joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100055b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003800c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x281def4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x281dac8
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x100057e4
push edi
mov edi, dword [0x281dac8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x100057e3
mov edi, dword [edi]
push 4
add edi, 0x2c
push edi
call esi
test eax, eax
jne 0x100057e3
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x100057e3
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x100057e3
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x100057e3
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x100057e3
mov edi, dword [edi]
push 4
add edi, 0x30
push edi
call esi
test eax, eax
jne 0x100057e3
mov edi, dword [edi]
push 4
add edi, 0x10a8
push edi
call esi
test eax, eax
jne 0x100057e3
push 4
push 0x281dac8
call esi
test eax, eax
jne 0x100057e3
push ebx
mov ebx, dword [0x281dac8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x100057e2
mov ebx, dword [ebx]
push 4
add ebx, 0x2c
push ebx
call esi
test eax, eax
jne 0x100057e2
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x100057e2
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x100057e2
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x100057e2
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x100057e2
push 4
push 0x281dac8
call esi
test eax, eax
jne 0x100057e2
mov ebx, dword [0x281dac8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x100057e2
mov ebx, dword [ebx]
push 4
add ebx, 0x2c
push ebx
call esi
test eax, eax
jne 0x100057e2
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x100057e2
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x100057e2
mov ebx, dword [ebx]
push 4
add ebx, 0x1b0
push ebx
call esi
test eax, eax
jne 0x100057e2
mov eax, dword [ebx]
cmp eax, 0x4bb35
je 0x100057bf
cmp eax, 0x4bef9
je 0x100057bf
cmp eax, 0x4bf44
je 0x100057bf
cmp eax, 0x4bf02
je 0x100057bf
cmp eax, 0x49455
je 0x100057bf
cmp eax, 0x4bf20
je 0x100057bf
cmp eax, 0x4bf4a
je 0x100057bf
cmp eax, 0x4bf63
je 0x100057bf
cmp eax, 0x494b4
je 0x100057bf
cmp eax, 0x4bb03
jne 0x100057e2
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 8]
mov dword [edi], 0xe7be1a28
push eax
push dword [ebp - 8]
push 4
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1002b830
mov esp, ebp
pop ebp
ret
Function at 0x10005800
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003800c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x281def4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x281dac8
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x100059ed
push edi
mov edi, dword [0x281dac8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x100059ec
mov edi, dword [edi]
push 4
add edi, 0x2c
push edi
call esi
test eax, eax
jne 0x100059ec
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x100059ec
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x100059ec
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x100059ec
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x100059ec
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x100059ec
mov edi, dword [edi]
push 4
add edi, 0x1dd0
push edi
call esi
test eax, eax
jne 0x100059ec
push 4
push 0x281dac8
call esi
test eax, eax
jne 0x100059ec
push ebx
mov ebx, dword [0x281dac8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x100059eb
mov ebx, dword [ebx]
push 4
add ebx, 0x2c
push ebx
call esi
test eax, eax
jne 0x100059eb
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x100059eb
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x100059eb
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x100059eb
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x100059eb
push 4
push 0x281dac8
call esi
test eax, eax
jne 0x100059eb
mov ebx, dword [0x281dac8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x100059eb
mov ebx, dword [ebx]
push 4
add ebx, 0x2c
push ebx
call esi
test eax, eax
jne 0x100059eb
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x100059eb
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x100059eb
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x100059eb
mov eax, dword [ebx]
cmp eax, 0xaf
je 0x100059c8
cmp eax, 0x27bf
jne 0x100059eb
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 8]
mov dword [edi], 0xd0f33aa8
push eax
push dword [ebp - 8]
push 4
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1002b830
mov esp, ebp
pop ebp
ret
Function at 0x10005a00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003800c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x281def4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x281dac8
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10005bed
push edi
mov edi, dword [0x281dac8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10005bec
mov edi, dword [edi]
push 4
add edi, 0x2c
push edi
call esi
test eax, eax
jne 0x10005bec
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10005bec
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10005bec
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10005bec
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10005bec
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10005bec
mov edi, dword [edi]
push 4
add edi, 0x1cb4
push edi
call esi
test eax, eax
jne 0x10005bec
push 4
push 0x281dac8
call esi
test eax, eax
jne 0x10005bec
push ebx
mov ebx, dword [0x281dac8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10005beb
mov ebx, dword [ebx]
push 4
add ebx, 0x2c
push ebx
call esi
test eax, eax
jne 0x10005beb
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10005beb
