joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41495f
Capabilities:
Get common file path
Get disk size
Get memory capacity

Disassembly:
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call fcn.0042387f
add esp, 0x14
jmp 0x4238ca
sub esp, 0x14
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.00437b3c
add esp, 0x14
jmp fcn.00437b81

Function at 0x4149cd
Capabilities:
Get common file path
Get disk size
Get file attributes

Disassembly:
sub esp, 0x10
push edi
push 0x64
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.004239a3
pop edi
add esp, 0x10
jmp fcn.004239d0

Function at 0x414adf
Capabilities:
Get common file path
Get memory capacity

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.00423c23
add esp, 0x20c
jmp fcn.00423c3e

Function at 0x414b47
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push edi
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x40
pop edi
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
lea eax, [ebp - 0x258]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00423d06
call fcn.00423d58
pop edi
leave
ret
Function at 0x414ba2
Capabilities:
Get common file path
Get disk size
Get file attributes
Get memory capacity

Disassembly:
push ecx
push ecx
push esi
lea eax, [esp + 4]
xor esi, esi
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.00423d91
pop esi
add esp, 8
jmp 0x423da5
sub esp, 0x20
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call fcn.00437ff0
add esp, 0x20
jmp 0x438030
sub esp, 0x10
push edi
mov edi, 0x498308
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop edi
add esp, 0x10
ret

Function at 0x414c1a
Capabilities:
Get common file path
Get disk size
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 8]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call fcn.00423e99
call fcn.00423ebd
leave
ret

Function at 0x414cf5
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x40
pop edi
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
call fcn.0042404d
call fcn.00424060
pop edi
leave
ret

Function at 0x414dec
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push edi
push 0x40
pop edi
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.004241ec
call fcn.00424239
pop edi
leave
ret
Function at 0x414e30
Capabilities:
Get disk size
Get memory capacity

Disassembly:
push ecx
push ecx
lea eax, [esp]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call fcn.00424286
add esp, 8
jmp fcn.004242ab

Function at 0x414e68
Capabilities:
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00424330
call fcn.00424378
pop ecx
ret

Function at 0x414e8c
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.0042438b
add esp, 0x14
jmp 0x4243c3
push ebp
push esi
push edi
xor ebp, ebp
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x64
push ebp
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
push eax
call esi
push 0x64
push ebp
call edi
push eax
call esi
push 0x64
push ebp
call edi
push eax
call esi
push 0x64
push ebp
call edi
push eax
call esi
call fcn.0043875b
pop edi
pop esi
pop ebp
jmp fcn.0042e1ca

Function at 0x414f23
Capabilities:
Get common file path
Get memory capacity

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.0042447f
add esp, 0x20c
jmp 0x4244ce
sub esp, 0x20c
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.00438825
add esp, 0x20c
jmp fcn.00438857

Function at 0x41501a
Capabilities:
Get common file path
Get disk size
Get file attributes

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.0042465c
add esp, 0xc
jmp 0x42469d
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.00438a4f
jmp fcn.00428576

Function at 0x41503f
Capabilities:
Get common file path
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.004246bf
call fcn.0042470c
pop ecx
ret
Function at 0x41507e
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.00424766
call fcn.00424785
leave
ret

Function at 0x415194
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
push edi
xor edi, edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.004249f4
pop edi
jmp fcn.00424a3f

Function at 0x415230
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0x24
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00424b52
add esp, 0x24
jmp fcn.00424b82

Function at 0x41525d
Capabilities:
Get file attributes

Disassembly:
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00424bbb
call fcn.00424c1b
pop ecx
ret

Function at 0x41528e
Capabilities:
Get file attributes

Disassembly:
push ecx
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00424c30
call fcn.00424c48
pop ecx
ret

Function at 0x4152d5
Capabilities:
Get common file path
Get disk size

Disassembly:
sub esp, 0x10
push esi
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 8]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x64
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x64
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call fcn.00424ceb
pop esi
add esp, 0x10
jmp fcn.00424d28

