joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007050
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10037040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x28d7504]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28d70d8
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x1000723f
push edi
mov edi, dword [0x28d70d8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x1000723e
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x1000723e
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x1000723e
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x1000723e
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x1000723e
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x1000723e
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x1000723e
mov edi, dword [edi]
push 4
add edi, 0x1b24
push edi
call esi
test eax, eax
jne 0x1000723e
push 4
push 0x28d70d8
call esi
test eax, eax
jne 0x1000723e
push ebx
mov ebx, dword [0x28d70d8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x1000723d
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x1000723d
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x1000723d
mov ebx, dword [ebx]
push 4
add ebx, 0x2e4
push ebx
call esi
test eax, eax
jne 0x1000723d
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x1000723d
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x1000723d
push 4
push 0x28d70d8
call esi
test eax, eax
jne 0x1000723d
mov ebx, dword [0x28d70d8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x1000723d
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x1000723d
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x1000723d
mov ebx, dword [ebx]
push 4
add ebx, 0x370
push ebx
call esi
test eax, eax
jne 0x1000723d
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x1000723d
mov eax, dword [ebx]
cmp eax, 3
je 0x1000721d
cmp eax, 0xc353
je 0x1000721d
cmp eax, 0xea63
jne 0x1000723d
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
mov byte [edi], 8
push eax
push dword [ebp - 8]
push 1
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10029901
mov esp, ebp
pop ebp
ret
Function at 0x10007250
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10037040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [0x28d7504]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28d70d8
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10007446
push edi
mov edi, dword [0x28d70d8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10007445
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10007445
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10007445
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x10007445
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10007445
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x10007445
push ebx
mov ebx, dword [edi]
push 4
push ebx
call esi
test eax, eax
jne 0x10007444
mov ebx, dword [ebx]
add ebx, dword [ebp + 0x20]
push 4
push ebx
call esi
test eax, eax
jne 0x10007444
push 4
push 0x28d70d8
call esi
test eax, eax
jne 0x10007444
mov edi, dword [0x28d70d8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10007444
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10007444
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10007444
mov edi, dword [edi]
push 4
add edi, 0x2e4
push edi
call esi
test eax, eax
jne 0x10007444
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10007444
mov ecx, dword [ebp - 8]
mov eax, dword [edi]
cmp eax, dword [ecx]
jne 0x10007444
push 4
push 0x28d70d8
call esi
test eax, eax
jne 0x10007444
mov edi, dword [0x28d70d8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10007444
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10007444
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10007444
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x10007444
mov edi, dword [edi]
push 4
add edi, 0x15c
push edi
call esi
test eax, eax
jne 0x10007444
mov eax, dword [edi]
cmp eax, 0x6e
je 0x10007419
cmp eax, 0x277e
jne 0x10007444
mov edi, dword [ebp + 0x28]
lea eax, [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push edi
push ebx
call esi
push edi
push dword [ebp - 0xc]
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push ebx
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10029901
mov esp, ebp
pop ebp
ret
Function at 0x10007460
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10037040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x28d7504]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28d70d8
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x1000764a
push edi
mov edi, dword [0x28d70d8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10007649
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10007649
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10007649
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x10007649
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10007649
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x10007649
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10007649
mov edi, dword [edi]
push 4
add edi, 0x1e72
push edi
call esi
test eax, eax
jne 0x10007649
push 4
push 0x28d70d8
call esi
test eax, eax
jne 0x10007649
push ebx
mov ebx, dword [0x28d70d8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10007648
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10007648
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10007648
mov ebx, dword [ebx]
push 4
add ebx, 0x2e4
push ebx
call esi
test eax, eax
jne 0x10007648
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10007648
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10007648
push 4
push 0x28d70d8
call esi
test eax, eax
jne 0x10007648
