joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10047740
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x10056004]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
lea eax, [esp + 8]
mov word [esp + 0x13], 0x64
push eax
mov edi, ecx
mov dword [esp + 0xe], 0x656d7573
mov dword [esp + 0x12], 0x65726854
mov word [esp + 0xc], 0x6552
mov byte [esp + 0x16], 0x61
call fcn.10047ef0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x100477a8
push edi
mov ecx, esi
call dword [0x1004a1b8]
call esi
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10002214
add esp, 0x14
ret
mov ecx, dword [esp + 0x18]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, esp
call fcn.10002214
add esp, 0x14
ret

Function at 0x100477c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x10056004]
xor eax, esp
mov dword [esp + 0x1c], eax
lea eax, [esp]
mov dword [esp + 0x10], 0x65536c61
push esi
push eax
mov dword [esp + 0x1e], 0x6e6f69
mov dword [esp + 0xe], 0x657a696c
mov dword [esp + 0xa], 0x61697469
mov word [esp + 0x1c], 0x7463
mov word [esp + 0x13], 0x6972
mov word [esp + 8], 0x6e49
mov word [esp + 0x16], 0x6369
mov byte [esp + 0x12], 0x43
mov byte [esp + 0x15], 0x74
call fcn.10047ef0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1004783a
push 0x1007c68c
mov ecx, esi
call dword [0x1004a1b8]
call esi
mov ecx, dword [esp + 0x20]
pop esi
xor ecx, esp
call fcn.10002214
add esp, 0x20
ret

Function at 0x100478e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x10056004]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
push ebp
push esi
push edi
mov ebp, edx
mov dword [esp + 0xc], eax
mov esi, 1
call fcn.10047ea0
mov edi, eax
test edi, edi
je 0x1004796b
push ebx
lea eax, [esp + 0x14]
mov dword [esp + 0x1e], 0x417845
push eax
push edi
mov word [esp + 0x1c], 0x6552
mov dword [esp + 0x1f], 0x6e65704f
mov word [esp + 0x23], 0x654b
mov byte [esp + 0x1e], 0x67
mov byte [esp + 0x25], 0x79
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x10047963
push dword [esp + 0x10]
mov ecx, ebx
push 0x20019
push 0
push ebp
push reloc.oledlg.dll_OleUIAddVerbMenuA
call dword [0x1004a1b8]
call ebx
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop ebx
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10002214
add esp, 0x18
ret
Function at 0x10047980
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x10056004]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
push edi
lea eax, [esp + 8]
mov word [esp + 0x11], 0x6946
push eax
mov edi, edx
mov dword [esp + 0x10], 0x6c75646f
mov dword [esp + 0xc], 0x4d746547
mov word [esp + 0x1a], 0x6d61
mov byte [esp + 0x14], 0x65
mov word [esp + 0x1d], 0x41
mov word [esp + 0x18], 0x4e65
mov byte [esp + 0x17], 0x6c
mov byte [esp + 0x1c], 0x65
call fcn.10047ef0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10047a07
push 0x104
push edi
push 0
mov ecx, esi
call dword [0x1004a1b8]
call esi
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10002214
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.10002214
add esp, 0x18
ret

Function at 0x10047a20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x10056004]
xor eax, esp
mov dword [esp + 0x10], eax
push ebp
push esi
push edi
mov ebp, edx
xor edi, edi
call fcn.10047e50
mov esi, eax
test esi, esi
je 0x10047a9e
push ebx
lea eax, [esp + 0x10]
mov word [esp + 0x1c], 0x7845
push eax
push esi
mov byte [esp + 0x26], 0
mov dword [esp + 0x1f], 0x6f6f4874
mov dword [esp + 0x1b], 0x78654e6c
mov word [esp + 0x19], 0x6c61
mov byte [esp + 0x23], 0x6b
mov byte [esp + 0x18], 0x43
