joyce8/EMBER2024-capa huggingface dataset:
Function at 0x84b06a
Capabilities:
Get file size
Read file on windows

Disassembly:
call fcn.0084a2b1
mov esi, 0x4a7614
mov edi, 0x4c502c
cmp byte [esi], 0
je 0x84b081
movsb byte es:[edi], byte [esi]
jmp 0x84b079
mov dword [edi], 0x676e614c
mov byte [edi + 4], 0x5c
add edi, 5
mov esi, str.RosAsmStrings
cmp byte [esi], 0
je 0x84b09b
movsb byte es:[edi], byte [esi]
jmp 0x84b093
push dword [0x430744]
pop dword [edi]
push 0x509de8
push 0x4c502c
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x84b16d
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push 0x4c502c
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x4c543c], eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x4c5440], eax
add eax, 0xa
mov ebx, 0x4c5444
mov edx, eax
call fcn.0084b515
add dword [0x4c5444], 0xa
push 0
push 0x4319c0
push dword [0x4c5440]
push dword [0x4c5444]
push dword [0x4c543c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [0x4c543c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [0x4c5444]
mov edx, esi
add edx, dword [0x4c5440]
cmp dword [0x430744], 0x687a2e
jne 0x84b15c
mov byte [0x43075c], 1
call fcn.0084b178
jmp 0x84b168
mov byte [0x43075c], 0
call fcn.0084b252
jmp 0x84b177
mov dword [0x430744], 0x6e652e
ret

Function at 0x84b515
Capabilities:
Terminate process

Disassembly:
push ebx
mov edi, 0x4c5448
cmp dword [edi], 0
jbe 0x84b572
add edi, 0xc
cmp edi, 0x4cfab0
jne 0x84b570
push 0x1010
push str.Memory_attribution_failure
push str.___RosAsm_is_going_to_close._Shut_down_some_Aplications_and_re_run
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.0084b83b
pushal
push 0x1000
push str.Arghhh___...
push str.VirtualAlloc_Buffer_overflowed
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_MessageBoxA]
popal
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x84b51b
mov eax, edx
add eax, 0xfff
and eax, 0xfffff000
add eax, 0x1000
mov dword [0x4cfab4], eax
mov dword [edi + 4], eax
cmp dword [0x4cfab4], 0xe000
ja 0x84b5a0
push edi
call fcn.0084b735
pop edi
jmp 0x84b5a5
mov eax, 0
cmp eax, 0
jne 0x84b5e5
push edi
mov eax, dword [0x4cfab4]
add eax, 0xffff
and eax, 0xffff0000
push 4
push 0x2000
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp eax, 0
jne 0x84b5dd
pushal
push dword [0x4cfab4]
pop eax
call fcn.0084a019
popal
pop edi
mov dword [edi], eax
mov dword [edi + 8], eax
jmp 0x84b5ea
mov dword [edi], eax
mov dword [edi + 8], ebx
cmp edi, dword [0x4cfab8]
jbe 0x84b5f8
mov dword [0x4cfab8], edi
mov ecx, dword [0x4cfab4]
sub ecx, 0x1000
push 4
push 0x1000
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp eax, 0
jne 0x84b65d
push 0x1010
push str.Memory_attribution_failure
push str.Error_inside_RosAsm_Memory_Management
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.0084b83b
pushal
push 0x1000
push str.Arghhh___...
push str.VirtualAlloc_Function_failure
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_MessageBoxA]
popal
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop ebx
mov dword [ebx], eax
ret
Function at 0x84b661
Capabilities:
Terminate process

Disassembly:
pushal
and eax, 0xfffff000
mov esi, 0x4c5448
cmp dword [esi], eax
je 0x84b6c2
add esi, 0xc
cmp esi, 0x4cfab0
jne 0x84b6c0
push 0x1010
push str.Error_inside_RosAsm_Memory_Management
push str.Error_inside_RosAsm_Memory_Management
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.0084b83b
pushal
push 0x1000
push str.Arghhh___...
push str.VirtualFree_Buffer_overflow
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_MessageBoxA]
popal
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x84b66c
push esi
mov ecx, dword [esi + 4]
sub ecx, 0x1000
push 0x4000
push ecx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop esi
mov ebx, dword [esi + 8]
mov ecx, 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push esi
mov esi, 0x4c5448
cmp esi, dword [0x4cfab8]
ja 0x84b710
cmp dword [esi + 8], ebx
jne 0x84b70b
inc ecx
add esi, 0xc
jmp 0x84b6fd
cmp ecx, 0
jne 0x84b723
push 0x8000
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop esi
cmp esi, dword [0x4cfab8]
jne 0x84b733
sub dword [0x4cfab8], 0xc
popal
ret
Function at 0x84efe4
Capabilities:
Parse credit card information

