joyce8/EMBER2024-capa huggingface dataset:
Function at 0x488000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
lea eax, [esp]
mov dword [esp + 0x10], 0x6c0064
push eax
mov dword [esp + 0x10], 0x2e0069
mov dword [esp + 4], 0x680053
mov dword [esp + 8], 0x77006c
mov dword [esp + 0xc], 0x700061
mov dword [esp + 0x18], 0x6c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
add esp, 0x18
ret

Function at 0x488050
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
lea eax, [esp]
mov dword [esp + 0xc], 0x2e0032
push eax
mov dword [esp + 0x14], 0x6c0064
mov dword [esp + 8], 0x6c0065
mov dword [esp + 0x18], 0x6c
mov dword [esp + 0xc], 0x33006c
mov dword [esp + 4], 0x680053
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
add esp, 0x18
ret

Function at 0x4880f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, 0x70
mov dword [esp], 0x640041
mov word [esp + 8], ax
mov edx, 0x64
xor eax, eax
mov dword [esp + 0xa], 0x330069
mov word [esp + 0x18], ax
lea eax, [esp]
push eax
mov dword [esp + 0x18], 0x6c006c
mov dword [esp + 0x12], 0x2e0032
mov dword [esp + 8], 0x610076
mov word [esp + 0x16], dx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
add esp, 0x1c
ret

Function at 0x488150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
xor eax, eax
mov dword [esp + 0x10], 0x64002e
mov word [esp + 0x18], ax
lea eax, [esp]
push eax
mov dword [esp + 0x10], 0x320033
mov dword [esp + 4], 0x65004b
mov dword [esp + 8], 0x6e0072
mov dword [esp + 0x18], 0x6c006c
mov dword [esp + 0xc], 0x6c0065
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
add esp, 0x1c
ret

Function at 0x4881a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
xor eax, eax
mov dword [esp], 0x720043
mov word [esp + 0x16], ax
mov eax, 0x79
mov word [esp + 4], ax
lea eax, [esp]
push eax
mov dword [esp + 0x16], 0x6c006c
mov dword [esp + 0xe], 0x320033
mov dword [esp + 0x12], 0x64002e
mov dword [esp + 0xa], 0x740070
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
add esp, 0x18
ret

Function at 0x4881f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
xor eax, eax
mov dword [esp + 0x10], 0x6c006c
mov word [esp + 0x14], ax
lea eax, [esp]
push eax
mov dword [esp + 0xc], 0x760065
mov dword [esp + 4], 0x65006e
mov dword [esp + 0x10], 0x64002e
mov dword [esp + 8], 0x640077
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
add esp, 0x18
ret

Function at 0x4882d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
xor eax, eax
mov dword [esp + 2], 0x6d006f
mov word [esp + 0x18], ax
mov eax, 0x43
mov word [esp], ax
mov eax, 0x64
mov word [esp + 0x12], ax
lea eax, [esp]
push eax
mov dword [esp + 0x18], 0x6c006c
mov dword [esp + 0xe], 0x33006c
mov dword [esp + 0x12], 0x2e0032
mov dword [esp + 0xa], 0x740063
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
add esp, 0x1c
ret
Function at 0x488380
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
xor eax, eax
mov dword [esp + 0x14], 0x6c006c
mov word [esp + 0x18], ax
mov eax, 0x49
mov word [esp], ax
mov eax, 0x68
mov word [esp + 0xa], ax
lea eax, [esp]
push eax
mov dword [esp + 0x14], 0x64002e
mov dword [esp + 0x10], 0x70006c
mov dword [esp + 6], 0x61006d
mov dword [esp + 0xa], 0x650067
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
add esp, 0x1c
ret

Function at 0x488430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
mov ebx, ecx
or esi, 0xffffffff
call fcn.00488000
mov edi, eax
test edi, edi
je 0x4884a8
lea eax, [esp + 0xc]
mov dword [esp + 0xf], 0x72615068
push eax
push edi
mov dword [esp + 0x1f], 0x6f4c6e6f
mov word [esp + 0x15], 0x7461
mov dword [esp + 0x24], 0x6f697461
mov word [esp + 0x28], 0x576e
mov byte [esp + 0x2a], 0
mov word [esp + 0x1c], 0x4965
mov byte [esp + 0x23], 0x63
mov byte [esp + 0x14], 0x50
mov byte [esp + 0x1b], 0x73
mov byte [esp + 0x1e], 0x63
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4884a1
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x18
ret

Function at 0x4884c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 9], 0x46646e69
push eax
mov esi, edx
mov dword [esp + 0x14], 0x6c694674
mov edi, ecx
mov word [esp + 0x19], 0x57
mov byte [esp + 0x18], 0x65
mov word [esp + 0x11], 0x7269
mov byte [esp + 0x13], 0x73
mov byte [esp + 0xc], 0x46
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x488515
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x10
ret
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x10
ret

Function at 0x488520
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 0xe], 0x69467478
push eax
mov esi, edx
mov dword [esp + 0xc], 0x646e6946
mov edi, ecx
mov word [esp + 0x10], 0x654e
mov dword [esp + 0x16], 0x57656c
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x488567
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x10
ret
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret

Function at 0x488570
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
push esi
lea eax, [esp + 4]
mov dword [esp + 8], 0x736f6c43
push eax
mov esi, ecx
mov word [esp + 9], 0x6e69
mov word [esp + 0x10], 0x65
mov byte [esp + 0xb], 0x64
mov byte [esp + 8], 0x46
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4885b3
push esi
call eax
pop esi
add esp, 0xc
ret
xor eax, eax
pop esi
add esp, 0xc
ret
Function at 0x4885c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push esi
lea eax, [esp + 4]
mov word [esp + 0xc], 0x6572
push eax
mov esi, ecx
mov dword [esp + 0x15], 0x577972
mov word [esp + 0xd], 0x4465
mov dword [esp + 8], 0x6f6d6552
mov word [esp + 0x12], 0x7463
mov byte [esp + 0xf], 0x69
mov byte [esp + 0x14], 0x6f
mov byte [esp + 0xc], 0x76
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x488617
push esi
call eax
pop esi
add esp, 0x14
ret
xor eax, eax
pop esi
add esp, 0x14
ret

Function at 0x488620
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
mov ebx, edx
xor esi, esi
call fcn.00488050
mov edi, eax
test edi, edi
je 0x48869c
lea eax, [esp + 0xc]
mov word [esp + 0xf], 0x7465
push eax
push edi
mov dword [esp + 0x1b], 0x61696365
mov word [esp + 0x14], 0x4853
mov dword [esp + 0x28], 0x416874
mov word [esp + 0x23], 0x6564
mov byte [esp + 0x16], 0x47
mov word [esp + 0x26], 0x6150
mov word [esp + 0x19], 0x7053
mov dword [esp + 0x1f], 0x6c6f466c
mov byte [esp + 0x25], 0x72
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x488695
push esi
push dword [esp + 0x2c]
push ebx
push esi
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x18
ret

Function at 0x4886b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00488000
mov edi, eax
test edi, edi
je 0x48870f
lea eax, [esp + 0x10]
mov word [esp + 0x19], 0x4164
push eax
push edi
mov word [esp + 0x1e], 0x6570
mov dword [esp + 0x19], 0x41687461
mov byte [esp + 0x23], 0
mov byte [esp + 0x18], 0x50
mov byte [esp + 0x20], 0x6e
mov byte [esp + 0x1d], 0x70
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x488708
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x488780
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00488000
mov edi, eax
test edi, edi
je 0x4887e5
lea eax, [esp + 0xc]
mov dword [esp + 0xe], 0x73496874
push eax
push edi
mov dword [esp + 0x1b], 0x63657269
mov word [esp + 0x1f], 0x6f74
mov word [esp + 0x14], 0x6150
mov word [esp + 0x22], 0x4179
mov byte [esp + 0x21], 0x72
mov byte [esp + 0x24], 0
mov byte [esp + 0x1a], 0x44
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4887de
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x488860
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, edx
mov esi, 0x800300fe
call fcn.00488050
mov edi, eax
test edi, edi
je 0x4888cb
lea eax, [esp + 0xc]
mov dword [esp + 0x1b], 0x576e69
push eax
push edi
mov dword [esp + 0x19], 0x65527972
mov dword [esp + 0x15], 0x65755148
mov byte [esp + 0x14], 0x53
mov word [esp + 0x21], 0x4265
mov word [esp + 0x1e], 0x6379
mov byte [esp + 0x20], 0x6c
mov byte [esp + 0x1d], 0x63
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4888c4
push ebx
push 0
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x4888e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
call fcn.004880f0
mov esi, eax
test esi, esi
je 0x488968
lea eax, [esp + 0xc]
mov dword [esp + 0x1d], 0x69577373
push eax
push esi
mov dword [esp + 0x2c], 0x57656d61
mov dword [esp + 0x20], 0x63634174
mov dword [esp + 0x19], 0x6c707845
mov dword [esp + 0x15], 0x646c6975
mov word [esp + 0x29], 0x6874
mov byte [esp + 0x24], 0x65
mov word [esp + 0x1e], 0x6963
mov byte [esp + 0x2b], 0x4e
mov byte [esp + 0x1d], 0x69
mov byte [esp + 0x14], 0x42
mov byte [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x488961
push 0
push 1
push 0x30006
push edi
push ebx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
add esp, 0x20
ret

Function at 0x488970
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
mov esi, 1
call fcn.004880f0
mov edi, eax
test edi, edi
je 0x4889e3
lea eax, [esp + 0xc]
mov word [esp + 0xc], 0x6552
push eax
push edi
mov dword [esp + 0x1d], 0x75636553
mov dword [esp + 0x22], 0x797469
mov word [esp + 0x1a], 0x654b
mov word [esp + 0x17], 0x6553
mov byte [esp + 0x1c], 0x79
mov byte [esp + 0x21], 0x72
mov byte [esp + 0x16], 0x67
mov byte [esp + 0x19], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4889dc
push dword [esp + 0x24]
push 4
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x4889f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
mov esi, 1
call fcn.004880f0
mov edi, eax
test edi, edi
je 0x488a51
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0x4b6e6570
push eax
push edi
mov dword [esp + 0x20], 0x78457965
mov word [esp + 0x24], 0x41
mov dword [esp + 0x18], 0x4f676552
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x488a4a
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push 0
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x488a60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
mov esi, 1
call fcn.004880f0
mov edi, eax
test edi, edi
je 0x488ad9
lea eax, [esp + 0x10]
mov dword [esp + 0x15], 0x65746165
push eax
push edi
mov dword [esp + 0x22], 0x78457965
mov word [esp + 0x18], 0x6552
mov word [esp + 0x1b], 0x7243
mov word [esp + 0x26], 0x41
mov byte [esp + 0x21], 0x4b
mov byte [esp + 0x1a], 0x67
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x488ad2
push 0
push dword [esp + 0x3c]
push 0
push dword [esp + 0x3c]
push 4
push 0
push 0
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x488af0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
mov esi, 1
call fcn.004880f0
mov edi, eax
test edi, edi
je 0x488b63
lea eax, [esp + 0x10]
mov dword [esp + 0x11], 0x65536765
push eax
push edi
mov word [esp + 0x24], 0x4178
mov dword [esp + 0x1f], 0x65756c61
mov byte [esp + 0x26], 0
mov byte [esp + 0x23], 0x45
mov word [esp + 0x1d], 0x5674
mov byte [esp + 0x18], 0x52
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x488b5c
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push 0
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x488b70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00488230
mov edi, eax
test edi, edi
je 0x488be9
lea eax, [esp + 0x10]
mov word [esp + 0x24], 0x7373
push eax
push edi
mov dword [esp + 0x1f], 0x6854776f
mov dword [esp + 0x27], 0x636f7250
mov dword [esp + 0x19], 0x69577465
mov word [esp + 0x2f], 0x64
mov dword [esp + 0x23], 0x64616572
mov byte [esp + 0x2b], 0x65
mov byte [esp + 0x2e], 0x49
mov word [esp + 0x1d], 0x646e
mov byte [esp + 0x18], 0x47
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x488be2
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret

Function at 0x488c00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push esi
push edi
xor esi, esi
call fcn.00488230
mov edi, eax
test edi, edi
je 0x488c6d
lea eax, [esp + 8]
mov dword [esp + 8], 0x46746547
push eax
push edi
mov word [esp + 0x17], 0x7267
mov dword [esp + 0x1a], 0x57646e75
mov word [esp + 0x22], 0x77
mov word [esp + 0x1f], 0x646e
mov word [esp + 0x14], 0x726f
mov byte [esp + 0x1e], 0x69
mov byte [esp + 0x21], 0x6f
mov byte [esp + 0x19], 0x6f
mov byte [esp + 0x16], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x488c66
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
add esp, 0x14
ret
Function at 0x488c80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
lea eax, [esp + 4]
mov dword [esp + 7], 0x76697244
push eax
mov esi, ecx
mov dword [esp + 0x10], 0x65707954
mov word [esp + 8], 0x6547
mov word [esp + 0x14], 0x57
mov byte [esp + 0xf], 0x65
mov byte [esp + 0xa], 0x74
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x488ccb
push esi
call eax
pop esi
add esp, 0x10
ret
xor eax, eax
pop esi
add esp, 0x10
ret

Function at 0x488ce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00487f00
mov edi, eax
test edi, edi
je 0x488d51
lea eax, [esp + 0x10]
mov word [esp + 0x10], 0x4d43
push eax
push edi
mov dword [esp + 0x1b], 0x5f746547
mov dword [esp + 0x1f], 0x69766544
mov word [esp + 0x25], 0x495f
mov word [esp + 0x28], 0x57
mov byte [esp + 0x1a], 0x5f
mov word [esp + 0x23], 0x6563
mov byte [esp + 0x27], 0x44
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x488d4a
push esi
push 0x400
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x488d60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00487f60
mov edi, eax
test edi, edi
je 0x488dd1
lea eax, [esp + 0x10]
mov dword [esp + 0x11], 0x7265746e
push eax
push edi
mov word [esp + 0x1f], 0x5274
mov word [esp + 0x22], 0x6461
mov dword [esp + 0x25], 0x656c69
mov byte [esp + 0x21], 0x65
mov word [esp + 0x1d], 0x656e
mov byte [esp + 0x18], 0x49
mov byte [esp + 0x24], 0x46
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x488dca
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x488de0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00487f60
mov edi, eax
test edi, edi
je 0x488e4b
lea eax, [esp + 0x10]
mov dword [esp + 0x11], 0x7265746e
push eax
push edi
mov dword [esp + 0x25], 0x576c72
mov dword [esp + 0x20], 0x6e65704f
mov word [esp + 0x1e], 0x7465
mov byte [esp + 0x18], 0x49
mov byte [esp + 0x1d], 0x6e
mov byte [esp + 0x24], 0x55
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x488e44
push esi
push 0x4000000
push esi
push esi
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x488e60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00487f60
mov edi, eax
test edi, edi
je 0x488eba
lea eax, [esp + 0x10]
mov dword [esp + 0x1a], 0x576e65
push eax
push edi
mov dword [esp + 0x1d], 0x4f74656e
mov dword [esp + 0x19], 0x7265746e
mov byte [esp + 0x18], 0x49
mov byte [esp + 0x21], 0x70
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x488eb3
push esi
push esi
push esi
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x488ed0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00487f60
mov edi, eax
test edi, edi
je 0x488f47
lea eax, [esp + 0x10]
mov word [esp + 0x12], 0x7074
push eax
push edi
mov word [esp + 0x1d], 0x6575
mov word [esp + 0x22], 0x666e
mov word [esp + 0x25], 0x57
mov word [esp + 0x18], 0x7448
mov word [esp + 0x20], 0x4979
mov byte [esp + 0x1c], 0x51
mov byte [esp + 0x1f], 0x72
mov byte [esp + 0x24], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x488f40
push esi
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x488f60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00487f60
mov edi, eax
test edi, edi
je 0x488fbf
lea eax, [esp + 0xc]
mov dword [esp + 0x16], 0x4865736f
push eax
push edi
mov dword [esp + 0x24], 0x656c64
mov dword [esp + 0x14], 0x65746e49
mov dword [esp + 0x1a], 0x6c437465
mov word [esp + 0x22], 0x6e61
mov word [esp + 0x18], 0x6e72
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x488fb8
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x488fd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00487f60
mov edi, eax
test edi, edi
je 0x489036
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0x646e6553
push eax
push edi
mov dword [esp + 0x20], 0x75716552
mov dword [esp + 0x18], 0x70747448
mov dword [esp + 0x24], 0x57747365
mov byte [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48902f
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x489040
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00487f60
mov edi, eax
test edi, edi
je 0x4890a7
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0x74656e72
push eax
push edi
mov dword [esp + 0x22], 0x74704f74
mov dword [esp + 0x26], 0x576e6f69
mov dword [esp + 0x18], 0x65746e49
mov word [esp + 0x20], 0x6553
mov byte [esp + 0x2a], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4890a0
push 4
push dword [esp + 0x2c]
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x4890c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00487f60
mov edi, eax
test edi, edi
je 0x489131
lea eax, [esp + 0xc]
mov dword [esp + 0x13], 0x65755174
push eax
push edi
mov dword [esp + 0x16], 0x6e726574
mov byte [esp + 0x1a], 0x65
mov word [esp + 0x14], 0x6e49
mov dword [esp + 0x25], 0x576e6f
mov dword [esp + 0x20], 0x74704f79
mov byte [esp + 0x1f], 0x72
mov byte [esp + 0x24], 0x69
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48912a
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push 0x1f
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x18
ret

Function at 0x489140
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00487f60
mov edi, eax
test edi, edi
je 0x4891aa
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x70747448
push eax
push edi
mov dword [esp + 0x24], 0x57747365
mov dword [esp + 0x20], 0x75716552
mov dword [esp + 0x1c], 0x6e65704f
mov byte [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4891a3
push esi
push dword [esp + 0x3c]
push esi
push esi
push str.HTTP_1.0
push dword [esp + 0x3c]
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x4891c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00487f60
mov edi, eax
test edi, edi
je 0x489239
lea eax, [esp + 0x10]
mov dword [esp + 0x1a], 0x63656e6e
push eax
push edi
mov word [esp + 0x18], 0x6e49
mov word [esp + 0x1e], 0x7465
mov word [esp + 0x1b], 0x7265
mov word [esp + 0x27], 0x57
mov word [esp + 0x20], 0x6f43
mov byte [esp + 0x26], 0x74
mov byte [esp + 0x1d], 0x6e
mov byte [esp + 0x1a], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x489232
push esi
push esi
push 3
push esi
push esi
push dword [esp + 0x3c]
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret