joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002c120
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x24]
mov ecx, dword [eax + 0x10]
cmp byte [ecx], 0x25
jne 0x1002c23e
push ebx
push esi
call sym.libxml2.dll_xmlNextChar
push esi
call sym.libxml2.dll_xmlParseName
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x1002c15f
push str.xmlParsePEReference:_no_name_n
mov eax, 0x44
call fcn.10021e30
add esp, 4
pop ebx
pop esi
ret
mov edx, dword [esi + 0x24]
mov eax, dword [edx + 0x10]
cmp byte [eax], 0x3b
je 0x1002c1d2
mov eax, dword [esi + 0xd4]
test eax, eax
je 0x1002c181
cmp dword [esi + 0xac], 0xffffffff
je 0x1002c23d
push 0
push str.EntityRef:_expecting___n
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 3
push 0x17
push 1
push 0
push esi
push 0
push 0
push 0
mov dword [esi + 0x54], 0x17
call sym.libxml2.dll___xmlRaiseError
mov eax, dword [esi + 0x120]
add esp, 0x44
test eax, eax
mov dword [esi + 0xc], 0
jne 0x1002c23d
pop ebx
mov dword [esi + 0xd4], 1
pop esi
ret
push edi
push esi
call sym.libxml2.dll_xmlNextChar
mov edx, dword [esi + 0x1b8]
mov eax, dword [esi]
add esp, 4
inc edx
test eax, eax
mov dword [esi + 0x1b8], edx
je 0x1002c206
mov eax, dword [eax + 0x60]
test eax, eax
je 0x1002c206
mov ecx, dword [esi + 4]
push ebx
push ecx
call eax
mov edi, eax
add esp, 8
test edi, edi
jne 0x1002c25f
cmp dword [esi + 0x1c], 1
je 0x1002c240
mov eax, dword [esi + 0x58]
test eax, eax
jne 0x1002c21a
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x1002c240
push 0x1b
mov edx, ebx
push esi
xor ecx, ecx
mov ebx, str.PEReference:____s__not_found_n
call fcn.10021ea0
add esp, 8
mov dword [esi + 0x64], 0
mov dword [esi + 0x5c], 1
pop edi
pop ebx
pop esi
ret
push str.PEReference:____s__not_found_n
mov eax, ebx
mov ecx, 0x1a
call fcn.10022010
add esp, 4
pop edi
pop ebx
mov dword [esi + 0x5c], 1
pop esi
ret
mov eax, dword [edi + 0x30]
cmp eax, 4
je 0x1002c28b
cmp eax, 5
je 0x1002c28b
push 0x1b
mov edx, ebx
push esi
xor ecx, ecx
mov ebx, str.Internal:____s__is_not_a_parameter_entity_n
call fcn.10021ea0
add esp, 8
pop edi
pop ebx
mov dword [esi + 0x5c], 1
pop esi
ret
mov edx, dword [esi + 0x24]
cmp dword [edx + 0x28], 0x100230e0
je 0x1002c2b9
mov eax, edi
mov ecx, esi
call fcn.100230f0
push eax
push esi
call sym.libxml2.dll_xmlPushInput
add esp, 8
test eax, eax
jl 0x1002c23c
pop edi
pop ebx
mov dword [esi + 0x5c], 1
pop esi
ret
push edi
push esi
call sym.libxml2.dll_xmlNewEntityInputStream
push eax
push esi
call sym.libxml2.dll_xmlPushInput
add esp, 0x10
test eax, eax
jl 0x1002c23c
cmp dword [edi + 0x30], 5
jne 0x1002c235
mov eax, dword [esi + 0x24]
mov eax, dword [eax + 0x10]
cmp byte [eax], 0x3c
jne 0x1002c235
cmp byte [eax + 1], 0x3f
jne 0x1002c235
cmp byte [eax + 2], 0x78
jne 0x1002c235
cmp byte [eax + 3], 0x6d
jne 0x1002c235
cmp byte [eax + 4], 0x6c
jne 0x1002c235
mov al, byte [eax + 5]
cmp al, 0x20
je 0x1002c32a
cmp al, 9
jb 0x1002c322
cmp al, 0xa
jbe 0x1002c32a
cmp al, 0xd
