Function at 0x100bb860
Capabilities:
Enumerate pe sections
Validate payment card number using luhn algorithm

Disassembly:
mov eax, dword [esp + 0x18]
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x14]
mov dword [eax], 0
mov al, byte [ebx]
push esi
mov esi, dword [esp + 0x10]
push edi
cmp al, 0xa
je 0x100bbdb5
cmp al, 0xd
je 0x100bbdb5
mov ecx, dword [esi + 0xc4]
lea edx, [esi + 0xc4]
mov edi, 4
lea eax, [ecx + 1]
mov dword [edx], eax
test ecx, ecx
jne 0x100bbce3
mov dword [esi + 0xd0], ecx
mov eax, dword [esi + 0x18]
mov eax, dword [eax + 0x260]
mov eax, dword [eax + 0x48]
test al, 3
je 0x100bba71
mov al, byte [ebx]
mov edi, ebx
test al, al
je 0x100bb8e1
nop dword [eax]
cmp al, 0x20
je 0x100bb8d9
cmp byte [edi], 9
jne 0x100bb8e1
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100bb8d0
push 5
push str.HTTP_
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x100bb9a2
movsx ecx, byte [edi + 5]
mov eax, ecx
sub eax, 0x31
je 0x100bb9cf
sub eax, 1
je 0x100bb92b
sub eax, 1
je 0x100bb92b
push str.Unsupported_HTTP_version_in_response
push esi
call fcn.100acfd0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret
mov al, byte [edi + 6]
cmp al, 0x20
je 0x100bb936
cmp al, 9
jne 0x100bb9a2
lea eax, [ecx - 0x30]
lea eax, [eax + eax*4]
add eax, eax
mov dword [esi + 0xd0], eax
mov cl, byte [edi + 7]
lea eax, [ecx - 0x30]
cmp al, 9
ja 0x100bb9a2
mov dl, byte [edi + 8]
lea eax, [edx - 0x30]
cmp al, 9
ja 0x100bb9a2
mov dh, byte [edi + 9]
mov al, dh
sub al, 0x30
cmp al, 9
ja 0x100bb9a2
movsx eax, cl
lea ecx, [eax + eax*4]
movsx eax, dl
lea eax, [eax + ecx*2]
lea ecx, [eax + eax*4]
movsx eax, dh
lea eax, [eax + ecx*2]
add eax, 0xffffeb30
mov dword [esi + 0xd4], eax
mov al, byte [edi + 0xa]
cmp al, 0x20
je 0x100bbb4b
cmp al, 9
je 0x100bbb4b
cmp al, 0xa
jl 0x100bb9a2
cmp al, 0xd
jle 0x100bbb4b
push ebp
push ebx
push esi
call fcn.100bace0
add esp, 0xc
cmp eax, 1
jne 0x100bbd0c
mov dword [esi + 0xd4], 0xc8
mov dword [esi + 0xd0], 0xa
jmp 0x100bbb4b
cmp byte [edi + 6], 0x2e
jne 0x100bba59
mov al, byte [edi + 7]
cmp al, 0x30
je 0x100bb9e4
cmp al, 0x31
jne 0x100bba59
mov cl, byte [edi + 8]
cmp cl, 0x20
je 0x100bb9f1
cmp cl, 9
jne 0x100bba59
movsx eax, al
sub eax, 0x26
mov dword [esi + 0xd0], eax
mov cl, byte [edi + 9]
lea eax, [ecx - 0x30]
cmp al, 9
ja 0x100bba59
mov dl, byte [edi + 0xa]
lea eax, [edx - 0x30]
cmp al, 9
ja 0x100bba59
mov dh, byte [edi + 0xb]
mov al, dh
sub al, 0x30
cmp al, 9
ja 0x100bba59
movsx eax, cl
lea ecx, [eax + eax*4]
movsx eax, dl
lea eax, [eax + ecx*2]
lea ecx, [eax + eax*4]
movsx eax, dh
lea eax, [eax + ecx*2]
add eax, 0xffffeb30
mov dword [esi + 0xd4], eax
mov al, byte [edi + 0xc]
cmp al, 0x20
je 0x100bbb4b
cmp al, 9
je 0x100bbb4b
sub al, 0xa
cmp al, 3
