joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10288b40
Capabilities:
Parse credit card information

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
jne 0x10288b4e
or eax, 0xffffffff
pop ebx
ret
push esi
mov esi, dword [ebx]
push edi
mov edi, dword [esp + 0x10]
mov al, byte [esi]
cmp al, 0x61
jl 0x10288b64
cmp al, 0x7a
jle 0x10288c48
cmp al, 0x41
jl 0x10288b70
cmp al, 0x5a
jle 0x10288c48
cmp al, 0x30
jl 0x10288b7c
cmp al, 0x39
jle 0x10288c48
cmp al, 0x2d
je 0x10288c48
cmp al, 0x2e
je 0x10288c48
cmp al, 0x5f
je 0x10288c48
cmp al, 0x7e
je 0x10288c48
cmp al, 0x25
jne 0x10288be2
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x10288bad
cmp cl, 0x39
jle 0x10288bc1
cmp cl, 0x61
jl 0x10288bb7
cmp cl, 0x66
jle 0x10288bc1
cmp cl, 0x41
jl 0x10288be2
cmp cl, 0x46
jg 0x10288be2
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x10288bce
cmp cl, 0x39
jle 0x10288c48
cmp cl, 0x61
jl 0x10288bd8
cmp cl, 0x66
jle 0x10288c48
cmp cl, 0x41
jl 0x10288be2
cmp cl, 0x46
jle 0x10288c48
cmp al, 0x21
je 0x10288c48
cmp al, 0x24
je 0x10288c48
cmp al, 0x26
je 0x10288c48
cmp al, 0x28
je 0x10288c48
cmp al, 0x29
je 0x10288c48
cmp al, 0x2a
je 0x10288c48
cmp al, 0x2b
je 0x10288c48
cmp al, 0x2c
je 0x10288c48
cmp al, 0x3b
je 0x10288c48
cmp al, 0x3d
je 0x10288c48
cmp al, 0x27
je 0x10288c48
cmp al, 0x3a
je 0x10288c48
cmp al, 0x40
je 0x10288c48
cmp al, 0x2f
je 0x10288c48
cmp al, 0x3f
je 0x10288c48
cmp al, 0x5b
je 0x10288c48
cmp al, 0x5d
je 0x10288c48
test edi, edi
je 0x10288c9b
test byte [edi + 0x24], 1
je 0x10288c5a
cmp al, 0x7b
je 0x10288c48
cmp al, 0x7d
je 0x10288c48
cmp al, 0x7c
je 0x10288c48
cmp al, 0x5c
je 0x10288c48
cmp al, 0x5e
je 0x10288c48
cmp al, 0x60
jne 0x10288c5a
cmp al, 0x25
jne 0x10288c54
add esi, 3
jmp 0x10288b56
inc esi
jmp 0x10288b56
mov eax, dword [edi + 0x20]
test eax, eax
je 0x10288c6b
push eax
call dword [sym.php5.dll_xmlFree]
add esp, 4
mov ecx, dword [ebx]
mov eax, esi
sub eax, ecx
test byte [edi + 0x24], 2
je 0x10288c8c
push eax
push ecx
call sym.php5.dll_xmlStrndup
add esp, 8
mov dword [edi + 0x20], eax
pop edi
mov dword [ebx], esi
pop esi
xor eax, eax
pop ebx
ret
push 0
push eax
push ecx
call sym.php5.dll_xmlURIUnescapeString
add esp, 0xc
mov dword [edi + 0x20], eax
pop edi
mov dword [ebx], esi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x10288cb0
Capabilities:
Parse credit card information

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [ebx]
push edi
mov al, byte [esi]
mov dword [esp + 0x14], esi
cmp al, 0x2f
jne 0x10288d30
cmp byte [esi + 1], 0x2f
lea eax, [esp + 0x14]
push eax
jne 0x10288d18
add esi, 2
mov dword [esp + 0x18], esi
mov esi, dword [esp + 0x14]
push esi
call fcn.10288a20
add esp, 8
test eax, eax
jne 0x10288e33
cmp dword [esi + 0xc], eax
jne 0x10288cf6
mov dword [esi + 0x14], 0xffffffff
lea eax, [esp + 0x14]
push eax
push esi
call fcn.10289050
add esp, 8
test eax, eax
jne 0x10288e33
mov eax, dword [esp + 0x14]
pop edi
mov dword [ebx], eax
pop esi
xor eax, eax
pop ebx
ret
push dword [esp + 0x14]
call fcn.102890f0
add esp, 8
test eax, eax
je 0x10288e2b
pop edi
pop esi
pop ebx
ret
cmp al, 0x61
jl 0x10288d3c
cmp al, 0x7a
jle 0x10288e16
cmp al, 0x41
jl 0x10288d48
cmp al, 0x5a
jle 0x10288e16
cmp al, 0x30
jl 0x10288d54
cmp al, 0x39
jle 0x10288e16
cmp al, 0x2d
je 0x10288e16
cmp al, 0x2e
je 0x10288e16
cmp al, 0x5f
je 0x10288e16
cmp al, 0x7e
je 0x10288e16
cmp al, 0x25
jne 0x10288dba
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x10288d85
cmp cl, 0x39
jle 0x10288d99
cmp cl, 0x61
jl 0x10288d8f
cmp cl, 0x66
jle 0x10288d99
cmp cl, 0x41
jl 0x10288dba
cmp cl, 0x46
jg 0x10288dba
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x10288da6
cmp cl, 0x39
jle 0x10288e16
cmp cl, 0x61
jl 0x10288db0
cmp cl, 0x66
jle 0x10288e16
cmp cl, 0x41
jl 0x10288dba
cmp cl, 0x46
jle 0x10288e16
cmp al, 0x21
je 0x10288e16
cmp al, 0x24
je 0x10288e16
cmp al, 0x26
je 0x10288e16
cmp al, 0x28
je 0x10288e16
cmp al, 0x29
je 0x10288e16
cmp al, 0x2a
je 0x10288e16
cmp al, 0x2b
je 0x10288e16
cmp al, 0x2c
je 0x10288e16
cmp al, 0x3b
je 0x10288e16
cmp al, 0x3d
je 0x10288e16
cmp al, 0x27
je 0x10288e16
cmp al, 0x3a
je 0x10288e16
cmp al, 0x40
je 0x10288e16
mov edi, dword [esp + 0x10]
test edi, edi
je 0x10288e2f
mov eax, dword [edi + 0x18]
test eax, eax
je 0x10288e07
push eax
call dword [sym.php5.dll_xmlFree]
add esp, 4
mov dword [edi + 0x18], 0
pop edi
mov dword [ebx], esi
pop esi
xor eax, eax
pop ebx
ret
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
call fcn.10289270
add esp, 8
test eax, eax
jne 0x10288e33
mov esi, dword [esp + 0x14]
mov dword [ebx], esi
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x10288e40
Capabilities:
Parse credit card information

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [ebp]
mov dword [esp + 0x14], esi
mov al, byte [esi]
mov ebx, esi
cmp al, 0x5b
jne 0x10288ee0
mov al, byte [esi + 1]
inc esi
cmp al, 0x5d
je 0x10288e6e
test al, al
je 0x10288ed2
mov al, byte [esi + 1]
inc esi
cmp al, 0x5d
jne 0x10288e62
inc esi
push edi
mov edi, dword [esp + 0x14]
test edi, edi
je 0x1028903b
mov eax, dword [edi + 8]
test eax, eax
je 0x10288e8d
push eax
call dword [sym.php5.dll_xmlFree]
add esp, 4
mov eax, dword [edi + 0xc]
mov dword [edi + 8], 0
test eax, eax
je 0x10288ea5
push eax
call dword [sym.php5.dll_xmlFree]
add esp, 4
cmp esi, ebx
je 0x10289034
mov eax, esi
sub eax, ebx
test byte [edi + 0x24], 2
je 0x1028901b
push eax
push ebx
call sym.php5.dll_xmlStrndup
add esp, 8
mov dword [edi + 0xc], eax
pop edi
mov dword [ebp], esi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
cmp byte [esi], 0x5d
je 0x10288e6e
pop esi
pop ebp
mov eax, 1
pop ebx
ret
cmp al, 0x30
jl 0x10288f55
cmp al, 0x39
jg 0x10288f55
lea eax, [esp + 0x14]
push eax
call fcn.10288aa0
add esp, 4
test eax, eax
jne 0x10288f55
mov eax, dword [esp + 0x14]
cmp byte [eax], 0x2e
jne 0x10288f55
inc eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
call fcn.10288aa0
add esp, 4
test eax, eax
jne 0x10288f55
mov eax, dword [esp + 0x14]
cmp byte [eax], 0x2e
