joyce8/EMBER2024-capa huggingface dataset:
Function at 0x519030
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x18]
push esi
call fcn.00517960
add esp, 4
test esi, esi
je 0x519255
cmp dword [esi + 0x14], 0
je 0x519255
cmp dword [esi], 0x46494c45
jne 0x519255
cmp dword [esi + 4], 0
je 0x51907a
push 0x19
push esi
call fcn.00442650
add esp, 8
mov eax, 0x19
pop esi
add esp, 0x10
ret
push ebp
mov ebp, dword [esp + 0x20]
test ebp, ebp
jne 0x519097
push 0x74
push esi
call fcn.00442650
add esp, 8
lea eax, [ebp + 0x74]
pop ebp
pop esi
add esp, 0x10
ret
cmp dword [esp + 0x38], 0
jne 0x5190b4
push 0x33
push esi
call fcn.00442650
add esp, 8
pop ebp
mov eax, 0x33
pop esi
add esp, 0x10
ret
mov eax, dword [esp + 0x24]
push ebx
push edi
push eax
push esi
call fcn.00517e80
mov edx, dword [esp + 0x40]
lea ecx, [esp + 0x1c]
push ecx
push edx
push esi
mov edi, eax
call fcn.00518020
add esp, 0x14
mov ebx, eax
test edi, edi
jne 0x5190f2
push 0x77
push esi
call fcn.00442650
add esp, 8
lea eax, [edi + 0x77]
pop edi
pop ebx
pop ebp
pop esi
add esp, 0x10
ret
test ebx, ebx
jne 0x51910c
push 0x78
push esi
call fcn.00442650
add esp, 8
pop edi
lea eax, [ebx + 0x78]
pop ebx
pop ebp
pop esi
add esp, 0x10
ret
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
push eax
push ecx
push ebp
push esi
call fcn.0052aca0
add esp, 0x10
test eax, eax
je 0x519131
pop edi
pop ebx
pop ebp
mov eax, 0xc1
pop esi
add esp, 0x10
ret
push ebx
push edi
push ebp
call fcn.0051db50
add esp, 0xc
push ebx
push edi
push ebp
test eax, eax
je 0x51914a
call fcn.0051dc70
jmp 0x51914f
call fcn.0051edc0
add esp, 0xc
cmp byte [esi + 0x40], 0
mov ebx, eax
je 0x519167
pop edi
pop ebx
pop ebp
mov eax, 0xcd
pop esi
add esp, 0x10
ret
mov edi, dword [esp + 0x3c]
mov edx, 0x4949
cmp word [esi + 0x30], dx
je 0x5191a2
cmp dword [esp + 0x14], 0
jne 0x5191a2
cmp edi, 2
jne 0x5191df
mov eax, dword [esp + 0x40]
movzx ecx, word [eax]
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x28], ecx
call fcn.00517720
lea eax, [esp + 0x28]
add esp, 4
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x40]
push edi
push eax
push ecx
push edx
push ebx
call fcn.0051e230
add esp, 0x14
cmp byte [esi + 0x40], 0
je 0x51924b
mov eax, dword [esi + 0x3c]
sub eax, 0x32
neg eax
pop edi
sbb eax, eax
pop ebx
and eax, 0xb2
pop ebp
add eax, 0x1b
pop esi
add esp, 0x10
ret
cmp edi, 4
jne 0x519205
mov ecx, dword [esp + 0x40]
mov edx, dword [ecx]
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], edx
call fcn.00517730
lea ecx, [esp + 0x14]
add esp, 4
mov dword [esp + 0x40], ecx
jmp 0x5191a2
cmp edi, 8
jne 0x519235
mov eax, dword [esp + 0x40]
mov edx, dword [eax]
mov eax, dword [eax + 4]
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], eax
call fcn.00517750
lea edx, [esp + 0x1c]
add esp, 4
mov dword [esp + 0x40], edx
jmp 0x5191a2
cmp edi, 1
je 0x5191a2
pop edi
pop ebx
pop ebp
mov eax, 0x79
pop esi
add esp, 0x10
ret
pop edi
pop ebx
pop ebp
xor eax, eax
pop esi
add esp, 0x10
ret
push 0x14
push esi
call fcn.00442650
add esp, 8
mov eax, 0x14
pop esi
add esp, 0x10
