joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48a310
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
mov ebx, edx
xor esi, esi
call fcn.004880f0
mov edi, eax
test edi, edi
je 0x48a373
lea eax, [esp + 0xc]
mov dword [esp + 0x15], 0x6d654d6e
push eax
push edi
mov dword [esp + 0x18], 0x6b6f546b
mov dword [esp + 0x25], 0x706968
mov dword [esp + 0x21], 0x73726562
mov dword [esp + 0x14], 0x63656843
mov byte [esp + 0x1c], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48a36c
push dword [esp + 0x28]
push ebx
push esi
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x18
ret

Function at 0x48a380
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
mov esi, 1
call fcn.004880f0
mov edi, eax
test edi, edi
je 0x48a3e4
lea eax, [esp + 0x10]
mov dword [esp + 0x15], 0x654b6e65
push eax
push edi
mov dword [esp + 0x22], 0x577845
mov dword [esp + 0x18], 0x4f676552
mov byte [esp + 0x1c], 0x70
mov byte [esp + 0x21], 0x79
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48a3dd
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push 0
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x48a3f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
lea eax, [esp + 4]
mov dword [esp + 5], 0x65567465
push eax
mov esi, ecx
mov dword [esp + 0x12], 0x577845
mov dword [esp + 0xe], 0x6e6f6973
mov byte [esp + 0xd], 0x72
mov byte [esp + 8], 0x47
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48a435
push esi
call eax
pop esi
add esp, 0x10
ret
xor eax, eax
pop esi
add esp, 0x10
ret

Function at 0x48a440
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00487f00
mov edi, eax
test edi, edi
je 0x48a4b7
lea eax, [esp + 0x10]
mov word [esp + 0x18], 0x756e
push eax
push edi
mov dword [esp + 0x1a], 0x44707574
mov dword [esp + 0x25], 0x65636976
mov dword [esp + 0x2a], 0x6f666e
mov word [esp + 0x23], 0x6544
mov byte [esp + 0x29], 0x49
mov byte [esp + 0x22], 0x6d
mov word [esp + 0x1e], 0x4569
mov word [esp + 0x18], 0x6553
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48a4b0
push dword [esp + 0x2c]
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x48a4d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
mov ebx, ecx
or esi, 0xffffffff
call fcn.00487f00
mov edi, eax
test edi, edi
je 0x48a544
lea eax, [esp + 0xc]
mov dword [esp + 0x16], 0x73616c43
push eax
push edi
mov word [esp + 0x15], 0x7465
mov dword [esp + 0x22], 0x76654473
mov byte [esp + 0x14], 0x53
mov dword [esp + 0x1a], 0x74654769
mov word [esp + 0x27], 0x57
mov word [esp + 0x18], 0x4470
mov byte [esp + 0x17], 0x75
mov byte [esp + 0x26], 0x73
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48a53d
push 2
push 0
push 0
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x18
ret

Function at 0x48a550
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.004880f0
mov edi, eax
test edi, edi
je 0x48a5da
lea eax, [esp + 0xc]
mov dword [esp + 0x14], 0x44797469
push eax
push edi
mov word [esp + 0x21], 0x6373
mov dword [esp + 0x29], 0x6c636144
mov word [esp + 0x24], 0x7069
mov byte [esp + 0x23], 0x72
mov word [esp + 0x14], 0x6553
mov word [esp + 0x27], 0x726f
mov dword [esp + 0x17], 0x75636553
mov byte [esp + 0x26], 0x74
mov byte [esp + 0x16], 0x74
mov byte [esp + 0x20], 0x65
mov byte [esp + 0x1b], 0x72
mov byte [esp + 0x2d], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48a5d3
push esi
push dword [esp + 0x30]
push 1
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x1c
ret