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x10005beb
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10005beb
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10005beb
push 4
push 0x281dac8
call esi
test eax, eax
jne 0x10005beb
mov ebx, dword [0x281dac8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10005beb
mov ebx, dword [ebx]
push 4
add ebx, 0x2c
push ebx
call esi
test eax, eax
jne 0x10005beb
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10005beb
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x10005beb
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10005beb
mov eax, dword [ebx]
cmp eax, 0x96
je 0x10005bc8
cmp eax, 0x27a6
jne 0x10005beb
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 8]
mov dword [edi], 0x19aa15
push eax
push dword [ebp - 8]
push 4
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1002b830
mov esp, ebp
pop ebp
ret
Function at 0x10005c00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003800c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x281def4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x281dac8
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10005ded
push edi
mov edi, dword [0x281dac8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10005dec
mov edi, dword [edi]
push 4
add edi, 0x2c
push edi
call esi
test eax, eax
jne 0x10005dec
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10005dec
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10005dec
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10005dec
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10005dec
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10005dec
mov edi, dword [edi]
push 4
add edi, 0x18c8
push edi
call esi
test eax, eax
jne 0x10005dec
push 4
push 0x281dac8
call esi
test eax, eax
jne 0x10005dec
push ebx
mov ebx, dword [0x281dac8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10005deb
mov ebx, dword [ebx]
push 4
add ebx, 0x2c
push ebx
call esi
test eax, eax
jne 0x10005deb
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10005deb
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x10005deb
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10005deb
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10005deb
push 4
push 0x281dac8
call esi
test eax, eax
jne 0x10005deb
mov ebx, dword [0x281dac8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10005deb
mov ebx, dword [ebx]
push 4
add ebx, 0x2c
push ebx
call esi
test eax, eax
jne 0x10005deb
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10005deb
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x10005deb
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10005deb
mov eax, dword [ebx]
cmp eax, 0xbb
je 0x10005dc8
cmp eax, 0x27cb
jne 0x10005deb
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 8]
mov dword [edi], 0xf7a76aa9
push eax
push dword [ebp - 8]
push 4
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1002b830
mov esp, ebp
pop ebp
ret
Function at 0x10005e00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003800c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x281def4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x281dac8
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10005fed
push edi
mov edi, dword [0x281dac8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10005fec
mov edi, dword [edi]
push 4
add edi, 0x2c
push edi
call esi
test eax, eax
jne 0x10005fec
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10005fec
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10005fec
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10005fec
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10005fec
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10005fec
mov edi, dword [edi]
push 4
add edi, 0x1c74
push edi
call esi
test eax, eax
jne 0x10005fec
push 4
push 0x281dac8
call esi
test eax, eax
jne 0x10005fec
push ebx
mov ebx, dword [0x281dac8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10005feb
mov ebx, dword [ebx]
push 4
add ebx, 0x2c
push ebx
call esi
test eax, eax
jne 0x10005feb
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10005feb
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x10005feb
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10005feb
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10005feb
push 4
push 0x281dac8
call esi
test eax, eax
jne 0x10005feb
mov ebx, dword [0x281dac8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10005feb
mov ebx, dword [ebx]
push 4
add ebx, 0x2c
push ebx
call esi
test eax, eax
jne 0x10005feb
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10005feb
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x10005feb
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10005feb
mov eax, dword [ebx]
cmp eax, 0xb6
je 0x10005fc8
cmp eax, 0x27c6
jne 0x10005feb
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 8]
mov dword [edi], 0x93a76aa8
push eax
push dword [ebp - 8]
push 4
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1002b830
mov esp, ebp
pop ebp
ret
Function at 0x10006000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003800c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x281def4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x281dac8
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x100061ed
push edi
mov edi, dword [0x281dac8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x100061ec
mov edi, dword [edi]
push 4
add edi, 0x2c
push edi
call esi
test eax, eax
jne 0x100061ec
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x100061ec
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x100061ec
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x100061ec
