joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10064450
Capabilities:
Parse credit card information

Disassembly:
test ebx, ebx
jne 0x10064458
or eax, 0xffffffff
ret
push esi
mov esi, dword [ebx]
mov edx, 1
mov al, byte [esi]
cmp al, 0x61
jl 0x1006446e
cmp al, 0x7a
jle 0x10064555
cmp al, 0x41
jl 0x1006447a
cmp al, 0x5a
jle 0x10064555
cmp al, 0x30
jl 0x10064486
cmp al, 0x39
jle 0x10064555
cmp al, 0x2d
je 0x10064555
cmp al, 0x2e
je 0x10064555
cmp al, 0x5f
je 0x10064555
cmp al, 0x7e
je 0x10064555
cmp al, 0x25
jne 0x100644ec
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x100644b7
cmp cl, 0x39
jle 0x100644cb
cmp cl, 0x61
jl 0x100644c1
cmp cl, 0x66
jle 0x100644cb
cmp cl, 0x41
jl 0x100644ec
cmp cl, 0x46
jg 0x100644ec
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x100644d8
cmp cl, 0x39
jle 0x10064555
cmp cl, 0x61
jl 0x100644e2
cmp cl, 0x66
jle 0x10064555
cmp cl, 0x41
jl 0x100644ec
cmp cl, 0x46
jle 0x10064555
cmp al, 0x21
je 0x10064555
cmp al, 0x24
je 0x10064555
cmp al, 0x26
je 0x10064555
cmp al, 0x28
je 0x10064555
cmp al, 0x29
je 0x10064555
cmp al, 0x2a
je 0x10064555
cmp al, 0x2b
je 0x10064555
cmp al, 0x2c
je 0x10064555
cmp al, 0x3b
je 0x10064555
cmp al, 0x3d
je 0x10064555
cmp al, 0x27
je 0x10064555
cmp al, 0x3a
je 0x10064555
cmp al, 0x40
je 0x10064555
cmp al, 0x2f
je 0x10064555
cmp al, 0x3f
je 0x10064555
test edi, edi
je 0x100645c8
test byte [edi + 0x24], dl
je 0x10064568
cmp al, 0x7b
je 0x10064555
cmp al, 0x7d
je 0x10064555
cmp al, 0x7c
je 0x10064555
cmp al, 0x5c
je 0x10064555
cmp al, 0x5e
je 0x10064555
cmp al, 0x5b
je 0x10064555
cmp al, 0x5d
je 0x10064555
cmp al, 0x60
jne 0x10064568
cmp al, 0x25
jne 0x10064561
add esi, 3
jmp 0x10064460
add esi, edx
jmp 0x10064460
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x10064579
push eax
call dword [sym.libxml2.dll_xmlFree]
add esp, 4
test byte [edi + 0x24], 2
mov eax, dword [ebx]
je 0x10064591
mov ecx, esi
sub ecx, eax
push ecx
push eax
call sym.libxml2.dll_xmlStrndup
add esp, 8
jmp 0x100645a1
mov edx, esi
push 0
sub edx, eax
push edx
push eax
call sym.libxml2.dll_xmlURIUnescapeString
add esp, 0xc
mov dword [edi + 0x1c], eax
mov eax, dword [edi + 0x28]
test eax, eax
je 0x100645b5
push eax
call dword [sym.libxml2.dll_xmlFree]
add esp, 4
mov eax, dword [ebx]
mov ecx, esi
sub ecx, eax
push ecx
push eax
call sym.libxml2.dll_xmlStrndup
add esp, 8
mov dword [edi + 0x28], eax
mov dword [ebx], esi
xor eax, eax
pop esi
ret
Function at 0x10064620
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, dword [ebx]
mov al, byte [esi]
cmp al, 0x61
jl 0x10064631
cmp al, 0x7a
jle 0x100646d3
cmp al, 0x41
jl 0x1006463d
cmp al, 0x5a
jle 0x100646d3
cmp al, 0x30
jl 0x10064649
cmp al, 0x39
jle 0x100646d3
cmp al, 0x2d
je 0x100646d3
cmp al, 0x2e
je 0x100646d3
cmp al, 0x5f
je 0x100646d3
cmp al, 0x7e
je 0x100646d3
cmp al, 0x25
jne 0x100646a3