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x10047a96
push dword [esp + 0x2c]
mov ecx, ebx
push dword [esp + 0x2c]
push ebp
push edi
call dword [0x1004a1b8]
call ebx
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop ebx
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10002214
add esp, 0x14
ret

Function at 0x10047ac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword [0x10056004]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
lea eax, [esp + 0xc]
mov word [esp + 0x1a], 0x6e6f
push eax
mov ebx, edx
mov dword [esp + 0x19], 0x74637572
mov edi, ecx
mov word [esp + 0x21], 0x6361
mov word [esp + 0x16], 0x736e
mov word [esp + 0x24], 0x65
mov byte [esp + 0x20], 0x43
mov dword [esp + 0x11], 0x6873756c
mov byte [esp + 0x18], 0x74
mov byte [esp + 0x10], 0x46
mov byte [esp + 0x23], 0x68
mov byte [esp + 0x15], 0x49
mov byte [esp + 0x1d], 0x69
call fcn.10047ef0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10047b58
push dword [esp + 0x2c]
mov ecx, esi
push ebx
push edi
call dword [0x1004a1b8]
call esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.10002214
add esp, 0x1c
ret
mov ecx, dword [esp + 0x24]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10002214
add esp, 0x1c
ret
Function at 0x10047b70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov eax, dword [0x10056004]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x30]
push ebp
push esi
mov dword [esp + 0xc], eax
mov ebp, ecx
mov eax, dword [esp + 0x3c]
mov esi, 1
push edi
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], eax
call fcn.10047ea0
mov edi, eax
test edi, edi
je 0x10047c13
push ebx
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0x41784565
push eax
push edi
mov dword [esp + 0x2c], 0x756c6156
mov word [esp + 0x27], 0x7551
mov word [esp + 0x24], 0x6552
mov word [esp + 0x29], 0x7265
mov byte [esp + 0x2b], 0x79
mov byte [esp + 0x26], 0x67
mov byte [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x10047c0b
push dword [esp + 0x10]
mov ecx, ebx
push dword [esp + 0x18]
push 0
push 0
push dword [esp + 0x28]
push ebp
call dword [0x1004a1b8]
call ebx
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop ebx
mov ecx, dword [esp + 0x2c]
mov eax, esi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10002214
add esp, 0x24
ret

Function at 0x10047c30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x10056004]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push esi
push edi
lea eax, [esp + 0xc]
mov word [esp + 0x13], 0x4e32
push eax
mov ebx, edx
mov word [esp + 0x14], 0x6461
mov edi, ecx
mov dword [esp + 0x19], 0x747865
mov byte [esp + 0x16], 0x33
mov word [esp + 0x11], 0x7268
mov byte [esp + 0x13], 0x65
mov byte [esp + 0x10], 0x54
call fcn.10047ef0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10047ca6
push ebx
push edi
mov ecx, esi
call dword [0x1004a1b8]
call esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10002214
add esp, 0x14
ret
mov ecx, dword [esp + 0x1c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10002214
add esp, 0x14
ret

Function at 0x10047cc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x10056004]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push esi
push edi
lea eax, [esp + 0xc]
mov dword [esp + 0xf], 0x33646165
push eax
mov ebx, edx
mov word [esp + 0x19], 0x7269
mov edi, ecx
mov word [esp + 0x1c], 0x74
mov word [esp + 0x17], 0x4632
mov word [esp + 0x11], 0x7268
mov byte [esp + 0x10], 0x54
mov byte [esp + 0x1b], 0x73
call fcn.10047ef0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10047d38
push ebx
push edi
mov ecx, esi
call dword [0x1004a1b8]
call esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10002214
add esp, 0x14
ret
mov ecx, dword [esp + 0x1c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10002214
add esp, 0x14
ret
Function at 0x10047d50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x10056004]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 0x1c], 0x746f6873
push eax
mov edi, edx
mov dword [esp + 0xe], 0x65746165
mov word [esp + 0x1a], 0x3233
mov word [esp + 0x14], 0x6c6f
mov word [esp + 0xc], 0x7243
mov word [esp + 0x17], 0x6c65
mov word [esp + 0x1d], 0x616e
mov word [esp + 0x12], 0x6f54
mov byte [esp + 0x16], 0x68
mov byte [esp + 0x1f], 0x70
mov byte [esp + 0x24], 0
mov byte [esp + 0x19], 0x70
mov byte [esp + 0x1c], 0x53
call fcn.10047ef0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10047dea
push edi
push 4
mov ecx, esi
call dword [0x1004a1b8]
call esi
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.10002214
add esp, 0x20
ret
mov ecx, dword [esp + 0x24]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, esp
call fcn.10002214
add esp, 0x20
ret

Function at 0x10047e50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x10056004]
xor eax, esp
mov dword [esp + 0xc], eax
lea ecx, [esp]
mov word [esp + 4], 0x3233
mov dword [esp + 6], 0x6c6c642e
mov word [esp + 1], 0x6573
mov byte [esp + 0xa], 0
mov byte [esp], 0x55
mov byte [esp + 3], 0x72
call fcn.10046ea0
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.10002214
add esp, 0x10
ret

Function at 0x10047ea0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x10056004]
xor eax, esp
mov dword [esp + 0x10], eax
lea ecx, [esp]
mov dword [esp + 9], 0x6c6c64
mov dword [esp + 5], 0x2e323369
mov word [esp + 3], 0x7061
mov word [esp], 0x6441
mov byte [esp + 2], 0x76
call fcn.10046ea0
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10002214
add esp, 0x14
ret

Function at 0x10047ef0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x10056004]
xor eax, esp
mov dword [esp + 0x10], eax
lea eax, [esp]
mov dword [esp + 7], 0x6c642e32
push eax
mov word [esp + 0xf], 0x6c
mov dword [esp + 5], 0x656e7265
mov word [esp + 9], 0x336c
mov byte [esp + 4], 0x4b
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10002214
add esp, 0x14
ret

Function at 0x10048000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x10056004]
xor eax, esp
mov dword [esp + 0x14], eax
lea eax, [esp]
mov word [esp + 0xf], 0x64
push esi
push eax
mov dword [esp + 0xe], 0x746e6572
mov word [esp + 8], 0x6547
mov word [esp + 0xb], 0x7543
mov dword [esp + 0x12], 0x65726854
mov byte [esp + 0xa], 0x74
mov byte [esp + 0xd], 0x72
mov byte [esp + 0x16], 0x61
call fcn.10047ef0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10048073
mov ecx, esi
call dword [0x1004a1b8]
call esi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10002214
add esp, 0x18
ret
mov ecx, dword [esp + 0x18]
xor eax, eax
pop esi
xor ecx, esp
call fcn.10002214
add esp, 0x18
ret
Function at 0x100480c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x120
mov eax, dword [0x10056004]
xor eax, esp
mov dword [esp + 0x11c], eax
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x10048179
push ecx
lea edx, [esp + 0x14]
call fcn.10047980
add esp, 4
mov dword [esp + 6], 0x75732074
lea eax, [esp]
mov dword [esp + 0xc], 0x74726f
mov dword [esp + 1], 0x6174736e
mov word [esp + 0xa], 0x7070
push eax
lea eax, [esp + 0x14]
mov byte [esp + 4], 0x69
push eax
mov byte [esp + 0xd], 0x6e