jne 0x1002c235
push esi
call sym.libxml2.dll_xmlParseTextDecl
mov eax, dword [esi + 0x54]
add esp, 4
cmp eax, 0x20
jne 0x1002c235
pop edi
pop ebx
mov dword [esi + 0xac], 0xffffffff
pop esi
ret
Function at 0x1004e370
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x100eaae4]
test eax, eax
jne 0x1004e3ce
push 0x100eaae8
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x1004e3aa
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x100e9638], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x100eaae0], eax
mov dword [0x100eaae4], 1
ret
mov eax, dword [0x100eaae4]
test eax, eax
jne 0x1004e3ce
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
lea ebx, [ebx]
push 0
call esi
mov eax, dword [0x100eaae4]
test eax, eax
je 0x1004e3c0
pop esi
ret

Function at 0x1004e3d0
Capabilities:
Create thread
Get thread local storage value
Set thread local storage value

Disassembly:
call fcn.1004e370
mov eax, dword [0x100e9638]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x1004e481
push esi
call fcn.1004e290
mov esi, eax
test esi, esi
jne 0x1004e3f7
pop esi
ret
push edi
push 8
call dword [sym.imp.msvcrt.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
jne 0x1004e43a
call sym.libxml2.dll___xmlGenericError
mov edi, eax
call sym.libxml2.dll___xmlGenericErrorContext
mov ecx, dword [eax]
push str.xmlGetGlobalState:_out_of_memory_n
push ecx
call dword [edi]
lea edx, [esi + 0x1c4]
push edx
call sym.libxml2.dll_xmlResetError
push esi
call dword [sym.imp.msvcrt.dll_free]
add esp, 0x10
pop edi
xor eax, eax
pop esi
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 1
push 0
push edi
mov dword [edi + 4], esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov eax, dword [0x100e9638]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edi
push 0
push 0x1004e2e0
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
pop ebx
pop edi
mov eax, esi
pop esi
ret

Function at 0x10051c70
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
je 0x10051c7e
mov ecx, dword [edx]
test ecx, ecx
jne 0x10051c81
xor eax, eax
ret
mov eax, dword [esp + 4]
test eax, eax
jne 0x10051c91
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
push eax
mov eax, dword [edx + 4]
push eax
push 1
push ecx
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
ret
Function at 0x10058250
Capabilities:
Parse credit card information

Disassembly:
mov edx, dword [esi]
mov al, byte [edx]
cmp al, 0x61
jl 0x10058260
cmp al, 0x7a
jle 0x10058320
cmp al, 0x41
jl 0x1005826c
cmp al, 0x5a
jle 0x10058320
cmp al, 0x30
jl 0x10058278
cmp al, 0x39
jle 0x10058320
cmp al, 0x2d
je 0x10058320
cmp al, 0x2e
je 0x10058320
cmp al, 0x5f
je 0x10058320
cmp al, 0x7e
je 0x10058320
cmp al, 0x25
jne 0x100582de
mov cl, byte [edx + 1]
cmp cl, 0x30
jl 0x100582a9
cmp cl, 0x39
jle 0x100582bd
cmp cl, 0x61
jl 0x100582b3
cmp cl, 0x66
jle 0x100582bd
cmp cl, 0x41
jl 0x100582de
cmp cl, 0x46
jg 0x100582de
mov cl, byte [edx + 2]
cmp cl, 0x30
jl 0x100582ca
cmp cl, 0x39
