joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402670
Capabilities:
Delete file
Get file attributes
Move file
Query environment variable
Set file attributes

Disassembly:
sub esp, 0x418
mov eax, dword [0x42a0d0]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
push edi
mov edi, dword [esp + 0x424]
push 0x800
call fcn.0040cf44
mov esi, eax
add esp, 4
test esi, esi
je 0x402836
cmp dword [0x433924], 5
jne 0x4026cd
push esi
call fcn.0040d4b6
add esp, 4
pop edi
pop esi
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.0040d609
add esp, 0x418
ret
push ebx
lea eax, [esp + 0x218]
push 0x104
push eax
call fcn.00401050
push edi
lea ecx, [esp + 0x1c]
push str._Sdesktop.ini
push ecx
call fcn.0040d54d
add esp, 0x14
push 0x104
lea edx, [esp + 0x118]
push edx
push str._Temp_desktop.ini
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [esp + 0x10]
push 0x4246d4
push eax
call fcn.0040e07d
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40282c
lea ecx, [esp + 0x114]
push 0x4246d0
push ecx
call fcn.0040e07d
mov edi, eax
add esp, 8
test edi, edi
je 0x4027ca
push 0xfeff
push 0x4246c8
push edi
call fcn.0040df25
lea eax, [esp + 0x18]
push eax
push esi
xor edx, edx
push str.___n__c
push ebx
mov word [esi], dx
call fcn.0040df05
add esp, 0x1c
cmp eax, 0xffffffff
je 0x4027ca
push 0x42469c
push esi
call fcn.0040d208
add esp, 8
test eax, eax
je 0x40278d
xor ecx, ecx
mov word [esi], cx
jmp 0x4027b1
xor eax, eax
mov edx, 0xfeff
cmp word [esi], dx
sete al
lea ecx, [esi + eax*2]
push ecx
push 0x42457c
push edi
call fcn.0040df25
add esp, 0xc
xor edx, edx
mov word [esi], dx
lea eax, [esp + 0xc]
push eax
push esi
push str.___n__c
push ebx
call fcn.0040df05
add esp, 0x10
cmp eax, 0xffffffff
jne 0x402774
push ebx
call fcn.0040de06
add esp, 4
test edi, edi
je 0x40282c
push edi
call fcn.0040de06
add esp, 4
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edi, eax
mov edx, edi
and edx, 0xfffffff8
push edx
lea eax, [esp + 0x14]
push eax
call ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push edi
lea ecx, [esp + 0x14]
push ecx
call ebx
push esi
call fcn.0040d4b6
add esp, 4
pop ebx
mov ecx, dword [esp + 0x41c]
pop edi
pop esi
xor ecx, esp
call fcn.0040d609
add esp, 0x418
ret
Function at 0x402850
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
sub esp, 0x668
mov eax, dword [0x42a0d0]
xor eax, esp
mov dword [esp + 0x664], eax
push ebx
mov ebx, dword [esp + 0x674]
push ebp
push esi
mov esi, dword [esp + 0x678]
push esi
lea eax, [esp + 0x260]
push str._s.lnk
push eax
call fcn.0040d8ea
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x260]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x402995
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
push 0x208
push eax
lea ecx, [esp + 0x472]
push ecx
mov word [esp + 0x474], ax
call fcn.0040d990
add esp, 0xc
test byte [esp + 0x10], 0x10
jne 0x402979
lea edx, [esp + 0x3c]
push edx
push esi
lea eax, [esp + 0x268]
push str._s_s
push eax
call fcn.0040d8ea
push ebx
lea ecx, [esp + 0x47c]
push ecx
lea edx, [esp + 0x278]
push edx
call fcn.00402520
add esp, 0x1c
test al, al
je 0x402979
lea eax, [esp + 0x468]
push str.nvstview.exe
push eax
call fcn.0040dcfc
add esp, 8
test eax, eax
jne 0x402933
lea ecx, [esp + 0x260]
push ecx
jmp 0x402977
lea edx, [esp + 0x468]
push 0x42469c
push edx
call fcn.0040dcfc
add esp, 8
test eax, eax
jne 0x402956
lea eax, [esp + 0x260]
push eax
jmp 0x402977
lea ecx, [esp + 0x468]