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x100481a5
mov edx, sym.gphelper.dll_fafk4j
mov ecx, 0x1007c570
call fcn.10049480
test eax, eax
je 0x100481a5
mov edx, sym.gphelper.dll_kx4zun
mov ecx, 0x1007c530
call fcn.10049480
test eax, eax
je 0x100481a5
mov edx, sym.gphelper.dll_kkec6z
mov ecx, 0x1007c564
call fcn.10049480
test eax, eax
je 0x100481a5
mov edx, sym.gphelper.dll_bonw1e
mov ecx, 0x1007c558
call fcn.10049480
jmp 0x100481a5
test eax, eax
jne 0x100481a5
mov ecx, 0x1007c570
call fcn.10049690
mov ecx, 0x1007c530
call fcn.10049690
mov ecx, 0x1007c564
call fcn.10049690
mov ecx, 0x1007c558
call fcn.10049690
mov ecx, dword [esp + 0x11c]
mov eax, 1
xor ecx, esp
call fcn.10002214
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100481f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x394
mov eax, dword [0x10056004]
xor eax, esp
mov dword [esp + 0x390], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [esp + 0x78]
push 0x104
push 0
push eax
mov word [esp + 0x78], 0x4f53
mov dword [esp + 0x7d], 0x5c455241
mov byte [esp + 0x81], 0
mov word [esp + 0x7b], 0x5754
mov byte [esp + 0x7a], 0x46
mov dword [esp + 0x69], 0x732573
mov byte [esp + 0x68], 0x25
call fcn.10004950
add esp, 0xc
lea ecx, [esp + 0x38]
call fcn.10048da0
mov ecx, eax
call fcn.100014a0
push eax
lea ecx, [esp + 0xc]
call fcn.100014c0
push ecx
lea edx, [esp + 0xc]
lea ecx, [esp + 0x24]
call fcn.10048cc0
add esp, 4
mov ecx, eax
call fcn.10001520
push eax
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x64]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x88]
push 0x104
push eax
call fcn.10001210
add esp, 0x18
lea ecx, [esp + 0x20]
call fcn.10001550
lea ecx, [esp + 8]
call fcn.100014b0
lea ecx, [esp + 0x38]
call fcn.100014b0
lea eax, [esp + 0x50]
push eax
sub esp, 8
lea edx, [esp + 0x84]
call fcn.100478e0
add esp, 0xc
test eax, eax
jne 0x100483b8
push 0x104
push eax
lea eax, [esp + 0x290]
push eax
call fcn.10004950
mov ecx, dword [esp + 0x5c]
lea eax, [esp + 0x64]
add esp, 0xc
mov dword [esp + 0x66], 0x736c61
lea edx, [esp + 0x64]
mov word [esp + 0x64], 0x7668
push eax
lea eax, [esp + 0x28c]
push eax
sub esp, 8
call fcn.10047b70
add esp, 0x10
test eax, eax
jne 0x100483af
cmp dword [esp + 0x58], eax
jbe 0x100483af
push 0x104
push eax
lea eax, [esp + 0x188]
push eax
call fcn.10004950
add esp, 0xc
mov word [esp + 0x54], 0x6425
lea eax, [esp + 0x54]
mov byte [esp + 0x56], 0
push esi
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x18c]
push 0x104
push eax
call fcn.10001210
add esp, 0x14
lea eax, [esp + 0x180]
push eax
lea eax, [esp + 0x28c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x100483af
mov ecx, dword [esp + 0x50]
call fcn.10047850
mov eax, 1
pop esi
mov ecx, dword [esp + 0x390]
xor ecx, esp
call fcn.10002214
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0x50]
call fcn.10047850
push esi
mov esi, dword [0x1007c558]
mov ecx, esi
call dword [0x1004a1b8]
call esi
mov ecx, dword [esp + 0x394]
pop esi
xor ecx, esp
call fcn.10002214
mov esp, ebp
pop ebp
ret 4
Function at 0x100483f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x394
mov eax, dword [0x10056004]
xor eax, esp
mov dword [esp + 0x390], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [esp + 0x78]
push 0x104
push 0
push eax
mov dword [esp + 0x7a], 0x41575446
mov word [esp + 0x78], 0x4f53
mov dword [esp + 0x7e], 0x5c4552
mov word [esp + 0x68], 0x7325
mov word [esp + 0x6b], 0x73
mov byte [esp + 0x6a], 0x25
call fcn.10004950
add esp, 0xc
lea ecx, [esp + 0x38]
call fcn.10048da0
mov ecx, eax
call fcn.100014a0
push eax
