joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006920
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x28a727c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28a6e50
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10006b0f
push edi
mov edi, dword [0x28a6e50]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10006b0e
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10006b0e
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10006b0e
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10006b0e
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10006b0e
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10006b0e
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10006b0e
mov edi, dword [edi]
push 4
add edi, 0x1b24
push edi
call esi
test eax, eax
jne 0x10006b0e
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x10006b0e
push ebx
mov ebx, dword [0x28a6e50]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006b0d
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10006b0d
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006b0d
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x10006b0d
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10006b0d
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10006b0d
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x10006b0d
mov ebx, dword [0x28a6e50]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006b0d
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10006b0d
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006b0d
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x10006b0d
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10006b0d
mov eax, dword [ebx]
cmp eax, 0x12
je 0x10006aed
cmp eax, 0x2722
je 0x10006aed
cmp eax, 0xea72
jne 0x10006b0d
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
mov byte [edi], 5
push eax
push dword [ebp - 8]
push 1
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100271b9
mov esp, ebp
pop ebp
ret
Function at 0x10006b20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x28a727c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28a6e50
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10006d0f
push edi
mov edi, dword [0x28a6e50]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10006d0e
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10006d0e
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10006d0e
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10006d0e
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10006d0e
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10006d0e
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10006d0e
mov edi, dword [edi]
push 4
add edi, 0x1b24
push edi
call esi
test eax, eax
jne 0x10006d0e
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x10006d0e
push ebx
mov ebx, dword [0x28a6e50]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006d0d
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10006d0d
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006d0d
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x10006d0d
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10006d0d
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10006d0d
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x10006d0d
mov ebx, dword [0x28a6e50]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006d0d
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10006d0d
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006d0d
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x10006d0d
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10006d0d
mov eax, dword [ebx]
cmp eax, 3
je 0x10006ced
cmp eax, 0xc353
je 0x10006ced
cmp eax, 0xea63
jne 0x10006d0d
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
mov byte [edi], 8
push eax
push dword [ebp - 8]
push 1
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100271b9
mov esp, ebp
pop ebp
ret
Function at 0x10006d20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1003400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [0x28a727c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28a6e50
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10006f16
push edi
mov edi, dword [0x28a6e50]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10006f15
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10006f15
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10006f15
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10006f15
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10006f15
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10006f15
push ebx
mov ebx, dword [edi]
push 4
push ebx
call esi
test eax, eax
jne 0x10006f14
mov ebx, dword [ebx]
add ebx, dword [ebp + 0x20]
push 4
push ebx
call esi
test eax, eax
jne 0x10006f14
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x10006f14
mov edi, dword [0x28a6e50]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10006f14
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10006f14
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10006f14
mov edi, dword [edi]
push 4
add edi, 0x2e0
push edi
call esi
test eax, eax
jne 0x10006f14
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10006f14
mov ecx, dword [ebp - 8]
mov eax, dword [edi]
cmp eax, dword [ecx]
jne 0x10006f14
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x10006f14
mov edi, dword [0x28a6e50]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10006f14
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10006f14
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10006f14
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10006f14
mov edi, dword [edi]
push 4
add edi, 0x15c
push edi
call esi
test eax, eax
jne 0x10006f14
mov eax, dword [edi]
cmp eax, 0x6e
je 0x10006ee9
cmp eax, 0x277e
jne 0x10006f14
mov edi, dword [ebp + 0x28]
lea eax, [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push edi
push ebx
call esi
push edi
push dword [ebp - 0xc]
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push ebx
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100271b9
mov esp, ebp
pop ebp
ret
Function at 0x10006f30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x28a727c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28a6e50
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x1000711a
push edi
mov edi, dword [0x28a6e50]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10007119
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10007119
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10007119
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10007119
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10007119
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10007119
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10007119
mov edi, dword [edi]
push 4
add edi, 0x1e72
push edi
call esi
test eax, eax
jne 0x10007119
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x10007119
push ebx
mov ebx, dword [0x28a6e50]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10007118
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10007118
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10007118
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x10007118
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10007118
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10007118
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x10007118
mov ebx, dword [0x28a6e50]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10007118
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10007118
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10007118
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x10007118
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10007118
mov eax, dword [ebx]
cmp eax, 0x99
je 0x100070f8
cmp eax, 0x27a9
jne 0x10007118
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
mov byte [edi], 0xc8
push eax
push dword [ebp - 8]
push 1
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100271b9
mov esp, ebp
pop ebp
ret
Function at 0x10007130
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1003400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [0x28a727c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28a6e50
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10007328
push edi
mov edi, dword [0x28a6e50]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10007327
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10007327
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10007327
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10007327
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10007327
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10007327
push ebx
mov ebx, dword [edi]
push 4
push ebx
call esi
test eax, eax
jne 0x10007326
mov ebx, dword [ebx]
add ebx, dword [ebp + 0x20]
push 4
push ebx
call esi
test eax, eax
jne 0x10007326
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x10007326
mov edi, dword [0x28a6e50]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10007326
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10007326
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10007326
mov edi, dword [edi]
push 4
add edi, 0x2e0
push edi
call esi
test eax, eax
jne 0x10007326
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10007326
mov ecx, dword [ebp - 8]
mov eax, dword [edi]
cmp eax, dword [ecx]
jne 0x10007326
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x10007326
mov edi, dword [0x28a6e50]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10007326
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10007326
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10007326
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10007326
mov edi, dword [edi]
push 4
add edi, 0x15c
push edi
call esi
test eax, eax
jne 0x10007326
mov eax, dword [edi]
cmp eax, 0xa9
je 0x100072fb
cmp eax, 0x27b9
jne 0x10007326
mov edi, dword [ebp + 0x28]
lea eax, [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push edi
push ebx
call esi
push edi
push dword [ebp - 0xc]
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push ebx
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100271b9
mov esp, ebp
pop ebp
ret
Function at 0x10007340
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x28a727c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28a6e50
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10007528
push edi
mov edi, dword [0x28a6e50]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10007527
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10007527
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10007527
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10007527
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10007527
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10007527
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10007527
mov edi, dword [edi]
push 4
add edi, 0x1b54
push edi
call esi
test eax, eax
jne 0x10007527
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x10007527
push ebx
mov ebx, dword [0x28a6e50]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10007526
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10007526
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10007526
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x10007526
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10007526
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10007526
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x10007526
mov ebx, dword [0x28a6e50]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10007526
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10007526
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10007526
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x10007526
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10007526
mov eax, dword [ebx]
cmp eax, 0x23
je 0x10007506
cmp eax, 0x2733
jne 0x10007526
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
mov byte [edi], 2
push eax
push dword [ebp - 8]
push 1
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100271b9
mov esp, ebp
pop ebp
ret
Function at 0x10007540
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x28a727c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28a6e50
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x1000777a
push edi
mov edi, dword [0x28a6e50]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10007779
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10007779
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10007779
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10007779
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10007779
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10007779
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10007779
mov edi, dword [edi]
push 4
add edi, 0x1bd8
push edi
call esi
test eax, eax
jne 0x10007779
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x10007779
push ebx
mov ebx, dword [0x28a6e50]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10007778
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10007778
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10007778
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x10007778
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10007778
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10007778
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x10007778
mov ebx, dword [0x28a6e50]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10007778
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10007778
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10007778
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x10007778
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10007778
mov eax, dword [ebx]
cmp eax, 4
je 0x10007756
cmp eax, 0xea64
je 0x10007756
cmp eax, 0x2714
je 0x10007756
cmp eax, 0xd
je 0x10007756
cmp eax, 0x271d
je 0x10007756
cmp eax, 0x1117d
je 0x10007756
cmp eax, 0x1f
je 0x10007756
cmp eax, 0x272f
je 0x10007756
cmp eax, 0x69
je 0x10007756
cmp eax, 0x2779
je 0x10007756
cmp eax, 0xb8
je 0x10007756
cmp eax, 0x27c8
jne 0x10007778
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 2
push edi
call esi
xor eax, eax
mov word [edi], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 2
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100271b9
mov esp, ebp
pop ebp
ret
Function at 0x10007790
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x28a727c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28a6e50
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x1000797a
push edi
mov edi, dword [0x28a6e50]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10007979
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10007979
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10007979
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10007979
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10007979
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10007979
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10007979
mov edi, dword [edi]
push 4
add edi, 0x1b5a
push edi
call esi
test eax, eax
jne 0x10007979
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x10007979
push ebx
mov ebx, dword [0x28a6e50]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10007978
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10007978
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10007978
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x10007978
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10007978
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10007978
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x10007978
mov ebx, dword [0x28a6e50]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10007978
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10007978
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10007978
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x10007978
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10007978
mov eax, dword [ebx]
cmp eax, 0xd4
je 0x10007958
cmp eax, 0x27e4
jne 0x10007978
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
mov byte [edi], 0xc8
push eax
push dword [ebp - 8]
push 1
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100271b9
mov esp, ebp
pop ebp
ret