What does the function code do

Question

What does this code do?

.text:0048EBCD                 mov     ecx, dword_4CEAC8
.text:0048EBD3                 mov     edx, dword_4CEACC
.text:0048EBD9                 mov     [ebp+var_4], eax
.text:0048EBDC                 mov     eax, dword_4CEAD0
.text:0048EBE1                 mov     [ebp+var_28], ecx
.text:0048EBE4                 mov     cl, byte_4CEAD4
.text:0048EBEA                 mov     [ebp+var_24], edx
.text:0048EBED                 mov     [ebp+var_20], eax
.text:0048EBF0                 mov     [ebp+var_1C], cl
.text:0048EBF3                 pusha
.text:0048EBF4                 mov     [ebp+var_18], 4
.text:0048EBFB                 pushf
.text:0048EBFC                 pop     eax
.text:0048EBFD                 mov     ecx, eax
.text:0048EBFF                 xor     eax, 200000h
.text:0048EC04                 push    eax
.text:0048EC05                 popf
.text:0048EC06                 pushf
.text:0048EC07                 pop     eax
.text:0048EC08                 xor     eax, ecx
.text:0048EC0A                 jz      short loc_48EC5C
.text:0048EC0C                 mov     [ebp+var_14], 0
.text:0048EC13                 mov     eax, 0
.text:0048EC18                 cpuid
.text:0048EC1A                 mov     [ebp+var_14], eax
.text:0048EC1D                 mov     [ebp+var_28], ebx
.text:0048EC20                 mov     [ebp+var_24], edx
.text:0048EC23                 mov     [ebp+var_20], ecx

What do this numbers mean?

.data:004CEAC8 dword_4CEAC8    dd 6E6F6E41h            ; DATA XREF: DX_Enumerate+1Dr
.data:004CEAC8                                         ; sub_497290+24r
.data:004CEACC dword_4CEACC    dd 756F6D79h            ; DATA XREF: DX_Enumerate+23r
.data:004CEACC                                         ; sub_497290+6r
.data:004CEAD0 dword_4CEAD0    dd 55504373h            ; DATA XREF: DX_Enumerate+2Cr
.data:004CEAD0                                         ; sub_497290+Cr
.data:004CEAD4 byte_4CEAD4     db 0                    ; DATA XREF: DX_Enumerate+34r
.data:004CEAD4                                         ; sub_497290+2Cr

Why is it done xor?

.text:0048EBFF                 xor     eax, 200000h

Answer 1

the string is "anonymousCPU"

by pushing the EFLAGS and Xorring with 200000 it is checking if CPUID is usable or not

21 0x0020 0000 ID Able to use CPUID instruction (Pentium+) System

and proceeds ahead based on result

Answer 2

This is not a function code because a function code is a few lines of code at the beginning of a function, which prepare the stack and registers for use within the function.

I split the assembly code in two parts.

The first part:

mov     ecx, 6E6F6E41h
mov     edx, 756F6D79h
...
jz      short loc_48EC5C

Before I will explain what this part does, you can see that I changed dword_4CEAC8 to 0x6E6F6E41 because dword_4CEAC8 is a memory location that holds a 4 byte (double word or 32 bit) value, the address dword_4CEAC8 is a memory location and it is a variable which holds a is points to a different location, the above does some stuff till the JZ instruction and if ZF(Zero Flag) is set the EIP(instruction pointer) jumps to loc_48EC5C address.

Afterwards, the second part:

mov     [ebp+var_14], 0
mov     eax, 0
cpuid
mov     [ebp+var_14], eax
mov     [ebp+var_28], ebx
mov     [ebp+var_24], edx
mov     [ebp+var_20], ecx

Get the CPU Vendor ID using the cpuid instruction which stores the vendor ID string in EBX, EDX and ECX registers.

We can say in general, this assembly code appears to be moving specific hexadecimal values into registers, and then storing those registers into memory at specific locations. The values being moved into registers are: 0x6E6F6E41 into ECX, 0x756F6D79 into EDX, 0x55504373 into EAX, and 0 into CL register. It then appears to be saving the current state of the processor flags on the stack, performing a bitwise XOR operation, and executing the CPUID instruction.

The idea of the CPUID instruction is that you can call it with different values in EAX, and it will return different information about the processor. Finally, it is moving the contents of the registers back into memory at different locations.

Just a note, I took the explanations about CPUID from osdev website , and advise with chatGPT about the code.

Read more

1. CPUID
2. function prologue and epilogue