lea ecx, [esp + 0xc]
call fcn.100014c0
push ecx
lea edx, [esp + 0xc]
lea ecx, [esp + 0x24]
call fcn.10048cc0
add esp, 4
mov ecx, eax
call fcn.10001520
push eax
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x64]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x88]
push 0x104
push eax
call fcn.10001210
add esp, 0x18
lea ecx, [esp + 0x20]
call fcn.10001550
lea ecx, [esp + 8]
call fcn.100014b0
lea ecx, [esp + 0x38]
call fcn.100014b0
lea eax, [esp + 0x50]
push eax
sub esp, 8
lea edx, [esp + 0x84]
call fcn.100478e0
add esp, 0xc
test eax, eax
jne 0x100485ab
push 0x104
push eax
lea eax, [esp + 0x290]
push eax
call fcn.10004950
mov ecx, dword [esp + 0x5c]
lea eax, [esp + 0x64]
add esp, 0xc
mov dword [esp + 0x66], 0x736c61
lea edx, [esp + 0x64]
mov word [esp + 0x64], 0x7668
push eax
lea eax, [esp + 0x28c]
push eax
sub esp, 8
call fcn.10047b70
add esp, 0x10
test eax, eax
jne 0x100485a2
cmp dword [esp + 0x58], eax
jbe 0x100485a2
push 0x104
push eax
lea eax, [esp + 0x188]
push eax
call fcn.10004950
add esp, 0xc
mov word [esp + 0x54], 0x6425
lea eax, [esp + 0x54]
mov byte [esp + 0x56], 0
push esi
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x18c]
push 0x104
push eax
call fcn.10001210
add esp, 0x14
lea eax, [esp + 0x180]
push eax
lea eax, [esp + 0x28c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x100485a2
mov ecx, dword [esp + 0x50]
call fcn.10047850
mov eax, esi
pop esi
mov ecx, dword [esp + 0x390]
xor ecx, esp
call fcn.10002214
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0x50]
call fcn.10047850
push esi
mov esi, dword [0x1007c564]
mov ecx, esi
call dword [0x1004a1b8]
call esi
mov ecx, dword [esp + 0x394]
pop esi
xor ecx, esp
call fcn.10002214
mov esp, ebp
pop ebp
ret 4
Function at 0x10048600
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x394
mov eax, dword [0x10056004]
xor eax, esp
mov dword [esp + 0x390], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [esp + 0x78]
push 0x104
push 0
push eax
mov dword [esp + 0x79], 0x5754464f
mov dword [esp + 0x7d], 0x5c455241
mov byte [esp + 0x78], 0x53
mov byte [esp + 0x81], 0
mov word [esp + 0x68], 0x7325
mov word [esp + 0x6b], 0x73
mov byte [esp + 0x6a], 0x25
call fcn.10004950
add esp, 0xc
lea ecx, [esp + 0x38]
call fcn.10048da0
mov ecx, eax
call fcn.100014a0
push eax
lea ecx, [esp + 0xc]
call fcn.100014c0
push ecx
lea edx, [esp + 0xc]
lea ecx, [esp + 0x24]
call fcn.10048cc0
add esp, 4
mov ecx, eax
call fcn.10001520
push eax
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x64]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x88]
push 0x104
push eax
call fcn.10001210
add esp, 0x18
lea ecx, [esp + 0x20]
call fcn.10001550
lea ecx, [esp + 8]
call fcn.100014b0
lea ecx, [esp + 0x38]
call fcn.100014b0
lea eax, [esp + 0x50]
push eax
sub esp, 8
lea edx, [esp + 0x84]
call fcn.100478e0
add esp, 0xc
test eax, eax
jne 0x100487d1
push 0x104
push eax
lea eax, [esp + 0x290]
push eax
call fcn.10004950
mov ecx, dword [esp + 0x5c]
lea eax, [esp + 0x64]
add esp, 0xc
mov word [esp + 0x67], 0x736c
lea edx, [esp + 0x64]
mov word [esp + 0x64], 0x7668
mov byte [esp + 0x69], 0
mov byte [esp + 0x66], 0x61
push eax
lea eax, [esp + 0x28c]
push eax
sub esp, 8
call fcn.10047b70
add esp, 0x10
test eax, eax
jne 0x100487c8
cmp dword [esp + 0x58], eax
jbe 0x100487c8
push 0x104
push eax
lea eax, [esp + 0x188]
push eax
call fcn.10004950
add esp, 0xc
mov word [esp + 0x54], 0x6425
lea eax, [esp + 0x54]
mov byte [esp + 0x56], 0
push esi
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x18c]
push 0x104