Disassembly:
mov dword [0x82e9d4], 4
mov dword [0x82e9d8], 0
push 0x1000
push dword [0x82e9c8]
push 0xa
push dword [0x82e9d0]
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
cmp eax, 0xa
jae 0x84f017
ret
mov byte [0x84784c], 1
mov eax, esp
mov dword [0x81363c], eax
mov byte [0x81367c], 0
mov eax, dword [0x82e9c8]
cmp byte [eax], 0
jbe 0x84f039
inc eax
jmp 0x84f031
mov byte [eax], 0xd
mov byte [eax + 1], 0xa
add eax, 2
inc eax
sub eax, dword [0x82e9c8]
push eax
call fcn.0084feff
pop eax
push eax
push dword [0x82e9c8]
call fcn.0084d252
call fcn.0084d29f
call fcn.0084e0aa
cmp byte [0x81367c], 1
jne 0x84f075
jmp 0x84f283
call fcn.0084d33d
cmp byte [0x81367c], 1
jne 0x84f088
jmp 0x84f283
mov esi, dword [0x5097dc]
mov edi, dword [0x82e9cc]
mov dword [0x82e9dc], 0
cmp byte [esi], 0x14
jne 0x84f0a4
inc esi
mov byte [edi], 0x5b
inc edi
cmp byte [esi], 2
jbe 0x84f21d
mov ebx, esi
cmp byte [ebx], 0x1f
jbe 0x84f0bb
inc ebx
jmp 0x84f0b3
cmp byte [ebx], 0xe
jne 0x84f0fc
cmp dword [0x82e9dc], 0
jne 0x84f0d3
mov dword [0x82e9dc], esi
cmp byte [esi], 0xe
je 0x84f0db
movsb byte es:[edi], byte [esi]
jmp 0x84f0d3
mov byte [edi], 0x20
inc edi
mov eax, dword [0x82e9d8]
call fcn.008b01e2
mov byte [edi], 0xd
mov byte [edi + 1], 0xa
mov byte [edi + 2], 0x20
add edi, 3
jmp 0x84f217
cmp byte [ebx], 0xf
jne 0x84f198
cmp byte [ebx - 1], 0x44
jne 0x84f117
mov dword [0x82e9d4], 4
jmp 0x84f193
cmp byte [ebx - 1], 0x57
jne 0x84f129
mov dword [0x82e9d4], 2
jmp 0x84f193
cmp byte [ebx - 1], 0x55
jne 0x84f13b
mov dword [0x82e9d4], 2
jmp 0x84f193
cmp byte [ebx - 1], 0x42
jne 0x84f14d
mov dword [0x82e9d4], 1
jmp 0x84f193
cmp byte [ebx - 1], 0x51
jne 0x84f15f
mov dword [0x82e9d4], 8
jmp 0x84f193
cmp byte [ebx - 1], 0x52
jne 0x84f171
mov dword [0x82e9d4], 8
jmp 0x84f193
cmp byte [ebx - 1], 0x46
jne 0x84f183
mov dword [0x82e9d4], 4
jmp 0x84f193
cmp byte [ebx - 1], 0x54
jne 0x84f193
mov dword [0x82e9d4], 0xa
jmp 0x84f217
cmp byte [ebx], 0x1c
jne 0x84f1cf
inc esi
cmp byte [esi], 0x30
jne 0x84f1ae
call fcn.00857653
jmp 0x84f1b3
call fcn.00857691
mul dword [0x82e9d4]
sub eax, dword [0x82e9d4]
add dword [0x82e9d8], eax
jmp 0x84f218
cmp byte [esi], 0x3f
jne 0x84f1e8
mov eax, dword [0x82e9d4]
add dword [0x82e9d8], eax
jmp 0x84f217
cmp byte [esi], 0x30
jae 0x84f1f6
jmp 0x84f217
cmp byte [esi], 0x39
jbe 0x84f204
jmp 0x84f217
mov eax, dword [0x82e9d4]
add dword [0x82e9d8], eax
cmp byte [esi], 0x1f
jbe 0x84f217
inc esi
jmp 0x84f20f
inc esi
jmp 0x84f0a8
cmp dword [0x82e9dc], 0
jne 0x84f228
jmp 0x84f283
inc esi
cmp byte [esi], 2
ja 0x84f0a8
mov byte [edi], 0xd
mov byte [edi + 1], 0xa
add edi, 2
mov esi, dword [0x82e9dc]
cmp byte [esi], 0xe
je 0x84f251
cmp byte [esi], 0
jne 0x84f24e
jmp 0x84f283
movsb byte es:[edi], byte [esi]
jmp 0x84f242
mov dword [edi], 0x455a4953
mov byte [edi + 4], 0x20
add edi, 5
mov eax, dword [0x82e9d8]
call fcn.008b01e2
mov byte [edi], 0x5d
mov byte [edi + 1], 0
push dword [0x82e9cc]
push 0xb
push dword [0x82e9d0]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
call fcn.00850075
mov byte [0x84784c], 0
ret
Function at 0x850221
Capabilities:
Get file size

