joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47fff4
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x47ff78
add esp, 8
cmp eax, 0xfff
jmp 0x47ff83
jmp 0x47ff87
jmp 0x47ff8a
jbe 0x47ffa7
jmp 0x47ff8f
jmp 0x47ff93
jmp 0x47ff96
int3
je 0x47ffad
jne 0x47ffad
jmp 0x47ffaf
jmp 0x47ffb0
sub ebx, 0x2eb6801
int 0x20
jmp 0x47ffb3
jmp 0x47ffb7
jmp 0x47ffba
je 0x47ffc0
jne 0x47ffc0
jmp 0x47ffc2
jmp 0x47ffc3
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x47ffd7
call 0x480cbd
call 0x47ffcd
call 0x47ffce
add esp, 8
sub eax, dword [esp]
je 0x47ffe8
jne 0x47ffe8
jmp 0x47ffea
jmp 0x47ffeb
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480002
add esp, 4
call fcn.0047fffd
call 0x480ce3
call 0x47fff3
call 0x47fff4
add esp, 8
cmp eax, 0xfff
jmp 0x48000d
jmp 0x480011
jmp 0x480014
jbe 0x480031
jmp 0x480019
jmp 0x48001d
jmp 0x480020
int3
je 0x480037
jne 0x480037
jmp 0x480039
jmp 0x48003a
sub eax, 0
call 0x48003f
add esp, 4
je 0x480048
jne 0x480048
jmp 0x48004a
jmp 0x48004b
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x48005f
call 0x480d45
call 0x480055
call 0x480056
add esp, 8
sub eax, dword [esp]
je 0x480070
jne 0x480070
jmp 0x480072
jmp 0x480073
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x48008a
add esp, 4
call 0x480085
call 0x480d6b
call 0x48007b
call 0x48007c
add esp, 8
cmp eax, 0xfff

Function at 0x4800d1
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x480095
jmp 0x480099
jmp 0x48009c
jbe 0x4800b9
jmp 0x4800a1
jmp 0x4800a5
jmp 0x4800a8
int3
je 0x4800bf
jne 0x4800bf
jmp 0x4800c1
jmp 0x4800c2
sub eax, 0xa
call 0x4800d1
call 0x480db7
call 0x4800c7
call 0x4800c8
add esp, 8
je 0x4800df
jne 0x4800df
jmp 0x4800e1
jmp 0x4800e2
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x4800f6
call 0x480ddc
call 0x4800ec
call 0x4800ed
add esp, 8
sub eax, dword [esp]
je 0x480107
jne 0x480107
jmp 0x480109
jmp 0x48010a
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480121
add esp, 4
call 0x48011c
call 0x480e02
call 0x480112
call 0x480113
add esp, 8
cmp eax, 0xfff

Function at 0x48015e
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x48012c
jmp 0x480130
jmp 0x480133
jbe 0x480150
jmp 0x480138
jmp 0x48013c
jmp 0x48013f
int3
call 0x480155
add esp, 4
call 0x480167
call 0x480e4d
call 0x48015d
call 0x48015e
add esp, 8
je 0x480175
jne 0x480175
jmp 0x480177
jmp 0x480178
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x48018c
call 0x480e72
call 0x480182
call 0x480183
add esp, 8
sub eax, dword [esp]
je 0x48019d
jne 0x48019d
jmp fcn.0048019f
jmp 0x4801a0
add esp, 4
call 0x4801b2
call 0x480e98
call 0x4801a8
call 0x4801a9