push eax
call fcn.10001210
add esp, 0x14
lea eax, [esp + 0x180]
push eax
lea eax, [esp + 0x28c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x100487c8
mov ecx, dword [esp + 0x50]
call fcn.10047850
mov eax, 1
pop esi
mov ecx, dword [esp + 0x390]
xor ecx, esp
call fcn.10002214
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0x50]
call fcn.10047850
push esi
mov esi, dword [0x1007c530]
mov ecx, esi
call dword [0x1004a1b8]
call esi
mov ecx, dword [esp + 0x394]
pop esi
xor ecx, esp
call fcn.10002214
mov esp, ebp
pop ebp
ret 4
Function at 0x10048820
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x390
mov eax, dword [0x10056004]
xor eax, esp
mov dword [esp + 0x38c], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [esp + 0x74]
push edi
mov edi, dword [ebp + 0xc]
push 0x104
push 0
push eax
mov word [esp + 0x7a], 0x5446
mov word [esp + 0x80], 0x5c
mov word [esp + 0x7d], 0x5241
mov word [esp + 0x78], 0x4f53
mov byte [esp + 0x7f], 0x45
mov byte [esp + 0x7c], 0x57
mov dword [esp + 0x68], 0x73257325
mov byte [esp + 0x6c], 0
call fcn.10004950
add esp, 0xc
lea ecx, [esp + 0x38]
call fcn.10048da0
mov ecx, eax
call fcn.100014a0
push eax
lea ecx, [esp + 0xc]
call fcn.100014c0
push ecx
lea edx, [esp + 0xc]
lea ecx, [esp + 0x24]
call fcn.10048cc0
add esp, 4
mov ecx, eax
call fcn.10001520
push eax
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x64]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x88]
push 0x104
push eax
call fcn.10001210
add esp, 0x18
lea ecx, [esp + 0x20]
call fcn.10001550
lea ecx, [esp + 8]
call fcn.100014b0
lea ecx, [esp + 0x38]
call fcn.100014b0
lea eax, [esp + 0x50]
push eax
sub esp, 8
lea edx, [esp + 0x84]
call fcn.100478e0
add esp, 0xc
test eax, eax
jne 0x100489f3
push 0x104
push eax
lea eax, [esp + 0x290]
push eax
call fcn.10004950
mov ecx, dword [esp + 0x5c]
lea eax, [esp + 0x64]
add esp, 0xc
mov dword [esp + 0x66], 0x736c61
lea edx, [esp + 0x64]
mov word [esp + 0x64], 0x7668
push eax
lea eax, [esp + 0x28c]
push eax
sub esp, 8
call fcn.10047b70
add esp, 0x10
test eax, eax
jne 0x100489ea
cmp dword [esp + 0x58], eax
jbe 0x100489ea
push 0x104
push eax
lea eax, [esp + 0x188]
push eax
call fcn.10004950
add esp, 0xc
mov word [esp + 0x54], 0x6425
lea eax, [esp + 0x54]
mov byte [esp + 0x56], 0
push esi
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x18c]
push 0x104
push eax
call fcn.10001210
add esp, 0x14
lea eax, [esp + 0x180]
push eax
lea eax, [esp + 0x28c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x100489ea
mov ecx, dword [esp + 0x50]
call fcn.10047850
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x38c]
xor ecx, esp
call fcn.10002214
mov esp, ebp
pop ebp
ret 0x1c
mov ecx, dword [esp + 0x50]
call fcn.10047850
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push esi
mov esi, dword [0x1007c570]
mov ecx, esi
call dword [0x1004a1b8]
call esi
mov ecx, dword [esp + 0x394]
pop edi
pop esi
xor ecx, esp
call fcn.10002214
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x10048a70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x10056004]
xor eax, esp
mov dword [esp + 0x14], eax
call fcn.10047e50
test eax, eax
je 0x10048acc
lea ecx, [esp]
mov word [esp + 5], 0x6957
push ecx
push eax
mov dword [esp + 8], 0x6e697242
mov dword [esp + 0xf], 0x776f646e
mov dword [esp + 0x15], 0x706f54
mov byte [esp + 0xc], 0x67
mov word [esp + 0x13], 0x6f54
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10002214
add esp, 0x18
ret
mov ecx, dword [esp + 0x14]
xor eax, eax
xor ecx, esp
call fcn.10002214
add esp, 0x18
ret