joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a3680
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 8
push esi
push edi
push 0
mov esi, eax
mov byte [esp + 0xf], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
mov dword [esp + 0xc], edi
je 0x4a3700
push ebx
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push edi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x4a36f7
mov edi, ebp
shr edi, 1
lea eax, [edi + 1]
push eax
call fcn.00480af0
mov ecx, dword [esi]
push ebp
push ebx
push ecx
call fcn.006a4bd0
mov edx, dword [esi]
mov word [edx + edi*2], 0
mov ecx, dword [esi]
lea eax, [edi - 1]
mov edi, dword [esp + 0x20]
mov dword [esi + 4], eax
add esp, 0xc
mov word [ecx + eax*2], 0
mov byte [esp + 0x13], 1
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop ebp
pop ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, byte [esp + 0xb]
pop edi
pop esi
add esp, 8
ret

Function at 0x4a3d20
Capabilities:
Get token membership

Disassembly:
sub esp, 0x10
push ebx
xor ebx, ebx
lea eax, [esp + 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [esp + 0x34]
push ecx
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x4a3d8e
mov eax, dword [esp + 8]
lea edx, [esp + 4]
push edx
push eax
push ebx
mov dword [esp + 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x4a3d83
cmp dword [esp + 4], 1
sete bl
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov al, bl
pop ebx
add esp, 0x10
ret
Function at 0x4a3da0
Capabilities:
Create directory
Enumerate files on windows
Get common file path

Disassembly:
sub esp, 0x870
push esi
push edi
call fcn.004a3d20
neg al
push 0x6ee610
push str.UsageStatsChoice
sbb eax, eax
neg eax
call fcn.00480f20
mov eax, dword [0x735b6c]
test eax, eax
mov esi, 0x735b6c
je 0x4a3e0e
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x4a3de0
push 0x6bc0cc
push eax
lea eax, [esp + 0x268]
push eax
mov eax, 0x735900
call fcn.004ad3a0
push 0
lea ecx, [esp + 0x264]
push ecx
call edi
mov eax, dword [esi + 4]
add esi, 4
test eax, eax
jne 0x4a3de0
call fcn.0049dc00
call fcn.00496630
test al, al
je 0x4a3fa9
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push ebp
lea edx, [esp + 0x46c]
push edx
push 0
push 0
push 0x17
push 0
mov word [esp + 0x480], 0
call esi
lea eax, [esp + 0x674]
push eax
push 0
push 0
push 2
push 0
mov word [esp + 0x688], 0
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea edi, [esp + 0x46c]
mov dword [esp + 0xc], 2
cmp word [edi], 0
mov dword [esp + 0x10], 0xffffffff
je 0x4a3f97
push 0x6bc0cc
push 0x6ee620
lea ecx, [esp + 0x26c]
push ecx
mov eax, edi
call fcn.004ad3a0
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x268]
push eax
call ebp
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
je 0x4a3f97
jmp 0x4a3ec0
push 0x12
lea esi, [esp + 0x44]
mov ecx, esi
push str.NCH_Software_Suite
push ecx
call fcn.0069cfe9
add esp, 0xc
test eax, eax
jne 0x4a3ef2
mov eax, 0x12
nop
cmp word [esi], 0
je 0x4a3f20
sub eax, 1
add esi, 2
test eax, eax
jg 0x4a3ee0
jmp 0x4a3f20
push 9
lea edx, [esp + 0x44]
push str.NCH_Suite
push edx
call fcn.0069cfe9
add esp, 0xc
test eax, eax
jne 0x4a3f6b
mov eax, 9
nop
cmp word [esi], 0
je 0x4a3f20
sub eax, 1
add esi, 2
test eax, eax
jg 0x4a3f10
movzx eax, word [esi]
test ax, ax
je 0x4a3f3a
cmp ax, 0x28
je 0x4a3f3a
movzx eax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x4a3f28
cmp word [esi], 0x28
jne 0x4a3f6b
push 0x6bc0cc
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x26c]
push ecx
mov eax, edi
call fcn.004ad3a0
lea edx, [esp + 0x264]
push edx
mov eax, 0xbb8
call fcn.004abff0
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4a3f8c
cmp dword [esp + 0x10], 0xffffffff
jne 0x4a3ec0
jmp 0x4a3f97
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
add edi, 0x208
sub dword [esp + 0xc], 1
jne 0x4a3e74
pop ebp
call fcn.005091a0
pop edi
mov al, 1
pop esi
add esp, 0x870
ret
Function at 0x4a4700
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x208
push esi
push 0x6bc0cc
push str.debut.exe
lea eax, [esp + 0xc]
push eax
mov eax, 0x735900
call fcn.004ad3a0
push str.DebutRunOnce
push SysReAllocStringLen
lea esi, [esp + 0xc]
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
call fcn.004af710
pop esi
add esp, 0x208
ret

Function at 0x4a4740
Capabilities:
Check if file exists
Check os version
Delete registry key
Get file attributes
Persist via run registry key

Disassembly:
sub esp, 0x320
push 0x6bc0cc
push str.debut.exe
lea eax, [esp + 0x120]
push eax
mov eax, 0x735900
call fcn.004ad3a0
lea ecx, [esp + 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4a47b8
lea edx, [esp + 0x118]
push edx
call fcn.004acda0
test al, al
je 0x4a47b8
push str.Uninstall_Software
push str.Debut_cannot_be_uninstalled_because_it_is_being_used_by_another_user_on_this_computer._Please_log_off_other_users_then_try_again_as_Administrator.
push 0
mov ecx, str.Continue
mov eax, str.More_Information
call fcn.004f3920
test al, al
je 0x4a47af
mov eax, 0x2823
call fcn.004019a0
xor al, al
add esp, 0x320
ret
call fcn.004c1ce0
lea eax, [esp]
push eax
push 2
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a47e7
lea ecx, [esp]
push ecx
mov eax, 0x6bc140
call fcn.004af990
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push str.SoftwareClasses_nch.debut
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SoftwareClasses_nch.debut
push SysReAllocStringLen
call esi
call fcn.00435080
call fcn.0050add0
call fcn.00551950
call fcn.0049da50
call fcn.0049dc00
call fcn.004c5820
call fcn.004c5770
call fcn.0049d8e0
call fcn.004baf50
call fcn.0049e180
call fcn.0049e0a0
call fcn.004af5a0
test al, al
pop esi
jne 0x4a486b
lea edx, [esp + 4]
push edx
mov dword [esp + 8], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp byte [esp + 8], 6
setae al
test al, al
je 0x4a486b
call fcn.004a8000
call fcn.004c4920
test al, al
jne 0x4a4879
call fcn.004a7390
mov al, 1
add esp, 0x320
ret
Function at 0x4a5300
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x418
push esi
push edi
push str.Scheduler
push str.SoftwareNCH_SoftwareDebut_s
mov esi, 0x104
lea edi, [esp + 0x18]
call fcn.004af0d0
add esp, 8
lea eax, [esp + 8]
push eax
push 1
push 0
mov ecx, edi
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a5390
mov ecx, dword [esp + 0x424]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x21c]
push eax
push 0
push 0
push ecx
push edx
mov dword [esp + 0x24], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4a5383
cmp esi, 0xea
jne 0x4a5390
pop edi
mov al, 1
pop esi
add esp, 0x418
ret 4
pop edi
xor al, al
pop esi
add esp, 0x418
ret 4