push str.nvstwiz.exe
push ecx
call fcn.0040dcfc
add esp, 8
test eax, eax
jne 0x402979
lea edx, [esp + 0x260]
push edx
call edi
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4028b0
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
push esi
call fcn.00402670
mov ecx, dword [esp + 0x674]
add esp, 4
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040d609
add esp, 0x668
ret

Function at 0x4029d0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x418
mov eax, dword [0x42a0d0]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 4]
push eax
call fcn.004029c0
mov esi, dword [sym.imp.SHFOLDER.dll_SHGetFolderPathW]
add esp, 4
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0x19
push 0
call esi
lea edx, [esp + 8]
push 0x4244d0
push edx
call fcn.00402850
add esp, 8
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
push 0
call esi
lea ecx, [esp + 8]
push 0x4244d0
push ecx
call fcn.00402850
add esp, 8
lea edx, [esp + 8]
push edx
push 0
push 0
push 0x16
push 0
call esi
mov eax, dword [esp + 4]
push eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x218]
push str._sProgramsNVIDIA_Corporation_S
push edx
call fcn.0040d8ea
lea eax, [esp + 0x220]
push 0
push eax
call fcn.00402850
add esp, 0x18
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [esp + 0x418]
pop esi
xor ecx, esp
call fcn.0040d609
add esp, 0x418
ret
Function at 0x402aa0
Capabilities:
Get common file path

Disassembly:
cmp dword [0x433924], 0
je 0x402b2e
push 0x44
push str.NVSTINST_INFO_:__d
call fcn.0040a7c0
add esp, 8
push 0x4365a0
push 0
push 0
push 0x25
mov eax, 0x2e
push 0
mov word [0x436498], ax
call dword [sym.imp.SHFOLDER.dll_SHGetFolderPathA]
push 0x436498
push str..VISTA
push str.setupapi.dll_InstallHinfSection_DefaultInstall_s_132__s_nvstereo.inf
push 0x436390
call fcn.0040d54d
push 0x4365a0
push str._s_rundll32.exe
push 0x436288
call fcn.0040d54d
add esp, 0x1c
push 1
push 1
push 0x3f9
call fcn.00401990
add esp, 8
push eax
push 0x436390
push 0x436288
call fcn.00401f80
add esp, 0x10
ret

Function at 0x402aad
Capabilities:
Get common file path

Disassembly:
cmp dword [0x433924], 0
je 0x402b2e
push 0x44
push str.NVSTINST_INFO_:__d
call fcn.0040a7c0
add esp, 8
push 0x4365a0
push 0
push 0
push 0x25
mov eax, 0x2e
push 0
mov word [0x436498], ax
call dword [sym.imp.SHFOLDER.dll_SHGetFolderPathA]
push 0x436498
push str..VISTA
push str.setupapi.dll_InstallHinfSection_DefaultInstall_s_132__s_nvstereo.inf
push 0x436390
call fcn.0040d54d
push 0x4365a0
push str._s_rundll32.exe
push 0x436288
call fcn.0040d54d
add esp, 0x1c
push 1
push 1
push 0x3f9
call fcn.00401990
add esp, 8
push eax
push 0x436390
push 0x436288
call fcn.00401f80
add esp, 0x10
ret

Function at 0x402b30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x402b47
test al, 0x10
je 0x402b47
mov al, 1
ret
xor al, al
ret

Function at 0x402c20
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x10c
mov eax, dword [0x42a0d0]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
push edi
mov edi, dword [esp + 0x118]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0x104
mov esi, eax
lea eax, [esp + 0xd]
push 0
push eax
mov byte [esp + 0x14], 0
call fcn.0040d990
push str._srcdir
push esi
call fcn.0040d130
add esp, 0x14
test eax, eax
jne 0x402c9a
push eax
push 0x404
call fcn.00401990
push eax
call fcn.00401da0
add esp, 0xc
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.0040d609
add esp, 0x10c
ret