Disassembly:
cmp dword [0x4319b0], 0
jbe 0x850238
push esi
push dword [0x4319b0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x85026f
mov eax, dword [str.Unable_to_open:_System_mangling_destination_file]
call fcn.0084a000
mov eax, 0xffffffff
ret
mov dword [0x4319b0], eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x4319b4], eax
ret

Function at 0x8502a7
Capabilities:
Read file on windows

Disassembly:
call fcn.00850221
cmp eax, 0xffffffff
jne 0x8502b2
ret
add eax, 0xf4240
push eax
mov ebx, 0x5097c8
mov edx, eax
call fcn.0084b515
push dword [0x5097c8]
pop dword [0x5097d4]
pop eax
add eax, dword [0x5097c8]
add eax, 0xfff
and eax, 0xfffff000
sub eax, 0x20
mov dword [0x509f28], eax
mov edi, dword [0x5097d4]
mov ax, 0xa0d
mov ecx, 5
rep stosw word es:[edi], ax
mov eax, edi
mov dword [0x5097d4], eax
mov dword [0x4319c0], 0
push 0
push 0x4319c0
push dword [0x4319b4]
push eax
push dword [0x4319b0]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [0x4319b0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4319b0], 0
mov edi, dword [0x5097d4]
add edi, dword [0x4319b4]
mov eax, 0xa0d0a0d
mov ecx, 0x64
rep stosd dword es:[edi], eax
mov edi, dword [0x5097d4]
mov ecx, 5
sub edi, 0xa
rep stosw word es:[edi], ax
mov eax, dword [0x5097d4]
add eax, dword [0x4319b4]
mov dword [0x4660a0], eax
ret

Function at 0x8504b8
Capabilities:
Get file size
Read file on windows

Disassembly:
call fcn.00850283
push 0x431c74
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
cmp dword [0x508fa8], 0
jne 0x8504d2
ret
call fcn.008802ec
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push 0x508fa8
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x850506
mov eax, dword [str.Unable_to_open:_System_mangling_destination_file]
call fcn.0084a000
ret
mov dword [0x4319b0], eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x5099ac], eax
push dword [0x5099ac]
call fcn.00878279
cmp eax, 7
jne 0x850540
push dword [0x4319b0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4319b0], 0
ret
mov edi, dword [0x466094]
cmp byte [edi - 1], 0xa
je 0x850555
inc edi
inc dword [0x466094]
jmp 0x850546
mov esi, dword [0x4660a0]
add esi, 0x190
mov edi, esi
add edi, dword [0x5099ac]
add edi, 2
mov ecx, dword [0x4660a0]
add ecx, 0x190
sub ecx, dword [0x466094]
inc ecx
std
rep movsb byte es:[edi], byte [esi]
cld
push dword [0x466094]
pop dword [0x818b5c]
mov dword [0x4319c0], 0
push 0
push 0x4319c0
push dword [0x5099ac]
push dword [0x818b5c]
push dword [0x4319b0]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [0x4319b0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4319b0], 0
mov edi, dword [0x466094]
add edi, dword [0x5099ac]
mov word [edi], 0xa0d
mov dword [0x818b60], edi
dec dword [0x818b60]
mov eax, dword [0x5099ac]
add eax, 2
add dword [0x4319b4], eax
add dword [0x4660a0], eax
mov byte [0x818bd8], 1
mov esi, dword [0x818b5c]
mov ecx, dword [0x818b60]
sub ecx, esi
call fcn.00878113
ret
Function at 0x85061a
Capabilities:
Read file on windows