Function at 0x4a5500
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x418
push esi
push edi
push eax
push str.SoftwareNCH_SoftwareDebut_s
mov esi, 0x104
lea edi, [esp + 0x18]
call fcn.004af0d0
add esp, 8
lea ecx, [esp + 8]
push ecx
push 1
push 0
mov edx, edi
push edx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a558c
mov edx, dword [esp + 0x424]
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x21c]
push ecx
push 0
push 0
push edx
push eax
mov dword [esp + 0x24], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 8]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4a557f
cmp esi, 0xea
jne 0x4a558c
pop edi
mov al, 1
pop esi
add esp, 0x418
ret 4
pop edi
xor al, al
pop esi
add esp, 0x418
ret 4
Function at 0x4a5ef0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0xa3c
push ebx
mov ebx, dword [esp + 0xa48]
push ebp
mov ebp, dword [esp + 0xa48]
push esi
push edi
push ebx
push 0x6e9ee8
mov esi, 0x104
lea edi, [esp + 0x28]
call fcn.004af0d0
add esp, 8
lea eax, [esp + 0x638]
push eax
push 0x6bc0cc
xor esi, esi
push str.Path
mov ecx, edi
mov edx, SysReAllocStringLen
mov word [esp + 0x644], si
call fcn.004af7e0
test al, al
jne 0x4a5f69
lea ecx, [esp + 0x638]
push ecx
push 0x6bc0cc
push str.Path
mov ecx, edi
mov edx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.004af7e0
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea edx, [esp + 0x638]
push edx
call edi
cmp eax, 0xffffffff
je 0x4a5fe9
lea eax, [esp + 0x228]
push eax
push 0x6bc0cc
push str.Version
lea ecx, [esp + 0x2c]
mov edx, SysReAllocStringLen
call fcn.004af7e0
test al, al
jne 0x4a6007
lea ecx, [esp + 0x228]
push ecx
push 0x6bc0cc
push str.Version
lea ecx, [esp + 0x2c]
mov edx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.004af7e0
test al, al
jne 0x4a6007
xor eax, eax
jmp 0x4a5fd0
movzx ecx, word [eax + 0x6d98dc]
mov word [esp + eax + 0x228], cx
add eax, 2
cmp cx, si
jne 0x4a5fd0
jmp 0x4a6007
xor eax, eax
jmp 0x4a5ff0
movzx ecx, word [eax + 0x6eecd8]
mov word [esp + eax + 0x228], cx
add eax, 2
cmp cx, si
jne 0x4a5ff0
lea edx, [esp + 0x10]
push edx
push ebp
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x24], ebx
call fcn.004a5dd0
cmp dword [eax], esi
je 0x4a6025
fld1
fstp qword [esp + 0x10]
mov edx, dword [ebp]
mov eax, dword [edx]
mov ecx, ebp
call eax
test al, al
jne 0x4a6156
lea ecx, [esp + 0x228]
push ecx
call fcn.0069c1ef
fcomp qword [esp + 0x14]
add esp, 4
fnstsw ax
test ah, 1
je 0x4a6156
lea edx, [esp + 0x840]
push edx
push esi
push ebx
push ebp
call fcn.004a6bc0
test al, al
je 0x4a6156
lea eax, [esp + 0x228]
push eax
push 0x6bc0cc
push str.Version
lea ecx, [esp + 0x2c]
mov edx, SysReAllocStringLen
call fcn.004af7e0
test al, al
jne 0x4a612c
lea ecx, [esp + 0x228]
push ecx
push 0x6bc0cc
push str.Version
lea ecx, [esp + 0x2c]
mov edx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.004af7e0
test al, al
jne 0x4a612c
lea edx, [esp + 0x430]
push edx
push 0x6bc0cc
push str.Path
lea ecx, [esp + 0x2c]
mov edx, SysReAllocStringLen
mov word [esp + 0x43c], si
call fcn.004af7e0
test al, al
jne 0x4a6105
lea eax, [esp + 0x430]
push eax
push 0x6bc0cc
push str.Path
lea ecx, [esp + 0x2c]
mov edx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.004af7e0
cmp word [esp + 0x430], si
je 0x4a6156
lea ecx, [esp + 0x430]
push ecx
call edi
cmp eax, 0xffffffff
setne al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa3c
ret 8
lea edx, [esp + 0x228]
push edx
call fcn.0069c1ef
