joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005f90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10030040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x286ffc4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x286fb98
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10006188
push edi
mov edi, dword [0x286fb98]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10006187
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10006187
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10006187
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10006187
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10006187
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10006187
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10006187
mov edi, dword [edi]
push 4
add edi, 0x18c8
push edi
call esi
test eax, eax
jne 0x10006187
push 4
push 0x286fb98
call esi
test eax, eax
jne 0x10006187
push ebx
mov ebx, dword [0x286fb98]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006186
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10006186
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006186
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x10006186
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10006186
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10006186
push 4
push 0x286fb98
call esi
test eax, eax
jne 0x10006186
mov ebx, dword [0x286fb98]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006186
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10006186
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006186
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x10006186
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10006186
mov eax, dword [ebx]
cmp eax, 0xa2
je 0x10006158
cmp eax, 0x27b2
jne 0x10006186
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 6
push edi
call esi
mov eax, dword [0x10028854]
mov dword [edi], eax
mov ax, word [0x10028858]
mov word [edi + 4], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100244d7
mov esp, ebp
pop ebp
ret
Function at 0x100061a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10030040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x286ffc4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x286fb98
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x1000638d
push edi
mov edi, dword [0x286fb98]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x1000638c
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x1000638c
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x1000638c
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x1000638c
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x1000638c
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x1000638c
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x1000638c
mov edi, dword [edi]
push 4
add edi, 0x18c8
push edi
call esi
test eax, eax
jne 0x1000638c
push 4
push 0x286fb98
call esi
test eax, eax
jne 0x1000638c
push ebx
mov ebx, dword [0x286fb98]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x1000638b
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x1000638b
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x1000638b
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x1000638b
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x1000638b
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x1000638b
push 4
push 0x286fb98
call esi
test eax, eax
jne 0x1000638b
mov ebx, dword [0x286fb98]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x1000638b
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x1000638b
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x1000638b
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x1000638b
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x1000638b
mov eax, dword [ebx]
cmp eax, 0xa5
je 0x10006368
cmp eax, 0x27b5
jne 0x1000638b
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 8]
mov dword [edi], 0xb3a76aa8
push eax
push dword [ebp - 8]
push 4
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100244d7
mov esp, ebp
pop ebp
ret
Function at 0x100063a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10030040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x286ffc4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x286fb98
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x1000658a
push edi
mov edi, dword [0x286fb98]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10006589
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10006589
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10006589
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10006589
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10006589
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10006589
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10006589
mov edi, dword [edi]
push 4
add edi, 0x1b48
push edi
call esi
test eax, eax
jne 0x10006589
push 4
push 0x286fb98
call esi
test eax, eax
jne 0x10006589
push ebx
mov ebx, dword [0x286fb98]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006588
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10006588
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006588
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x10006588
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10006588
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10006588
push 4
push 0x286fb98
call esi
test eax, eax
jne 0x10006588
mov ebx, dword [0x286fb98]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006588
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10006588
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006588
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x10006588
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10006588
mov eax, dword [ebx]
cmp eax, 0xb0
je 0x10006568
cmp eax, 0x27c0
jne 0x10006588
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
mov byte [edi], 0x14
push eax
push dword [ebp - 8]
push 1
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100244d7
mov esp, ebp
pop ebp
ret
Function at 0x100065a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10030040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x286ffc4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x286fb98
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x1000678d
push edi
mov edi, dword [0x286fb98]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x1000678c
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x1000678c
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x1000678c
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x1000678c
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x1000678c
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x1000678c
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x1000678c
mov edi, dword [edi]
push 4
add edi, 0x1c4c
push edi
call esi
test eax, eax
jne 0x1000678c
push 4
push 0x286fb98
call esi
test eax, eax
jne 0x1000678c
push ebx
mov ebx, dword [0x286fb98]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x1000678b
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x1000678b
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x1000678b
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x1000678b
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x1000678b
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x1000678b
push 4
push 0x286fb98
call esi
test eax, eax
jne 0x1000678b
mov ebx, dword [0x286fb98]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x1000678b
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x1000678b
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x1000678b
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x1000678b
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x1000678b
mov eax, dword [ebx]
cmp eax, 0xb3
je 0x10006768
cmp eax, 0x27c3
jne 0x1000678b
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 8]
mov dword [edi], 0x42c80000
push eax
push dword [ebp - 8]
push 4
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100244d7
mov esp, ebp
pop ebp
ret
Function at 0x100067a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10030040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x286ffc4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x286fb98
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x1000698b
push edi
mov edi, dword [0x286fb98]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x1000698a
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x1000698a
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x1000698a
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x1000698a
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x1000698a
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x1000698a
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x1000698a
mov edi, dword [edi]
push 4
add edi, 0x21e0
push edi
call esi
test eax, eax
jne 0x1000698a
push 4
push 0x286fb98
call esi
test eax, eax
jne 0x1000698a
push ebx
mov ebx, dword [0x286fb98]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006989
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10006989
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006989
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x10006989
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10006989
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10006989
push 4
push 0x286fb98
call esi
test eax, eax
jne 0x10006989
mov ebx, dword [0x286fb98]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006989
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10006989
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006989
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x10006989
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10006989
mov eax, dword [ebx]
cmp eax, 0x55
je 0x10006966
cmp eax, 0x2765
jne 0x10006989
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 8]
mov dword [edi], 0xf5287aa9
push eax
push dword [ebp - 8]
push 4
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100244d7
mov esp, ebp
pop ebp
ret
Function at 0x100069a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10030040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x286ffc4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x286fb98
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10006b88
push edi
mov edi, dword [0x286fb98]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10006b87
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10006b87
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10006b87
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10006b87
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10006b87
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10006b87
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10006b87
mov edi, dword [edi]
push 4
add edi, 0x1b38
push edi
call esi
test eax, eax
jne 0x10006b87
push 4
push 0x286fb98
call esi
test eax, eax
jne 0x10006b87
push ebx
mov ebx, dword [0x286fb98]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006b86
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10006b86
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006b86
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x10006b86
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10006b86
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10006b86
push 4
push 0x286fb98
call esi
test eax, eax
jne 0x10006b86
mov ebx, dword [0x286fb98]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006b86
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10006b86
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006b86
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x10006b86
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10006b86
mov eax, dword [ebx]
cmp eax, 0x55
je 0x10006b66
cmp eax, 0x2765
jne 0x10006b86
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
mov byte [edi], 6
push eax
push dword [ebp - 8]
push 1
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100244d7
mov esp, ebp
pop ebp
ret
Function at 0x10006ba0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10030040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x286ffc4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x286fb98
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10006d8f
push edi
mov edi, dword [0x286fb98]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10006d8e
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10006d8e
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10006d8e
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10006d8e
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10006d8e
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10006d8e
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10006d8e
mov edi, dword [edi]
push 4
add edi, 0x1b24
push edi
call esi
test eax, eax
jne 0x10006d8e
push 4
push 0x286fb98
call esi
test eax, eax
jne 0x10006d8e
push ebx
mov ebx, dword [0x286fb98]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006d8d
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10006d8d
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006d8d
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x10006d8d
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10006d8d
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10006d8d
push 4
push 0x286fb98
call esi
test eax, eax
jne 0x10006d8d
mov ebx, dword [0x286fb98]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006d8d
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10006d8d
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006d8d
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x10006d8d
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10006d8d
mov eax, dword [ebx]
cmp eax, 0x12
je 0x10006d6d
cmp eax, 0x2722
je 0x10006d6d
cmp eax, 0xea72
jne 0x10006d8d
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
mov byte [edi], 5
push eax
push dword [ebp - 8]
push 1
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100244d7
mov esp, ebp
pop ebp
ret
Function at 0x10006da0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10030040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x286ffc4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x286fb98
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10006f8f
push edi
mov edi, dword [0x286fb98]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10006f8e
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10006f8e
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10006f8e
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10006f8e
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10006f8e
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10006f8e
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10006f8e
mov edi, dword [edi]
push 4
add edi, 0x1b24
push edi
call esi
test eax, eax
jne 0x10006f8e
push 4
push 0x286fb98
call esi
test eax, eax
jne 0x10006f8e
push ebx
mov ebx, dword [0x286fb98]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006f8d
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10006f8d
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006f8d
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x10006f8d
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10006f8d
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10006f8d
push 4
push 0x286fb98
call esi
test eax, eax
jne 0x10006f8d
mov ebx, dword [0x286fb98]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006f8d
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10006f8d
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006f8d
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x10006f8d
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10006f8d
mov eax, dword [ebx]
cmp eax, 3
je 0x10006f6d
cmp eax, 0xc353
je 0x10006f6d
cmp eax, 0xea63
jne 0x10006f8d
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
mov byte [edi], 8
push eax
push dword [ebp - 8]
push 1
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100244d7
mov esp, ebp
pop ebp
ret