jle 0x10058320
cmp cl, 0x61
jl 0x100582d4
cmp cl, 0x66
jle 0x10058320
cmp cl, 0x41
jl 0x100582de
cmp cl, 0x46
jle 0x10058320
cmp al, 0x21
je 0x10058320
cmp al, 0x24
je 0x10058320
cmp al, 0x26
je 0x10058320
cmp al, 0x28
je 0x10058320
cmp al, 0x29
je 0x10058320
cmp al, 0x2a
je 0x10058320
cmp al, 0x2b
je 0x10058320
cmp al, 0x2c
je 0x10058320
cmp al, 0x3b
je 0x10058320
cmp al, 0x3d
je 0x10058320
cmp al, 0x3a
je 0x10058320
cmp al, 0x40
je 0x10058320
mov ecx, dword [esp + 4]
xor eax, eax
test ecx, ecx
sete al
ret
mov al, byte [edx]
cmp al, 0x61
jl 0x1005832e
cmp al, 0x7a
jle 0x100583d0
cmp al, 0x41
jl 0x1005833a
cmp al, 0x5a
jle 0x100583d0
cmp al, 0x30
jl 0x10058346
cmp al, 0x39
jle 0x100583d0
cmp al, 0x2d
je 0x100583d0
cmp al, 0x2e
je 0x100583d0
cmp al, 0x5f
je 0x100583d0
cmp al, 0x7e
je 0x100583d0
cmp al, 0x25
jne 0x100583a0
mov cl, byte [edx + 1]
cmp cl, 0x30
jl 0x1005836b
cmp cl, 0x39
jle 0x1005837f
cmp cl, 0x61
jl 0x10058375
cmp cl, 0x66
jle 0x1005837f
cmp cl, 0x41
jl 0x100583a0
cmp cl, 0x46
jg 0x100583a0
mov cl, byte [edx + 2]
cmp cl, 0x30
jl 0x1005838c
cmp cl, 0x39
jle 0x100583d0
cmp cl, 0x61
jl 0x10058396
cmp cl, 0x66
jle 0x100583d0
cmp cl, 0x41
jl 0x100583a0
cmp cl, 0x46
jle 0x100583d0
cmp al, 0x21
je 0x100583d0
cmp al, 0x24
je 0x100583d0
cmp al, 0x26
je 0x100583d0
cmp al, 0x28
je 0x100583d0
cmp al, 0x29
je 0x100583d0
cmp al, 0x2a
je 0x100583d0
cmp al, 0x2b
je 0x100583d0
cmp al, 0x2c
je 0x100583d0
cmp al, 0x3b
je 0x100583d0
cmp al, 0x3d
je 0x100583d0
cmp al, 0x3a
je 0x100583d0
cmp al, 0x40
jne 0x100583e6
cmp al, bl
je 0x100583e6
cmp al, 0x25
jne 0x100583e0
add edx, 3
jmp 0x10058320
inc edx
jmp 0x10058320
mov dword [esi], edx
xor eax, eax
ret
Function at 0x100596c0
Capabilities:
Parse credit card information

Disassembly:
test ebx, ebx
jne 0x100596c8
or eax, 0xffffffff
ret
push esi
mov esi, dword [ebx]
mov dl, 1
lea ecx, [ecx]
mov al, byte [esi]
cmp al, 0x61
jl 0x100596de
cmp al, 0x7a
jle 0x100597bd
cmp al, 0x41
jl 0x100596ea
cmp al, 0x5a
jle 0x100597bd
cmp al, 0x30
jl 0x100596f6
cmp al, 0x39
jle 0x100597bd
cmp al, 0x2d
je 0x100597bd
cmp al, 0x2e
je 0x100597bd
cmp al, 0x5f
je 0x100597bd
cmp al, 0x7e
je 0x100597bd
cmp al, 0x25
jne 0x1005975c
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x10059727
cmp cl, 0x39
jle 0x1005973b
cmp cl, 0x61
jl 0x10059731
cmp cl, 0x66
jle 0x1005973b
cmp cl, 0x41
jl 0x1005975c
cmp cl, 0x46
jg 0x1005975c
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x10059748
cmp cl, 0x39
jle 0x100597bd
cmp cl, 0x61
jl 0x10059752
cmp cl, 0x66
jle 0x100597bd
cmp cl, 0x41
jl 0x1005975c
cmp cl, 0x46
jle 0x100597bd
cmp al, 0x21
je 0x100597bd
cmp al, 0x24
je 0x100597bd
cmp al, 0x26
je 0x100597bd
cmp al, 0x28
je 0x100597bd
cmp al, 0x29
je 0x100597bd
cmp al, 0x2a
je 0x100597bd
cmp al, 0x2b
je 0x100597bd
cmp al, 0x2c
je 0x100597bd
cmp al, 0x3b
je 0x100597bd
cmp al, 0x3d
je 0x100597bd
cmp al, 0x3a
je 0x100597bd
cmp al, 0x40
je 0x100597bd
cmp al, 0x2f
je 0x100597bd
cmp al, 0x3f
je 0x100597bd
cmp al, 0x5b
je 0x100597bd
cmp al, 0x5d
je 0x100597bd
test edi, edi
je 0x10059812
test byte [edi + 0x24], dl
je 0x100597cf
cmp al, 0x7b
je 0x100597bd
cmp al, 0x7d
je 0x100597bd
cmp al, 0x7c
je 0x100597bd
cmp al, 0x5c
je 0x100597bd
cmp al, 0x5e
je 0x100597bd
cmp al, 0x60
jne 0x100597cf
cmp al, 0x25
jne 0x100597c9
add esi, 3
jmp 0x100596d0
inc esi
jmp 0x100596d0
mov eax, dword [edi + 0x20]
test eax, eax
je 0x100597e0
push eax
call dword [sym.libxml2.dll_xmlFree]
add esp, 4
test byte [edi + 0x24], 2
mov eax, dword [ebx]
je 0x100597ff
mov ecx, esi
sub ecx, eax
push ecx
push eax
call sym.libxml2.dll_xmlStrndup
add esp, 8
mov dword [edi + 0x20], eax
mov dword [ebx], esi
xor eax, eax
pop esi
ret
mov edx, esi
push 0
sub edx, eax
push edx
push eax
call sym.libxml2.dll_xmlURIUnescapeString
add esp, 0xc
mov dword [edi + 0x20], eax
mov dword [ebx], esi
xor eax, eax
pop esi
ret
Function at 0x10059820
Capabilities:
Parse credit card information

Disassembly:
test ebx, ebx
jne 0x10059828
or eax, 0xffffffff
ret
push esi
mov esi, dword [ebx]
mov dl, 1
lea ecx, [ecx]
mov al, byte [esi]
cmp al, 0x61
jl 0x1005983e
cmp al, 0x7a
jle 0x10059921
cmp al, 0x41
jl 0x1005984a
cmp al, 0x5a
jle 0x10059921
cmp al, 0x30
jl 0x10059856
cmp al, 0x39
jle 0x10059921
cmp al, 0x2d
je 0x10059921
cmp al, 0x2e
je 0x10059921
cmp al, 0x5f
je 0x10059921
cmp al, 0x7e
je 0x10059921
cmp al, 0x25
jne 0x100598bc
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x10059887
cmp cl, 0x39
jle 0x1005989b
cmp cl, 0x61
jl 0x10059891
cmp cl, 0x66
jle 0x1005989b
cmp cl, 0x41
jl 0x100598bc
cmp cl, 0x46
jg 0x100598bc
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x100598a8
cmp cl, 0x39
jle 0x10059921
cmp cl, 0x61
jl 0x100598b2
cmp cl, 0x66
jle 0x10059921
cmp cl, 0x41
jl 0x100598bc
cmp cl, 0x46
jle 0x10059921
cmp al, 0x21
je 0x10059921
cmp al, 0x24
je 0x10059921
cmp al, 0x26
je 0x10059921
cmp al, 0x28
je 0x10059921
cmp al, 0x29
je 0x10059921
cmp al, 0x2a
je 0x10059921
cmp al, 0x2b
je 0x10059921
cmp al, 0x2c
je 0x10059921
cmp al, 0x3b
je 0x10059921
cmp al, 0x3d
je 0x10059921
cmp al, 0x3a
je 0x10059921
cmp al, 0x40
je 0x10059921
cmp al, 0x2f
je 0x10059921
cmp al, 0x3f
je 0x10059921
test edi, edi
je 0x10059993
test byte [edi + 0x24], dl
je 0x10059933
cmp al, 0x7b
je 0x10059921
cmp al, 0x7d
je 0x10059921
cmp al, 0x7c
je 0x10059921
cmp al, 0x5c
je 0x10059921
cmp al, 0x5e
je 0x10059921
cmp al, 0x5b
je 0x10059921
cmp al, 0x5d
je 0x10059921
cmp al, 0x60
jne 0x10059933
cmp al, 0x25
jne 0x1005992d
add esi, 3
jmp 0x10059830
inc esi
jmp 0x10059830
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x10059944
push eax
call dword [sym.libxml2.dll_xmlFree]
add esp, 4
test byte [edi + 0x24], 2
mov eax, dword [ebx]
je 0x1005995c
mov ecx, esi
sub ecx, eax
push ecx
push eax
call sym.libxml2.dll_xmlStrndup
add esp, 8
jmp 0x1005996c
mov edx, esi
push 0
sub edx, eax
push edx
push eax
call sym.libxml2.dll_xmlURIUnescapeString
add esp, 0xc
mov dword [edi + 0x1c], eax