jbe 0x100bbb4b
push str.Unsupported_HTTP_1_subversion_in_response
push esi
call fcn.100acfd0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret
test eax, 0x40000
je 0x100bbd0c
mov al, byte [ebx]
mov edi, ebx
test al, al
je 0x100bba95
cmp al, 0x20
je 0x100bba8d
cmp byte [edi], 9
jne 0x100bba95
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100bba84
push 5
push str.RTSP_
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x100bbd0c
mov al, byte [edi + 5]
sub al, 0x30
cmp al, 9
ja 0x100bbd13
cmp byte [edi + 6], 0x2e
jne 0x100bbd13
mov al, byte [edi + 7]
sub al, 0x30
cmp al, 9
ja 0x100bbd13
mov al, byte [edi + 8]
cmp al, 0x20
je 0x100bbae1
cmp al, 9
jne 0x100bbd13
mov cl, byte [edi + 9]
lea eax, [ecx - 0x30]
cmp al, 9
ja 0x100bbd13
mov dl, byte [edi + 0xa]
lea eax, [edx - 0x30]
cmp al, 9
ja 0x100bbd13
mov dh, byte [edi + 0xb]
mov al, dh
sub al, 0x30
cmp al, 9
ja 0x100bbd13
movsx eax, cl
lea ecx, [eax + eax*4]
movsx eax, dl
lea eax, [eax + ecx*2]
lea ecx, [eax + eax*4]
movsx eax, dh
lea eax, [eax + ecx*2]
add eax, 0xffffeb30
mov dword [esi + 0xd4], eax
mov al, byte [edi + 0xc]
cmp al, 0x20
je 0x100bbb41
cmp al, 9
je 0x100bbb41
sub al, 0xa
cmp al, 3
ja 0x100bbd13
mov dword [esi + 0xd0], 0xb
mov ecx, dword [esi + 0xd0]
mov eax, ecx
mov edi, dword [esi + 0x18]
sub eax, 0xa
je 0x100bbb75
sub eax, 1
je 0x100bbb75
mov eax, ecx
mov ecx, 0xa
cdq
idiv ecx
mov ecx, edx
mov edx, eax
mov eax, str.Unsupported_HTTP_version___u._d__in_response
jmp 0x100bbbb2
mov al, byte [edi + 0x4d4]
test al, al
je 0x100bbbc8
movzx ecx, al
mov eax, 0xcccccccd
mul ecx
mov eax, 0x66666667
shr edx, 3
mov dword [esp + 0x28], edx
imul dword [esi + 0xd0]
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [esp + 0x28]
cmp ecx, edx
je 0x100bbbc8
mov eax, str.Version_mismatch__from_HTTP__u_to_HTTP__u_
push ecx
push edx
push eax
push esi
call fcn.100acfd0
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esi + 0xd4]
mov dword [esi + 0xd08], eax
mov eax, dword [esi + 0xd0]
mov dword [esi + 0xd10], eax
movzx eax, byte [esi + 0xd0]
mov byte [edi + 0x4d4], al
mov al, byte [esi + 0xce5]
test al, al
je 0x100bbc02
movzx eax, al
cmp eax, dword [esi + 0xd0]
jle 0x100bbc0e
mov al, byte [esi + 0xd0]
mov byte [esi + 0xce5], al
mov eax, dword [esi + 0xbc8]
or eax, dword [esi + 0xbcc]
je 0x100bbc38
cmp byte [esi + 0xce6], 0
jne 0x100bbc38
cmp dword [esi + 0xd4], 0x1a0
jne 0x100bbc38
mov byte [esi + 0x136], 1
mov eax, dword [esi + 0xd0]
cmp eax, 0xa
jne 0x100bbc5b
push str.HTTP_1.0__assume_close_after_body
push esi
call fcn.100ad0a0
push 1
push edi
call fcn.100af360
add esp, 0x10
jmp 0x100bbc7e
cmp eax, 0x14
je 0x100bbc72
cmp dword [esi + 0xdc], 2
jne 0x100bbc7e
cmp dword [esi + 0xd4], 0x65
jne 0x100bbc7e
