joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422054
Capabilities:
Get common file path
Get memory capacity

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call fcn.0042b1d3
add esp, 0x20c
jmp fcn.00435852

Function at 0x4220a0
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.00435c83
call fcn.00435cc0
leave
ret

Function at 0x422110
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
lea eax, [ebp - 0x228]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00435d2b
call fcn.00428bbd
leave
ret

Function at 0x42216e
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call fcn.00435d66
call fcn.00435da2
leave
ret

Function at 0x4222af
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x24
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call fcn.00435f26
add esp, 0x24
jmp fcn.00427d8e

Function at 0x4222e0
Capabilities:
Get disk size

Disassembly:
push ecx
push ecx
lea eax, [esp]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call fcn.00427d03
add esp, 8
jmp 0x435f52
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
ret
Function at 0x422347
Capabilities:
Get disk size

Disassembly:
push ecx
push ecx
lea eax, [esp]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call fcn.004280d6
add esp, 8
jmp fcn.00427ffd

Function at 0x4223a2
Capabilities:
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.0043601f
call fcn.00436066
pop ecx
ret

Function at 0x422452
Capabilities:
Get common file path
Get file attributes

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.004361f2
add esp, 0x20c
jmp fcn.00436219

Function at 0x42264a
Capabilities:
Get file attributes

Disassembly:
push ecx
push ecx
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call fcn.004364bb
add esp, 8
jmp 0x4364ea
push ecx
push ecx
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
pop ecx
pop ecx
ret

Function at 0x42266e
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x230]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call fcn.0042c72e
call fcn.00436515
leave
ret

Function at 0x4226e4
Capabilities:
Get disk size
Get file attributes

Disassembly:
push ecx
push ecx
lea eax, [esp]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.0043658d
add esp, 8
jmp fcn.004365d8

Function at 0x422742
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.00436634
add esp, 0x20c
jmp fcn.00436677
Function at 0x42289b
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.0043682f
call fcn.00436860
leave
ret

Function at 0x422914
Capabilities:
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00428d6c
call fcn.004368c7
pop ecx
ret

Function at 0x422932
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x10
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.0043691b
add esp, 0x10
jmp 0x436937
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp dword [sym.imp.KERNEL32.dll_GetTickCount]

Function at 0x4229a9
Capabilities:
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00429b7b
call fcn.0042b710
leave
ret

Function at 0x4229f5
Capabilities:
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
lea eax, [ebp - 0x10]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov edi, 0x498308
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.004369ba
call fcn.004369fa
pop edi
leave
ret

Function at 0x422a7d
Capabilities:
Get file attributes

Disassembly:
push ecx
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00436a57
call fcn.00436a9f
pop ecx
ret

Function at 0x422b24
Capabilities:
Get file attributes

Disassembly:
push ecx
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.0042bf4e
call fcn.00436b65
pop ecx
ret
Function at 0x422c07
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.00436caa
add esp, 0x24
jmp fcn.0042e1ca

Function at 0x422c5c
Capabilities:
Get common file path
Get disk size

Disassembly:
sub esp, 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.00436cd1
add esp, 0x10
jmp fcn.00436d06

Function at 0x422caf
Capabilities:
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.004365d8
call fcn.0042858a
leave
ret

Function at 0x422ceb
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.00428553
add esp, 0x20c
jmp 0x436d6e
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
ret

Function at 0x422d47
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call fcn.00428bbd
call fcn.00436dd4
leave
ret

Function at 0x422d87
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
call fcn.0042f0ae
call fcn.00428082
leave
ret

Function at 0x422e1d
Capabilities:
Get file attributes

Disassembly:
push ecx
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.0042fb8c
call fcn.00436e2d
pop ecx
ret

Function at 0x422ef5
Capabilities:
Get common file path
Get file attributes

Disassembly:
push ecx
push ecx
push edi
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.00436f4a
pop edi
add esp, 8
jmp fcn.004280d6
Function at 0x422f77
Capabilities:
Get common file path
Get disk size
Get file attributes

Disassembly:
push edi
mov edi, 0x498308
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.00436f9c
pop edi
jmp fcn.00436feb