ret
Function at 0x53bb20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xcc
mov eax, 4
mov ecx, eax
mov word [esp + 0x14], cx
mov word [esp + 0x2c], cx
mov word [esp + 0x44], cx
mov word [esp + 0x5c], cx
mov ecx, 8
mov word [esp + 8], ax
mov dword [esp + 0x1c], eax
mov word [esp + 0x20], ax
mov word [esp + 0x38], ax
mov word [esp + 0x50], ax
mov word [esp + 0x68], ax
mov word [esp + 0x74], cx
mov ecx, eax
mov word [esp + 0x80], ax
mov eax, 8
mov word [esp + 0x8c], cx
mov ecx, eax
mov word [esp + 0x98], ax
mov eax, 4
push ebx
mov word [esp + 0xb4], ax
mov edx, 2
xor eax, eax
push esi
mov dword [esp + 8], str.Apple:Global_Name_TOC_Seed
mov dword [esp + 0xc], edx
mov dword [esp + 0x14], str.Apple:Global_Name_TOC_MinSeed
mov dword [esp + 0x18], 3
mov dword [esp + 0x20], str.Apple:Global_Name_TOC_Object
mov dword [esp + 0x2c], str.Apple:Global_Name_TOC_Container
mov dword [esp + 0x30], 5
mov dword [esp + 0x38], str.Apple:Global_Name_TOC_Deleted
mov dword [esp + 0x3c], 6
mov dword [esp + 0x44], str.Apple:Global_Name_TOC_Free
mov dword [esp + 0x48], 7
mov dword [esp + 0x50], str.Apple:Global_Name_TOC_Target
mov dword [esp + 0x54], 9
mov dword [esp + 0x5c], str.Apple:Global_Name_TOC_NewValuesTOC
mov dword [esp + 0x60], 8
mov dword [esp + 0x68], str.Apple:Global_Name_TOC_DeleteList
mov dword [esp + 0x6c], 0xa
mov dword [esp + 0x74], str.Apple:Global_Name_TOC_Type
mov dword [esp + 0x78], 0x13
mov dword [esp + 0x80], str.Apple:Dynamic_Value
mov dword [esp + 0x84], 0x19
mov dword [esp + 0x8c], str.Apple:Type_BaseType
mov dword [esp + 0x90], 0x1a
mov dword [esp + 0x98], str.Apple:Type_BaseTypeList
mov dword [esp + 0x9c], 0x1b
mov dword [esp + 0xa4], str.Apple:Target_Container
mov dword [esp + 0xa8], 0x1c
mov word [esp + 0xac], cx
mov dword [esp + 0xb0], str.Apple:Type_ValueUpdates
mov dword [esp + 0xb4], 0x1d
mov dword [esp + 0xbc], str.Apple:Type_UpdatesData
mov dword [esp + 0xc0], 0x1e
mov word [esp + 0xc4], cx
mov dword [esp + 0xc8], 0x6edb9d
mov dword [esp + 0xcc], 0
mov word [esp + 0xd0], ax
mov bl, 1
lea esi, [esp + 0xc]
jmp 0x53bcf0
test byte [esi + 4], 8
je 0x53bd02
mov eax, 0x17
mov ecx, 0x2008
jmp 0x53bd0c
mov eax, 0x18
mov ecx, 0x2004
push ecx
mov ecx, dword [edi + 0x7c]
push 0
push ecx
mov ecx, dword [esi - 4]
push ecx
push 0x15
push eax
push edx
push edi
call fcn.005447f0
add esp, 0x20
test bl, bl
je 0x53bd2e
test eax, eax
jne 0x53bd2e
xor bl, bl
mov edx, dword [esi + 0xc]
add esi, 0xc
test edx, edx
jne 0x53bcf0
pop esi
mov al, bl
pop ebx
add esp, 0xcc
ret
Function at 0x554d00
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
test ebx, ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
je 0x554d13
mov dword [ebx], 0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x554d21
mov dword [eax], 0
lea eax, [esp + 0xc]
push eax
push ebp
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x554d87
push edi
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
push esi
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x554d7f
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x10]
push edx
push 0x701a64
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x554d7f
test ebx, ebx
mov ecx, dword [esp + 0xc]
je 0x554d72
mov eax, dword [ecx + 8]
mov dword [ebx], eax
mov eax, dword [esp + 0x20]
test eax, eax
je 0x554d7f
mov ecx, dword [ecx + 0xc]
mov dword [eax], ecx
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
add esp, 0xc
ret

Function at 0x554ee0
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x100
push esi
push edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [esp + 0xc]
push str.QTMLInitTermMutex_lx
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
test edi, edi
je 0x554f20
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x8a54b8]
test eax, eax
jle 0x554f31
inc eax
mov dword [0x8a54b8], eax
jmp 0x554f8a
push str.QuickTime.qts
call fcn.005559e0
add esp, 4
test eax, eax
mov dword [0x8a54bc], eax
jne 0x554fa8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0xfffff7d3
mov eax, dword [0x8a54bc]
test eax, eax
je 0x554f6c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x8a54bc], 0
mov eax, 0x554cf0
mov dword [0x89ad40], 0x554e80
mov dword [0x89ad50], eax
mov dword [0x89ad54], eax
mov dword [0x89ad4c], eax
test edi, edi
je 0x554f9c
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov ax, si
pop esi
add esp, 0x100
ret
call fcn.00554e80
mov esi, eax
test si, si
jne 0x554f52
mov edx, dword [esp + 0x10c]
push edx
call fcn.00554cd0
add esp, 4
mov esi, eax
test si, si
jne 0x554f52
inc dword [0x8a54b8]
jmp 0x554f8a
Function at 0x555650
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x14]
lea ecx, [esp + 4]
push ecx
push 1
push 0
push edx
push reloc.WS2_32.dll_bind
mov dword [esp + 0x18], 0
mov dword [esp + 0x2c], eax
mov byte [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5556ed
mov eax, dword [esp + 4]
test eax, eax
je 0x5556fc
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5556ed
cmp byte [esi], 0
je 0x5556ed
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5556b2
sub eax, edx
cmp byte [eax + esi - 1], 0x5c
je 0x5556ed
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5556c7
sub eax, edx
cmp byte [eax + esi - 1], 0x2f
je 0x5556ed
dec esi
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x5556d8
mov ax, word [0x701a64]
push edi
mov edi, esi
mov word [edi], ax
pop edi
mov eax, dword [esp + 4]
test eax, eax
je 0x5556fc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ecx
ret
Function at 0x555700
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push esi
mov esi, dword [esp + 0x10c]
xor eax, eax
test esi, esi
je 0x55586d
mov byte [esi], al
mov eax, dword [esp + 0x114]
test eax, eax
je 0x55572b
mov dword [eax], 0
push ebx
push edi
push str.QuickTime.qts
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
mov ebx, dword [esp + 0x118]
je 0x55578f
push 0x104
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jbe 0x55578f
lea eax, [esp + 0xc]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x555760
sub eax, edx
lea edi, [eax - 0xd]
test edi, edi
jbe 0x55578f
lea edx, [edi + 1]
cmp ebx, edx
jbe 0x55578f
push edi
lea eax, [esp + 0x10]
push eax
push esi
call fcn.00641290
add esp, 0xc
mov byte [edi + esi], 0
jmp 0x555818
cmp byte [esi], 0
jne 0x55581d
push ebx
push esi
push str.QTSysDir
push str.SoftwareApple_Computer__Inc.QuickTime
call fcn.00555650
mov al, byte [esi]
add esp, 0x10
test al, al
je 0x5557c1
push 0
push esi
call fcn.006452e2
add esp, 8
test eax, eax
je 0x5557c4
mov byte [esi], 0
cmp byte [esi], 0
jne 0x55581d
push ebx
push esi
push str.QuickTime.qts_folder
push str.SoftwareApple_Computer__Inc.QuickTime
call fcn.00555650
mov al, byte [esi]
add esp, 0x10
test al, al
je 0x5557f2
push 0
push esi
call fcn.006452e2
add esp, 8
test eax, eax
je 0x5557f5
mov byte [esi], 0
cmp byte [esi], 0
jne 0x55581d
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jbe 0x555815
push 0
push esi
call fcn.006452e2
add esp, 8
test eax, eax
je 0x555818
mov byte [esi], 0
cmp byte [esi], 0
je 0x555862
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x555822
sub eax, edx
cmp byte [eax + esi - 1], 0x5c
je 0x555862
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x555837
sub eax, edx
cmp byte [eax + esi - 1], 0x2f
je 0x555862
mov edi, esi
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x555850
mov cx, word [0x701a64]
mov word [edi], cx
mov cl, byte [esi]
xor eax, eax
test cl, cl
pop edi
setne al
pop ebx
pop esi
add esp, 0x104
ret
Function at 0x555880
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
push ebp
mov ebp, dword [esp + 0x210]
push esi
mov esi, dword [esp + 0x218]
push esi
push ebp
push str.QTExtDir
push str.SoftwareApple_Computer__Inc.QuickTime
call fcn.00555650
mov al, byte [ebp]
add esp, 0x10
test al, al
jne 0x5559bc
add esi, 0xfffffff6
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0
lea ecx, [esp + 0x110]
push esi
push ecx
call fcn.00555700
mov al, byte [esp + 0x118]
add esp, 0xc
test al, al
je 0x5559bc
lea eax, [esp + 8]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5558f0
sub eax, edx
cmp byte [esp + eax + 7], 0x5c
push edi
je 0x555932
lea eax, [esp + 0xc]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x555908
sub eax, edx
cmp byte [esp + eax + 0xb], 0x2f
je 0x555932
lea edi, [esp + 0xc]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x555920
mov dx, word [0x701a64]
mov word [edi], dx
lea eax, [esp + 0x110]
mov edx, ebp
mov ecx, eax
sub edx, ecx
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x555940
lea esi, [esp + 0x110]
lea eax, [esp + 0xc]
push ebx
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x55597e
test cl, cl
je 0x55597a
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x55597e
add eax, 2
add esi, 2
test cl, cl
jne 0x555956
xor eax, eax
jmp 0x555983
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
pop ebx
jne 0x5559bb
mov edi, ebp
dec edi
jmp 0x555990
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x555990
mov eax, dword [str.QuickTime_]
mov dword [edi], eax
mov ecx, dword [0x74df20]
mov dword [edi + 4], ecx
mov dx, word [0x74df24]
mov word [edi + 8], dx
mov al, byte [0x74df26]
mov byte [edi + 0xa], al
pop edi
mov eax, ebp
pop esi
lea edx, [eax + 1]
pop ebp
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5559c3
sub eax, edx
add esp, 0x208
ret
Function at 0x56ac40
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x24]
mov ecx, dword [eax + 0x10]
cmp byte [ecx], 0x25
jne 0x56ad4e
push ebx
push esi
call fcn.0058cc90
push esi
call fcn.00566980
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x56ac7a
mov ecx, str.xmlParsePEReference:_no_name_n
lea eax, [ebx + 0x44]
call fcn.00561c70
pop ebx
pop esi
ret
mov edx, dword [esi + 0x24]
mov eax, dword [edx + 0x10]
cmp byte [eax], 0x3b
je 0x56aceb
cmp dword [esi + 0xd4], 0
je 0x56ac9b
cmp dword [esi + 0xac], 0xffffffff
je 0x56ad4d
push 0
push str.EntityRef:_expecting___n
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 3
push 0x17
push 1
push 0
push esi
push 0
push 0
push 0
mov dword [esi + 0x54], 0x17
call fcn.00588a40
add esp, 0x44
cmp dword [esi + 0x120], 0
mov dword [esi + 0xc], 0
jne 0x56ad4d
pop ebx
mov dword [esi + 0xd4], 1
pop esi
ret
push edi
push esi
call fcn.0058cc90
mov eax, dword [esi]
inc dword [esi + 0x1b8]
add esp, 4
test eax, eax
je 0x56ad18
mov eax, dword [eax + 0x60]
test eax, eax
je 0x56ad18
mov ecx, dword [esi + 4]
push ebx
push ecx
call eax
mov edi, eax
add esp, 8
test edi, edi
jne 0x56ad6c
cmp dword [esi + 0x1c], 1
je 0x56ad50
cmp dword [esi + 0x58], 0
jne 0x56ad2a
cmp dword [esi + 0x5c], 0
je 0x56ad50
push 0x1b
mov edx, ebx
push esi
xor ecx, ecx
mov ebx, str.PEReference:____s__not_found_n
call fcn.00561ce0
add esp, 8
mov dword [esi + 0x64], 0
mov dword [esi + 0x5c], 1
pop edi
pop ebx
pop esi
ret
mov eax, ebx
mov edx, str.PEReference:____s__not_found_n
mov ecx, 0x1a
call fcn.00561e70
pop edi
pop ebx
mov dword [esi + 0x5c], 1
pop esi
ret
mov eax, dword [edi + 0x30]
cmp eax, 4
je 0x56ad98
cmp eax, 5
je 0x56ad98
push 0x1b
mov edx, ebx
push esi
xor ecx, ecx
mov ebx, str.Internal:____s__is_not_a_parameter_entity_n
call fcn.00561ce0
add esp, 8
pop edi
pop ebx
mov dword [esi + 0x5c], 1
pop esi
ret
mov edx, dword [esi + 0x24]
cmp dword [edx + 0x28], 0x562d20
push edi
je 0x56adc5
mov eax, esi
call fcn.00562d30
push eax
push esi
call fcn.005646b0
add esp, 0xc
test eax, eax
jl 0x56ad4c
pop edi
pop ebx
mov dword [esi + 0x5c], 1
pop esi
ret
push esi
call fcn.0058d9e0
push eax
push esi
call fcn.005646b0
add esp, 0x10
test eax, eax
jl 0x56ad4c
cmp dword [edi + 0x30], 5
jne 0x56ad45
mov eax, dword [esi + 0x24]
mov eax, dword [eax + 0x10]
cmp byte [eax], 0x3c
jne 0x56ad45
cmp byte [eax + 1], 0x3f
jne 0x56ad45
cmp byte [eax + 2], 0x78
jne 0x56ad45
cmp byte [eax + 3], 0x6d
jne 0x56ad45
cmp byte [eax + 4], 0x6c
jne 0x56ad45
mov al, byte [eax + 5]
cmp al, 0x20
je 0x56ae35
cmp al, 9
jb 0x56ae2d
cmp al, 0xa
jbe 0x56ae35
cmp al, 0xd
jne 0x56ad45
push esi
call fcn.00565710
add esp, 4
cmp dword [esi + 0x54], 0x20
jne 0x56ad45
pop edi
pop ebx
mov dword [esi + 0xac], 0xffffffff
pop esi
ret
Function at 0x589160
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x8a5584], 0
jne 0x5891be
push 0x8a5588
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x58919a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x89b1e0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x8a5580], eax
mov dword [0x8a5584], 1
ret
cmp dword [0x8a5584], 0
jne 0x5891be
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
lea ebx, [ebx]
push 0
call esi
cmp dword [0x8a5584], 0
je 0x5891b0
pop esi
ret

Function at 0x58b770
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, eax
xor eax, eax
push edi
mov edi, ecx
test edx, edx
je 0x58b7ab
mov cl, byte [edx]
movzx esi, cl
mov eax, esi
shl eax, 4
sub eax, esi
add eax, eax
test cl, cl
je 0x58b7ab
push ebp
mov esi, eax
mov ebp, eax
shl esi, 5
shr ebp, 3
movsx ecx, cl
add esi, ebp
inc edx
add esi, ecx
mov cl, byte [edx]
xor eax, esi
test cl, cl
jne 0x58b790
pop ebp
test edi, edi
je 0x58b7cf
mov cl, byte [edi]
test cl, cl
je 0x58b7cf
mov edx, eax
mov esi, eax
shl edx, 5
shr esi, 3
movsx ecx, cl
add edx, esi
inc edi
add edx, ecx
mov cl, byte [edi]
xor eax, edx
test cl, cl
jne 0x58b7b5
test ebx, ebx
je 0x58b7fa
mov cl, byte [ebx]
test cl, cl
je 0x58b7fa
lea esp, [esp]
mov edx, eax
mov esi, eax
shl edx, 5
shr esi, 3
movsx ecx, cl
add edx, esi
inc ebx
add edx, ecx
mov cl, byte [ebx]
xor eax, edx
test cl, cl
jne 0x58b7e0
mov ecx, dword [esp + 0x10]
xor edx, edx
div dword [ecx + 4]
pop edi
pop esi
pop ebx
mov eax, edx
ret
Function at 0x58b810
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov ebx, eax
mov esi, ecx
test edx, edx
je 0x58b962
mov cl, byte [edx]
movzx edi, cl
mov eax, edi
shl eax, 4
sub eax, edi
add eax, eax
test cl, cl
je 0x58b854
mov edi, eax
mov ebp, eax
shl edi, 5
shr ebp, 3
movsx ecx, cl
add edi, ebp
inc edx
add edi, ecx
mov cl, byte [edx]
xor eax, edi
test cl, cl
jne 0x58b836
mov ebp, dword [esp + 0x18]
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
lea edx, [edx + ecx + 0x3a]
xor eax, edx
test esi, esi
je 0x58b88a
mov cl, byte [esi]
test cl, cl
je 0x58b88a
mov edi, edi
mov edx, eax
mov edi, eax
shl edx, 5
shr edi, 3
movsx ecx, cl
add edx, edi
inc esi
add edx, ecx
mov cl, byte [esi]
xor eax, edx
test cl, cl
jne 0x58b870
test ebx, ebx
je 0x58b8be
mov cl, byte [ebx]
test cl, cl
je 0x58b8ae
mov edx, eax
mov esi, eax
shl edx, 5
shr esi, 3
movsx ecx, cl
add edx, esi
inc ebx
add edx, ecx
mov cl, byte [ebx]
xor eax, edx
test cl, cl
jne 0x58b894
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
lea edx, [edx + ecx + 0x3a]
xor eax, edx
test ebp, ebp
je 0x58b8eb
mov cl, byte [ebp]
test cl, cl
je 0x58b8eb
lea esp, [esp]
mov edx, eax
mov esi, eax
shl edx, 5
shr esi, 3
movsx ecx, cl
add edx, esi
inc ebp
add edx, ecx
mov cl, byte [ebp]
xor eax, edx
test cl, cl
jne 0x58b8d0
mov edx, dword [esp + 0x1c]
test edx, edx
je 0x58b92a
mov cl, byte [edx]
test cl, cl
je 0x58b91a
lea esp, [esp]
mov esi, eax
mov edi, eax
shl esi, 5
shr edi, 3
movsx ecx, cl
add esi, edi
inc edx
add esi, ecx
mov cl, byte [edx]
xor eax, esi
test cl, cl
jne 0x58b900
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
lea edx, [edx + ecx + 0x3a]
xor eax, edx
mov edx, dword [esp + 0x20]
test edx, edx
je 0x58b952
mov cl, byte [edx]
test cl, cl
je 0x58b952
mov esi, eax
mov edi, eax
shl esi, 5
shr edi, 3
movsx ecx, cl
add esi, edi
inc edx
add esi, ecx
mov cl, byte [edx]
xor eax, esi
test cl, cl
jne 0x58b938
mov ecx, dword [esp + 0x14]
xor edx, edx
div dword [ecx + 4]
pop edi
pop esi
pop ebp
pop ebx
mov eax, edx
ret
movzx ecx, byte [esi]
mov eax, ecx
shl eax, 4
sub eax, ecx
add eax, eax
jmp 0x58b864

Function at 0x58e720
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
jle 0x58e75b
test esi, esi
je 0x58e75b
xor eax, eax
xor ecx, ecx
test edx, edx
jle 0x58e74a
push edi
movzx edi, byte [ecx + esi]
add edi, eax
imul edi, edi, 0x401
mov eax, edi
shr edi, 6
inc ecx
xor eax, edi
cmp ecx, edx
jl 0x58e731
pop edi
lea ecx, [eax + eax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
ret
xor eax, eax
ret
Function at 0x58f0a0
Capabilities:
Parse credit card information

Disassembly:
mov edx, dword [esi]
mov al, byte [edx]
cmp al, 0x61
jl 0x58f0b0
cmp al, 0x7a
jle 0x58f168
cmp al, 0x41
jl 0x58f0bc
cmp al, 0x5a
jle 0x58f168
cmp al, 0x30
jl 0x58f0c8
cmp al, 0x39
jle 0x58f168
cmp al, 0x2d
je 0x58f168
cmp al, 0x2e
je 0x58f168
cmp al, 0x5f
je 0x58f168
cmp al, 0x7e
je 0x58f168
cmp al, 0x25
jne 0x58f12e
mov cl, byte [edx + 1]
cmp cl, 0x30
jl 0x58f0f9
cmp cl, 0x39
jle 0x58f10d
cmp cl, 0x61
jl 0x58f103
cmp cl, 0x66
jle 0x58f10d
cmp cl, 0x41
jl 0x58f12e
cmp cl, 0x46
jg 0x58f12e
mov cl, byte [edx + 2]
cmp cl, 0x30
jl 0x58f11a
cmp cl, 0x39
jle 0x58f168
cmp cl, 0x61
jl 0x58f124
cmp cl, 0x66
jle 0x58f168
cmp cl, 0x41
jl 0x58f12e
cmp cl, 0x46
jle 0x58f168
cmp al, 0x21
je 0x58f168
cmp al, 0x24
je 0x58f168
cmp al, 0x26
je 0x58f168
cmp al, 0x28
je 0x58f168
cmp al, 0x29
je 0x58f168
cmp al, 0x2a
je 0x58f168
cmp al, 0x2b
je 0x58f168
cmp al, 0x2c
je 0x58f168
cmp al, 0x3b
je 0x58f168
cmp al, 0x3d
je 0x58f168
cmp al, 0x3a
je 0x58f168
cmp al, 0x40
je 0x58f168
xor eax, eax
cmp dword [esp + 4], eax
sete al
ret
mov al, byte [edx]
cmp al, 0x61
jl 0x58f176
cmp al, 0x7a
jle 0x58f21c
cmp al, 0x41
jl 0x58f182
cmp al, 0x5a
jle 0x58f21c
cmp al, 0x30
jl 0x58f18e
cmp al, 0x39
jle 0x58f21c
cmp al, 0x2d
je 0x58f21c
cmp al, 0x2e
je 0x58f21c
cmp al, 0x5f
je 0x58f21c
cmp al, 0x7e
je 0x58f21c
cmp al, 0x25
jne 0x58f1ec
mov cl, byte [edx + 1]
cmp cl, 0x30
jl 0x58f1b7
cmp cl, 0x39
jle 0x58f1cb
cmp cl, 0x61
jl 0x58f1c1
cmp cl, 0x66
jle 0x58f1cb
cmp cl, 0x41
jl 0x58f1ec
cmp cl, 0x46
jg 0x58f1ec
mov cl, byte [edx + 2]
cmp cl, 0x30
jl 0x58f1d8
cmp cl, 0x39
jle 0x58f21c
cmp cl, 0x61
jl 0x58f1e2
cmp cl, 0x66
jle 0x58f21c
cmp cl, 0x41
jl 0x58f1ec
cmp cl, 0x46
jle 0x58f21c
cmp al, 0x21
je 0x58f21c
cmp al, 0x24
je 0x58f21c
cmp al, 0x26
je 0x58f21c
cmp al, 0x28
je 0x58f21c
cmp al, 0x29
je 0x58f21c
cmp al, 0x2a
je 0x58f21c
cmp al, 0x2b
je 0x58f21c
cmp al, 0x2c
je 0x58f21c
cmp al, 0x3b
je 0x58f21c
cmp al, 0x3d
je 0x58f21c
cmp al, 0x3a
je 0x58f21c
cmp al, 0x40
jne 0x58f232
cmp al, bl
je 0x58f232
cmp al, 0x25
jne 0x58f22c
add edx, 3
jmp 0x58f168
inc edx
jmp 0x58f168
mov dword [esi], edx
xor eax, eax
ret