Function at 0x1400038e0
Capabilities:
Parse credit card information
Parse pe header

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov ecx, 0x65
xor r12d, r12d
mov r14, r8
or r8, 0xffffffffffffffff
mov r15d, edx
mov qword [rsp + 0x50], rcx
mov eax, 2
mov r13, r9
mov ebp, r12d
mov word [rsp + 0x38], r8w
mov qword [rsp + 0x48], r12
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.140016ed8
lea ecx, [r12 + 4]
mov word [rax], r12w
mov qword [rsp + 0x40], rax
call fcn.140016ed8
test rax, rax
je 0x140033d50
mov rsi, rax
mov dword [rax], 1
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rdi
cmp qword [r13 + 0x10], rbp
jbe 0x1400039a0
mov rbx, r12
mov rax, qword [r13 + 8]
mov rdi, qword [rax + rbx*8]
test rdi, rdi
je 0x140003994
movzx eax, word [rdi + 8]
cmp ax, 0x3f
jle 0x140003a7b
mov rcx, rdi
call fcn.140016a60
inc rbx
cmp rbx, qword [r13 + 0x10]
jb 0x140003971
xor r12d, r12d
mov qword [r13 + 0x10], r12
cmp word [r14], bp
je 0x140003b50
lea rdi, sym.imp.gdi32.dll_SetDIBitsToDevice
mov esi, gethostbyname
nop word [rax + rax]
mov eax, ebp
movzx ecx, word [r14 + rax*2]
cmp cx, 0x20
je 0x140003ad2
cmp cx, 9
je 0x140003ad2
mov eax, ebp
movzx ebx, word [r14 + rax*2]
test bx, bx
je 0x140003b33
mov dword [rsp + 0xa0], ebp
mov word [rsp + 0x3a], bp
cmp bx, 0x30
jae 0x140003ad9
cmp bx, 0x2e
je 0x140003ae3
cmp bx, 0x41
jae 0x140003c62
cmp bx, 0x61
jae 0x140003f80
cmp bx, 0x5f
je 0x140003c6c
movzx eax, bx
cmp eax, 0x24
je 0x140003bb2
cmp eax, 0x3d
je 0x140003cb6
cmp eax, 0x28
je 0x140003d08
cmp eax, 0x29
je 0x140003ce5
cmp eax, 0x22
je case.0x140003a79.28
sub eax, 0x1a
cmp eax, 0x44
ja case.0x140003a79.40
cdqe
movzx eax, byte [rdi + rax + 0x407c]
mov ecx, dword [rdi + rax*4 + 0x4040]
add rcx, rdi
jmp rcx
cmp ax, 0x30
jl 0x14000398c
mov r12, qword [rdi]
test r12, r12
je 0x14000398c
mov rax, qword [r12 + 0x18]
dec dword [rax]
mov rax, qword [r12 + 0x18]
cmp dword [rax], ebp
je 0x140033d5d
mov rcx, r12
call fcn.140016a60
jmp 0x14000398c
lea rcx, [rsp + 0x30]
mov edx, 0x40
call fcn.1400041f0
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.1400040d0
inc ebp
jmp 0x140003b25
inc ebp
jmp 0x1400039c0
cmp bx, 0x39
ja 0x140003a01
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0xa0]
lea rcx, [0x1400c7ef0]
mov rdx, r14
mov qword [rsp + 0x20], rax
call fcn.140003380
cmp al, 1
jne 0x140033d76
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.1400040d0
mov ebp, dword [rsp + 0xa0]
mov eax, ebp
cmp word [r14 + rax*2], 0
jne 0x1400039c0
movzx r11d, word [rsp + 0x38]
cmp r11w, 0x30
jl 0x140003b4b
cmp r11w, 0x3f
jle 0x140003e57
mov rsi, qword [rsp + 0x58]
mov r11d, 0x7f
lea rdx, [rsp + 0x30]
mov rcx, r13
mov dword [rsp + 0x30], r12d
mov word [rsp + 0x3a], bp
mov word [rsp + 0x38], r11w
call fcn.1400040d0
add dword [rsi], 0xffffffff
jne 0x140003b8a
mov rcx, qword [rsp + 0x40]
call fcn.140016a60
mov rcx, rsi
call fcn.140016a60
xor eax, eax
mov rdi, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov rbp, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
lea rcx, [rsp + 0x40]
inc ebp
call fcn.140003300
movzx edx, word [r14 + rbp*2]
mov r11d, ebp
cmp dx, 0x5a
ja 0x140003bd2
cmp dx, 0x41
jae 0x140003bde
cmp dx, 0x61
jb 0x140003bf1
cmp dx, 0x7a
ja 0x140003bf1
lea rcx, [rsp + 0x40]
call fcn.1400037e0
inc ebp
mov dx, word [r14 + rbp*2]
jmp 0x140003bc6
cmp dx, 0x30
jae 0x140003e19
cmp dx, 0x5f
je 0x140003bde
cmp qword [rsp + 0x48], 0
je 0x140033f81
lea rcx, [rsp + 0x40]
call fcn.1400032e0
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.USER32.dll_CharUpperBuffW]
mov r11w, word [rsp + 0x38]