Function at 0x42306f
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
push ecx
push ecx
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.00430431
add esp, 8
jmp fcn.0043710b

Function at 0x4230c4
Capabilities:
Get disk size
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 8]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call fcn.0043715b
call fcn.00437179
leave
ret

Function at 0x423129
Capabilities:
Get common file path
Get disk size
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0x20c
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.004371c5
add esp, 0x20c
jmp fcn.004371ff

Function at 0x4231be
Capabilities:
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.00428bbd
call fcn.004372cc
leave
ret

Function at 0x4231fa
Capabilities:
Get memory capacity

Disassembly:
push ecx
push ecx
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.004372f2
add esp, 8
jmp fcn.0042b58e

Function at 0x423270
Capabilities:
Get common file path
Get file attributes

Disassembly:
sub esp, 0x10
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.004373e4
add esp, 0x10
jmp 0x437423
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
ret
Function at 0x4232a1
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
lea eax, [ebp - 0x250]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.0043744a
call fcn.0043747f
leave
ret

Function at 0x423453
Capabilities:
Get file attributes

Disassembly:
push ecx
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00437613
call fcn.004298cf
pop ecx
ret

Function at 0x423484
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.004306b7
add esp, 0x24
jmp fcn.00428901

Function at 0x42349e
Capabilities:
Get file attributes

Disassembly:
push ecx
push ecx
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00428bbd
add esp, 8
jmp fcn.0042a454

Function at 0x42360a
Capabilities:
Get common file path
Get disk size
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0x14
lea eax, [esp]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, 0x498308
push edi
call esi
push edi
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
call esi
call fcn.004367d2
pop edi
pop esi
add esp, 0x14
jmp fcn.0043777a

Function at 0x4236e6
Capabilities:
Get disk size
Get memory capacity

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.00431a75
add esp, 0x14
jmp fcn.0043798e

Function at 0x423808
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
lea eax, [ebp - 0x228]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00427d03
call fcn.00437a7b
leave
ret
Function at 0x4238f4
Capabilities:
Get common file path
Get memory capacity

Disassembly:
push ecx
push ecx
push ebx
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x64
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x64
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.00437bc7
pop ebx
add esp, 8
jmp fcn.00437c03

Function at 0x423a20
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 0x230]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00437014
call fcn.00437c95
leave
ret

Function at 0x423abf
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
lea eax, [ebp - 0x230]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.00437cce
call fcn.00437d0d
leave
ret

Function at 0x423b0d
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push edi
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xor edi, edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x64
push edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call fcn.00428901
call fcn.00427d8e
pop edi
leave
ret

Function at 0x423bba
Capabilities:
Get file attributes

Disassembly:
push ecx
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00437d5e
call fcn.00437d89
pop ecx
ret

Function at 0x423bd2
Capabilities:
Get common file path
Get disk size
Get file attributes

Disassembly:
sub esp, 0x14
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.00437db5
add esp, 0x14
jmp fcn.00437df0
Function at 0x423bf6
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
push edi
mov edi, 0x498308
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.004282fc
pop edi
jmp 0x437e35
sub esp, 0x24
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
add esp, 0x24
ret

Function at 0x423c23
Capabilities:
Get file attributes

Disassembly:
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call fcn.0042c649
jmp sub.KERNEL32.dll_GetTickCount

Function at 0x423c82
Capabilities:
Get common file path
Get file attributes

Disassembly:
push ecx
push ecx
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.00428aee
add esp, 8
jmp fcn.00437ee1

Function at 0x423d58
Capabilities:
Get disk size

Disassembly:
sub esp, 0x10
lea eax, [esp + 4]
push esi
push eax
xor esi, esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x64
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.00437fa5
pop esi
add esp, 0x10
jmp fcn.00429359

Function at 0x423de5
Capabilities:
Get common file path
Get memory capacity

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.00438079
add esp, 0x20c
jmp fcn.0042e0ca

Function at 0x423e10
Capabilities:
Get file attributes

Disassembly:
push ecx
push ecx
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call fcn.004380cc
add esp, 8
jmp fcn.00438102

Function at 0x423e3a
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.0043812f
add esp, 0x10
jmp fcn.00428f8b