mov eax, dword [edi + 0x4a8]
mov dword [eax], 2
mov ecx, dword [esi + 0xd4]
lea eax, [ecx - 0x64]
cmp eax, 0x63
setbe al
mov byte [esi + 0x137], al
sub ecx, 0xcc
je 0x100bbcaf
sub ecx, 0x64
jne 0x100bbcde
cmp byte [esi + 0x3b0], cl
je 0x100bbcaf
mov byte [esi + 0xdc8], 1
mov dword [esi + 0x88], 0
mov dword [esi + 0x8c], 0
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], 0
mov byte [esi + 0x137], 1
mov edi, 0xc
push ebp
push 0
push ebx
call sub.VCRUNTIME140.dll_memchr
add esp, 0xc
test eax, eax
je 0x100bbd1d
mov eax, str.Nul_byte_in_header
push eax
push esi
call fcn.100acfd0
add esp, 8
mov eax, 8
pop edi
pop esi
pop ebp
pop ebx
ret
mov byte [esi + 0x12d], 0
pop edi
pop esi
pop ebp
mov eax, 8
pop ebx
ret
mov ecx, dword [esi + 0xc4]
cmp ecx, 2
jl 0x100bbd60
mov al, byte [ebx]
cmp al, 0x20
je 0x100bbd32
cmp al, 9
jne 0x100bbd37
cmp ecx, 2
jg 0x100bbd60
push ebp
push 0x3a
push ebx
call sub.VCRUNTIME140.dll_memchr
add esp, 0xc
test eax, eax
jne 0x100bbd60
mov eax, str.Header_without_colon
push eax
push esi
call fcn.100acfd0
add esp, 8
mov eax, 8
pop edi
pop esi
pop ebp
pop ebx
ret
push ebp
push ebx
push esi
call fcn.100b9430
add esp, 0xc
test eax, eax
jne 0x100bbe94
push ebp
push ebx
push 1
push esi
call fcn.100acf20
mov eax, dword [esi + 0xd4]
add esp, 0x10
sub eax, 0x64
cmp eax, 0x64
jae 0x100bbd91
or edi, 0x20
push ebp
push ebx
push edi
push esi
call fcn.100ae170
add esp, 0x10
test eax, eax
jne 0x100bbe94
push eax
push ebp
push esi
call fcn.100b8a70
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
ret
push ebp
push ebx
push 1
push esi
call fcn.100acf20
mov eax, dword [esi + 0xd4]
sub eax, 0x64
cmp eax, 0x64
push ebp
sbb eax, eax
and eax, 0x20
add eax, 4
push ebx
push eax
push esi
call fcn.100ae170
add esp, 0x20
test eax, eax
jne 0x100bbe94
mov ecx, dword [esi + 0xbc]
mov edx, 0x4b000
add ecx, ebp
cmp ebp, edx
jae 0x100bbe26
mov eax, dword [esi + 0xd48]
add dword [esi + 0xb8], ebp
add eax, ebp
mov dword [esi + 0xd48], eax
mov dword [esi + 0xbc], ecx
cmp ecx, edx
ja 0x100bbe2a
cmp eax, 0x5dc000
jbe 0x100bbe44
mov ecx, eax
mov edx, 0x5dc000
jmp 0x100bbe2a
test ecx, ecx
je 0x100bbe44
push edx
push ecx
push str.Too_large_response_headers:__zu____u
push esi
call fcn.100acfd0
add esp, 0x10
mov eax, 0x38
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esi + 0xd4]
sub eax, 0x64
cmp eax, 0x63
ja 0x100bbe5a
mov eax, dword [esi + 0xb8]
jmp 0x100bbe5c
xor eax, eax
mov dword [esi + 0xc0], eax
lea eax, [esi + 0x870]
push eax
call fcn.100a0d70
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push esi
call fcn.100bae30
add esp, 0x14
test eax, eax
jne 0x100bbe94
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
add dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret