I have the following lines:
...
mov [ebp+nSize], offset nullsub_1
...
sub [ebp+nSize], offset loc_402B58
So, nSize is then used for the call of VirtualAllocEx. At nullsub_1, I have the follwoing(notice I use IDA PRO):
nulsub_1 proc near
retn
nullsub_1 endp
Question 1 : What is that ? Has somebody an idea what this can be ? I would say, it is a pointer to NULL but I am not sure.
At loc_402B58 I have the following(It is the same what I posted in another topic, I thought it would be helpful when I also post this Question about process injection):
loc_402B58:
push esi
mov esi, [esp+8]
lea eax, [esi+14h]
push eax
call dword ptr[esi]
test eax, eax
mov [esi+10h], eax
jz short loc_402B80
lea ecx, [esi+46h]
push ecx
push eax
call dword ptr [esi+4]
test eax, eax
jz short_loc402B80
call eax
push 0
call eax
push 0
call dword ptr [esi+8]
loc_402B80:
xor eax, eax
pop esi
retn 4
How can we subtract pieces of codes which is done at sub [ebp+nSize], offset loc_402B58 ? I have never seen a piece of code like nullsub_1 . So I hope somebody can tell me what is it but i understand what the code at loc_402B58 does.