joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48b380
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push esi
push edi
mov esi, ecx
call fcn.00488000
mov edi, eax
test edi, edi
je 0x48b3de
lea eax, [esp + 8]
mov word [esp + 0xc], 0x6946
push eax
push edi
mov dword [esp + 0x1a], 0x614e656c
mov dword [esp + 0x1e], 0x57656d
mov word [esp + 0x11], 0x7461
mov dword [esp + 0x16], 0x6946646e
mov byte [esp + 0x13], 0x68
mov byte [esp + 0x10], 0x50
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48b3d7
push esi
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
add esp, 0x14
ret

Function at 0x48b3f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
mov esi, 1
call fcn.004880f0
mov edi, eax
test edi, edi
je 0x48b45d
lea eax, [esp + 0x10]
mov dword [esp + 0x1a], 0x57784565
push eax
push edi
mov dword [esp + 0x19], 0x65536765
mov byte [esp + 0x18], 0x52
mov dword [esp + 0x1e], 0x756c6156
mov byte [esp + 0x26], 0
mov byte [esp + 0x1d], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48b456
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push 0
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x48b470
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push esi
lea eax, [esp + 4]
mov dword [esp + 4], 0x65646957
push eax
mov esi, ecx
mov dword [esp + 0xc], 0x72616843
mov dword [esp + 0x12], 0x746c754d
mov dword [esp + 0x18], 0x657479
mov word [esp + 0x16], 0x4269
mov word [esp + 0x10], 0x6f54
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48b4d7
push 0
push 0
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push 0
push esi
call eax
pop esi
add esp, 0x14
ret
xor eax, eax
pop esi
add esp, 0x14
ret

Function at 0x48b4e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
mov esi, 0x402
call fcn.00488050
mov edi, eax
test edi, edi
je 0x48b542
lea eax, [esp + 0xc]
mov dword [esp + 0x13], 0x61726570
push eax
push edi
mov dword [esp + 0x20], 0x576e6f69
mov dword [esp + 0x16], 0x656c6946
mov byte [esp + 0x24], 0
mov byte [esp + 0x1f], 0x74
mov byte [esp + 0x1a], 0x4f
mov word [esp + 0x14], 0x4853
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48b53b
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x48b550
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00488380
mov edi, eax
test edi, edi
je 0x48b5d8
lea eax, [esp + 0xc]
mov dword [esp + 0x1f], 0x61636966
push eax
push edi
mov dword [esp + 0x1d], 0x74617265
mov dword [esp + 0x21], 0x72654365
mov dword [esp + 0x2b], 0x736574
mov word [esp + 0x1a], 0x756e
mov dword [esp + 0x15], 0x6567616d
mov word [esp + 0x25], 0x6974
mov byte [esp + 0x14], 0x49
mov byte [esp + 0x1c], 0x6d
mov byte [esp + 0x19], 0x45
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48b5d1
push 0x80
push dword [esp + 0x34]
push dword [esp + 0x34]
push 0xff
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x1c
ret

Function at 0x48b5f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00488380
mov edi, eax
test edi, edi
je 0x48b666
lea eax, [esp + 0x10]
mov word [esp + 0x19], 0x7265
push eax
push edi
mov dword [esp + 0x1c], 0x74654765
mov dword [esp + 0x18], 0x67616d49
mov dword [esp + 0x28], 0x44657461
mov dword [esp + 0x2c], 0x617461
mov dword [esp + 0x23], 0x69666974
mov byte [esp + 0x27], 0x63
mov byte [esp + 0x20], 0x43
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48b65f
push dword [esp + 0x30]
push dword [esp + 0x30]
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x48b670
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00488000
mov edi, eax
test edi, edi
je 0x48b6e4
lea eax, [esp + 0xc]
mov word [esp + 0x10], 0x7349
push eax
push edi
mov word [esp + 0x20], 0x726f
mov word [esp + 0x15], 0x7461
mov word [esp + 0x1d], 0x6365
mov word [esp + 0x1a], 0x6944
mov byte [esp + 0x14], 0x50
mov byte [esp + 0x17], 0x68
mov word [esp + 0x23], 0x57
mov byte [esp + 0x1f], 0x74
mov byte [esp + 0x22], 0x79
mov byte [esp + 0x1c], 0x72
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48b6dd
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x48b750
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00488000
mov edi, eax
test edi, edi
je 0x48b7c9
lea eax, [esp + 0xc]
mov dword [esp + 0x13], 0x79427461
push eax
push edi
mov dword [esp + 0x21], 0x657a6953
mov word [esp + 0x25], 0x57
mov word [esp + 0x15], 0x7274
mov word [esp + 0x18], 0x726f
mov word [esp + 0x1f], 0x6574
mov byte [esp + 0x17], 0x46
mov byte [esp + 0x1a], 0x6d
mov byte [esp + 0x14], 0x53
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48b7c2
push 0xff
push ebx
push dword [esp + 0x30]
push dword [esp + 0x30]
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x48b7e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00488000
mov edi, eax
test edi, edi
je 0x48b840
lea eax, [esp + 0xc]
mov dword [esp + 0xf], 0x6c694668
push eax
push edi
mov dword [esp + 0x1d], 0x74736978
mov word [esp + 0x21], 0x5773
mov byte [esp + 0x23], 0
mov word [esp + 0x15], 0x7461
mov word [esp + 0x1b], 0x4565
mov byte [esp + 0x14], 0x50
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48b839
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x48b850
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, edx
xor esi, esi
call fcn.00488050
mov edi, eax
test edi, edi
je 0x48b8b2
lea eax, [esp + 0xc]
mov dword [esp + 0x11], 0x4d726142
push eax
push edi
mov word [esp + 0x1d], 0x7365
mov dword [esp + 0x20], 0x656761
mov word [esp + 0x17], 0x7070
mov word [esp + 0x14], 0x4853
mov byte [esp + 0x16], 0x41
mov byte [esp + 0x1f], 0x73
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48b8ab
push ebx
push 5
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x48b920
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
mov esi, 1
call fcn.00488000
mov edi, eax
test edi, edi
je 0x48b989
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x65534853
push eax
push edi
mov dword [esp + 0x1d], 0x756c6156
mov byte [esp + 0x1c], 0x74
mov word [esp + 0x21], 0x5765
mov byte [esp + 0x23], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48b982
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x48b9a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
mov esi, 1
call fcn.00488000
mov edi, eax
test edi, edi
je 0x48ba00
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x65444853
push eax
push edi
mov dword [esp + 0x23], 0x576575
mov word [esp + 0x1c], 0x656c
mov dword [esp + 0x1f], 0x6c615665
mov byte [esp + 0x1e], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48b9f9
push dword [esp + 0x24]
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x48ba10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00488330
mov edi, eax
test edi, edi
je 0x48ba78
lea eax, [esp + 0xc]
mov word [esp + 0x16], 0x756c
push eax
push edi
mov word [esp + 0x21], 0x57
mov dword [esp + 0x18], 0x79726575
mov dword [esp + 0x14], 0x51726556
mov byte [esp + 0x20], 0x65
mov word [esp + 0x1c], 0x6156
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48ba71
push dword [esp + 0x24]
push dword [esp + 0x24]
push 0x657520
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x48ba90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
lea eax, [esp + 4]
mov word [esp + 7], 0x7250
push eax
mov esi, ecx
mov word [esp + 8], 0x6547
mov dword [esp + 0xe], 0x73736563
mov word [esp + 0x12], 0x6449
mov byte [esp + 0xd], 0x6f
mov byte [esp + 0x14], 0
mov byte [esp + 0xa], 0x74
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48badf
push esi
call eax
pop esi
add esp, 0x10
ret
xor eax, eax
pop esi
add esp, 0x10
ret

Function at 0x48baf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
push esi
push edi
lea eax, [esp + 8]
mov word [esp + 0x14], 0x5473
push eax
mov esi, edx
mov dword [esp + 0x11], 0x6f72506e
mov edi, ecx
mov dword [esp + 0x21], 0x746365
mov word [esp + 0x1b], 0x6f4a
mov dword [esp + 0xc], 0x69737341
mov word [esp + 0x1e], 0x624f
mov word [esp + 0x16], 0x7365
mov byte [esp + 0x1a], 0x6f
mov byte [esp + 0x1d], 0x62
mov byte [esp + 0x10], 0x67
mov byte [esp + 0x20], 0x6a
mov byte [esp + 0x15], 0x63
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48bb65
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x1c
ret
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret
Function at 0x48bb70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
mov esi, 0x80004005
call fcn.004883e0
mov edi, eax
test edi, edi
je 0x48bbda
lea eax, [esp + 0x10]
mov dword [esp + 0x1b], 0x4449534c
push eax
push edi
mov word [esp + 0x20], 0x6d6f
mov word [esp + 0x1d], 0x4667
mov dword [esp + 0x18], 0x69727453
mov byte [esp + 0x22], 0x43
mov byte [esp + 0x27], 0
mov byte [esp + 0x1c], 0x6e
mov byte [esp + 0x1f], 0x72
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48bbd3
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x48bbf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00488230
mov edi, eax
test edi, edi
je 0x48bc56
lea eax, [esp + 0x10]
mov word [esp + 0x13], 0x6173
push eax
push edi
mov dword [esp + 0x22], 0x577845
mov dword [esp + 0x1e], 0x786f4265
mov word [esp + 0x18], 0x654d
mov byte [esp + 0x1a], 0x73
mov byte [esp + 0x1d], 0x67
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48bc4f
push 9
push 0x10
push 0x65d238
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x48bc60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00488050
mov edi, eax
test edi, edi
je 0x48bcd0
lea eax, [esp + 0x10]
mov dword [esp + 0x1f], 0x577667
push eax
push edi
mov word [esp + 0x18], 0x6f43
mov word [esp + 0x21], 0x656e
mov word [esp + 0x24], 0x416f
mov dword [esp + 0x1b], 0x646e616d
mov word [esp + 0x1f], 0x694c
mov byte [esp + 0x1a], 0x6d
mov byte [esp + 0x23], 0x54
mov byte [esp + 0x26], 0x72
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48bcc9
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x48bce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00488230
mov edi, eax
test edi, edi
je 0x48bd37
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0x6e65696c
push eax
push edi
mov dword [esp + 0x21], 0x74636552
mov dword [esp + 0x18], 0x43746547
mov byte [esp + 0x20], 0x74
mov byte [esp + 0x25], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48bd30
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x48bd50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.004880a0
mov edi, eax
test edi, edi
je 0x48bdb8
lea eax, [esp + 0xc]
mov dword [esp + 0x16], 0x6f736552
push eax
push edi
mov dword [esp + 0x14], 0x6f6d6552
mov dword [esp + 0x1a], 0x746e6f46
mov word [esp + 0x18], 0x6576
mov word [esp + 0x26], 0x57
mov word [esp + 0x23], 0x6372
mov byte [esp + 0x22], 0x75
mov byte [esp + 0x25], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48bdb1
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x48bdd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 8], 0x45746547
push eax
mov esi, edx
mov dword [esp + 0x15], 0x72506564
mov edi, ecx
mov word [esp + 0x1c], 0x7373
mov word [esp + 0x19], 0x636f
mov dword [esp + 0x11], 0x6f437469
mov byte [esp + 0x1e], 0
mov byte [esp + 0x1b], 0x65
mov byte [esp + 0x10], 0x78
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48be2d
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x14
ret
pop edi
xor eax, eax
pop esi
add esp, 0x14
ret

Function at 0x48be90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push esi
push edi
lea eax, [esp + 8]
mov word [esp + 8], 0x6547
push eax
mov esi, edx
mov dword [esp + 0xf], 0x676e6f4c
mov edi, ecx
mov word [esp + 0x14], 0x7461
mov word [esp + 0x1a], 0x5765
mov word [esp + 0x17], 0x614e
mov byte [esp + 0xe], 0x74
mov byte [esp + 0x16], 0x68
mov byte [esp + 0x19], 0x6d
mov byte [esp + 0x13], 0x50
mov byte [esp + 0x1c], 0
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48befa
push 0x104
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x14
ret
pop edi
xor eax, eax
pop esi
add esp, 0x14
ret

Function at 0x48bf10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
lea eax, [esp + 8]
mov word [esp + 0xb], 0x6e45
push eax
mov esi, edx
mov dword [esp + 0x1b], 0x61697261
mov edi, ecx
mov word [esp + 0xc], 0x6547
mov dword [esp + 0x11], 0x6f726976
mov dword [esp + 0x15], 0x6e656d6e
mov dword [esp + 0x20], 0x57656c
mov byte [esp + 0xe], 0x74
mov word [esp + 0x19], 0x5674
mov byte [esp + 0x1f], 0x62
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48bf7c
push 0x104
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x18
ret
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret
Function at 0x48bf90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 9], 0x65747379
push eax
mov esi, edx
mov dword [esp + 0x1c], 0x656d6954
mov edi, ecx
mov dword [esp + 0x18], 0x656c6946
mov word [esp + 0x11], 0x546d
mov dword [esp + 0x14], 0x6f54656d
mov byte [esp + 0x13], 0x69
mov byte [esp + 0x20], 0
mov byte [esp + 0xc], 0x53
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48bfee
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x18
ret
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret

Function at 0x48c000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 0x14], 0x466f5465
push eax
mov esi, edx
mov dword [esp + 0x1c], 0x54656c69
mov edi, ecx
mov word [esp + 0xf], 0x6c61
mov word [esp + 0xc], 0x6f4c
mov dword [esp + 0x12], 0x54656c69
mov dword [esp + 0x20], 0x656d69
mov byte [esp + 0xe], 0x63
mov byte [esp + 0x11], 0x46
mov word [esp + 0x16], 0x6d69
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48c067
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x18
ret
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret

Function at 0x48c070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
lea eax, [esp + 4]
mov dword [esp + 0x10], 0x46734165
push eax
mov esi, ecx
mov dword [esp + 0xf], 0x69546d65
mov dword [esp + 0x18], 0x54656c69
mov word [esp + 0xd], 0x7473
mov dword [esp + 8], 0x53746547
mov dword [esp + 0x1c], 0x656d69
mov byte [esp + 0xc], 0x79
mov byte [esp + 0x13], 0x6d
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48c0c7
push esi
call eax
pop esi
add esp, 0x18
ret

Function at 0x48c160
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 8], 0x53746547
push eax
mov esi, edx
mov dword [esp + 0x11], 0x5074726f
mov edi, ecx
mov dword [esp + 0x1a], 0x57656d
mov word [esp + 0x18], 0x614e
mov word [esp + 0x15], 0x7461
mov byte [esp + 0x17], 0x68
mov byte [esp + 0x10], 0x68
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48c1bd
push 0x104
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x14
ret
pop edi
xor eax, eax
pop esi
add esp, 0x14
ret
Function at 0x48c1d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 0x15], 0x656c6966
push eax
mov esi, edx
mov dword [esp + 0x14], 0x72506574
mov edi, ecx
mov word [esp + 0x1e], 0x6365
mov word [esp + 0xc], 0x6547
mov dword [esp + 0xf], 0x76697250
mov word [esp + 0x24], 0x57
mov word [esp + 0x21], 0x6f69
mov byte [esp + 0x13], 0x61
mov byte [esp + 0x20], 0x74
mov byte [esp + 0xe], 0x74
mov byte [esp + 0x1d], 0x53
mov byte [esp + 0x18], 0x6f
mov byte [esp + 0x23], 0x6e
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48c253
push dword [esp + 0x2c]
push 0x7fff
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x1c
ret
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret

Function at 0x48c260
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push esi
lea eax, [esp + 4]
mov dword [esp + 0xd], 0x756c6f56
push eax
mov esi, ecx
mov dword [esp + 0xd], 0x74737269
mov word [esp + 0x16], 0x5765
mov dword [esp + 9], 0x46646e69
mov byte [esp + 0x18], 0
mov byte [esp + 0x15], 0x6d
mov byte [esp + 8], 0x46
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48c2b6
push 0x104
push esi
call eax
pop esi
add esp, 0x14
ret
or eax, 0xffffffff
pop esi
add esp, 0x14
ret

Function at 0x48c2c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
mov esi, SysReAllocString
call fcn.004880a0
mov edi, eax
test edi, edi
je 0x48c330
lea eax, [esp + 0x10]
mov dword [esp + 0x18], 0x61726168
push eax
push edi
mov dword [esp + 0x24], 0x72657463
mov dword [esp + 0x18], 0x54746553
mov word [esp + 0x29], 0x7478
mov dword [esp + 0x1c], 0x43747865
mov word [esp + 0x2c], 0x61
mov byte [esp + 0x2b], 0x72
mov byte [esp + 0x28], 0x45
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48c329
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x48c340
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
push esi
lea eax, [esp + 4]
mov dword [esp + 4], 0x65736552
push eax
mov esi, ecx
mov dword [esp + 0xc], 0x65764574
mov word [esp + 0x11], 0x74
mov byte [esp + 0x10], 0x6e
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48c37f
push esi
call eax
pop esi
add esp, 0xc
ret
xor eax, eax
pop esi
add esp, 0xc
ret

Function at 0x48c390
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push esi
lea eax, [esp + 4]
mov dword [esp + 0x11], 0x577463
push eax
mov esi, edx
mov dword [esp + 9], 0x74616572
mov word [esp + 0x10], 0x4f62
mov word [esp + 0xd], 0x4a65
mov byte [esp + 8], 0x43
mov word [esp + 0x13], 0x656a
mov byte [esp + 0x12], 0x62
mov byte [esp + 0xf], 0x6f
call fcn.00488150
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48c3e9
push esi
push 0
call eax
pop esi
add esp, 0x14
ret
xor eax, eax
pop esi
add esp, 0x14
ret