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x1006466e
cmp cl, 0x39
jle 0x10064682
cmp cl, 0x61
jl 0x10064678
cmp cl, 0x66
jle 0x10064682
cmp cl, 0x41
jl 0x100646a3
cmp cl, 0x46
jg 0x100646a3
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x1006468f
cmp cl, 0x39
jle 0x100646d3
cmp cl, 0x61
jl 0x10064699
cmp cl, 0x66
jle 0x100646d3
cmp cl, 0x41
jl 0x100646a3
cmp cl, 0x46
jle 0x100646d3
cmp al, 0x21
je 0x100646d3
cmp al, 0x24
je 0x100646d3
cmp al, 0x26
je 0x100646d3
cmp al, 0x28
je 0x100646d3
cmp al, 0x29
je 0x100646d3
cmp al, 0x2a
je 0x100646d3
cmp al, 0x2b
je 0x100646d3
cmp al, 0x2c
je 0x100646d3
cmp al, 0x3b
je 0x100646d3
cmp al, 0x3d
je 0x100646d3
cmp al, 0x27
je 0x100646d3
cmp al, 0x3a
jne 0x100646e5
cmp al, 0x25
jne 0x100646df
add esi, 3
jmp 0x10064623
inc esi
jmp 0x10064623
cmp byte [esi], 0x40
jne 0x10064737
test edi, edi
je 0x10064731
mov eax, dword [edi + 0x10]
test eax, eax
je 0x100646ff
push eax
call dword [sym.libxml2.dll_xmlFree]
add esp, 4
test byte [edi + 0x24], 2
mov eax, dword [ebx]
je 0x1006471e
mov ecx, esi
sub ecx, eax
push ecx
push eax
call sym.libxml2.dll_xmlStrndup
add esp, 8
mov dword [edi + 0x10], eax
mov dword [ebx], esi
xor eax, eax
pop esi
ret
mov edx, esi
push 0
sub edx, eax
push edx
push eax
call sym.libxml2.dll_xmlURIUnescapeString
add esp, 0xc
mov dword [edi + 0x10], eax
mov dword [ebx], esi
xor eax, eax
pop esi
ret
mov eax, 1
pop esi
ret
Function at 0x100647d0
Capabilities:
Parse credit card information

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, dword [eax]
mov al, byte [edi]
mov dword [esp + 0x10], edi
mov ebx, edi
cmp al, 0x5b
jne 0x10064815
mov al, byte [edi + 1]
inc edi
cmp al, 0x5d
je 0x100647ff
test al, al
je 0x10064805
mov al, byte [edi + 1]
inc edi
cmp al, 0x5d
jne 0x100647f3
inc edi
jmp 0x10064926
cmp byte [edi], 0x5d
je 0x100647ff
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
cmp al, 0x30
jl 0x10064868
cmp al, 0x39
jg 0x10064868
lea esi, [esp + 0x10]
call fcn.10064740
test eax, eax
jne 0x10064868
mov ecx, dword [esp + 0x10]
cmp byte [ecx], 0x2e
jne 0x10064868
inc dword [esp + 0x10]
call fcn.10064740
test eax, eax
jne 0x10064868
mov edx, dword [esp + 0x10]
cmp byte [edx], 0x2e
jne 0x10064868
call fcn.10064740
test eax, eax
jne 0x10064868
mov eax, dword [esp + 0x10]
cmp byte [eax], 0x2e
jne 0x10064868
call fcn.10064740
test eax, eax
je 0x10064922
mov al, byte [edi]
cmp al, 0x61
jl 0x10064876
cmp al, 0x7a
jle 0x10064910
cmp al, 0x41
jl 0x10064882
cmp al, 0x5a
jle 0x10064910
cmp al, 0x30
jl 0x1006488e
cmp al, 0x39
jle 0x10064910
cmp al, 0x2d
je 0x10064910
cmp al, 0x2e
je 0x10064910
cmp al, 0x5f
je 0x10064910
cmp al, 0x7e
je 0x10064910
cmp al, 0x25
jne 0x100648e4
mov cl, byte [edi + 1]
cmp cl, 0x30
jl 0x100648af
cmp cl, 0x39
jle 0x100648c3
cmp cl, 0x61
jl 0x100648b9
cmp cl, 0x66
jle 0x100648c3
cmp cl, 0x41
