joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408553
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xchg esp, eax
and byte cs:[ebp - 0x514], 0
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
push eax
call fcn.0040794e
pop ecx
push eax
push dword [ebp + 0x18]
jne 0x4085ee
push dword [ebp + 0x14]
call fcn.00407903
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.0040793e
push cs
add ch, byte [ecx + 0x2a]
push 0x104
lea eax, [ebp - 0x334]
push eax
push dword [ebp + 8]
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x408632
cmp dword [ebp - 0x398], 0
je 0x4087fc
cmp dword [ebp + 0xc], 1
je 0x4087fc
cmp dword [ebp + 0xc], 8
jne 0x4087c4
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.0040794e
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00407903
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x698], eax
call fcn.0040793e
jp 0x40878e
out 7, al
push dword [ebp - 0x698]
lea eax, [ebp - 0x6c0]
push eax
push dword [ebp + 8]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00407b1a
add esp, 0x14
call fcn.0040793e
mov ebx, 0xff5c2248
mov ch, 0x68
stc
invalid
inc dword [ebx - 0x5817eb3c]
int1
invalid
call fcn.0040793e
invalid
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
Function at 0x4088a5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub al, 0xc6
test dword [ebp + 0x26fffffc], ebx
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.0040794e
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00407903
add esp, 0xc
mov dword [ebp - 0x3d4], eax
invalid

Function at 0x4096f8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x7b7], 0xb2
mov byte [ebp - 0x7b6], 0xb1
mov byte [ebp - 0x7b5], 0xb8
mov byte [ebp - 0x7b4], 0xcf
mov byte [ebp - 0x7b3], 0xce
mov byte [ebp - 0x7b2], 0xd3
mov byte [ebp - 0x7b1], 0x99
mov byte [ebp - 0x7b0], 0x91
mov byte [ebp - 0x7af], 0x91
mov byte [ebp - 0x7ae], 0xfd
call fcn.0040793e
push es
std
xor byte [eax + 0x6a], dh
or ecx, dword [ebp - 0x7bb7b]
call dword [eax - 0x18]
stc
loope 0x409753
invalid
call [ecx + 0x50]
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.004078af
add esp, 0xc
jmp 0x4098b6
Function at 0x40672b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x40673a
pop dword [ebp - 0x2c]
mov eax, 0xe4cff227
sub eax, 0xe48f8aed
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xdd7795bd
sub dword [ebp - 0x3c], 0x8f255072
mov dword [ebp - 0x38], 0x7e081dee
sub dword [ebp - 0x38], 0x4bd4d1a9
mov dword [ebp - 0x34], 0x1ec45acc
sub dword [ebp - 0x34], 0xd278169e
mov dword [ebp - 0x30], 0xeab57616
add dword [ebp - 0x30], 0x154a89ea
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x2dfd7e25
sub eax, 0x2dbcfd21
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x212c1d25
add dword [ebp - 0x3c], 0x53464c31
mov dword [ebp - 0x38], 0xb5575b96
sub dword [ebp - 0x38], 0x73eafa21
mov dword [ebp - 0x34], 0x710f4b1f
sub dword [ebp - 0x34], 0xd9fdeb3
mov dword [ebp - 0x30], 0xce078819
add dword [ebp - 0x30], 0x31f877e7
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xe9a3f7cb
add eax, 0x169c8935
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x35b95
push 0
call eax
mov ecx, 0x40d5
xor esi, esi
add esi, eax
mov edi, 0xc4c307d9
sub edi, 0xc47c23d9
add edi, dword [ebp - 0x2c]
mov edx, 0xf66c8a0
xor dword [ebp - 4], edi
mov ebx, dword [edi]
xor dword [ebp - 0x24], 0xc9a6e3f6
add ebx, edx
xor dword [ebp - 8], eax
mov dword [esi], ebx
add dword [ebp - 0x28], edx
add esi, 0x7e9d4a53
add esi, 0x8162b5b1
add edi, 4
loop 0x406852
add eax, 0xf627
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x8d4c4e11
add ecx, 0x72f3b1ef
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x10002d80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x1007b060]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, edx
mov dword [ebp - 0x278], ecx
push esi
xor eax, eax
push edi
test ebx, ebx
je 0x10002daf
cmp byte [ebx], al
je 0x10002daf
inc eax
cmp byte [ebx + eax], 0
jne 0x10002da8
test eax, eax
je 0x10002dbc
cmp byte [ebx + eax], 0x2f
je 0x10002dc2
