I have the following lines:
... mov [ebp+nSize], offset nullsub_1 ... sub [ebp+nSize], offset loc_402B58
So, nSize is then used for the call of VirtualAllocEx. At nullsub_1, I have the follwoing(notice I use IDA PRO):
nulsub_1 proc near retn nullsub_1 endp
Question 1 : What is that ? Has somebody an idea what this can be ? I would say, it is a pointer to NULL but I am not sure.
At loc_402B58 I have the following(It is the same what I posted in another topic, I thought it would be helpful when I also post this Question about process injection):
loc_402B58: push esi mov esi, [esp+8] lea eax, [esi+14h] push eax call dword ptr[esi] test eax, eax mov [esi+10h], eax jz short loc_402B80 lea ecx, [esi+46h] push ecx push eax call dword ptr [esi+4] test eax, eax jz short_loc402B80 call eax push 0 call eax push 0 call dword ptr [esi+8] loc_402B80: xor eax, eax pop esi retn 4
How can we subtract pieces of codes which is done at sub [ebp+nSize], offset loc_402B58 ? I have never seen a piece of code like nullsub_1 . So I hope somebody can tell me what is it but i understand what the code at loc_402B58 does.