joyce8/EMBER2024-capa huggingface dataset:
Function at 0x480929
Capabilities:
Execute anti-debugging instructions

Disassembly:
jne 0x4807d7
jmp 0x4807d9
jmp 0x4807da
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x4807ee
call 0x4814d4
call 0x4807e4
call 0x4807e5
add esp, 8
sub eax, dword [esp]
je 0x4807ff
jne 0x4807ff
jmp 0x480801
jmp 0x480802
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480819
add esp, 4
call 0x480814
call 0x4814fa
call 0x48080a
call 0x48080b
add esp, 8
cmp eax, 0xfff
jmp 0x480824
jmp 0x480828
jmp 0x48082b
jbe 0x480848
jmp 0x480830
jmp 0x480834
jmp 0x480837
int3
je 0x48084e
jne 0x48084e
jmp 0x480850
jmp 0x480851
sub eax, 0
call 0x480856
add esp, 4
je 0x48085f
jne 0x48085f
jmp 0x480861
jmp 0x480862
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480876
call 0x48155c
call 0x48086c
call 0x48086d
add esp, 8
sub eax, dword [esp]
je 0x480887
jne 0x480887
jmp 0x480889
jmp 0x48088a
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x4808a1
add esp, 4
call 0x48089c
call 0x481582
call 0x480892
call 0x480893
add esp, 8
cmp eax, 0xfff
jmp 0x4808ac
jmp 0x4808b0
jmp 0x4808b3
jbe 0x4808d0
jmp 0x4808b8
jmp 0x4808bc
jmp 0x4808bf
int3
je 0x4808d6
jne 0x4808d6
jmp 0x4808d8
jmp 0x4808d9
sub eax, 0xa
call 0x4808e8
call 0x4815ce
call 0x4808de
call 0x4808df
add esp, 8
je 0x4808f6
jne 0x4808f6
jmp 0x4808f8
jmp 0x4808f9
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x48090d
call 0x4815f3
call 0x480903
call 0x480904
add esp, 8
sub eax, dword [esp]
je 0x48091e
jne 0x48091e
jmp 0x480920
jmp 0x480921
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480938
add esp, 4
call 0x480933
call 0x481619
call 0x480929
call 0x48092a
add esp, 8
cmp eax, 0xfff
jmp 0x480943
jmp 0x480947
jmp 0x48094a
jbe 0x480967
jmp 0x48094f
jmp 0x480953
jmp 0x480956
int3
call 0x48096c
add esp, 4
call 0x48097e
call 0x481664
call 0x480974
call 0x480975
add esp, 8
je 0x48098c
jne 0x48098c
jmp 0x48098e
jmp 0x48098f
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x4809a3
Function at 0x48092a
Capabilities:
Execute anti-debugging instructions

Disassembly:
jne 0x4807d7
jmp 0x4807d9
jmp 0x4807da
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x4807ee
call 0x4814d4
call 0x4807e4
call 0x4807e5
add esp, 8
sub eax, dword [esp]
je 0x4807ff
jne 0x4807ff
jmp 0x480801
jmp 0x480802
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480819
add esp, 4
call 0x480814
call 0x4814fa
call 0x48080a
call 0x48080b
add esp, 8
cmp eax, 0xfff
jmp 0x480824
jmp 0x480828
jmp 0x48082b
jbe 0x480848
jmp 0x480830
jmp 0x480834
jmp 0x480837
int3
je 0x48084e
jne 0x48084e
jmp 0x480850
jmp 0x480851
sub eax, 0
call 0x480856
add esp, 4
je 0x48085f
jne 0x48085f
jmp 0x480861
jmp 0x480862
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480876
call 0x48155c
call 0x48086c
call 0x48086d
add esp, 8
sub eax, dword [esp]
je 0x480887
jne 0x480887
jmp 0x480889
jmp 0x48088a
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x4808a1
add esp, 4
