Function at 0x4b0850
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter
Execute anti-debugging instructions
Get disk size
Get memory capacity
Get system information on windows
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xec
mov eax, dword [0x51e080]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov eax, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xe4], eax
push ebx
push esi
push edi
test edx, edx
je 0x4b0de9
test ecx, ecx
je 0x4b0de9
push 0xb8
mov dword [eax + 0x1c], edx
mov dword [eax + 0x20], ecx
call fcn.004d9a7e
add esp, 4
mov dword [ebp - 0xd0], eax
mov eax, 0
mov edx, 0
rdtsc
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc8], edx
mov eax, dword [ebp - 0xd0]
mov ecx, dword [ebp - 0xc8]
mov dword [eax], ecx
lea esi, [eax + 8]
mov ecx, dword [ebp - 0xc4]
mov dword [eax + 4], ecx
lea eax, [ebp - 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0xbc]
mov dword [esi], eax
mov eax, dword [ebp - 0xc0]
mov dword [esi + 4], eax
lea eax, [ebp - 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov eax, dword [ebp - 0xbc]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0xc0]
mov dword [esi + 0xc], eax
add esi, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
add esi, 0x10
mov dword [ebp - 0xcc], esi
mov eax, 0
mov edx, 0
rdtsc
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc8], edx
mov ebx, dword [ebp - 0xcc]
mov eax, dword [ebp - 0xc8]
mov dword [ebx], eax
mov eax, dword [ebp - 0xc4]
mov dword [ebx + 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebx + 8], eax
add ebx, 0xc
lea eax, [ebp - 0xe0]
mov dword [ebp - 0xc4], 0x34
push eax
push 0x65
push 0
call dword [sym.imp.NETAPI32.dll_NetServerGetInfo]
test eax, eax
jne 0x4b09e0
mov eax, dword [ebp - 0xe0]
movups xmm0, xmmword [eax]
movups xmmword [ebx], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebx + 0x10], xmm0
add ebx, 0x18
mov edx, dword [eax + 4]
mov ecx, edx
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b09a0
sub ecx, esi
sar ecx, 1
lea eax, [ecx + ecx]
mov ecx, 0x10
cmp eax, ecx
cmova eax, ecx
push eax
push edx
push ebx
call fcn.004d6950
add esp, 0xc
mov dword [ebp - 0xc4], 0x5c
add ebx, 0x10
push dword [ebp - 0xe0]
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx], eax
add ebx, 4
mov dword [ebp - 0xcc], ebx
mov eax, 0
mov edx, 0
rdtsc
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xc8], edx
mov esi, dword [ebp - 0xcc]
mov eax, dword [ebp - 0xc8]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov dword [esi], eax
mov eax, dword [ebp - 0xd4]
mov dword [esi + 4], eax
add esi, 8
push esi
call edi
lea eax, [ebp - 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0xbc]
mov dword [esi + 0x40], eax
mov eax, dword [ebp - 0xc0]
mov dword [esi + 0x44], eax
lea eax, [ebp - 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov eax, dword [ebp - 0xbc]
lea ecx, [ebp - 0xb8]
mov dword [esi + 0x48], eax
mov eax, dword [ebp - 0xc0]
mov dword [esi + 0x4c], eax
mov eax, dword [ebp - 0xc4]
mov esi, dword [ebp - 0xd0]
add eax, 0x5c
push ecx
push eax
push esi
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x98], 0
mov dword [ebp - 0xb8], 0x6a09e667
mov dword [ebp - 0xb4], 0xbb67ae85
mov dword [ebp - 0xb0], 0x3c6ef372
mov dword [ebp - 0xac], 0xa54ff53a
mov dword [ebp - 0xa8], 0x510e527f
mov dword [ebp - 0xa4], 0x9b05688c
mov dword [ebp - 0xa0], 0x1f83d9ab
mov dword [ebp - 0x9c], 0x5be0cd19
mov dword [ebp - 0x48], 0
call fcn.004b2370
lea eax, [ebp - 0xb8]
push eax
call fcn.004b2880
movups xmm0, xmmword [ebp - 0xb8]
mov ecx, dword [ebp - 0xe4]
lea edx, [ebp - 0x24]
push edx
movups xmmword [ebp - 0x24], xmm0
push 0x20
movups xmm0, xmmword [ebp - 0xa8]
lea eax, [ecx + 0x24]
mov ecx, dword [ecx + 0x20]
push eax
movups xmmword [ebp - 0x14], xmm0
call fcn.004b48f0
push esi
call fcn.004d9a63
push 0x9c0
call fcn.004d9a7e
mov ebx, eax
push 0x9c0
mov dword [ebp - 0xc8], ebx
call fcn.004d9a7e
add esp, 0xc
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xd0], 0xc
push ebx
call edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0x40], eax
add ebx, 0x44
mov dword [ebp - 0xcc], ebx
mov eax, 0
mov edx, 0
rdtsc
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xd4], edx
mov esi, dword [ebp - 0xcc]
mov eax, dword [ebp - 0xd4]
mov dword [esi], eax
mov eax, dword [ebp - 0xe8]
mov dword [esi + 4], eax
lea eax, [ebp - 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0xbc]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0xc0]
mov dword [esi + 0xc], eax
lea eax, [ebp - 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov eax, dword [ebp - 0xbc]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0xc0]
mov dword [esi + 0x14], eax
add esi, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x40]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
movups xmm0, xmmword [ebp - 0x40]
movups xmmword [esi + 0x10], xmm0
movq xmm0, qword [ebp - 0x30]
movq qword [esi + 0x20], xmm0
add esi, 0x28
mov dword [ebp - 0xcc], esi
mov eax, 0
mov edx, 0
rdtsc
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], edx
mov ebx, dword [ebp - 0xcc]
mov eax, dword [ebp - 0xd8]
mov dword [ebx], eax
mov eax, dword [ebp - 0xdc]
mov dword [ebx + 4], eax
add ebx, 8
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
add ebx, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea eax, [ebp - 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0xbc]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebx + 0x28], eax
lea eax, [ebp - 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov eax, dword [ebp - 0xbc]
mov dword [ebx + 0x2c], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebx + 0x30], eax
add ebx, 0x34
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
sub dword [ebp - 0xd0], 1
mov edi, dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
jne 0x4b0b61
mov eax, 0
mov edx, 0
rdtsc
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xdc], edx
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov esi, dword [ebp - 0xe4]
mov edx, dword [ebp - 0xbc]
mov edi, dword [ebp - 0xc0]
mov dword [ebp - 0x1c], edx
lea ecx, [esi + 0x24]
mov dword [ebp - 0x18], edi
test ecx, ecx
je 0x4b0d2f
mov eax, dword [ebp - 0x24]
mov dword [ecx + 0x1e0], eax
mov eax, dword [ebp - 0x20]
mov dword [ecx + 0x1e4], eax
mov dword [ecx + 0x1e8], edx
mov dword [ecx + 0x1ec], edi
mov edi, dword [esi + 0x20]
mov ebx, dword [ebp - 0xc4]
test ecx, ecx
je 0x4b0d9f
mov edx, dword [ebp - 0xc8]
test edx, edx
je 0x4b0d9f
test ebx, ebx
je 0x4b0d9f
mov eax, dword [ecx + 0x200]
cmp eax, 0xa
je 0x4b0d5f
cmp eax, 0xc
je 0x4b0d5f
cmp eax, 0xe
jne 0x4b0d9f
sub eax, 0xa
je 0x4b0d90
sub eax, 2
je 0x4b0d7f
sub eax, 2
jne 0x4b0d9f
push 0x9c
push ebx
push edx
push ecx
mov ecx, edi
call fcn.004b6710
jmp 0x4b0d9f
push 0x9c
push ebx
push edx
push ecx
mov ecx, edi
call fcn.004b7580
jmp 0x4b0d9f
push 0x9c
push ebx
push edx
push ecx
mov ecx, edi
call fcn.004b8200
mov ecx, dword [esi + 0x274]
push 0x270
push ebx
call fcn.004b0480
push ebx
call fcn.004d9a63
push dword [ebp - 0xc8]
call fcn.004d9a63
add esp, 8
mov dword [esi + 0x228], 0
mov dword [esi], 1
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3878
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d3878
mov esp, ebp
pop ebp
ret 8