fcomp qword [esp + 0x14]
add esp, 4
fnstsw ax
test ah, 1
jne 0x4a6156
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa3c
ret 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xa3c
ret 8
Function at 0x4a6570
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x834
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, eax
mov eax, dword [ebx]
mov edx, dword [eax + 0x20]
push 0
push str.Initializing_run_on_demand...
mov ecx, ebx
call edx
test esi, esi
je 0x4a65cb
cmp word [esi], 0
je 0x4a65cb
push esi
push str._s...
mov esi, 0x104
lea edi, [esp + 0x640]
call fcn.004af0d0
mov eax, dword [ebx]
mov edx, dword [eax + 0x20]
add esp, 8
push 1
mov ecx, edi
push ecx
mov ecx, ebx
call edx
mov edi, dword [ebp + 0x10]
jmp 0x4a65da
mov eax, dword [ebx]
mov edi, dword [ebp + 0x10]
mov edx, dword [eax + 0x20]
push 1
push edi
mov ecx, ebx
call edx
mov eax, dword [ebx]
mov edx, dword [eax]
mov ecx, ebx
call edx
test al, al
je 0x4a65f8
mov eax, dword [ebp + 8]
mov dword [eax], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
call fcn.00542560
test al, al
jne 0x4a6613
mov eax, dword [ebp + 8]
mov dword [eax], 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
lea esi, [esp + 0x228]
call fcn.00401df0
push str..exe
push edi
lea eax, [esp + 0x28]
push eax
mov eax, esi
call fcn.004ad3a0
lea edx, [esp + 0x20]
lea esi, [esp + 0x430]
call fcn.004ad160
lea ecx, [esp + 0x20]
push ecx
push str.audiochannel.net
push ebx
lea edx, [esp + 0x24]
push edx
mov ecx, esi
call fcn.00499fa0
mov eax, dword [esp + 0x18]
mov esi, 2
cmp eax, esi
jne 0x4a6687
lea eax, [esp + 0x20]
push eax
push str.www.nch.com.au
push ebx
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x440]
call fcn.00499fa0
mov eax, dword [eax]
mov dword [esp + 0x18], eax
test eax, eax
jne 0x4a66f4
lea eax, [esp + 0x20]
mov dword [esp + 0x18], esi
call fcn.00401c60
test eax, eax
jbe 0x4a66f4
mov edx, dword [ebx]
mov eax, dword [edx + 0x20]
push 0
push str.Running_install_on_demand
mov ecx, ebx
call eax
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push ecx
push edx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.004a6170
mov edx, dword [esp + 0x1c]
push edi
mov edi, ebx
mov dword [esp + 0x1c], edx
call fcn.004a6500
test al, al
jne 0x4a66dd
mov dword [esp + 0x18], esi
jmp 0x4a66f4
cmp dword [esp + 0x18], 0
jne 0x4a66f4
mov eax, dword [ebx]
mov edx, dword [eax + 0x20]
push 0
push str.Completed
mov ecx, ebx
call edx
mov eax, dword [ebx]
fld1
mov edx, dword [eax + 0x24]
sub esp, 8
mov ecx, ebx
fstp qword [esp]
call edx
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x18]
mov esi, dword [ebp + 8]
mov dword [esi], ecx
lea ecx, [esp + 0x228]
call fcn.004ad910
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4a6a60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x210]
push esi
push edi
push eax
push 0x6e9ee8
mov esi, 0x104
lea edi, [esp + 0x14]
call fcn.004af0d0
add esp, 8
push ebx
push 0x6bc0cc
push str.Path
mov ecx, edi
mov edx, SysReAllocStringLen
call fcn.004af7e0
test al, al
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
je 0x4a6abe
push ebx
call esi
cmp eax, 0xffffffff
je 0x4a6abe
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0x208
ret 4
push ebx
push 0x6bc0cc
push str.Path
lea ecx, [esp + 0x18]
mov edx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.004af7e0
test al, al
je 0x4a6ae3
push ebx
call esi
cmp eax, 0xffffffff
jne 0x4a6ab0
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x208
ret 4