jne 0x10288f55
lea eax, [esp + 0x14]
push eax
call fcn.10288aa0
add esp, 4
test eax, eax
jne 0x10288f55
mov eax, dword [esp + 0x14]
cmp byte [eax], 0x2e
jne 0x10288f55
lea eax, [esp + 0x14]
push eax
call fcn.10288aa0
add esp, 4
test eax, eax
jne 0x10288f55
mov esi, dword [esp + 0x14]
jmp 0x10288e6f
mov al, byte [esi]
cmp al, 0x61
jl 0x10288f63
cmp al, 0x7a
jle 0x10289009
cmp al, 0x41
jl 0x10288f6f
cmp al, 0x5a
jle 0x10289009
cmp al, 0x30
jl 0x10288f7b
cmp al, 0x39
jle 0x10289009
cmp al, 0x2d
je 0x10289009
cmp al, 0x2e
je 0x10289009
cmp al, 0x5f
je 0x10289009
cmp al, 0x7e
je 0x10289009
cmp al, 0x25
jne 0x10288fd9
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x10288fa4
cmp cl, 0x39
jle 0x10288fb8
cmp cl, 0x61
jl 0x10288fae
cmp cl, 0x66
jle 0x10288fb8
cmp cl, 0x41
jl 0x10288fd9
cmp cl, 0x46
jg 0x10288fd9
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x10288fc5
cmp cl, 0x39
jle 0x10289009
cmp cl, 0x61
jl 0x10288fcf
cmp cl, 0x66
jle 0x10289009
cmp cl, 0x41
jl 0x10288fd9
cmp cl, 0x46
jle 0x10289009
cmp al, 0x21
je 0x10289009
cmp al, 0x24
je 0x10289009
cmp al, 0x26
je 0x10289009
cmp al, 0x28
je 0x10289009
cmp al, 0x29
je 0x10289009
cmp al, 0x2a
je 0x10289009
cmp al, 0x2b
je 0x10289009
cmp al, 0x2c
je 0x10289009
cmp al, 0x3b
je 0x10289009
cmp al, 0x3d
je 0x10289009
cmp al, 0x27
jne 0x10288e6f
cmp al, 0x25
jne 0x10289015
add esi, 3
jmp 0x10288f55
inc esi
jmp 0x10288f55
push 0
push eax
push ebx
call sym.php5.dll_xmlURIUnescapeString
add esp, 0xc
mov dword [edi + 0xc], eax
pop edi
mov dword [ebp], esi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov dword [edi + 0xc], 0
pop edi
mov dword [ebp], esi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x10289390
Capabilities:
Parse credit card information

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
jne 0x1028939e
or eax, 0xffffffff
pop ebx
ret
push esi
mov esi, dword [ebx]
push edi
mov edi, dword [esp + 0x10]
mov al, byte [esi]
cmp al, 0x61
jl 0x102893b4
cmp al, 0x7a
jle 0x1028949c
cmp al, 0x41
jl 0x102893c0
cmp al, 0x5a
jle 0x1028949c
cmp al, 0x30
jl 0x102893cc
cmp al, 0x39
jle 0x1028949c
cmp al, 0x2d
je 0x1028949c
cmp al, 0x2e
je 0x1028949c
cmp al, 0x5f
je 0x1028949c
cmp al, 0x7e
je 0x1028949c
cmp al, 0x25
jne 0x10289432
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x102893fd
cmp cl, 0x39
jle 0x10289411
cmp cl, 0x61
jl 0x10289407
cmp cl, 0x66
jle 0x10289411
cmp cl, 0x41
jl 0x10289432
cmp cl, 0x46
jg 0x10289432
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x1028941e
cmp cl, 0x39
jle 0x1028949c
cmp cl, 0x61
jl 0x10289428
cmp cl, 0x66
jle 0x1028949c
cmp cl, 0x41
jl 0x10289432
cmp cl, 0x46
jle 0x1028949c
cmp al, 0x21
je 0x1028949c
cmp al, 0x24
je 0x1028949c
cmp al, 0x26
je 0x1028949c
cmp al, 0x28
je 0x1028949c
cmp al, 0x29
je 0x1028949c
cmp al, 0x2a
je 0x1028949c
cmp al, 0x2b
je 0x1028949c
cmp al, 0x2c
je 0x1028949c
cmp al, 0x3b
je 0x1028949c
cmp al, 0x3d
je 0x1028949c
cmp al, 0x27
je 0x1028949c
cmp al, 0x3a
je 0x1028949c
cmp al, 0x40
je 0x1028949c