mov eax, dword [edi + 0x28]
test eax, eax
je 0x10059980
push eax
call dword [sym.libxml2.dll_xmlFree]
add esp, 4
mov eax, dword [ebx]
mov ecx, esi
sub ecx, eax
push ecx
push eax
call sym.libxml2.dll_xmlStrndup
add esp, 8
mov dword [edi + 0x28], eax
mov dword [ebx], esi
xor eax, eax
pop esi
ret
Function at 0x100599a0
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, dword [ebx]
mov al, byte [esi]
cmp al, 0x61
jl 0x100599b1
cmp al, 0x7a
jle 0x10059a4b
cmp al, 0x41
jl 0x100599bd
cmp al, 0x5a
jle 0x10059a4b
cmp al, 0x30
jl 0x100599c9
cmp al, 0x39
jle 0x10059a4b
cmp al, 0x2d
je 0x10059a4b
cmp al, 0x2e
je 0x10059a4b
cmp al, 0x5f
je 0x10059a4b
cmp al, 0x7e
je 0x10059a4b
cmp al, 0x25
jne 0x10059a1f
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x100599ea
cmp cl, 0x39
jle 0x100599fe
cmp cl, 0x61
jl 0x100599f4
cmp cl, 0x66
jle 0x100599fe
cmp cl, 0x41
jl 0x10059a1f
cmp cl, 0x46
jg 0x10059a1f
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x10059a0b
cmp cl, 0x39
jle 0x10059a4b
cmp cl, 0x61
jl 0x10059a15
cmp cl, 0x66
jle 0x10059a4b
cmp cl, 0x41
jl 0x10059a1f
cmp cl, 0x46
jle 0x10059a4b
cmp al, 0x21
je 0x10059a4b
cmp al, 0x24
je 0x10059a4b
cmp al, 0x26
je 0x10059a4b
cmp al, 0x28
je 0x10059a4b
cmp al, 0x29
je 0x10059a4b
cmp al, 0x2a
je 0x10059a4b
cmp al, 0x2b
je 0x10059a4b
cmp al, 0x2c
je 0x10059a4b
cmp al, 0x3b
je 0x10059a4b
cmp al, 0x3d
je 0x10059a4b
cmp al, 0x3a
jne 0x10059a5d
cmp al, 0x25
jne 0x10059a57
add esi, 3
jmp 0x100599a3
inc esi
jmp 0x100599a3
cmp byte [esi], 0x40
jne 0x10059aaf
test edi, edi
je 0x10059aa9
mov eax, dword [edi + 0x10]
test eax, eax
je 0x10059a77
push eax
call dword [sym.libxml2.dll_xmlFree]
add esp, 4
test byte [edi + 0x24], 2
mov eax, dword [ebx]
je 0x10059a96
mov ecx, esi
sub ecx, eax
push ecx
push eax
call sym.libxml2.dll_xmlStrndup
add esp, 8
mov dword [edi + 0x10], eax
mov dword [ebx], esi
xor eax, eax
pop esi
ret
mov edx, esi
push 0
sub edx, eax
push edx
push eax
call sym.libxml2.dll_xmlURIUnescapeString
add esp, 0xc
mov dword [edi + 0x10], eax
mov dword [ebx], esi
xor eax, eax
pop esi
ret
mov eax, 1
pop esi
ret
Function at 0x10059ac0
Capabilities:
Parse credit card information

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, dword [eax]
mov al, byte [edi]
cmp al, 0x5b
mov dword [esp + 0x10], edi
mov ebx, edi
jne 0x10059b05
mov al, byte [edi + 1]
inc edi
cmp al, 0x5d
je 0x10059aef
test al, al
je 0x10059af5
mov al, byte [edi + 1]
inc edi
cmp al, 0x5d
jne 0x10059ae3
inc edi
jmp 0x10059c16
cmp byte [edi], 0x5d
je 0x10059aef
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
cmp al, 0x30
jl 0x10059b60
cmp al, 0x39
jg 0x10059b60
lea esi, [esp + 0x10]
call fcn.100581c0
test eax, eax
jne 0x10059b60
mov ecx, dword [esp + 0x10]
cmp byte [ecx], 0x2e
jne 0x10059b60
mov edx, ecx
inc edx
mov dword [esp + 0x10], edx
call fcn.100581c0
test eax, eax
jne 0x10059b60
mov edx, dword [esp + 0x10]
cmp byte [edx], 0x2e
jne 0x10059b60
call fcn.100581c0
test eax, eax
jne 0x10059b60
mov eax, dword [esp + 0x10]
cmp byte [eax], 0x2e
jne 0x10059b60
call fcn.100581c0
test eax, eax
je 0x10059c12
jmp 0x10059b60
mov al, byte [edi]
cmp al, 0x61
jl 0x10059b6e
cmp al, 0x7a
jle 0x10059c00
cmp al, 0x41
jl 0x10059b7a
cmp al, 0x5a
jle 0x10059c00
cmp al, 0x30
jl 0x10059b82
cmp al, 0x39
jle 0x10059c00
cmp al, 0x2d
je 0x10059c00
cmp al, 0x2e
je 0x10059c00
cmp al, 0x5f
je 0x10059c00
cmp al, 0x7e
je 0x10059c00
cmp al, 0x25
jne 0x10059bd8
mov cl, byte [edi + 1]
cmp cl, 0x30
jl 0x10059ba3
cmp cl, 0x39
jle 0x10059bb7
cmp cl, 0x61
jl 0x10059bad
cmp cl, 0x66
jle 0x10059bb7
cmp cl, 0x41
jl 0x10059bd8
cmp cl, 0x46
jg 0x10059bd8
mov cl, byte [edi + 2]
cmp cl, 0x30
jl 0x10059bc4
cmp cl, 0x39
jle 0x10059c00
cmp cl, 0x61
jl 0x10059bce
cmp cl, 0x66
jle 0x10059c00
cmp cl, 0x41
jl 0x10059bd8
cmp cl, 0x46
jle 0x10059c00
cmp al, 0x21
je 0x10059c00
cmp al, 0x24
je 0x10059c00
cmp al, 0x26
je 0x10059c00
cmp al, 0x28
je 0x10059c00
cmp al, 0x29
je 0x10059c00
cmp al, 0x2a
je 0x10059c00
cmp al, 0x2b
je 0x10059c00
cmp al, 0x2c
je 0x10059c00
cmp al, 0x3b
je 0x10059c00
cmp al, 0x3d
jne 0x10059c16
cmp al, 0x25
jne 0x10059c0c
add edi, 3
jmp 0x10059b60
inc edi
jmp 0x10059b60
mov edi, dword [esp + 0x10]
xor esi, esi
cmp ebp, esi
je 0x10059c8d
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x10059c2d
push eax
call dword [sym.libxml2.dll_xmlFree]
add esp, 4
mov eax, dword [ebp + 0xc]
cmp eax, esi
mov dword [ebp + 8], esi
je 0x10059c41
push eax
call dword [sym.libxml2.dll_xmlFree]
add esp, 4
cmp edi, ebx
je 0x10059c8a
test byte [ebp + 0x24], 2
je 0x10059c6a
mov ecx, edi
sub ecx, ebx
push ecx
push ebx
call sym.libxml2.dll_xmlStrndup
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 0x24]
add esp, 8
mov dword [eax], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov edx, edi
push esi
sub edx, ebx
push edx
push ebx
call sym.libxml2.dll_xmlURIUnescapeString
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 0x28]
add esp, 0xc
mov dword [eax], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov dword [ebp + 0xc], esi
mov eax, dword [esp + 0x1c]
mov dword [eax], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x1005a010
Capabilities:
Parse credit card information

Disassembly:
push ecx
push esi
mov esi, dword [ebx]
push edi
mov edi, eax
mov al, byte [esi]
cmp al, 0x2f
mov dword [esp + 8], esi
jne 0x1005a078
cmp byte [esi + 1], 0x2f
lea eax, [esp + 8]
push eax
jne 0x1005a064
add esi, 2
mov eax, edi
mov dword [esp + 0xc], esi
call fcn.10059ca0
add esp, 4
test eax, eax
jne 0x1005a16f
lea ecx, [esp + 8]
push ecx
call fcn.10059d20
add esp, 4
test eax, eax
jne 0x1005a16f
mov edx, dword [esp + 8]
pop edi
mov dword [ebx], edx
pop esi
pop ecx
ret
call fcn.10059dc0
add esp, 4
test eax, eax
je 0x1005a167
pop edi
pop esi
pop ecx
ret
cmp al, 0x61
jl 0x1005a084
cmp al, 0x7a
jle 0x1005a156
cmp al, 0x41
jl 0x1005a090
cmp al, 0x5a
jle 0x1005a156
cmp al, 0x30
jl 0x1005a09c
cmp al, 0x39
jle 0x1005a156
cmp al, 0x2d
je 0x1005a156
cmp al, 0x2e
je 0x1005a156
cmp al, 0x5f
je 0x1005a156
cmp al, 0x7e
je 0x1005a156
cmp al, 0x25
jne 0x1005a102
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x1005a0cd
cmp cl, 0x39
jle 0x1005a0e1
cmp cl, 0x61
jl 0x1005a0d7
cmp cl, 0x66
jle 0x1005a0e1
cmp cl, 0x41
jl 0x1005a102
cmp cl, 0x46
jg 0x1005a102
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x1005a0ee
cmp cl, 0x39
jle 0x1005a156
cmp cl, 0x61
jl 0x1005a0f8
cmp cl, 0x66
jle 0x1005a156
cmp cl, 0x41
jl 0x1005a102
cmp cl, 0x46
jle 0x1005a156
cmp al, 0x21
je 0x1005a156
cmp al, 0x24
je 0x1005a156
cmp al, 0x26
je 0x1005a156
cmp al, 0x28
je 0x1005a156
cmp al, 0x29
je 0x1005a156
cmp al, 0x2a
je 0x1005a156
cmp al, 0x2b
je 0x1005a156
cmp al, 0x2c
je 0x1005a156
cmp al, 0x3b
je 0x1005a156
cmp al, 0x3d
je 0x1005a156
cmp al, 0x3a
je 0x1005a156
cmp al, 0x40
je 0x1005a156
test edi, edi
je 0x1005a16b
mov eax, dword [edi + 0x18]
test eax, eax
je 0x1005a147
push eax
call dword [sym.libxml2.dll_xmlFree]
add esp, 4
mov dword [edi + 0x18], 0
pop edi
mov dword [ebx], esi
xor eax, eax
pop esi
pop ecx
ret
lea ecx, [esp + 8]
push ecx
call fcn.10059e90
add esp, 4
test eax, eax
jne 0x1005a16f
mov esi, dword [esp + 8]
mov dword [ebx], esi
xor eax, eax
pop edi
pop esi
pop ecx
ret
Function at 0x1005a180
Capabilities:
Parse credit card information

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, eax
mov al, byte [ebx]
cmp al, 0x2f
jne 0x1005a1e2
cmp byte [ebx + 1], 0x2f
jne 0x1005a1ca
lea eax, [esp + 0xc]
push eax
add ebx, 2
mov eax, edi
mov dword [esp + 0x10], ebx
call fcn.10059ca0
add esp, 4
test eax, eax
jne 0x1005a31d
lea ecx, [esp + 0xc]
push ecx
call fcn.10059d20
add esp, 4
test eax, eax
je 0x1005a2cb
pop edi
pop ebx
ret
lea edx, [esp + 0xc]
push edx
call fcn.10059dc0
add esp, 4
test eax, eax
je 0x1005a2cb
pop edi
pop ebx
ret
cmp al, 0x61
jl 0x1005a1ee
cmp al, 0x7a
jle 0x1005a2ba
cmp al, 0x41
jl 0x1005a1fa
cmp al, 0x5a
jle 0x1005a2ba
cmp al, 0x30
jl 0x1005a206
cmp al, 0x39
jle 0x1005a2ba
cmp al, 0x2d
je 0x1005a2ba
cmp al, 0x2e
je 0x1005a2ba
cmp al, 0x5f
je 0x1005a2ba
cmp al, 0x7e
je 0x1005a2ba
cmp al, 0x25
jne 0x1005a26c
mov cl, byte [ebx + 1]
cmp cl, 0x30
jl 0x1005a237
cmp cl, 0x39
jle 0x1005a24b
cmp cl, 0x61
jl 0x1005a241
cmp cl, 0x66
jle 0x1005a24b
cmp cl, 0x41
jl 0x1005a26c
cmp cl, 0x46
jg 0x1005a26c
mov cl, byte [ebx + 2]
cmp cl, 0x30
jl 0x1005a258
cmp cl, 0x39
jle 0x1005a2ba
cmp cl, 0x61
jl 0x1005a262
cmp cl, 0x66
jle 0x1005a2ba
cmp cl, 0x41
jl 0x1005a26c
cmp cl, 0x46
jle 0x1005a2ba
cmp al, 0x21
je 0x1005a2ba
cmp al, 0x24
je 0x1005a2ba
cmp al, 0x26
je 0x1005a2ba
cmp al, 0x28
je 0x1005a2ba
cmp al, 0x29
je 0x1005a2ba
cmp al, 0x2a
je 0x1005a2ba
cmp al, 0x2b
je 0x1005a2ba
cmp al, 0x2c
je 0x1005a2ba
cmp al, 0x3b
je 0x1005a2ba
cmp al, 0x3d
je 0x1005a2ba
cmp al, 0x3a
je 0x1005a2ba
cmp al, 0x40
je 0x1005a2ba
test edi, edi
je 0x1005a2cf
mov eax, dword [edi + 0x18]
test eax, eax
je 0x1005a2b1
push eax
call dword [sym.libxml2.dll_xmlFree]
add esp, 4
mov dword [edi + 0x18], 0
jmp 0x1005a2cf
lea eax, [esp + 0xc]
push eax
call fcn.10059f50
add esp, 4
test eax, eax
jne 0x1005a31d
mov ebx, dword [esp + 0xc]
cmp byte [ebx], 0x3f
jne 0x1005a2ea
inc ebx
mov dword [esp + 0xc], ebx
lea ebx, [esp + 0xc]
call fcn.10059820
test eax, eax
jne 0x1005a31d
mov ebx, dword [esp + 0xc]
cmp byte [ebx], 0x23
jne 0x1005a305
inc ebx
mov dword [esp + 0xc], ebx
lea ebx, [esp + 0xc]
call fcn.100596c0
test eax, eax
jne 0x1005a31d
mov ebx, dword [esp + 0xc]
cmp byte [ebx], 0
je 0x1005a31b
push esi
mov esi, edi
call fcn.10059080
pop esi
pop edi
mov eax, 1
pop ebx
ret
xor eax, eax
pop edi
pop ebx
ret

Function at 0x10065a60
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x10065a9e
mov eax, dword [esp + 8]
test eax, eax
je 0x10065a9e
push esi
push ecx
mov ecx, dword [esp + 0x14]
push ecx
push 1
push eax
call dword [sym.imp.msvcrt.dll_fread]
mov esi, eax
add esp, 0x10
test esi, esi
jge 0x10065a9a
push str.fread__
push 0
push 8
call fcn.100651c0
add esp, 0xc
mov eax, esi
pop esi
ret
or eax, 0xffffffff
ret

Function at 0x10066310
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x1006632d
mov eax, dword [esp + 0xc]
test eax, eax
jl 0x1006632d
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
jmp sym.libxml2.dll_xmlNanoFTPRead
or eax, 0xffffffff
ret
Function at 0x10068390
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x100eacfc]
test eax, eax
je 0x1006839d
or eax, 0xffffffff
ret
push esi
push edi
mov dword [0x100eacfc], 1
call sym.libxml2.dll_xmlNewMutex
mov esi, dword [sym.imp.msvcrt.dll_getenv]
push str.XML_MEM_BREAKPOINT
mov dword [0x100ead0c], eax
call esi
mov edi, dword [sym.imp.msvcrt.dll_sscanf]
add esp, 4
test eax, eax
je 0x100683dd
push 0x100ead14
push 0x100ce4a4
push eax
call edi
add esp, 0xc
push str.XML_MEM_TRACE
call esi
add esp, 4
test eax, eax
je 0x100683fb
push 0x100ead18
push 0x100ce490
push eax
call edi
add esp, 0xc
pop edi
xor eax, eax
pop esi
ret
Function at 0x100725d0
Capabilities:
Parse credit card information

Disassembly:
mov eax, dword [edi + 4]
cmp byte [eax], 0x5b
jne 0x1007261e
push esi
inc eax
push 3
mov esi, edi
mov dword [edi + 4], eax
call fcn.1006da80
add esp, 4
test eax, eax
mov dword [edi + 0x1c], eax
je 0x10072607
push edi
call fcn.100724d0
mov eax, dword [edi + 4]
mov cl, byte [eax]
add esp, 4
cmp cl, 0x5d
jne 0x10072609
inc eax
mov dword [edi + 4], eax
pop esi
ret
mov esi, str.xmlFAParseCharClass:___expected
mov edx, edi
mov dword [edi + 8], 0x5aa
call fcn.1006d8e0
pop esi
ret
mov eax, edi
jmp fcn.10071dd0

Function at 0x100738d0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test edx, edx
je 0x10073905
mov cl, byte [edx]
movzx ax, cl
imul eax, eax, 0x1e
test cl, cl
je 0x10073905
push esi
push edi
xor edi, edi
mov di, ax
shr di, 3
mov esi, eax
shl esi, 5
movsx ecx, cl
inc edx
add esi, edi
add esi, ecx
mov cl, byte [edx]
xor eax, esi
test cl, cl
jne 0x100738e5
pop edi
pop esi
ret