dec eax
jne 0x10002db3
cmp byte [ebx + eax], 0x2f
jne 0x10002dc3
inc eax
mov edx, dword [ebp + 8]
lea esi, [ebp - 0x270]
sub esi, edx
mov edi, edi
mov cl, byte [edx]
lea edx, [edx + 1]
mov byte [esi + edx - 1], cl
test cl, cl
jne 0x10002dd0
lea edx, [ebp - 0x270]
lea esi, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x10002de6
sub edx, esi
mov dword [ebp - 0x274], edx
lea edx, [ebx + eax]
mov esi, edx
lea ebx, [ebx]
mov al, byte [edx]
inc edx
test al, al
jne 0x10002e00
lea edi, [ebp - 0x270]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10002e10
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x270]
add dword [ebp - 0x274], edi
mov eax, edi
push 0x10063bd4
push eax
call dword [sym.imp.MSVCR120.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
je 0x10002ec6
mov ecx, dword [ebp - 0x278]
mov edx, ebx
push 0
call fcn.1000bef0
mov esi, eax
add esp, 4
test esi, esi
je 0x10002ebc
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x70]
mov edx, dword [esi]
push 0x64
push eax
mov ecx, dword [ecx + 0x2c]
call fcn.1000faf0
add esp, 8
test eax, eax
je 0x10002ea5
mov ebx, dword [sym.imp.MSVCR120.dll_fwrite]
push edi
push eax
lea eax, [ebp - 0x70]
push 1
push eax
call ebx
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x70]
mov edx, dword [esi]
push 0x64
push eax
mov ecx, dword [ecx + 0x2c]
call fcn.1000faf0
add esp, 0x18
test eax, eax
jne 0x10002e81
mov ecx, dword [esi + 4]
mov edx, dword [esi]
mov ecx, dword [ecx + 0x2c]
call fcn.1000fa20
push esi
call dword [sym.dspconv.dll_xmlFree]
add esp, 4
push edi
call dword [sym.imp.MSVCR120.dll_fclose]
add esp, 4
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x10002edb
lea ecx, [ebp - 0x270]
call fcn.10002bd0
jmp 0x10002eeb
cmp eax, 2
jne 0x10002eeb
lea ecx, [ebp - 0x270]
call fcn.10002a50
mov ecx, dword [0x1007c008]
mov eax, 0x2aaaaaab
sub ecx, dword [0x1007c004]
imul ecx
sar edx, 2
mov esi, edx
shr esi, 0x1f
add esi, edx
lea eax, [esi + 1]
push eax
call fcn.10003540
mov edx, dword [ebp - 0x274]
lea ecx, [esi + esi*2]
mov eax, dword [0x1007c004]
cmp byte [edx], 0
lea edi, [eax + ecx*8]
jne 0x10002f2b
xor ecx, ecx
jmp 0x10002f39
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002f30
sub ecx, esi
push ecx
push edx
mov ecx, edi
call fcn.100038b0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10060998
mov esp, ebp
pop ebp
ret
Function at 0x10007940
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10061f53
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1007b060]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x1007bf08
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [ebp - 4], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ecx], 0x1007bf08
mov byte [ebp - 4], 1
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x100638ec
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.10006740
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10007c20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
test ebx, ebx
jne 0x10007c7a
cmp byte [edi + 0x2c], bl
jne 0x10007c71
mov edx, dword [str.Failed_to_open_file]
mov ecx, edx
mov byte [edi + 0x2c], 1
mov dword [edi + 0x30], 2
lea esi, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10007c50
sub ecx, esi
push ecx
push edx
lea ecx, [edi + 0x34]
call fcn.10006740
mov dword [edi + 0x40], 0xffffffff
mov dword [edi + 0x3c], 0xffffffff
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 8
mov esi, dword [edi + 0x18]
test esi, esi
je 0x10007c90
mov ecx, esi
mov esi, dword [esi + 0x28]
push 1
mov eax, dword [ecx]
call dword [eax]
test esi, esi
jne 0x10007c81
mov esi, dword [sym.imp.MSVCR120.dll_fseek]
push 2
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
push 0
push ebx
mov dword [edi + 8], 0xffffffff
mov dword [edi + 4], 0xffffffff
call esi
push ebx
call dword [sym.imp.MSVCR120.dll_ftell]
push 0
push 0
push ebx
mov dword [ebp + 8], eax
call esi
mov eax, dword [ebp + 8]
add esp, 0x1c
test eax, eax
jg 0x10007cfc
cmp byte [edi + 0x2c], 0
jne 0x10007c71
mov edx, dword [str.Error_document_empty.]
