joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415dc2
Capabilities:
Get disk size
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 8]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.004260c7
call fcn.00426103
leave
ret

Function at 0x415dfe
Capabilities:
Get disk size
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 8]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call fcn.0042612e
call fcn.0042616a
leave
ret

Function at 0x415e69
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call fcn.004261fc
add esp, 0xc
jmp 0x426234
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.0043af63
add esp, 0x24
jmp sub.KERNEL32.dll_GetTickCount

Function at 0x415e89
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call fcn.0042624e
call fcn.00426272
leave
ret

Function at 0x415f83
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call fcn.00426498
call fcn.004264ad
leave
ret
Function at 0x416022
Capabilities:
Get common file path
Get disk size
Get file attributes

Disassembly:
sub esp, 0x208
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.00426546
add esp, 0x208
jmp 0x426569
push ecx
push ecx
push esi
lea eax, [esp + 4]
xor esi, esi
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x64
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call sub.KERNEL32.dll_GetTickCount
pop esi
add esp, 8
jmp 0x43b390
sub esp, 0x208
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edi
mov edi, 0x498308
push edi
call esi
push edi
call esi
push edi
call esi
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
pop edi
pop esi
add esp, 0x208
ret

Function at 0x41604d
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.0042659a
add esp, 0x14
jmp 0x4265e2
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.0043b42e
call fcn.0042b44b
pop ecx
ret

Function at 0x416083
Capabilities:
Get common file path
Get file attributes

Disassembly:
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call fcn.004265f5
jmp 0x426632
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.0043b49b
jmp fcn.00428bbd

Function at 0x4160de
Capabilities:
Get disk size
Get memory capacity

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
call esi
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea eax, [esp + 8]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call esi
call esi
call fcn.004266bd
pop edi
pop esi
add esp, 0xc
jmp fcn.00426709

Function at 0x4161d8
Capabilities:
Get common file path
Get memory capacity

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.00426864
add esp, 0x24
jmp 0x4268a6
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.0043b726
jmp fcn.0042d637
Function at 0x416287
Capabilities:
Get common file path
Get memory capacity

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.004269f4
add esp, 0x14
jmp fcn.00426a27

Function at 0x4162b2
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x24
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.00426a58
add esp, 0x24
jmp 0x426aa7
sub esp, 0x24
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.00427ffd
add esp, 0x24
jmp fcn.004282fc

Function at 0x4162dd
Capabilities:
Get file attributes

Disassembly:
push ecx
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00426ac7
call fcn.00426ae2
pop ecx
ret

Function at 0x416535
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x10]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov edi, 0x498308
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00426efe
call fcn.00426f2f
pop edi
leave
ret

Function at 0x416570
Capabilities:
Get common file path

Disassembly:
push ecx
push ecx
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call fcn.00426f65
add esp, 8
jmp 0x426fa2
sub esp, 0x10
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.0042d7ca
add esp, 0x10
jmp fcn.00432836

Function at 0x416589
Capabilities:
Get common file path
Get memory capacity

Disassembly:
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call fcn.00426fd7
add esp, 0xc
jmp fcn.0042702a

Function at 0x416768
Capabilities:
Get common file path
Get file attributes

Disassembly:
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.004272f0
call fcn.00427312
pop ecx
ret
Function at 0x4167d8
Capabilities:
Get disk size
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.004273e6
add esp, 0x14
jmp 0x427433
sub esp, 0x14
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.0043c3e8
add esp, 0x14
jmp fcn.0043c429

Function at 0x416838
Capabilities:
Get common file path
Get disk size
Get memory capacity

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.004274dd
add esp, 0x24
jmp 0x427524
sub esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x64
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [esp + 8]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x64
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.0043c53f
pop edi
add esp, 0x10
jmp fcn.0043c576

Function at 0x4168aa
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.004275bd
add esp, 0x24
jmp 0x4275e4
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.0043c678
call fcn.0043c6aa
pop ecx
ret