jl 0x100648e4
cmp cl, 0x46
jg 0x100648e4
mov cl, byte [edi + 2]
cmp cl, 0x30
jl 0x100648d0
cmp cl, 0x39
jle 0x10064910
cmp cl, 0x61
jl 0x100648da
cmp cl, 0x66
jle 0x10064910
cmp cl, 0x41
jl 0x100648e4
cmp cl, 0x46
jle 0x10064910
cmp al, 0x21
je 0x10064910
cmp al, 0x24
je 0x10064910
cmp al, 0x26
je 0x10064910
cmp al, 0x28
je 0x10064910
cmp al, 0x29
je 0x10064910
cmp al, 0x2a
je 0x10064910
cmp al, 0x2b
je 0x10064910
cmp al, 0x2c
je 0x10064910
cmp al, 0x3b
je 0x10064910
cmp al, 0x3d
je 0x10064910
cmp al, 0x27
jne 0x10064926
cmp al, 0x25
jne 0x1006491c
add edi, 3
jmp 0x10064868
inc edi
jmp 0x10064868
mov edi, dword [esp + 0x10]
xor esi, esi
cmp ebp, esi
je 0x1006499d
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x1006493d
push eax
call dword [sym.libxml2.dll_xmlFree]
add esp, 4
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], esi
cmp eax, esi
je 0x10064951
push eax
call dword [sym.libxml2.dll_xmlFree]
add esp, 4
cmp edi, ebx
je 0x1006499a
test byte [ebp + 0x24], 2
je 0x1006497a
mov ecx, edi
sub ecx, ebx
push ecx
push ebx
call sym.libxml2.dll_xmlStrndup
add esp, 8
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 0x1c]
mov dword [eax], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov edx, edi
push esi
sub edx, ebx
push edx
push ebx
call sym.libxml2.dll_xmlURIUnescapeString
add esp, 0xc
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 0x1c]
mov dword [eax], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov dword [ebp + 0xc], esi
mov eax, dword [esp + 0x1c]
mov dword [eax], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x10064a30
Capabilities:
Parse credit card information

Disassembly:
mov edx, dword [esi]
mov al, byte [edx]
cmp al, 0x61
jl 0x10064a40
cmp al, 0x7a
jle 0x10064b00
cmp al, 0x41
jl 0x10064a4c
cmp al, 0x5a
jle 0x10064b00
cmp al, 0x30
jl 0x10064a58
cmp al, 0x39
jle 0x10064b00
cmp al, 0x2d
je 0x10064b00
cmp al, 0x2e
je 0x10064b00
cmp al, 0x5f
je 0x10064b00
cmp al, 0x7e
je 0x10064b00
cmp al, 0x25
jne 0x10064abe
mov cl, byte [edx + 1]
cmp cl, 0x30
jl 0x10064a89
cmp cl, 0x39
jle 0x10064a9d
cmp cl, 0x61
jl 0x10064a93
cmp cl, 0x66
jle 0x10064a9d
cmp cl, 0x41
jl 0x10064abe
cmp cl, 0x46
jg 0x10064abe
mov cl, byte [edx + 2]
cmp cl, 0x30
jl 0x10064aaa
cmp cl, 0x39
jle 0x10064b00
cmp cl, 0x61
jl 0x10064ab4
cmp cl, 0x66
jle 0x10064b00
cmp cl, 0x41
jl 0x10064abe
cmp cl, 0x46
jle 0x10064b00
cmp al, 0x21
je 0x10064b00
cmp al, 0x24
je 0x10064b00
cmp al, 0x26
je 0x10064b00
cmp al, 0x28
je 0x10064b00
cmp al, 0x29
je 0x10064b00
cmp al, 0x2a
je 0x10064b00
cmp al, 0x2b
je 0x10064b00
cmp al, 0x2c
je 0x10064b00
cmp al, 0x3b
je 0x10064b00
cmp al, 0x3d
je 0x10064b00
cmp al, 0x27
je 0x10064b00
cmp al, 0x3a
je 0x10064b00
cmp al, 0x40
je 0x10064b00
xor eax, eax
cmp dword [esp + 4], eax
sete al
ret
mov al, byte [edx]
cmp al, 0x61
jl 0x10064b0e
cmp al, 0x7a