cmp al, 0x2f
je 0x1028949c
cmp al, 0x3f
je 0x1028949c
test edi, edi
je 0x1028950a
test byte [edi + 0x24], 1
je 0x102894ae
cmp al, 0x7b
je 0x1028949c
cmp al, 0x7d
je 0x1028949c
cmp al, 0x7c
je 0x1028949c
cmp al, 0x5c
je 0x1028949c
cmp al, 0x5e
je 0x1028949c
cmp al, 0x5b
je 0x1028949c
cmp al, 0x5d
je 0x1028949c
cmp al, 0x60
jne 0x102894ae
cmp al, 0x25
jne 0x102894a8
add esi, 3
jmp 0x102893a6
inc esi
jmp 0x102893a6
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x102894bf
push eax
call dword [sym.php5.dll_xmlFree]
add esp, 4
mov ecx, dword [ebx]
mov eax, esi
sub eax, ecx
test byte [edi + 0x24], 2
je 0x102894d7
push eax
push ecx
call sym.php5.dll_xmlStrndup
add esp, 8
jmp 0x102894e3
push 0
push eax
push ecx
call sym.php5.dll_xmlURIUnescapeString
add esp, 0xc
mov dword [edi + 0x1c], eax
mov eax, dword [edi + 0x28]
test eax, eax
je 0x102894f7
push eax
call dword [sym.php5.dll_xmlFree]
add esp, 4
mov ecx, dword [ebx]
mov eax, esi
sub eax, ecx
push eax
push ecx
call sym.php5.dll_xmlStrndup
add esp, 8
mov dword [edi + 0x28], eax
pop edi
mov dword [ebx], esi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x10289520
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov al, byte [esi]
cmp al, 0x2f
jne 0x1028957f
cmp byte [esi + 1], 0x2f
mov edi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push edi
jne 0x1028956c
add esi, 2
mov dword [esp + 0x18], esi
call fcn.10288a20
add esp, 8
test eax, eax
jne 0x102896d1
lea eax, [esp + 0x10]
push eax
push edi
call fcn.10289050
add esp, 8
test eax, eax
je 0x10289675
pop edi
pop esi
ret
call fcn.102890f0
add esp, 8
test eax, eax
je 0x10289675
pop edi
pop esi
ret
cmp al, 0x61
jl 0x1028958b
cmp al, 0x7a
jle 0x1028965f
cmp al, 0x41
jl 0x10289597
cmp al, 0x5a
jle 0x1028965f
cmp al, 0x30
jl 0x102895a3
cmp al, 0x39
jle 0x1028965f
cmp al, 0x2d
je 0x1028965f
cmp al, 0x2e
je 0x1028965f
cmp al, 0x5f
je 0x1028965f
cmp al, 0x7e
je 0x1028965f
cmp al, 0x25
jne 0x10289609
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x102895d4
cmp cl, 0x39
jle 0x102895e8
cmp cl, 0x61
jl 0x102895de
cmp cl, 0x66
jle 0x102895e8
cmp cl, 0x41
jl 0x10289609
cmp cl, 0x46
jg 0x10289609
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x102895f5
cmp cl, 0x39
jle 0x1028965f
cmp cl, 0x61
jl 0x102895ff
cmp cl, 0x66
jle 0x1028965f
cmp cl, 0x41
jl 0x10289609
cmp cl, 0x46
jle 0x1028965f
cmp al, 0x21
je 0x1028965f
cmp al, 0x24
je 0x1028965f
cmp al, 0x26
je 0x1028965f
cmp al, 0x28
je 0x1028965f
cmp al, 0x29
je 0x1028965f
cmp al, 0x2a
je 0x1028965f
cmp al, 0x2b
je 0x1028965f
cmp al, 0x2c
je 0x1028965f
cmp al, 0x3b
je 0x1028965f
cmp al, 0x3d
je 0x1028965f
cmp al, 0x27
je 0x1028965f
cmp al, 0x3a
je 0x1028965f
cmp al, 0x40
je 0x1028965f
mov edi, dword [esp + 0xc]
test edi, edi
je 0x10289679
mov eax, dword [edi + 0x18]
test eax, eax
je 0x10289656
push eax
call dword [sym.php5.dll_xmlFree]
add esp, 4
mov dword [edi + 0x18], 0
jmp 0x10289679
mov edi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push edi
call fcn.102891b0
