joyce8/EMBER2024-capa huggingface dataset:
Function at 0x480a2e
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4809a8
add esp, 8
sub eax, dword [esp]
je 0x4809b4
jne 0x4809b4
jmp 0x4809b6
jmp 0x4809b7
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x4809ce
add esp, 4
call 0x4809c9
call 0x4816af
call 0x4809bf
call 0x4809c0
add esp, 8
cmp eax, 0xfff
jmp 0x4809d9
jmp 0x4809dd
jmp 0x4809e0
jbe 0x4809fd
jmp 0x4809e5
jmp 0x4809e9
jmp 0x4809ec
int3
jmp 0x480a00
jmp 0x480a04
jmp 0x480a07
jmp 0x480a0a
jmp 0x480a0e
jmp 0x480a11
je 0x480a17
jne 0x480a17
jmp 0x480a19
jmp 0x480a1a
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480a2e
call 0x481714
call 0x480a24
call 0x480a25
inc dword [ebx + 0x42b08c4]
and al, 0x74
invalid
jne 0x480a3f
jmp 0x480a41
jmp 0x480a42
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480a59
add esp, 4
call 0x480a54
call 0x48173a
call 0x480a4a
call 0x480a4b
add esp, 8
cmp eax, 0xfff
jmp 0x480a64
jmp 0x480a68
jmp 0x480a6b
jbe 0x480a88
jmp 0x480a70
jmp 0x480a74
jmp 0x480a77
int3
call 0x480a8d
add esp, 4
call 0x480a9f
call 0x481785
call 0x480a95
call 0x480a96
add esp, 8
je 0x480aad
jne 0x480aad
jmp 0x480aaf
jmp 0x480ab0
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480ac4
call 0x4817aa
call 0x480aba
call 0x480abb
add esp, 8
sub eax, dword [esp]
je 0x480ad5
jne 0x480ad5
jmp 0x480ad8
add esp, 4
call 0x480aea
call 0x4817d0
call 0x480ae0
call 0x480ae1
add esp, 8
cmp eax, 0xfff
jmp 0x480afa
jmp 0x480afe
jmp 0x480b01
jbe 0x480b1e
jmp 0x480b06
jmp 0x480b0a
jmp 0x480b0d
int3
call 0x480b23
add esp, 4
call 0x480b35
call 0x48181b
call 0x480b2b
call 0x480b2c
add esp, 8
je 0x480b43
jne 0x480b43
jmp 0x480b45
jmp 0x480b46
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480b5a
call 0x481840
call 0x480b50
call 0x480b51
add esp, 8
sub eax, dword [esp]
je 0x480b6b
jne 0x480b6b
jmp 0x480b6d
jmp 0x480b6e
add dword [ebx + 0xae804c4], 0xe8000000
jmp fcn.00480b85
add esp, 4
call 0x480b80
call 0x481866
call 0x480b76
call 0x480b77
Function at 0x480a4a
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4809a8
add esp, 8
sub eax, dword [esp]
je 0x4809b4
jne 0x4809b4
jmp 0x4809b6
jmp 0x4809b7
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x4809ce
add esp, 4
call 0x4809c9
call 0x4816af
call 0x4809bf
call 0x4809c0
add esp, 8
cmp eax, 0xfff
jmp 0x4809d9
jmp 0x4809dd
jmp 0x4809e0
jbe 0x4809fd
jmp 0x4809e5
jmp 0x4809e9
jmp 0x4809ec
int3
jmp 0x480a00
jmp 0x480a04
jmp 0x480a07
jmp 0x480a0a
jmp 0x480a0e
jmp 0x480a11
je 0x480a17
jne 0x480a17
jmp 0x480a19
jmp 0x480a1a
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480a2e
call 0x481714
call 0x480a24
call 0x480a25
inc dword [ebx + 0x42b08c4]
and al, 0x74
invalid
jne 0x480a3f
jmp 0x480a41
jmp 0x480a42
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480a59
add esp, 4
call 0x480a54
call 0x48173a
call 0x480a4a
call 0x480a4b
add esp, 8
cmp eax, 0xfff
jmp 0x480a64
jmp 0x480a68
jmp 0x480a6b
jbe 0x480a88
jmp 0x480a70
jmp 0x480a74