Function at 0x480183
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x48012c
jmp 0x480130
jmp 0x480133
jbe 0x480150
jmp 0x480138
jmp 0x48013c
jmp 0x48013f
int3
call 0x480155
add esp, 4
call 0x480167
call 0x480e4d
call 0x48015d
call 0x48015e
add esp, 8
je 0x480175
jne 0x480175
jmp 0x480177
jmp 0x480178
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x48018c
call 0x480e72
call 0x480182
call 0x480183
add esp, 8
sub eax, dword [esp]
je 0x48019d
jne 0x48019d
jmp fcn.0048019f
jmp 0x4801a0
add esp, 4
call 0x4801b2
call 0x480e98
call 0x4801a8
call 0x4801a9
Function at 0x48018c
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x48012c
jmp 0x480130
jmp 0x480133
jbe 0x480150
jmp 0x480138
jmp 0x48013c
jmp 0x48013f
int3
call 0x480155
add esp, 4
call 0x480167
call 0x480e4d
call 0x48015d
call 0x48015e
add esp, 8
je 0x480175
jne 0x480175
jmp 0x480177
jmp 0x480178
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x48018c
call 0x480e72
call 0x480182
call 0x480183
add esp, 8
sub eax, dword [esp]
je 0x48019d
jne 0x48019d
jmp fcn.0048019f
jmp 0x4801a0
add esp, 4
call 0x4801b2
call 0x480e98
call 0x4801a8
call 0x4801a9

Function at 0x4801a9
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x48012c
jmp 0x480130
jmp 0x480133
jbe 0x480150
jmp 0x480138
jmp 0x48013c
jmp 0x48013f
int3
call 0x480155
add esp, 4
call 0x480167
call 0x480e4d
call 0x48015d
call 0x48015e
add esp, 8
je 0x480175
jne 0x480175
jmp 0x480177
jmp 0x480178
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x48018c
call 0x480e72
call 0x480182
call 0x480183
add esp, 8
sub eax, dword [esp]
je 0x48019d
jne 0x48019d
jmp fcn.0048019f
jmp 0x4801a0
add esp, 4
call 0x4801b2
call 0x480e98
call 0x4801a8
call 0x4801a9

Function at 0x4801bf
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4801c2
jmp 0x4801c6
jmp 0x4801c9
jbe 0x4801e6
jmp 0x4801ce
jmp 0x4801d2
jmp 0x4801d5
int3
jmp 0x4801e9
jmp 0x4801ed
jmp 0x4801f0
jmp 0x4801f3
jmp 0x4801f7
jmp 0x4801fa
je 0x480200
jne 0x480200
jmp 0x480202
jmp 0x480203
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480217
call 0x480efd
call 0x48020d
call 0x48020e
add esp, 8
sub eax, dword [esp]
je 0x480228
jne 0x480228
jmp 0x48022a
jmp 0x48022b
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480242
add esp, 4
call 0x48023d
call 0x480f23
call 0x480233
call 0x480234
add esp, 8
cmp eax, 0xfff
jmp 0x48024d
jmp 0x480251
jmp 0x480254
jbe 0x480271
jmp 0x480259
jmp 0x48025d
jmp 0x480260
int3
call 0x480276
add esp, 4
call 0x480288
call 0x480f6e
call 0x48027e
call 0x48027f
add esp, 8
je 0x480296

Function at 0x48027f
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4801c2
jmp 0x4801c6
jmp 0x4801c9
jbe 0x4801e6
jmp 0x4801ce
jmp 0x4801d2
jmp 0x4801d5
int3
jmp 0x4801e9
jmp 0x4801ed
jmp 0x4801f0
jmp 0x4801f3
jmp 0x4801f7
jmp 0x4801fa
je 0x480200
jne 0x480200
jmp 0x480202
jmp 0x480203
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480217
call 0x480efd
call 0x48020d
call 0x48020e
add esp, 8
sub eax, dword [esp]
je 0x480228
jne 0x480228
jmp 0x48022a
jmp 0x48022b
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480242
add esp, 4
call 0x48023d
call 0x480f23
call 0x480233
call 0x480234
add esp, 8
cmp eax, 0xfff
jmp 0x48024d
jmp 0x480251
jmp 0x480254
jbe 0x480271
jmp 0x480259
jmp 0x48025d
jmp 0x480260
int3
call 0x480276
add esp, 4
call 0x480288
call 0x480f6e
call 0x48027e
call 0x48027f
add esp, 8
je 0x480296
Function at 0x480292
Capabilities:
Execute anti-debugging instructions