Disassembly:
mov byte [0x5099a8], 1
cmp dword [0x8177f8], 0
jne 0x85063d
call fcn.00850406
call fcn.008511f1
jmp 0x850717
mov byte [0x5099b0], 1
push 0
push 0x852119
push 0
push 0x6591
push dword [0x8187e0]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov byte [0x5099b0], 0
cmp byte [0x50a5a4], 0xff
jne 0x850688
call fcn.00874d3d
mov dword [0x8177f8], 0
jmp 0x85062e
cmp byte [0x50a5a4], 1
jne 0x850717
call fcn.00850283
push 0x431c74
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
cmp dword [0x508fa8], 0
je 0x850717
mov esi, 0x508fa8
call fcn.00850221
cmp eax, 0xffffffff
jne 0x8506be
ret
mov eax, dword [0x5097d4]
add eax, dword [0x4319b4]
mov dword [0x4660a0], eax
mov dword [0x4319c0], 0
push 0
push 0x4319c0
push dword [0x4319b4]
push dword [0x5097d4]
push dword [0x4319b0]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [0x4319b0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4319b0], 0
call fcn.00878146
call fcn.00878662
ret

Function at 0x85083f
Capabilities:
Copy file

Disassembly:
or dword [0x431cf4], 2
mov dword [str.Choose_main_RosAsm_PE_file...], 0x431d48
push 0x431cc0
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
mov dword [str.Choose_main_RosAsm_PE_file...], 0
cmp eax, 0
jne 0x85086b
ret
xor dword [0x431cf4], 2
jmp 0x850898
call fcn.00850d38
cmp eax, 0
jne 0x8508a7
jmp fcn.00850718
push eax
call fcn.008501df
push 0x4a7b68
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop eax
xor dword [0x431cf4], 2
mov eax, 1
ret

Function at 0x850874
Capabilities:
Copy file

Disassembly:
mov edi, 0x508fa8
mov eax, 0
mov ecx, 0x41
rep stosd dword es:[edi], eax
mov edi, 0x508fa8
mov esi, str.NoName.exe
cmp byte [esi], 0
jbe 0x850897
movsb byte es:[edi], byte [esi]
jmp 0x85088f
movsb byte es:[edi], byte [esi]

Function at 0x850b81
Capabilities:
Get file size
Read file on windows

Disassembly:
call fcn.0084a2b1
mov esi, 0x4a7614
mov edi, 0x5099bc
cmp byte [esi], 0
je 0x850b98
movsb byte es:[edi], byte [esi]
jmp 0x850b90
mov dword [edi], 0x65736142
mov dword [edi + 4], 0x5c73
add edi, 6
mov dword [0x431d74], edi
mov esi, str.BasesList.txt
cmp byte [esi], 0
je 0x850bbb
movsb byte es:[edi], byte [esi]
jmp 0x850bb3
mov byte [edi], 0
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push 0x5099bc
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x850bef
mov eax, 0xffffffff
ret
mov dword [0x509dcc], eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x509dd0], 0x4a7b68
add dword [0x509dd0], eax
push 0
push 0x4319c0
push eax
push 0x4a7b68
push dword [0x509dcc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [0x509dcc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x4a7b68
cmp esi, dword [0x509dd0]
jae 0x850c73
cmp byte [esi], 0x20
je 0x850c4b
inc esi
jmp 0x850c43
mov edi, 0x4a7a28
cmp byte [esi], 0xd
je 0x850c58
movsb byte es:[edi], byte [esi]
jmp 0x850c50
mov byte [edi], 0
add esi, 2
push 0x4a7a28
push dword [0x5099b8]
call fcn.00850b63
jmp 0x850c37
ret
Function at 0x8511f1
Capabilities:
Get file size
Read file on windows