mov ecx, edx
mov byte [edi + 0x2c], 1
mov dword [edi + 0x30], 0xc
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10007cf0
jmp 0x10007c57
inc eax
push eax
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
push ebx
mov ebx, dword [ebp + 8]
mov esi, eax
push 1
push ebx
push esi
mov byte [esi], 0
call dword [sym.imp.MSVCR120.dll_fread]
add esp, 0x14
cmp eax, 1
je 0x10007d5c
push esi
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
cmp byte [edi + 0x2c], 0
jne 0x10007c71
mov edx, dword [str.Failed_to_open_file]
mov ecx, edx
mov byte [edi + 0x2c], 1
mov dword [edi + 0x30], 2
lea esi, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10007d50
jmp 0x10007c57
mov byte [esi + ebx], 0
mov eax, esi
cmp byte [esi], 0
mov ecx, esi
je 0x10007d8c
lea esp, [esp]
mov dl, byte [eax]
cmp dl, 0xd
jne 0x10007d83
inc eax
mov byte [ecx], 0xa
inc ecx
cmp byte [eax], 0xa
jne 0x10007d87
jmp 0x10007d86
mov byte [ecx], dl
inc ecx
inc eax
cmp byte [eax], 0
jne 0x10007d70
mov byte [ecx], 0
mov ecx, edi
mov eax, dword [edi]
push 0
push 0
push esi
call dword [eax + 8]
push esi
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
cmp byte [edi + 0x2c], al
sete al
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x100083f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10062059
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1007b060]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebx + 8], 0xffffffff
mov dword [ebx + 4], 0xffffffff
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x20], 0x1007bf08
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 5
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
mov dword [ebp - 4], 0
lea ecx, [ebx + 0x2c]
mov dword [ebx], vtable.TiXmlDeclaration.0
mov dword [ecx], 0x1007bf08
mov dword [ebx + 0x30], 0x1007bf08
mov dword [ebx + 0x34], 0x1007bf08
push 3
push 0x10063bc0
mov byte [ebp - 4], 3
call fcn.10006740
push 5
push str.UTF_8
lea ecx, [ebx + 0x30]
call fcn.10006740
push 2
push 0x10063bb4
lea ecx, [ebx + 0x34]
call fcn.10006740
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10022a30
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0x24]
mov eax, dword [eax + 0x10]
cmp byte [eax], 0x25
jne 0x10022c69
push esi
call sym.dspconv.dll_xmlNextChar
add esp, 4
push esi
call sym.dspconv.dll_xmlParseName
mov edi, eax
add esp, 4
test edi, edi
jne 0x10022a77
push str.xmlParsePEReference:_no_name_n
lea edx, [eax + 0x44]
mov ecx, esi
call fcn.10016d30
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [esi + 0x24]
mov eax, dword [eax + 0x10]
cmp byte [eax], 0x3b
je 0x10022aee
cmp dword [esi + 0xd4], 0
je 0x10022a98
cmp dword [esi + 0xac], 0xffffffff
je 0x10022c69
push 0
push str.EntityRef:_expecting___n
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 3
push 0x17
push 1
push 0
push esi
push 0
push 0
push 0
mov dword [esi + 0x54], 0x17
call sym.dspconv.dll___xmlRaiseError
add esp, 0x44
mov dword [esi + 0xc], 0
cmp dword [esi + 0x120], 0
jne 0x10022c69
mov dword [esi + 0xd4], 1
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call sym.dspconv.dll_xmlNextChar
inc dword [esi + 0x1b8]
add esp, 4