Disassembly:
jne 0x480296
jmp 0x480298
jmp 0x480299
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x4802ad
call 0x480f93
call 0x4802a3
call 0x4802a4
add esp, 8
sub eax, dword [esp]
je 0x4802be
jne 0x4802be
jmp 0x4802c0
jmp 0x4802c1
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x4802d8
add esp, 4
call 0x4802d3
call 0x480fb9
call 0x4802c9
call 0x4802ca
add esp, 8
cmp eax, 0xfff
jmp 0x4802e3
jmp 0x4802e7
jmp 0x4802ea
jbe 0x480307
jmp 0x4802ef
jmp 0x4802f3
jmp 0x4802f6
int3
call 0x48030c
add esp, 4
call fcn.0048031e
call 0x481004
call 0x480314
call 0x480315
add esp, 8
je 0x48032c
jne 0x48032c
jmp 0x48032e
jmp 0x48032f
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480343
call 0x481029
call 0x480339
call 0x48033a
add esp, 8
sub eax, dword [esp]
je 0x480354
jne 0x480354
jmp 0x480356
jmp 0x480357
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x48036e
add esp, 4
call 0x480369
call 0x48104f
call 0x48035f
call 0x480360
add esp, 8
cmp eax, 0xfff
jmp 0x480379
jmp 0x48037d
jmp 0x480380
jbe 0x48039d
jmp 0x480385
jmp 0x480389
jmp 0x48038c
int3
call 0x4803a2
add esp, 4
mov ax, 0xfe
out 0x64, ax
mov eax, dword [esp + 0xc]
mov dword [eax + 4], 0
add al, 0
add byte [eax], al
add bh, al
inc eax
or byte [eax], al
add byte [eax], al
add bh, al
inc eax
or al, 0
add byte [eax], al
add bh, al
inc eax
adc byte [eax], al
add byte [eax], al
add byte [ebx + 0x64082464], cl
pop dword [0]
add esp, 4
call 0x4803df
add esp, 4
call 0x4803f1
call 0x4810d7
call 0x4803e7
call 0x4803e8
add esp, 8
je 0x4803ff
jne 0x4803ff
jmp 0x480401
jmp 0x480402
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480416
call 0x4810fc
call 0x48040c
call 0x48040d
add esp, 8
sub eax, dword [esp]
je 0x480427
jne 0x480427
jmp 0x480429
jmp 0x48042a
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480441
add esp, 4
call 0x48043c
call 0x481122
call 0x480432
call 0x480433
add esp, 8
cmp eax, 0xfff
Function at 0x4802a4
Capabilities:
Execute anti-debugging instructions

Disassembly:
jne 0x480296
jmp 0x480298
jmp 0x480299
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x4802ad
call 0x480f93
call 0x4802a3
call 0x4802a4
add esp, 8
sub eax, dword [esp]
je 0x4802be
jne 0x4802be
jmp 0x4802c0
jmp 0x4802c1
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x4802d8
add esp, 4
call 0x4802d3
call 0x480fb9
call 0x4802c9
call 0x4802ca
add esp, 8
cmp eax, 0xfff
jmp 0x4802e3
jmp 0x4802e7
jmp 0x4802ea
jbe 0x480307
jmp 0x4802ef
jmp 0x4802f3
jmp 0x4802f6
int3
call 0x48030c
add esp, 4
call fcn.0048031e
call 0x481004
call 0x480314
call 0x480315
add esp, 8
je 0x48032c
jne 0x48032c
jmp 0x48032e
jmp 0x48032f
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480343
call 0x481029
call 0x480339
call 0x48033a
add esp, 8
sub eax, dword [esp]
je 0x480354
jne 0x480354
jmp 0x480356
jmp 0x480357
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x48036e
add esp, 4
call 0x480369
call 0x48104f
call 0x48035f
call 0x480360
add esp, 8
cmp eax, 0xfff
jmp 0x480379
jmp 0x48037d
jmp 0x480380
jbe 0x48039d
jmp 0x480385
jmp 0x480389
jmp 0x48038c
int3
call 0x4803a2
add esp, 4
mov ax, 0xfe
out 0x64, ax
mov eax, dword [esp + 0xc]
mov dword [eax + 4], 0
add al, 0
add byte [eax], al
add bh, al
inc eax
or byte [eax], al
add byte [eax], al
add bh, al
inc eax
or al, 0
add byte [eax], al
add bh, al
inc eax
adc byte [eax], al
add byte [eax], al
add byte [ebx + 0x64082464], cl
pop dword [0]
add esp, 4
call 0x4803df
add esp, 4
call 0x4803f1
call 0x4810d7
call 0x4803e7
call 0x4803e8
add esp, 8
je 0x4803ff
jne 0x4803ff
jmp 0x480401
jmp 0x480402
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480416
call 0x4810fc
call 0x48040c
call 0x48040d
add esp, 8
sub eax, dword [esp]
je 0x480427
jne 0x480427
jmp 0x480429
jmp 0x48042a
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480441
add esp, 4
call 0x48043c
call 0x481122
call 0x480432
call 0x480433
add esp, 8
cmp eax, 0xfff
Function at 0x4802ad
Capabilities:
Execute anti-debugging instructions

Disassembly:
jne 0x480296
jmp 0x480298
jmp 0x480299
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x4802ad
call 0x480f93
call 0x4802a3
call 0x4802a4
add esp, 8
sub eax, dword [esp]
je 0x4802be
jne 0x4802be
jmp 0x4802c0
jmp 0x4802c1
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x4802d8
add esp, 4
call 0x4802d3
call 0x480fb9
call 0x4802c9
call 0x4802ca
add esp, 8
cmp eax, 0xfff
jmp 0x4802e3
jmp 0x4802e7
jmp 0x4802ea
jbe 0x480307
jmp 0x4802ef
jmp 0x4802f3
jmp 0x4802f6
int3
call 0x48030c
add esp, 4
call fcn.0048031e
call 0x481004
call 0x480314
call 0x480315
add esp, 8
je 0x48032c
jne 0x48032c
jmp 0x48032e
jmp 0x48032f
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480343
call 0x481029
call 0x480339
call 0x48033a
add esp, 8
sub eax, dword [esp]
je 0x480354
jne 0x480354
jmp 0x480356
jmp 0x480357
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x48036e
add esp, 4
call 0x480369
call 0x48104f
call 0x48035f
call 0x480360
add esp, 8
cmp eax, 0xfff
jmp 0x480379
jmp 0x48037d
jmp 0x480380
jbe 0x48039d
jmp 0x480385
jmp 0x480389
jmp 0x48038c
int3
call 0x4803a2
add esp, 4
mov ax, 0xfe
out 0x64, ax
mov eax, dword [esp + 0xc]
mov dword [eax + 4], 0
add al, 0
add byte [eax], al
add bh, al
inc eax
or byte [eax], al
add byte [eax], al
add bh, al
inc eax
or al, 0
add byte [eax], al
add bh, al
inc eax
adc byte [eax], al
add byte [eax], al
add byte [ebx + 0x64082464], cl
pop dword [0]
add esp, 4
call 0x4803df
add esp, 4
call 0x4803f1
call 0x4810d7
call 0x4803e7
call 0x4803e8
add esp, 8
je 0x4803ff
jne 0x4803ff
jmp 0x480401
jmp 0x480402
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480416
call 0x4810fc
call 0x48040c
call 0x48040d
add esp, 8
sub eax, dword [esp]
je 0x480427
jne 0x480427
jmp 0x480429
jmp 0x48042a
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480441
add esp, 4
call 0x48043c
call 0x481122
call 0x480432
call 0x480433
add esp, 8
cmp eax, 0xfff
Function at 0x4802b8
Capabilities:
Execute anti-debugging instructions

Disassembly:
jne 0x480296
jmp 0x480298
jmp 0x480299
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x4802ad
call 0x480f93
call 0x4802a3
call 0x4802a4
add esp, 8
sub eax, dword [esp]
je 0x4802be
jne 0x4802be
jmp 0x4802c0
jmp 0x4802c1
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x4802d8
add esp, 4
call 0x4802d3
call 0x480fb9
call 0x4802c9
call 0x4802ca
add esp, 8
cmp eax, 0xfff
jmp 0x4802e3
jmp 0x4802e7
jmp 0x4802ea
jbe 0x480307
jmp 0x4802ef
jmp 0x4802f3
jmp 0x4802f6
int3
call 0x48030c
add esp, 4
call fcn.0048031e
call 0x481004
call 0x480314
call 0x480315
add esp, 8
je 0x48032c
jne 0x48032c
jmp 0x48032e
jmp 0x48032f
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480343
call 0x481029
call 0x480339
call 0x48033a
add esp, 8
sub eax, dword [esp]
je 0x480354
jne 0x480354
jmp 0x480356
jmp 0x480357
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x48036e
add esp, 4
call 0x480369
call 0x48104f
call 0x48035f
call 0x480360
add esp, 8
cmp eax, 0xfff
jmp 0x480379
jmp 0x48037d
jmp 0x480380
jbe 0x48039d
jmp 0x480385
jmp 0x480389
jmp 0x48038c
int3
call 0x4803a2
add esp, 4
mov ax, 0xfe
out 0x64, ax
mov eax, dword [esp + 0xc]
mov dword [eax + 4], 0
add al, 0
add byte [eax], al
add bh, al
inc eax
or byte [eax], al
add byte [eax], al
add bh, al
inc eax
or al, 0
add byte [eax], al
add bh, al
inc eax
adc byte [eax], al
add byte [eax], al
add byte [ebx + 0x64082464], cl
pop dword [0]
add esp, 4
call 0x4803df
add esp, 4
call 0x4803f1
call 0x4810d7
call 0x4803e7
call 0x4803e8
add esp, 8
je 0x4803ff
jne 0x4803ff
jmp 0x480401
jmp 0x480402
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480416
call 0x4810fc
call 0x48040c
call 0x48040d
add esp, 8
sub eax, dword [esp]
je 0x480427
jne 0x480427
jmp 0x480429
jmp 0x48042a
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480441
add esp, 4
call 0x48043c
call 0x481122
call 0x480432
call 0x480433
add esp, 8
cmp eax, 0xfff
Function at 0x4802c9
Capabilities:
Execute anti-debugging instructions

Disassembly:
jne 0x480296
jmp 0x480298
jmp 0x480299
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x4802ad
call 0x480f93
call 0x4802a3
call 0x4802a4
add esp, 8
sub eax, dword [esp]
je 0x4802be
jne 0x4802be
jmp 0x4802c0
jmp 0x4802c1
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x4802d8
add esp, 4
call 0x4802d3
call 0x480fb9
call 0x4802c9
call 0x4802ca
add esp, 8
cmp eax, 0xfff
jmp 0x4802e3
jmp 0x4802e7
jmp 0x4802ea
jbe 0x480307
jmp 0x4802ef
jmp 0x4802f3
jmp 0x4802f6
int3
call 0x48030c
add esp, 4
call fcn.0048031e
call 0x481004
call 0x480314
call 0x480315
add esp, 8
je 0x48032c
jne 0x48032c
jmp 0x48032e
jmp 0x48032f
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480343
call 0x481029
call 0x480339
call 0x48033a
add esp, 8
sub eax, dword [esp]
je 0x480354
jne 0x480354
jmp 0x480356
jmp 0x480357
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x48036e
add esp, 4
call 0x480369
call 0x48104f
call 0x48035f
call 0x480360
add esp, 8
cmp eax, 0xfff
jmp 0x480379
jmp 0x48037d
jmp 0x480380
jbe 0x48039d
jmp 0x480385
jmp 0x480389
jmp 0x48038c
int3
call 0x4803a2
add esp, 4
mov ax, 0xfe
out 0x64, ax
mov eax, dword [esp + 0xc]
mov dword [eax + 4], 0
add al, 0
add byte [eax], al
add bh, al
inc eax
or byte [eax], al
add byte [eax], al
add bh, al
inc eax
or al, 0
add byte [eax], al
add bh, al
inc eax
adc byte [eax], al
add byte [eax], al
add byte [ebx + 0x64082464], cl
pop dword [0]
add esp, 4
call 0x4803df
add esp, 4
call 0x4803f1
call 0x4810d7
call 0x4803e7
call 0x4803e8
add esp, 8
je 0x4803ff
jne 0x4803ff
jmp 0x480401
jmp 0x480402
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480416
call 0x4810fc
call 0x48040c
call 0x48040d
add esp, 8
sub eax, dword [esp]
je 0x480427
jne 0x480427
jmp 0x480429
jmp 0x48042a
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480441
add esp, 4
call 0x48043c
call 0x481122
call 0x480432
call 0x480433
add esp, 8
cmp eax, 0xfff
Function at 0x4802ca
Capabilities:
Execute anti-debugging instructions

Disassembly:
jne 0x480296
jmp 0x480298
jmp 0x480299
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x4802ad
call 0x480f93
call 0x4802a3
call 0x4802a4
add esp, 8
sub eax, dword [esp]
je 0x4802be
jne 0x4802be
jmp 0x4802c0
jmp 0x4802c1
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x4802d8
add esp, 4
call 0x4802d3
call 0x480fb9
call 0x4802c9
call 0x4802ca
add esp, 8
cmp eax, 0xfff
jmp 0x4802e3
jmp 0x4802e7
jmp 0x4802ea
jbe 0x480307
jmp 0x4802ef
jmp 0x4802f3
jmp 0x4802f6
int3
call 0x48030c
add esp, 4
call fcn.0048031e
call 0x481004
call 0x480314
call 0x480315
add esp, 8
je 0x48032c
jne 0x48032c
jmp 0x48032e
jmp 0x48032f
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480343
call 0x481029
call 0x480339
call 0x48033a
add esp, 8
sub eax, dword [esp]
je 0x480354
jne 0x480354
jmp 0x480356
jmp 0x480357
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x48036e
add esp, 4
call 0x480369
call 0x48104f
call 0x48035f
call 0x480360
add esp, 8
cmp eax, 0xfff
jmp 0x480379
jmp 0x48037d
jmp 0x480380
jbe 0x48039d
jmp 0x480385
jmp 0x480389
jmp 0x48038c
int3
call 0x4803a2
add esp, 4
mov ax, 0xfe
out 0x64, ax
mov eax, dword [esp + 0xc]
mov dword [eax + 4], 0
add al, 0
add byte [eax], al
add bh, al
inc eax
or byte [eax], al
add byte [eax], al
add bh, al
inc eax
or al, 0
add byte [eax], al
add bh, al
inc eax
adc byte [eax], al
add byte [eax], al
add byte [ebx + 0x64082464], cl
pop dword [0]
add esp, 4
call 0x4803df
add esp, 4
call 0x4803f1
call 0x4810d7
call 0x4803e7
call 0x4803e8
add esp, 8
je 0x4803ff
jne 0x4803ff
jmp 0x480401
jmp 0x480402
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480416
call 0x4810fc
call 0x48040c
call 0x48040d
add esp, 8
sub eax, dword [esp]
je 0x480427
jne 0x480427
jmp 0x480429
jmp 0x48042a
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480441
add esp, 4
call 0x48043c
call 0x481122
call 0x480432
call 0x480433
add esp, 8
cmp eax, 0xfff
Function at 0x4802d3
Capabilities:
Execute anti-debugging instructions

Disassembly:
jne 0x480296
jmp 0x480298
jmp 0x480299
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x4802ad
call 0x480f93
call 0x4802a3
call 0x4802a4
add esp, 8
sub eax, dword [esp]
je 0x4802be
jne 0x4802be
jmp 0x4802c0
jmp 0x4802c1
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x4802d8
add esp, 4
call 0x4802d3
call 0x480fb9
call 0x4802c9
call 0x4802ca
add esp, 8
cmp eax, 0xfff
jmp 0x4802e3
jmp 0x4802e7
jmp 0x4802ea
jbe 0x480307
jmp 0x4802ef
jmp 0x4802f3
jmp 0x4802f6
int3
call 0x48030c
add esp, 4
call fcn.0048031e
call 0x481004
call 0x480314
call 0x480315
add esp, 8
je 0x48032c
jne 0x48032c
jmp 0x48032e
jmp 0x48032f
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480343
call 0x481029
call 0x480339
call 0x48033a
add esp, 8
sub eax, dword [esp]
je 0x480354
jne 0x480354
jmp 0x480356
jmp 0x480357
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x48036e
add esp, 4
call 0x480369
call 0x48104f
call 0x48035f
call 0x480360
add esp, 8
cmp eax, 0xfff
jmp 0x480379
jmp 0x48037d
jmp 0x480380
jbe 0x48039d
jmp 0x480385
jmp 0x480389
jmp 0x48038c
int3
call 0x4803a2
add esp, 4
mov ax, 0xfe
out 0x64, ax
mov eax, dword [esp + 0xc]
mov dword [eax + 4], 0
add al, 0
add byte [eax], al
add bh, al
inc eax
or byte [eax], al
add byte [eax], al
add bh, al
inc eax
or al, 0
add byte [eax], al
add bh, al
inc eax
adc byte [eax], al
add byte [eax], al
add byte [ebx + 0x64082464], cl
pop dword [0]
add esp, 4
call 0x4803df
add esp, 4
call 0x4803f1
call 0x4810d7
call 0x4803e7
call 0x4803e8
add esp, 8
je 0x4803ff
jne 0x4803ff
jmp 0x480401
jmp 0x480402
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480416
call 0x4810fc
call 0x48040c
call 0x48040d
add esp, 8
sub eax, dword [esp]
je 0x480427
jne 0x480427
jmp 0x480429
jmp 0x48042a
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480441
add esp, 4
call 0x48043c
call 0x481122
call 0x480432
call 0x480433
add esp, 8
cmp eax, 0xfff
Function at 0x480314
Capabilities:
Execute anti-debugging instructions

Disassembly:
jne 0x480296
jmp 0x480298
jmp 0x480299
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x4802ad
call 0x480f93
call 0x4802a3
call 0x4802a4
add esp, 8
sub eax, dword [esp]
je 0x4802be
jne 0x4802be
jmp 0x4802c0
jmp 0x4802c1
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x4802d8
add esp, 4
call 0x4802d3
call 0x480fb9
call 0x4802c9
call 0x4802ca
add esp, 8
cmp eax, 0xfff
jmp 0x4802e3
jmp 0x4802e7
jmp 0x4802ea
jbe 0x480307
jmp 0x4802ef
jmp 0x4802f3
jmp 0x4802f6
int3
call 0x48030c
add esp, 4
call fcn.0048031e
call 0x481004
call 0x480314
call 0x480315
add esp, 8
je 0x48032c
jne 0x48032c
jmp 0x48032e
jmp 0x48032f
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480343
call 0x481029
call 0x480339
call 0x48033a
add esp, 8
sub eax, dword [esp]
je 0x480354
jne 0x480354
jmp 0x480356
jmp 0x480357
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x48036e
add esp, 4
call 0x480369
call 0x48104f
call 0x48035f
call 0x480360
add esp, 8
cmp eax, 0xfff
jmp 0x480379
jmp 0x48037d
jmp 0x480380
jbe 0x48039d
jmp 0x480385
jmp 0x480389
jmp 0x48038c
int3
call 0x4803a2
add esp, 4
mov ax, 0xfe
out 0x64, ax
mov eax, dword [esp + 0xc]
mov dword [eax + 4], 0
add al, 0
add byte [eax], al
add bh, al
inc eax
or byte [eax], al
add byte [eax], al
add bh, al
inc eax
or al, 0
add byte [eax], al
add bh, al
inc eax
adc byte [eax], al
add byte [eax], al
add byte [ebx + 0x64082464], cl
pop dword [0]
add esp, 4
call 0x4803df
add esp, 4
call 0x4803f1
call 0x4810d7
call 0x4803e7
call 0x4803e8
add esp, 8
je 0x4803ff
jne 0x4803ff
jmp 0x480401
jmp 0x480402
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480416
call 0x4810fc
call 0x48040c
call 0x48040d
add esp, 8
sub eax, dword [esp]
je 0x480427
jne 0x480427
jmp 0x480429
jmp 0x48042a
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480441
add esp, 4
call 0x48043c
call 0x481122
call 0x480432
call 0x480433
add esp, 8
cmp eax, 0xfff
Function at 0x480315
Capabilities:
Execute anti-debugging instructions

Disassembly:
jne 0x480296
jmp 0x480298
jmp 0x480299
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x4802ad
call 0x480f93
call 0x4802a3
call 0x4802a4
add esp, 8
sub eax, dword [esp]
je 0x4802be
jne 0x4802be
jmp 0x4802c0
jmp 0x4802c1
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x4802d8
add esp, 4
call 0x4802d3
call 0x480fb9
call 0x4802c9
call 0x4802ca
add esp, 8
cmp eax, 0xfff
jmp 0x4802e3
jmp 0x4802e7
jmp 0x4802ea
jbe 0x480307
jmp 0x4802ef
jmp 0x4802f3
jmp 0x4802f6
int3
call 0x48030c
add esp, 4
call fcn.0048031e
call 0x481004
call 0x480314
call 0x480315
add esp, 8
je 0x48032c
jne 0x48032c
jmp 0x48032e
jmp 0x48032f
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480343
call 0x481029
call 0x480339
call 0x48033a
add esp, 8
sub eax, dword [esp]
je 0x480354
jne 0x480354
jmp 0x480356
jmp 0x480357
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x48036e
add esp, 4
call 0x480369
call 0x48104f
call 0x48035f
call 0x480360
add esp, 8
cmp eax, 0xfff
jmp 0x480379
jmp 0x48037d
jmp 0x480380
jbe 0x48039d
jmp 0x480385
jmp 0x480389
jmp 0x48038c
int3
call 0x4803a2
add esp, 4
mov ax, 0xfe
out 0x64, ax
mov eax, dword [esp + 0xc]
mov dword [eax + 4], 0
add al, 0
add byte [eax], al
add bh, al
inc eax
or byte [eax], al
add byte [eax], al
add bh, al
inc eax
or al, 0
add byte [eax], al
add bh, al
inc eax
adc byte [eax], al
add byte [eax], al
add byte [ebx + 0x64082464], cl
pop dword [0]
add esp, 4
call 0x4803df
add esp, 4
call 0x4803f1
call 0x4810d7
call 0x4803e7
call 0x4803e8
add esp, 8
je 0x4803ff
jne 0x4803ff
jmp 0x480401
jmp 0x480402
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480416
call 0x4810fc
call 0x48040c
call 0x48040d
add esp, 8
sub eax, dword [esp]
je 0x480427
jne 0x480427
jmp 0x480429
jmp 0x48042a
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480441
add esp, 4
call 0x48043c
call 0x481122
call 0x480432
call 0x480433
add esp, 8
cmp eax, 0xfff