Function at 0x4a6e10
Capabilities:
Get common file path
Get program files directory

Disassembly:
sub esp, 0x618
lea eax, [esp]
push eax
push 0
push 0
push 0x26
push 0
mov word [esp + 0x14], 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x6bc0cc
push str.NCH_Software
lea ecx, [esp + 0x210]
push ecx
lea eax, [esp + 0xc]
call fcn.004ad3a0
push 0x6bc0cc
push str.Components
lea edx, [esp + 0x418]
push edx
lea eax, [esp + 0x214]
call fcn.004ad3a0
push 0x6bc0cc
push str.Shared
push esi
lea eax, [esp + 0x41c]
call fcn.004ad3a0
push esi
call fcn.004021c0
test al, al
je 0x4a6e92
mov al, 1
add esp, 0x618
ret
mov ecx, esi
call fcn.004ad6d0
add esp, 0x618
ret

Function at 0x4a6ea0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x618
lea eax, [esp]
push eax
push 0
push 0
push 0x1a
push 0
mov word [esp + 0x14], 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x6bc0cc
push str.NCH_Software
lea ecx, [esp + 0x210]
push ecx
lea eax, [esp + 0xc]
call fcn.004ad3a0
push 0x6bc0cc
push str.Components
lea edx, [esp + 0x418]
push edx
lea eax, [esp + 0x214]
call fcn.004ad3a0
push 0x6bc0cc
push str.Shared
push esi
lea eax, [esp + 0x41c]
call fcn.004ad3a0
push esi
call fcn.004021c0
test al, al
je 0x4a6f22
mov al, 1
add esp, 0x618
ret
mov ecx, esi
call fcn.004ad6d0
add esp, 0x618
ret
Function at 0x4a6f30
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x828
push ebx
push ebp
mov ebp, dword [esp + 0x838]
push esi
push edi
push eax
mov eax, ebp
call fcn.004a6a60
test al, al
jne 0x4a7127
lea ecx, [esp + 0x428]
push ecx
call fcn.004c4840
test al, al
jne 0x4a6f73
xor bx, bx
mov word [esp + 0x428], bx
jmp 0x4a6f7b
mov bx, word [esp + 0x428]
test bx, bx
mov word [esp + 0x18], 0
je 0x4a6fbf
push str..zip
push ebp
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x434]
call fcn.004ad3a0
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp + 0x18]
push eax
call edi
cmp eax, 0xffffffff
jne 0x4a6fb5
xor bx, bx
jmp 0x4a6fc5
mov bx, word [esp + 0x428]
jmp 0x4a6fc5
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea esi, [esp + 0x220]
call fcn.004a6e10
test al, al
mov byte [esp + 0x13], al
jne 0x4a6fde
call fcn.004a6ea0
lea ecx, [esp + 0x220]
push ecx
call edi
cmp eax, 0xffffffff
je 0x4a7046
test bx, bx
jne 0x4a7055
push str..zip
push ebp
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x22c]
call fcn.004ad3a0
mov esi, dword [esp + 0x83c]
lea eax, [esp + 0x18]
push eax
push ebp
push str.audiochannel.net
push esi
lea ecx, [esp + 0x24]
push ecx
call fcn.004a72a0
cmp dword [eax], 0
je 0x4a705c
lea edx, [esp + 0x18]
push edx
push ebp
push str.www.nch.com.au
push esi
lea eax, [esp + 0x24]
push eax
call fcn.004a72a0
cmp dword [eax], 0
je 0x4a705c
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x828
ret 0xc
mov esi, dword [esp + 0x83c]
lea ecx, [esp + 0x18]
push ecx
call edi
cmp eax, 0xffffffff
je 0x4a7046
call fcn.004af5a0
test al, al
je 0x4a7085
lea edx, [esp + 0x18]
push edx
push esi
lea eax, [esp + 0x228]
call fcn.00550d30
jmp 0x4a709b
lea edi, [esp + 0x220]
lea eax, [esp + 0x18]
call fcn.00550bc0
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test bx, bx
jne 0x4a70ab
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [esp + 0x844]
push 0x6bc0cc
push ebp
push esi
lea eax, [esp + 0x22c]
call fcn.004ad3a0
push esi
call edi
cmp eax, 0xffffffff
je 0x4a7046
push ebp
push 0x6e9ee8
mov esi, 0x104
lea edi, [esp + 0x638]
call fcn.004af0d0
add esp, 8
cmp byte [esp + 0x13], 0
je 0x4a710a
mov esi, dword [esp + 0x844]
push str.Path
push reloc.OLEAUT32.dll_SysReAllocString
mov edx, edi
call fcn.004af710
mov esi, dword [esp + 0x844]
push str.Path
push SysReAllocStringLen
lea edx, [esp + 0x638]
call fcn.004af710
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x828
ret 0xc
Function at 0x4a72a0
Capabilities:
Delete file

