joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002550
Capabilities:
Log keystrokes

Disassembly:
mov eax, dword [0x397e8dc]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ecx + 0x14]
mov eax, dword [edx + 0x3d0]
add eax, 0x2c
mov al, byte [eax]
push esi
push edi
cmp al, 1
jne 0x100025a1
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x23
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x23
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x23
call esi
push eax
push 0x23
call edi
pop edi
pop esi
ret
cmp al, 2
jne 0x100025da
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x28
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x28
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x28
call esi
push eax
push 0x28
call edi
pop edi
pop esi
ret
cmp al, 3
jne 0x10002613
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x22
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x22
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x22
call esi
push eax
push 0x22
call edi
pop edi
pop esi
ret
cmp al, 4
jne 0x1000264c
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x25
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x25
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x25
call esi
push eax
push 0x25
call edi
pop edi
pop esi
ret
cmp al, 5
jne 0x10002685
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0xc
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0xc
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0xc
call esi
push eax
push 0xc
call edi
pop edi
pop esi
ret
cmp al, 6
jne 0x100026be
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x27
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x27
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x27
call esi
push eax
push 0x27
call edi
pop edi
pop esi
ret
cmp al, 7
jne 0x100026f7
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x24
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x24
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x24
call esi
push eax
push 0x24
call edi
pop edi
pop esi
ret
cmp al, 8
jne 0x10002730
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x26
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x26
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x26
call esi
push eax
push 0x26
call edi
pop edi
pop esi
ret
cmp al, 9
jne 0x10002766
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x21
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x21
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x21
call esi
push eax
push 0x21
call edi
pop edi
pop esi
ret
Function at 0x10002770
Capabilities:
Log keystrokes

Disassembly:
mov eax, dword [0x397e8dc]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ecx + 0x14]
mov eax, dword [edx + 0x3d0]
add eax, 0x30
mov al, byte [eax]
push esi
push edi
cmp al, 1
jne 0x100027c1
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x23
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x23
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x23
call esi
push eax
push 0x23
call edi
pop edi
pop esi
ret
cmp al, 2
jne 0x100027fa
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x28
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x28
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x28
call esi
push eax
push 0x28
call edi
pop edi
pop esi
ret
cmp al, 3
jne 0x10002833
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x22
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x22
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x22
call esi
push eax
push 0x22
call edi
pop edi
pop esi
ret
cmp al, 4
jne 0x1000286c
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x25
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x25
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x25
call esi
push eax
push 0x25
call edi
pop edi
pop esi
ret
cmp al, 5
jne 0x100028a5
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0xc
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0xc
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0xc
call esi
push eax
push 0xc
call edi
pop edi
pop esi
ret
cmp al, 6
jne 0x100028de
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x27
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x27
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x27
call esi
push eax
push 0x27
call edi
pop edi
pop esi
ret
cmp al, 7
jne 0x10002917
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x24
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x24
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x24
call esi
push eax
push 0x24
call edi
pop edi
pop esi
ret
cmp al, 8
jne 0x10002950
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x26
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x26
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x26
call esi
push eax
push 0x26
call edi
pop edi
pop esi
ret
cmp al, 9
jne 0x10002986
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x21
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x21
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x21
call esi
push eax
push 0x21
call edi
pop edi
pop esi
ret
Function at 0x10002990
Capabilities:
Log keystrokes

Disassembly:
mov eax, dword [0x397e8dc]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ecx + 0x14]
mov eax, dword [edx + 0x3d0]
add eax, 0x34
mov al, byte [eax]
push esi
push edi
cmp al, 1
jne 0x100029e1
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x23
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x23
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x23
call esi
push eax
push 0x23
call edi
pop edi
pop esi
ret
cmp al, 2
jne 0x10002a1a
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x28
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x28
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x28
call esi
push eax
push 0x28
call edi
pop edi
pop esi
ret
cmp al, 3
jne 0x10002a53
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x22
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x22
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x22
call esi
push eax
push 0x22
call edi
pop edi
pop esi
ret
cmp al, 4
jne 0x10002a8c
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x25
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x25
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x25
call esi
push eax
push 0x25
call edi
pop edi
pop esi
ret
cmp al, 5
jne 0x10002ac5
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0xc
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0xc
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0xc
call esi
push eax
push 0xc
call edi
pop edi
pop esi
ret
cmp al, 6
jne 0x10002afe
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x27
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x27
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x27
call esi
push eax
push 0x27
call edi
pop edi
pop esi
ret
cmp al, 7
jne 0x10002b37
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x24
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x24
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x24
call esi
push eax
push 0x24
call edi
pop edi
pop esi
ret
cmp al, 8
jne 0x10002b70
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x26
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x26
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x26
call esi
push eax
push 0x26
call edi
pop edi
pop esi
ret
cmp al, 9
jne 0x10002ba6
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x21
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x21
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x21
call esi
push eax
push 0x21
call edi
pop edi
pop esi
ret
Function at 0x10002bb0
Capabilities:
Log keystrokes

Disassembly:
mov eax, dword [0x397e8dc]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ecx + 0x14]
mov eax, dword [edx + 0x3d0]
add eax, 0x38
mov al, byte [eax]
push esi
push edi
cmp al, 1
jne 0x10002c01
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x23
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x23
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x23
call esi
push eax
push 0x23
call edi
pop edi
pop esi
ret
cmp al, 2
jne 0x10002c3a
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x28
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x28
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x28
call esi
push eax
push 0x28
call edi
pop edi
pop esi
ret
cmp al, 3
jne 0x10002c73
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x22
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x22
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x22
call esi
push eax
push 0x22
call edi
pop edi
pop esi
ret
cmp al, 4
jne 0x10002cac
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x25
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x25
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x25
call esi
push eax
push 0x25
call edi
pop edi
pop esi
ret
cmp al, 5
jne 0x10002ce5
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0xc
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0xc
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0xc
call esi
push eax
push 0xc
call edi
pop edi
pop esi
ret
cmp al, 6
jne 0x10002d1e
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x27
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x27
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x27
call esi
push eax
push 0x27
call edi
pop edi
pop esi
ret
cmp al, 7
jne 0x10002d57
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x24
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x24
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x24
call esi
push eax
push 0x24
call edi
pop edi
pop esi
ret
cmp al, 8
jne 0x10002d90
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x26
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x26
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x26
call esi
push eax
push 0x26
call edi
pop edi
pop esi
ret
cmp al, 9
jne 0x10002dc6
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x21
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x21
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x21
call esi
push eax
push 0x21
call edi
pop edi
pop esi
ret
Function at 0x10002dd0
Capabilities:
Log keystrokes

Disassembly:
mov eax, dword [0x397e8dc]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ecx + 0x14]
mov eax, dword [edx + 0x3d0]
add eax, 0x3c
mov al, byte [eax]
push esi
push edi
cmp al, 1
jne 0x10002e21
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x23
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x23
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x23
call esi
push eax
push 0x23
call edi
pop edi
pop esi
ret
cmp al, 2
jne 0x10002e5a
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x28
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x28
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x28
call esi
push eax
push 0x28
call edi
pop edi
pop esi
ret
cmp al, 3
jne 0x10002e93
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x22
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x22
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x22
call esi
push eax
push 0x22
call edi
pop edi
pop esi
ret
cmp al, 4
jne 0x10002ecc
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x25
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x25
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x25
call esi
push eax
push 0x25
call edi
pop edi
pop esi
ret
cmp al, 5
jne 0x10002f05
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0xc
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0xc
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0xc
call esi
push eax
push 0xc
call edi
pop edi
pop esi
ret
cmp al, 6
jne 0x10002f3e
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x27
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x27
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x27
call esi
push eax
push 0x27
call edi
pop edi
pop esi
ret
cmp al, 7
jne 0x10002f77
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x24
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x24
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x24
call esi
push eax
push 0x24
call edi
pop edi
pop esi
ret
cmp al, 8
jne 0x10002fb0
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x26
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x26
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x26
call esi
push eax
push 0x26
call edi
pop edi
pop esi
ret
cmp al, 9
jne 0x10002fe6
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x21
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x21
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x21
call esi
push eax
push 0x21
call edi
pop edi
pop esi
ret
Function at 0x10002ff0
Capabilities:
Log keystrokes