call 0x48089c
call 0x481582
call 0x480892
call 0x480893
add esp, 8
cmp eax, 0xfff
jmp 0x4808ac
jmp 0x4808b0
jmp 0x4808b3
jbe 0x4808d0
jmp 0x4808b8
jmp 0x4808bc
jmp 0x4808bf
int3
je 0x4808d6
jne 0x4808d6
jmp 0x4808d8
jmp 0x4808d9
sub eax, 0xa
call 0x4808e8
call 0x4815ce
call 0x4808de
call 0x4808df
add esp, 8
je 0x4808f6
jne 0x4808f6
jmp 0x4808f8
jmp 0x4808f9
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x48090d
call 0x4815f3
call 0x480903
call 0x480904
add esp, 8
sub eax, dword [esp]
je 0x48091e
jne 0x48091e
jmp 0x480920
jmp 0x480921
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480938
add esp, 4
call 0x480933
call 0x481619
call 0x480929
call 0x48092a
add esp, 8
cmp eax, 0xfff
jmp 0x480943
jmp 0x480947
jmp 0x48094a
jbe 0x480967
jmp 0x48094f
jmp 0x480953
jmp 0x480956
int3
call 0x48096c
add esp, 4
call 0x48097e
call 0x481664
call 0x480974
call 0x480975
add esp, 8
je 0x48098c
jne 0x48098c
jmp 0x48098e
jmp 0x48098f
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x4809a3
Function at 0x480933
Capabilities:
Execute anti-debugging instructions

Disassembly:
jne 0x4807d7
jmp 0x4807d9
jmp 0x4807da
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x4807ee
call 0x4814d4
call 0x4807e4
call 0x4807e5
add esp, 8
sub eax, dword [esp]
je 0x4807ff
jne 0x4807ff
jmp 0x480801
jmp 0x480802
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480819
add esp, 4
call 0x480814
call 0x4814fa
call 0x48080a
call 0x48080b
add esp, 8
cmp eax, 0xfff
jmp 0x480824
jmp 0x480828
jmp 0x48082b
jbe 0x480848
jmp 0x480830
jmp 0x480834
jmp 0x480837
int3
je 0x48084e
jne 0x48084e
jmp 0x480850
jmp 0x480851
sub eax, 0
call 0x480856
add esp, 4
je 0x48085f
jne 0x48085f
jmp 0x480861
jmp 0x480862
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480876
call 0x48155c
call 0x48086c
call 0x48086d
add esp, 8
sub eax, dword [esp]
je 0x480887
jne 0x480887
jmp 0x480889
jmp 0x48088a
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x4808a1
add esp, 4
call 0x48089c
call 0x481582
call 0x480892
call 0x480893
add esp, 8
cmp eax, 0xfff
jmp 0x4808ac
jmp 0x4808b0
jmp 0x4808b3
jbe 0x4808d0
jmp 0x4808b8
jmp 0x4808bc
jmp 0x4808bf
int3
je 0x4808d6
jne 0x4808d6
jmp 0x4808d8
jmp 0x4808d9
sub eax, 0xa
call 0x4808e8
call 0x4815ce
call 0x4808de
call 0x4808df
add esp, 8
je 0x4808f6
jne 0x4808f6
jmp 0x4808f8
jmp 0x4808f9
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x48090d
call 0x4815f3
call 0x480903
call 0x480904
add esp, 8
sub eax, dword [esp]
je 0x48091e
jne 0x48091e
jmp 0x480920
jmp 0x480921
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480938
add esp, 4
call 0x480933
call 0x481619
call 0x480929
call 0x48092a
add esp, 8
cmp eax, 0xfff
jmp 0x480943
jmp 0x480947
jmp 0x48094a
jbe 0x480967
jmp 0x48094f
jmp 0x480953
jmp 0x480956
int3
call 0x48096c
add esp, 4
call 0x48097e
call 0x481664
call 0x480974
call 0x480975
add esp, 8
je 0x48098c
jne 0x48098c
jmp 0x48098e
jmp 0x48098f
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x4809a3
