joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006610
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003800c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x281def4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x281dac8
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x100067fa
push edi
mov edi, dword [0x281dac8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x100067f9
mov edi, dword [edi]
push 4
add edi, 0x2c
push edi
call esi
test eax, eax
jne 0x100067f9
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x100067f9
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x100067f9
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x100067f9
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x100067f9
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x100067f9
mov edi, dword [edi]
push 4
add edi, 0x1b48
push edi
call esi
test eax, eax
jne 0x100067f9
push 4
push 0x281dac8
call esi
test eax, eax
jne 0x100067f9
push ebx
mov ebx, dword [0x281dac8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x100067f8
mov ebx, dword [ebx]
push 4
add ebx, 0x2c
push ebx
call esi
test eax, eax
jne 0x100067f8
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x100067f8
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x100067f8
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x100067f8
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x100067f8
push 4
push 0x281dac8
call esi
test eax, eax
jne 0x100067f8
mov ebx, dword [0x281dac8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x100067f8
mov ebx, dword [ebx]
push 4
add ebx, 0x2c
push ebx
call esi
test eax, eax
jne 0x100067f8
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x100067f8
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x100067f8
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x100067f8
mov eax, dword [ebx]
cmp eax, 0xb0
je 0x100067d8
cmp eax, 0x27c0
jne 0x100067f8
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
mov byte [edi], 0x14
push eax
push dword [ebp - 8]
push 1
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1002b830
mov esp, ebp
pop ebp
ret
Function at 0x10006810
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003800c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x281def4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x281dac8
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x100069fd
push edi
mov edi, dword [0x281dac8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x100069fc
mov edi, dword [edi]
push 4
add edi, 0x2c
push edi
call esi
test eax, eax
jne 0x100069fc
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x100069fc
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x100069fc
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x100069fc
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x100069fc
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x100069fc
mov edi, dword [edi]
push 4
add edi, 0x1c4c
push edi
call esi
test eax, eax
jne 0x100069fc
push 4
push 0x281dac8
call esi
test eax, eax
jne 0x100069fc
push ebx
mov ebx, dword [0x281dac8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x100069fb
mov ebx, dword [ebx]
push 4
add ebx, 0x2c
push ebx
call esi
test eax, eax
jne 0x100069fb
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x100069fb
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x100069fb
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x100069fb
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x100069fb
push 4
push 0x281dac8
call esi
test eax, eax
jne 0x100069fb
mov ebx, dword [0x281dac8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x100069fb
mov ebx, dword [ebx]
push 4
add ebx, 0x2c
push ebx
call esi
test eax, eax
jne 0x100069fb
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x100069fb
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x100069fb
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x100069fb
mov eax, dword [ebx]
cmp eax, 0xb3
je 0x100069d8
cmp eax, 0x27c3
jne 0x100069fb
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 8]
mov dword [edi], 0x42c80000
push eax
push dword [ebp - 8]
push 4
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1002b830
mov esp, ebp
pop ebp
ret
Function at 0x10006a10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003800c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x281def4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x281dac8
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10006bfb
push edi
mov edi, dword [0x281dac8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10006bfa
mov edi, dword [edi]
push 4
add edi, 0x2c
push edi
call esi
test eax, eax
jne 0x10006bfa
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10006bfa
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10006bfa
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10006bfa
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10006bfa
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10006bfa
mov edi, dword [edi]
push 4
add edi, 0x21e0
push edi
call esi
test eax, eax
jne 0x10006bfa
push 4
push 0x281dac8
call esi
test eax, eax
jne 0x10006bfa
push ebx
mov ebx, dword [0x281dac8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006bf9
mov ebx, dword [ebx]
push 4
add ebx, 0x2c
push ebx
call esi
test eax, eax
jne 0x10006bf9
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006bf9
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x10006bf9
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10006bf9
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10006bf9
push 4
push 0x281dac8
call esi
test eax, eax
jne 0x10006bf9
mov ebx, dword [0x281dac8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006bf9
mov ebx, dword [ebx]
push 4
add ebx, 0x2c
push ebx
call esi
test eax, eax
jne 0x10006bf9
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006bf9
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x10006bf9
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10006bf9
mov eax, dword [ebx]
cmp eax, 0x55
je 0x10006bd6
cmp eax, 0x2765
jne 0x10006bf9
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 8]
mov dword [edi], 0xf5287aa9
push eax
push dword [ebp - 8]
push 4
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1002b830
mov esp, ebp
pop ebp
ret
Function at 0x10006c10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003800c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x281def4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x281dac8
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10006df8
push edi
mov edi, dword [0x281dac8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10006df7
mov edi, dword [edi]
push 4
add edi, 0x2c
push edi
call esi
test eax, eax
jne 0x10006df7
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10006df7
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10006df7
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10006df7
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10006df7
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10006df7
mov edi, dword [edi]
push 4
add edi, 0x1b38
push edi
call esi
test eax, eax
jne 0x10006df7
push 4
push 0x281dac8
call esi
test eax, eax
jne 0x10006df7
push ebx
mov ebx, dword [0x281dac8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006df6
mov ebx, dword [ebx]
push 4
add ebx, 0x2c
push ebx
call esi
test eax, eax
jne 0x10006df6
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006df6
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x10006df6
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10006df6
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10006df6
push 4
push 0x281dac8
call esi
test eax, eax
jne 0x10006df6
mov ebx, dword [0x281dac8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006df6
mov ebx, dword [ebx]
push 4
add ebx, 0x2c
push ebx
call esi
test eax, eax
jne 0x10006df6
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006df6
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x10006df6
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10006df6
mov eax, dword [ebx]
cmp eax, 0x55
je 0x10006dd6
cmp eax, 0x2765
jne 0x10006df6
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
mov byte [edi], 6
push eax
push dword [ebp - 8]
push 1
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1002b830
mov esp, ebp
pop ebp
ret
Function at 0x10006e10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003800c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x281def4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x281dac8
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10006fff
push edi
mov edi, dword [0x281dac8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10006ffe
mov edi, dword [edi]
push 4
add edi, 0x2c
push edi
call esi
test eax, eax
jne 0x10006ffe
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10006ffe
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10006ffe
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10006ffe
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10006ffe
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10006ffe
mov edi, dword [edi]
push 4
add edi, 0x1b24
push edi
call esi
test eax, eax
jne 0x10006ffe
push 4
push 0x281dac8
call esi
test eax, eax
jne 0x10006ffe
push ebx
mov ebx, dword [0x281dac8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006ffd
mov ebx, dword [ebx]
push 4
add ebx, 0x2c
push ebx
call esi
test eax, eax
jne 0x10006ffd
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006ffd
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x10006ffd
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10006ffd
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10006ffd
push 4
push 0x281dac8
call esi
test eax, eax
jne 0x10006ffd
mov ebx, dword [0x281dac8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10006ffd
mov ebx, dword [ebx]
push 4
add ebx, 0x2c
push ebx
call esi
test eax, eax
jne 0x10006ffd
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10006ffd
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x10006ffd
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10006ffd
mov eax, dword [ebx]
cmp eax, 0x12
je 0x10006fdd
cmp eax, 0x2722
je 0x10006fdd
cmp eax, 0xea72
jne 0x10006ffd
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
mov byte [edi], 5
push eax
push dword [ebp - 8]
push 1
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1002b830
mov esp, ebp
pop ebp
ret
Function at 0x10007010
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003800c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x281def4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x281dac8
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x100071ff
push edi
mov edi, dword [0x281dac8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x100071fe
mov edi, dword [edi]
push 4
add edi, 0x2c
push edi
call esi
test eax, eax
jne 0x100071fe
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x100071fe
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x100071fe
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x100071fe
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x100071fe
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x100071fe
mov edi, dword [edi]
push 4
add edi, 0x1b24
push edi
call esi
test eax, eax
jne 0x100071fe
push 4
push 0x281dac8
call esi
test eax, eax
jne 0x100071fe
push ebx
mov ebx, dword [0x281dac8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x100071fd
mov ebx, dword [ebx]
push 4
add ebx, 0x2c
push ebx
call esi
test eax, eax
jne 0x100071fd
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x100071fd
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x100071fd
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x100071fd
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x100071fd
push 4
push 0x281dac8
call esi
test eax, eax
jne 0x100071fd
mov ebx, dword [0x281dac8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x100071fd
mov ebx, dword [ebx]
push 4
add ebx, 0x2c
push ebx
call esi
test eax, eax
jne 0x100071fd
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x100071fd
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x100071fd
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x100071fd
mov eax, dword [ebx]
cmp eax, 3
je 0x100071dd
cmp eax, 0xc353
je 0x100071dd
cmp eax, 0xea63
jne 0x100071fd
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
mov byte [edi], 8
push eax
push dword [ebp - 8]
push 1
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1002b830
mov esp, ebp
pop ebp
ret
Function at 0x10007210
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1003800c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [0x281def4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x281dac8
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10007406
push edi
mov edi, dword [0x281dac8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10007405
mov edi, dword [edi]
push 4
add edi, 0x2c
push edi
call esi
test eax, eax
jne 0x10007405
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10007405
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10007405
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10007405
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10007405
push ebx
mov ebx, dword [edi]
push 4
push ebx
call esi
test eax, eax
jne 0x10007404
mov ebx, dword [ebx]
add ebx, dword [ebp + 0x20]
push 4
push ebx
call esi
test eax, eax
jne 0x10007404
push 4
push 0x281dac8
call esi
test eax, eax
jne 0x10007404
mov edi, dword [0x281dac8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10007404
mov edi, dword [edi]
push 4
add edi, 0x2c
push edi
call esi
test eax, eax
jne 0x10007404
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10007404
mov edi, dword [edi]
push 4
add edi, 0x2e0
push edi
call esi
test eax, eax
jne 0x10007404
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10007404
mov ecx, dword [ebp - 8]
mov eax, dword [edi]
cmp eax, dword [ecx]
jne 0x10007404
push 4
push 0x281dac8
call esi
test eax, eax
jne 0x10007404
mov edi, dword [0x281dac8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10007404
mov edi, dword [edi]
push 4
add edi, 0x2c
push edi
call esi
test eax, eax
jne 0x10007404
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10007404
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10007404
mov edi, dword [edi]
push 4
add edi, 0x15c
push edi
call esi
test eax, eax
jne 0x10007404
mov eax, dword [edi]
cmp eax, 0x6e
je 0x100073d9
cmp eax, 0x277e
jne 0x10007404
mov edi, dword [ebp + 0x28]
lea eax, [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push edi
push ebx
call esi
push edi
push dword [ebp - 0xc]
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push ebx
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1002b830
mov esp, ebp
pop ebp
ret
Function at 0x10007420
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003800c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x281def4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x281dac8
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x1000760a
push edi
mov edi, dword [0x281dac8]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10007609
mov edi, dword [edi]
push 4
add edi, 0x2c
push edi
call esi
test eax, eax
jne 0x10007609
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10007609
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10007609
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10007609
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10007609
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10007609
mov edi, dword [edi]
push 4
add edi, 0x1e72
push edi
call esi
test eax, eax
jne 0x10007609
push 4
push 0x281dac8
call esi
test eax, eax
jne 0x10007609
push ebx
mov ebx, dword [0x281dac8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10007608
mov ebx, dword [ebx]
push 4
add ebx, 0x2c
push ebx
call esi
test eax, eax
jne 0x10007608
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10007608
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x10007608
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10007608
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10007608
push 4
push 0x281dac8
call esi
test eax, eax
jne 0x10007608
mov ebx, dword [0x281dac8]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10007608
mov ebx, dword [ebx]
push 4
add ebx, 0x2c
push ebx
call esi
test eax, eax
jne 0x10007608
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10007608
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x10007608
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10007608
mov eax, dword [ebx]
cmp eax, 0x99
je 0x100075e8
cmp eax, 0x27a9
jne 0x10007608
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
mov byte [edi], 0xc8
push eax
push dword [ebp - 8]
push 1
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1002b830
mov esp, ebp
pop ebp
ret