mov ebx, dword [0x28d70d8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10007648
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10007648
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10007648
mov ebx, dword [ebx]
push 4
add ebx, 0x370
push ebx
call esi
test eax, eax
jne 0x10007648
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10007648
mov eax, dword [ebx]
cmp eax, 0x99
je 0x10007628
cmp eax, 0x27a9
jne 0x10007648
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
mov byte [edi], 0xc8
push eax
push dword [ebp - 8]
push 1
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10029901
mov esp, ebp
pop ebp
ret
Function at 0x10007660
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10037040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [0x28d7504]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28d70d8
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10007858
push edi
mov edi, dword [0x28d70d8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10007857
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10007857
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10007857
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x10007857
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10007857
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x10007857
push ebx
mov ebx, dword [edi]
push 4
push ebx
call esi
test eax, eax
jne 0x10007856
mov ebx, dword [ebx]
add ebx, dword [ebp + 0x20]
push 4
push ebx
call esi
test eax, eax
jne 0x10007856
push 4
push 0x28d70d8
call esi
test eax, eax
jne 0x10007856
mov edi, dword [0x28d70d8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10007856
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10007856
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10007856
mov edi, dword [edi]
push 4
add edi, 0x2e4
push edi
call esi
test eax, eax
jne 0x10007856
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10007856
mov ecx, dword [ebp - 8]
mov eax, dword [edi]
cmp eax, dword [ecx]
jne 0x10007856
push 4
push 0x28d70d8
call esi
test eax, eax
jne 0x10007856
mov edi, dword [0x28d70d8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10007856
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10007856
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10007856
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x10007856
mov edi, dword [edi]
push 4
add edi, 0x15c
push edi
call esi
test eax, eax
jne 0x10007856
mov eax, dword [edi]
cmp eax, 0xa9
je 0x1000782b
cmp eax, 0x27b9
jne 0x10007856
mov edi, dword [ebp + 0x28]
lea eax, [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push edi
push ebx
call esi
push edi
push dword [ebp - 0xc]
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push ebx
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10029901
mov esp, ebp
pop ebp
ret
Function at 0x10007870
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10037040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x28d7504]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28d70d8
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10007a58
push edi
mov edi, dword [0x28d70d8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10007a57
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10007a57
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10007a57
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x10007a57
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10007a57
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x10007a57
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10007a57
mov edi, dword [edi]
push 4
add edi, 0x1b54
push edi
call esi
test eax, eax
jne 0x10007a57
push 4
push 0x28d70d8
call esi
test eax, eax
jne 0x10007a57
push ebx
mov ebx, dword [0x28d70d8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10007a56
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10007a56
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10007a56
mov ebx, dword [ebx]
push 4
add ebx, 0x2e4
push ebx
call esi
test eax, eax
jne 0x10007a56
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10007a56
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10007a56
push 4
push 0x28d70d8
call esi
test eax, eax
jne 0x10007a56
mov ebx, dword [0x28d70d8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10007a56
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10007a56
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10007a56
mov ebx, dword [ebx]
push 4
add ebx, 0x370
push ebx
call esi
test eax, eax
jne 0x10007a56
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10007a56
mov eax, dword [ebx]
cmp eax, 0x23
je 0x10007a36
cmp eax, 0x2733
jne 0x10007a56
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
mov byte [edi], 2
push eax
push dword [ebp - 8]
push 1
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10029901
mov esp, ebp
pop ebp
ret
Function at 0x10007a70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10037040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x28d7504]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28d70d8
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10007caa
push edi
mov edi, dword [0x28d70d8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10007ca9
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10007ca9
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10007ca9
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x10007ca9
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10007ca9
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x10007ca9
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10007ca9
mov edi, dword [edi]
push 4
add edi, 0x1bd8
push edi
call esi
test eax, eax
jne 0x10007ca9
push 4
push 0x28d70d8
call esi
test eax, eax
jne 0x10007ca9
push ebx
mov ebx, dword [0x28d70d8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10007ca8
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10007ca8
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10007ca8
mov ebx, dword [ebx]
push 4
add ebx, 0x2e4
push ebx
call esi
test eax, eax
jne 0x10007ca8
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10007ca8
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10007ca8
push 4
push 0x28d70d8
call esi
test eax, eax
jne 0x10007ca8
mov ebx, dword [0x28d70d8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10007ca8
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10007ca8
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10007ca8
mov ebx, dword [ebx]
push 4
add ebx, 0x370
push ebx
call esi
test eax, eax
jne 0x10007ca8
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10007ca8
mov eax, dword [ebx]
cmp eax, 4
je 0x10007c86
cmp eax, 0xea64
je 0x10007c86
cmp eax, 0x2714
je 0x10007c86
cmp eax, 0xd
je 0x10007c86
cmp eax, 0x271d
je 0x10007c86
cmp eax, 0x1117d
je 0x10007c86
cmp eax, 0x1f
je 0x10007c86
cmp eax, 0x272f
je 0x10007c86
cmp eax, 0x69
je 0x10007c86
cmp eax, 0x2779
je 0x10007c86
cmp eax, 0xb8
je 0x10007c86
cmp eax, 0x27c8
jne 0x10007ca8
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 2
push edi
call esi
xor eax, eax
mov word [edi], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 2
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10029901
mov esp, ebp
pop ebp
ret
Function at 0x10007cc0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10037040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x28d7504]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28d70d8
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10007eaa
push edi
mov edi, dword [0x28d70d8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10007ea9
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10007ea9
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10007ea9
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x10007ea9
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10007ea9
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x10007ea9
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10007ea9
mov edi, dword [edi]
push 4
add edi, 0x1b5a
push edi
call esi
test eax, eax
jne 0x10007ea9
push 4
push 0x28d70d8
call esi
test eax, eax
jne 0x10007ea9
push ebx
mov ebx, dword [0x28d70d8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10007ea8
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10007ea8
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10007ea8
mov ebx, dword [ebx]
push 4
add ebx, 0x2e4
push ebx
call esi
test eax, eax
jne 0x10007ea8
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10007ea8
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10007ea8
push 4
push 0x28d70d8
call esi
test eax, eax
jne 0x10007ea8
mov ebx, dword [0x28d70d8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10007ea8
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10007ea8
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10007ea8
mov ebx, dword [ebx]
push 4
add ebx, 0x370
push ebx
call esi
test eax, eax
jne 0x10007ea8
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10007ea8
mov eax, dword [ebx]
cmp eax, 0xd4
je 0x10007e88
cmp eax, 0x27e4
jne 0x10007ea8
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
mov byte [edi], 0xc8
push eax
push dword [ebp - 8]
push 1
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10029901
mov esp, ebp
pop ebp
ret
Function at 0x10007ec0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10037040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [0x28d7504]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28d70d8
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x100080bd
push edi
mov edi, dword [0x28d70d8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x100080bc
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x100080bc
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x100080bc
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x100080bc
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x100080bc
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x100080bc
push ebx
mov ebx, dword [edi]
push 4
push ebx
call esi
test eax, eax
jne 0x100080bb
mov ebx, dword [ebx]
add ebx, dword [ebp + 0x20]
push 4
push ebx
call esi
test eax, eax
jne 0x100080bb
push 4
push 0x28d70d8
call esi
test eax, eax
jne 0x100080bb
mov edi, dword [0x28d70d8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x100080bb
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x100080bb
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x100080bb
mov edi, dword [edi]
push 4
add edi, 0x2e4
push edi
call esi
test eax, eax
jne 0x100080bb
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x100080bb
mov ecx, dword [ebp - 8]
mov eax, dword [edi]
cmp eax, dword [ecx]
jne 0x100080bb
push 4
push 0x28d70d8
call esi
test eax, eax
jne 0x100080bb
mov edi, dword [0x28d70d8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x100080bb
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x100080bb
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x100080bb
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x100080bb
mov edi, dword [edi]
push 4
add edi, 0x15c
push edi
call esi
test eax, eax
jne 0x100080bb
mov eax, dword [edi]
cmp eax, 0x1a
je 0x10008090
cmp eax, 0x272a
je 0x10008090
cmp eax, 0xea7a
jne 0x100080bb
mov edi, dword [ebp + 0x28]
lea eax, [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push edi
push ebx
call esi
push edi
push dword [ebp - 0xc]
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push ebx
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10029901
mov esp, ebp
pop ebp
ret