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x100061ec
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x100061ec
mov edi, dword [edi]
push 4
add edi, 0x1c74
push edi
call esi
test eax, eax
jne 0x100061ec
push 4
push 0x281dac8
call esi
test eax, eax
jne 0x100061ec
push ebx
mov ebx, dword [0x281dac8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x100061eb
mov ebx, dword [ebx]
push 4
add ebx, 0x2c
push ebx
call esi
test eax, eax
jne 0x100061eb
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x100061eb
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x100061eb
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x100061eb
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x100061eb
push 4
push 0x281dac8
call esi
test eax, eax
jne 0x100061eb
mov ebx, dword [0x281dac8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x100061eb
mov ebx, dword [ebx]
push 4
add ebx, 0x2c
push ebx
call esi
test eax, eax
jne 0x100061eb
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x100061eb
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x100061eb
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x100061eb
mov eax, dword [ebx]
cmp eax, 0xca
je 0x100061c8
cmp eax, 0x27da
jne 0x100061eb
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 8]
mov dword [edi], 0x64
push eax
push dword [ebp - 8]
push 4
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1002b830
mov esp, ebp
pop ebp
ret
Function at 0x10006200
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003800c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x281def4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x281dac8
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x100063f8
push edi
mov edi, dword [0x281dac8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x100063f7
mov edi, dword [edi]
push 4
add edi, 0x2c
push edi
call esi
test eax, eax
jne 0x100063f7
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x100063f7
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x100063f7
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x100063f7
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x100063f7
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x100063f7
mov edi, dword [edi]
push 4
add edi, 0x18c8
push edi
call esi
test eax, eax
jne 0x100063f7
push 4
push 0x281dac8
call esi
test eax, eax
jne 0x100063f7
push ebx
mov ebx, dword [0x281dac8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x100063f6
mov ebx, dword [ebx]
push 4
add ebx, 0x2c
push ebx
call esi
test eax, eax
jne 0x100063f6
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x100063f6
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x100063f6
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x100063f6
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x100063f6
push 4
push 0x281dac8
call esi
test eax, eax
jne 0x100063f6
mov ebx, dword [0x281dac8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x100063f6
mov ebx, dword [ebx]
push 4
add ebx, 0x2c
push ebx
call esi
test eax, eax
jne 0x100063f6
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x100063f6
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x100063f6
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x100063f6
mov eax, dword [ebx]
cmp eax, 0xa2
je 0x100063c8
cmp eax, 0x27b2
jne 0x100063f6
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 6
push edi
call esi
mov eax, dword [0x10030b30]
mov dword [edi], eax
mov ax, word [0x10030b34]
mov word [edi + 4], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1002b830
mov esp, ebp
pop ebp
ret
Function at 0x10006410
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003800c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x281def4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x281dac8
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x100065fd
push edi
mov edi, dword [0x281dac8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x100065fc
mov edi, dword [edi]
push 4
add edi, 0x2c
push edi
call esi
test eax, eax
jne 0x100065fc
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x100065fc
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x100065fc
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x100065fc
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x100065fc
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x100065fc
mov edi, dword [edi]
push 4
add edi, 0x18c8
push edi
call esi
test eax, eax
jne 0x100065fc
push 4
push 0x281dac8
call esi
test eax, eax
jne 0x100065fc
push ebx
mov ebx, dword [0x281dac8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x100065fb
mov ebx, dword [ebx]
push 4
add ebx, 0x2c
push ebx
call esi
test eax, eax
jne 0x100065fb
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x100065fb
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x100065fb
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x100065fb
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x100065fb
push 4
push 0x281dac8
call esi
test eax, eax
jne 0x100065fb
mov ebx, dword [0x281dac8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x100065fb
mov ebx, dword [ebx]
push 4
add ebx, 0x2c
push ebx
call esi
test eax, eax
jne 0x100065fb
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x100065fb
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x100065fb
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x100065fb
mov eax, dword [ebx]
cmp eax, 0xa5
je 0x100065d8
cmp eax, 0x27b5
jne 0x100065fb
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 8]
mov dword [edi], 0xb3a76aa8
push eax
push dword [ebp - 8]
push 4
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1002b830
mov esp, ebp
pop ebp
ret