joyce8/EMBER2024-capa huggingface dataset:
Function at 0x489250
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
xor esi, esi
call fcn.00487fb0
mov edi, eax
test edi, edi
je 0x4892c0
lea eax, [esp + 8]
mov dword [esp + 8], 0x65666153
push eax
push edi
mov word [esp + 0x1a], 0x6572
mov word [esp + 0x1d], 0x6574
mov dword [esp + 0x16], 0x43796172
mov word [esp + 0x14], 0x7241
mov dword [esp + 0x20], 0x6f746365
mov word [esp + 0x24], 0x72
mov byte [esp + 0x1f], 0x56
mov byte [esp + 0x1c], 0x61
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4892b9
push 1
push esi
push 0xc
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
add esp, 0x18
ret

Function at 0x4892d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, ecx
call fcn.00488000
mov esi, eax
test esi, esi
je 0x489338
lea eax, [esp + 8]
mov dword [esp + 0xe], 0x65766f6d
push eax
push esi
mov dword [esp + 0x10], 0x68746150
mov dword [esp + 0x1a], 0x65747845
mov word [esp + 0x1f], 0x6973
mov word [esp + 0x22], 0x576e
mov byte [esp + 0x24], 0
mov word [esp + 0x14], 0x6552
mov byte [esp + 0x21], 0x6f
mov byte [esp + 0x1e], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x489331
push edi
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
add esp, 0x18
ret

Function at 0x4893a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
push edi
xor esi, esi
call fcn.00488000
mov edi, eax
test edi, edi
je 0x489405
lea eax, [esp + 8]
mov dword [esp + 0xe], 0x6e4f646e
push eax
push edi
mov dword [esp + 0x11], 0x46687461
mov word [esp + 0x1b], 0x7461
mov word [esp + 0x1e], 0x57
mov byte [esp + 0x10], 0x50
mov byte [esp + 0x15], 0x69
mov byte [esp + 0x1a], 0x50
mov byte [esp + 0x1d], 0x68
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4893fe
push esi
push 0x6a48f8
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x489410
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
mov ebx, edx
xor esi, esi
call fcn.00488050
mov edi, eax
test edi, edi
je 0x489498
lea eax, [esp + 0xc]
mov word [esp + 0x1e], 0x6150
push eax
push edi
mov word [esp + 0x17], 0x7465
mov word [esp + 0x29], 0x5768
mov word [esp + 0x14], 0x4853
mov dword [esp + 0x1a], 0x69636570
mov byte [esp + 0x2b], 0
mov byte [esp + 0x19], 0x53
mov word [esp + 0x1e], 0x6c61
mov dword [esp + 0x21], 0x65646c6f
mov byte [esp + 0x25], 0x72
mov byte [esp + 0x28], 0x74
mov byte [esp + 0x20], 0x46
mov byte [esp + 0x16], 0x47
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x489491
push esi
push dword [esp + 0x2c]
push ebx
push esi
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x4894b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00488050
mov edi, eax
test edi, edi
je 0x489510
lea eax, [esp + 0xc]
mov word [esp + 0x14], 0x7563
push eax
push edi
mov word [esp + 0x1f], 0x4565
mov dword [esp + 0x14], 0x6c656853
mov dword [esp + 0x18], 0x6578456c
mov byte [esp + 0x1e], 0x74
mov word [esp + 0x22], 0x57
mov byte [esp + 0x21], 0x78
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x489509
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x489520
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.004880a0
mov edi, eax
test edi, edi
je 0x48957f
lea eax, [esp + 0xc]
mov dword [esp + 0x18], 0x57656372
push eax
push edi
mov dword [esp + 0x17], 0x746e6f46
mov word [esp + 0x14], 0x6441
mov dword [esp + 0x1c], 0x756f7365
mov byte [esp + 0x1b], 0x52
mov byte [esp + 0x24], 0
mov byte [esp + 0x16], 0x64
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x489578
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x489590
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.004880f0
mov edi, eax
test edi, edi
je 0x489622
lea eax, [esp + 0x10]
mov dword [esp + 0x16], 0x74697275
push eax
push edi
mov dword [esp + 0x1a], 0x63655374
mov word [esp + 0x2c], 0x4472
mov word [esp + 0x24], 0x7365
mov word [esp + 0x2f], 0x6c63
mov byte [esp + 0x31], 0
mov word [esp + 0x2a], 0x6f74
mov word [esp + 0x18], 0x6547
mov word [esp + 0x27], 0x6972
mov word [esp + 0x22], 0x4479
mov byte [esp + 0x29], 0x70
mov byte [esp + 0x2e], 0x61
mov byte [esp + 0x26], 0x63
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48961b
push dword [esp + 0x34]
push dword [esp + 0x34]
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret

Function at 0x489630
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.004880f0
mov edi, eax
test edi, edi
je 0x4896ab
lea eax, [esp + 0x10]
mov dword [esp + 0x18], 0x6e697274
push eax
push edi
mov dword [esp + 0x25], 0x54646953
mov word [esp + 0x2c], 0x5764
mov byte [esp + 0x2e], 0
mov dword [esp + 0x1b], 0x74726576
mov word [esp + 0x29], 0x536f
mov word [esp + 0x18], 0x6f43
mov byte [esp + 0x1f], 0x53
mov byte [esp + 0x2b], 0x69
mov byte [esp + 0x24], 0x67
mov byte [esp + 0x1a], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4896a4
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x4896c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
lea eax, [esp]
mov dword [esp + 3], 0x54657461
push eax
mov dword [esp + 0x16], 0x68737061
mov dword [esp + 0xe], 0x706c6568
mov word [esp + 0xc], 0x6c6f
mov dword [esp + 0x12], 0x6e533233
mov word [esp + 0x1a], 0x746f
mov word [esp + 4], 0x7243
mov byte [esp + 0x1c], 0
mov byte [esp + 0xb], 0x6f
mov byte [esp + 6], 0x65
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x489725
push 0
push 2
call eax
add esp, 0x1c
ret
or eax, 0xffffffff
add esp, 0x1c
ret

Function at 0x489730
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
push edi
lea eax, [esp + 8]
mov word [esp + 8], 0x7250
push eax
mov esi, edx
mov dword [esp + 0xf], 0x73736563
mov edi, ecx
mov word [esp + 0x17], 0x7372
mov word [esp + 0x1a], 0x57
mov dword [esp + 0x13], 0x69463233
mov byte [esp + 0xe], 0x6f
mov byte [esp + 0x19], 0x74
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x489787
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x10
ret
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret

Function at 0x489790
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 0x10], 0x78654e32
push eax
mov esi, edx
mov dword [esp + 0xc], 0x636f7250
mov edi, ecx
mov word [esp + 0x19], 0x57
mov word [esp + 0x11], 0x7373
mov byte [esp + 0x10], 0x65
mov byte [esp + 0x18], 0x74
mov byte [esp + 0x13], 0x33
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4897e5
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x10
ret
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret

Function at 0x4897f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
mov esi, 0x80070057
call fcn.00487fb0
mov edi, eax
test edi, edi
je 0x489868
lea eax, [esp + 0xc]
mov word [esp + 0x10], 0x7241
push eax
push edi
mov dword [esp + 0x23], 0x646e75
mov dword [esp + 0x1e], 0x424c7465
mov word [esp + 0x15], 0x6661
mov byte [esp + 0x14], 0x53
mov word [esp + 0x1b], 0x7961
mov byte [esp + 0x22], 0x6f
mov byte [esp + 0x1d], 0x47
mov byte [esp + 0x1a], 0x72
mov byte [esp + 0x17], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x489861
push dword [esp + 0x24]
push 1
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x489880
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
mov esi, 0x80070057
call fcn.00487fb0
mov edi, eax
test edi, edi
je 0x4898ef
lea eax, [esp + 0xc]
mov dword [esp + 0x1b], 0x646e75
push eax
push edi
mov dword [esp + 0x14], 0x65666153
mov dword [esp + 0x19], 0x79617272
mov byte [esp + 0x18], 0x41
mov word [esp + 0x1e], 0x7465
mov word [esp + 0x21], 0x6f42
mov byte [esp + 0x1d], 0x47
mov byte [esp + 0x20], 0x55
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4898e8
push dword [esp + 0x24]
push 1
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x489900
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
mov esi, 0x80070057
call fcn.00487fb0
mov edi, eax
test edi, edi
je 0x489969
lea eax, [esp + 0x10]
mov word [esp + 0x15], 0x7272
push eax
push edi
mov dword [esp + 0x19], 0x41656661
mov dword [esp + 0x20], 0x63634179
mov dword [esp + 0x28], 0x617461
mov dword [esp + 0x24], 0x44737365
mov byte [esp + 0x18], 0x53
mov byte [esp + 0x1f], 0x61
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x489962
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x489980
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
mov ebx, ecx
mov esi, 0x80070057
call fcn.00487fb0
mov edi, eax
test edi, edi
je 0x4899f5
lea eax, [esp + 0xc]
mov word [esp + 0x1c], 0x4473
push eax
push edi
mov word [esp + 0x27], 0x6174
mov dword [esp + 0x15], 0x41656661
mov byte [esp + 0x26], 0x61
mov dword [esp + 0x20], 0x73656363
mov dword [esp + 0x19], 0x79617272
mov byte [esp + 0x29], 0
mov word [esp + 0x1e], 0x616e
mov byte [esp + 0x1d], 0x55
mov byte [esp + 0x14], 0x53
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4899ee
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x18
ret

Function at 0x489a00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00487f00
mov edi, eax
test edi, edi
je 0x489a80
lea eax, [esp + 0xc]
mov word [esp + 0xc], 0x6553
push eax
push edi
mov dword [esp + 0x1b], 0x74736544
mov dword [esp + 0x20], 0x6544796f
mov dword [esp + 0x17], 0x69447075
mov word [esp + 0x2a], 0x6f66
mov dword [esp + 0x25], 0x49656369
mov dword [esp + 0x2d], 0x747369
mov byte [esp + 0x29], 0x6e
mov byte [esp + 0x16], 0x74
mov byte [esp + 0x2c], 0x4c
mov byte [esp + 0x1f], 0x72
mov byte [esp + 0x24], 0x76
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x489a79
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x489a90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00487f00
mov edi, eax
test edi, edi
je 0x489b05
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x75746553
push eax
push edi
mov dword [esp + 0x21], 0x65446e65
mov dword [esp + 0x25], 0x67655276
mov word [esp + 0x2a], 0x7965
mov dword [esp + 0x1d], 0x704f6944
mov byte [esp + 0x2c], 0
mov byte [esp + 0x29], 0x4b
mov byte [esp + 0x1c], 0x70
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x489afe
push 0x20019
push 2
push esi
push 1
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x489b10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
mov edi, 1
call fcn.004880f0
mov esi, eax
test esi, esi
je 0x489ba0
lea eax, [esp + 0x10]
mov word [esp + 0x14], 0x6575
push eax
push esi
mov word [esp + 0x19], 0x6765
mov dword [esp + 0x25], 0x577965
mov dword [esp + 0x1f], 0x666e4979
mov byte [esp + 0x18], 0x52
mov byte [esp + 0x1e], 0x72
mov word [esp + 0x23], 0x4b6f
mov byte [esp + 0x1b], 0x51
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x489b99
push 0
push dword [esp + 0x4c]
push dword [esp + 0x4c]
push dword [esp + 0x4c]
push dword [esp + 0x4c]
push dword [esp + 0x4c]
push dword [esp + 0x4c]
push dword [esp + 0x4c]
push 0
push dword [esp + 0x4c]
push ebx
push ebp
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x489bb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
push edi
mov esi, 1
call fcn.004880f0
mov edi, eax
test edi, edi
je 0x489c16
lea eax, [esp + 8]
mov dword [esp + 0xb], 0x61657243
push eax
push edi
mov dword [esp + 0x19], 0x5779654b
mov word [esp + 0x11], 0x6765
mov byte [esp + 0x1d], 0
mov word [esp + 0x17], 0x6574
mov byte [esp + 0x10], 0x52
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x489c0f
push dword [esp + 0x1c]
push str.SoftwareAPCTab
push SysReAllocString
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x489c20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
mov esi, 0x80004005
call fcn.00488000
mov edi, eax
test edi, edi
je 0x489c7d
lea eax, [esp + 0x10]
mov dword [esp + 0x15], 0x65706163
push eax
push edi
mov dword [esp + 0x18], 0x456c7255
mov word [esp + 0x21], 0x57
mov byte [esp + 0x1c], 0x73
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x489c76
push 0x2000
push dword [esp + 0x24]
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x489c90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 0x1e], 0x577367
push eax
mov esi, edx
mov word [esp + 0x1b], 0x746e
mov edi, ecx
mov dword [esp + 0x16], 0x6d6e6f72
mov dword [esp + 0xc], 0x61707845
mov dword [esp + 0x1e], 0x6e697274
mov dword [esp + 0x10], 0x6e45646e
mov word [esp + 0x14], 0x6976
mov byte [esp + 0x1a], 0x65
mov byte [esp + 0x1d], 0x53
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x489cfc
push dword [esp + 0x28]
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x1c
ret
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret

Function at 0x489d10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00487f00
mov edi, eax
test edi, edi
je 0x489d98
lea eax, [esp + 0x10]
mov word [esp + 0x1d], 0x7373
push eax
push edi
mov dword [esp + 0x1a], 0x44707574
mov word [esp + 0x2e], 0x6974
mov dword [esp + 0x20], 0x6c437465
mov dword [esp + 0x30], 0x576e6f
mov dword [esp + 0x27], 0x63736544
mov word [esp + 0x1e], 0x4769
mov word [esp + 0x18], 0x6553
mov word [esp + 0x2b], 0x6972
mov byte [esp + 0x2d], 0x70
mov byte [esp + 0x24], 0x61
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x489d91
push esi
push 0x800
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret

Function at 0x489e10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, edx
mov esi, 1
call fcn.00488000
mov edi, eax
test edi, edi
je 0x489e6f
lea eax, [esp + 0xc]
mov word [esp + 0x16], 0x5779
push eax
push edi
mov dword [esp + 0x14], 0x65444853
mov dword [esp + 0x19], 0x4b657465
mov byte [esp + 0x20], 0
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x18], 0x6c
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x489e68
push ebx
push SysReAllocString
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x489e80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.004880f0
mov edi, eax
test edi, edi
je 0x489ef2
lea eax, [esp + 0x10]
mov dword [esp + 0x1b], 0x63736544
push eax
push edi
mov dword [esp + 0x19], 0x65537465
mov dword [esp + 0x2f], 0x70756f
mov dword [esp + 0x1d], 0x69727563
mov dword [esp + 0x27], 0x74706972
mov dword [esp + 0x2b], 0x7247726f
mov byte [esp + 0x18], 0x53
mov word [esp + 0x21], 0x7974
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x489eeb
push esi
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x489f00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
mov esi, 0x80004005
call fcn.00487fb0
mov edi, eax
test edi, edi
je 0x489f6a
lea eax, [esp + 0x10]
mov dword [esp + 0x1a], 0x65727574
push eax
push edi
mov dword [esp + 0x19], 0x6f4c656c
mov dword [esp + 0x1e], 0x63695064
mov byte [esp + 0x18], 0x4f
mov byte [esp + 0x26], 0
mov byte [esp + 0x1d], 0x61
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x489f63
push dword [esp + 0x2c]
push 0x64fb44
push 0
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x489f80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.004881a0
mov edi, eax
test edi, edi
je 0x489ff5
lea eax, [esp + 0xc]
mov dword [esp + 0x11], 0x614e7465
push eax
push edi
mov dword [esp + 0x15], 0x47747265
mov dword [esp + 0x20], 0x6e697274
mov word [esp + 0x1d], 0x656d
mov word [esp + 0x25], 0x57
mov byte [esp + 0x1f], 0x53
mov byte [esp + 0x24], 0x67
mov byte [esp + 0x14], 0x43
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x489fee
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push esi
push 2
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x48a000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
push edi
xor esi, esi
call fcn.004881a0
mov edi, eax
test edi, edi
je 0x48a062
lea eax, [esp + 8]
mov dword [esp + 0xe], 0x74536e65
push eax
push edi
mov word [esp + 0x14], 0x704f
mov dword [esp + 0x1a], 0x65726f
mov word [esp + 0x11], 0x7265
mov byte [esp + 0x10], 0x43
mov byte [esp + 0x13], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48a05b
push dword [esp + 0x24]
push esi
push esi
push 0x10001
push 5
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x48a070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.004881a0
mov edi, eax
test edi, edi
je 0x48a10d
lea eax, [esp + 0xc]
mov word [esp + 0xd], 0x7265
push eax
push edi
mov dword [esp + 0x1d], 0x69747265
mov word [esp + 0x2c], 0x6572
mov word [esp + 0x1b], 0x4364
mov dword [esp + 0x21], 0x61636966
mov dword [esp + 0x25], 0x6e496574
mov word [esp + 0x18], 0x6946
mov byte [esp + 0x17], 0x74
mov word [esp + 0x29], 0x7453
mov byte [esp + 0x2b], 0x6f
mov byte [esp + 0x1a], 0x6e
mov byte [esp + 0x14], 0x43
mov byte [esp + 0x2e], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48a106
push dword [esp + 0x38]
push dword [esp + 0x38]
push 0xa0000
push 2
push 0x10001
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x48a120
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.004881a0
mov edi, eax
test edi, edi
je 0x48a180
lea eax, [esp + 0xc]
mov dword [esp + 0x13], 0x74536573
push eax
push edi
mov dword [esp + 0x16], 0x6c437472
mov word [esp + 0x20], 0x6572
mov word [esp + 0x14], 0x6543
mov byte [esp + 0x22], 0
mov byte [esp + 0x1a], 0x6f
mov byte [esp + 0x1f], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48a179
push 1
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x48a190
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00488000
mov edi, eax
test edi, edi
je 0x48a1e1
lea eax, [esp + 0xc]
mov dword [esp + 0xf], 0x6e496f54
push eax
push edi
mov word [esp + 0x1c], 0x57
mov word [esp + 0x14], 0x7453
mov byte [esp + 0x1b], 0x74
mov byte [esp + 0x16], 0x72
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48a1da
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x48a1f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00487f00
mov edi, eax
test edi, edi
je 0x48a274
lea eax, [esp + 0x10]
mov dword [esp + 0x1f], 0x6f724665
push eax
push edi
mov word [esp + 0x20], 0x616c
mov dword [esp + 0x2e], 0x576469
mov word [esp + 0x2b], 0x476d
mov word [esp + 0x1d], 0x6944
mov dword [esp + 0x18], 0x75746553
mov dword [esp + 0x22], 0x614e7373
mov byte [esp + 0x26], 0x6d
mov byte [esp + 0x1c], 0x70
mov byte [esp + 0x2d], 0x75
mov byte [esp + 0x1f], 0x43
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48a26d
push esi
push 0x400
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret

Function at 0x48a280
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
push ebx
push esi
push edi
mov ebx, edx
mov esi, 0x80004005
call fcn.00488050
mov edi, eax
test edi, edi
je 0x48a2ff
lea eax, [esp + 0xc]
mov dword [esp + 0x1a], 0x7265646c
push eax
push edi
mov dword [esp + 0x1e], 0x6f466c61
mov dword [esp + 0x15], 0x74654748
mov dword [esp + 0x19], 0x63657053
mov dword [esp + 0x2b], 0x6e6f69
mov byte [esp + 0x14], 0x53
mov word [esp + 0x29], 0x7461
mov word [esp + 0x26], 0x6f4c
mov byte [esp + 0x28], 0x63
mov byte [esp + 0x1d], 0x69
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48a2f8
push dword [esp + 0x2c]
push ebx
push 0
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x1c
ret