jmp 0x480a77
int3
call 0x480a8d
add esp, 4
call 0x480a9f
call 0x481785
call 0x480a95
call 0x480a96
add esp, 8
je 0x480aad
jne 0x480aad
jmp 0x480aaf
jmp 0x480ab0
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480ac4
call 0x4817aa
call 0x480aba
call 0x480abb
add esp, 8
sub eax, dword [esp]
je 0x480ad5
jne 0x480ad5
jmp 0x480ad8
add esp, 4
call 0x480aea
call 0x4817d0
call 0x480ae0
call 0x480ae1
add esp, 8
cmp eax, 0xfff
jmp 0x480afa
jmp 0x480afe
jmp 0x480b01
jbe 0x480b1e
jmp 0x480b06
jmp 0x480b0a
jmp 0x480b0d
int3
call 0x480b23
add esp, 4
call 0x480b35
call 0x48181b
call 0x480b2b
call 0x480b2c
add esp, 8
je 0x480b43
jne 0x480b43
jmp 0x480b45
jmp 0x480b46
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480b5a
call 0x481840
call 0x480b50
call 0x480b51
add esp, 8
sub eax, dword [esp]
je 0x480b6b
jne 0x480b6b
jmp 0x480b6d
jmp 0x480b6e
add dword [ebx + 0xae804c4], 0xe8000000
jmp fcn.00480b85
add esp, 4
call 0x480b80
call 0x481866
call 0x480b76
call 0x480b77
Function at 0x480a4b
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4809a8
add esp, 8
sub eax, dword [esp]
je 0x4809b4
jne 0x4809b4
jmp 0x4809b6
jmp 0x4809b7
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x4809ce
add esp, 4
call 0x4809c9
call 0x4816af
call 0x4809bf
call 0x4809c0
add esp, 8
cmp eax, 0xfff
jmp 0x4809d9
jmp 0x4809dd
jmp 0x4809e0
jbe 0x4809fd
jmp 0x4809e5
jmp 0x4809e9
jmp 0x4809ec
int3
jmp 0x480a00
jmp 0x480a04
jmp 0x480a07
jmp 0x480a0a
jmp 0x480a0e
jmp 0x480a11
je 0x480a17
jne 0x480a17
jmp 0x480a19
jmp 0x480a1a
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480a2e
call 0x481714
call 0x480a24
call 0x480a25
inc dword [ebx + 0x42b08c4]
and al, 0x74
invalid
jne 0x480a3f
jmp 0x480a41
jmp 0x480a42
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480a59
add esp, 4
call 0x480a54
call 0x48173a
call 0x480a4a
call 0x480a4b
add esp, 8
cmp eax, 0xfff
jmp 0x480a64
jmp 0x480a68
jmp 0x480a6b
jbe 0x480a88
jmp 0x480a70
jmp 0x480a74
jmp 0x480a77
int3
call 0x480a8d
add esp, 4
call 0x480a9f
call 0x481785
call 0x480a95
call 0x480a96
add esp, 8
je 0x480aad
jne 0x480aad
jmp 0x480aaf
jmp 0x480ab0
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480ac4
call 0x4817aa
call 0x480aba
call 0x480abb
add esp, 8
sub eax, dword [esp]
je 0x480ad5
jne 0x480ad5
jmp 0x480ad8
add esp, 4
call 0x480aea
call 0x4817d0
call 0x480ae0
call 0x480ae1
add esp, 8
cmp eax, 0xfff
jmp 0x480afa
jmp 0x480afe
jmp 0x480b01
jbe 0x480b1e
jmp 0x480b06
jmp 0x480b0a
jmp 0x480b0d
int3
call 0x480b23
add esp, 4
call 0x480b35
call 0x48181b
call 0x480b2b
call 0x480b2c
add esp, 8
je 0x480b43
jne 0x480b43
jmp 0x480b45
jmp 0x480b46
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480b5a
call 0x481840
call 0x480b50
call 0x480b51
add esp, 8
sub eax, dword [esp]
je 0x480b6b
jne 0x480b6b
jmp 0x480b6d
jmp 0x480b6e
add dword [ebx + 0xae804c4], 0xe8000000
jmp fcn.00480b85
add esp, 4
call 0x480b80
call 0x481866
call 0x480b76
call 0x480b77
Function at 0x480a54