Function at 0x480974
Capabilities:
Execute anti-debugging instructions

Disassembly:
jne 0x4807d7
jmp 0x4807d9
jmp 0x4807da
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x4807ee
call 0x4814d4
call 0x4807e4
call 0x4807e5
add esp, 8
sub eax, dword [esp]
je 0x4807ff
jne 0x4807ff
jmp 0x480801
jmp 0x480802
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480819
add esp, 4
call 0x480814
call 0x4814fa
call 0x48080a
call 0x48080b
add esp, 8
cmp eax, 0xfff
jmp 0x480824
jmp 0x480828
jmp 0x48082b
jbe 0x480848
jmp 0x480830
jmp 0x480834
jmp 0x480837
int3
je 0x48084e
jne 0x48084e
jmp 0x480850
jmp 0x480851
sub eax, 0
call 0x480856
add esp, 4
je 0x48085f
jne 0x48085f
jmp 0x480861
jmp 0x480862
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480876
call 0x48155c
call 0x48086c
call 0x48086d
add esp, 8
sub eax, dword [esp]
je 0x480887
jne 0x480887
jmp 0x480889
jmp 0x48088a
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x4808a1
add esp, 4
call 0x48089c
call 0x481582
call 0x480892
call 0x480893
add esp, 8
cmp eax, 0xfff
jmp 0x4808ac
jmp 0x4808b0
jmp 0x4808b3
jbe 0x4808d0
jmp 0x4808b8
jmp 0x4808bc
jmp 0x4808bf
int3
je 0x4808d6
jne 0x4808d6
jmp 0x4808d8
jmp 0x4808d9
sub eax, 0xa
call 0x4808e8
call 0x4815ce
call 0x4808de
call 0x4808df
add esp, 8
je 0x4808f6
jne 0x4808f6
jmp 0x4808f8
jmp 0x4808f9
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x48090d
call 0x4815f3
call 0x480903
call 0x480904
add esp, 8
sub eax, dword [esp]
je 0x48091e
jne 0x48091e
jmp 0x480920
jmp 0x480921
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480938
add esp, 4
call 0x480933
call 0x481619
call 0x480929
call 0x48092a
add esp, 8
cmp eax, 0xfff
jmp 0x480943
jmp 0x480947
jmp 0x48094a
jbe 0x480967
jmp 0x48094f
jmp 0x480953
jmp 0x480956
int3
call 0x48096c
add esp, 4
call 0x48097e
call 0x481664
call 0x480974
call 0x480975
add esp, 8
je 0x48098c
jne 0x48098c
jmp 0x48098e
jmp 0x48098f
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x4809a3
Function at 0x480975
Capabilities:
Execute anti-debugging instructions

Disassembly:
jne 0x4807d7
jmp 0x4807d9
jmp 0x4807da
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x4807ee
call 0x4814d4
call 0x4807e4
call 0x4807e5
add esp, 8
sub eax, dword [esp]
je 0x4807ff
jne 0x4807ff
jmp 0x480801
jmp 0x480802
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480819
add esp, 4
call 0x480814
call 0x4814fa
call 0x48080a
call 0x48080b
add esp, 8
cmp eax, 0xfff
jmp 0x480824
jmp 0x480828
jmp 0x48082b
jbe 0x480848
jmp 0x480830
jmp 0x480834
jmp 0x480837
int3
je 0x48084e
jne 0x48084e
jmp 0x480850
jmp 0x480851
sub eax, 0
call 0x480856
add esp, 4
je 0x48085f
jne 0x48085f
jmp 0x480861
jmp 0x480862
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480876
call 0x48155c
call 0x48086c
call 0x48086d
add esp, 8
sub eax, dword [esp]
je 0x480887
jne 0x480887
jmp 0x480889
jmp 0x48088a
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x4808a1
add esp, 4
call 0x48089c
call 0x481582
call 0x480892
call 0x480893