add esp, 8
test eax, eax
jne 0x102896d1
mov esi, dword [esp + 0x10]
cmp byte [esi], 0x3f
jne 0x10289699
lea eax, [esp + 0x10]
push eax
inc esi
push edi
mov dword [esp + 0x18], esi
call fcn.10289390
add esp, 8
test eax, eax
jne 0x102896d1
mov esi, dword [esp + 0x10]
cmp byte [esi], 0x23
jne 0x102896b9
lea eax, [esp + 0x10]
push eax
inc esi
push edi
mov dword [esp + 0x18], esi
call fcn.10288b40
add esp, 8
test eax, eax
jne 0x102896d1
mov esi, dword [esp + 0x10]
cmp byte [esi], 0
je 0x102896cf
push edi
call fcn.102886a0
add esp, 4
mov eax, 1
pop edi
pop esi
ret
xor eax, eax
pop edi
pop esi
ret
Function at 0x10289770
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, dword [esp + 8]
mov edx, dword [esi]
mov al, byte [edx]
cmp al, 0x61
jl 0x10289785
cmp al, 0x7a
jle 0x10289842
cmp al, 0x41
jl 0x10289791
cmp al, 0x5a
jle 0x10289842
cmp al, 0x30
jl 0x1028979d
cmp al, 0x39
jle 0x10289842
cmp al, 0x2d
je 0x10289842
cmp al, 0x2e
je 0x10289842
cmp al, 0x5f
je 0x10289842
cmp al, 0x7e
je 0x10289842
cmp al, 0x25
jne 0x10289803
mov cl, byte [edx + 1]
cmp cl, 0x30
jl 0x102897ce
cmp cl, 0x39
jle 0x102897e2
cmp cl, 0x61
jl 0x102897d8
cmp cl, 0x66
jle 0x102897e2
cmp cl, 0x41
jl 0x10289803
cmp cl, 0x46
jg 0x10289803
mov cl, byte [edx + 2]
cmp cl, 0x30
jl 0x102897ef
cmp cl, 0x39
jle 0x10289842
cmp cl, 0x61
jl 0x102897f9
cmp cl, 0x66
jle 0x10289842
cmp cl, 0x41
jl 0x10289803
cmp cl, 0x46
jle 0x10289842
cmp al, 0x21
je 0x10289842
cmp al, 0x24
je 0x10289842
cmp al, 0x26
je 0x10289842
cmp al, 0x28
je 0x10289842
cmp al, 0x29
je 0x10289842
cmp al, 0x2a
je 0x10289842
cmp al, 0x2b
je 0x10289842
cmp al, 0x2c
je 0x10289842
cmp al, 0x3b
je 0x10289842
cmp al, 0x3d
je 0x10289842
cmp al, 0x27
je 0x10289842
cmp al, 0x3a
je 0x10289842
cmp al, 0x40
je 0x10289842
xor eax, eax
cmp dword [esp + 0x10], eax
pop esi
sete al
ret
push ebx
mov bl, byte [esp + 0x10]
mov al, byte [edx]
cmp al, 0x61
jl 0x10289855
cmp al, 0x7a
jle 0x10289903
cmp al, 0x41
jl 0x10289861
cmp al, 0x5a
jle 0x10289903
cmp al, 0x30
jl 0x1028986d
cmp al, 0x39
jle 0x10289903
cmp al, 0x2d
je 0x10289903
cmp al, 0x2e
je 0x10289903
cmp al, 0x5f
je 0x10289903
cmp al, 0x7e
je 0x10289903
cmp al, 0x25
jne 0x102898cf
mov cl, byte [edx + 1]
cmp cl, 0x30
jl 0x1028989a
cmp cl, 0x39
jle 0x102898ae
cmp cl, 0x61
jl 0x102898a4
cmp cl, 0x66
jle 0x102898ae
cmp cl, 0x41
jl 0x102898cf
cmp cl, 0x46
jg 0x102898cf
mov cl, byte [edx + 2]
cmp cl, 0x30
jl 0x102898bb
cmp cl, 0x39
jle 0x10289903
cmp cl, 0x61
jl 0x102898c5
cmp cl, 0x66
jle 0x10289903
cmp cl, 0x41
jl 0x102898cf
cmp cl, 0x46
jle 0x10289903
cmp al, 0x21
je 0x10289903
cmp al, 0x24
je 0x10289903
cmp al, 0x26
je 0x10289903
cmp al, 0x28
je 0x10289903
cmp al, 0x29
je 0x10289903
cmp al, 0x2a
je 0x10289903
cmp al, 0x2b
je 0x10289903
cmp al, 0x2c
je 0x10289903
cmp al, 0x3b
je 0x10289903
cmp al, 0x3d
je 0x10289903
cmp al, 0x27
je 0x10289903
cmp al, 0x3a
je 0x10289903
cmp al, 0x40
jne 0x10289919
cmp al, bl
je 0x10289919
cmp al, 0x25
jne 0x10289913
add edx, 3
jmp 0x10289847
inc edx
jmp 0x10289847
pop ebx
mov dword [esi], edx
xor eax, eax
pop esi
ret
Function at 0x102899c0
Capabilities:
Parse credit card information

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [ebx]
mov al, byte [esi]
cmp al, 0x61
jl 0x102899d6
cmp al, 0x7a
jle 0x10289a78
cmp al, 0x41
jl 0x102899e2
cmp al, 0x5a
jle 0x10289a78
cmp al, 0x30
jl 0x102899ee
cmp al, 0x39
jle 0x10289a78
cmp al, 0x2d
je 0x10289a78
cmp al, 0x2e
je 0x10289a78
cmp al, 0x5f
je 0x10289a78
cmp al, 0x7e
je 0x10289a78
cmp al, 0x25
jne 0x10289a48
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x10289a13
cmp cl, 0x39
jle 0x10289a27
cmp cl, 0x61
jl 0x10289a1d
cmp cl, 0x66
jle 0x10289a27
cmp cl, 0x41
jl 0x10289a48
cmp cl, 0x46
jg 0x10289a48
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x10289a34
cmp cl, 0x39
jle 0x10289a78
cmp cl, 0x61
jl 0x10289a3e
cmp cl, 0x66
jle 0x10289a78
cmp cl, 0x41
jl 0x10289a48
cmp cl, 0x46
jle 0x10289a78
cmp al, 0x21
je 0x10289a78
cmp al, 0x24
je 0x10289a78
cmp al, 0x26
je 0x10289a78
cmp al, 0x28
je 0x10289a78
cmp al, 0x29
je 0x10289a78
cmp al, 0x2a
je 0x10289a78
cmp al, 0x2b
je 0x10289a78
cmp al, 0x2c
je 0x10289a78
cmp al, 0x3b
je 0x10289a78
cmp al, 0x3d
je 0x10289a78
cmp al, 0x27
je 0x10289a78
cmp al, 0x3a
jne 0x10289a8a
cmp al, 0x25
jne 0x10289a84
add esi, 3
jmp 0x102899c8
inc esi
jmp 0x102899c8
cmp byte [esi], 0x40
jne 0x10289ae1
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x10289ad9
mov eax, dword [edi + 0x10]
test eax, eax
je 0x10289aa9
push eax
call dword [sym.php5.dll_xmlFree]
add esp, 4
mov ecx, dword [ebx]
mov eax, esi
sub eax, ecx
test byte [edi + 0x24], 2
je 0x10289aca
push eax
push ecx
call sym.php5.dll_xmlStrndup
add esp, 8
mov dword [edi + 0x10], eax
pop edi
mov dword [ebx], esi
pop esi
xor eax, eax
pop ebx
ret
push 0
push eax
push ecx
call sym.php5.dll_xmlURIUnescapeString
add esp, 0xc
mov dword [edi + 0x10], eax
pop edi
mov dword [ebx], esi
pop esi
xor eax, eax
pop ebx
ret
pop esi
mov eax, 1
pop ebx
ret
Function at 0x102c8220
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
xor eax, eax
test esi, esi
je 0x102c825d
mov bl, byte [esi]
movzx ecx, bl
mov eax, ecx
shl eax, 4
sub eax, ecx
add eax, eax
test bl, bl
je 0x102c825d
mov edi, edi
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
add edx, ecx
movsx ecx, bl
mov bl, byte [esi + 1]
lea esi, [esi + 1]
add edx, ecx
xor eax, edx
test bl, bl
jne 0x102c8240
mov esi, dword [esp + 0x14]
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
add edx, ecx
xor eax, edx
test esi, esi
je 0x102c829d
mov bl, byte [esi]
test bl, bl
je 0x102c829d
lea esp, [esp]
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
add edx, ecx
movsx ecx, bl
mov bl, byte [esi + 1]
lea esi, [esi + 1]
add edx, ecx
xor eax, edx
test bl, bl
jne 0x102c8280
mov esi, dword [esp + 0x18]
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
add edx, ecx
xor eax, edx
test esi, esi
je 0x102c82dd
mov bl, byte [esi]
test bl, bl
je 0x102c82dd
lea esp, [esp]
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
add edx, ecx
movsx ecx, bl
mov bl, byte [esi + 1]
lea esi, [esi + 1]
add edx, ecx
xor eax, edx
test bl, bl
jne 0x102c82c0
mov ecx, dword [esp + 0xc]
xor edx, edx
div dword [ecx + 4]
pop esi
pop ebx
mov eax, edx
ret
Function at 0x102c82f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
test edi, edi
je 0x102c8341
mov bl, byte [edi]
movzx ecx, bl
mov eax, ecx
shl eax, 4
sub eax, ecx
add eax, eax
test bl, bl
je 0x102c832e
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
add edx, ecx
movsx ecx, bl
mov bl, byte [edi + 1]
lea edi, [edi + 1]
add edx, ecx
xor eax, edx
test bl, bl
jne 0x102c8311
mov ecx, eax
shr ecx, 3
mov edx, eax
shl edx, 5
add ecx, 0x3a
add ecx, edx
xor eax, ecx
jmp 0x102c834d
movzx ecx, byte [esi]
mov eax, ecx
shl eax, 4
sub eax, ecx
add eax, eax
test esi, esi
je 0x102c8374
mov bl, byte [esi]
test bl, bl
je 0x102c8374
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
add edx, ecx
movsx ecx, bl
mov bl, byte [esi + 1]
lea esi, [esi + 1]
add edx, ecx
xor eax, edx
test bl, bl
jne 0x102c8357
mov esi, dword [esp + 0x1c]
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
add edx, ecx
xor eax, edx
test esi, esi
je 0x102c83be
mov bl, byte [esi]
test bl, bl
je 0x102c83ad
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
add edx, ecx
movsx ecx, bl
mov bl, byte [esi + 1]
lea esi, [esi + 1]
add edx, ecx
xor eax, edx
test bl, bl
jne 0x102c8390
mov ecx, eax
shr ecx, 3
mov edx, eax
shl edx, 5
add ecx, 0x3a
add ecx, edx
xor eax, ecx
mov esi, dword [esp + 0x20]
test esi, esi
je 0x102c83ed
mov bl, byte [esi]
test bl, bl
je 0x102c83ed
lea esp, [esp]
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
add edx, ecx
movsx ecx, bl
mov bl, byte [esi + 1]
lea esi, [esi + 1]
add edx, ecx
xor eax, edx
test bl, bl
jne 0x102c83d0
mov esi, dword [esp + 0x24]
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
add edx, ecx
xor eax, edx
test esi, esi
je 0x102c843e
mov bl, byte [esi]
test bl, bl
je 0x102c842d
lea esp, [esp]
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
add edx, ecx
movsx ecx, bl
mov bl, byte [esi + 1]
lea esi, [esi + 1]
add edx, ecx
xor eax, edx
test bl, bl
jne 0x102c8410
mov ecx, eax
shr ecx, 3
mov edx, eax
shl edx, 5
add ecx, 0x3a
add ecx, edx
xor eax, ecx
mov esi, dword [esp + 0x28]
test esi, esi
je 0x102c846d
mov bl, byte [esi]
test bl, bl
je 0x102c846d
lea esp, [esp]
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
add edx, ecx
movsx ecx, bl
mov bl, byte [esi + 1]
lea esi, [esi + 1]
add edx, ecx
xor eax, edx
test bl, bl
jne 0x102c8450
mov ecx, dword [esp + 0x10]
xor edx, edx
div dword [ecx + 4]
pop edi
pop esi
pop ebx
mov eax, edx
ret
Function at 0x102df360
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x102df36e
or eax, 0xffffffff
pop esi
ret
cmp dword [esp + 8], 0
je 0x102df369
push esi
call sym.php5.dll_xmlStrlen
push 0
push eax
push esi
call sym.php5.dll_xmlParserInputBufferCreateStatic
add esp, 0x10
test eax, eax
je 0x102df369
pop esi
mov dword [esp + 8], eax
jmp sym.php5.dll_xmlTextReaderSetup

Function at 0x102df3a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
jns 0x102df3ac
or eax, 0xffffffff
ret
cmp dword [esp + 4], 0
je 0x102df3a8
push 0
push eax
call sym.php5.dll_xmlParserInputBufferCreateFd
add esp, 8
test eax, eax
je 0x102df3a8
mov dword [eax + 8], 0
mov dword [esp + 8], eax
jmp sym.php5.dll_xmlTextReaderSetup
Function at 0x102e40a0
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0x10
cmp dword [esp + 0x14], 0
push ebx
je 0x102e41ec
mov ebx, dword [esp + 0x1c]
test ebx, ebx
js 0x102e41ec
cmp dword [esp + 0x20], 0
je 0x102e41ec
push ebp
push edi
xor ebp, ebp
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], ebp
xor edi, edi
push esi
lea esp, [esp]
mov ebp, dword [esp + 0x2c]
mov word [esp + 0x11], 0
mov byte [esp + 0x10], 0
xor eax, eax
cmp edi, ebx
jge 0x102e4104
mov cl, byte [edi + ebp]
mov byte [esp + eax + 0x10], cl
inc eax
inc edi
cmp eax, 3
jl 0x102e40f2
mov ebp, dword [esp + 0x18]
test eax, eax
jle 0x102e41cf
movzx edx, byte [esp + 0x10]
movzx esi, byte [esp + 0x11]
mov ecx, edx
shr ecx, 2
and edx, 3
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_0123456789ABCDEF]
mov byte [esp + 0x14], cl
mov ecx, esi
shr ecx, 4
shl edx, 4
or ecx, edx
movzx edx, byte [esp + 0x12]
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_0123456789ABCDEF]
mov byte [esp + 0x15], cl
mov ecx, edx
shr ecx, 6
and esi, 0xf
shl esi, 2
or ecx, esi
and edx, 0x3f
mov ch, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_0123456789ABCDEF]
mov cl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_0123456789ABCDEF]
mov byte [esp + 0x16], ch
mov byte [esp + 0x17], cl
cmp eax, 3
jge 0x102e4185
movzx ecx, ch
cmp eax, 2
mov eax, 0x3d
cmovl ecx, eax
mov byte [esp + 0x17], 0x3d
mov byte [esp + 0x16], cl
mov esi, dword [esp + 0x1c]
cmp esi, 0x48
jl 0x102e41aa
push 0x10548574
push 2
push dword [esp + 0x2c]
call sym.php5.dll_xmlOutputBufferWrite
add esp, 0xc
cmp eax, 0xffffffff
je 0x102e41e1
add ebp, eax
xor esi, esi
lea eax, [esp + 0x14]
push eax
push 4
push dword [esp + 0x2c]
call sym.php5.dll_xmlOutputBufferWrite
add esp, 0xc
cmp eax, 0xffffffff
je 0x102e41e1
add ebp, eax
add esi, 4
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], esi
cmp edi, ebx
jl 0x102e40e0
pop esi
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x10
ret
pop esi
pop edi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x10
ret
or eax, 0xffffffff
pop ebx
add esp, 0x10
ret

Function at 0x102e7750
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
test esi, esi
jle 0x102e779b
mov edi, dword [esp + 0xc]
test edi, edi
je 0x102e779b
mov ecx, dword [esp + 0x14]
xor edx, edx
test esi, esi
jle 0x102e7788
lea esp, [esp]
movzx eax, byte [edx + edi]
add ecx, eax
imul ecx, ecx, 0x401
mov eax, ecx
shr eax, 6
inc edx
xor ecx, eax
cmp edx, esi
jl 0x102e7770
lea ecx, [ecx + ecx*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
pop edi
imul eax, eax, 0x8001
pop esi
ret
pop edi
xor eax, eax
pop esi
ret