add eax, 8
lea edx, [esp + 8]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x402ca3
lea eax, [esp + 8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402cb4
sub eax, edx
lea eax, [esp + eax + 8]
mov cl, 0x20
cmp byte [eax - 1], cl
jne 0x402cd1
dec eax
mov byte [eax], 0
cmp byte [eax - 1], cl
je 0x402cc8
dec eax
cmp byte [eax], 0x5c
jne 0x402ce0
mov byte [eax], 0
dec eax
cmp byte [eax], 0x5c
je 0x402cd7
lea eax, [esp + 8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402ce7
sub eax, edx
cmp eax, dword [esp + 0x11c]
jae 0x402c81
lea eax, [esp + 8]
mov edx, edi
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x402d03
mov ecx, dword [esp + 0x110]
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.0040d609
add esp, 0x10c
ret
Function at 0x403030
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x354
mov eax, dword [0x42a0d0]
xor eax, esp
mov dword [esp + 0x350], eax
push esi
mov esi, dword [esp + 0x35c]
push edi
push esi
lea eax, [esp + 0x254]
push str._s.
push eax
call fcn.0040d54d
add esp, 0xc
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x403096
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x350]
xor ecx, esp
call fcn.0040d609
add esp, 0x354
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea ecx, [ecx]
mov ecx, 0x4245c8
lea eax, [esp + 0x38]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4030d0
test dl, dl
je 0x4030cc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4030d0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4030b0
xor eax, eax
jmp 0x4030d5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40316b
mov ecx, 0x4245c4
lea eax, [esp + 0x38]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x403106
test dl, dl
je 0x403102
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x403106
add eax, 2
add ecx, 2
test dl, dl
jne 0x4030e6
xor eax, eax
jmp 0x40310b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40316b
lea eax, [esp + 0x38]
push eax
push esi
lea ecx, [esp + 0x154]
push 0x4245ec
push ecx
call fcn.0040d54d
add esp, 0x10
test byte [esp + 0xc], 0x10
je 0x40315d
lea edx, [esp + 0x14c]
push edx
call fcn.00403030
add esp, 4
test al, al
jne 0x40316b
pop ebp
pop edi
pop esi
mov ecx, dword [esp + 0x350]
xor ecx, esp
call fcn.0040d609
add esp, 0x354
ret
lea eax, [esp + 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0xc]
push ecx
push edi
call ebp
test eax, eax
jne 0x4030a0
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [esp + 0x35c]
pop ebp
neg eax
pop edi
sbb eax, eax
pop esi
xor ecx, esp
neg eax
call fcn.0040d609
add esp, 0x354
ret
Function at 0x4031b0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10c
mov eax, dword [0x42a0d0]
xor eax, esp
mov dword [esp + 0x108], eax
lea eax, [esp]
push eax
push 0
push 0
push 0x36
push 0
call dword [sym.imp.SHFOLDER.dll_SHGetFolderPathA]
lea eax, [esp]
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4031e0
mov ecx, dword [0x42489c]
mov edx, dword [0x4248a0]
mov dword [eax], ecx
mov ecx, dword [0x4248a4]
mov dword [eax + 4], edx
mov edx, dword [0x4248a8]
mov dword [eax + 8], ecx
mov ecx, dword [0x4248ac]
mov dword [eax + 0xc], edx
lea edx, [esp]
push edx
mov dword [eax + 0x10], ecx
call fcn.00402b30
add esp, 4
test al, al
je 0x4032bb
lea eax, [esp]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x403230
mov ecx, dword [str.3D_Vision_Experience]
mov edx, dword [0x424888]
mov dword [eax], ecx
mov ecx, dword [0x42488c]
