joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406caf
Capabilities:
Get common file path
Get disk size
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
lea eax, [ebp - 0x28]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 8]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00407ebb
call fcn.00407efc
pop esi
leave
ret

Function at 0x406cef
Capabilities:
Get file attributes

Disassembly:
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00407f3a
call fcn.00407f74
pop ecx
ret

Function at 0x406d0f
Capabilities:
Get disk size
Get memory capacity

Disassembly:
sub esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [esp + 8]
xor edi, edi
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x64
push edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call fcn.00407fc4
pop edi
add esp, 0x10
jmp fcn.00407ff5

Function at 0x406dd7
Capabilities:
Get common file path
Get memory capacity

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.00408129
add esp, 0x14
jmp fcn.00408140

Function at 0x406df1
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call fcn.00408173
add esp, 0x24
jmp fcn.004081aa
Function at 0x406e24
Capabilities:
Get common file path
Get disk size
Get file attributes

Disassembly:
sub esp, 0x10
lea eax, [esp + 4]
push esi
push eax
xor esi, esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x64
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.004081f7
pop esi
add esp, 0x10
jmp 0x408233
sub esp, 0x10
push esi
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [esp + 8]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call fcn.0040a7b5
pop esi
add esp, 0x10
jmp 0x40a7d3
sub esp, 0x20c
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.0040f5d5
add esp, 0x20c
jmp 0x40f5ff
push ecx
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00419287
call fcn.004192c8
pop ecx
ret

Function at 0x406e9d
Capabilities:
Get common file path
Get disk size
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
lea eax, [ebp - 0x10]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x218]
mov edi, 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 8]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.004082bb
call fcn.0040830a
pop edi
leave
ret

Function at 0x4070c5
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.0040864b
add esp, 0x14
jmp fcn.00408678
Function at 0x407106
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0x20c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.004086c6
add esp, 0x20c
jmp 0x4086e5
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call fcn.0040b21e
add esp, 0xc
jmp 0x40b265
push edi
xor edi, edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.004109ee
pop edi
jmp fcn.00410a47

Function at 0x4071ca
Capabilities:
Get common file path
Get file attributes

Disassembly:
sub esp, 0x14
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.00408867
add esp, 0x14
jmp 0x408898
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call fcn.0040b5c9
add esp, 0xc
jmp 0x40b622
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.004110cc
call fcn.00411106
pop ecx
ret

Function at 0x4072f8
Capabilities:
Get common file path
Get disk size

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.00408ad3
add esp, 0x20c
jmp 0x408b14
sub esp, 0x20c
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.0040baec
add esp, 0x20c
jmp 0x40bb2a
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.004119f2
add esp, 0xc
jmp fcn.00411a24

Function at 0x407330
Capabilities:
Get common file path
Get memory capacity

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.00408ba3
add esp, 0x24
jmp fcn.00408bb6
Function at 0x407368
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call fcn.00408c8a
add esp, 0x14
jmp 0x408cbc
sub esp, 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.0040be15
add esp, 0x14
jmp 0x40be49
push ecx
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.004120d5
call fcn.0041212c
pop ecx
ret

Function at 0x407468
Capabilities:
Get common file path
Get file attributes

Disassembly:
sub esp, 0x210
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call esi
call esi
call fcn.00408e3f
pop esi
add esp, 0x210
jmp 0x408e6a
sub esp, 0xc
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.0040c178
add esp, 0xc
jmp 0x40c19d
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.0041276c
call fcn.0041279d
pop ecx
ret

Function at 0x4074e2
Capabilities:
Get file attributes

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call fcn.00408f4b
add esp, 0xc
jmp 0x408f6b
push ecx
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.0040c2aa
call fcn.0040c2eb
pop ecx
ret

Function at 0x407522
Capabilities:
Get file attributes

Disassembly:
push ecx
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.00408fd8
call fcn.0040901a
pop ecx
ret
Function at 0x4075c0
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.00409107
add esp, 0x24
jmp 0x409121
sub esp, 0x20c
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.0040c69a
add esp, 0x20c
jmp 0x40c6cc
sub esp, 0x20c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.00413358
add esp, 0x20c
jmp fcn.004133a2

Function at 0x407634
Capabilities:
Get disk size

Disassembly:
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.004091b3
add esp, 0x14
jmp fcn.004091f1

Function at 0x407654
Capabilities:
Get common file path
Get disk size

Disassembly:
sub esp, 0x10
lea eax, [esp + 4]
push esi
push eax
xor esi, esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x64
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.00409221
pop esi
add esp, 0x10
jmp 0x409245
sub esp, 0xc
lea eax, [esp]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call fcn.0040c8d5
add esp, 0xc
jmp fcn.0040c928