cmp r11w, 0x30
jge 0x140003e80
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
mov word [rsp + 0x38], si
mov qword [rsp + 0x30], r12
call fcn.140004290
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.1400040d0
jmp 0x140003b25
cmp bx, 0x5a
ja 0x140003a15
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0xa0]
lea rcx, [0x1400c7ef0]
mov rdx, r14
mov qword [rsp + 0x20], rax
call fcn.1400035c0
cmp dword [rsp + 0x30], 0xffffffff
je 0x140033f9f
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.1400040d0
mov ebp, dword [rsp + 0xa0]
jmp 0x140003b25
inc ebp
cmp word [r14 + rbp*2], 0x3d
je 0x140033f4d
lea rcx, [rsp + 0x30]
mov edx, 0x41
call fcn.1400041f0
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.1400040d0
jmp 0x140003b25
lea rcx, [rsp + 0x30]
mov edx, 0x48
call fcn.1400041f0
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.1400040d0
inc ebp
jmp 0x140003b25
lea rcx, [rsp + 0x30]
mov edx, 0x47
call fcn.1400041f0
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.1400040d0
inc ebp
jmp 0x140003b25
lea rax, [rsp + 0x40]
lea r9, [rsp + 0xa0]
lea rcx, [0x1400c7ef0]
mov r8, r14
mov edx, r15d
mov qword [rsp + 0x20], rax
call fcn.140003840
test eax, eax
jne 0x140034013
lea edx, [rax + 0x36]
lea rcx, [rsp + 0x30]
call fcn.1400041f0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.140004290
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.1400040d0
mov ebp, dword [rsp + 0xa0]
jmp 0x140003b25
lea rcx, [rsp + 0x30]
mov edx, reloc.OLEAUT32.dll_VarR8FromUI1
call fcn.1400041f0
inc ebp
cmp word [r14 + rbp*2], 0x3d
je 0x140003f8f
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.1400040d0
jmp 0x140003b25
lea rcx, [rsp + 0x30]
mov edx, VarR8FromUI1
call fcn.1400041f0
inc ebp
cmp word [r14 + rbp*2], 0x3d
je 0x140003fb2
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.1400040d0
jmp 0x140003b25
lea rcx, [rsp + 0x30]
mov edx, VarR8FromUI1
call fcn.1400041f0
inc ebp
cmp word [r14 + rbp*2], 0x3d
je 0x140033eca
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.1400040d0
jmp 0x140003b25
cmp dx, 0x39
jbe 0x140003bde
jmp 0x140003bfb
lea rcx, [rsp + 0x30]
mov edx, VarR8FromUI1
call fcn.1400041f0
inc ebp
cmp word [r14 + rbp*2], 0x3d
je 0x140033e90
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.1400040d0
jmp 0x140003b25
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x140003e71
mov rcx, rbx
call fcn.140002610
mov rcx, rbx
call fcn.140016a60
mov rsi, qword [rsp + 0x58]
mov qword [rsp + 0x30], r12
jmp 0x140003b50
cmp r11w, 0x3f
jg 0x140003c37
jmp 0x140033f63
lea rcx, [rsp + 0x30]
mov edx, 0x4e
call fcn.1400041f0
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.1400040d0
inc ebp
jmp 0x140003b25
lea rcx, [rsp + 0x30]
mov edx, 0x4f
call fcn.1400041f0
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.1400040d0
inc ebp
jmp 0x140003b25
lea rcx, [rsp + 0x40]
inc ebp
call fcn.140003300
movzx edx, word [r14 + rbp*2]
mov r11d, ebp
nop word [rax + rax]
cmp dx, 0x5a
ja 0x140003efc
cmp dx, 0x41
jae 0x140003f08
cmp dx, 0x61
jb 0x140003f1b
cmp dx, 0x7a
ja 0x140003f1b
lea rcx, [rsp + 0x40]
call fcn.1400037e0
inc ebp
mov dx, word [r14 + rbp*2]
jmp 0x140003ef0
cmp dx, 0x30
jae 0x140033e40
cmp dx, 0x5f
je 0x140003f08
cmp qword [rsp + 0x48], 0
je 0x140033f81
lea rcx, [rsp + 0x40]
call fcn.1400032e0
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.USER32.dll_CharUpperBuffW]
lea rcx, [rsp + 0x30]
mov edx, gethostbyname
call fcn.1400041f0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.140004290
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.1400040d0
jmp 0x140003b25
cmp bx, 0x7a
jbe 0x140003c6c
jmp 0x140003a1f
lea rcx, [rsp + 0x30]
mov edx, 0x56
inc ebp
call fcn.1400041f0
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.1400040d0
jmp 0x140003b25
lea rcx, [rsp + 0x30]
mov edx, 0x52
inc ebp
call fcn.1400041f0
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.1400040d0
jmp 0x140003b25
inc ebp
movzx ecx, word [r14 + rbp*2]
sub ecx, 0x3d
je 0x140033ef7
cmp ecx, 1
je 0x140033ee1
lea rcx, [rsp + 0x30]
mov edx, 0x43
call fcn.1400041f0
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.1400040d0
jmp 0x140003b25
inc ebp
cmp word [r14 + rbp*2], 0x3d
je 0x140033f0d
lea rcx, [rsp + 0x30]
mov edx, 0x42
call fcn.1400041f0
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.1400040d0
jmp 0x140003b25
mov rsi, r12
mov qword [rsp + 0x58], r12
jmp 0x140003958
mov rcx, qword [r12]
call fcn.140016a60
mov rcx, qword [r12 + 0x18]
call fcn.140016a60
nop
jmp 0x140003aa5
cmp bx, 0x2e
jne 0x140033e34
mov ebp, dword [rsp + 0xa0]
lea rcx, [rsp + 0x40]
inc ebp
call fcn.140003300
movzx edx, word [r14 + rbp*2]
mov r11d, ebp
cmp dx, 0x41
jb 0x140033daf
cmp dx, 0x5a
jbe 0x140033e1e
cmp dx, 0x61
jb 0x140033dc3
cmp dx, 0x7a
jbe 0x140033e1e
cmp dx, 0x30
jb 0x140033dd7
cmp dx, 0x39
jbe 0x140033e1e
cmp dx, 0x5f
je 0x140033e1e
cmp qword [rsp + 0x48], 0
je 0x140033f81
lea rcx, [rsp + 0x30]
mov edx, gethostname
call fcn.1400041f0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.140004290
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.1400040d0
nop
jmp 0x140003b25
lea rcx, [rsp + 0x40]
call fcn.1400037e0
inc ebp
mov dx, word [r14 + rbp*2]
jmp 0x140033d9b
mov ebp, dword [rsp + 0xa0]
jmp 0x140003a0b
cmp dx, 0x39
jbe 0x140003f08
jmp 0x140003f25
lea rcx, [rsp + 0x30]
mov edx, VarR8FromUI1
call fcn.1400041f0
inc ebp
cmp word [r14 + rbp*2], 0x3d
jne 0x140033e7d
lea rcx, [rsp + 0x30]
mov edx, 0x53
inc ebp
call fcn.1400041f0
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.1400040d0
nop
jmp 0x140003b25
lea rcx, [rsp + 0x30]
mov edx, 0x54
inc ebp
call fcn.1400041f0
nop
jmp 0x140003e45
lea rcx, [rsp + 0x30]
mov edx, 0x51
call fcn.1400041f0
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.1400040d0
inc ebp
jmp 0x140003b25
lea rcx, [rsp + 0x30]
mov edx, 0x55
inc ebp
call fcn.1400041f0
nop
jmp 0x140003e07
lea rcx, [rsp + 0x30]
mov edx, 0x44
call fcn.1400041f0
inc ebp
jmp 0x140003ffd
lea rcx, [rsp + 0x30]
mov edx, 0x46
call fcn.1400041f0
inc ebp
jmp 0x140003ffd
lea rcx, [rsp + 0x30]
mov edx, 0x45
call fcn.1400041f0
inc ebp
jmp 0x14000402c
test ebp, ebp
jne case.0x140003a79.40
cmp word [r14 + 2], bp
jne case.0x140003a79.40
cmp r15d, dword [0x1400c7f10]
jl case.0x140003a79.40
mov ebp, 1
jmp 0x140003b25
lea rcx, [rsp + 0x30]
mov edx, 0x50
call fcn.1400041f0
inc ebp
jmp 0x140003cd3
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140003c37
mov edx, 1
call fcn.1400535c0
nop
jmp 0x140003c37
lea r9d, [rbp - 1]
lea rcx, [0x1400c7ef0]
mov r8d, 0x138b
mov edx, r15d
call fcn.140071bb0
jmp 0x140033ff5
mov r9d, dword [rsp + 0xa0]
lea rcx, [0x1400c7ef0]
mov r8d, 0x138c
mov edx, r15d
call fcn.140071bb0
jmp 0x140033ff5
lea rcx, [0x1400c7ef0]
mov r9d, ebp
mov r8d, 0x1388
mov edx, r15d
call fcn.140071bb0
lea rcx, [rsp + 0x30]
mov edx, 0x7f
call fcn.1400041f0
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.1400040d0
lea rcx, [rsp + 0x40]
call fcn.140002610
lea rcx, [rsp + 0x30]
call fcn.140059430
mov eax, 1
jmp 0x140003b8c
lea rcx, [rsp + 0x30]
mov edx, 0x7f
call fcn.1400041f0
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.1400040d0
jmp 0x140033ff5