Disassembly:
mov eax, dword [0x397e8dc]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ecx + 0x14]
mov eax, dword [edx + 0x3d0]
add eax, 0x40
mov al, byte [eax]
push esi
push edi
cmp al, 1
jne 0x10003041
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x23
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x23
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x23
call esi
push eax
push 0x23
call edi
pop edi
pop esi
ret
cmp al, 2
jne 0x1000307a
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x28
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x28
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x28
call esi
push eax
push 0x28
call edi
pop edi
pop esi
ret
cmp al, 3
jne 0x100030b3
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x22
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x22
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x22
call esi
push eax
push 0x22
call edi
pop edi
pop esi
ret
cmp al, 4
jne 0x100030ec
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x25
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x25
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x25
call esi
push eax
push 0x25
call edi
pop edi
pop esi
ret
cmp al, 5
jne 0x10003125
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0xc
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0xc
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0xc
call esi
push eax
push 0xc
call edi
pop edi
pop esi
ret
cmp al, 6
jne 0x1000315e
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x27
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x27
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x27
call esi
push eax
push 0x27
call edi
pop edi
pop esi
ret
cmp al, 7
jne 0x10003197
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x24
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x24
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x24
call esi
push eax
push 0x24
call edi
pop edi
pop esi
ret
cmp al, 8
jne 0x100031d0
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x26
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x26
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x26
call esi
push eax
push 0x26
call edi
pop edi
pop esi
ret
cmp al, 9
jne 0x10003206
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x21
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x21
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x21
call esi
push eax
push 0x21
call edi
pop edi
pop esi
ret
Function at 0x10003210
Capabilities:
Log keystrokes

Disassembly:
mov eax, dword [0x397e8dc]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ecx + 0x14]
mov eax, dword [edx + 0x3d0]
add eax, 0x44
mov al, byte [eax]
push esi
push edi
cmp al, 1
jne 0x10003261
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x23
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x23
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x23
call esi
push eax
push 0x23
call edi
pop edi
pop esi
ret
cmp al, 2
jne 0x1000329a
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x28
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x28
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x28
call esi
push eax
push 0x28
call edi
pop edi
pop esi
ret
cmp al, 3
jne 0x100032d3
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x22
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x22
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x22
call esi
push eax
push 0x22
call edi
pop edi
pop esi
ret
cmp al, 4
jne 0x1000330c
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x25
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x25
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x25
call esi
push eax
push 0x25
call edi
pop edi
pop esi
ret
cmp al, 5
jne 0x10003345
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0xc
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0xc
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0xc
call esi
push eax
push 0xc
call edi
pop edi
pop esi
ret
cmp al, 6
jne 0x1000337e
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x27
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x27
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x27
call esi
push eax
push 0x27
call edi
pop edi
pop esi
ret
cmp al, 7
jne 0x100033b7
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x24
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x24
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x24
call esi
push eax
push 0x24
call edi
pop edi
pop esi
ret
cmp al, 8
jne 0x100033f0
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x26
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x26
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x26
call esi
push eax
push 0x26
call edi
pop edi
pop esi
ret
cmp al, 9
jne 0x10003426
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push 0
push 0
push 0x21
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x21
call edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 2
push 0
push 0x21
call esi
push eax
push 0x21
call edi
pop edi
pop esi
ret
Function at 0x10003430
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100052d0
push 0x10003f89
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [section..data]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [0x100063a0]
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 5
push esi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call edi
mov byte [esi], 0xe9
mov ecx, 0x100034e0
sub ecx, esi
sub ecx, 5
mov dword [esi + 1], ecx
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x1c]
push eax
push 5
push esi
call edi
mov dword [ebp - 4], 0xfffffffe
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10003750
Capabilities:
Create thread
Execute command
Set console window title

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x100037ff
push esi
push edi
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push str.color_03
call dword [sym.imp.MSVCR100.dll_system]
add esp, 4
push str.QUICKERS_COMMUNITY
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
mov dword [ebp + 0xc], 0
call esi
mov edi, dword [sym.imp.MSVCR100.dll_freopen_s]
push eax
push 0x10005190
lea eax, [ebp + 0xc]
push 0x10005194
push eax
call edi
call esi
add eax, 0x20
push eax
push 0x10005198
lea ecx, [ebp + 0xc]
push 0x10005194
push ecx
call edi
call esi
add eax, 0x40
push eax
push 0x10005198
lea edx, [ebp + 0xc]
push 0x10005194
push edx
call edi
mov esi, dword [sym.imp.MSVCR100.dll_printf]
push str.F3_No_Red_:_On_n
call esi
push str.F4_No_Red_:_Off_n
call esi
push str.ALT_KANAN_Auto_Arrow_:_On_n
call esi
push 0xc
push 0
push 0x10003510
call dword [sym.imp.MSVCR100.dll__beginthread]
add esp, 0x48
pop edi
pop esi
mov eax, 1
pop ebp
ret 0xc