mov dword [eax + 4], edx
mov edx, dword [0x424890]
mov dword [eax + 8], ecx
mov ecx, dword [0x424894]
mov dword [eax + 0xc], edx
mov dx, word [0x424898]
mov dword [eax + 0x10], ecx
mov word [eax + 0x14], dx
lea eax, [esp]
push eax
call fcn.00402b30
add esp, 4
test al, al
je 0x4032bb
push esi
push edi
lea edi, [esp + 8]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403286
mov ecx, 6
mov esi, str.3D_Vision_preview_pack_1
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 8]
push ecx
movsw word es:[edi], word [esi]
call fcn.00402b30
add esp, 4
pop edi
pop esi
test al, al
je 0x4032bb
lea edx, [esp]
push edx
call fcn.00403030
add esp, 4
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.0040d609
add esp, 0x10c
ret
Function at 0x4035f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x114
mov eax, dword [0x42a0d0]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push esi
mov esi, dword [esp + 0x120]
xor bl, bl
test esi, esi
je 0x4036d1
push edi
mov edi, dword [esp + 0x128]
push edi
push 0
push esi
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], 0x104
call fcn.0040d990
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push 0x20119
push 0
push str.SOFTWARENVIDIA_CorporationGlobalNVDisplay.ContainerLocalSystem
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4036b7
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push str.PluginFolderPath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4036b7
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403687
sub eax, edx
cmp edi, eax
jle 0x4036ac
lea eax, [esp + 0x18]
mov edx, esi
mov ecx, eax
sub edx, ecx
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4036a0
mov bl, 1
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, bl
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0040d609
add esp, 0x114
ret
mov ecx, dword [esp + 0x118]
pop esi
mov al, bl
pop ebx
xor ecx, esp
call fcn.0040d609
add esp, 0x114
ret
Function at 0x404090
Capabilities:
Create directory

Disassembly:
sub esp, 0x108
mov eax, dword [0x42a0d0]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push ebx
push esi
xor cl, cl
push edi
test eax, eax
je 0x40413c
lea edx, [esp + 0xc]
sub edx, eax
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4040c0
lea eax, [esp + 0xc]
push 0x5c
push eax
call fcn.0040d040
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, eax
add esp, 8
test esi, esi
je 0x40411c
mov bl, byte [esi]
lea ecx, [esp + 0xc]
push ecx
mov byte [esi], 0
call fcn.00402b30
add esp, 4
test al, al
jne 0x404108
push 0
lea edx, [esp + 0x10]
push edx
call edi
test eax, eax
je 0x404156
mov byte [esi], bl
push 0x5c
inc esi
push esi
call fcn.0040d040
mov esi, eax
add esp, 8
test esi, esi
jne 0x4040e5
lea eax, [esp + 0xc]
push eax
call fcn.00402b30
add esp, 4
test al, al
jne 0x40413a
push 0
lea ecx, [esp + 0x10]
push ecx
call edi
test eax, eax
je 0x404156
mov cl, 1
pop edi
pop esi
mov al, cl
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0040d609
add esp, 0x108
ret
mov ecx, dword [esp + 0x110]
pop edi
pop esi
pop ebx
xor ecx, esp
xor al, al
call fcn.0040d609
add esp, 0x108
ret

Function at 0x404170
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x404187
test al, 0x10
jne 0x404187
mov al, 1
ret
xor al, al
ret
Function at 0x404190
Capabilities:
Delete file
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x804]
sub esp, 0x804
push 0xfffffffffffffffe
push 0x4278d0
push 0x40e2d0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x42a0d0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x800], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 0x80c]
xor bl, bl
mov dword [ebp - 4], 0
lea eax, [ebp]
push eax
push 0
push 0
push 0x8023
push 0
call dword [sym.imp.SHFOLDER.dll_SHGetFolderPathW]
mov eax, esi
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404200
sub eax, esi
lea edi, [ebp]
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x404213
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x20], edi
cmp edi, 2
jge 0x4042ba
lea ecx, [ebp]
push ecx
call fcn.00404170
add esp, 4
test al, al
je 0x4042a3
lea edx, [ebp]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff8
push eax
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp]
push ecx
call esi
mov ebx, eax
neg ebx
sbb ebx, ebx
neg ebx
mov byte [ebp - 0x19], bl
test bl, bl
jne 0x4042a3
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp]
push edx
call fcn.00404170
add esp, 4
test al, al
je 0x4042a3
lea eax, [ebp]
push eax
call esi
mov ebx, eax
neg ebx
sbb ebx, ebx
neg ebx
mov byte [ebp - 0x19], bl
push 0x2e
lea ecx, [ebp]
push ecx
call fcn.0040d1dc
add esp, 8
test eax, eax
jne 0x4042d8
xor bl, bl
mov byte [ebp - 0x19], bl
mov dword [ebp - 4], 0xfffffffe
test bl, bl
jne 0x4042d4
push 0xd
push str.NVSTINST_ERROR_:__d
call fcn.0040a7c0
add esp, 8
mov al, bl
jmp 0x404309
mov ecx, str..old
mov edx, eax
nop
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x4042e0
inc edi
jmp 0x404235
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.0040d609
add ebp, 0x804
mov esp, ebp
pop ebp
ret
Function at 0x404330
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x20c
mov eax, dword [0x42a0d0]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push esi
mov esi, dword [esp + 0x218]
push str._nvstapisvr.dll
push esi
lea eax, [esp + 0x10]
push str._s_S
push eax
mov bl, 1
call fcn.0040d54d
push str._nvstapisvr64.dll
push esi
lea ecx, [esp + 0x124]
push str._s_S
push ecx
call fcn.0040d54d
lea edx, [esp + 0x28]
push edx
call fcn.004010c0
add esp, 0x24
test al, al
jne 0x4043a5
lea eax, [esp + 0x10c]
push eax
call fcn.004010c0
add esp, 4
test al, al
je 0x4044f2
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push edi
lea ecx, [esp + 0xc]
push ecx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
and eax, 0xfffffff8
push eax
lea edx, [esp + 0x10]
push edx
call edi
lea eax, [esp + 0x110]
push eax
call esi
and eax, 0xfffffff8
push eax
lea ecx, [esp + 0x114]
push ecx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0xc]
push edx
call esi
test eax, eax
je 0x4043ff
lea eax, [esp + 0x110]
push eax
call esi
test eax, eax
jne 0x4044d8
push 0x1a
push str.NVSTINST_INFO_:__d
call fcn.0040a7c0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WIN_ERROR_:__d
call fcn.0040a7c0
push 0x1b
push str.NVSTINST_INFO_:__d
call fcn.0040a7c0
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x10
xor edi, edi
push ebp
jmp 0x404440
lea ecx, [esp + 0x10]
mov esi, 1
push ecx
mov ebp, esi
call fcn.004010c0
add esp, 4
test al, al
je 0x404465
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
lea eax, [esp + 0x114]
push eax
call fcn.004010c0
add esp, 4
test al, al
je 0x404489
lea ecx, [esp + 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebp, eax
test esi, esi
je 0x404491
test ebp, ebp
jne 0x4044c5
push 0x32
call ebx
inc edi
cmp edi, 0x64
jl 0x404440
push 0xe
