I'm analysing some malware executable with ImmDBG and IDA Pro.
The executable calls the kernel32.VirtualAlloc() at runtime with an argument lpAddress=NULL what means that an operating system decides itself where the memory has to be allocated. The VirtualAlloc() returns an address 0x003F0000. After that the executable writes some function to this memory, which is quite big, and I would like to analyse this function in IDA Pro.
The problem is, that my executable is loaded to the 0x004010000 in IDA Pro and I don't know how could I extend the memory of the executable in IDA Pro in order to create this function manually(with help of PatchBytes).
Also maybe it's possible somehow to build a function from a sequence of opcodes in IDA Pro?
Thank you in advance!