joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41363a
Capabilities:
Get common file path
Get disk size

Disassembly:
sub esp, 0x208
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.00421478
add esp, 0x208
jmp 0x4214a4
sub esp, 0x10
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.004350a2
add esp, 0x10
jmp fcn.004350d3

Function at 0x4136c6
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.0042153c
call fcn.00421571
leave
ret

Function at 0x4137f5
Capabilities:
Get common file path
Get disk size
Get file attributes

Disassembly:
sub esp, 0x10
push esi
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x64
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 8]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.00421785
pop esi
add esp, 0x10
jmp 0x4217aa
push ecx
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.00435385
call fcn.004353b6
pop ecx
ret

Function at 0x4138fe
Capabilities:
Get common file path
Get file attributes

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.004218f3
add esp, 0x20c
jmp fcn.00421935

Function at 0x41395c
Capabilities:
Get common file path
Get memory capacity

Disassembly:
push esi
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x64
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.004219bd
pop esi
jmp 0x4219e2
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call sub.KERNEL32.dll_GetTickCount
add esp, 0x10
jmp 0x42e833
sub esp, 0x20
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
add esp, 0x20
ret
Function at 0x413989
Capabilities:
Get common file path
Get memory capacity

Disassembly:
sub esp, 0x24
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.00421a2c
add esp, 0x24
jmp 0x421a8d
push esi
push 0x64
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call fcn.004356ae
pop esi
jmp 0x4356d6
sub esp, 0x208
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
add esp, 0x208
ret

Function at 0x4139c1
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.00421ac0
add esp, 0xc
jmp fcn.00421b0b

Function at 0x4139f8
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
lea eax, [ebp - 0x258]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.00421b4c
call fcn.00421b85
leave
ret

Function at 0x413ad4
Capabilities:
Get disk size
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0xc
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call fcn.00421cca
add esp, 0xc
jmp fcn.00421ce5
Function at 0x413b77
Capabilities:
Get common file path

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call fcn.00421df0
jmp 0x421e13
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.00429359
jmp 0x435a40
sub esp, 0x10
push edi
xor edi, edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x64
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
pop edi
add esp, 0x10
ret

Function at 0x413b9a
Capabilities:
Get common file path
Get disk size
Get file attributes

Disassembly:
sub esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call fcn.00421e2b
add esp, 0xc
jmp 0x421e71
push ecx
push ecx
push esi
lea eax, [esp + 4]
xor esi, esi
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.00435aa7
pop esi
add esp, 8
jmp fcn.00435ae0

Function at 0x413bbc
Capabilities:
Get common file path
Get disk size
Get file attributes

Disassembly:
sub esp, 0xc
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call fcn.00421e9a
add esp, 0xc
jmp 0x421ede
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.00427ea4
call fcn.00427d8e
pop ecx
ret

Function at 0x413c27
Capabilities:
Get common file path
Get memory capacity

Disassembly:
sub esp, 0x24
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.00421f76
add esp, 0x24
jmp fcn.00421fb1

Function at 0x413cfd
Capabilities:
Get common file path
Get disk size
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push esi
lea eax, [ebp - 8]
xor esi, esi
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x250]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0x64
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call fcn.00422110
call fcn.0042216e
pop esi
leave
ret
Function at 0x413d61
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0x24c
push ebx
push ebp
mov ebp, 0x498308
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp + 0x48]
mov ebx, 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 8]
mov dword [esp + 8], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
lea eax, [esp + 0x48]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.004221a9
pop ebp
pop ebx
add esp, 0x24c
jmp 0x4221ed
push ecx
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.00428f8b
call fcn.00435e50
pop ecx
ret

Function at 0x413e6f
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call fcn.00422347
add esp, 0x10
jmp fcn.00422365

Function at 0x413eaa
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
lea eax, [ebp - 0x20]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
lea eax, [ebp - 0x228]
mov edi, 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x228]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.004223a2
call fcn.004223c0
pop edi
leave
ret

Function at 0x413f01
Capabilities:
Get common file path
Get memory capacity

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.004223f4
add esp, 0x14
jmp 0x422438
sub esp, 0x14
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.00436197
add esp, 0x14
jmp fcn.004361c5

Function at 0x413f83
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call fcn.004224e1
add esp, 0xc
jmp fcn.004224f4

Function at 0x413f9d
Capabilities:
Get disk size
Get memory capacity

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call fcn.00422517
add esp, 0xc
jmp fcn.00422552
Function at 0x414089
Capabilities:
Get disk size
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
lea eax, [ebp - 8]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call fcn.00422742
call fcn.00422773
pop esi
leave
ret

Function at 0x4140d2
Capabilities:
Get disk size
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0x10
push esi
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp + 8]
xor esi, esi
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x64
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.004227b6
pop esi
add esp, 0x10
jmp fcn.004227f7

Function at 0x414115
Capabilities:
Get common file path

Disassembly:
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor ebx, ebx
push ebx
call edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push ebx
call edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push ebx
call edi
call fcn.0042284a
pop edi
pop ebx
jmp 0x42285e
sub esp, 0x208
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.004367d2
add esp, 0x208
jmp 0x4367f1
sub esp, 0x208
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
add esp, 0x208
ret

Function at 0x414183
Capabilities:
Get disk size
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0x64
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 8]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call fcn.00422914
call fcn.00422932
pop esi
leave
ret
Function at 0x414217
Capabilities:
Get file attributes

Disassembly:
push ecx
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.00422a7d
call fcn.00422a95
pop ecx
ret

Function at 0x414310
Capabilities:
Get file attributes

Disassembly:
push ecx
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call fcn.00422c21
call fcn.00422c5c
pop ecx
ret

Function at 0x41436a
Capabilities:
Get common file path
Get disk size
Get memory capacity

Disassembly:
sub esp, 0x10
push esi
push 0x64
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [esp + 8]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x64
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call fcn.00422ceb
pop esi
add esp, 0x10
jmp fcn.00422d10

Function at 0x414457
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call fcn.00422e7e
jmp 0x422ea1
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call fcn.00427ffd
jmp fcn.00436ee9

Function at 0x41450a
Capabilities:
Get common file path
Get disk size

Disassembly:
sub esp, 0x10
push esi
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 8]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call fcn.00423000
pop esi
add esp, 0x10
jmp 0x42303e
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.004370e1
add esp, 0x10
jmp fcn.00428bbd
Function at 0x414534
Capabilities:
Get common file path
Get file attributes

Disassembly:
push ecx
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call fcn.0042306f
add esp, 8
jmp 0x423092
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call fcn.0042b58e
jmp 0x437135
push ecx
push ecx
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
add esp, 8
jmp dword [sym.imp.KERNEL32.dll_GetTickCount]

Function at 0x414589
Capabilities:
Get common file path
Get memory capacity

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.00423129
add esp, 0x24
jmp 0x423172
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.0043722d
add esp, 0x10
jmp fcn.00437263

Function at 0x414650
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0xc
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call fcn.004232a1
add esp, 0xc
jmp fcn.004232f8

Function at 0x4146a8
Capabilities:
Get common file path
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
push esi
push edi
lea eax, [ebp - 0x248]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
lea eax, [ebp - 0x40]
push 0x40
pop edi
push eax
mov dword [ebp - 0x40], edi
call esi
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], edi
push eax
call esi
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], edi
push eax
call esi
call fcn.004233da
call fcn.0042341d
pop edi
pop esi
leave
ret

Function at 0x414747
Capabilities:
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
call fcn.0042349e
call fcn.004234c2
leave
ret
Function at 0x4147cd
Capabilities:
Get disk size
Get file attributes
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x64
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
lea eax, [ebp - 8]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call fcn.0042357d
call fcn.004235b5
pop esi
leave
ret

Function at 0x41483f
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.00423643
add esp, 0x14
jmp fcn.00423666

Function at 0x4148bb
Capabilities:
Get common file path
Get memory capacity

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.00423717
add esp, 0x24
jmp fcn.0042373b

Function at 0x41491e
Capabilities:
Get common file path
Get disk size
Get file attributes
Get memory capacity

Disassembly:
sub esp, 0x10
lea eax, [esp + 4]
push esi
push eax
xor esi, esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x64
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.00423808
pop esi
add esp, 0x10
jmp 0x42384e
sub esp, 0x10
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call fcn.00428aee
add esp, 0x10
jmp 0x437ac4
sub esp, 0x20
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0x498308
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
add esp, 0x20
jmp dword [sym.imp.KERNEL32.dll_GetProcessHeap]