jle 0x10064bb8
cmp al, 0x41
jl 0x10064b1a
cmp al, 0x5a
jle 0x10064bb8
cmp al, 0x30
jl 0x10064b26
cmp al, 0x39
jle 0x10064bb8
cmp al, 0x2d
je 0x10064bb8
cmp al, 0x2e
je 0x10064bb8
cmp al, 0x5f
je 0x10064bb8
cmp al, 0x7e
je 0x10064bb8
cmp al, 0x25
jne 0x10064b84
mov cl, byte [edx + 1]
cmp cl, 0x30
jl 0x10064b4f
cmp cl, 0x39
jle 0x10064b63
cmp cl, 0x61
jl 0x10064b59
cmp cl, 0x66
jle 0x10064b63
cmp cl, 0x41
jl 0x10064b84
cmp cl, 0x46
jg 0x10064b84
mov cl, byte [edx + 2]
cmp cl, 0x30
jl 0x10064b70
cmp cl, 0x39
jle 0x10064bb8
cmp cl, 0x61
jl 0x10064b7a
cmp cl, 0x66
jle 0x10064bb8
cmp cl, 0x41
jl 0x10064b84
cmp cl, 0x46
jle 0x10064bb8
cmp al, 0x21
je 0x10064bb8
cmp al, 0x24
je 0x10064bb8
cmp al, 0x26
je 0x10064bb8
cmp al, 0x28
je 0x10064bb8
cmp al, 0x29
je 0x10064bb8
cmp al, 0x2a
je 0x10064bb8
cmp al, 0x2b
je 0x10064bb8
cmp al, 0x2c
je 0x10064bb8
cmp al, 0x3b
je 0x10064bb8
cmp al, 0x3d
je 0x10064bb8
cmp al, 0x27
je 0x10064bb8
cmp al, 0x3a
je 0x10064bb8
cmp al, 0x40
jne 0x10064bce
cmp al, bl
je 0x10064bce
cmp al, 0x25
jne 0x10064bc8
add edx, 3
jmp 0x10064b00
inc edx
jmp 0x10064b00
mov dword [esi], edx
xor eax, eax
ret
Function at 0x10064ed0
Capabilities:
Parse credit card information

Disassembly:
push ecx
push esi
mov esi, dword [ebx]
push edi
mov edi, eax
mov al, byte [esi]
mov dword [esp + 8], esi
cmp al, 0x2f
jne 0x10064f38
cmp byte [esi + 1], 0x2f
lea eax, [esp + 8]
push eax
jne 0x10064f24
add esi, 2
mov eax, edi
mov dword [esp + 0xc], esi
call fcn.100649b0
add esp, 4
test eax, eax
jne 0x10065033
lea ecx, [esp + 8]
push ecx
call fcn.10064be0
add esp, 4
test eax, eax
jne 0x10065033
mov edx, dword [esp + 8]
pop edi
mov dword [ebx], edx
pop esi
pop ecx
ret
call fcn.10064c80
add esp, 4
test eax, eax
je 0x1006502b
pop edi
pop esi
pop ecx
ret
cmp al, 0x61
jl 0x10064f44
cmp al, 0x7a
jle 0x1006501a
cmp al, 0x41
jl 0x10064f50
cmp al, 0x5a
jle 0x1006501a
cmp al, 0x30
jl 0x10064f5c
cmp al, 0x39
jle 0x1006501a
cmp al, 0x2d
je 0x1006501a
cmp al, 0x2e
je 0x1006501a
cmp al, 0x5f
je 0x1006501a
cmp al, 0x7e
je 0x1006501a
cmp al, 0x25
jne 0x10064fc2
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x10064f8d
cmp cl, 0x39
jle 0x10064fa1
cmp cl, 0x61
jl 0x10064f97
cmp cl, 0x66
jle 0x10064fa1
cmp cl, 0x41
jl 0x10064fc2
cmp cl, 0x46
jg 0x10064fc2
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x10064fae
cmp cl, 0x39
jle 0x1006501a
cmp cl, 0x61
jl 0x10064fb8
cmp cl, 0x66
jle 0x1006501a
cmp cl, 0x41
jl 0x10064fc2
cmp cl, 0x46
jle 0x1006501a
cmp al, 0x21
je 0x1006501a
cmp al, 0x24
je 0x1006501a
cmp al, 0x26
je 0x1006501a
cmp al, 0x28
je 0x1006501a
cmp al, 0x29
je 0x1006501a
cmp al, 0x2a
je 0x1006501a
cmp al, 0x2b
je 0x1006501a
cmp al, 0x2c
je 0x1006501a
cmp al, 0x3b
je 0x1006501a
cmp al, 0x3d
je 0x1006501a
cmp al, 0x27
je 0x1006501a
cmp al, 0x3a
je 0x1006501a
cmp al, 0x40
je 0x1006501a
test edi, edi
