joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001660
Capabilities:
Log keystrokes

Disassembly:
mov eax, dword [0x397e8dc]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ecx + 0x14]
mov eax, dword [edx + 0x3d0]
add eax, 0x10
mov al, byte [eax]
push esi
push edi
cmp al, 1
jne 0x100016b1
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x23
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x23
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x23
call esi
push eax
push 0x23
call edi
pop edi
pop esi
ret
cmp al, 2
jne 0x100016ea
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x28
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x28
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x28
call esi
push eax
push 0x28
call edi
pop edi
pop esi
ret
cmp al, 3
jne 0x10001723
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x22
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x22
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x22
call esi
push eax
push 0x22
call edi
pop edi
pop esi
ret
cmp al, 4
jne 0x1000175c
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x25
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x25
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x25
call esi
push eax
push 0x25
call edi
pop edi
pop esi
ret
cmp al, 5
jne 0x10001795
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0xc
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0xc
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0xc
call esi
push eax
push 0xc
call edi
pop edi
pop esi
ret
cmp al, 6
jne 0x100017ce
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x27
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x27
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x27
call esi
push eax
push 0x27
call edi
pop edi
pop esi
ret
cmp al, 7
jne 0x10001807
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x24
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x24
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x24
call esi
push eax
push 0x24
call edi
pop edi
pop esi
ret
cmp al, 8
jne 0x10001840
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x26
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x26
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x26
call esi
push eax
push 0x26
call edi
pop edi
pop esi
ret
cmp al, 9
jne 0x10001876
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x21
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x21
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x21
call esi
push eax
push 0x21
call edi
pop edi
pop esi
ret
Function at 0x10001880
Capabilities:
Log keystrokes

Disassembly:
mov eax, dword [0x397e8dc]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ecx + 0x14]
mov eax, dword [edx + 0x3d0]
add eax, 0x14
mov al, byte [eax]
push esi
push edi
cmp al, 1
jne 0x100018d1
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x23
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x23
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x23
call esi
push eax
push 0x23
call edi
pop edi
pop esi
ret
cmp al, 2
jne 0x1000190a
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x28
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x28
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x28
call esi
push eax
push 0x28
call edi
pop edi
pop esi
ret
cmp al, 3
jne 0x10001943
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x22
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x22
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x22
call esi
push eax
push 0x22
call edi
pop edi
pop esi
ret
cmp al, 4
jne 0x1000197c
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x25
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x25
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x25
call esi
push eax
push 0x25
call edi
pop edi
pop esi
ret
cmp al, 5
jne 0x100019b5
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0xc
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0xc
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0xc
call esi
push eax
push 0xc
call edi
pop edi
pop esi
ret
cmp al, 6
jne 0x100019ee
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x27
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x27
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x27
call esi
push eax
push 0x27
call edi
pop edi
pop esi
ret
cmp al, 7
jne 0x10001a27
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x24
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x24
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x24
call esi
push eax
push 0x24
call edi
pop edi
pop esi
ret
cmp al, 8
jne 0x10001a60
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x26
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x26
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x26
call esi
push eax
push 0x26
call edi
pop edi
pop esi
ret
cmp al, 9
jne 0x10001a96
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x21
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x21
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x21
call esi
push eax
push 0x21
call edi
pop edi
pop esi
ret
Function at 0x10001aa0
Capabilities:
Log keystrokes

Disassembly:
mov eax, dword [0x397e8dc]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ecx + 0x14]
mov eax, dword [edx + 0x3d0]
add eax, 0x18
mov al, byte [eax]
push esi
push edi
cmp al, 1
jne 0x10001af1
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x23
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x23
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x23
call esi
push eax
push 0x23
call edi
pop edi
pop esi
ret
cmp al, 2
jne 0x10001b2a
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x28
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x28
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x28
call esi
push eax
push 0x28
call edi
pop edi
pop esi
ret
cmp al, 3
jne 0x10001b63
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x22
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x22
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x22
call esi
push eax
push 0x22
call edi
pop edi
pop esi
ret
cmp al, 4
jne 0x10001b9c
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x25
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x25
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x25
call esi
push eax
push 0x25
call edi
pop edi
pop esi
ret
cmp al, 5
jne 0x10001bd5
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0xc
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0xc
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0xc
call esi
push eax
push 0xc
call edi
pop edi
pop esi
ret
cmp al, 6
jne 0x10001c0e
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x27
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x27
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x27
call esi
push eax
push 0x27
call edi
pop edi
pop esi
ret
cmp al, 7
jne 0x10001c47
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x24
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x24
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x24
call esi
push eax
push 0x24
call edi
pop edi
pop esi
ret
cmp al, 8
jne 0x10001c80
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x26
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x26
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x26
call esi
push eax
push 0x26
call edi
pop edi
pop esi
ret
cmp al, 9
jne 0x10001cb6
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x21
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x21
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x21
call esi
push eax
push 0x21
call edi
pop edi
pop esi
ret
Function at 0x10001cc0
Capabilities:
Log keystrokes

