joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5840c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xec
mov esi, ecx
mov eax, dword [0x5c1040]
xor eax, ebp
mov dword [ebp - 0x10], eax
pcmpeqd xmm0, xmm0
lea ebx, [ebp - 0x50]
movdqu xmmword [ebx + 0x30], xmm0
movdqu xmmword [ebx + 0x20], xmm0
movdqu xmmword [ebx + 0x10], xmm0
movdqu xmmword [ebx], xmm0
lea edi, [ecx + 0x10]
mov ecx, edi
call fcn.00522070
mov ecx, esi
push ebx
push 0
push 0x40
push edx
push eax
call fcn.005887d0
test al, al
je 0x5841b5
movzx eax, word [ebp - 0x50]
cmp eax, 0x5a4d
jne 0x58417b
mov ebx, dword [ebp + 8]
mov ecx, edi
call fcn.00522070
mov ecx, dword [ebp - 0x14]
mov edi, ecx
sar edi, 0x1f
add eax, ecx
adc edi, edx
mov ecx, esi
push ebx
push 0
push 0xf8
push edi
mov dword [ebp - 0xf8], eax
push eax
call fcn.005887d0
test al, al
je 0x58422c
cmp dword [ebx], 0x4550
jne 0x584262
mov eax, dword [ebp + 0xc]
mov bl, 1
test eax, eax
je 0x584213
mov ecx, dword [ebp - 0xf8]
mov dword [eax], ecx
mov dword [eax + 4], edi
jmp 0x584213
push 1
call fcn.004bb790
add esp, 4
test al, al
je 0x584211
lea edi, [ebp - 0xf4]
mov ecx, edi
push 1
push 0x15a
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.0044fd30
lea eax, [ebp - 0xec]
push 0x21
push str.invalid_e_magic_in_dos_header_of
jmp 0x5841e9
push 1
call fcn.004bb790
add esp, 4
test al, al
je 0x584211
lea edi, [ebp - 0xf4]
mov ecx, edi
push 1
push 0x154
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.0044fd30
lea eax, [ebp - 0xec]
push 0x1f
push str.could_not_read_dos_header_from
push eax
call fcn.00499a00
add esp, 0xc
movsx ecx, byte [esi + 0xb]
test ecx, ecx
jns 0x5841ff
mov ecx, dword [esi + 4]
mov esi, dword [esi]
push ecx
push esi
push eax
call fcn.00499a00
add esp, 0xc
mov ecx, edi
call fcn.00450200
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1eb0
mov eax, ebx
add esp, 0xec
pop esi
pop edi
pop ebx
pop ebp
ret 8
push 1
call fcn.004bb790
add esp, 4
test al, al
je 0x584211
lea edi, [ebp - 0xf4]
mov ecx, edi
push 1
push 0x162
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.0044fd30
lea eax, [ebp - 0xec]
push 0x1f
push str.could_not_read_nt_headers_from
jmp 0x5841e9
push 1
call fcn.004bb790
add esp, 4
test al, al
je 0x584211
lea edi, [ebp - 0xf4]
mov ecx, edi
push 1
push 0x168
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.0044fd30
lea eax, [ebp - 0xec]
push 0x23
push str.invalid_signature_in_nt_headers_of
jmp 0x5841e9
Function at 0x431006
Capabilities:
Encode data using xor

Disassembly:
call 0x43100c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x403088
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0xc], 0
xorps xmm0, xmm0
push ebx
push esi
push edi
mov ebx, ecx
movlpd qword [ebp - 8], xmm0
jb 0x4030e0
ja 0x4030a9
cmp dword [ebp + 8], 0
jbe 0x4030e0
mov edi, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov eax, dword [ebp + 0x10]
mov ecx, esi
mov edx, dword [ebp + 0x14]
and ecx, 7
shl ecx, 3
call fcn.0048ba20
mov ecx, 0xff
and ax, cx
xor word [ebx + esi*2], ax
add esi, 1
adc edi, 0
cmp edi, dword [ebp + 0xc]
jb 0x4030af
ja 0x4030e0
cmp esi, dword [ebp + 8]
jb 0x4030af
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4059ce
Capabilities:
Get file attributes

Disassembly:
push ecx
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.00405a47
call fcn.00405a7d
pop ecx
ret

Function at 0x405a05
Capabilities:
Get common file path
Get disk size
Get file attributes

Disassembly:
sub esp, 0x10
lea eax, [esp + 4]
push ebx
push eax
xor ebx, ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x64
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x64
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call fcn.00405ac1
pop ebx
add esp, 0x10
jmp fcn.00405b13

Function at 0x405a47
Capabilities:
Get common file path
Get disk size
Get file attributes

Disassembly:
sub esp, 0x10
push edi
xor edi, edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [esp + 8]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call fcn.00405b60
pop edi
add esp, 0x10
jmp fcn.00405b9a

Function at 0x405b60
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0x18
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, 0x498308
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.00405d3f
pop edi
add esp, 0x18
jmp fcn.00405d8d

Function at 0x405bea
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0x20c
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.00405e35
add esp, 0x20c
jmp fcn.00405e7b

Function at 0x405c3c
Capabilities:
Get disk size
Get memory capacity

Disassembly:
sub esp, 0x10
lea eax, [esp + 4]
push esi
push eax
xor esi, esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x64
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call fcn.00405eae
pop esi
add esp, 0x10
jmp fcn.00405ece
Function at 0x405c6e
Capabilities:
Get disk size
Get file attributes

Disassembly:
sub esp, 0x14
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.00405efc
add esp, 0x14
jmp 0x405f47
sub esp, 0xc
lea eax, [esp]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call fcn.00406503
add esp, 0xc
jmp 0x406551
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call fcn.00407087
call fcn.004070c5
pop ecx
ret