mov eax, dword [esi]
test eax, eax
je 0x10022c12
mov eax, dword [eax + 0x60]
test eax, eax
je 0x10022c12
push edi
push dword [esi + 4]
call eax
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x10022c12
mov eax, dword [ebx + 0x30]
cmp eax, 4
je 0x10022b54
cmp eax, 5
je 0x10022b54
push ecx
push edi
push str.Internal:____s__is_not_a_parameter_entity_n
mov edx, 0x1b
mov ecx, esi
call fcn.10016da0
add esp, 0xc
mov dword [esi + 0x5c], 1
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [esi + 0x24]
cmp dword [eax + 0x28], 0x10018a10
je 0x10022b87
mov edx, ebx
mov ecx, esi
call fcn.10018a20
push eax
push esi
call sym.dspconv.dll_xmlPushInput
add esp, 8
test eax, eax
js 0x10022c69
mov dword [esi + 0x5c], 1
pop edi
pop esi
pop ebx
pop ebp
ret
push ebx
push esi
call sym.dspconv.dll_xmlNewEntityInputStream
push eax
push esi
call sym.dspconv.dll_xmlPushInput
add esp, 0x10
test eax, eax
js 0x10022c69
cmp dword [ebx + 0x30], 5
jne 0x10022c62
mov eax, dword [esi + 0x24]
mov eax, dword [eax + 0x10]
cmp byte [eax], 0x3c
jne 0x10022c62
cmp byte [eax + 1], 0x3f
jne 0x10022c62
cmp byte [eax + 2], 0x78
jne 0x10022c62
cmp byte [eax + 3], 0x6d
jne 0x10022c62
cmp byte [eax + 4], 0x6c
jne 0x10022c62
mov al, byte [eax + 5]
cmp al, 0x20
je 0x10022bf4
cmp al, 9
jb 0x10022bf0
cmp al, 0xa
jbe 0x10022bf4
cmp al, 0xd
jne 0x10022c62
push esi
call sym.dspconv.dll_xmlParseTextDecl
add esp, 4
cmp dword [esi + 0x54], 0x20
jne 0x10022c62
mov dword [esi + 0xac], 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
cmp dword [esi + 0x1c], 1
je 0x10022c4d
cmp dword [esi + 0x58], 0
jne 0x10022c24
cmp dword [esi + 0x5c], 0
je 0x10022c4d
push ecx
push edi
push str.PEReference:____s__not_found_n
mov edx, 0x1b
mov ecx, esi
call fcn.10016da0
add esp, 0xc
mov dword [esi + 0x64], 0
mov dword [esi + 0x5c], 1
pop edi
pop esi
pop ebx
pop ebp
ret
push edi
push str.PEReference:____s__not_found_n
mov edx, 0x1a
mov ecx, esi
call fcn.10016fd0
add esp, 8
mov dword [esi + 0x5c], 1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1002e210
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x1002e24c
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x1002e24c
push esi
push eax
push dword [ebp + 0x10]
push 1
push ecx
call dword [sym.imp.MSVCR120.dll_fread]
mov esi, eax
add esp, 0x10
test esi, esi
jns 0x1002e247
push str.fread__
xor edx, edx
call fcn.1002d850
add esp, 4
mov eax, esi
pop esi
pop ebp
ret
or eax, 0xffffffff
pop ebp
ret
Function at 0x10034c90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x10034ca0
xor eax, eax
pop esi
pop ebp
ret
cmp dword [esi], 0
je 0x10034c9b
mov eax, dword [ebp + 8]
test eax, eax
jne 0x10034cb5
call dword [sym.imp.MSVCR120.dll___iob_func]
add eax, 0x20
push eax
push dword [esi + 4]
push 1
push dword [esi]
call dword [sym.imp.MSVCR120.dll_fwrite]
add esp, 0x10
pop esi
pop ebp
ret

Function at 0x100376c0
Capabilities:
Parse credit card information

Disassembly:
push ebx
mov ebx, edx
push edi
mov edi, ecx
test ebx, ebx
jne 0x100376d0
pop edi
or eax, 0xffffffff
pop ebx
ret
push esi
mov esi, dword [ebx]
mov al, byte [esi]
cmp al, 0x61
jl 0x100376e1
cmp al, 0x7a