je 0x1006502f
mov eax, dword [edi + 0x18]
test eax, eax
je 0x1006500b
push eax
call dword [sym.libxml2.dll_xmlFree]
add esp, 4
mov dword [edi + 0x18], 0
pop edi
mov dword [ebx], esi
xor eax, eax
pop esi
pop ecx
ret
lea ecx, [esp + 8]
push ecx
call fcn.10064d50
add esp, 4
test eax, eax
jne 0x10065033
mov esi, dword [esp + 8]
mov dword [ebx], esi
xor eax, eax
pop edi
pop esi
pop ecx
ret
Function at 0x10065040
Capabilities:
Parse credit card information

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, eax
mov al, byte [ebx]
cmp al, 0x2f
jne 0x100650a1
cmp byte [ebx + 1], al
jne 0x10065089
lea eax, [esp + 0xc]
push eax
add ebx, 2
mov eax, edi
mov dword [esp + 0x10], ebx
call fcn.100649b0
add esp, 4
test eax, eax
jne 0x100651e0
lea ecx, [esp + 0xc]
push ecx
call fcn.10064be0
add esp, 4
test eax, eax
je 0x1006518e
pop edi
pop ebx
ret
lea edx, [esp + 0xc]
push edx
call fcn.10064c80
add esp, 4
test eax, eax
je 0x1006518e
pop edi
pop ebx
ret
cmp al, 0x61
jl 0x100650ad
cmp al, 0x7a
jle 0x1006517d
cmp al, 0x41
jl 0x100650b9
cmp al, 0x5a
jle 0x1006517d
cmp al, 0x30
jl 0x100650c5
cmp al, 0x39
jle 0x1006517d
cmp al, 0x2d
je 0x1006517d
cmp al, 0x2e
je 0x1006517d
cmp al, 0x5f
je 0x1006517d
cmp al, 0x7e
je 0x1006517d
cmp al, 0x25
jne 0x1006512b
mov cl, byte [ebx + 1]
cmp cl, 0x30
jl 0x100650f6
cmp cl, 0x39
jle 0x1006510a
cmp cl, 0x61
jl 0x10065100
cmp cl, 0x66
jle 0x1006510a
cmp cl, 0x41
jl 0x1006512b
cmp cl, 0x46
jg 0x1006512b
mov cl, byte [ebx + 2]
cmp cl, 0x30
jl 0x10065117
cmp cl, 0x39
jle 0x1006517d
cmp cl, 0x61
jl 0x10065121
cmp cl, 0x66
jle 0x1006517d
cmp cl, 0x41
jl 0x1006512b
cmp cl, 0x46
jle 0x1006517d
cmp al, 0x21
je 0x1006517d
cmp al, 0x24
je 0x1006517d
cmp al, 0x26
je 0x1006517d
cmp al, 0x28
je 0x1006517d
cmp al, 0x29
je 0x1006517d
cmp al, 0x2a
je 0x1006517d
cmp al, 0x2b
je 0x1006517d
cmp al, 0x2c
je 0x1006517d
cmp al, 0x3b
je 0x1006517d
cmp al, 0x3d
je 0x1006517d
cmp al, 0x27
je 0x1006517d
cmp al, 0x3a
je 0x1006517d
cmp al, 0x40
je 0x1006517d
test edi, edi
je 0x10065192
mov eax, dword [edi + 0x18]
test eax, eax
je 0x10065174
push eax
call dword [sym.libxml2.dll_xmlFree]
add esp, 4
mov dword [edi + 0x18], 0
jmp 0x10065192
lea eax, [esp + 0xc]
push eax
call fcn.10064e10
add esp, 4
test eax, eax
jne 0x100651e0
mov ebx, dword [esp + 0xc]
cmp byte [ebx], 0x3f
jne 0x100651ad
inc ebx
mov dword [esp + 0xc], ebx
lea ebx, [esp + 0xc]
call fcn.10064450
test eax, eax
jne 0x100651e0
mov ebx, dword [esp + 0xc]
cmp byte [ebx], 0x23
jne 0x100651c8
inc ebx
mov dword [esp + 0xc], ebx
lea ebx, [esp + 0xc]
call fcn.100642f0
test eax, eax
jne 0x100651e0
mov ebx, dword [esp + 0xc]
cmp byte [ebx], 0
je 0x100651de
push esi
mov esi, edi
call fcn.10066010
pop esi
pop edi
mov eax, 1
pop ebx
ret
xor eax, eax
pop edi
pop ebx
ret
Function at 0x10072260
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x1007229e