Function at 0x40768e
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push edi
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0x40
pop edi
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00409264
call fcn.004092a5
pop edi
leave
ret
Function at 0x40774a
Capabilities:
Get common file path
Get memory capacity

Disassembly:
sub esp, 0x10
push ebx
push 0x64
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x64
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x64
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.00409388
pop ebx
add esp, 0x10
jmp fcn.004093b9

Function at 0x4077b3
Capabilities:
Get common file path
Get memory capacity

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call fcn.00409462
add esp, 0x20c
jmp fcn.004094bb

Function at 0x407806
Capabilities:
Get common file path
Get disk size
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0xc
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call fcn.004094ea
add esp, 0xc
jmp fcn.0040952b

Function at 0x4078ed
Capabilities:
Get common file path
Get disk size
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
lea eax, [ebp - 0x250]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 8]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call fcn.00409662
call fcn.00409692
leave
ret

Function at 0x40798a
Capabilities:
Get common file path
Get memory capacity

Disassembly:
sub esp, 0x18
push esi
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x64
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x64
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call fcn.00409718
pop esi
add esp, 0x18
jmp fcn.0040975b
Function at 0x4079d8
Capabilities:
Get common file path
Get memory capacity

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.0040979c
add esp, 0x24
jmp 0x4097b4
sub esp, 0xc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call fcn.0040d43b
add esp, 0xc
jmp fcn.0040d47d

Function at 0x4079f2
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.004097d8
call fcn.004097f2
leave
ret

Function at 0x407a2c
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.0040980c
call fcn.00409832
leave
ret

Function at 0x407a7f
Capabilities:
Get file attributes

Disassembly:
push ecx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
call esi
push 0
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, 0x498308
push edi
call esi
push edi
call esi
call fcn.00409875
call fcn.0040988f
pop edi
pop esi
pop ecx
ret

Function at 0x407ad5
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.0040992c
call fcn.0040995d
leave
ret

Function at 0x407b40
Capabilities:
Get common file path
Get disk size

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.00409a0d
add esp, 0x14
jmp 0x409a48
sub esp, 0x20c
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.0040dab6
add esp, 0x20c
jmp fcn.0040daf3
Function at 0x407b5a
Capabilities:
Get common file path
Get disk size
Get memory capacity

Disassembly:
sub esp, 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.00409a6d
add esp, 0x14
jmp 0x409aac
sub esp, 0xc
lea eax, [esp]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.0040dbb3
add esp, 0xc
jmp 0x40dbd0
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.00415c93
add esp, 0x24
jmp 0x415ccd
push ecx
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call fcn.00425f03
call fcn.00425f3e
pop ecx
ret

Function at 0x407b82
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0x24
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.00409ad1
add esp, 0x24
jmp 0x409b04
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.0040dc6b
call fcn.0040dcbe
pop ecx
ret

Function at 0x407c16
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00409b68
add esp, 0x14
jmp fcn.00409bb3

Function at 0x407c5a
Capabilities:
Get file attributes

Disassembly:
push ecx
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00409beb
call fcn.00409c1d
pop ecx
ret

Function at 0x407cfc
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call fcn.00409d3a
call fcn.00409d64
leave
ret
Function at 0x407d88
Capabilities:
Get file attributes

Disassembly:
push ecx
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.00409df1
call fcn.00409e39
pop ecx
ret

Function at 0x407da8
Capabilities:
Get disk size
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call fcn.00409e7a
add esp, 0xc
jmp fcn.00409ebb

Function at 0x407e06
Capabilities:
Get file attributes

Disassembly:
push ecx
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00409f60
call fcn.00409f8c
pop ecx
ret

Function at 0x407e1e
Capabilities:
Get common file path
Get disk size

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call fcn.00409fe9
add esp, 0xc
jmp fcn.0040a02f

Function at 0x407e43
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x24
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.0040a068
add esp, 0x24
jmp 0x40a07f
sub esp, 0x14
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call fcn.0040e675
add esp, 0x14
jmp fcn.0040e697

Function at 0x407efc
Capabilities:
Get common file path
Get disk size
Get memory capacity

Disassembly:
sub esp, 0x28
push esi
push 0x64
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.0040a1fd
pop esi
add esp, 0x28
jmp 0x40a22d
sub esp, 0x10
lea eax, [esp + 4]
push esi
push eax
xor esi, esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x64
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.0040e9cb
pop esi
add esp, 0x10
jmp fcn.0040ea14

Function at 0x407f3a
Capabilities:
Get disk size
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0x10
lea eax, [esp + 4]
push esi
push eax
xor esi, esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call fcn.0040a25f
pop esi
add esp, 0x10
jmp fcn.0040a2ab