add esp, 8
cmp eax, 0xfff
jmp 0x4808ac
jmp 0x4808b0
jmp 0x4808b3
jbe 0x4808d0
jmp 0x4808b8
jmp 0x4808bc
jmp 0x4808bf
int3
je 0x4808d6
jne 0x4808d6
jmp 0x4808d8
jmp 0x4808d9
sub eax, 0xa
call 0x4808e8
call 0x4815ce
call 0x4808de
call 0x4808df
add esp, 8
je 0x4808f6
jne 0x4808f6
jmp 0x4808f8
jmp 0x4808f9
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x48090d
call 0x4815f3
call 0x480903
call 0x480904
add esp, 8
sub eax, dword [esp]
je 0x48091e
jne 0x48091e
jmp 0x480920
jmp 0x480921
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480938
add esp, 4
call 0x480933
call 0x481619
call 0x480929
call 0x48092a
add esp, 8
cmp eax, 0xfff
jmp 0x480943
jmp 0x480947
jmp 0x48094a
jbe 0x480967
jmp 0x48094f
jmp 0x480953
jmp 0x480956
int3
call 0x48096c
add esp, 4
call 0x48097e
call 0x481664
call 0x480974
call 0x480975
add esp, 8
je 0x48098c
jne 0x48098c
jmp 0x48098e
jmp 0x48098f
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x4809a3
Function at 0x48097e
Capabilities:
Execute anti-debugging instructions

Disassembly:
jne 0x4807d7
jmp 0x4807d9
jmp 0x4807da
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x4807ee
call 0x4814d4
call 0x4807e4
call 0x4807e5
add esp, 8
sub eax, dword [esp]
je 0x4807ff
jne 0x4807ff
jmp 0x480801
jmp 0x480802
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480819
add esp, 4
call 0x480814
call 0x4814fa
call 0x48080a
call 0x48080b
add esp, 8
cmp eax, 0xfff
jmp 0x480824
jmp 0x480828
jmp 0x48082b
jbe 0x480848
jmp 0x480830
jmp 0x480834
jmp 0x480837
int3
je 0x48084e
jne 0x48084e
jmp 0x480850
jmp 0x480851
sub eax, 0
call 0x480856
add esp, 4
je 0x48085f
jne 0x48085f
jmp 0x480861
jmp 0x480862
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480876
call 0x48155c
call 0x48086c
call 0x48086d
add esp, 8
sub eax, dword [esp]
je 0x480887
jne 0x480887
jmp 0x480889
jmp 0x48088a
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x4808a1
add esp, 4
call 0x48089c
call 0x481582
call 0x480892
call 0x480893
add esp, 8
cmp eax, 0xfff
jmp 0x4808ac
jmp 0x4808b0
jmp 0x4808b3
jbe 0x4808d0
jmp 0x4808b8
jmp 0x4808bc
jmp 0x4808bf
int3
je 0x4808d6
jne 0x4808d6
jmp 0x4808d8
jmp 0x4808d9
sub eax, 0xa
call 0x4808e8
call 0x4815ce
call 0x4808de
call 0x4808df
add esp, 8
je 0x4808f6
jne 0x4808f6
jmp 0x4808f8
jmp 0x4808f9
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x48090d
call 0x4815f3
call 0x480903
call 0x480904
add esp, 8
sub eax, dword [esp]
je 0x48091e
jne 0x48091e
jmp 0x480920
jmp 0x480921
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480938
add esp, 4
call 0x480933
call 0x481619
call 0x480929
call 0x48092a
add esp, 8
cmp eax, 0xfff
jmp 0x480943
jmp 0x480947
jmp 0x48094a
jbe 0x480967
jmp 0x48094f
jmp 0x480953
jmp 0x480956
int3
call 0x48096c
add esp, 4
call 0x48097e
call 0x481664
call 0x480974
call 0x480975
add esp, 8
je 0x48098c
jne 0x48098c
jmp 0x48098e
jmp 0x48098f
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x4809a3

Function at 0x48099a