Function at 0x405ca1
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.00405f66
add esp, 0x20c
jmp fcn.00405f9f

Function at 0x405cdd
Capabilities:
Get common file path
Get disk size
Get file attributes

Disassembly:
sub esp, 0x20c
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.00405fdb
add esp, 0x20c
jmp 0x405ff7
sub esp, 0xc
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call fcn.00406713
add esp, 0xc
jmp 0x40672b
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, 0x498308
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00407368
pop edi
jmp fcn.00407388

Function at 0x405d0d
Capabilities:
Get disk size
Get memory capacity

Disassembly:
sub esp, 0x10
push esi
push 0x64
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esp + 8]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call fcn.00406044
pop esi
add esp, 0x10
jmp fcn.00406065
Function at 0x405dd1
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.004061c4
add esp, 0x20c
jmp 0x4061fe
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.004069e7
call fcn.00406a18
pop ecx
ret

Function at 0x405e35
Capabilities:
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.004062bb
call fcn.00406319
leave
ret

Function at 0x405eae
Capabilities:
Get file attributes

Disassembly:
push ecx
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.004063c5
call fcn.0040640b
pop ecx
ret

Function at 0x405f66
Capabilities:
Get common file path
Get disk size
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0x24
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edi
mov edi, 0x498308
push edi
call esi
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
push edi
call esi
call fcn.00406575
pop edi
pop esi
add esp, 0x24
jmp fcn.004065b3

Function at 0x405fdb
Capabilities:
Get common file path
Get memory capacity

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.00406674
add esp, 0x24
jmp fcn.004066d8

Function at 0x406127
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.004068c2
call fcn.0040691c
leave
ret
Function at 0x4061c4
Capabilities:
Get common file path
Get disk size
Get file attributes

Disassembly:
sub esp, 0x10
push esi
push 0x64
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 8]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call fcn.004069a5
pop esi
add esp, 0x10
jmp 0x4069b8
push ecx
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.004079f2
call fcn.00407a2c
pop ecx
ret

Function at 0x4062bb
Capabilities:
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push edi
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x218]
mov edi, 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.00406b49
call fcn.00406ba0
pop edi
leave
ret

Function at 0x4063ad
Capabilities:
Get file attributes

Disassembly:
push ecx
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00406cef
call fcn.00406d0f
pop ecx
ret

Function at 0x4063c5
Capabilities:
Get disk size
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 8]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call fcn.00406d53
call fcn.00406d9b
leave
ret

Function at 0x40640b
Capabilities:
Get file attributes

Disassembly:
push ecx
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00406dd7
call fcn.00406df1
pop ecx
ret

Function at 0x40648a
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call fcn.00406e9d
add esp, 0xc
jmp fcn.00406ef9

Function at 0x4064a4
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00406f1c
call fcn.00406f61
leave
ret
Function at 0x4064d8
Capabilities:
Get common file path
Get disk size
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0x24
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.00406f85
add esp, 0x24
jmp 0x406fcf
sub esp, 0x14
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.004084d3
add esp, 0x14
jmp fcn.00408514

Function at 0x406503
Capabilities:
Get common file path
Get disk size
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0xc
push ebx
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x64
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, 0x498308
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp + 8]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00406fe9
pop edi
pop ebx
add esp, 0xc
jmp fcn.0040702d

Function at 0x406575
Capabilities:
Get common file path
Get memory capacity

Disassembly:
push edi
push 0x64
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x64
push edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.00407106
pop edi
jmp 0x40713b
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.0040870d
add esp, 0x24
jmp 0x408741
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.0040b318
call fcn.0040b337
pop ecx
ret

Function at 0x406604
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.004071ca
call fcn.0040720a
leave
ret

Function at 0x406713
Capabilities:
Get file attributes

Disassembly:
push ecx
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00407330
call fcn.0040734a
pop ecx
ret

Function at 0x406769
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.004073d6
add esp, 0x14
jmp fcn.00407414
Function at 0x406839
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.004075f2
call fcn.00407634
leave
ret

Function at 0x4068c2
Capabilities:
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push edi
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x208]
mov edi, 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x208]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call fcn.0040774a
call fcn.004077a0
pop edi
leave
ret

Function at 0x40691c
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
call fcn.004077b3
call fcn.00407806
leave
ret

Function at 0x406954
Capabilities:
Get disk size
Get memory capacity

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call fcn.00407842
add esp, 0xc
jmp fcn.00407899

Function at 0x406973
Capabilities:
Get common file path
Get disk size
Get memory capacity

Disassembly:
sub esp, 0x10
lea eax, [esp + 4]
push esi
push eax
xor esi, esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x64
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.004078ed
pop esi
add esp, 0x10
jmp fcn.00407945

Function at 0x4069e7
Capabilities:
Get common file path
Get file attributes

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call fcn.00407a7f
add esp, 0xc
jmp 0x407ab5
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.004098c2
add esp, 0x14
jmp fcn.004098d9
Function at 0x406a18
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x24
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.00407ad5
add esp, 0x24
jmp fcn.00407b03

Function at 0x406a74
Capabilities:
Get common file path
Get disk size

Disassembly:
sub esp, 0x10
push esi
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea eax, [esp + 8]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x64
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call fcn.00407b82
pop esi
add esp, 0x10
jmp fcn.00407bd1

Function at 0x406af4
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
lea eax, [ebp - 0x250]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.00407c72
call fcn.00407ca9
leave
ret

Function at 0x406b49
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x250]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.00407cfc
call fcn.00407d46
leave
ret

Function at 0x406c1a
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.00407e1e
call fcn.00407e43
leave
ret

Function at 0x406c69
Capabilities:
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00407e74
call fcn.00407ea6
leave
ret