Disassembly:
mov eax, 0x4218
call fcn.006ab750
mov eax, dword [esp + 0x4228]
mov ecx, dword [esp + 0x4224]
push ebx
mov ebx, dword [esp + 0x4230]
push ebp
mov ebp, dword [esp + 0x4224]
push esi
push edi
push eax
push ecx
push str.http:___s_components_shared__s.zip
mov esi, 0x2002
lea edi, [esp + 0x22c]
mov dword [ebp], 2
call fcn.004af0d0
mov edx, dword [esp + 0x423c]
add esp, 0xc
push 0
push ebx
mov eax, edi
push edx
lea edi, [esp + 0x20]
call fcn.00408560
mov eax, dword [eax]
test eax, eax
mov dword [ebp], eax
je 0x4a737a
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x4238]
mov ecx, dword [esp + 0x4234]
push eax
push ecx
push str.http:___s_components_shared__s.zip
lea edi, [esp + 0x22c]
call fcn.004af0d0
add esp, 0xc
mov edx, edi
push edx
lea esi, [esp + 0x1c]
call fcn.004a5640
mov eax, dword [eax]
mov edx, dword [esp + 0x4230]
push 0
push ebx
push eax
lea ecx, [esp + 0x20]
call fcn.00541e10
mov ecx, dword [esp + 0x21c]
push ecx
call fcn.0069c8fa
mov eax, dword [esp + 0x18]
add esp, 4
test eax, eax
mov dword [ebp], eax
je 0x4a737a
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x4218
ret 0x14
Function at 0x4a7390
Capabilities:
Delete directory
Delete registry key
Get common file path
Get program files directory

Disassembly:
sub esp, 0xa44
push ebx
push ebp
mov ebp, dword [sym.imp.SHLWAPI.dll_SHDeleteEmptyKeyW]
xor eax, eax
push esi
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
push edi
mov dword [esp + 0x14], str.NCH_Software
mov dword [esp + 0x18], str.NCH_Swift_Sound
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], SysReAllocStringLen
mov dword [esp + 0x28], eax
mov dword [esp + 0x10], eax
nop
xor edi, edi
mov esi, str.NCH_Software
jmp 0x4a73e0
push esi
push str.Software_sComponents
lea edx, [esp + 0x34]
call fcn.00401000
add esp, 8
cmp word [esp + 0x2c], 0
je 0x4a7406
lea eax, [esp + 0x2c]
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push esi
push str.Software_s
lea edx, [esp + 0x34]
call fcn.00401000
add esp, 8
lea ecx, [esp + 0x2c]
push ecx
push ebx
call ebp
mov esi, dword [esp + edi*4 + 0x18]
add edi, 1
test esi, esi
jne 0x4a73e0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + eax*4 + 0x24]
add eax, 1
test ebx, ebx
mov dword [esp + 0x10], eax
jne 0x4a73d0
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor ebp, ebp
lea edx, [esp + 0x234]
push edx
push ebp
push ebp
push 0x26
push ebp
mov word [esp + 0x248], bp
call esi
lea eax, [esp + 0x43c]
push eax
push ebp
push ebp
push 0x1a
push ebp
mov word [esp + 0x450], bp
call esi
cmp word [esp + 0x234], bp
mov word [esp + 0x644], bp
mov dword [esp + 0x10], ebp
je 0x4a7526
mov ebx, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea edi, [esp + 0x234]
jmp 0x4a74a0
xor esi, esi
mov eax, str.NCH_Software
jmp 0x4a74b0
push 0x6bc0cc
push eax
lea ecx, [esp + 0x34]
push ecx
mov eax, edi
call fcn.004ad3a0
push 0x6bc0cc
push str.Components
lea edx, [esp + 0x854]
push edx
lea eax, [esp + 0x38]
call fcn.004ad3a0
mov edx, 0xbb8
lea ecx, [esp + 0x84c]
call fcn.004ad810
lea eax, [esp + 0x2c]
push eax
call ebx
mov eax, dword [esp + esi*4 + 0x18]
add esi, 1
cmp eax, ebp
jne 0x4a74b0
mov eax, dword [esp + 0x10]
add eax, 1
mov dword [esp + 0x10], eax
imul eax, eax, 0x208
cmp word [esp + eax + 0x234], bp
lea edi, [esp + eax + 0x234]
jne 0x4a74a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa44
ret