Function at 0x41531f
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
push edi
push 0x64
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.00424d63
pop edi
jmp fcn.00424d8f
Function at 0x415353
Capabilities:
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00424de0
call fcn.00424e29
pop ecx
ret

Function at 0x415448
Capabilities:
Get common file path
Get disk size
Get file attributes

Disassembly:
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, 0x498308
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00424ff3
pop edi
jmp fcn.00425026

Function at 0x41547e
Capabilities:
Get common file path
Get memory capacity

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.0042505c
add esp, 0x14
jmp fcn.00425081

Function at 0x4154ca
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x250]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.0042516d
call fcn.004251b5
leave
ret

Function at 0x415566
Capabilities:
Get common file path
Get disk size
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0x10
push esi
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp + 8]
xor esi, esi
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.004252b9
pop esi
add esp, 0x10
jmp 0x4252f0
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call sub.KERNEL32.dll_GetProcessHeap
add esp, 0x24
jmp fcn.00427d03

Function at 0x4155de
Capabilities:
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call fcn.00425376
call fcn.0042539a
pop ebx
leave
ret
Function at 0x41576d
Capabilities:
Get common file path
Get disk size

Disassembly:
sub esp, 0x208
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.004255d0
add esp, 0x208
jmp fcn.00425601

Function at 0x4157bd
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
call fcn.004256c0
call fcn.004256f0
leave
ret

Function at 0x41584a
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.0042575b
add esp, 0x24
jmp 0x42577b
sub esp, 0x14
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.00439efd
add esp, 0x14
jmp fcn.0042843e

Function at 0x415897
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x228]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.00425795
call fcn.004257f8
leave
ret

Function at 0x4158e4
Capabilities:
Get disk size
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x64
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [ebp - 8]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call fcn.00425821
call fcn.00425853
pop esi
leave
ret
Function at 0x415983
Capabilities:
Get common file path
Get file attributes

Disassembly:
push esi
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x64
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x64
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.00425938
pop esi
jmp 0x42598c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.0043a14f
jmp fcn.004328a2

Function at 0x4159ca
Capabilities:
Get common file path
Get disk size
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
lea eax, [ebp - 8]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.004259b1
call fcn.004259e6
pop esi
leave
ret

Function at 0x415a62
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
push edi
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.00425a87
pop edi
jmp 0x425ada
sub esp, 0x20c
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call fcn.00428082
add esp, 0x20c
jmp fcn.0043a299

Function at 0x415abc
Capabilities:
Get disk size
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
lea eax, [ebp - 8]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00425b73
call fcn.00425b98
leave
ret

Function at 0x415aff
Capabilities:
Get file attributes

Disassembly:
push ecx
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00425bb2
call fcn.00425bee
pop ecx
ret
Function at 0x415bb0
Capabilities:
Get common file path

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call fcn.00425d40
add esp, 0xc
jmp 0x425d5f
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call sub.KERNEL32.dll_GetProcessHeap
jmp fcn.0042c910

Function at 0x415bca
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00425d71
add esp, 0xc
jmp 0x425d9a
sub esp, 0x20c
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call sub.KERNEL32.dll_GetTickCount
add esp, 0x20c
jmp fcn.0043a69e

Function at 0x415c93
Capabilities:
Get file attributes

Disassembly:
push ecx
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00425ec3
call fcn.00425ed3
pop ecx
ret

Function at 0x415ceb
Capabilities:
Get common file path
Get disk size
Get file attributes

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.00425f7a
jmp 0x425f8a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call fcn.0043a9e7
jmp 0x43aa27
push ecx
push ecx
push ebx
push ebp
mov ebp, 0x498308
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp + 8]
xor ebx, ebx
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [esp + 8]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x415d5c
Capabilities:
Get common file path
Get disk size
Get memory capacity

Disassembly:
push ecx
push ecx
push esi
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 4]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call fcn.00426019
pop esi
add esp, 8
jmp 0x426044
push ecx
push ecx
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.0043ac1c
add esp, 8
jmp fcn.0043ac52