joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b95b
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.004116d8
call fcn.00411717
leave
ret

Function at 0x40b9c1
Capabilities:
Get common file path
Get disk size

Disassembly:
sub esp, 0xc
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call fcn.004117c3
add esp, 0xc
jmp 0x4117f2
sub esp, 0x20c
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.0041d546
add esp, 0x20c
jmp 0x41d582
push edi
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x64
push edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call fcn.004305dc
pop edi
jmp fcn.00428576

Function at 0x40ba7e
Capabilities:
Get common file path
Get disk size
Get memory capacity

Disassembly:
sub esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [esp + 8]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call fcn.004118ff
pop esi
add esp, 0x10
jmp fcn.00411924

Function at 0x40bbb9
Capabilities:
Get disk size
Get memory capacity

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call fcn.00411b1c
add esp, 0xc
jmp fcn.00411b62

Function at 0x40bbd3
Capabilities:
Get disk size

Disassembly:
sub esp, 0x14
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.00411baf
add esp, 0x14
jmp fcn.00411bd5

Function at 0x40bbfe
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call fcn.00411c12
call fcn.00411c2c
leave
ret
Function at 0x40bcd6
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call fcn.00411d6b
add esp, 0xc
jmp 0x411d9b
push edi
mov edi, 0x498308
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.0041e203
pop edi
jmp 0x41e257
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.0043159d
add esp, 0x24
jmp fcn.004315b3

Function at 0x40bcf6
Capabilities:
Get disk size
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0x24
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.00411dc0
add esp, 0x24
jmp fcn.00411ddf

Function at 0x40bd32
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0x18
push esi
push 0x64
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x64
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.00411e25
pop esi
add esp, 0x18
jmp 0x411e76
sub esp, 0x24
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.0041e3b8
add esp, 0x24
jmp 0x41e3e4
push ecx
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00427ea4
call fcn.00428901
pop ecx
ret

Function at 0x40bd7f
Capabilities:
Get common file path
Get memory capacity

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.00411eba
add esp, 0x24
jmp 0x411ee9
sub esp, 0x20c
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.0041e467
add esp, 0x20c
jmp fcn.0041e4a5
Function at 0x40be67
Capabilities:
Get common file path
Get disk size
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0xc
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call fcn.0041215a
add esp, 0xc
jmp fcn.0041219b

Function at 0x40bed0
Capabilities:
Get disk size
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0x24
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.00412288
add esp, 0x24
jmp 0x4122c3
sub esp, 0x14
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.0041ead3
add esp, 0x14
jmp 0x41eb37
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
call esi
call esi
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call fcn.0043217b
pop esi
jmp fcn.004321a2

Function at 0x40bf07
Capabilities:
Get common file path
Get disk size

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.004122dd
add esp, 0x14
jmp fcn.004122fb

Function at 0x40c01a
Capabilities:
Get common file path
Get disk size
Get file attributes

Disassembly:
sub esp, 0xc
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call fcn.004124d5
add esp, 0xc
jmp 0x4124fe
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
xor ebx, ebx
push 0x64
push ebx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
push eax
call esi
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x64
push ebx
call edi
push eax
call esi
push 0x64
push ebx
call edi
push eax
call esi
call fcn.0041f048
pop edi
pop esi
pop ebx
add esp, 0x10
jmp fcn.0041f05a
Function at 0x40c0e3
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0x20c
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.0041265e
add esp, 0x20c
jmp 0x4126a4
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call fcn.0041f365
add esp, 0x24
jmp fcn.0041f398

Function at 0x40c178
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.00412721
add esp, 0x20c
jmp 0x412755
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.0041f546
call fcn.0041f587
pop ecx
ret

Function at 0x40c1b8
Capabilities:
Get common file path
Get disk size

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call fcn.004127de
add esp, 0xc
jmp fcn.0041281a

Function at 0x40c1d7
Capabilities:
Get disk size

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.00412870
add esp, 0x14
jmp fcn.00412893

Function at 0x40c25c
Capabilities:
Get file attributes

Disassembly:
push ecx
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.004129b0
call fcn.004129ed
pop ecx
ret

Function at 0x40c384
Capabilities:
Get common file path
Get disk size
Get memory capacity

Disassembly:
sub esp, 0x24
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.00412c11
add esp, 0x24
jmp 0x412c69
sub esp, 0x14
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call fcn.0041ffb4
add esp, 0x14
jmp fcn.0041fffc

Function at 0x40c41a
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x24
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.00412cf8
add esp, 0x24
jmp 0x412d3d
push ecx
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.0042018e
call fcn.004201d6
pop ecx
ret
Function at 0x40c4dc
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call fcn.00412f92
add esp, 0x24
jmp fcn.00412fb8

Function at 0x40c513
Capabilities:
Get common file path
Get file attributes

Disassembly:
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.00412ffa
jmp 0x41304e
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00420759
jmp 0x4207a1
sub esp, 0x208
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call fcn.00434073
add esp, 0x208
jmp 0x4340b4
push edi
xor edi, edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
pop edi
ret

Function at 0x40c611
Capabilities:
Get common file path
Get memory capacity

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.00413205
add esp, 0x20c
jmp fcn.0041322a

Function at 0x40c69a
Capabilities:
Get common file path

Disassembly:
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.004132f4
add esp, 0x14
jmp 0x41332f
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.00420cf9
add esp, 8
jmp 0x420d17
sub esp, 0x10
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.0042b58e
add esp, 0x10
jmp 0x4346ea
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
ret
Function at 0x40c818
Capabilities:
Get common file path
Get disk size

Disassembly:
sub esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [esp + 8]
xor edi, edi
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x64
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.00413572
pop edi
add esp, 0x10
jmp 0x4135a1
sub esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
call esi
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x64
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [esp + 8]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call fcn.004213cb
pop esi
add esp, 0x10
jmp 0x42141e
push ecx
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.00434f30
call fcn.00434f6c
pop ecx
ret

Function at 0x40c968
Capabilities:
Get common file path
Get file attributes

Disassembly:
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call fcn.00413884
call fcn.004138c9
pop ecx
ret

Function at 0x40c9d8
Capabilities:
Get common file path
Get disk size
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
lea eax, [ebp - 0x210]
push edi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, 0x498308
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 8]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.0041395c
call fcn.00413989
pop edi
leave
ret

Function at 0x40ca69
Capabilities:
Get disk size
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push edi
push eax
xor edi, edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 8]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00413a56
call fcn.00413a69
pop edi
leave
ret

Function at 0x40cb70
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call fcn.00413c27
add esp, 0xc
jmp fcn.00413c58
Function at 0x40cbdf
Capabilities:
Get common file path
Get memory capacity

Disassembly:
sub esp, 0x10
push esi
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x64
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x64
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.00413d61
pop esi
add esp, 0x10
jmp fcn.00413dbe

Function at 0x40cc26
Capabilities:
Get common file path
Get disk size
Get file attributes

Disassembly:
sub esp, 0x210
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x64
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x64
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x64
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.00413df1
pop ebx
add esp, 0x210
jmp fcn.00413e1f

Function at 0x40cce0
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.00413f83
call fcn.00413f9d
leave
ret

Function at 0x40cde9
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.00414115
add esp, 0x14
jmp fcn.00414144

Function at 0x40ce1c
Capabilities:
Get common file path
Get disk size
Get memory capacity

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.00414183
add esp, 0x20c
jmp fcn.004141cb

Function at 0x40ce96
Capabilities:
Get disk size
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 8]
push edi
push eax
xor edi, edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x64
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 8]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.0041432e
call fcn.0041436a
pop edi
leave
ret
Function at 0x40cfa1
Capabilities:
Get common file path
Get disk size
Get memory capacity

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.00414534
add esp, 0x20c
jmp 0x414557
sub esp, 0x10
push esi
push 0x64
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [esp + 8]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call fcn.004230c4
pop esi
add esp, 0x10
jmp fcn.00423106

Function at 0x40d05c
Capabilities:
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00414650
call fcn.00414675
leave
ret

Function at 0x40d173
Capabilities:
Get common file path

Disassembly:
sub esp, 0x18
lea eax, [esp + 4]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x64
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x64
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.0041483f
pop ebx
add esp, 0x18
jmp 0x414861
push ecx
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call fcn.0042368c
call fcn.004236a1
pop ecx
ret

Function at 0x40d33c
Capabilities:
Get file attributes

Disassembly:
push ecx
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00414ba2
call fcn.00414bcb
pop ecx
ret

Function at 0x40d391
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00414c5b
call fcn.00414cad
leave
ret

Function at 0x40d3c5
Capabilities:
Get disk size
Get memory capacity

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call fcn.00414cf5
add esp, 0xc
jmp 0x414d45
sub esp, 0x10
push esi
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea eax, [esp + 8]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call fcn.0042409f
pop esi
add esp, 0x10
jmp fcn.004240c2