi
call fcn.0040d100
push esi
mov byte [eax], 0
call fcn.00402240
add esp, 0xc
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 0x108]
push eax
push 0
push 0
push 0x16
push 0
call dword [sym.imp.SHFOLDER.dll_SHGetFolderPathW]
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [esp + 0x108]
push ecx
lea edx, [esp + 8]
push str._SProgramsNVIDIA_Corporation3D_Vision
push edx
call fcn.0040d54d
lea eax, [esp + 0x10]
push eax
call fcn.00402240
add esp, 0x10
pop esi
test al, al
je 0x406400
lea ecx, [esp + 0x104]
push ecx
lea edx, [esp + 4]
push str._SProgramsNVIDIA_Corporation
push edx
call fcn.0040d54d
lea eax, [esp + 0xc]
push eax
call fcn.00402240
add esp, 0x10
mov ecx, dword [esp + 0x30c]
xor ecx, esp
call fcn.0040d609
add esp, 0x310
ret

Function at 0x406460
Capabilities:
Copy file
Create process on windows
Delete file
Query environment variable

Disassembly:
sub esp, 0x578
mov eax, dword [0x42a0d0]
xor eax, esp
mov dword [esp + 0x574], eax
push esi
push 0x105
lea eax, [esp + 0x26c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0x105
lea ecx, [esp + 0x5c]
push ecx
push str._Temp__nvStInst.exe
call esi
test eax, eax
jne 0x4064c5
push 0x105
lea edx, [esp + 0x5c]
push edx
push str._Tmp__nvStInst.exe
call esi
test eax, eax
je 0x40657c
lea eax, [esp + 0x268]
push eax
lea ecx, [esp + 0x164]
push str._s.exe
push ecx
call fcn.0040d54d
add esp, 0xc
push 0
lea edx, [esp + 0x5c]
push edx
lea eax, [esp + 0x270]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp + 0x160]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x160]
push edx
lea eax, [esp + 0x26c]
push eax
call fcn.0040e785
mov esi, dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
add esp, 8
lea ecx, [esp + 0x14]
push ecx
call esi
lea edx, [esp + 0x160]
push edx
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x378]
push str._s__delete__s
push ecx
call fcn.0040d54d
add esp, 0x10
lea edx, [esp + 0x14]
push edx
call esi
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
lea edx, [esp + 0x390]
push edx
lea eax, [esp + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [esp + 0x578]
pop esi
xor ecx, esp
call fcn.0040d609
add esp, 0x578
ret
Function at 0x4069f0
Capabilities:
Delete file
Move file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x42a0d0]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
mov esi, dword [esp + 0x214]
push edi
push str.nvstereo.inf
push esi
call fcn.0040db62
add esp, 8
test eax, eax
jne 0x406a39
push esi
push 0x433820
lea eax, [esp + 0x10]
push 0x4245ec
push eax
call fcn.0040d54d
add esp, 0x10
jmp 0x406a78
push str.nvStreaming.exe
push esi
call fcn.0040db62
add esp, 8
test eax, eax
jne 0x406a65
push esi
push 0x433d30
lea ecx, [esp + 0x10]
push str._sSystem32_s
push ecx
call fcn.0040d54d
add esp, 0x10
jmp 0x406a78
push 0x104
lea edx, [esp + 0xc]
push edx
push esi
call fcn.00402b50
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 8]
push eax
call edi
test eax, eax
jne 0x406b02
push 0x4e
push str.NVSTINST_INFO_:__d
call fcn.0040a7c0
lea ecx, [esp + 0x10]
push ecx
push 0x42517c
call fcn.0040a7c0
push esi
push 0x433e38
lea edx, [esp + 0x124]
push 0x4245ec
push edx
call fcn.0040d54d
add esp, 0x20
lea eax, [esp + 0x10c]
push eax
call edi
push 0x4f
push str.NVSTINST_INFO_:__d
call fcn.0040a7c0
add esp, 8
lea ecx, [esp + 0x10c]
push ecx
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x406af3
push 0x50
jmp 0x406af5
push 0x51
push str.NVSTINST_INFO_:__d
call fcn.0040a7c0
add esp, 8
mov ecx, dword [esp + 0x210]
pop edi
pop esi
xor ecx, esp
call fcn.0040d609
add esp, 0x20c
ret

Function at 0x406a89
Capabilities:
Delete file
Move file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x42a0d0]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
mov esi, dword [esp + 0x214]
push edi
push str.nvstereo.inf
push esi
call fcn.0040db62
add esp, 8
test eax, eax
jne 0x406a39
push esi
push 0x433820
lea eax, [esp + 0x10]
push 0x4245ec
push eax
call fcn.0040d54d
add esp, 0x10
jmp 0x406a78
push str.nvStreaming.exe
push esi
call fcn.0040db62
add esp, 8
test eax, eax
jne 0x406a65
push esi
push 0x433d30
lea ecx, [esp + 0x10]
push str._sSystem32_s
push ecx
call fcn.0040d54d
add esp, 0x10
jmp 0x406a78
push 0x104
lea edx, [esp + 0xc]
push edx
push esi
call fcn.00402b50
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 8]
push eax
call edi
test eax, eax
jne 0x406b02
push 0x4e
push str.NVSTINST_INFO_:__d
call fcn.0040a7c0
lea ecx, [esp + 0x10]
push ecx
push 0x42517c
call fcn.0040a7c0
push esi
push 0x433e38
lea edx, [esp + 0x124]
push 0x4245ec
push edx
call fcn.0040d54d
add esp, 0x20
lea eax, [esp + 0x10c]
push eax
call edi
push 0x4f
push str.NVSTINST_INFO_:__d
call fcn.0040a7c0
add esp, 8
lea ecx, [esp + 0x10c]
push ecx
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x406af3
push 0x50
jmp 0x406af5
push 0x51
push str.NVSTINST_INFO_:__d
call fcn.0040a7c0
add esp, 8
mov ecx, dword [esp + 0x210]
pop edi
pop esi
xor ecx, esp
call fcn.0040d609
add esp, 0x20c
ret
Function at 0x406b20
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.0040e26b
push 5
push str.HKLM_
push esi
call fcn.0040e9f2
add esp, 0x10
test eax, eax
jne 0x406c22
push str.runonce
push esi
call fcn.0040d130
add esp, 8
test eax, eax
jne 0x406be0
push 0x4251dc
push esi
call fcn.0040d130
add esp, 8
test eax, eax
jne 0x406be0
push str.nvidiastereo
push esi
call fcn.0040d130
add esp, 8
test eax, eax
je 0x406ba2
push str.nvidiastereo
push esi
call fcn.0040d130
add esp, 8
add esi, 5
push esi
push 0x80000002
mov byte [eax + 0xc], 0
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
pop edi
pop esi
ret
push str.softwaremozillaplugins_nvidia.com
push esi
call fcn.0040d130
add esp, 8
test eax, eax
je 0x406ca2
add esi, 5
push 0x2c
push esi
call fcn.0040d040
add esp, 8
test eax, eax
je 0x406ca2
push esi
push 0x80000002
mov byte [eax], 0
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
pop edi
pop esi
ret
lea edi, [esi + 5]
push 0x2c
push edi
call fcn.0040d040
add esp, 8
test eax, eax
je 0x406ca2
lea esi, [eax + 1]
push 0x2c
push esi
mov byte [eax], 0
call fcn.0040d040
add esp, 8
test eax, eax
je 0x406ca2
push esi
push edi
push 0x80000002
mov byte [eax], 0
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
pop edi
pop esi
ret
push 5
push str.HKCR_
push esi
call fcn.0040e9f2
add esp, 0xc
test eax, eax
jne 0x406ca2
add esi, 5
push 0x2c
push esi
call fcn.0040d040
add esp, 8
test eax, eax
je 0x406ca2
lea edi, [eax + 1]
push 0x2c
push edi
mov byte [eax], 0
call fcn.0040d040
add esp, 8
test eax, eax
je 0x406ca2
mov byte [eax], 0
cmp byte [esi], 0x22
jne 0x406c7d
inc esi
mov eax, esi
lea edx, [eax + 1]
jmp 0x406c70
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406c70
sub eax, edx
mov byte [eax + esi - 1], cl
cmp byte [edi], 0x22
jne 0x406c95
inc edi
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406c88
sub eax, edx
mov byte [eax + edi - 1], cl
push edi
push esi
push 0x80000000
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
pop edi
pop esi
ret
Function at 0x406e60
Capabilities:
Copy file
Enumerate files on windows
Get common file path

Disassembly:
sub esp, 0x66c
mov eax, dword [0x42a0d0]
xor eax, esp
mov dword [esp + 0x668], eax
push ebx
xor ebx, ebx
push 0x104
lea eax, [esp + 0x251]
push ebx
push eax
mov byte [esp + 0x258], bl
call fcn.0040d990
push 0x104
lea ecx, [esp + 0x155]
push ebx
push ecx
mov byte [esp + 0x15c], bl
call fcn.0040d990
push 0x104
lea edx, [esp + 0x371]
push ebx
push edx
mov byte [esp + 0x378], bl
call fcn.0040d990
lea eax, [esp + 0x270]
push 0x105
push eax
call fcn.00402c20
add esp, 0x2c
test al, al
je 0x407062
push edi
lea ecx, [esp + 0x148]
push ecx
push ebx
push ebx
push 0x36
push ebx
call dword [sym.imp.SHFOLDER.dll_SHGetFolderPathA]
lea edi, [esp + 0x148]
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x406f00
push esi
mov ecx, 0x10
mov esi, str.NVIDIA_Corporation3D_Vision_Experience3D_Vision_preview_pack_1
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x14c]
push edx
movsw word es:[edi], word [esi]
call fcn.00404090
add esp, 4
test al, al
je 0x407060
lea eax, [esp + 0x254]
push eax
lea ecx, [esp + 0x360]
push str._s.jps
push ecx
call fcn.0040d54d
add esp, 0xc
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x360]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x407060
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
jmp 0x406f80
lea ecx, [esp + 0x3c]
push ecx
call fcn.0040e26b
lea eax, [esp + 0x40]
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x406f94
sub eax, edx
cmp eax, 4
jbe 0x407048
lea edx, [esp + 0x3c]
push str..jps
push edx
call fcn.0040d130
add esp, 8
test eax, eax
je 0x407048
push 0x104
lea eax, [esp + 0x46d]
push ebx
push eax
mov byte [esp + 0x474], bl
call fcn.0040d990
push 0x104
lea ecx, [esp + 0x581]
push ebx
push ecx
mov byte [esp + 0x588], bl
call fcn.0040d990
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x274]
push eax
lea ecx, [esp + 0x488]
push 0x4245ec
push ecx
call fcn.0040d54d
lea edx, [esp + 0x64]
push edx
lea eax, [esp + 0x17c]
push eax
lea ecx, [esp + 0x5a0]
push 0x4245ec
push ecx
call fcn.0040d54d
add esp, 0x38
push ebx
lea edx, [esp + 0x574]
push edx
lea eax, [esp + 0x470]
push eax
call esi
lea ecx, [esp + 0x10]
push ecx
push edi
call ebp
test eax, eax
jne 0x406f80
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
pop esi
pop edi
mov ecx, dword [esp + 0x66c]
pop ebx
xor ecx, esp
call fcn.0040d609
add esp, 0x66c
ret
Function at 0x409b00
Capabilities:
Get common file path

Disassembly:
push str.DefaultUninstall.VISTA
call fcn.00409350
add esp, 4
jmp fcn.004029d0
Function at 0x40a320
Capabilities:
Move file

Disassembly:
sub esp, 0x804
mov eax, dword [0x42a0d0]
xor eax, esp
mov dword [esp + 0x800], eax
push ebx
push esi
push edi
mov esi, ecx
lea edi, [esi + 0xc08]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor eax, eax
push 0x7fe
push eax
lea ecx, [esp + 0x16]
push ecx
xor bl, bl
mov word [esp + 0x18], ax
call fcn.0040d990
add esi, 4
lea edx, [esp + 0x18]
add esp, 0xc
mov eax, esi
sub edx, esi
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x40a370
lea edx, [esp + 0xc]
push 0x2e
push edx
call fcn.0040d1dc
add esp, 8
test eax, eax
jne 0x40a3b3
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.0040d609
add esp, 0x804
ret
mov ecx, str..old
mov edx, eax
sub edx, ecx
lea esp, [esp]
movzx eax, word [ecx]
mov word [edx + ecx], ax
add ecx, 2
test ax, ax
jne 0x40a3c0
lea eax, [esp + 0xc]
push 0x5c
push eax
call fcn.0040d1dc
add esp, 8
test eax, eax
je 0x40a3f6
push 1
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x40a3f6
mov bl, 1
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x80c]
pop edi
pop esi
mov al, bl
pop ebx
xor ecx, esp
call fcn.0040d609
add esp, 0x804
ret

Function at 0x40a420
Capabilities:
Get file size

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ebp, [esi + 0xc08]
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
push ebx
push 0x80
push 4
push ebx
push 3
push 0xc0000000
lea eax, [esi + 4]
push eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40a4b5
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x40a4ae
cmp dword [esp + 0x14], ebx
jl 0x40a4ae
jg 0x40a483
cmp dword [esp + 0x10], 0x80
jbe 0x40a4ae
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call fcn.0040a320
test al, al
je 0x40a4b5
mov dword [esi + 0xc04], ebx
push ebp
mov bl, 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 8
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 8
ret