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x481689
call fcn.00480999
call fcn.0048099a

Function at 0x4809a3
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x481689
call fcn.00480999
call fcn.0048099a
Function at 0x4809bf
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4809a8
add esp, 8
sub eax, dword [esp]
je 0x4809b4
jne 0x4809b4
jmp 0x4809b6
jmp 0x4809b7
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x4809ce
add esp, 4
call 0x4809c9
call 0x4816af
call 0x4809bf
call 0x4809c0
add esp, 8
cmp eax, 0xfff
jmp 0x4809d9
jmp 0x4809dd
jmp 0x4809e0
jbe 0x4809fd
jmp 0x4809e5
jmp 0x4809e9
jmp 0x4809ec
int3
jmp 0x480a00
jmp 0x480a04
jmp 0x480a07
jmp 0x480a0a
jmp 0x480a0e
jmp 0x480a11
je 0x480a17
jne 0x480a17
jmp 0x480a19
jmp 0x480a1a
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480a2e
call 0x481714
call 0x480a24
call 0x480a25
inc dword [ebx + 0x42b08c4]
and al, 0x74
invalid
jne 0x480a3f
jmp 0x480a41
jmp 0x480a42
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480a59
add esp, 4
call 0x480a54
call 0x48173a
call 0x480a4a
call 0x480a4b
add esp, 8
cmp eax, 0xfff
jmp 0x480a64
jmp 0x480a68
jmp 0x480a6b
jbe 0x480a88
jmp 0x480a70
jmp 0x480a74
jmp 0x480a77
int3
call 0x480a8d
add esp, 4
call 0x480a9f
call 0x481785
call 0x480a95
call 0x480a96
add esp, 8
je 0x480aad
jne 0x480aad
jmp 0x480aaf
jmp 0x480ab0
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480ac4
call 0x4817aa
call 0x480aba
call 0x480abb
add esp, 8
sub eax, dword [esp]
je 0x480ad5
jne 0x480ad5
jmp 0x480ad8
add esp, 4
call 0x480aea
call 0x4817d0
call 0x480ae0
call 0x480ae1
add esp, 8
cmp eax, 0xfff
jmp 0x480afa
jmp 0x480afe
jmp 0x480b01
jbe 0x480b1e
jmp 0x480b06
jmp 0x480b0a
jmp 0x480b0d
int3
call 0x480b23
add esp, 4
call 0x480b35
call 0x48181b
call 0x480b2b
call 0x480b2c
add esp, 8
je 0x480b43
jne 0x480b43
jmp 0x480b45
jmp 0x480b46
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480b5a
call 0x481840
call 0x480b50
call 0x480b51
add esp, 8
sub eax, dword [esp]
je 0x480b6b
jne 0x480b6b
jmp 0x480b6d
jmp 0x480b6e
add dword [ebx + 0xae804c4], 0xe8000000
jmp fcn.00480b85
add esp, 4
call 0x480b80
call 0x481866
call 0x480b76
call 0x480b77
Function at 0x4809c0
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4809a8
add esp, 8
sub eax, dword [esp]
je 0x4809b4
jne 0x4809b4
jmp 0x4809b6
jmp 0x4809b7
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x4809ce
add esp, 4
call 0x4809c9
call 0x4816af
call 0x4809bf
call 0x4809c0
add esp, 8
cmp eax, 0xfff
jmp 0x4809d9
jmp 0x4809dd
jmp 0x4809e0
jbe 0x4809fd
jmp 0x4809e5
jmp 0x4809e9
jmp 0x4809ec
int3
jmp 0x480a00
jmp 0x480a04
jmp 0x480a07
jmp 0x480a0a
jmp 0x480a0e
jmp 0x480a11
je 0x480a17
jne 0x480a17
jmp 0x480a19
jmp 0x480a1a
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480a2e
call 0x481714
call 0x480a24
call 0x480a25
inc dword [ebx + 0x42b08c4]
and al, 0x74
invalid
jne 0x480a3f
jmp 0x480a41
jmp 0x480a42
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480a59
add esp, 4
call 0x480a54
call 0x48173a
call 0x480a4a
call 0x480a4b
add esp, 8
cmp eax, 0xfff
jmp 0x480a64
jmp 0x480a68
jmp 0x480a6b
jbe 0x480a88
jmp 0x480a70
jmp 0x480a74
jmp 0x480a77
int3
call 0x480a8d
add esp, 4
call 0x480a9f
call 0x481785
call 0x480a95
call 0x480a96
add esp, 8
je 0x480aad
jne 0x480aad
jmp 0x480aaf
jmp 0x480ab0
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480ac4
call 0x4817aa
call 0x480aba
call 0x480abb
add esp, 8
sub eax, dword [esp]
je 0x480ad5
jne 0x480ad5
jmp 0x480ad8
add esp, 4
call 0x480aea
call 0x4817d0
call 0x480ae0
call 0x480ae1
add esp, 8
cmp eax, 0xfff
jmp 0x480afa
jmp 0x480afe
jmp 0x480b01
jbe 0x480b1e
jmp 0x480b06
jmp 0x480b0a
jmp 0x480b0d
int3
call 0x480b23
add esp, 4
call 0x480b35
call 0x48181b
call 0x480b2b
call 0x480b2c
add esp, 8
je 0x480b43
jne 0x480b43
jmp 0x480b45
jmp 0x480b46
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480b5a
call 0x481840
call 0x480b50
call 0x480b51
add esp, 8
sub eax, dword [esp]
je 0x480b6b
jne 0x480b6b
jmp 0x480b6d
jmp 0x480b6e
add dword [ebx + 0xae804c4], 0xe8000000
jmp fcn.00480b85
add esp, 4
call 0x480b80
call 0x481866
call 0x480b76
call 0x480b77
Function at 0x4809c9
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4809a8
add esp, 8
sub eax, dword [esp]
je 0x4809b4
jne 0x4809b4
jmp 0x4809b6
jmp 0x4809b7
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x4809ce
add esp, 4
call 0x4809c9
call 0x4816af
call 0x4809bf
call 0x4809c0
add esp, 8
cmp eax, 0xfff
jmp 0x4809d9
jmp 0x4809dd
jmp 0x4809e0
jbe 0x4809fd
jmp 0x4809e5
jmp 0x4809e9
jmp 0x4809ec
int3
jmp 0x480a00
jmp 0x480a04
jmp 0x480a07
jmp 0x480a0a
jmp 0x480a0e
jmp 0x480a11
je 0x480a17
jne 0x480a17
jmp 0x480a19
jmp 0x480a1a
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480a2e
call 0x481714
call 0x480a24
call 0x480a25
inc dword [ebx + 0x42b08c4]
and al, 0x74
invalid
jne 0x480a3f
jmp 0x480a41
jmp 0x480a42
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480a59
add esp, 4
call 0x480a54
call 0x48173a
call 0x480a4a
call 0x480a4b
add esp, 8
cmp eax, 0xfff
jmp 0x480a64
jmp 0x480a68
jmp 0x480a6b
jbe 0x480a88
jmp 0x480a70
jmp 0x480a74
jmp 0x480a77
int3
call 0x480a8d
add esp, 4
call 0x480a9f
call 0x481785
call 0x480a95
call 0x480a96
add esp, 8
je 0x480aad
jne 0x480aad
jmp 0x480aaf
jmp 0x480ab0
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480ac4
call 0x4817aa
call 0x480aba
call 0x480abb
add esp, 8
sub eax, dword [esp]
je 0x480ad5
jne 0x480ad5
jmp 0x480ad8
add esp, 4
call 0x480aea
call 0x4817d0
call 0x480ae0
call 0x480ae1
add esp, 8
cmp eax, 0xfff
jmp 0x480afa
jmp 0x480afe
jmp 0x480b01
jbe 0x480b1e
jmp 0x480b06
jmp 0x480b0a
jmp 0x480b0d
int3
call 0x480b23
add esp, 4
call 0x480b35
call 0x48181b
call 0x480b2b
call 0x480b2c
add esp, 8
je 0x480b43
jne 0x480b43
jmp 0x480b45
jmp 0x480b46
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480b5a
call 0x481840
call 0x480b50
call 0x480b51
add esp, 8
sub eax, dword [esp]
je 0x480b6b
jne 0x480b6b
jmp 0x480b6d
jmp 0x480b6e
add dword [ebx + 0xae804c4], 0xe8000000
