joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004e80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10030040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
push 0x286fb98
mov dword [ebp - 0xc], eax
call esi
test eax, eax
jne 0x10004f34
push edi
mov edi, dword [0x286fb98]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10004f22
push ebx
mov ebx, dword [edi]
push 4
add ebx, 0x110
push ebx
call esi
test eax, eax
jne 0x10004f0f
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10004f0f
mov edi, dword [ebp + 0x14]
lea eax, [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push edi
push ebx
call esi
push edi
push dword [ebp - 0xc]
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push ebx
call esi
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100244d7
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100244d7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100244d7
mov esp, ebp
pop ebp
ret

Function at 0x10004f50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10030040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push edi
push 4
push 0x286d26c
mov edi, edx
call esi
test eax, eax
jne 0x10004fa7
mov eax, dword [0x286d26c]
add edi, eax
push 4
push edi
call esi
test eax, eax
jne 0x10004fa7
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
mov byte [edi], 5
push eax
push dword [ebp - 8]
push 1
push edi
call esi
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.100244d7
mov esp, ebp
pop ebp
ret
Function at 0x10004fc0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10030040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x286ffc4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x286fb98
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x100050f9
push edi
mov edi, dword [0x286fb98]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x100050f8
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x100050f8
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x100050f8
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x100050f8
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x100050f8
push ebx
mov ebx, dword [edi]
push 4
add ebx, 0xaa
push ebx
call esi
test eax, eax
jne 0x100050f7
push 4
push 0x286fb98
call esi
test eax, eax
jne 0x100050f7
mov edi, dword [0x286fb98]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x100050f7
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x100050f7
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x100050f7
mov edi, dword [edi]
push 4
add edi, 0x2e0
push edi
call esi
test eax, eax
jne 0x100050f7
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x100050f7
mov ecx, dword [ebp - 8]
mov eax, dword [edi]
cmp eax, dword [ecx]
jne 0x100050f7
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push ebx
call esi
lea eax, [ebp - 8]
mov dword [ebx], 0x90909090
push eax
push dword [ebp - 8]
push 4
push ebx
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100244d7
mov esp, ebp
pop ebp
ret
Function at 0x10005110
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10030040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x286ffc4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x286fb98
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10005320
push edi
mov edi, dword [0x286fb98]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x1000531f
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x1000531f
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x1000531f
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x1000531f
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x1000531f
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x1000531f
mov edi, dword [edi]
push 4
add edi, 0x28
push edi
call esi
test eax, eax
jne 0x1000531f
mov edi, dword [edi]
push 4
add edi, 0x10a8
push edi
call esi
test eax, eax
jne 0x1000531f
push 4
push 0x286fb98
call esi
test eax, eax
jne 0x1000531f
push ebx
mov ebx, dword [0x286fb98]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x1000531e
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x1000531e
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x1000531e
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x1000531e
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x1000531e
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x1000531e
push 4
push 0x286fb98
call esi
test eax, eax
jne 0x1000531e
mov ebx, dword [0x286fb98]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x1000531e
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x1000531e
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x1000531e
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x1000531e
mov ebx, dword [ebx]
push 4
add ebx, 0x178
push ebx
call esi
test eax, eax
jne 0x1000531e
mov eax, dword [ebx]
cmp eax, 0x1b1bb
je 0x100052fb
cmp eax, 0x18715
je 0x100052fb
cmp eax, 0x1b1ba
je 0x100052fb
cmp eax, 0x1b1bd
je 0x100052fb
cmp eax, 0x1872c
je 0x100052fb
cmp eax, 0x1b21c
jne 0x1000531e
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 8]
mov dword [edi], 0x69239aa8
push eax
push dword [ebp - 8]
push 4
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100244d7
mov esp, ebp
pop ebp
ret
Function at 0x10005340
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10030040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x286ffc4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x286fb98
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10005574
push edi
mov edi, dword [0x286fb98]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10005573
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10005573
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10005573
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10005573
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10005573
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10005573
mov edi, dword [edi]
push 4
add edi, 0x30
push edi
call esi
test eax, eax
jne 0x10005573
mov edi, dword [edi]
push 4
add edi, 0x10a8
push edi
call esi
test eax, eax
jne 0x10005573
push 4
push 0x286fb98
call esi
test eax, eax
jne 0x10005573
push ebx
mov ebx, dword [0x286fb98]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10005572
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10005572
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10005572
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x10005572
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10005572
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10005572
push 4
push 0x286fb98
call esi
test eax, eax
jne 0x10005572
mov ebx, dword [0x286fb98]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10005572
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10005572
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10005572
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x10005572
mov ebx, dword [ebx]
push 4
add ebx, 0x1b0
push ebx
call esi
test eax, eax
jne 0x10005572
mov eax, dword [ebx]
cmp eax, 0x4bb35
je 0x1000554f
cmp eax, 0x4bef9
je 0x1000554f
cmp eax, 0x4bf44
je 0x1000554f
cmp eax, 0x4bf02
je 0x1000554f
cmp eax, 0x49455
je 0x1000554f
cmp eax, 0x4bf20
je 0x1000554f
cmp eax, 0x4bf4a
je 0x1000554f
cmp eax, 0x4bf63
je 0x1000554f
cmp eax, 0x494b4
je 0x1000554f
cmp eax, 0x4bb03
jne 0x10005572
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 8]
mov dword [edi], 0xe7be1a28
push eax
push dword [ebp - 8]
push 4
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100244d7
mov esp, ebp
pop ebp
ret
Function at 0x10005590
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10030040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x286ffc4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x286fb98
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x1000577d
push edi
mov edi, dword [0x286fb98]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x1000577c
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x1000577c
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x1000577c
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x1000577c
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x1000577c
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x1000577c
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x1000577c
mov edi, dword [edi]
push 4
add edi, 0x1dd0
push edi
call esi
test eax, eax
jne 0x1000577c
push 4
push 0x286fb98
call esi
test eax, eax
jne 0x1000577c
push ebx
mov ebx, dword [0x286fb98]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x1000577b
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x1000577b
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x1000577b
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x1000577b
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x1000577b