jle 0x100377c1
cmp al, 0x41
jl 0x100376ed
cmp al, 0x5a
jle 0x100377c1
cmp al, 0x30
jl 0x100376f9
cmp al, 0x39
jle 0x100377c1
cmp al, 0x2d
je 0x100377c1
cmp al, 0x2e
je 0x100377c1
cmp al, 0x5f
je 0x100377c1
cmp al, 0x7e
je 0x100377c1
cmp al, 0x25
jne 0x1003775f
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x1003772a
cmp cl, 0x39
jle 0x1003773e
cmp cl, 0x61
jl 0x10037734
cmp cl, 0x66
jle 0x1003773e
cmp cl, 0x41
jl 0x1003775f
cmp cl, 0x46
jg 0x1003775f
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x1003774b
cmp cl, 0x39
jle 0x100377c1
cmp cl, 0x61
jl 0x10037755
cmp cl, 0x66
jle 0x100377c1
cmp cl, 0x41
jl 0x1003775f
cmp cl, 0x46
jle 0x100377c1
cmp al, 0x21
je 0x100377c1
cmp al, 0x24
je 0x100377c1
cmp al, 0x26
je 0x100377c1
cmp al, 0x28
je 0x100377c1
cmp al, 0x29
je 0x100377c1
cmp al, 0x2a
je 0x100377c1
cmp al, 0x2b
je 0x100377c1
cmp al, 0x2c
je 0x100377c1
cmp al, 0x3b
je 0x100377c1
cmp al, 0x3d
je 0x100377c1
cmp al, 0x3a
je 0x100377c1
cmp al, 0x40
je 0x100377c1
cmp al, 0x2f
je 0x100377c1
cmp al, 0x3f
je 0x100377c1
cmp al, 0x5b
je 0x100377c1
cmp al, 0x5d
je 0x100377c1
test edi, edi
je 0x10037814
test byte [edi + 0x24], 1
je 0x100377d3
cmp al, 0x7b
je 0x100377c1
cmp al, 0x7d
je 0x100377c1
cmp al, 0x7c
je 0x100377c1
cmp al, 0x5c
je 0x100377c1
cmp al, 0x5e
je 0x100377c1
cmp al, 0x60
jne 0x100377d3
cmp al, 0x25
jne 0x100377cd
add esi, 3
jmp 0x100376d3
inc esi
jmp 0x100376d3
mov eax, dword [edi + 0x20]
test eax, eax
je 0x100377e4
push eax
call dword [sym.dspconv.dll_xmlFree]
add esp, 4
mov ecx, dword [ebx]
mov eax, esi
sub eax, ecx
test byte [edi + 0x24], 2
je 0x10037805
push eax
push ecx
call sym.dspconv.dll_xmlStrndup
add esp, 8
mov dword [edi + 0x20], eax
mov dword [ebx], esi
xor eax, eax
pop esi
pop edi
pop ebx
ret
push 0
push eax
push ecx
call sym.dspconv.dll_xmlURIUnescapeString
add esp, 0xc
mov dword [edi + 0x20], eax
mov dword [ebx], esi
xor eax, eax
pop esi
pop edi
pop ebx
ret
Function at 0x10037820
Capabilities:
Parse credit card information

Disassembly:
push ebx
mov ebx, edx
push edi
mov edi, ecx
test ebx, ebx
jne 0x10037830
pop edi
or eax, 0xffffffff
pop ebx
ret
push esi
mov esi, dword [ebx]
mov al, byte [esi]
cmp al, 0x61
jl 0x10037841
cmp al, 0x7a
jle 0x10037925
cmp al, 0x41
jl 0x1003784d
cmp al, 0x5a
jle 0x10037925
cmp al, 0x30
jl 0x10037859
cmp al, 0x39
jle 0x10037925
cmp al, 0x2d
je 0x10037925
cmp al, 0x2e
je 0x10037925
cmp al, 0x5f
je 0x10037925
cmp al, 0x7e
je 0x10037925
cmp al, 0x25
jne 0x100378bf
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x1003788a
cmp cl, 0x39
jle 0x1003789e
cmp cl, 0x61
jl 0x10037894
cmp cl, 0x66
jle 0x1003789e
cmp cl, 0x41
jl 0x100378bf
cmp cl, 0x46
jg 0x100378bf
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x100378ab
cmp cl, 0x39
jle 0x10037925
cmp cl, 0x61
jl 0x100378b5
cmp cl, 0x66
jle 0x10037925
cmp cl, 0x41
jl 0x100378bf
cmp cl, 0x46
jle 0x10037925
cmp al, 0x21
je 0x10037925
cmp al, 0x24
je 0x10037925
cmp al, 0x26
je 0x10037925
cmp al, 0x28
je 0x10037925
cmp al, 0x29
je 0x10037925
cmp al, 0x2a
je 0x10037925
cmp al, 0x2b
je 0x10037925
cmp al, 0x2c
je 0x10037925
cmp al, 0x3b