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4809a8
add esp, 8
sub eax, dword [esp]
je 0x4809b4
jne 0x4809b4
jmp 0x4809b6
jmp 0x4809b7
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x4809ce
add esp, 4
call 0x4809c9
call 0x4816af
call 0x4809bf
call 0x4809c0
add esp, 8
cmp eax, 0xfff
jmp 0x4809d9
jmp 0x4809dd
jmp 0x4809e0
jbe 0x4809fd
jmp 0x4809e5
jmp 0x4809e9
jmp 0x4809ec
int3
jmp 0x480a00
jmp 0x480a04
jmp 0x480a07
jmp 0x480a0a
jmp 0x480a0e
jmp 0x480a11
je 0x480a17
jne 0x480a17
jmp 0x480a19
jmp 0x480a1a
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480a2e
call 0x481714
call 0x480a24
call 0x480a25
inc dword [ebx + 0x42b08c4]
and al, 0x74
invalid
jne 0x480a3f
jmp 0x480a41
jmp 0x480a42
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480a59
add esp, 4
call 0x480a54
call 0x48173a
call 0x480a4a
call 0x480a4b
add esp, 8
cmp eax, 0xfff
jmp 0x480a64
jmp 0x480a68
jmp 0x480a6b
jbe 0x480a88
jmp 0x480a70
jmp 0x480a74
jmp 0x480a77
int3
call 0x480a8d
add esp, 4
call 0x480a9f
call 0x481785
call 0x480a95
call 0x480a96
add esp, 8
je 0x480aad
jne 0x480aad
jmp 0x480aaf
jmp 0x480ab0
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480ac4
call 0x4817aa
call 0x480aba
call 0x480abb
add esp, 8
sub eax, dword [esp]
je 0x480ad5
jne 0x480ad5
jmp 0x480ad8
add esp, 4
call 0x480aea
call 0x4817d0
call 0x480ae0
call 0x480ae1
add esp, 8
cmp eax, 0xfff
jmp 0x480afa
jmp 0x480afe
jmp 0x480b01
jbe 0x480b1e
jmp 0x480b06
jmp 0x480b0a
jmp 0x480b0d
int3
call 0x480b23
add esp, 4
call 0x480b35
call 0x48181b
call 0x480b2b
call 0x480b2c
add esp, 8
je 0x480b43
jne 0x480b43
jmp 0x480b45
jmp 0x480b46
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480b5a
call 0x481840
call 0x480b50
call 0x480b51
add esp, 8
sub eax, dword [esp]
je 0x480b6b
jne 0x480b6b
jmp 0x480b6d
jmp 0x480b6e
add dword [ebx + 0xae804c4], 0xe8000000
jmp fcn.00480b85
add esp, 4
call 0x480b80
call 0x481866
call 0x480b76
call 0x480b77
Function at 0x480a95
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4809a8
add esp, 8
sub eax, dword [esp]
je 0x4809b4
jne 0x4809b4
jmp 0x4809b6
jmp 0x4809b7
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x4809ce
add esp, 4
call 0x4809c9
call 0x4816af
call 0x4809bf
call 0x4809c0
add esp, 8
cmp eax, 0xfff
jmp 0x4809d9
jmp 0x4809dd
jmp 0x4809e0
jbe 0x4809fd
jmp 0x4809e5
jmp 0x4809e9
jmp 0x4809ec
int3
jmp 0x480a00
jmp 0x480a04
jmp 0x480a07
jmp 0x480a0a
jmp 0x480a0e
jmp 0x480a11
je 0x480a17
jne 0x480a17
jmp 0x480a19
jmp 0x480a1a
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480a2e
call 0x481714
call 0x480a24
call 0x480a25
inc dword [ebx + 0x42b08c4]
and al, 0x74
invalid
jne 0x480a3f
jmp 0x480a41
jmp 0x480a42
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480a59
add esp, 4
call 0x480a54
call 0x48173a
call 0x480a4a
call 0x480a4b
add esp, 8
cmp eax, 0xfff
jmp 0x480a64
jmp 0x480a68
jmp 0x480a6b
jbe 0x480a88
jmp 0x480a70
jmp 0x480a74
jmp 0x480a77
int3
call 0x480a8d
add esp, 4
call 0x480a9f
call 0x481785
call 0x480a95
call 0x480a96
add esp, 8
je 0x480aad
jne 0x480aad
jmp 0x480aaf
jmp 0x480ab0
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480ac4
call 0x4817aa
call 0x480aba
call 0x480abb
add esp, 8
sub eax, dword [esp]
je 0x480ad5
jne 0x480ad5
jmp 0x480ad8
add esp, 4
call 0x480aea
call 0x4817d0
call 0x480ae0
call 0x480ae1
add esp, 8
cmp eax, 0xfff
jmp 0x480afa
jmp 0x480afe
jmp 0x480b01
jbe 0x480b1e
jmp 0x480b06
jmp 0x480b0a
jmp 0x480b0d
int3
call 0x480b23
add esp, 4
call 0x480b35
call 0x48181b
call 0x480b2b
call 0x480b2c
add esp, 8
je 0x480b43
jne 0x480b43
jmp 0x480b45
jmp 0x480b46
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480b5a
call 0x481840
call 0x480b50
call 0x480b51
add esp, 8
sub eax, dword [esp]
je 0x480b6b
jne 0x480b6b
jmp 0x480b6d
jmp 0x480b6e
add dword [ebx + 0xae804c4], 0xe8000000
jmp fcn.00480b85
add esp, 4
call 0x480b80
call 0x481866
call 0x480b76
call 0x480b77
Function at 0x480a96
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4809a8
add esp, 8
sub eax, dword [esp]
je 0x4809b4
jne 0x4809b4
jmp 0x4809b6
jmp 0x4809b7
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x4809ce
add esp, 4
call 0x4809c9
call 0x4816af
call 0x4809bf
call 0x4809c0
add esp, 8
cmp eax, 0xfff
jmp 0x4809d9
jmp 0x4809dd
jmp 0x4809e0
jbe 0x4809fd
jmp 0x4809e5
jmp 0x4809e9
jmp 0x4809ec
int3
jmp 0x480a00
jmp 0x480a04
jmp 0x480a07
jmp 0x480a0a
jmp 0x480a0e
jmp 0x480a11
je 0x480a17
jne 0x480a17
jmp 0x480a19
jmp 0x480a1a
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480a2e
call 0x481714
call 0x480a24
call 0x480a25
inc dword [ebx + 0x42b08c4]
and al, 0x74
invalid
jne 0x480a3f
jmp 0x480a41
jmp 0x480a42
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480a59
add esp, 4
call 0x480a54
call 0x48173a
call 0x480a4a
call 0x480a4b
add esp, 8
cmp eax, 0xfff
jmp 0x480a64
jmp 0x480a68
jmp 0x480a6b
jbe 0x480a88
jmp 0x480a70
jmp 0x480a74
jmp 0x480a77
int3
call 0x480a8d
add esp, 4
call 0x480a9f
call 0x481785
call 0x480a95
call 0x480a96
add esp, 8
je 0x480aad
jne 0x480aad
jmp 0x480aaf
jmp 0x480ab0
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480ac4
call 0x4817aa
call 0x480aba
call 0x480abb
add esp, 8
sub eax, dword [esp]
je 0x480ad5
jne 0x480ad5
jmp 0x480ad8
add esp, 4
call 0x480aea
call 0x4817d0
call 0x480ae0
call 0x480ae1
add esp, 8
cmp eax, 0xfff
jmp 0x480afa
jmp 0x480afe
jmp 0x480b01
jbe 0x480b1e
jmp 0x480b06
jmp 0x480b0a
jmp 0x480b0d
int3
call 0x480b23
add esp, 4
call 0x480b35
call 0x48181b
call 0x480b2b
call 0x480b2c
add esp, 8
je 0x480b43
jne 0x480b43
jmp 0x480b45
jmp 0x480b46
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480b5a
call 0x481840
call 0x480b50
call 0x480b51
add esp, 8
sub eax, dword [esp]
je 0x480b6b
jne 0x480b6b
jmp 0x480b6d
jmp 0x480b6e
add dword [ebx + 0xae804c4], 0xe8000000
jmp fcn.00480b85
add esp, 4
call 0x480b80
call 0x481866
call 0x480b76
call 0x480b77
Function at 0x480a9f
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4809a8
add esp, 8
sub eax, dword [esp]
je 0x4809b4
jne 0x4809b4
jmp 0x4809b6
jmp 0x4809b7
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x4809ce
add esp, 4
call 0x4809c9
call 0x4816af
call 0x4809bf
call 0x4809c0
add esp, 8
cmp eax, 0xfff
jmp 0x4809d9
jmp 0x4809dd
jmp 0x4809e0
jbe 0x4809fd
jmp 0x4809e5
jmp 0x4809e9
jmp 0x4809ec
int3
jmp 0x480a00
jmp 0x480a04
jmp 0x480a07
jmp 0x480a0a
jmp 0x480a0e
jmp 0x480a11
je 0x480a17
jne 0x480a17
jmp 0x480a19
jmp 0x480a1a
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480a2e
call 0x481714
call 0x480a24
call 0x480a25
inc dword [ebx + 0x42b08c4]
and al, 0x74
invalid
jne 0x480a3f
jmp 0x480a41
jmp 0x480a42
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480a59
add esp, 4
call 0x480a54
call 0x48173a
call 0x480a4a
call 0x480a4b
add esp, 8
cmp eax, 0xfff
jmp 0x480a64
jmp 0x480a68
jmp 0x480a6b
jbe 0x480a88
jmp 0x480a70
jmp 0x480a74
jmp 0x480a77
int3
call 0x480a8d
add esp, 4
call 0x480a9f
call 0x481785
call 0x480a95
call 0x480a96
add esp, 8
je 0x480aad
jne 0x480aad
jmp 0x480aaf
jmp 0x480ab0
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480ac4
call 0x4817aa
call 0x480aba
call 0x480abb
add esp, 8
sub eax, dword [esp]
je 0x480ad5
jne 0x480ad5
jmp 0x480ad8
add esp, 4
call 0x480aea
call 0x4817d0
call 0x480ae0
call 0x480ae1
add esp, 8
cmp eax, 0xfff
jmp 0x480afa
jmp 0x480afe
jmp 0x480b01
jbe 0x480b1e
jmp 0x480b06
jmp 0x480b0a
jmp 0x480b0d
int3
call 0x480b23
add esp, 4
call 0x480b35
call 0x48181b
call 0x480b2b
call 0x480b2c
add esp, 8
je 0x480b43
jne 0x480b43
jmp 0x480b45
jmp 0x480b46
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480b5a
call 0x481840
call 0x480b50
call 0x480b51
add esp, 8
sub eax, dword [esp]
je 0x480b6b
jne 0x480b6b
jmp 0x480b6d
jmp 0x480b6e
add dword [ebx + 0xae804c4], 0xe8000000
jmp fcn.00480b85
add esp, 4
call 0x480b80
call 0x481866
call 0x480b76
call 0x480b77
Function at 0x480aba
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4809a8
add esp, 8
sub eax, dword [esp]
je 0x4809b4
jne 0x4809b4
jmp 0x4809b6
jmp 0x4809b7
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x4809ce
add esp, 4
call 0x4809c9
call 0x4816af
call 0x4809bf
call 0x4809c0
add esp, 8
cmp eax, 0xfff
jmp 0x4809d9
jmp 0x4809dd
jmp 0x4809e0
jbe 0x4809fd
jmp 0x4809e5
jmp 0x4809e9
jmp 0x4809ec
int3
jmp 0x480a00
jmp 0x480a04
jmp 0x480a07
jmp 0x480a0a
jmp 0x480a0e
jmp 0x480a11
je 0x480a17
jne 0x480a17
jmp 0x480a19
jmp 0x480a1a
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480a2e
call 0x481714
call 0x480a24
call 0x480a25
inc dword [ebx + 0x42b08c4]
and al, 0x74
invalid
jne 0x480a3f
jmp 0x480a41
jmp 0x480a42
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480a59
add esp, 4
call 0x480a54
call 0x48173a
call 0x480a4a
call 0x480a4b
add esp, 8
cmp eax, 0xfff
jmp 0x480a64
jmp 0x480a68
jmp 0x480a6b
jbe 0x480a88
jmp 0x480a70
jmp 0x480a74
jmp 0x480a77
int3
call 0x480a8d
add esp, 4
call 0x480a9f
call 0x481785
call 0x480a95
call 0x480a96
add esp, 8
je 0x480aad
jne 0x480aad
jmp 0x480aaf
jmp 0x480ab0
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480ac4
call 0x4817aa
call 0x480aba
call 0x480abb
add esp, 8
sub eax, dword [esp]
je 0x480ad5
jne 0x480ad5
jmp 0x480ad8
add esp, 4
call 0x480aea
call 0x4817d0
call 0x480ae0
call 0x480ae1
add esp, 8
cmp eax, 0xfff
jmp 0x480afa
jmp 0x480afe
jmp 0x480b01
jbe 0x480b1e
jmp 0x480b06
jmp 0x480b0a
jmp 0x480b0d
int3
call 0x480b23
add esp, 4
call 0x480b35
call 0x48181b
call 0x480b2b
call 0x480b2c
add esp, 8
je 0x480b43
jne 0x480b43
jmp 0x480b45
jmp 0x480b46
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480b5a
call 0x481840
call 0x480b50
call 0x480b51
add esp, 8
sub eax, dword [esp]
je 0x480b6b
jne 0x480b6b
jmp 0x480b6d
jmp 0x480b6e
add dword [ebx + 0xae804c4], 0xe8000000
jmp fcn.00480b85
add esp, 4
call 0x480b80
call 0x481866
call 0x480b76
call 0x480b77
Function at 0x480abb
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4809a8
add esp, 8
sub eax, dword [esp]
je 0x4809b4
jne 0x4809b4
jmp 0x4809b6
jmp 0x4809b7
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x4809ce
add esp, 4
call 0x4809c9
call 0x4816af
call 0x4809bf
call 0x4809c0
add esp, 8
cmp eax, 0xfff
jmp 0x4809d9
jmp 0x4809dd
jmp 0x4809e0
jbe 0x4809fd
jmp 0x4809e5
jmp 0x4809e9
jmp 0x4809ec
int3
jmp 0x480a00
jmp 0x480a04
jmp 0x480a07
jmp 0x480a0a
jmp 0x480a0e
jmp 0x480a11
je 0x480a17
jne 0x480a17
jmp 0x480a19
jmp 0x480a1a
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480a2e
call 0x481714
call 0x480a24
call 0x480a25
inc dword [ebx + 0x42b08c4]
and al, 0x74
invalid
jne 0x480a3f
jmp 0x480a41
jmp 0x480a42
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480a59
add esp, 4
call 0x480a54
call 0x48173a
call 0x480a4a
call 0x480a4b
add esp, 8
cmp eax, 0xfff
jmp 0x480a64
jmp 0x480a68
jmp 0x480a6b
jbe 0x480a88
jmp 0x480a70
jmp 0x480a74
jmp 0x480a77
int3
call 0x480a8d
add esp, 4
call 0x480a9f
call 0x481785
call 0x480a95
call 0x480a96
add esp, 8
je 0x480aad
jne 0x480aad
jmp 0x480aaf
jmp 0x480ab0
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480ac4
call 0x4817aa
call 0x480aba
call 0x480abb
add esp, 8
sub eax, dword [esp]
je 0x480ad5
jne 0x480ad5
jmp 0x480ad8
add esp, 4
call 0x480aea
call 0x4817d0
call 0x480ae0
call 0x480ae1
add esp, 8
cmp eax, 0xfff
jmp 0x480afa
jmp 0x480afe
jmp 0x480b01
jbe 0x480b1e
jmp 0x480b06
jmp 0x480b0a
jmp 0x480b0d
int3
call 0x480b23
add esp, 4
call 0x480b35
call 0x48181b
call 0x480b2b
call 0x480b2c
add esp, 8
je 0x480b43
jne 0x480b43
jmp 0x480b45
jmp 0x480b46
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480b5a
call 0x481840
call 0x480b50
call 0x480b51
add esp, 8
sub eax, dword [esp]
je 0x480b6b
jne 0x480b6b
jmp 0x480b6d
jmp 0x480b6e
add dword [ebx + 0xae804c4], 0xe8000000
jmp fcn.00480b85
add esp, 4
call 0x480b80
call 0x481866
call 0x480b76
call 0x480b77
Function at 0x480ac4
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4809a8
add esp, 8
sub eax, dword [esp]
je 0x4809b4
jne 0x4809b4
jmp 0x4809b6
jmp 0x4809b7
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x4809ce
add esp, 4
call 0x4809c9
call 0x4816af
call 0x4809bf
call 0x4809c0
add esp, 8
cmp eax, 0xfff
jmp 0x4809d9
jmp 0x4809dd
jmp 0x4809e0
jbe 0x4809fd
jmp 0x4809e5
jmp 0x4809e9
jmp 0x4809ec
int3
jmp 0x480a00
jmp 0x480a04
jmp 0x480a07
jmp 0x480a0a
jmp 0x480a0e
jmp 0x480a11
je 0x480a17
jne 0x480a17
jmp 0x480a19
jmp 0x480a1a
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480a2e
call 0x481714
call 0x480a24
call 0x480a25
inc dword [ebx + 0x42b08c4]
and al, 0x74
invalid
jne 0x480a3f
jmp 0x480a41
jmp 0x480a42
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480a59
add esp, 4
call 0x480a54
call 0x48173a
call 0x480a4a
call 0x480a4b
add esp, 8
cmp eax, 0xfff
jmp 0x480a64
jmp 0x480a68
jmp 0x480a6b
jbe 0x480a88
jmp 0x480a70
jmp 0x480a74
jmp 0x480a77
int3
call 0x480a8d
add esp, 4
call 0x480a9f
call 0x481785
call 0x480a95
call 0x480a96
add esp, 8
je 0x480aad
jne 0x480aad
jmp 0x480aaf
jmp 0x480ab0
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480ac4
call 0x4817aa
call 0x480aba
call 0x480abb
add esp, 8
sub eax, dword [esp]
je 0x480ad5
jne 0x480ad5
jmp 0x480ad8
add esp, 4
call 0x480aea
call 0x4817d0
call 0x480ae0
call 0x480ae1
add esp, 8
cmp eax, 0xfff
jmp 0x480afa
jmp 0x480afe
jmp 0x480b01
jbe 0x480b1e
jmp 0x480b06
jmp 0x480b0a
jmp 0x480b0d
int3
call 0x480b23
add esp, 4
call 0x480b35
call 0x48181b
call 0x480b2b
call 0x480b2c
add esp, 8
je 0x480b43
jne 0x480b43
jmp 0x480b45
jmp 0x480b46
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480b5a
call 0x481840
call 0x480b50
call 0x480b51
add esp, 8
sub eax, dword [esp]
je 0x480b6b
jne 0x480b6b
jmp 0x480b6d
jmp 0x480b6e
add dword [ebx + 0xae804c4], 0xe8000000
jmp fcn.00480b85
add esp, 4
call 0x480b80
call 0x481866
call 0x480b76
call 0x480b77

Function at 0x480ae0
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x480ad7
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480aef

Function at 0x480ae1
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x480ad7
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480aef
Function at 0x480aea
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4809a8
add esp, 8
sub eax, dword [esp]
je 0x4809b4
jne 0x4809b4
jmp 0x4809b6
jmp 0x4809b7
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x4809ce
add esp, 4
call 0x4809c9
call 0x4816af
call 0x4809bf
call 0x4809c0
add esp, 8
cmp eax, 0xfff
jmp 0x4809d9
jmp 0x4809dd
jmp 0x4809e0
jbe 0x4809fd
jmp 0x4809e5
jmp 0x4809e9
jmp 0x4809ec
int3
jmp 0x480a00
jmp 0x480a04
jmp 0x480a07
jmp 0x480a0a
jmp 0x480a0e
jmp 0x480a11
je 0x480a17
jne 0x480a17
jmp 0x480a19
jmp 0x480a1a
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480a2e
call 0x481714
call 0x480a24
call 0x480a25
inc dword [ebx + 0x42b08c4]
and al, 0x74
invalid
jne 0x480a3f
jmp 0x480a41
jmp 0x480a42
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480a59
add esp, 4
call 0x480a54
call 0x48173a
call 0x480a4a
call 0x480a4b
add esp, 8
cmp eax, 0xfff
jmp 0x480a64
jmp 0x480a68
jmp 0x480a6b
jbe 0x480a88
jmp 0x480a70
jmp 0x480a74
jmp 0x480a77
int3
call 0x480a8d
add esp, 4
call 0x480a9f
call 0x481785
call 0x480a95
call 0x480a96
add esp, 8
je 0x480aad
jne 0x480aad
jmp 0x480aaf
jmp 0x480ab0
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480ac4
call 0x4817aa
call 0x480aba
call 0x480abb
add esp, 8
sub eax, dword [esp]
je 0x480ad5
jne 0x480ad5
jmp 0x480ad8
add esp, 4
call 0x480aea
call 0x4817d0
call 0x480ae0
call 0x480ae1
add esp, 8
cmp eax, 0xfff
jmp 0x480afa
jmp 0x480afe
jmp 0x480b01
jbe 0x480b1e
jmp 0x480b06
jmp 0x480b0a
jmp 0x480b0d
int3
call 0x480b23
add esp, 4
call 0x480b35
call 0x48181b
call 0x480b2b
call 0x480b2c
add esp, 8
je 0x480b43
jne 0x480b43
jmp 0x480b45
jmp 0x480b46
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480b5a
call 0x481840
call 0x480b50
call 0x480b51
add esp, 8
sub eax, dword [esp]
je 0x480b6b
jne 0x480b6b
jmp 0x480b6d
jmp 0x480b6e
add dword [ebx + 0xae804c4], 0xe8000000
jmp fcn.00480b85
add esp, 4
call 0x480b80
call 0x481866
call 0x480b76
call 0x480b77
Function at 0x480b2b
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4809a8
add esp, 8
sub eax, dword [esp]
je 0x4809b4
jne 0x4809b4
jmp 0x4809b6
jmp 0x4809b7
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x4809ce
add esp, 4
call 0x4809c9
call 0x4816af
call 0x4809bf
call 0x4809c0
add esp, 8
cmp eax, 0xfff
jmp 0x4809d9
jmp 0x4809dd
jmp 0x4809e0
jbe 0x4809fd
jmp 0x4809e5
jmp 0x4809e9
jmp 0x4809ec
int3
jmp 0x480a00
jmp 0x480a04
jmp 0x480a07
jmp 0x480a0a
jmp 0x480a0e
jmp 0x480a11
je 0x480a17
jne 0x480a17
jmp 0x480a19
jmp 0x480a1a
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480a2e
call 0x481714
call 0x480a24
call 0x480a25
inc dword [ebx + 0x42b08c4]
and al, 0x74
invalid
jne 0x480a3f
jmp 0x480a41
jmp 0x480a42
add dword [ebx + 0xae804c4], 0xe8000000
jmp 0x480a59
add esp, 4
call 0x480a54
call 0x48173a
call 0x480a4a
call 0x480a4b
add esp, 8
cmp eax, 0xfff
jmp 0x480a64
jmp 0x480a68
jmp 0x480a6b
jbe 0x480a88
jmp 0x480a70
jmp 0x480a74
jmp 0x480a77
int3
call 0x480a8d
add esp, 4
call 0x480a9f
call 0x481785
call 0x480a95
call 0x480a96
add esp, 8
je 0x480aad
jne 0x480aad
jmp 0x480aaf
jmp 0x480ab0
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480ac4
call 0x4817aa
call 0x480aba
call 0x480abb
add esp, 8
sub eax, dword [esp]
je 0x480ad5
jne 0x480ad5
jmp 0x480ad8
add esp, 4
call 0x480aea
call 0x4817d0
call 0x480ae0
call 0x480ae1
add esp, 8
cmp eax, 0xfff
jmp 0x480afa
jmp 0x480afe
jmp 0x480b01
jbe 0x480b1e
jmp 0x480b06
jmp 0x480b0a
jmp 0x480b0d
int3
call 0x480b23
add esp, 4
call 0x480b35
call 0x48181b
call 0x480b2b
call 0x480b2c
add esp, 8
je 0x480b43
jne 0x480b43
jmp 0x480b45
jmp 0x480b46
or dword [edi], 0x310f5031
rdtsc
push eax
rdtsc
call 0x480b5a
call 0x481840
call 0x480b50
call 0x480b51
add esp, 8
sub eax, dword [esp]
je 0x480b6b
jne 0x480b6b
jmp 0x480b6d
jmp 0x480b6e
add dword [ebx + 0xae804c4], 0xe8000000
jmp fcn.00480b85
add esp, 4
call 0x480b80
call 0x481866
call 0x480b76
call 0x480b77