push str.NVSTINST_ERROR_:__d
call fcn.0040a7c0
add esp, 8
xor al, al
pop ebp
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0040d609
add esp, 0x20c
ret
push 0x1c
push str.NVSTINST_INFO_:__d
call fcn.0040a7c0
add esp, 8
mov al, 1
jmp 0x4044ac
pop edi
pop esi
mov al, bl
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0040d609
add esp, 0x20c
ret
mov ecx, dword [esp + 0x210]
pop esi
mov al, bl
pop ebx
xor ecx, esp
call fcn.0040d609
add esp, 0x20c
ret
Function at 0x404d50
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x42a0d0]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push esi
push edi
push 0x1d
push str.NVSTINST_INFO_:__d
call fcn.0040a7c0
push 0x104
lea eax, [esp + 0x19]
push 0
push eax
mov bl, 1
mov byte [esp + 0x20], 0
call fcn.0040d990
push 0x105
lea ecx, [esp + 0x24]
push ecx
push str.nvscpapisvr.exe
call fcn.00402b50
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
add esp, 0x20
test al, al
jne 0x404e12
push 0x105
lea edx, [esp + 0x10]
push 0
push edx
call fcn.0040d990
add esp, 0xc
push 0x104
lea eax, [esp + 0x10]
push eax
call edi
test eax, eax
je 0x404e03
lea ecx, [esp + 0xc]
push 0x5c
push ecx
call fcn.0040d040
add esp, 8
mov esi, eax
call fcn.00401a80
test al, al
mov eax, str.Program_Files__x86_
jne 0x404df4
mov eax, str.Program_Files
push eax
push str._sNVIDIA_Corporation3D_Vision_nvSCPAPISvr.exe
push esi
call fcn.0040d54d
add esp, 0xc
push 0xf
push str.NVSTINST_ERROR_:__d
call fcn.0040a7c0
add esp, 8
lea edx, [esp + 0xc]
push edx
call fcn.004010c0
add esp, 4
test al, al
je 0x404f98
push ebp
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and eax, 0xfffffff8
push eax
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x10]
push edx
call ebp
test eax, eax
jne 0x404f8f
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x7b
jne 0x404ee2
push 0x103
lea eax, [esp + 0x11d]
push 0
push eax
mov byte [esp + 0x124], 0
call fcn.0040d990
add esp, 0xc
push 0x104
lea ecx, [esp + 0x11c]
push ecx
call edi
test eax, eax
je 0x404ee2
lea edx, [esp + 0x118]
push 0x5c
push edx
call fcn.0040d040
add esp, 8
mov esi, eax
call fcn.00401a80
test al, al
mov eax, str.Program_Files__x86_
jne 0x404ec1
mov eax, str.Program_Files
push eax
push str._sNVIDIA_Corporation3D_Vision_nvSCPAPISvr.exe
push esi
call fcn.0040d54d
add esp, 0xc
xor eax, eax
mov cl, byte [esp + eax + 0x118]
mov byte [esp + eax + 0x10], cl
inc eax
test cl, cl
jne 0x404ed2
push 0x10
push str.NVSTINST_ERROR_:__d
call fcn.0040a7c0
add esp, 8
call ebx
push eax
push str.WIN_ERROR_:__d
call fcn.0040a7c0
push 0x1e
push str.NVSTINST_INFO_:__d
call fcn.0040a7c0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x10
xor bl, bl
xor esi, esi
jmp 0x404f20
lea eax, [esp + 0x10]
push eax
call fcn.004010c0
add esp, 4
test al, al
je 0x404f7f
push 0x1f
push str.NVSTINST_INFO_:__d
call fcn.0040a7c0
add esp, 8
lea ecx, [esp + 0x10]
push ecx
call ebp
test eax, eax
jne 0x404f7f
push 0x32
call edi
inc esi
cmp esi, 0xa
jl 0x404f20
push 0x11
push str.NVSTINST_ERROR_:__d
call fcn.0040a7c0
mov al, bl
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.0040d609
add esp, 0x210
ret
push 0x20
push str.NVSTINST_INFO_:__d
call fcn.0040a7c0
mov al, 1
jmp 0x404f63
push 0x21
push str.NVSTINST_INFO_:__d
jmp 0x404f5c
push 0x22
push str.NVSTINST_INFO_:__d
call fcn.0040a7c0
mov ecx, dword [esp + 0x220]
add esp, 8
pop edi
pop esi
mov al, bl
pop ebx
xor ecx, esp
call fcn.0040d609
add esp, 0x210
ret