je 0x10037925
cmp al, 0x3d
je 0x10037925
cmp al, 0x3a
je 0x10037925
cmp al, 0x40
je 0x10037925
cmp al, 0x2f
je 0x10037925
cmp al, 0x3f
je 0x10037925
test edi, edi
je 0x10037993
test byte [edi + 0x24], 1
je 0x10037937
cmp al, 0x7b
je 0x10037925
cmp al, 0x7d
je 0x10037925
cmp al, 0x7c
je 0x10037925
cmp al, 0x5c
je 0x10037925
cmp al, 0x5e
je 0x10037925
cmp al, 0x5b
je 0x10037925
cmp al, 0x5d
je 0x10037925
cmp al, 0x60
jne 0x10037937
cmp al, 0x25
jne 0x10037931
add esi, 3
jmp 0x10037833
inc esi
jmp 0x10037833
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x10037948
push eax
call dword [sym.dspconv.dll_xmlFree]
add esp, 4
mov ecx, dword [ebx]
mov eax, esi
sub eax, ecx
test byte [edi + 0x24], 2
je 0x10037960
push eax
push ecx
call sym.dspconv.dll_xmlStrndup
add esp, 8
jmp 0x1003796c
push 0
push eax
push ecx
call sym.dspconv.dll_xmlURIUnescapeString
add esp, 0xc
mov dword [edi + 0x1c], eax
mov eax, dword [edi + 0x28]
test eax, eax
je 0x10037980
push eax
call dword [sym.dspconv.dll_xmlFree]
add esp, 4
mov ecx, dword [ebx]
mov eax, esi
sub eax, ecx
push eax
push ecx
call sym.dspconv.dll_xmlStrndup
add esp, 8
mov dword [edi + 0x28], eax
mov dword [ebx], esi
xor eax, eax
pop esi
pop edi
pop ebx
ret
Function at 0x10037a00
Capabilities:
Parse credit card information

Disassembly:
push ebx
mov ebx, edx
push esi
push edi
mov edi, ecx
mov esi, dword [ebx]
lea esp, [esp]
mov al, byte [esi]
cmp al, 0x61
jl 0x10037a1e
cmp al, 0x7a
jle 0x10037ab8
cmp al, 0x41
jl 0x10037a2a
cmp al, 0x5a
jle 0x10037ab8
cmp al, 0x30
jl 0x10037a36
cmp al, 0x39
jle 0x10037ab8
cmp al, 0x2d
je 0x10037ab8
cmp al, 0x2e
je 0x10037ab8
cmp al, 0x5f
je 0x10037ab8
cmp al, 0x7e
je 0x10037ab8
cmp al, 0x25
jne 0x10037a8c
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x10037a57
cmp cl, 0x39
jle 0x10037a6b
cmp cl, 0x61
jl 0x10037a61
cmp cl, 0x66
jle 0x10037a6b
cmp cl, 0x41
jl 0x10037a8c
cmp cl, 0x46
jg 0x10037a8c
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x10037a78
cmp cl, 0x39
jle 0x10037ab8
cmp cl, 0x61
jl 0x10037a82
cmp cl, 0x66
jle 0x10037ab8
cmp cl, 0x41
jl 0x10037a8c
cmp cl, 0x46
jle 0x10037ab8
cmp al, 0x21
je 0x10037ab8
cmp al, 0x24
je 0x10037ab8
cmp al, 0x26
je 0x10037ab8
cmp al, 0x28
je 0x10037ab8
cmp al, 0x29
je 0x10037ab8
cmp al, 0x2a
je 0x10037ab8
cmp al, 0x2b
je 0x10037ab8
cmp al, 0x2c
je 0x10037ab8
cmp al, 0x3b
je 0x10037ab8
cmp al, 0x3d
je 0x10037ab8
cmp al, 0x3a
jne 0x10037aca
cmp al, 0x25
jne 0x10037ac4
add esi, 3
jmp 0x10037a10
inc esi
jmp 0x10037a10
cmp byte [esi], 0x40
jne 0x10037b1c
test edi, edi
je 0x10037b14
mov eax, dword [edi + 0x10]
test eax, eax
je 0x10037ae4
push eax
call dword [sym.dspconv.dll_xmlFree]
add esp, 4
mov ecx, dword [ebx]
mov eax, esi
sub eax, ecx
test byte [edi + 0x24], 2
je 0x10037b05
push eax
push ecx
call sym.dspconv.dll_xmlStrndup
add esp, 8
mov dword [edi + 0x10], eax
mov dword [ebx], esi
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0
push eax
push ecx
call sym.dspconv.dll_xmlURIUnescapeString
add esp, 0xc
mov dword [edi + 0x10], eax
pop edi
mov dword [ebx], esi
xor eax, eax
pop esi
pop ebx
ret
pop edi
pop esi
mov eax, 1
pop ebx
ret