mov eax, dword [esp + 8]
test eax, eax
je 0x1007229e
push esi
push ecx
mov ecx, dword [esp + 0x14]
push ecx
push 1
push eax
call dword [sym.imp.MSVCR90.dll_fread]
mov esi, eax
add esp, 0x10
test esi, esi
jge 0x1007229a
push str.fread__
push 8
xor eax, eax
call fcn.10071a30
add esp, 8
mov eax, esi
pop esi
ret
or eax, 0xffffffff
ret

Function at 0x10072800
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x1007281d
mov eax, dword [esp + 0xc]
test eax, eax
jl 0x1007281d
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
jmp sym.libxml2.dll_xmlNanoFTPRead
or eax, 0xffffffff
ret

Function at 0x10074fc0
Capabilities:
Query environment variable

Disassembly:
cmp dword [0x1010c2b0], 0
je 0x10074fcd
or eax, 0xffffffff
ret
push esi
push edi
push 4
mov dword [0x1010c2b0], 1
call dword [sym.imp.MSVCR90.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x10074ffa
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
mov eax, esi
mov esi, dword [sym.imp.MSVCR90.dll_getenv]
push str.XML_MEM_BREAKPOINT
mov dword [0x1010c2c0], eax
call esi
mov edi, dword [sym.imp.MSVCR90.dll_sscanf]
add esp, 4
test eax, eax
je 0x10075029
push 0x1010c2c8
push 0x100e255c
push eax
call edi
add esp, 0xc
push str.XML_MEM_TRACE
call esi
add esp, 4
test eax, eax
je 0x10075047
push 0x1010c2cc
push 0x100e2570
push eax
call edi
add esp, 0xc
pop edi
xor eax, eax
pop esi
ret
Function at 0x1007ff70
Capabilities:
Parse credit card information

Disassembly:
push edi
mov edi, eax
mov eax, dword [edi + 4]
cmp byte [eax], 0x5b
jne 0x1007ffbe
inc eax
push 3
mov dword [edi + 4], eax
call fcn.1007af00
add esp, 4
mov dword [edi + 0x1c], eax
test eax, eax
je 0x1007ffa5
push edi
call fcn.1007feb0
mov eax, dword [edi + 4]
add esp, 4
cmp byte [eax], 0x5d
jne 0x1007ffa7
inc eax
mov dword [edi + 4], eax
pop edi
ret
push esi
mov esi, str.xmlFAParseCharClass:___expected
mov edx, edi
mov dword [edi + 8], 0x5aa
call fcn.1007a710
pop esi
pop edi
ret
mov eax, edi
pop edi
jmp fcn.1007f7d0
Function at 0x100b3320
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
sub esp, 8
push ebx
xor ebx, ebx
cmp dword [esp + 0x10], ebx
je 0x100b3455
cmp ecx, ebx
jl 0x100b3455
cmp eax, ebx
je 0x100b3455
push ebp
push esi
push edi
xor edi, edi
xor ebp, ebp
xor esi, esi
mov byte [esp + 0x12], bl
mov byte [esp + 0x11], bl
mov byte [esp + 0x10], bl
xor edx, edx
nop
cmp esi, ecx
jge 0x100b3372
mov bl, byte [esi + eax]
mov byte [esp + edx + 0x10], bl
inc edx
inc esi
cmp edx, 3
jl 0x100b3360
xor ebx, ebx
cmp edx, ebx
jle 0x100b3438
movzx eax, byte [esp + 0x10]
mov ecx, eax
shr ecx, 2
movzx ecx, byte [ecx + 0x100fa150]
mov byte [esp + 0x14], cl
movzx ecx, byte [esp + 0x11]
and eax, 3
mov ebx, ecx
shl eax, 4
shr ebx, 4
or ebx, eax
movzx eax, byte [ebx + 0x100fa150]
mov byte [esp + 0x15], al
movzx eax, byte [esp + 0x12]
and ecx, 0xf
mov ebx, eax
add ecx, ecx
add ecx, ecx
shr ebx, 6
or ebx, ecx
movzx ecx, byte [ebx + 0x100fa150]
and eax, 0x3f
cmp edx, 3
movzx eax, byte [eax + 0x100fa150]
mov byte [esp + 0x16], cl
mov byte [esp + 0x17], al
jge 0x100b33ee
cmp edx, 2
mov al, 0x3d
mov byte [esp + 0x17], al
jge 0x100b33ee
mov byte [esp + 0x16], al
cmp edi, 0x48
jl 0x100b3410
mov ecx, dword [esp + 0x1c]
push 0x100da944
push 2
push ecx
call sym.libxml2.dll_xmlOutputBufferWrite
add esp, 0xc
cmp eax, 0xffffffff
je 0x100b344a
add ebp, eax
xor edi, edi
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x14]
push edx
push 4
push eax
call sym.libxml2.dll_xmlOutputBufferWrite
add esp, 0xc
cmp eax, 0xffffffff
je 0x100b344a
mov ecx, dword [esp + 0x20]
add ebp, eax
mov eax, dword [esp + 0x24]
add edi, 4
xor ebx, ebx
cmp esi, ecx
jl 0x100b3351
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 8
ret
or eax, 0xffffffff
pop ebx
add esp, 8
ret
Function at 0x100ca320
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x100ca32a
repz ret
jmp fcn.100ca6f0
Function at 0x402e24
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push 0
mov eax, dword [ebp + 8]
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
push eax
push dword [ebp + 0x14]
call sub.kernel32.dll_WriteFile
test eax, eax
setne al
movsx eax, al
push eax
call fcn.00402cc4
mov esi, eax
cmp dword [0x407e8c], 0xffffffff
je 0x402e85
mov eax, dword [ebp + 0x14]
cmp eax, dword [0x407e88]
jne 0x402e85
lea eax, [ebp - 0x1c]
push eax
push dword [0x407e88]
call sub.kernel32.dll_GetConsoleScreenBufferInfo
movsx eax, word [ebp - 0x18]
mov dword [0x407e94], eax
movsx eax, word [ebp - 0x16]
mov dword [0x407e98], eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x402f9c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38c
push esi
push edi
mov edi, 3
push 0x4089c0
call fcn.00406020
mov esi, dword [eax]
push 0x4089c0
call fcn.00406020
mov dword [eax], 0x40
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x38c]
push eax
push 0
call fcn.00405888
call fcn.00405704
lea eax, [ebp - 0x150]
push eax
push 1
call fcn.00405790
call fcn.00404428
test eax, eax
jne 0x4030dd
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x190]
push eax
push 0x40
push 0
call fcn.00405868
call fcn.00404428
test eax, eax
jne 0x403053
cmp word [ebp - 0x190], 0x5a4d
jne 0x403053
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x154]
call fcn.004057ac
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x190]
push eax
push 2
push 0
call fcn.00405868
jmp 0x40305d
mov dword [ebp - 0x154], 0
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x154]
call fcn.004057ac
call fcn.00404428
test eax, eax
jne 0x4030c1
cmp word [ebp - 0x190], 0x4550
jne 0x4030c1
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x288]
push eax
push 0xf8
push 0
call fcn.00405868
call fcn.00404428
test eax, eax
jne 0x4030c1