Function at 0x48a5f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, edx
xor esi, esi
call fcn.00488050
mov edi, eax
test edi, edi
je 0x48a655
lea eax, [esp + 0xc]
mov dword [esp + 0x12], 0x75636578
push eax
push edi
mov word [esp + 0x15], 0x6568
mov dword [esp + 0x1e], 0x576574
mov byte [esp + 0x14], 0x53
mov word [esp + 0x18], 0x456c
mov byte [esp + 0x17], 0x6c
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48a64e
push 1
push esi
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push ebx
push esi
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x48a660
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00488000
mov edi, eax
test edi, edi
je 0x48a6ba
lea eax, [esp + 0xc]
mov dword [esp + 0x13], 0x69784565
push eax
push edi
mov dword [esp + 0x15], 0x46687461
mov dword [esp + 0x1f], 0x41737473
mov byte [esp + 0x14], 0x50
mov word [esp + 0x19], 0x6c69
mov byte [esp + 0x23], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48a6b3
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x48a6d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push esi
lea eax, [esp + 4]
mov dword [esp + 0x11], 0x656d614e
push eax
mov esi, edx
mov word [esp + 0xb], 0x6f4d
mov word [esp + 0x11], 0x6946
mov word [esp + 0xe], 0x6c75
mov word [esp + 0x13], 0x656c
mov word [esp + 0x19], 0x57
mov byte [esp + 0x10], 0x65
mov word [esp + 8], 0x6547
mov byte [esp + 0xa], 0x74
mov byte [esp + 0xd], 0x64
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48a73a
push dword [esp + 0x1c]
push esi
push 0
call eax
pop esi
add esp, 0x14
ret
xor eax, eax
pop esi
add esp, 0x14
ret

Function at 0x48a750
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
push ebx
push esi
push edi
mov ebx, edx
xor esi, esi
call fcn.004881f0
mov edi, eax
test edi, edi
je 0x48a7ee
lea eax, [esp + 0xc]
mov word [esp + 0x17], 0x4672
push eax
push edi
mov dword [esp + 0x16], 0x65746164
mov dword [esp + 0x32], 0x57736563
mov dword [esp + 0x22], 0x756c5072
mov dword [esp + 0x29], 0x616c5064
mov dword [esp + 0x2d], 0x76654479
mov dword [esp + 0x1a], 0x76697244
mov word [esp + 0x14], 0x7055
mov word [esp + 0x26], 0x4167
mov byte [esp + 0x28], 0x6e
mov byte [esp + 0x21], 0x6f
mov byte [esp + 0x31], 0x69
mov byte [esp + 0x36], 0
mov byte [esp + 0x1e], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48a7e7
push dword [esp + 0x3c]
push 1
push dword [esp + 0x3c]
push ebx
push esi
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x24
ret

Function at 0x48a870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
mov esi, 1
call fcn.004880f0
mov edi, eax
test edi, edi
je 0x48a8de
lea eax, [esp + 0xc]
mov dword [esp + 0x18], 0x6f666e
push eax
push edi
mov dword [esp + 0x14], 0x53746547
mov word [esp + 0x19], 0x7563
mov dword [esp + 0x1c], 0x49797469
mov byte [esp + 0x18], 0x65
mov byte [esp + 0x1b], 0x72
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48a8d7
push dword [esp + 0x34]
push 0
push dword [esp + 0x34]
push 0
push 0
push 4
push esi
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x48a8f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
push esi
lea eax, [esp + 4]
mov dword [esp + 0xb], 0x57656c69
push eax
mov esi, ecx
mov word [esp + 0xb], 0x7465
mov word [esp + 8], 0x6544
mov word [esp + 0xd], 0x4665
mov byte [esp + 0x13], 0
mov byte [esp + 0xa], 0x6c
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48a93a
push esi
call eax
pop esi
add esp, 0xc
ret
xor eax, eax
pop esi
add esp, 0xc
ret
Function at 0x48a990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
push edi
xor esi, esi
call fcn.00488230
mov edi, eax
test edi, edi
je 0x48a9ec
lea eax, [esp + 8]
mov dword [esp + 0xe], 0x776f646e
push eax
push edi
mov word [esp + 0x14], 0x6957
mov word [esp + 0x11], 0x6978
mov dword [esp + 0x1a], 0x784573
mov byte [esp + 0x13], 0x74
mov byte [esp + 0x10], 0x45
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48a9e5
push 0x80040002
push 2
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x48aa00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.004880f0
mov edi, eax
test edi, edi
je 0x48aa77
lea eax, [esp + 0xc]
mov dword [esp + 0x1e], 0x736567
push eax
push edi
mov dword [esp + 0x1f], 0x76697250
mov dword [esp + 0x1a], 0x656b6f54
mov dword [esp + 0x15], 0x73756a64
mov word [esp + 0x23], 0x6c69
mov byte [esp + 0x1e], 0x6e
mov byte [esp + 0x19], 0x74
mov byte [esp + 0x14], 0x41
mov byte [esp + 0x25], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48aa70
push esi
push esi
push dword [esp + 0x34]
push dword [esp + 0x34]
push esi
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x18
ret

