joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48d5e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00488230
mov edi, eax
test edi, edi
je 0x48d64e
lea eax, [esp + 0x10]
mov word [esp + 0x10], 0x6547
push eax
push edi
mov word [esp + 0x22], 0x6e6f
mov word [esp + 0x1e], 0x6f64
mov word [esp + 0x1b], 0x6957
mov word [esp + 0x25], 0x57
mov word [esp + 0x20], 0x4c77
mov byte [esp + 0x1d], 0x6e
mov byte [esp + 0x1a], 0x74
mov byte [esp + 0x24], 0x67
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48d647
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x48d660
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00488230
mov edi, eax
test edi, edi
je 0x48d6b9
lea eax, [esp + 0xc]
mov dword [esp + 0xd], 0x63537465
push eax
push edi
mov word [esp + 0x1f], 0x73
mov dword [esp + 0x1a], 0x506c6c6f
mov byte [esp + 0x19], 0x72
mov byte [esp + 0x1e], 0x6f
mov byte [esp + 0x14], 0x47
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48d6b2
push 2
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x48d6d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
mov esi, 0x80004005
call fcn.004883e0
mov edi, eax
test edi, edi
je 0x48d74a
lea eax, [esp + 0x10]
mov word [esp + 0x21], 0x626f
push eax
push edi
mov word [esp + 0x2c], 0x6c
mov dword [esp + 0x23], 0x486e4f6d
mov dword [esp + 0x1c], 0x74536574
mov dword [esp + 0x18], 0x61657243
mov word [esp + 0x21], 0x6165
mov word [esp + 0x27], 0x6c47
mov byte [esp + 0x2b], 0x61
mov byte [esp + 0x20], 0x72
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48d743
push dword [esp + 0x2c]
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x48d760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
push esi
push edi
lea eax, [esp + 8]
mov word [esp + 0x10], 0x65
push eax
mov esi, edx
mov word [esp + 0xc], 0x7257
mov edi, ecx
mov dword [esp + 0xf], 0x69466574
mov byte [esp + 0x13], 0x6c
mov byte [esp + 0xe], 0x69
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48d7b2
push 0
push dword [esp + 0x20]
push dword [esp + 0x20]
push esi
push edi
call eax
pop edi
pop esi
add esp, 0xc
ret
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret
Function at 0x48d7c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 0xc], 0x53726f46
push eax
mov esi, edx
mov word [esp + 0x18], 0x4f65
mov edi, ecx
mov dword [esp + 0x14], 0x6c676e69
mov word [esp + 0x1e], 0x74
mov word [esp + 0x1b], 0x656a
mov dword [esp + 0xc], 0x74696157
mov byte [esp + 0x1a], 0x62
mov byte [esp + 0x1d], 0x63
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48d81f
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x14
ret
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x14
ret

Function at 0x48d880
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
xor esi, esi
call fcn.00488230
mov edi, eax
test edi, edi
je 0x48d8f3
lea eax, [esp + 8]
mov dword [esp + 0x17], 0x666e4973
push eax
push edi
mov dword [esp + 0x19], 0x74656d61
mov dword [esp + 0x13], 0x506d6574
mov word [esp + 0x1d], 0x7265
mov word [esp + 0x23], 0x576f
mov word [esp + 0x17], 0x7261
mov word [esp + 0x11], 0x7379
mov byte [esp + 0x10], 0x53
mov byte [esp + 0x25], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48d8ec
push esi
push dword [esp + 0x28]
push esi
push 0x30
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
add esp, 0x18
ret

Function at 0x48d960
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
mov esi, 1
call fcn.004880f0
mov edi, eax
test edi, edi
je 0x48d9c7
lea eax, [esp + 0x10]
mov word [esp + 0x17], 0x6574
push eax
push edi
mov dword [esp + 0x24], 0x576575
mov dword [esp + 0x1a], 0x6c654467
mov word [esp + 0x22], 0x6c61
mov byte [esp + 0x21], 0x56
mov word [esp + 0x18], 0x6552
mov byte [esp + 0x1e], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48d9c0
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x48d9e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 0x1a], 0x576e6f
push eax
mov esi, edx
mov dword [esp + 0x17], 0x6d726f66
mov edi, ecx
mov dword [esp + 0xc], 0x56746547
mov word [esp + 0x1c], 0x6974
mov dword [esp + 0x13], 0x6e49656d
mov word [esp + 0x11], 0x756c
mov byte [esp + 0x10], 0x6f
mov byte [esp + 0x1b], 0x61
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48da5a
push 0x105
push dword [esp + 0x38]
push dword [esp + 0x38]
push dword [esp + 0x38]
push dword [esp + 0x38]
push 0x105
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x18
ret
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret
Function at 0x48dad0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.004880f0
mov edi, eax
test edi, edi
je 0x48db51
lea eax, [esp + 0x10]
mov dword [esp + 0x21], 0x726f7470
push eax
push edi
mov dword [esp + 0x1a], 0x63655374
mov word [esp + 0x23], 0x6544
mov dword [esp + 0x2d], 0x656e774f
mov word [esp + 0x26], 0x7263
mov dword [esp + 0x1e], 0x74697275
mov word [esp + 0x31], 0x72
mov word [esp + 0x18], 0x6553
mov byte [esp + 0x25], 0x73
mov byte [esp + 0x28], 0x69
mov byte [esp + 0x22], 0x79
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48db4a
push esi
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret

Function at 0x48db60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
mov esi, 0x80004005
call fcn.004883e0
mov edi, eax
test edi, edi
je 0x48dbc1
lea eax, [esp + 0x10]
mov dword [esp + 0x1b], 0x676e6972
push eax
push edi
mov dword [esp + 0x18], 0x49534c43
mov dword [esp + 0x1e], 0x536d6f72
mov word [esp + 0x1c], 0x4644
mov byte [esp + 0x22], 0x74
mov byte [esp + 0x27], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48dbba
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x48dbd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
lea eax, [esp]
mov word [esp + 7], 0x7268
push eax
mov word [esp + 5], 0x6572
mov word [esp + 0xe], 0x6461
mov word [esp + 8], 0x6574
mov byte [esp + 7], 0x61
mov byte [esp + 0xa], 0x54
mov byte [esp + 0x10], 0
mov byte [esp + 4], 0x43
mov byte [esp + 0xd], 0x65
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48dc34
push dword [esp + 0x20]
push 0
push dword [esp + 0x20]
push dword [esp + 0x20]
push 0
push 0
call eax
add esp, 0x10
ret
xor eax, eax
add esp, 0x10
ret

Function at 0x48dc40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
or esi, 0xffffffff
call fcn.00488230
mov edi, eax
test edi, edi
je 0x48dca2
lea eax, [esp + 0xc]
mov dword [esp + 0x18], 0x656c6449
push eax
push edi
mov dword [esp + 0x1b], 0x75706e49
mov dword [esp + 0x17], 0x726f4674
mov byte [esp + 0x24], 0
mov word [esp + 0x15], 0x6961
mov byte [esp + 0x1f], 0x74
mov byte [esp + 0x14], 0x57
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48dc9b
push 0xffffffffffffffff
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x48dd10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
mov esi, 1
call fcn.004880f0
mov edi, eax
test edi, edi
je 0x48dd7c
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x45676552
push eax
push edi
mov dword [esp + 0x21], 0x57784579
mov dword [esp + 0x1d], 0x654b6d75
mov byte [esp + 0x25], 0
mov byte [esp + 0x1c], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48dd75
push dword [esp + 0x38]
push 0
push 0
push 0
push dword [esp + 0x38]
push dword [esp + 0x38]
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x48dd90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
mov esi, 0x80004005
call fcn.004883e0
mov edi, eax
test edi, edi
je 0x48ddf0
lea eax, [esp + 0xc]
mov dword [esp + 0xd], 0x6572436f
push eax
push edi
mov byte [esp + 0x14], 0x43
mov word [esp + 0x1c], 0x7547
mov word [esp + 0x19], 0x7461
mov word [esp + 0x1e], 0x6469
mov byte [esp + 0x20], 0
mov byte [esp + 0x1b], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48dde9
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x48de00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 0x10], 0x57687461
push eax
mov esi, edx
mov word [esp + 0xf], 0x6554
mov edi, ecx
mov word [esp + 0xc], 0x6547
mov byte [esp + 0x18], 0
mov word [esp + 0x12], 0x5070
mov byte [esp + 0xe], 0x74
mov byte [esp + 0x11], 0x6d
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48de54
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x10
ret
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret

Function at 0x48de60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00488230
mov edi, eax
test edi, edi
je 0x48ded4
lea eax, [esp + 0xc]
mov dword [esp + 0x13], 0x6e695772
push eax
push edi
mov word [esp + 0x19], 0x6574
mov word [esp + 0x27], 0x6567
mov dword [esp + 0x14], 0x69676552
mov word [esp + 0x24], 0x7373
mov dword [esp + 0x1f], 0x4d776f64
mov byte [esp + 0x23], 0x65
mov word [esp + 0x29], 0x57
mov byte [esp + 0x18], 0x73
mov byte [esp + 0x26], 0x61
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48decd
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x48dee0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
mov esi, 1
call fcn.004880f0
mov edi, eax
test edi, edi
je 0x48df5d
lea eax, [esp + 0x10]
mov word [esp + 0x13], 0x6553
push eax
push edi
mov dword [esp + 0x24], 0x6f666e
mov word [esp + 0x18], 0x6553
mov word [esp + 0x1f], 0x6972
mov word [esp + 0x22], 0x4979
mov word [esp + 0x1d], 0x7563
mov byte [esp + 0x1a], 0x74
mov byte [esp + 0x21], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48df56
push 0
push dword [esp + 0x34]
push 0
push dword [esp + 0x34]
push dword [esp + 0x34]
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x48df70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
mov esi, 0x80004005
call fcn.00487fb0
mov edi, eax
test edi, edi
je 0x48dfe1
lea eax, [esp + 0xc]
mov word [esp + 0x17], 0x7473
push eax
push edi
mov word [esp + 0x22], 0x796f
mov dword [esp + 0x15], 0x41656661
mov byte [esp + 0x24], 0
mov byte [esp + 0x14], 0x53
mov word [esp + 0x19], 0x7272
mov word [esp + 0x1c], 0x4479
mov byte [esp + 0x1b], 0x61
mov byte [esp + 0x21], 0x72
mov byte [esp + 0x1e], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48dfda
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x48e060
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00488230
mov edi, eax
test edi, edi
je 0x48e0d0
lea eax, [esp + 0xc]
mov word [esp + 0x19], 0x5077
push eax
push edi
mov dword [esp + 0x1a], 0x69577265
mov word [esp + 0x24], 0x73
mov word [esp + 0x14], 0x6e45
mov word [esp + 0x17], 0x6544
mov word [esp + 0x1e], 0x646e
mov byte [esp + 0x23], 0x6f
mov byte [esp + 0x20], 0x6f
mov byte [esp + 0x16], 0x64
mov byte [esp + 0x19], 0x66
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48e0c9
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x48e0e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.004880a0
mov edi, eax
test edi, edi
je 0x48e145
lea eax, [esp + 0xc]
mov dword [esp + 0xd], 0x74616572
push eax
push edi
mov word [esp + 0x19], 0x5365
mov word [esp + 0x1c], 0x696c
mov dword [esp + 0x1f], 0x73757242
mov byte [esp + 0x1e], 0x64
mov word [esp + 0x23], 0x68
mov byte [esp + 0x1b], 0x6f
mov byte [esp + 0x14], 0x43
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48e13e
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x48e150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
mov esi, 1
call fcn.004880f0
mov edi, eax
test edi, edi
je 0x48e1c6
lea eax, [esp + 0x10]
mov dword [esp + 0x16], 0x6c61566d
push eax
push edi
mov dword [esp + 0x22], 0x576575
mov word [esp + 0x19], 0x6765
mov word [esp + 0x1c], 0x756e
mov byte [esp + 0x1b], 0x45
mov byte [esp + 0x18], 0x52
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48e1bf
push dword [esp + 0x38]
push dword [esp + 0x38]
push dword [esp + 0x38]
push 0
push dword [esp + 0x38]
push dword [esp + 0x38]
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x48e1d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
push edi
mov edi, ecx
call fcn.00487fb0
mov esi, eax
test esi, esi
je 0x48e22a
lea eax, [esp + 8]
mov dword [esp + 0xb], 0x65657246
push eax
push esi
mov word [esp + 0x19], 0x6972
mov word [esp + 0x1c], 0x67
mov word [esp + 0x11], 0x7379
mov byte [esp + 0x1b], 0x6e
mov byte [esp + 0x10], 0x53
mov word [esp + 0x17], 0x7453
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48e223
push edi
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
add esp, 0x10
ret

Function at 0x48e230
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push esi
lea eax, [esp + 4]
mov dword [esp + 6], 0x6c694674
push eax
mov esi, ecx
mov word [esp + 0xf], 0x7441
mov dword [esp + 0x17], 0x577365
mov word [esp + 0x12], 0x6972
mov byte [esp + 0x11], 0x74
mov word [esp + 8], 0x6547
mov word [esp + 0x15], 0x7475
mov byte [esp + 0xe], 0x65
mov byte [esp + 0x14], 0x62
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48e28e
push esi
call eax
pop esi
add esp, 0x14
ret
or eax, 0xffffffff
pop esi
add esp, 0x14
ret

Function at 0x48e2a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00488230
mov edi, eax
test edi, edi
je 0x48e317
lea eax, [esp + 0x10]
mov dword [esp + 0x1a], 0x736f5077
push eax
push edi
mov word [esp + 0x20], 0x6f64
mov word [esp + 0x18], 0x6544
mov dword [esp + 0x1b], 0x69577265
mov byte [esp + 0x26], 0
mov byte [esp + 0x1a], 0x66
mov byte [esp + 0x1f], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48e310
push dword [esp + 0x38]
push dword [esp + 0x38]
push dword [esp + 0x38]
push dword [esp + 0x38]
push dword [esp + 0x38]
push esi
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x48e330
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.004880a0
mov edi, eax
test edi, edi
je 0x48e3a5
lea eax, [esp + 0x10]
mov dword [esp + 0x15], 0x78457478
push eax
push edi
mov dword [esp + 0x28], 0x3233746e
mov dword [esp + 0x19], 0x65547465
mov dword [esp + 0x23], 0x6f50746e
mov word [esp + 0x2c], 0x57
mov byte [esp + 0x18], 0x47
mov byte [esp + 0x27], 0x69
mov word [esp + 0x21], 0x6574
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48e39e
push dword [esp + 0x30]
push dword [esp + 0x30]
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x48e3b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
mov esi, 1
call fcn.004880f0
mov edi, eax
test edi, edi
je 0x48e42d
lea eax, [esp + 0x10]
mov word [esp + 0x1a], 0x7965
push eax
push edi
mov word [esp + 0x25], 0x5778
mov dword [esp + 0x1d], 0x65746165
mov dword [esp + 0x19], 0x72436765
mov byte [esp + 0x24], 0x45
mov byte [esp + 0x18], 0x52
mov byte [esp + 0x27], 0
mov byte [esp + 0x21], 0x4b
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48e426
push 0
push dword [esp + 0x3c]
push 0
push 0x2001f
push 0
push 0
push 0
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x48e490
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
push esi
lea eax, [esp + 4]
mov word [esp + 7], 0x6946
push eax
mov esi, ecx
mov word [esp + 0x11], 0x657a
mov word [esp + 0xe], 0x5365
mov word [esp + 8], 0x6547
mov byte [esp + 0xa], 0x74
mov byte [esp + 0x13], 0
mov byte [esp + 0x10], 0x69
mov byte [esp + 0xd], 0x6c
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48e4e5
push 0
push esi
call eax
pop esi
add esp, 0xc
ret
or eax, 0xffffffff
pop esi
add esp, 0xc
ret

Function at 0x48e4f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00488230
mov edi, eax
test edi, edi
je 0x48e54e
lea eax, [esp + 0xc]
mov dword [esp + 0x12], 0x646e6957
push eax
push edi
mov word [esp + 0x1f], 0x77
mov dword [esp + 0x15], 0x61726465
mov byte [esp + 0x1e], 0x6f
mov byte [esp + 0x19], 0x77
mov byte [esp + 0x14], 0x52
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48e547
push 0x105
push esi
push esi
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x48e560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
mov ebx, ecx
or esi, 0xffffffff
call fcn.004880a0
mov edi, eax
test edi, edi
je 0x48e5bd
lea eax, [esp + 0xc]
mov word [esp + 0x15], 0x72
push eax
push edi
mov word [esp + 0x17], 0x6b42
mov word [esp + 0x1a], 0x6c6f
mov byte [esp + 0x19], 0x43
mov word [esp + 0x15], 0x7465
mov byte [esp + 0x14], 0x47
mov byte [esp + 0x1c], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48e5b6
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x48e5d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push esi
lea eax, [esp + 4]
mov word [esp + 0xd], 0x6f54
push eax
mov esi, ecx
mov dword [esp + 0x14], 0x43656469
mov dword [esp + 0xd], 0x65747942
mov word [esp + 0xb], 0x6974
mov word [esp + 8], 0x754d
mov dword [esp + 0x18], 0x726168
mov byte [esp + 0xa], 0x6c
mov byte [esp + 0x13], 0x57
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48e63c
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push 0
push esi
call eax
pop esi
add esp, 0x14
ret
xor eax, eax
pop esi
add esp, 0x14
ret

Function at 0x48e650
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
push esi
push edi
mov esi, 1
call fcn.004880f0
mov edi, eax
test edi, edi
je 0x48e6af
lea eax, [esp + 8]
mov word [esp + 0xd], 0x6e65
push eax
push edi
mov dword [esp + 0x17], 0x5779654b
mov dword [esp + 0x10], 0x4f676552
mov byte [esp + 0x1b], 0
mov byte [esp + 0x14], 0x70
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48e6a8
push dword [esp + 0x18]
push str.SoftwareAPCTab
push SysReAllocString
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
add esp, 0xc
ret

Function at 0x48e6c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
push esi
lea eax, [esp + 4]
mov word [esp + 0xa], 0x6c6c
push eax
mov esi, edx
mov dword [esp + 9], 0x6c61636f
mov word [esp + 0x11], 0x63
mov byte [esp + 0x10], 0x6f
mov byte [esp + 0xd], 0x41
mov byte [esp + 8], 0x4c
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48e70a
push esi
push 0
call eax
pop esi
add esp, 0xc
ret
xor eax, eax
pop esi
add esp, 0xc
ret