joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c656
Capabilities:
Get common file path
Get disk size

Disassembly:
sub esp, 0x208
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call sub.KERNEL32.dll_GetTickCount
add esp, 0x208
jmp fcn.00428576

Function at 0x41c69a
Capabilities:
Get common file path
Get disk size
Get memory capacity

Disassembly:
sub esp, 0x10
lea eax, [esp + 4]
push esi
push eax
xor esi, esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x64
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.00428082
pop esi
add esp, 0x10
jmp fcn.0042f33b

Function at 0x41c733
Capabilities:
Get disk size
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push edi
mov edi, 0x498308
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 8]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.0042d9dc
call sub.KERNEL32.dll_GetTickCount
pop edi
leave
ret

Function at 0x41c7ff
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.0042f4b1
add esp, 0x208
jmp fcn.0042f4dd

Function at 0x41c871
Capabilities:
Get common file path

Disassembly:
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.0042f57a
add esp, 0x14
jmp fcn.00428d6c

Function at 0x41c90a
Capabilities:
Get common file path
Get file attributes

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call esi
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
call esi
call fcn.0042f671
pop esi
jmp fcn.00428f8b

Function at 0x41c9d1
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.0042f788
add esp, 0x10
jmp 0x42f7bd
sub esp, 0x208
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
add esp, 0x208
ret
Function at 0x41ca48
Capabilities:
Get common file path
Get disk size
Get file attributes
Get memory capacity

Disassembly:
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.004290dc
jmp fcn.0042f7f2

Function at 0x41cb2d
Capabilities:
Get file attributes

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call fcn.0042f91f
jmp 0x42f955
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
ret

Function at 0x41cb43
Capabilities:
Get common file path
Get disk size
Get memory capacity

Disassembly:
sub esp, 0x20c
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.0042c24d
add esp, 0x20c
jmp fcn.0042f982

Function at 0x41cc71
Capabilities:
Get common file path
Get disk size
Get memory capacity

Disassembly:
sub esp, 0x10
push esi
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea eax, [esp + 8]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call fcn.0042fa89
pop esi
add esp, 0x10
jmp fcn.0042fac0

Function at 0x41cd17
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0x20c
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.0042c054
add esp, 0x20c
jmp fcn.0042fb5e

Function at 0x41cdd9
Capabilities:
Get common file path
Get file attributes

Disassembly:
push ecx
push ebx
push edi
push 0x64
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, 0x498308
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.0042fc6e
call fcn.0042fca6
pop edi
pop ebx
pop ecx
ret
Function at 0x41ceb3
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0x28
push edi
xor edi, edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.0042fd9f
pop edi
add esp, 0x28
jmp fcn.0042fde9

Function at 0x41cfa2
Capabilities:
Get common file path
Get disk size
Get memory capacity

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.0042ec5b
add esp, 0x14
jmp fcn.0042fef7

Function at 0x41d0ff
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.0042a2bd
add esp, 0x208
jmp fcn.0042a901

Function at 0x41d1ca
Capabilities:
Get file attributes

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.00430126
jmp sub.KERNEL32.dll_GetTickCount

Function at 0x41d360
Capabilities:
Get common file path
Get memory capacity

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.00430321
add esp, 0x20c
jmp fcn.0043035c

Function at 0x41d43d
Capabilities:
Get common file path
Get disk size

Disassembly:
push ecx
push ecx
push esi
push 0x64
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [esp + 4]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call fcn.0042b58e
pop esi
add esp, 8
jmp fcn.00427ea4

Function at 0x41d47c
Capabilities:
Get common file path
Get file attributes

Disassembly:
sub esp, 0x210
push edi
mov edi, 0x498308
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.0043049d
pop edi
add esp, 0x210
jmp 0x4304ec
sub esp, 0x10
push edi
xor edi, edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
pop edi
add esp, 0x10
ret
Function at 0x41d546
Capabilities:
Get common file path
Get memory capacity

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.00428d6c
add esp, 0x20c
jmp fcn.0043059f

Function at 0x41d5bc
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.0042c054
add esp, 0x20c
jmp fcn.0043060f

Function at 0x41d5f8
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
push ebx
push 0x64
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x64
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.0043064b
pop ebx
jmp fcn.0043067c

Function at 0x41d6f5
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push edi
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x40
pop edi
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
call fcn.00430755
call fcn.00430793
pop edi
leave
ret

Function at 0x41d7c7
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.00430834
add esp, 0x208
jmp fcn.00429359

Function at 0x41d89e
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
push ebx
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x64
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x64
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esp + 4]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x64
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call fcn.0043094f
pop ebx
add esp, 0x208
jmp fcn.00430982
Function at 0x41d952
Capabilities:
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.004309cd
call fcn.004309fa
leave
ret

Function at 0x41da7d
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0x20c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.0042ae9f
add esp, 0x20c
jmp fcn.00430bed

Function at 0x41dabd
Capabilities:
Get common file path
Get disk size

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.00430c25
add esp, 0xc
jmp fcn.00430c5d

Function at 0x41db11
Capabilities:
Get disk size
Get file attributes

Disassembly:
sub esp, 0x10
lea eax, [esp + 4]
push ebp
push eax
xor ebp, ebp
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x64
push ebp
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esp + 8]
push eax
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x64
push ebp
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.00428901
pop ebp
add esp, 0x10
jmp 0x430d1f
sub esp, 0x10
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
add esp, 0x10
ret

Function at 0x41db79
Capabilities:
Get common file path
Get file attributes

Disassembly:
push ecx
push ecx
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.00430d52
add esp, 8
jmp 0x430d8a
sub esp, 0x208
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
add esp, 0x208
ret
Function at 0x41dbeb
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call fcn.0042aff7
call fcn.00428f8b
leave
ret

Function at 0x41dd81
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0xc
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call fcn.00430f28
add esp, 0xc
jmp 0x430f5b
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0x24
jmp dword [sym.imp.KERNEL32.dll_GetTickCount]

Function at 0x41ddac
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call fcn.00430f86
call fcn.00430fa2
leave
ret

Function at 0x41dde3
Capabilities:
Get common file path
Get memory capacity

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.00430fca
add esp, 0x20c
jmp fcn.0043100a

Function at 0x41de08
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.00431040
add esp, 0x14
jmp fcn.00431060

Function at 0x41de6e
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.004310e9
call fcn.00431115
leave
ret

Function at 0x41df07
Capabilities:
Get common file path
Get file attributes

Disassembly:
sub esp, 0x208
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edi
mov edi, 0x498308
push edi
call esi
push edi
call esi
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
call esi
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.0042fc5d
pop edi
pop esi
add esp, 0x208
jmp fcn.00431222
Function at 0x41df56
Capabilities:
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
lea eax, [ebp - 0x218]
push edi
push eax
mov edi, 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.00431259
call fcn.00431298
pop edi
leave
ret

Function at 0x41dfa3
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [ebp - 0x228]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00428bbd
call fcn.004312ce
leave
ret

Function at 0x41e158
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push edi
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, 0x498308
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.004314bd
call fcn.0042e609
pop edi
leave
ret

Function at 0x41e295
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.004315fa
add esp, 0x10
jmp fcn.0043162b

Function at 0x41e302
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.004316a5
call fcn.004316de
leave
ret

Function at 0x41e348
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.00431710
add esp, 0x10
jmp fcn.00431737
Function at 0x41e36a
Capabilities:
Get common file path
Get disk size

Disassembly:
push ecx
push ecx
lea eax, [esp]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call fcn.00431764
add esp, 8
jmp fcn.0042ef18

Function at 0x41e3fc
Capabilities:
Get file attributes

Disassembly:
push ecx
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.004317ef
call fcn.0043182d
pop ecx
ret

Function at 0x41e467
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00429839
call fcn.004318ec
leave
ret

Function at 0x41e4ed
Capabilities:
Get common file path
Get disk size
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
lea eax, [ebp - 8]
push esi
push eax
xor esi, esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00431963
call fcn.004319a3
pop esi
leave
ret

Function at 0x41e537
Capabilities:
Get common file path
Get file attributes

Disassembly:
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.004319c5
jmp fcn.00428f8b

Function at 0x41e57b
Capabilities:
Get common file path
Get disk size
Get memory capacity

Disassembly:
sub esp, 0x10
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call sub.KERNEL32.dll_GetProcessHeap
add esp, 0x10
jmp fcn.00431a24

Function at 0x41e6a9
Capabilities:
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.00429bca
call fcn.00431bce
leave
ret

Function at 0x41e6f6
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call fcn.00431c1e
add esp, 0xc
jmp fcn.00431c5a