Disassembly:
mov eax, dword [0x397e8dc]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ecx + 0x14]
mov eax, dword [edx + 0x3d0]
add eax, 0x1c
mov al, byte [eax]
push esi
push edi
cmp al, 1
jne 0x10001d11
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x23
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x23
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x23
call esi
push eax
push 0x23
call edi
pop edi
pop esi
ret
cmp al, 2
jne 0x10001d4a
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x28
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x28
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x28
call esi
push eax
push 0x28
call edi
pop edi
pop esi
ret
cmp al, 3
jne 0x10001d83
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x22
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x22
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x22
call esi
push eax
push 0x22
call edi
pop edi
pop esi
ret
cmp al, 4
jne 0x10001dbc
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x25
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x25
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x25
call esi
push eax
push 0x25
call edi
pop edi
pop esi
ret
cmp al, 5
jne 0x10001df5
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0xc
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0xc
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0xc
call esi
push eax
push 0xc
call edi
pop edi
pop esi
ret
cmp al, 6
jne 0x10001e2e
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x27
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x27
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x27
call esi
push eax
push 0x27
call edi
pop edi
pop esi
ret
cmp al, 7
jne 0x10001e67
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x24
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x24
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x24
call esi
push eax
push 0x24
call edi
pop edi
pop esi
ret
cmp al, 8
jne 0x10001ea0
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x26
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x26
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x26
call esi
push eax
push 0x26
call edi
pop edi
pop esi
ret
cmp al, 9
jne 0x10001ed6
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x21
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x21
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x21
call esi
push eax
push 0x21
call edi
pop edi
pop esi
ret
Function at 0x10001ef0
Capabilities:
Log keystrokes

Disassembly:
mov eax, dword [0x397e8dc]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ecx + 0x14]
mov eax, dword [edx + 0x3d0]
add eax, 0x20
mov al, byte [eax]
push esi
push edi
cmp al, 1
jne 0x10001f41
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x23
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x23
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x23
call esi
push eax
push 0x23
call edi
pop edi
pop esi
ret
cmp al, 2
jne 0x10001f7a
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x28
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x28
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x28
call esi
push eax
push 0x28
call edi
pop edi
pop esi
ret
cmp al, 3
jne 0x10001fb3
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x22
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x22
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x22
call esi
push eax
push 0x22
call edi
pop edi
pop esi
ret
cmp al, 4
jne 0x10001fec
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x25
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x25
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x25
call esi
push eax
push 0x25
call edi
pop edi
pop esi
ret
cmp al, 5
jne 0x10002025
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0xc
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0xc
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0xc
call esi
push eax
push 0xc
call edi
pop edi
pop esi
ret
cmp al, 6
jne 0x1000205e
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x27
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x27
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x27
call esi
push eax
push 0x27
call edi
pop edi
pop esi
ret
cmp al, 7
jne 0x10002097
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x24
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x24
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x24
call esi
push eax
push 0x24
call edi
pop edi
pop esi
ret
cmp al, 8
jne 0x100020d0
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x26
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x26
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x26
call esi
push eax
push 0x26
call edi
pop edi
pop esi
ret
cmp al, 9
jne 0x10002106
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x21
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x21
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x21
call esi
push eax
push 0x21
call edi
pop edi
pop esi
ret
Function at 0x10002110
Capabilities:
Log keystrokes

Disassembly:
mov eax, dword [0x397e8dc]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ecx + 0x14]
mov eax, dword [edx + 0x3d0]
add eax, 0x24
mov al, byte [eax]
push esi
push edi
cmp al, 1
jne 0x10002161
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x23
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x23
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x23
call esi
push eax
push 0x23
call edi
pop edi
pop esi
ret
cmp al, 2
jne 0x1000219a
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x28
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x28
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x28
call esi
push eax
push 0x28
call edi
pop edi
pop esi
ret
cmp al, 3
jne 0x100021d3
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x22
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x22
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x22
call esi
push eax
push 0x22
call edi
pop edi
pop esi
ret
cmp al, 4
jne 0x1000220c
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x25
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x25
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x25
call esi
push eax
push 0x25
call edi
pop edi
pop esi
ret
cmp al, 5
jne 0x10002245
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0xc
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0xc
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0xc
call esi
push eax
push 0xc
call edi
pop edi
pop esi
ret
cmp al, 6
jne 0x1000227e
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x27
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x27
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x27
call esi
push eax
push 0x27
call edi
pop edi
pop esi
ret
cmp al, 7
jne 0x100022b7
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x24
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x24
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x24
call esi
push eax
push 0x24
call edi
pop edi
pop esi
ret
cmp al, 8
jne 0x100022f0
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x26
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x26
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x26
call esi
push eax
push 0x26
call edi
pop edi
pop esi
ret
cmp al, 9
jne 0x10002326
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x21
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x21
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x21
call esi
push eax
push 0x21
call edi
pop edi
pop esi
ret
Function at 0x10002330
Capabilities:
Log keystrokes

Disassembly:
mov eax, dword [0x397e8dc]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ecx + 0x14]
mov eax, dword [edx + 0x3d0]
add eax, 0x28
mov al, byte [eax]
push esi
push edi
cmp al, 1
jne 0x10002381
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x23
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x23
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x23
call esi
push eax
push 0x23
call edi
pop edi
pop esi
ret
cmp al, 2
jne 0x100023ba
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x28
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x28
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x28
call esi
push eax
push 0x28
call edi
pop edi
pop esi
ret
cmp al, 3
jne 0x100023f3
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x22
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x22
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x22
call esi
push eax
push 0x22
call edi
pop edi
pop esi
ret
cmp al, 4
jne 0x1000242c
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x25
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x25
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x25
call esi
push eax
push 0x25
call edi
pop edi
pop esi
ret
cmp al, 5
jne 0x10002465
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0xc
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0xc
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0xc
call esi
push eax
push 0xc
call edi
pop edi
pop esi
ret
cmp al, 6
jne 0x1000249e
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x27
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x27
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x27
call esi
push eax
push 0x27
call edi
pop edi
pop esi
ret
cmp al, 7
jne 0x100024d7
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x24
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x24
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x24
call esi
push eax
push 0x24
call edi
pop edi
pop esi
ret
cmp al, 8
jne 0x10002510
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x26
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x26
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x26
call esi
push eax
push 0x26
call edi
pop edi
pop esi
ret
cmp al, 9
jne 0x10002546
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x21
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x21
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x21
call esi
push eax
push 0x21
call edi
pop edi
pop esi
ret