cmp dword [ebp - 0x288], 0x4550
jne 0x4030c1
cmp word [ebp - 0x22c], 3
jne 0x4030c1
mov edi, 2
lea eax, [ebp - 0x150]
push eax
call fcn.004057dc
push 0x4089b8
call fcn.00406020
mov dword [eax], 0
push 0x4089c0
call fcn.00406020
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x403134
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 8]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 0x18]
push dword [ebp + 0x1c]
call sub.kernel32.dll_CreateThread
mov esi, eax
push esi
call sub.kernel32.dll_CloseHandle
test esi, esi
setne al
movsx eax, al
push eax
call fcn.00402cc4
mov esi, eax
mov eax, esi
pop esi
pop ebp
ret 0x18
Function at 0x4031d8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
cmp dword [0x407f2c], 0
je 0x4031fa
mov eax, dword [0x407f2c]
mov dword [ebp - 4], eax
jmp 0x40328f
push 0x104
call fcn.004044fc
mov dword [ebp - 4], eax
push 0x104
push dword [ebp - 4]
push 0
call sub.kernel32.dll_GetModuleFileNameA
push dword [ebp - 4]
call fcn.00403fc4
inc eax
mov ebx, eax
call sub.kernel32.dll_GetCommandLineA
mov esi, eax
mov al, byte [esi]
dec al
cmp al, 0x1f
jbe 0x40323f
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.00403170
mov esi, eax
inc esi
push esi
call fcn.00403fc4
inc eax
mov edi, eax
lea eax, [ebp - 4]
push eax
mov eax, ebx
add eax, edi
inc eax
push eax
call fcn.0040455c
call sub.kernel32.dll_AreFileApisANSI
test eax, eax
jne 0x403270
push edi
mov eax, dword [ebp - 4]
add eax, ebx
push eax
push esi
call sub.user32.dll_CharToOemBuffA
jmp 0x40327d
push esi
mov eax, dword [ebp - 4]
add eax, ebx
push eax
push edi
call fcn.00404d3c
mov eax, dword [ebp - 4]
add eax, ebx
add eax, edi
mov byte [eax], 0
mov eax, dword [ebp - 4]
mov dword [0x407f2c], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40336c
Capabilities:
Contain obfuscated stackstrings
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov dword [ebp - 0x24], 0x52414853
mov dword [ebp - 0x20], 0x454d4445
mov dword [ebp - 0x1c], 0x5356354d
call sub.kernel32.dll_GetCurrentProcessId
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0xb
call fcn.00404cb0
xor eax, eax
mov bl, 0
cmp dword [0x407ed0], 0
jne 0x4033ba
push 0x407c20
push 1
call fcn.00402bd0
mov dword [0x407ed0], eax
cmp dword [0x407ed0], 0
jne 0x4033d3
push 0x8000
call fcn.004044fc
mov esi, eax
mov bl, 1
jmp 0x40340d
lea eax, [ebp - 0x24]
push eax
push 0
push 6
call dword [0x407ed0]
test eax, eax
jne 0x4033fd
lea eax, [ebp - 0x24]
push eax
push 0x8000
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov bl, 1
push 0
push 0
push 0
push 6
push eax
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
test bl, bl
je 0x403436
push esi
push 0x8000
push 0xff
call fcn.00404d98
push esi
push 0x24
push 0
call fcn.00404d98
mov eax, esi
add eax, 0xc
push eax
call fcn.004045e4
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret