joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005e40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10037040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x28d7504]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28d70d8
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x1000602d
push edi
mov edi, dword [0x28d70d8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x1000602c
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x1000602c
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x1000602c
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x1000602c
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x1000602c
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x1000602c
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x1000602c
mov edi, dword [edi]
push 4
add edi, 0x1c74
push edi
call esi
test eax, eax
jne 0x1000602c
push 4
push 0x28d70d8
call esi
test eax, eax
jne 0x1000602c
push ebx
mov ebx, dword [0x28d70d8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x1000602b
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x1000602b
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x1000602b
mov ebx, dword [ebx]
push 4
add ebx, 0x2e4
push ebx
call esi
test eax, eax
jne 0x1000602b
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x1000602b
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x1000602b
push 4
push 0x28d70d8
call esi
test eax, eax
jne 0x1000602b
mov ebx, dword [0x28d70d8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x1000602b
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x1000602b
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x1000602b
mov ebx, dword [ebx]
push 4
add ebx, 0x370
push ebx
call esi
test eax, eax
jne 0x1000602b
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x1000602b
mov eax, dword [ebx]
cmp eax, 0xb6
je 0x10006008
cmp eax, 0x27c6
jne 0x1000602b
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 8]
mov dword [edi], 0x93a76aa8
push eax
push dword [ebp - 8]
push 4
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10029901
mov esp, ebp
pop ebp
ret
Function at 0x10006040
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10037040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x28d7504]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28d70d8
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x1000622d
push edi
mov edi, dword [0x28d70d8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x1000622c
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x1000622c
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x1000622c
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x1000622c
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x1000622c
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x1000622c
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x1000622c
mov edi, dword [edi]
push 4
add edi, 0x1c74
push edi
call esi
test eax, eax
jne 0x1000622c
push 4
push 0x28d70d8
call esi
test eax, eax
jne 0x1000622c
push ebx
mov ebx, dword [0x28d70d8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x1000622b
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x1000622b
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x1000622b
mov ebx, dword [ebx]
push 4
add ebx, 0x2e4
push ebx
call esi
test eax, eax
jne 0x1000622b
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x1000622b
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x1000622b
push 4
push 0x28d70d8
call esi
test eax, eax
jne 0x1000622b
mov ebx, dword [0x28d70d8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x1000622b
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x1000622b
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x1000622b
mov ebx, dword [ebx]
push 4
add ebx, 0x370
push ebx
call esi
test eax, eax
jne 0x1000622b
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x1000622b
mov eax, dword [ebx]
cmp eax, 0xca
je 0x10006208
cmp eax, 0x27da
jne 0x1000622b
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 8]
mov dword [edi], 0x64
push eax
push dword [ebp - 8]
push 4
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10029901
mov esp, ebp
pop ebp
ret
Function at 0x10006240
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10037040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x28d7504]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28d70d8
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10006438
push edi
mov edi, dword [0x28d70d8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10006437
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10006437
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10006437
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x10006437
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10006437
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x10006437
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10006437
mov edi, dword [edi]
push 4
add edi, 0x18c8
push edi
call esi
test eax, eax
jne 0x10006437
push 4
push 0x28d70d8
call esi
test eax, eax
jne 0x10006437
push ebx
mov ebx, dword [0x28d70d8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006436
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10006436
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006436
mov ebx, dword [ebx]
push 4
add ebx, 0x2e4
push ebx
call esi
test eax, eax
jne 0x10006436
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10006436
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10006436
push 4
push 0x28d70d8
call esi
test eax, eax
jne 0x10006436
mov ebx, dword [0x28d70d8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006436
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10006436
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006436
mov ebx, dword [ebx]
push 4
add ebx, 0x370
push ebx
call esi
test eax, eax
jne 0x10006436
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10006436
mov eax, dword [ebx]
cmp eax, 0xa2
je 0x10006408
cmp eax, 0x27b2
jne 0x10006436
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 6
push edi
call esi
mov eax, dword [0x1002ee7c]
mov dword [edi], eax
mov ax, word [0x1002ee80]
mov word [edi + 4], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10029901
mov esp, ebp
pop ebp
ret
Function at 0x10006450
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10037040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x28d7504]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28d70d8
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x1000663d
push edi
mov edi, dword [0x28d70d8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x1000663c
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x1000663c
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x1000663c
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x1000663c
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x1000663c
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x1000663c
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x1000663c
mov edi, dword [edi]
push 4
add edi, 0x18c8
push edi
call esi
test eax, eax
jne 0x1000663c
push 4
push 0x28d70d8
call esi
test eax, eax
jne 0x1000663c
push ebx
mov ebx, dword [0x28d70d8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x1000663b
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x1000663b
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x1000663b
mov ebx, dword [ebx]
push 4
add ebx, 0x2e4
push ebx
call esi
test eax, eax
jne 0x1000663b
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x1000663b
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x1000663b
push 4
push 0x28d70d8
call esi
test eax, eax
jne 0x1000663b
mov ebx, dword [0x28d70d8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x1000663b
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x1000663b
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x1000663b
mov ebx, dword [ebx]
push 4
add ebx, 0x370
push ebx
call esi
test eax, eax
jne 0x1000663b
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x1000663b
mov eax, dword [ebx]
cmp eax, 0xa5
je 0x10006618
cmp eax, 0x27b5
jne 0x1000663b
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 8]
mov dword [edi], 0xb3a76aa8
push eax
push dword [ebp - 8]
push 4
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10029901
mov esp, ebp
pop ebp
ret
Function at 0x10006650
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10037040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x28d7504]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28d70d8
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x1000683a
push edi
mov edi, dword [0x28d70d8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10006839
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10006839
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10006839
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x10006839
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10006839
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x10006839
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10006839
mov edi, dword [edi]
push 4
add edi, 0x1b48
push edi
call esi
test eax, eax
jne 0x10006839
push 4
push 0x28d70d8
call esi
test eax, eax
jne 0x10006839
push ebx
mov ebx, dword [0x28d70d8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006838
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10006838
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006838
mov ebx, dword [ebx]
push 4
add ebx, 0x2e4
push ebx
call esi
test eax, eax
jne 0x10006838
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10006838
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10006838
push 4
push 0x28d70d8
call esi
test eax, eax
jne 0x10006838
mov ebx, dword [0x28d70d8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006838
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10006838
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006838
mov ebx, dword [ebx]
push 4
add ebx, 0x370
push ebx
call esi
test eax, eax
jne 0x10006838
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10006838
mov eax, dword [ebx]
cmp eax, 0xb0
je 0x10006818
cmp eax, 0x27c0
jne 0x10006838
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
mov byte [edi], 0x14
push eax
push dword [ebp - 8]
push 1
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10029901
mov esp, ebp
pop ebp
ret
Function at 0x10006850
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10037040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x28d7504]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28d70d8
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10006a3d
push edi
mov edi, dword [0x28d70d8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10006a3c
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10006a3c
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10006a3c
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x10006a3c
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10006a3c
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x10006a3c
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10006a3c
mov edi, dword [edi]
push 4
add edi, 0x1c4c
push edi
call esi
test eax, eax
jne 0x10006a3c
push 4
push 0x28d70d8
call esi
test eax, eax
jne 0x10006a3c
push ebx
mov ebx, dword [0x28d70d8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006a3b
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10006a3b
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006a3b
mov ebx, dword [ebx]
push 4
add ebx, 0x2e4
push ebx
call esi
test eax, eax
jne 0x10006a3b
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10006a3b
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10006a3b
push 4
push 0x28d70d8
call esi
test eax, eax
jne 0x10006a3b
mov ebx, dword [0x28d70d8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006a3b
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10006a3b
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006a3b
mov ebx, dword [ebx]
push 4
add ebx, 0x370
push ebx
call esi
test eax, eax
jne 0x10006a3b
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10006a3b
mov eax, dword [ebx]
cmp eax, 0xb3
je 0x10006a18
cmp eax, 0x27c3
jne 0x10006a3b
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 8]
mov dword [edi], 0x42c80000
push eax
push dword [ebp - 8]
push 4
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10029901
mov esp, ebp
pop ebp
ret
Function at 0x10006a50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10037040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x28d7504]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28d70d8
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10006c3b
push edi
mov edi, dword [0x28d70d8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10006c3a
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10006c3a
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10006c3a
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x10006c3a
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10006c3a
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x10006c3a
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10006c3a
mov edi, dword [edi]
push 4
add edi, 0x21e0
push edi
call esi
test eax, eax
jne 0x10006c3a
push 4
push 0x28d70d8
call esi
test eax, eax
jne 0x10006c3a
push ebx
mov ebx, dword [0x28d70d8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006c39
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10006c39
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006c39
mov ebx, dword [ebx]
push 4
add ebx, 0x2e4
push ebx
call esi
test eax, eax
jne 0x10006c39
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10006c39
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10006c39
push 4
push 0x28d70d8
call esi
test eax, eax
jne 0x10006c39
mov ebx, dword [0x28d70d8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006c39
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10006c39
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006c39
mov ebx, dword [ebx]
push 4
add ebx, 0x370
push ebx
call esi
test eax, eax
jne 0x10006c39
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10006c39
mov eax, dword [ebx]
cmp eax, 0x55
je 0x10006c16
cmp eax, 0x2765
jne 0x10006c39
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 8]
mov dword [edi], 0xf5287aa9
push eax
push dword [ebp - 8]
push 4
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10029901
mov esp, ebp
pop ebp
ret
Function at 0x10006c50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10037040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x28d7504]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28d70d8
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10006e38
push edi
mov edi, dword [0x28d70d8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10006e37
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10006e37
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10006e37
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x10006e37
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10006e37
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x10006e37
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10006e37
mov edi, dword [edi]
push 4
add edi, 0x1b38
push edi
call esi
test eax, eax
jne 0x10006e37
push 4
push 0x28d70d8
call esi
test eax, eax
jne 0x10006e37
push ebx
mov ebx, dword [0x28d70d8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006e36
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10006e36
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006e36
mov ebx, dword [ebx]
push 4
add ebx, 0x2e4
push ebx
call esi
test eax, eax
jne 0x10006e36
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10006e36
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10006e36
push 4
push 0x28d70d8
call esi
test eax, eax
jne 0x10006e36
mov ebx, dword [0x28d70d8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006e36
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10006e36
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006e36
mov ebx, dword [ebx]
push 4
add ebx, 0x370
push ebx
call esi
test eax, eax
jne 0x10006e36
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10006e36
mov eax, dword [ebx]
cmp eax, 0x55
je 0x10006e16
cmp eax, 0x2765
jne 0x10006e36
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
mov byte [edi], 6
push eax
push dword [ebp - 8]
push 1
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10029901
mov esp, ebp
pop ebp
ret
Function at 0x10006e50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10037040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x28d7504]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28d70d8
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x1000703f
push edi
mov edi, dword [0x28d70d8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x1000703e
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x1000703e
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x1000703e
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x1000703e
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x1000703e
mov edi, dword [edi]
push 4
add edi, 0x370
push edi
call esi
test eax, eax
jne 0x1000703e
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x1000703e
mov edi, dword [edi]
push 4
add edi, 0x1b24
push edi
call esi
test eax, eax
jne 0x1000703e
push 4
push 0x28d70d8
call esi
test eax, eax
jne 0x1000703e
push ebx
mov ebx, dword [0x28d70d8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x1000703d
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x1000703d
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x1000703d
mov ebx, dword [ebx]
push 4
add ebx, 0x2e4
push ebx
call esi
test eax, eax
jne 0x1000703d
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x1000703d
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x1000703d
push 4
push 0x28d70d8
call esi
test eax, eax
jne 0x1000703d
mov ebx, dword [0x28d70d8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x1000703d
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x1000703d
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x1000703d
mov ebx, dword [ebx]
push 4
add ebx, 0x370
push ebx
call esi
test eax, eax
jne 0x1000703d
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x1000703d
mov eax, dword [ebx]
cmp eax, 0x12
je 0x1000701d
cmp eax, 0x2722
je 0x1000701d
cmp eax, 0xea72
jne 0x1000703d
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
mov byte [edi], 5
push eax
push dword [ebp - 8]
push 1
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10029901
mov esp, ebp
pop ebp
ret