Disassembly:
mov dword [0x468ec4], 0
mov edi, 0x508fa8
mov al, 0
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
cmp byte [edi], 0x2e
je 0x851211
dec edi
jmp 0x851209
push dword [edi]
push edi
mov dword [edi], 0x4d4b422e
push 0x509de8
push 0x508fa8
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x851259
cmp dword [0x81b500], 0
je 0x851250
mov eax, dword [0x81b500]
call fcn.0084b661
mov dword [0x81b500], 0
pop edi
pop dword [edi]
ret
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push 0x508fa8
call dword [sym.imp.KERNEL32.dll_CreateFileA]
pop edi
pop dword [edi]
cmp eax, 0xffffffff
jne 0x85129a
mov eax, dword [str.Unable_to_open:_System_mangling_destination_file]
call fcn.0084a000
pop eax
ret
mov dword [0x509de0], eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x509de4], eax
cmp dword [0x81b500], 0
je 0x8512ca
mov eax, dword [0x81b500]
call fcn.0084b661
mov dword [0x81b500], 0
mov ebx, 0x81b500
mov edx, 0x1000
call fcn.0084b515
push 0
push 0x4319c0
push dword [0x509de4]
push dword [0x81b500]
push dword [0x509de0]
call dword [sym.imp.KERNEL32.dll_ReadFile]
call fcn.00879f64
call fcn.0087a381
push dword [0x509de0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret

Function at 0x85130f
Capabilities:
Read file on windows
Set current directory

Disassembly:
push dword [0x5098a0]
pop dword [0x509f2c]
mov byte [0x5098a0], 0
call fcn.00850283
call fcn.00850295
push edi
mov edi, 0x431cc0
mov eax, 0x4c
stosd dword es:[edi], eax
mov eax, dword [0x8187e4]
stosd dword es:[edi], eax
mov eax, 0
stosd dword es:[edi], eax
mov eax, str.Files__.exe__.dll__.wll__.ocx__.drv__.bpl__.cpl__.fon__.mpd__.vbx__.vxd__.sys__.scr_
stosd dword es:[edi], eax
mov eax, 0x508b98
stosd dword es:[edi], eax
mov eax, 0x104
stosd dword es:[edi], eax
mov eax, 1
stosd dword es:[edi], eax
mov eax, 0x508fa8
stosd dword es:[edi], eax
mov eax, 0x104
stosd dword es:[edi], eax
mov eax, 0x5093b8
stosd dword es:[edi], eax
mov eax, 0x104
stosd dword es:[edi], eax
mov eax, 0
stosd dword es:[edi], eax
mov eax, str.Choose_main_RosAsm_PE_file...
stosd dword es:[edi], eax
mov eax, 0x281804
stosd dword es:[edi], eax
mov eax, 0
stosd dword es:[edi], eax
mov eax, 0
stosd dword es:[edi], eax
mov eax, 0
stosd dword es:[edi], eax
mov eax, 0
stosd dword es:[edi], eax
mov eax, 0
stosd dword es:[edi], eax
pop edi
push 0x431cc0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
cmp dword [0x508fa8], 0
jne fcn.008513c6
push dword [0x509f2c]
pop dword [0x5098a0]
ret

Function at 0x8513c6
Capabilities:
Read file on windows
Set current directory

Disassembly:
call fcn.008501b7
push 0x508fa8
pop esi
call fcn.008526f5
call fcn.008802ec
call fcn.0088b6b2
cmp dword [0x5097c8], 0
je fcn.008513fd
mov eax, dword [0x5097c8]
call fcn.0084b661
mov dword [0x5097c8], 0
Function at 0x857653
Capabilities:
Parse credit card information

