During an analysis, I found the following piece of malware:
... lea eax, [ebp+ThreadId] push eax ;lpThreadId push ebx ;dwCreationFlags push [ebp+lpParameter] ;lpParameter push [ebp+lpStartAddress] ;lpStartAddress push ebx ;dwStackSize push ebx ;lpThreadAttributes push [ebp+hProcess] ;hProcess call CreateRemoteThread ...
What I definitely know
From some previous parts, I know that
xor ebx, ebx -> ebx = NULL or zero
At the address pointed to by
lpParameter, the malware stores the address of
hProcess is a handle to
What I want to know
lpStartAddress, I have found the following lines:
... push ebx push [ebp+nSize] push offset loc_402B58 push [ebp+lpStartAddress] push [ebp+hProcess] call WriteProcessMemory ...
So, this function writes the content of
offset loc_402B58 into the region of pages started at
lpStartAddress (which was allocated some lines before).
Now, when I go to
offset loc_402B58, I see the following (note: I use IDA PRO):
loc_402B58: push esi mov esi, [esp+8] lea eax, [esi+14h] push eax call dword ptr[esi] test eax, eax mov [esi+10h], eax jz short loc_402B80 lea ecx, [esi+46h] push ecx push eax call dword ptr [esi+4] test eax, eax jz short_loc402B80 call eax push 0 call eax <----- edited because i have forgotten it push 0 <----- '' call dword ptr [esi+8] <----- '' loc_402B80: xor eax, eax pop esi retn 4
So my question would be:
What does the assembly at