Function at 0x416910
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call fcn.0042764c
call fcn.0042767d
leave
ret

Function at 0x4169a0
Capabilities:
Get common file path

Disassembly:
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.004276fc
jmp 0x42770c
push ebx
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x64
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x64
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.00429359
pop ebx
jmp fcn.0042858a
Function at 0x416b9b
Capabilities:
Get disk size
Get memory capacity

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call fcn.00427af1
add esp, 0xc
jmp fcn.00427b06

Function at 0x416bf5
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.00427bb2
add esp, 0x14
jmp 0x427c05
sub esp, 0x14
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.0042a463
add esp, 0x14
jmp fcn.0043ddf7

Function at 0x416c56
Capabilities:
Get common file path
Get disk size
Get memory capacity

Disassembly:
sub esp, 0x18
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call esi
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.00427c95
pop esi
add esp, 0x18
jmp fcn.00427cad

Function at 0x416cd3
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.00427d15
add esp, 0x24
jmp 0x427d34
sub esp, 0x24
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
add esp, 0x24
ret

Function at 0x416ced
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.00427d6f
call fcn.00427d8e
leave
ret

Function at 0x416dd0
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call fcn.00427ece
call fcn.00427ee4
leave
ret
Function at 0x416e23
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00427f12
call fcn.00427f3f
leave
ret

Function at 0x416e6f
Capabilities:
Get file attributes

Disassembly:
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00427f6b
jmp sub.KERNEL32.dll_GetProcessHeap

Function at 0x416ed7
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0x28
lea eax, [esp + 4]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov edi, 0x498308
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.0042800e
pop edi
add esp, 0x28
jmp fcn.0042802e

Function at 0x416f07
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0x24
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.00428051
add esp, 0x24
jmp fcn.00428082

Function at 0x416f44
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.00428093
call fcn.004280d6
leave
ret

Function at 0x416fea
Capabilities:
Get common file path
Get disk size
Get memory capacity

Disassembly:
sub esp, 0x10
push edi
xor edi, edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 8]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.004281e4
pop edi
add esp, 0x10
jmp fcn.0042822c

Function at 0x417087
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.004283d0
add esp, 0x24
jmp fcn.004283f2
Function at 0x4170b8
Capabilities:
Get common file path
Get disk size
Get memory capacity

Disassembly:
sub esp, 0x10
push esi
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [esp + 8]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call fcn.0042843e
pop esi
add esp, 0x10
jmp fcn.00428468

Function at 0x4170e8
Capabilities:
Get disk size
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 8]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.00428496
call sub.KERNEL32.dll_GetTickCount
leave
ret

Function at 0x41711e
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.004284cd
add esp, 0x14
jmp fcn.00428504

Function at 0x417143
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
lea eax, [ebp - 0x230]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00428525
call fcn.00428553
leave
ret

Function at 0x4171eb
Capabilities:
Get disk size
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 8]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.00428674
call fcn.004286c8
pop esi
leave
ret

Function at 0x417230
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.00428704
call fcn.00428743
leave
ret
Function at 0x4172fb
Capabilities:
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00427ea4
call fcn.0042885d
leave
ret

Function at 0x4173cb
Capabilities:
Get common file path

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.0042892a
jmp fcn.0042896e

Function at 0x41759e
Capabilities:
Get file attributes

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00428b88
jmp fcn.00428baf

Function at 0x4176a6
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call fcn.00428d0d
add esp, 0x24
jmp fcn.00428d38

Function at 0x4176d1
Capabilities:
Get common file path

Disassembly:
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call sub.KERNEL32.dll_GetTickCount
jmp fcn.00428d6c

Function at 0x4176e5
Capabilities:
Get common file path
Get file attributes

Disassembly:
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00428d88
call fcn.00428da1
pop ecx
ret

Function at 0x4177b0
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00428576
jmp fcn.00428f49

Function at 0x4177f7
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call fcn.00428fc1
add esp, 0x208
jmp 0x428fdc
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
ret