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x1000577b
push 4
push 0x286fb98
call esi
test eax, eax
jne 0x1000577b
mov ebx, dword [0x286fb98]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x1000577b
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x1000577b
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x1000577b
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x1000577b
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x1000577b
mov eax, dword [ebx]
cmp eax, 0xaf
je 0x10005758
cmp eax, 0x27bf
jne 0x1000577b
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 8]
mov dword [edi], 0xd0f33aa8
push eax
push dword [ebp - 8]
push 4
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100244d7
mov esp, ebp
pop ebp
ret
Function at 0x10005790
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10030040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x286ffc4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x286fb98
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x1000597d
push edi
mov edi, dword [0x286fb98]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x1000597c
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x1000597c
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x1000597c
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x1000597c
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x1000597c
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x1000597c
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x1000597c
mov edi, dword [edi]
push 4
add edi, 0x1cb4
push edi
call esi
test eax, eax
jne 0x1000597c
push 4
push 0x286fb98
call esi
test eax, eax
jne 0x1000597c
push ebx
mov ebx, dword [0x286fb98]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x1000597b
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x1000597b
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x1000597b
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x1000597b
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x1000597b
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x1000597b
push 4
push 0x286fb98
call esi
test eax, eax
jne 0x1000597b
mov ebx, dword [0x286fb98]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x1000597b
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x1000597b
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x1000597b
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x1000597b
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x1000597b
mov eax, dword [ebx]
cmp eax, 0x96
je 0x10005958
cmp eax, 0x27a6
jne 0x1000597b
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 8]
mov dword [edi], 0x19aa15
push eax
push dword [ebp - 8]
push 4
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100244d7
mov esp, ebp
pop ebp
ret
Function at 0x10005990
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10030040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x286ffc4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x286fb98
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10005b7d
push edi
mov edi, dword [0x286fb98]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10005b7c
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10005b7c
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10005b7c
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10005b7c
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10005b7c
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10005b7c
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10005b7c
mov edi, dword [edi]
push 4
add edi, 0x18c8
push edi
call esi
test eax, eax
jne 0x10005b7c
push 4
push 0x286fb98
call esi
test eax, eax
jne 0x10005b7c
push ebx
mov ebx, dword [0x286fb98]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10005b7b
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10005b7b
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10005b7b
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x10005b7b
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10005b7b
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10005b7b
push 4
push 0x286fb98
call esi
test eax, eax
jne 0x10005b7b
mov ebx, dword [0x286fb98]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10005b7b
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10005b7b
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10005b7b
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x10005b7b
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10005b7b
mov eax, dword [ebx]
cmp eax, 0xbb
je 0x10005b58
cmp eax, 0x27cb
jne 0x10005b7b
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 8]
mov dword [edi], 0xf7a76aa9
push eax
push dword [ebp - 8]
push 4
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100244d7
mov esp, ebp
pop ebp
ret
Function at 0x10005b90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10030040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x286ffc4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x286fb98
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10005d7d
push edi
mov edi, dword [0x286fb98]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10005d7c
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10005d7c
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10005d7c
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10005d7c
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10005d7c
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10005d7c
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10005d7c
mov edi, dword [edi]
push 4
add edi, 0x1c74
push edi
call esi
test eax, eax
jne 0x10005d7c
push 4
push 0x286fb98
call esi
test eax, eax
jne 0x10005d7c
push ebx
mov ebx, dword [0x286fb98]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10005d7b
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10005d7b
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10005d7b
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x10005d7b
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10005d7b
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10005d7b
push 4
push 0x286fb98
call esi
test eax, eax
jne 0x10005d7b
mov ebx, dword [0x286fb98]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10005d7b
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10005d7b
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10005d7b
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x10005d7b
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10005d7b
mov eax, dword [ebx]
cmp eax, 0xb6
je 0x10005d58
cmp eax, 0x27c6
jne 0x10005d7b
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 8]
mov dword [edi], 0x93a76aa8
push eax
push dword [ebp - 8]
push 4
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100244d7
mov esp, ebp
pop ebp
ret
Function at 0x10005d90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10030040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x286ffc4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x286fb98
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10005f7d
push edi
mov edi, dword [0x286fb98]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10005f7c
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10005f7c
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10005f7c
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10005f7c
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10005f7c
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10005f7c
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10005f7c
mov edi, dword [edi]
push 4
add edi, 0x1c74
push edi
call esi
test eax, eax
jne 0x10005f7c
push 4
push 0x286fb98
call esi
test eax, eax
jne 0x10005f7c
push ebx
mov ebx, dword [0x286fb98]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10005f7b
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10005f7b
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10005f7b
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x10005f7b
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10005f7b
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10005f7b
push 4
push 0x286fb98
call esi
test eax, eax
jne 0x10005f7b
mov ebx, dword [0x286fb98]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10005f7b
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10005f7b
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10005f7b
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x10005f7b
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10005f7b
mov eax, dword [ebx]
cmp eax, 0xca
je 0x10005f58
cmp eax, 0x27da
jne 0x10005f7b
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 8]
mov dword [edi], 0x64
push eax
push dword [ebp - 8]
push 4
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100244d7
mov esp, ebp
pop ebp
ret