Function at 0x48aa80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
mov ebx, edx
xor esi, esi
call fcn.004880f0
mov edi, eax
test edi, edi
je 0x48aaee
lea eax, [esp + 0xc]
mov dword [esp + 0xe], 0x70756b6f
push eax
push edi
mov dword [esp + 0x1f], 0x6567656c
mov dword [esp + 0x1b], 0x69766972
mov dword [esp + 0x24], 0x65756c61
mov word [esp + 0x28], 0x57
mov byte [esp + 0x23], 0x56
mov byte [esp + 0x1a], 0x50
mov word [esp + 0x14], 0x6f4c
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48aae7
push dword [esp + 0x28]
push ebx
push esi
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x18
ret

Function at 0x48ab00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00488050
mov edi, eax
test edi, edi
je 0x48ab74
lea eax, [esp + 0x10]
mov dword [esp + 0x1c], 0x4c44496d
push eax
push edi
mov word [esp + 0x19], 0x4748
mov dword [esp + 0x29], 0x577473
mov word [esp + 0x1c], 0x5074
mov dword [esp + 0x1f], 0x72466874
mov byte [esp + 0x28], 0x69
mov byte [esp + 0x18], 0x53
mov byte [esp + 0x23], 0x6f
mov byte [esp + 0x1e], 0x61
mov byte [esp + 0x1b], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48ab6d
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x48ab80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
push esi
lea eax, [esp + 4]
mov word [esp + 9], 0x7250
push eax
mov esi, edx
mov dword [esp + 0x13], 0x6f725065
mov word [esp + 0x10], 0x6176
mov dword [esp + 0x1e], 0x57676e69
mov dword [esp + 8], 0x74697257
mov dword [esp + 0x1a], 0x72745365
mov byte [esp + 0xf], 0x69
mov word [esp + 0x17], 0x6966
mov byte [esp + 0x22], 0
mov byte [esp + 0x12], 0x74
mov byte [esp + 0xc], 0x65
mov byte [esp + 0x19], 0x6c
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48abfe
push dword [esp + 0x28]
push dword [esp + 0x28]
push esi
push str.Settings
call eax
pop esi
add esp, 0x1c
ret
xor eax, eax
pop esi
add esp, 0x1c
ret

Function at 0x48ac10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
push esi
push edi
lea eax, [esp + 8]
mov word [esp + 0x17], 0x656c
push eax
mov esi, edx
mov dword [esp + 0x16], 0x666f7250
mov edi, ecx
mov dword [esp + 0x1e], 0x6e697274
mov dword [esp + 0x11], 0x74617669
mov word [esp + 0x22], 0x5767
mov dword [esp + 0xd], 0x72507465
mov byte [esp + 0x24], 0
mov byte [esp + 0x1d], 0x53
mov byte [esp + 0xc], 0x47
mov byte [esp + 0x15], 0x65
mov byte [esp + 0x1a], 0x69
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48ac8f
push dword [esp + 0x34]
push dword [esp + 0x34]
push dword [esp + 0x34]
push dword [esp + 0x34]
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x1c
ret
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret

Function at 0x48aca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
lea eax, [esp + 4]
mov word [esp + 0x13], 0x656c
push eax
mov esi, edx
mov dword [esp + 0xa], 0x69725074
mov dword [esp + 0xe], 0x65746176
mov dword [esp + 0x1a], 0x57746e
mov dword [esp + 0x12], 0x666f7250
mov word [esp + 8], 0x6547
mov byte [esp + 0x16], 0x69
mov byte [esp + 0x19], 0x49
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48ad06
push dword [esp + 0x24]
push 0
push esi
push str.Settings
call eax
pop esi
add esp, 0x18
ret
xor eax, eax
pop esi
add esp, 0x18
ret

Function at 0x48ad10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00488280
mov edi, eax
test edi, edi
je 0x48ad93
lea eax, [esp + 0xc]
mov dword [esp + 0x11], 0x656c7564
push eax
push edi
mov word [esp + 0x1f], 0x656c
mov word [esp + 0x24], 0x4565
mov word [esp + 0x14], 0x6547
mov word [esp + 0x27], 0x57
mov word [esp + 0x17], 0x6f4d
mov word [esp + 0x22], 0x6d61
mov byte [esp + 0x16], 0x74
mov byte [esp + 0x21], 0x4e
mov byte [esp + 0x26], 0x78
mov word [esp + 0x1d], 0x6946
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48ad8c
push 0x104
push dword [esp + 0x2c]
push esi
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x48ada0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.004880f0
mov edi, eax
test edi, edi
je 0x48ae24
lea eax, [esp + 0xc]
mov word [esp + 0xf], 0x7461
push eax
push edi
mov word [esp + 0x1b], 0x6c65
mov word [esp + 0x24], 0x6469
mov word [esp + 0x21], 0x6e77
mov byte [esp + 0x26], 0
mov word [esp + 0x14], 0x7243
mov word [esp + 0x1e], 0x6e4b
mov word [esp + 0x19], 0x5765
mov byte [esp + 0x20], 0x6f
mov byte [esp + 0x23], 0x53
mov byte [esp + 0x1d], 0x6c
mov byte [esp + 0x16], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48ae1d
push dword [esp + 0x28]
push dword [esp + 0x28]
push esi
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x48ae30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push esi
push edi
mov esi, 0x80004005
call fcn.00488050
mov edi, eax
test edi, edi
je 0x48ae92
lea eax, [esp + 8]
mov dword [esp + 0x17], 0x576e69
push eax
push edi
mov dword [esp + 0x12], 0x74706d45
mov dword [esp + 0x1b], 0x42656c63
mov dword [esp + 0x16], 0x63655279
mov word [esp + 0x10], 0x4853
mov byte [esp + 0x1a], 0x79
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48ae8b
push 5
push 0
push 0
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
add esp, 0x14
ret

Function at 0x48aea0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00488000
mov edi, eax
test edi, edi
je 0x48af08
lea eax, [esp + 0xc]
mov word [esp + 0x1a], 0x7053
push eax
push edi
mov dword [esp + 0x17], 0x6d655268
mov dword [esp + 0x1d], 0x6c694665
mov dword [esp + 0x24], 0x576365
mov word [esp + 0x14], 0x6150
mov word [esp + 0x1b], 0x766f
mov byte [esp + 0x21], 0x65
mov byte [esp + 0x16], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48af01
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x48af20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.004882d0
mov edi, eax
test edi, edi
je 0x48af87
lea eax, [esp + 0xc]
mov word [esp + 0x19], 0x7274
push eax
push edi
mov dword [esp + 0x18], 0x6d6d6f43
mov dword [esp + 0x24], 0x7845736c
mov dword [esp + 0x14], 0x74696e49
mov dword [esp + 0x1c], 0x6f436e6f
mov byte [esp + 0x23], 0x6f
mov byte [esp + 0x28], 0
mov byte [esp + 0x20], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48af80
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x48af90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
mov esi, 1
call fcn.004880f0
mov edi, eax
test edi, edi
je 0x48b004
lea eax, [esp + 0x10]
mov dword [esp + 0x11], 0x75516765
push eax
push edi
mov dword [esp + 0x1f], 0x6c615679
mov byte [esp + 0x18], 0x52
mov dword [esp + 0x24], 0x57784565
mov byte [esp + 0x28], 0
mov word [esp + 0x1d], 0x7265
mov byte [esp + 0x23], 0x75
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48affd
push dword [esp + 0x34]
push dword [esp + 0x34]
push dword [esp + 0x34]
push 0
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x48b010
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, edx
mov esi, 1
call fcn.00488050
mov edi, eax
test edi, edi
je 0x48b076
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x72434853
push eax
push edi
mov word [esp + 0x21], 0x6f74
mov word [esp + 0x24], 0x79
mov dword [esp + 0x19], 0x44657461
mov dword [esp + 0x1d], 0x63657269
mov byte [esp + 0x23], 0x72
mov byte [esp + 0x18], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48b06f
push ebx
push 0
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x48b0e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00488330
mov edi, eax
test edi, edi
je 0x48b15d
lea eax, [esp + 0x10]
mov dword [esp + 0x15], 0x6556656c
push eax
push edi
mov dword [esp + 0x24], 0x6e496e6f
mov word [esp + 0x2a], 0x6953
mov word [esp + 0x2d], 0x5765
mov word [esp + 0x21], 0x7372
mov byte [esp + 0x23], 0x69
mov dword [esp + 0x18], 0x46746547
mov byte [esp + 0x2f], 0
mov byte [esp + 0x2c], 0x7a
mov word [esp + 0x28], 0x6f66
mov byte [esp + 0x1c], 0x69
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48b156
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x48b170
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.004880f0
mov edi, eax
test edi, edi
je 0x48b1f7
lea eax, [esp + 0xc]
mov word [esp + 0x14], 0x6e41
push eax
push edi
mov dword [esp + 0x1f], 0x74696e49
mov dword [esp + 0x18], 0x65746163
mov word [esp + 0x28], 0x5365
mov dword [esp + 0x14], 0x6f6c6c41
mov dword [esp + 0x24], 0x7a696c61
mov word [esp + 0x2b], 0x64
mov byte [esp + 0x23], 0x69
mov byte [esp + 0x2a], 0x69
mov byte [esp + 0x1e], 0x64
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48b1f0
push dword [esp + 0x4c]
push esi
push esi
push esi
push esi
push esi
push esi
push dword [esp + 0x4c]
push 0x20
push 2
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x1c
ret

Function at 0x48b200
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push esi
push edi
mov esi, 0x80004005
call fcn.00488050
mov edi, eax
test edi, edi
je 0x48b270
lea eax, [esp + 8]
mov dword [esp + 0xb], 0x6f467465
push eax
push edi
mov word [esp + 0x1f], 0x57
mov dword [esp + 0x18], 0x50726564
mov word [esp + 0x1c], 0x7461
mov byte [esp + 0x17], 0x6c
mov word [esp + 0x10], 0x4853
mov byte [esp + 0x12], 0x47
mov byte [esp + 0x1e], 0x68
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48b269
push dword [esp + 0x28]
push 0
push 0
push 0x1c
push 0
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
add esp, 0x14
ret

Function at 0x48b280
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push esi
push edi
xor esi, esi
call fcn.00488000
mov edi, eax
test edi, edi
je 0x48b2e7
lea eax, [esp + 8]
mov dword [esp + 0x17], 0x577365
push eax
push edi
mov word [esp + 0x13], 0x5568
mov dword [esp + 0x1b], 0x63617053
mov word [esp + 0x10], 0x6150
mov dword [esp + 0x16], 0x746f7571
mov byte [esp + 0x1a], 0x65
mov byte [esp + 0x15], 0x6e
mov byte [esp + 0x12], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48b2e0
push 0x6a48f8
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
add esp, 0x14
ret

Function at 0x48b2f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00488330
mov edi, eax
test edi, edi
je 0x48b36d
lea eax, [esp + 0x10]
mov dword [esp + 0x17], 0x73726556
push eax
push edi
mov dword [esp + 0x26], 0x6f666e49
mov word [esp + 0x23], 0x6f69
mov word [esp + 0x19], 0x7465
mov byte [esp + 0x25], 0x6e
mov word [esp + 0x1c], 0x6c69
mov word [esp + 0x2a], 0x57
mov byte [esp + 0x1b], 0x46
mov byte [esp + 0x18], 0x47
mov byte [esp + 0x1e], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48b366
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret