joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005710
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x28a727c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28a6e50
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x100058fd
push edi
mov edi, dword [0x28a6e50]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x100058fc
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x100058fc
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x100058fc
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x100058fc
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x100058fc
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x100058fc
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x100058fc
mov edi, dword [edi]
push 4
add edi, 0x18c8
push edi
call esi
test eax, eax
jne 0x100058fc
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x100058fc
push ebx
mov ebx, dword [0x28a6e50]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x100058fb
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x100058fb
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x100058fb
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x100058fb
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x100058fb
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x100058fb
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x100058fb
mov ebx, dword [0x28a6e50]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x100058fb
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x100058fb
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x100058fb
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x100058fb
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x100058fb
mov eax, dword [ebx]
cmp eax, 0xbb
je 0x100058d8
cmp eax, 0x27cb
jne 0x100058fb
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 8]
mov dword [edi], 0xf7a76aa9
push eax
push dword [ebp - 8]
push 4
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100271b9
mov esp, ebp
pop ebp
ret
Function at 0x10005910
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x28a727c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28a6e50
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10005afd
push edi
mov edi, dword [0x28a6e50]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10005afc
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10005afc
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10005afc
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10005afc
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10005afc
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10005afc
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10005afc
mov edi, dword [edi]
push 4
add edi, 0x1c74
push edi
call esi
test eax, eax
jne 0x10005afc
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x10005afc
push ebx
mov ebx, dword [0x28a6e50]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10005afb
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10005afb
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10005afb
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x10005afb
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10005afb
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10005afb
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x10005afb
mov ebx, dword [0x28a6e50]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10005afb
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10005afb
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10005afb
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x10005afb
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10005afb
mov eax, dword [ebx]
cmp eax, 0xb6
je 0x10005ad8
cmp eax, 0x27c6
jne 0x10005afb
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 8]
mov dword [edi], 0x93a76aa8
push eax
push dword [ebp - 8]
push 4
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100271b9
mov esp, ebp
pop ebp
ret
Function at 0x10005b10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x28a727c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28a6e50
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10005cfd
push edi
mov edi, dword [0x28a6e50]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10005cfc
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10005cfc
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10005cfc
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10005cfc
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10005cfc
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10005cfc
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10005cfc
mov edi, dword [edi]
push 4
add edi, 0x1c74
push edi
call esi
test eax, eax
jne 0x10005cfc
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x10005cfc
push ebx
mov ebx, dword [0x28a6e50]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10005cfb
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10005cfb
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10005cfb
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x10005cfb
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10005cfb
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10005cfb
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x10005cfb
mov ebx, dword [0x28a6e50]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10005cfb
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10005cfb
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10005cfb
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x10005cfb
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10005cfb
mov eax, dword [ebx]
cmp eax, 0xca
je 0x10005cd8
cmp eax, 0x27da
jne 0x10005cfb
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 8]
mov dword [edi], 0x64
push eax
push dword [ebp - 8]
push 4
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100271b9
mov esp, ebp
pop ebp
ret
Function at 0x10005d10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x28a727c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28a6e50
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10005f08
push edi
mov edi, dword [0x28a6e50]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10005f07
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10005f07
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10005f07
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10005f07
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10005f07
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10005f07
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10005f07
mov edi, dword [edi]
push 4
add edi, 0x18c8
push edi
call esi
test eax, eax
jne 0x10005f07
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x10005f07
push ebx
mov ebx, dword [0x28a6e50]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10005f06
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10005f06
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10005f06
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x10005f06
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10005f06
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10005f06
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x10005f06
mov ebx, dword [0x28a6e50]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10005f06
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10005f06
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10005f06
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x10005f06
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10005f06
mov eax, dword [ebx]
cmp eax, 0xa2
je 0x10005ed8
cmp eax, 0x27b2
jne 0x10005f06
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 6
push edi
call esi
mov eax, dword [0x1002bdfc]
mov dword [edi], eax
mov ax, word [0x1002be00]
mov word [edi + 4], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100271b9
mov esp, ebp
pop ebp
ret
Function at 0x10005f20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x28a727c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28a6e50
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x1000610d
push edi
mov edi, dword [0x28a6e50]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x1000610c
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x1000610c
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x1000610c
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x1000610c
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x1000610c
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x1000610c
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x1000610c
mov edi, dword [edi]
push 4
add edi, 0x18c8
push edi
call esi
test eax, eax
jne 0x1000610c
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x1000610c
push ebx
mov ebx, dword [0x28a6e50]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x1000610b
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x1000610b
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x1000610b
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x1000610b
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x1000610b
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x1000610b
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x1000610b
mov ebx, dword [0x28a6e50]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x1000610b
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x1000610b
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x1000610b
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x1000610b
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x1000610b
mov eax, dword [ebx]
cmp eax, 0xa5
je 0x100060e8
cmp eax, 0x27b5
jne 0x1000610b
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 8]
mov dword [edi], 0xb3a76aa8
push eax
push dword [ebp - 8]
push 4
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100271b9
mov esp, ebp
pop ebp
ret
Function at 0x10006120
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x28a727c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28a6e50
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x1000630a
push edi
mov edi, dword [0x28a6e50]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10006309
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10006309
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10006309
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10006309
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10006309
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10006309
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10006309
mov edi, dword [edi]
push 4
add edi, 0x1b48
push edi
call esi
test eax, eax
jne 0x10006309
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x10006309
push ebx
mov ebx, dword [0x28a6e50]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006308
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10006308
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006308
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x10006308
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10006308
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10006308
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x10006308
mov ebx, dword [0x28a6e50]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006308
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10006308
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006308
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x10006308
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10006308
mov eax, dword [ebx]
cmp eax, 0xb0
je 0x100062e8
cmp eax, 0x27c0
jne 0x10006308
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
mov byte [edi], 0x14
push eax
push dword [ebp - 8]
push 1
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100271b9
mov esp, ebp
pop ebp
ret
Function at 0x10006320
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x28a727c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28a6e50
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x1000650d
push edi
mov edi, dword [0x28a6e50]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x1000650c
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x1000650c
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x1000650c
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x1000650c
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x1000650c
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x1000650c
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x1000650c
mov edi, dword [edi]
push 4
add edi, 0x1c4c
push edi
call esi
test eax, eax
jne 0x1000650c
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x1000650c
push ebx
mov ebx, dword [0x28a6e50]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x1000650b
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x1000650b
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x1000650b
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x1000650b
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x1000650b
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x1000650b
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x1000650b
mov ebx, dword [0x28a6e50]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x1000650b
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x1000650b
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x1000650b
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x1000650b
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x1000650b
mov eax, dword [ebx]
cmp eax, 0xb3
je 0x100064e8
cmp eax, 0x27c3
jne 0x1000650b
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 8]
mov dword [edi], 0x42c80000
push eax
push dword [ebp - 8]
push 4
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100271b9
mov esp, ebp
pop ebp
ret
Function at 0x10006520
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x28a727c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28a6e50
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x1000670b
push edi
mov edi, dword [0x28a6e50]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x1000670a
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x1000670a
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x1000670a
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x1000670a
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x1000670a
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x1000670a
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x1000670a
mov edi, dword [edi]
push 4
add edi, 0x21e0
push edi
call esi
test eax, eax
jne 0x1000670a
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x1000670a
push ebx
mov ebx, dword [0x28a6e50]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006709
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10006709
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006709
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x10006709
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10006709
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10006709
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x10006709
mov ebx, dword [0x28a6e50]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006709
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10006709
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006709
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x10006709
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10006709
mov eax, dword [ebx]
cmp eax, 0x55
je 0x100066e6
cmp eax, 0x2765
jne 0x10006709
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 8]
mov dword [edi], 0xf5287aa9
push eax
push dword [ebp - 8]
push 4
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100271b9
mov esp, ebp
pop ebp
ret
Function at 0x10006720
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x28a727c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28a6e50
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10006908
push edi
mov edi, dword [0x28a6e50]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10006907
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10006907
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10006907
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10006907
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10006907
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10006907
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10006907
mov edi, dword [edi]
push 4
add edi, 0x1b38
push edi
call esi
test eax, eax
jne 0x10006907
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x10006907
push ebx
mov ebx, dword [0x28a6e50]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006906
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10006906
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006906
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x10006906
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10006906
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10006906
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x10006906
mov ebx, dword [0x28a6e50]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006906
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10006906
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006906
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x10006906
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10006906
mov eax, dword [ebx]
cmp eax, 0x55
je 0x100068e6
cmp eax, 0x2765
jne 0x10006906
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
mov byte [edi], 6
push eax
push dword [ebp - 8]
push 1
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100271b9
mov esp, ebp
pop ebp
ret