jmp fcn.00480b85
add esp, 4
call 0x480b80
call 0x481866
call 0x480b76
call 0x480b77
Function at 0x480a0a
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4809a8
add esp, 8
sub eax, dword [esp]
je 0x4809b4
jne 0x4809b4
jmp 0x4809b6
jmp 0x4809b7
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x4809ce
add esp, 4
call 0x4809c9
call 0x4816af
call 0x4809bf
call 0x4809c0
add esp, 8
cmp eax, 0xfff
jmp 0x4809d9
jmp 0x4809dd
jmp 0x4809e0
jbe 0x4809fd
jmp 0x4809e5
jmp 0x4809e9
jmp 0x4809ec
int3
jmp 0x480a00
jmp 0x480a04
jmp 0x480a07
jmp 0x480a0a
jmp 0x480a0e
jmp 0x480a11
je 0x480a17
jne 0x480a17
jmp 0x480a19
jmp 0x480a1a
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480a2e
call 0x481714
call 0x480a24
call 0x480a25
inc dword [ebx + 0x42b08c4]
and al, 0x74
invalid
jne 0x480a3f
jmp 0x480a41
jmp 0x480a42
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480a59
add esp, 4
call 0x480a54
call 0x48173a
call 0x480a4a
call 0x480a4b
add esp, 8
cmp eax, 0xfff
jmp 0x480a64
jmp 0x480a68
jmp 0x480a6b
jbe 0x480a88
jmp 0x480a70
jmp 0x480a74
jmp 0x480a77
int3
call 0x480a8d
add esp, 4
call 0x480a9f
call 0x481785
call 0x480a95
call 0x480a96
add esp, 8
je 0x480aad
jne 0x480aad
jmp 0x480aaf
jmp 0x480ab0
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480ac4
call 0x4817aa
call 0x480aba
call 0x480abb
add esp, 8
sub eax, dword [esp]
je 0x480ad5
jne 0x480ad5
jmp 0x480ad8
add esp, 4
call 0x480aea
call 0x4817d0
call 0x480ae0
call 0x480ae1
add esp, 8
cmp eax, 0xfff
jmp 0x480afa
jmp 0x480afe
jmp 0x480b01
jbe 0x480b1e
jmp 0x480b06
jmp 0x480b0a
jmp 0x480b0d
int3
call 0x480b23
add esp, 4
call 0x480b35
call 0x48181b
call 0x480b2b
call 0x480b2c
add esp, 8
je 0x480b43
jne 0x480b43
jmp 0x480b45
jmp 0x480b46
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480b5a
call 0x481840
call 0x480b50
call 0x480b51
add esp, 8
sub eax, dword [esp]
je 0x480b6b
jne 0x480b6b
jmp 0x480b6d
jmp 0x480b6e
add dword [ebx + 0xae804c4], 0xe8000000
jmp fcn.00480b85
add esp, 4
call 0x480b80
call 0x481866
call 0x480b76
call 0x480b77
Function at 0x480a24
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4809a8
add esp, 8
sub eax, dword [esp]
je 0x4809b4
jne 0x4809b4
jmp 0x4809b6
jmp 0x4809b7
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x4809ce
add esp, 4
call 0x4809c9
call 0x4816af
call 0x4809bf
call 0x4809c0
add esp, 8
cmp eax, 0xfff
jmp 0x4809d9
jmp 0x4809dd
jmp 0x4809e0
jbe 0x4809fd
jmp 0x4809e5
jmp 0x4809e9
jmp 0x4809ec
int3
jmp 0x480a00
jmp 0x480a04
jmp 0x480a07
jmp 0x480a0a
jmp 0x480a0e
jmp 0x480a11
je 0x480a17
jne 0x480a17
jmp 0x480a19
jmp 0x480a1a
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480a2e
call 0x481714
call 0x480a24
call 0x480a25
inc dword [ebx + 0x42b08c4]
and al, 0x74
invalid
jne 0x480a3f
jmp 0x480a41
jmp 0x480a42
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480a59
add esp, 4
call 0x480a54
call 0x48173a
call 0x480a4a
call 0x480a4b
add esp, 8
cmp eax, 0xfff
jmp 0x480a64
jmp 0x480a68
jmp 0x480a6b
jbe 0x480a88
jmp 0x480a70
jmp 0x480a74
jmp 0x480a77
int3
call 0x480a8d
add esp, 4
call 0x480a9f
call 0x481785
call 0x480a95
call 0x480a96
add esp, 8
je 0x480aad
jne 0x480aad
jmp 0x480aaf
jmp 0x480ab0
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480ac4
call 0x4817aa
call 0x480aba
call 0x480abb
add esp, 8
sub eax, dword [esp]
je 0x480ad5
jne 0x480ad5
jmp 0x480ad8
add esp, 4
call 0x480aea
call 0x4817d0
call 0x480ae0
call 0x480ae1
add esp, 8
cmp eax, 0xfff
jmp 0x480afa
jmp 0x480afe
jmp 0x480b01
jbe 0x480b1e
jmp 0x480b06
jmp 0x480b0a
jmp 0x480b0d
int3
call 0x480b23
add esp, 4
call 0x480b35
call 0x48181b
call 0x480b2b
call 0x480b2c
add esp, 8
je 0x480b43
jne 0x480b43
jmp 0x480b45
jmp 0x480b46
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480b5a
call 0x481840
call 0x480b50
call 0x480b51
add esp, 8
sub eax, dword [esp]
je 0x480b6b
jne 0x480b6b
jmp 0x480b6d
jmp 0x480b6e
add dword [ebx + 0xae804c4], 0xe8000000
jmp fcn.00480b85
add esp, 4
call 0x480b80
call 0x481866
call 0x480b76
call 0x480b77
Function at 0x480a25
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4809a8
add esp, 8
sub eax, dword [esp]
je 0x4809b4
jne 0x4809b4
jmp 0x4809b6
jmp 0x4809b7
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x4809ce
add esp, 4
call 0x4809c9
call 0x4816af
call 0x4809bf
call 0x4809c0
add esp, 8
cmp eax, 0xfff
jmp 0x4809d9
jmp 0x4809dd
jmp 0x4809e0
jbe 0x4809fd
jmp 0x4809e5
jmp 0x4809e9
jmp 0x4809ec
int3
jmp 0x480a00
jmp 0x480a04
jmp 0x480a07
jmp 0x480a0a
jmp 0x480a0e
jmp 0x480a11
je 0x480a17
jne 0x480a17
jmp 0x480a19
jmp 0x480a1a
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480a2e
call 0x481714
call 0x480a24
call 0x480a25
inc dword [ebx + 0x42b08c4]
and al, 0x74
invalid
jne 0x480a3f
jmp 0x480a41
jmp 0x480a42
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480a59
add esp, 4
call 0x480a54
call 0x48173a
call 0x480a4a
call 0x480a4b
add esp, 8
cmp eax, 0xfff
jmp 0x480a64
jmp 0x480a68
jmp 0x480a6b
jbe 0x480a88
jmp 0x480a70
jmp 0x480a74
jmp 0x480a77
int3
call 0x480a8d
add esp, 4
call 0x480a9f
call 0x481785
call 0x480a95
call 0x480a96
add esp, 8
je 0x480aad
jne 0x480aad
jmp 0x480aaf
jmp 0x480ab0
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480ac4
call 0x4817aa
call 0x480aba
call 0x480abb
add esp, 8
sub eax, dword [esp]
je 0x480ad5
jne 0x480ad5
jmp 0x480ad8
add esp, 4
call 0x480aea
call 0x4817d0
call 0x480ae0
call 0x480ae1
add esp, 8
cmp eax, 0xfff
jmp 0x480afa
jmp 0x480afe
jmp 0x480b01
jbe 0x480b1e
jmp 0x480b06
jmp 0x480b0a
jmp 0x480b0d
int3
call 0x480b23
add esp, 4
call 0x480b35
call 0x48181b
call 0x480b2b
call 0x480b2c
add esp, 8
je 0x480b43
jne 0x480b43
jmp 0x480b45
jmp 0x480b46
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480b5a
call 0x481840
call 0x480b50
call 0x480b51
add esp, 8
sub eax, dword [esp]
je 0x480b6b
jne 0x480b6b
jmp 0x480b6d
jmp 0x480b6e
add dword [ebx + 0xae804c4], 0xe8000000
jmp fcn.00480b85
add esp, 4
call 0x480b80
call 0x481866
call 0x480b76
call 0x480b77