Disassembly:
mov ebx, 0
mov edx, 0
mov ecx, 0
lodsb al, byte [esi]
cmp al, 0x13
jbe 0x857650
sub al, 0x30
shld edx, ebx, 1
shl ebx, 1
or bl, al
cmp edx, ecx
jb 0x857645
mov ecx, edx
cmp al, 2
jb 0x85762c
mov ecx, dword [str.Invalid_binary_number]
jmp 0x8576b9
mov eax, ebx
ret
lodsb al, byte [esi]
mov ebx, 0
mov edx, 0
mov ecx, 0
lodsb al, byte [esi]
cmp al, 0x1f
jbe 0x85768e
sub al, 0x30
cmp al, 9
jbe 0x857670
sub al, 7
shld edx, ebx, 4
shl ebx, 4
or bl, al
cmp edx, ecx
jb 0x857683
mov ecx, edx
cmp al, 0xf
jbe 0x857663
mov ecx, dword [str.Invalid_Hexa_number]
jmp 0x8576b9
mov eax, ebx
ret
dec esi
lodsb al, byte [esi]
cmp al, 0x58
jne 0x8576c0
lodsb al, byte [esi]
cmp al, 0x48
jne 0x8576d2
cmp byte [esi], 0x1f
ja 0x8576f6
jmp 0x857774
cmp al, 0x44
jne 0x8576e4
cmp byte [esi], 0x1f
ja 0x8576f6
jmp 0x857774
cmp al, 0x42
jne 0x8576f6
cmp byte [esi], 0x1f
ja 0x8576f6
jmp 0x857774
cmp byte [esi], 0x1f
jbe 0x8576fe
inc esi
jmp 0x8576f6
dec esi
lodsb al, byte [esi]
cmp al, 0x48
jne 0x85772f
cmp ecx, str.Invalid_Hexa_number
jne 0x857719
pushal
popal
mov eax, ecx
jmp fcn.0086e2d2
cmp ecx, str.Invalid_decimal_number
jne 0x85772a
pushal
popal
mov eax, ecx
jmp fcn.0086e2d2
jmp 0x857774
cmp al, 0x44
jne 0x85774d
cmp ecx, str.Invalid_decimal_number
jne 0x857748
pushal
popal
mov eax, ecx
jmp fcn.0086e2d2
jmp 0x857774
cmp al, 0x42
jne 0x85776b
cmp ecx, str.Invalid_binary_number
jne 0x857766
pushal
popal
mov eax, ecx
jmp fcn.0086e2d2
jmp 0x857774
pushal
popal
mov eax, ecx
jmp fcn.0086e2d2
dec esi
push edi
mov edi, esi
dec esi
cmp byte [esi], 0x58
jne 0x85777f
dec esi
std
cmp byte [esi], 0x1f
jbe 0x857788
movsb byte es:[edi], byte [esi]
jmp 0x857780
cld
cmp byte [edi], 0x1f
jbe 0x857794
mov byte [edi], 0x30
dec edi
jmp 0x857789
pop edi
inc esi
cmp byte [esi], 0x30
jne 0x85779e
inc esi
jmp 0x857796
cmp byte [esi], 0x3c
jne 0x8577a4
inc esi
cmp al, 0x48
jne 0x8577af
jmp 0x857654
cmp al, 0x44
jne 0x8577ba
jmp fcn.00857691
jmp 0x85761d
Function at 0x8580b1
Capabilities:
Parse credit card information

Disassembly:
cmp byte [esi + 1], 0xf
jne 0x8580be
lodsb al, byte [esi]
mov byte [0x444380], al
lodsb al, byte [esi]
lodsb al, byte [esi]
cmp al, 4
ja 0x8580c4
lodsb al, byte [esi]
cmp al, 0x3f
je 0x8580d4
pushal
popal
mov eax, dword [str.Bad_Virtual_Data]
jmp fcn.0086e2d2
cmp byte [0x444380], 0x44
jne 0x8580eb
mov eax, 4
jmp 0x8581af
cmp byte [0x444380], 0x42
jne 0x858102
mov eax, 1
jmp 0x8581af
cmp byte [0x444380], 0x57
jne 0x858119
mov eax, 2
jmp 0x8581af
cmp byte [0x444380], 0x55
jne 0x858130
mov eax, 2
jmp 0x8581af
cmp byte [0x444380], 0x51
jne 0x858147
mov eax, 8
jmp 0x8581af
cmp byte [0x444380], 0x52
jne 0x85815e
mov eax, 4
jmp 0x8581af
cmp byte [0x444380], 0x48
jne 0x858175
mov eax, 8
jmp 0x8581af
cmp byte [0x444380], 0x46
jne 0x85818c
mov eax, 4
jmp 0x8581af
cmp byte [0x444380], 0x54
jne 0x8581a3
mov eax, 0xa
jmp 0x8581af
pushal
popal
mov eax, dword [str.Unknown_Size_marker]
jmp fcn.0086e2d2
add dword [0x50e2f8], eax
add dword [0x509878], eax
cmp byte [esi], 4
jae 0x8581c1
inc esi
ret
Function at 0x8590a3
Capabilities:
Parse credit card information

Disassembly:
mov esi, dword [0x444398]
lodsb al, byte [esi]
cmp al, 3
jne 0x8590a9
cmp byte [esi + 1], 0xf
jne 0x85923c
mov al, byte [esi]
mov byte [0x4443cf], al
mov word [esi], 0
add esi, 2
cmp byte [esi], 0xf
jne 0x8590cd
inc esi
mov byte [0x4443d4], 6
cmp byte [esi], 2
jne 0x8590e5
pushal
popal
mov eax, dword [str.Unvalid_parameter]
jmp fcn.0086e2d2
cmp al, 0x44
jne 0x8590f9
mov byte [0x4443e1], 1
jmp 0x8591c2
cmp al, 0x42
jne 0x85910d
mov byte [0x4443e1], 0
jmp 0x8591c2
cmp al, 0x57
jne 0x859121
mov byte [0x4443e1], 3
jmp 0x8591c2
cmp al, 0x51
jne 0x859135
mov byte [0x4443e1], 4
jmp 0x8591c2
cmp al, 0x52
jne 0x859149
mov byte [0x4443e1], 4
jmp 0x8591c2
cmp al, 0x46
jne 0x85916a
cmp byte [esi], 0x41
jae 0x85915e
call fcn.0085905e
ret
mov byte [0x4443e1], 1
jmp 0x8591c2
cmp al, 0x54
jne 0x85917e
mov byte [0x4443e1], 8
jmp 0x8591c2
cmp al, 0x58
jne 0x859192
mov byte [0x4443e1], 0xff
jmp 0x8591c2
cmp al, 0x4f
jne 0x8591a6
mov byte [0x4443e1], 0x10
jmp 0x8591c2
cmp al, 0x48
jne 0x8591b6
pushal
popal
mov eax, dword [str._H___now_reserved_for_futher_developement._Use__R___or__F___instead]
jmp fcn.0086e2d2
pushal
popal
mov eax, dword [str.Unknown_Size_marker]
jmp fcn.0086e2d2
call fcn.008589a2
call fcn.00858ca4
call fcn.00858dec
cmp byte [0x4443ca], 1
jne 0x85921a
cmp byte [0x4443c9], 0
jne 0x85921a
cmp byte [0x4443a4], 1
jne 0x85921a
cmp byte [0x4443ec], 1
jne 0x85921a
mov al, byte [0x4443c6]
and al, 7
cmp al, 5
jne 0x85921a
mov byte [0x4443c9], 1
mov byte [0x4443a8], 1
call fcn.00858f3d
or byte [0x4443cd], 1
cmp byte [0x4443cd], 2
jbe 0x85923b
pushal
popal
mov eax, dword [str.More_than_2_labels_is_this_expression]
jmp fcn.0086e2d2
ret
call fcn.00858565
cmp ah, 0
je 0x859263
mov byte [0x4443d4], 1
mov byte [0x4443d1], al
mov byte [0x4443d7], ah
mov al, byte [0x4443e0]
mov byte [0x4443e1], al
ret
call fcn.00858b48
cmp byte [0x4443c8], 0
je 0x859280
mov byte [0x4443d4], 5
mov byte [0x4443f0], 1
ret
cmp byte [0x50e308], 1
jne 0x8592b4
mov byte [0x4443c9], 1
mov byte [0x50e308], 0
mov byte [0x4443d4], 6
mov byte [0x4443e4], 0
mov byte [0x4443da], 5
mov byte [0x4443e1], 1
ret
call fcn.00858dec
cmp byte [0x4443cc], 0
jne 0x8592ce
pushal
popal
mov eax, dword [str.unable_to_resolve_this_parameter]
jmp fcn.0086e2d2
mov byte [0x4443d4], 7
or byte [0x4443cd], 1
cmp byte [0x4443cd], 2
jbe 0x8592f1
pushal
popal
mov eax, dword [str.More_than_2_labels_is_this_expression]
jmp fcn.0086e2d2
ret