joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48c3f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
push esi
lea eax, [esp + 4]
mov word [esp + 0x1b], 0x7463
push eax
mov esi, ecx
mov dword [esp + 0xc], 0x666e4979
mov dword [esp + 0x11], 0x74616d72
mov dword [esp + 0x18], 0x4f626f4a
mov dword [esp + 8], 0x72657551
mov word [esp + 0x15], 0x6f69
mov byte [esp + 0x10], 0x6f
mov byte [esp + 0x21], 0
mov word [esp + 0x1c], 0x6a62
mov byte [esp + 0x17], 0x6e
mov byte [esp + 0x1e], 0x65
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48c469
push 0
push 0x2710
push dword [esp + 0x2c]
push 3
push esi
call eax
pop esi
add esp, 0x1c
ret
xor eax, eax
pop esi
add esp, 0x1c
ret

Function at 0x48c470
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
push esi
lea eax, [esp + 4]
mov word [esp + 0xe], 0x73
push eax
mov esi, ecx
mov dword [esp + 9], 0x506e6570
mov dword [esp + 0xd], 0x65636f72
mov byte [esp + 8], 0x4f
mov byte [esp + 0x11], 0x73
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48c4ba
push dword [esp + 0x14]
push 0
push esi
call eax
pop esi
add esp, 0xc
ret
xor eax, eax
pop esi
add esp, 0xc
ret

Function at 0x48c4d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
mov ebx, ecx
mov esi, 0x80004005
call fcn.004883e0
mov edi, eax
test edi, edi
je 0x48c553
lea eax, [esp + 0xc]
mov dword [esp + 0x11], 0x6c616974
push eax
push edi
mov word [esp + 0x1d], 0x7a69
mov dword [esp + 0x15], 0x696e496f
mov dword [esp + 0x25], 0x797469
mov word [esp + 0x20], 0x6553
mov byte [esp + 0x14], 0x43
mov word [esp + 0x23], 0x7275
mov byte [esp + 0x22], 0x63
mov byte [esp + 0x1f], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48c54c
push 0
push 0x3000
push 0
push 2
push 6
push 0
push 0
push 0xffffffffffffffff
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x18
ret

Function at 0x48c560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.004880f0
mov edi, eax
test edi, edi
je 0x48c5be
lea eax, [esp + 0x10]
mov dword [esp + 0x1c], 0x6e656b6f
push eax
push edi
mov dword [esp + 0x18], 0x6e65704f
mov dword [esp + 0x20], 0x54737365
mov dword [esp + 0x1c], 0x636f7250
mov byte [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48c5b7
push dword [esp + 0x28]
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x48c5d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.004880f0
mov edi, eax
test edi, edi
je 0x48c661
lea eax, [esp + 0xc]
mov word [esp + 0x1d], 0x4479
push eax
push edi
mov word [esp + 0x14], 0x6e49
mov dword [esp + 0x20], 0x69727563
mov word [esp + 0x1d], 0x5365
mov dword [esp + 0x28], 0x69726373
mov word [esp + 0x17], 0x6974
mov dword [esp + 0x2c], 0x726f7470
mov word [esp + 0x1a], 0x696c
mov byte [esp + 0x24], 0x74
mov byte [esp + 0x1f], 0x65
mov byte [esp + 0x16], 0x69
mov byte [esp + 0x30], 0
mov byte [esp + 0x27], 0x65
mov byte [esp + 0x19], 0x61
mov byte [esp + 0x1c], 0x7a
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48c65a
push 1
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x20
ret

Function at 0x48c670
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00488230
mov edi, eax
test edi, edi
je 0x48c6bc
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x64616f4c
push eax
push edi
mov dword [esp + 0x1c], 0x6e6f6349
mov word [esp + 0x20], 0x57
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48c6b5
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x48c6d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00488050
mov edi, eax
test edi, edi
je 0x48c73b
lea eax, [esp + 0x10]
mov word [esp + 0x1a], 0x7966
push eax
push edi
mov dword [esp + 0x18], 0x6c656853
mov word [esp + 0x1f], 0x746f
mov dword [esp + 0x26], 0x576e6f
mov word [esp + 0x24], 0x6349
mov word [esp + 0x1c], 0x5f6c
mov byte [esp + 0x21], 0x69
mov byte [esp + 0x1e], 0x4e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48c734
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x48c750
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00488000
mov edi, eax
test edi, edi
je 0x48c7c5
lea eax, [esp + 0xc]
mov word [esp + 0xf], 0x4668
push eax
push edi
mov word [esp + 0x20], 0x736e
mov word [esp + 0x1a], 0x646e
mov word [esp + 0x1d], 0x7478
mov dword [esp + 0x23], 0x576e6f
mov word [esp + 0x14], 0x6150
mov byte [esp + 0x1c], 0x45
mov byte [esp + 0x1f], 0x65
mov byte [esp + 0x22], 0x69
mov byte [esp + 0x16], 0x74
mov byte [esp + 0x19], 0x69
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48c7be
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x48c7d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
mov esi, 1
call fcn.004880f0
mov edi, eax
test edi, edi
je 0x48c838
lea eax, [esp + 0xc]
mov dword [esp + 0x16], 0x72756365
push eax
push edi
mov dword [esp + 0x22], 0x797469
mov dword [esp + 0x19], 0x79654b74
mov dword [esp + 0x15], 0x65476765
mov byte [esp + 0x14], 0x52
mov byte [esp + 0x1d], 0x53
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48c831
push dword [esp + 0x28]
push dword [esp + 0x28]
push 4
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x48c850
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
push esi
push edi
mov edi, ecx
call fcn.00487fb0
mov esi, eax
test esi, esi
je 0x48c89d
lea eax, [esp + 8]
mov dword [esp + 0xc], 0x49746e61
push eax
push esi
mov word [esp + 0x19], 0x7469
mov byte [esp + 0x1b], 0
mov dword [esp + 0x10], 0x69726156
mov byte [esp + 0x18], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48c896
push edi
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
add esp, 0xc
ret

Function at 0x48c8b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, edx
xor edi, edi
call fcn.004880f0
mov esi, eax
test esi, esi
je 0x48c935
lea eax, [esp + 0xc]
mov word [esp + 0x12], 0x6341
push eax
push esi
mov word [esp + 0x21], 0x6953
mov word [esp + 0x14], 0x6f4c
mov word [esp + 0x17], 0x756b
mov dword [esp + 0x1c], 0x6e756f63
mov word [esp + 0x24], 0x57
mov byte [esp + 0x23], 0x64
mov byte [esp + 0x16], 0x6f
mov byte [esp + 0x20], 0x74
mov byte [esp + 0x19], 0x70
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48c92e
push dword [esp + 0x34]
push dword [esp + 0x34]
push dword [esp + 0x34]
push dword [esp + 0x34]
push dword [esp + 0x34]
push ebx
push edi
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x48c940
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
mov esi, 1
call fcn.004880f0
mov edi, eax
test edi, edi
je 0x48c9a0
lea eax, [esp + 0x10]
mov dword [esp + 0x13], 0x656c6544
push eax
push edi
mov dword [esp + 0x20], 0x79654b65
mov word [esp + 0x24], 0x57
mov word [esp + 0x18], 0x6552
mov byte [esp + 0x1a], 0x67
mov byte [esp + 0x1f], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48c999
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x48ca70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00488000
mov edi, eax
test edi, edi
je 0x48cac6
lea eax, [esp + 0xc]
mov dword [esp + 0x14], 0x526f5470
push eax
push edi
mov dword [esp + 0x21], 0x57746f
mov dword [esp + 0x14], 0x68746150
mov dword [esp + 0x18], 0x69727453
mov byte [esp + 0x20], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48cabf
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x48cad0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
mov esi, 1
call fcn.004880f0
mov edi, eax
test edi, edi
je 0x48cb44
lea eax, [esp + 0x10]
mov dword [esp + 0x1a], 0x63416e49
push eax
push edi
mov dword [esp + 0x1b], 0x72746e45
mov word [esp + 0x18], 0x6553
mov word [esp + 0x26], 0x576c
mov byte [esp + 0x1a], 0x74
mov byte [esp + 0x28], 0
mov word [esp + 0x20], 0x7365
mov byte [esp + 0x1f], 0x69
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48cb3d
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x48cb50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00488230
mov edi, eax
test edi, edi
je 0x48cba5
lea eax, [esp + 0x10]
mov word [esp + 0x18], 0x43
push eax
push edi
mov dword [esp + 0x1b], 0x65736165
mov word [esp + 0x18], 0x6552
mov byte [esp + 0x1a], 0x6c
mov byte [esp + 0x1f], 0x44
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48cb9e
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x48cc40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
mov esi, 0x60
call fcn.004880a0
mov edi, eax
test edi, edi
je 0x48cca9
lea eax, [esp + 0x10]
mov word [esp + 0x11], 0x7465
push eax
push edi
mov byte [esp + 0x18], 0x47
mov word [esp + 0x1f], 0x6563
mov dword [esp + 0x21], 0x73706143
mov word [esp + 0x1c], 0x7665
mov byte [esp + 0x1b], 0x44
mov byte [esp + 0x25], 0
mov byte [esp + 0x1e], 0x69
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48cca2
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x48cd10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
push esi
lea eax, [esp + 4]
mov dword [esp + 0xb], 0x656c646e
push eax
mov esi, ecx
mov dword [esp + 0xb], 0x61486573
mov word [esp + 9], 0x6f6c
mov byte [esp + 0x13], 0
mov byte [esp + 8], 0x43
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48cd54
push esi
call eax
pop esi
add esp, 0xc
ret
xor eax, eax
pop esi
add esp, 0xc
ret

Function at 0x48cd60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
lea eax, [esp]
mov dword [esp + 7], 0x78657475
push eax
mov dword [esp + 4], 0x61657243
mov word [esp + 8], 0x6574
mov byte [esp + 0xa], 0x4d
mov word [esp + 0xf], 0x57
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48cda8
push dword [esp + 0x14]
push 0
push 0
call eax
add esp, 0x10
ret
xor eax, eax
add esp, 0x10
ret

Function at 0x48cdb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00488230
mov edi, eax
test edi, edi
je 0x48ce06
lea eax, [esp + 0x10]
mov word [esp + 0x15], 0x6e69
push eax
push edi
mov dword [esp + 0x18], 0x646e6946
mov dword [esp + 0x1f], 0x57776f64
mov byte [esp + 0x23], 0
mov byte [esp + 0x1c], 0x57
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48cdff
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x48ce10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
lea eax, [esp + 4]
mov word [esp + 0x17], 0x78
push eax
mov esi, ecx
mov word [esp + 0xb], 0x6162
mov dword [esp + 0x10], 0x79726f6d
mov dword [esp + 0x16], 0x73757461
mov word [esp + 8], 0x6c47
mov word [esp + 0x14], 0x7453
mov byte [esp + 0xa], 0x6f
mov word [esp + 0xe], 0x654d
mov byte [esp + 0x1a], 0x45
mov byte [esp + 0xd], 0x6c
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48ce75
push esi
call eax
pop esi
add esp, 0x18
ret
xor eax, eax
pop esi
add esp, 0x18
ret

Function at 0x48ce80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, edx
mov esi, 0x80004005
call fcn.004883e0
mov edi, eax
test edi, edi
je 0x48cee3
lea eax, [esp + 0xc]
mov word [esp + 0xf], 0x696e
push eax
push edi
mov word [esp + 0x14], 0x6f43
mov dword [esp + 0x1a], 0x696c6169
mov dword [esp + 0x1f], 0x784565
mov byte [esp + 0x19], 0x74
mov byte [esp + 0x1e], 0x7a
mov byte [esp + 0x16], 0x49
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48cedc
push ebx
push 0
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x48cef0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
mov esi, 0x80004005
call fcn.004883e0
mov edi, eax
test edi, edi
je 0x48cf5b
lea eax, [esp + 0xc]
mov dword [esp + 0x16], 0x6e617473
push eax
push edi
mov word [esp + 0x23], 0x65
mov dword [esp + 0x16], 0x61657243
mov word [esp + 0x14], 0x6f43
mov dword [esp + 0x1a], 0x6e496574
mov byte [esp + 0x22], 0x63
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48cf54
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push 1
push 0
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x48cf70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
call fcn.004883e0
mov esi, eax
test esi, esi
je 0x48cfbc
lea eax, [esp + 4]
mov dword [esp + 0xd], 0x7a696c61
push eax
push esi
mov dword [esp + 0xc], 0x6e556f43
mov dword [esp + 0x11], 0x6974696e
mov word [esp + 0x19], 0x65
mov byte [esp + 0x10], 0x69
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48cfb5
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
add esp, 0x10
ret

Function at 0x48cfd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
mov esi, 0x80004005
call fcn.004883e0
mov edi, eax
test edi, edi
je 0x48d042
lea eax, [esp + 0xc]
mov dword [esp + 0x10], 0x6f725074
push eax
push edi
mov word [esp + 0x15], 0x536f
mov dword [esp + 0x22], 0x74656b
mov byte [esp + 0x14], 0x43
mov dword [esp + 0x1e], 0x6e616c42
mov word [esp + 0x1c], 0x7978
mov byte [esp + 0x17], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48d03b
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x48d050
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00488230
mov edi, eax
test edi, edi
je 0x48d0b0
lea eax, [esp + 0x10]
mov dword [esp + 0x12], 0x654d7473
push eax
push edi
mov dword [esp + 0x1e], 0x67617373
mov word [esp + 0x23], 0x57
mov byte [esp + 0x22], 0x65
mov word [esp + 0x18], 0x6f50
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48d0a9
push dword [esp + 0x28]
push dword [esp + 0x28]
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x48d0c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
lea eax, [esp]
mov dword [esp + 6], 0x6c646e61
push eax
mov word [esp + 0xf], 0x4564
mov dword [esp + 0x14], 0x6f697470
mov word [esp + 7], 0x6e55
mov dword [esp + 0x18], 0x6c69466e
mov dword [esp + 0x1c], 0x726574
mov word [esp + 0x12], 0x6563
mov byte [esp + 0x11], 0x78
mov byte [esp + 9], 0x68
mov word [esp + 4], 0x6553
mov byte [esp + 0xe], 0x65
mov byte [esp + 6], 0x74
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48d132
push 0x43d6b0
call eax
add esp, 0x1c
ret
xor eax, eax
add esp, 0x1c
ret

Function at 0x48d140
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
lea eax, [esp]
mov dword [esp + 6], 0x72724574
push eax
mov dword [esp + 5], 0x614c7465
mov word [esp + 0xf], 0x72
mov byte [esp + 9], 0x73
mov byte [esp + 4], 0x47
mov byte [esp + 0xe], 0x6f
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48d183
call eax
add esp, 0x10
ret
xor eax, eax
add esp, 0x10
ret

Function at 0x48d190
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
lea eax, [esp]
mov word [esp + 7], 0x6e61
push eax
mov word [esp + 0x11], 0x5765
mov word [esp + 5], 0x7465
mov byte [esp + 0x13], 0
mov word [esp + 0xe], 0x694c
mov byte [esp + 0x10], 0x6e
mov byte [esp + 4], 0x47
mov word [esp + 8], 0x6d6f
mov byte [esp + 7], 0x43
mov byte [esp + 0xd], 0x64
mov byte [esp + 0xa], 0x6d
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48d1ee
call eax
add esp, 0x10
ret
xor eax, eax
add esp, 0x10
ret

Function at 0x48d200
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
push edi
mov esi, 0x80004005
call fcn.004883e0
mov edi, eax
test edi, edi
je 0x48d25e
lea eax, [esp + 8]
mov dword [esp + 0x10], 0x657a696c
push eax
push edi
mov byte [esp + 0x1c], 0
mov word [esp + 0x13], 0x696e
mov word [esp + 0x10], 0x6f43
mov word [esp + 0x16], 0x6169
mov byte [esp + 0x15], 0x74
mov byte [esp + 0x12], 0x49
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48d257
push 0
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x48d270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
mov esi, 0x80004005
call fcn.00487fb0
mov edi, eax
test edi, edi
je 0x48d2c1
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x69726156
push eax
push edi
mov dword [esp + 0x19], 0x6c43746e
mov dword [esp + 0x1d], 0x726165
mov byte [esp + 0x18], 0x61
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48d2ba
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x48d370
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 0x10], 0x7365636f
push eax
mov esi, edx
mov dword [esp + 0xd], 0x74616572
mov edi, ecx
mov word [esp + 0x18], 0x5773
mov word [esp + 0x12], 0x7250
mov byte [esp + 0x1a], 0
mov byte [esp + 0xc], 0x43
mov byte [esp + 0x11], 0x65
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48d3db
push dword [esp + 0x38]
push dword [esp + 0x38]
push 0
push 0
push dword [esp + 0x38]
push 0
push 0
push 0
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x10
ret
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret

Function at 0x48d3f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
lea eax, [esp]
mov dword [esp + 2], 0x72754374
push eax
mov word [esp + 0xe], 0x7250
mov word [esp + 0x11], 0x6563
mov word [esp + 0x14], 0x73
mov dword [esp + 0xa], 0x746e6572
mov byte [esp + 0x10], 0x6f
mov word [esp + 4], 0x6547
mov byte [esp + 0x13], 0x73
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48d443
call eax
add esp, 0x14
ret
or eax, 0xffffffff
add esp, 0x14
ret

Function at 0x48d450
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 9], 0x6f437465
push eax
mov esi, edx
mov dword [esp + 0x11], 0x7475706d
mov edi, ecx
mov dword [esp + 0x15], 0x614e7265
mov dword [esp + 0x19], 0x57656d
mov byte [esp + 0xc], 0x47
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48d49d
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x14
ret
pop edi
xor eax, eax
pop esi
add esp, 0x14
ret

Function at 0x48d4b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push esi
lea eax, [esp + 4]
mov dword [esp + 0x11], 0x577972
push eax
mov esi, ecx
mov dword [esp + 9], 0x74616572
mov dword [esp + 0xd], 0x72694465
mov byte [esp + 8], 0x43
mov word [esp + 0x12], 0x7463
mov byte [esp + 0x14], 0x6f
mov byte [esp + 0x11], 0x65
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48d503
push 0
push esi
call eax
pop esi
add esp, 0x14
ret
xor eax, eax
pop esi
add esp, 0x14
ret

Function at 0x48d570
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00488230
mov edi, eax
test edi, edi
je 0x48d5d4
lea eax, [esp + 0xc]
mov dword [esp + 0x12], 0x4c776f64
push eax
push edi
mov word [esp + 0x1e], 0x6e6f
mov word [esp + 0x21], 0x57
mov dword [esp + 0x15], 0x69577465
mov byte [esp + 0x19], 0x6e
mov byte [esp + 0x14], 0x53
mov byte [esp + 0x20], 0x67
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48d5cd
push dword [esp + 0x20]
push 0xffffffffffffffec
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret