joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d2d20
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov ebx, eax
mov esi, ecx
test edx, edx
je 0x100d2e72
mov cl, byte [edx]
movzx edi, cl
mov eax, edi
shl eax, 4
sub eax, edi
add eax, eax
test cl, cl
je 0x100d2d64
mov edi, eax
mov ebp, eax
shl edi, 5
shr ebp, 3
movsx ecx, cl
add edi, ebp
inc edx
add edi, ecx
mov cl, byte [edx]
xor eax, edi
test cl, cl
jne 0x100d2d46
mov ebp, dword [esp + 0x18]
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
lea edx, [edx + ecx + 0x3a]
xor eax, edx
test esi, esi
je 0x100d2d9a
mov cl, byte [esi]
test cl, cl
je 0x100d2d9a
mov edi, edi
mov edx, eax
mov edi, eax
shl edx, 5
shr edi, 3
movsx ecx, cl
add edx, edi
inc esi
add edx, ecx
mov cl, byte [esi]
xor eax, edx
test cl, cl
jne 0x100d2d80
test ebx, ebx
je 0x100d2dce
mov cl, byte [ebx]
test cl, cl
je 0x100d2dbe
mov edx, eax
mov esi, eax
shl edx, 5
shr esi, 3
movsx ecx, cl
add edx, esi
inc ebx
add edx, ecx
mov cl, byte [ebx]
xor eax, edx
test cl, cl
jne 0x100d2da4
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
lea edx, [edx + ecx + 0x3a]
xor eax, edx
test ebp, ebp
je 0x100d2dfb
mov cl, byte [ebp]
test cl, cl
je 0x100d2dfb
lea esp, [esp]
mov edx, eax
mov esi, eax
shl edx, 5
shr esi, 3
movsx ecx, cl
add edx, esi
inc ebp
add edx, ecx
mov cl, byte [ebp]
xor eax, edx
test cl, cl
jne 0x100d2de0
mov edx, dword [esp + 0x1c]
test edx, edx
je 0x100d2e3a
mov cl, byte [edx]
test cl, cl
je 0x100d2e2a
lea esp, [esp]
mov esi, eax
mov edi, eax
shl esi, 5
shr edi, 3
movsx ecx, cl
add esi, edi
inc edx
add esi, ecx
mov cl, byte [edx]
xor eax, esi
test cl, cl
jne 0x100d2e10
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
lea edx, [edx + ecx + 0x3a]
xor eax, edx
mov edx, dword [esp + 0x20]
test edx, edx
je 0x100d2e62
mov cl, byte [edx]
test cl, cl
je 0x100d2e62
mov esi, eax
mov edi, eax
shl esi, 5
shr edi, 3
movsx ecx, cl
add esi, edi
inc edx
add esi, ecx
mov cl, byte [edx]
xor eax, esi
test cl, cl
jne 0x100d2e48
mov ecx, dword [esp + 0x14]
xor edx, edx
div dword [ecx + 4]
pop edi
pop esi
pop ebp
pop ebx
mov eax, edx
ret
movzx ecx, byte [esi]
mov eax, ecx
shl eax, 4
sub eax, ecx
add eax, eax
jmp 0x100d2d74
Function at 0x100e01f0
Capabilities:
Parse credit card information

Disassembly:
mov edx, dword [esi]
mov al, byte [edx]
cmp al, 0x61
jl 0x100e0200
cmp al, 0x7a
jle 0x100e02b8
cmp al, 0x41
jl 0x100e020c
cmp al, 0x5a
jle 0x100e02b8
cmp al, 0x30
jl 0x100e0218
cmp al, 0x39
jle 0x100e02b8
cmp al, 0x2d
je 0x100e02b8
cmp al, 0x2e
je 0x100e02b8
cmp al, 0x5f
je 0x100e02b8
cmp al, 0x7e
je 0x100e02b8
cmp al, 0x25
jne 0x100e027e
mov cl, byte [edx + 1]
cmp cl, 0x30
jl 0x100e0249
cmp cl, 0x39
jle 0x100e025d
cmp cl, 0x61
jl 0x100e0253
cmp cl, 0x66
jle 0x100e025d
cmp cl, 0x41
jl 0x100e027e
cmp cl, 0x46
jg 0x100e027e
mov cl, byte [edx + 2]
cmp cl, 0x30
jl 0x100e026a
cmp cl, 0x39
jle 0x100e02b8
cmp cl, 0x61
jl 0x100e0274
cmp cl, 0x66
jle 0x100e02b8
cmp cl, 0x41
jl 0x100e027e
cmp cl, 0x46
jle 0x100e02b8
cmp al, 0x21
je 0x100e02b8
cmp al, 0x24
je 0x100e02b8
cmp al, 0x26
je 0x100e02b8
cmp al, 0x28
je 0x100e02b8
cmp al, 0x29
je 0x100e02b8
cmp al, 0x2a
je 0x100e02b8
cmp al, 0x2b
je 0x100e02b8
cmp al, 0x2c
je 0x100e02b8
cmp al, 0x3b
je 0x100e02b8
cmp al, 0x3d
je 0x100e02b8
cmp al, 0x3a
je 0x100e02b8
cmp al, 0x40
je 0x100e02b8
xor eax, eax
cmp dword [esp + 4], eax
sete al
ret
mov al, byte [edx]
cmp al, 0x61
jl 0x100e02c6
cmp al, 0x7a
jle 0x100e036c
cmp al, 0x41
jl 0x100e02d2
cmp al, 0x5a
jle 0x100e036c
cmp al, 0x30
jl 0x100e02de
cmp al, 0x39
jle 0x100e036c
cmp al, 0x2d
je 0x100e036c
cmp al, 0x2e
je 0x100e036c
cmp al, 0x5f
je 0x100e036c
cmp al, 0x7e
je 0x100e036c
cmp al, 0x25
jne 0x100e033c
mov cl, byte [edx + 1]
cmp cl, 0x30
jl 0x100e0307
cmp cl, 0x39
jle 0x100e031b
cmp cl, 0x61
jl 0x100e0311
cmp cl, 0x66
jle 0x100e031b
cmp cl, 0x41
jl 0x100e033c
cmp cl, 0x46
jg 0x100e033c
mov cl, byte [edx + 2]
cmp cl, 0x30
jl 0x100e0328
cmp cl, 0x39
jle 0x100e036c
cmp cl, 0x61
jl 0x100e0332
cmp cl, 0x66
jle 0x100e036c
cmp cl, 0x41
jl 0x100e033c
cmp cl, 0x46
jle 0x100e036c
cmp al, 0x21
je 0x100e036c
cmp al, 0x24
je 0x100e036c
cmp al, 0x26
je 0x100e036c
cmp al, 0x28
je 0x100e036c
cmp al, 0x29
je 0x100e036c
cmp al, 0x2a
je 0x100e036c
cmp al, 0x2b
je 0x100e036c
cmp al, 0x2c
je 0x100e036c
cmp al, 0x3b
je 0x100e036c
cmp al, 0x3d
je 0x100e036c
cmp al, 0x3a
je 0x100e036c
cmp al, 0x40
jne 0x100e0382
cmp al, bl
je 0x100e0382
cmp al, 0x25
jne 0x100e037c
add edx, 3
jmp 0x100e02b8
inc edx
jmp 0x100e02b8
mov dword [esi], edx
xor eax, eax
ret
Function at 0x100e1590
Capabilities:
Parse credit card information

Disassembly:
test ebx, ebx
jne 0x100e1598
or eax, 0xffffffff
ret
push esi
mov esi, dword [ebx]
mov edx, 1
mov al, byte [esi]
cmp al, 0x61
jl 0x100e15ae
cmp al, 0x7a
jle 0x100e168d
cmp al, 0x41
jl 0x100e15ba
cmp al, 0x5a
jle 0x100e168d
cmp al, 0x30
jl 0x100e15c6
cmp al, 0x39
jle 0x100e168d
cmp al, 0x2d
je 0x100e168d
cmp al, 0x2e
je 0x100e168d
cmp al, 0x5f
je 0x100e168d
cmp al, 0x7e
je 0x100e168d
cmp al, 0x25
jne 0x100e162c
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x100e15f7
cmp cl, 0x39
jle 0x100e160b
cmp cl, 0x61
jl 0x100e1601
cmp cl, 0x66
jle 0x100e160b
cmp cl, 0x41
jl 0x100e162c
cmp cl, 0x46
jg 0x100e162c
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x100e1618
cmp cl, 0x39
jle 0x100e168d
cmp cl, 0x61
jl 0x100e1622
cmp cl, 0x66
jle 0x100e168d
cmp cl, 0x41
jl 0x100e162c
cmp cl, 0x46
jle 0x100e168d
cmp al, 0x21
je 0x100e168d
cmp al, 0x24
je 0x100e168d
cmp al, 0x26
je 0x100e168d
cmp al, 0x28
je 0x100e168d
cmp al, 0x29
je 0x100e168d
cmp al, 0x2a
je 0x100e168d
cmp al, 0x2b
je 0x100e168d
cmp al, 0x2c
je 0x100e168d
cmp al, 0x3b
je 0x100e168d
cmp al, 0x3d
je 0x100e168d
cmp al, 0x3a
je 0x100e168d
cmp al, 0x40
je 0x100e168d
cmp al, 0x2f
je 0x100e168d
cmp al, 0x3f
je 0x100e168d
cmp al, 0x5b
je 0x100e168d
cmp al, 0x5d
je 0x100e168d
test edi, edi
je 0x100e16e3
test byte [edi + 0x24], dl
je 0x100e16a0
cmp al, 0x7b
je 0x100e168d
cmp al, 0x7d
je 0x100e168d
cmp al, 0x7c
je 0x100e168d
cmp al, 0x5c
je 0x100e168d
cmp al, 0x5e
je 0x100e168d
cmp al, 0x60
jne 0x100e16a0
cmp al, 0x25
jne 0x100e1699
add esi, 3
jmp 0x100e15a0
add esi, edx
jmp 0x100e15a0
mov eax, dword [edi + 0x20]
test eax, eax
je 0x100e16b1
push eax
call dword [0x10438018]
add esp, 4
test byte [edi + 0x24], 2
mov eax, dword [ebx]
je 0x100e16d0
mov ecx, esi
sub ecx, eax
push ecx
push eax
call fcn.100d1cd0
add esp, 8
mov dword [edi + 0x20], eax
mov dword [ebx], esi
xor eax, eax
pop esi
ret
mov edx, esi
push 0
sub edx, eax
push edx
push eax
call fcn.100e1260
add esp, 0xc
mov dword [edi + 0x20], eax
mov dword [ebx], esi
xor eax, eax
pop esi
ret
Function at 0x100e16f0
Capabilities:
Parse credit card information

Disassembly:
test ebx, ebx
jne 0x100e16f8
or eax, 0xffffffff
ret
push esi
mov esi, dword [ebx]
mov edx, 1
mov al, byte [esi]
cmp al, 0x61
jl 0x100e170e
cmp al, 0x7a
jle 0x100e17f1
cmp al, 0x41
jl 0x100e171a
cmp al, 0x5a
jle 0x100e17f1
cmp al, 0x30
jl 0x100e1726
cmp al, 0x39
jle 0x100e17f1
cmp al, 0x2d
je 0x100e17f1
cmp al, 0x2e
je 0x100e17f1
cmp al, 0x5f
je 0x100e17f1
cmp al, 0x7e
je 0x100e17f1
cmp al, 0x25
jne 0x100e178c
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x100e1757
cmp cl, 0x39
jle 0x100e176b
cmp cl, 0x61
jl 0x100e1761
cmp cl, 0x66
jle 0x100e176b
cmp cl, 0x41
jl 0x100e178c
cmp cl, 0x46
jg 0x100e178c
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x100e1778
cmp cl, 0x39
jle 0x100e17f1
cmp cl, 0x61
jl 0x100e1782
cmp cl, 0x66
jle 0x100e17f1
cmp cl, 0x41
jl 0x100e178c
cmp cl, 0x46
jle 0x100e17f1
cmp al, 0x21
je 0x100e17f1
cmp al, 0x24
je 0x100e17f1
cmp al, 0x26
je 0x100e17f1
cmp al, 0x28
je 0x100e17f1
cmp al, 0x29
je 0x100e17f1
cmp al, 0x2a
je 0x100e17f1
cmp al, 0x2b
je 0x100e17f1
cmp al, 0x2c
je 0x100e17f1
cmp al, 0x3b
je 0x100e17f1
cmp al, 0x3d
je 0x100e17f1
cmp al, 0x3a
je 0x100e17f1
cmp al, 0x40
je 0x100e17f1
cmp al, 0x2f
je 0x100e17f1
cmp al, 0x3f
je 0x100e17f1
test edi, edi
je 0x100e1864
test byte [edi + 0x24], dl
je 0x100e1804
cmp al, 0x7b
je 0x100e17f1
cmp al, 0x7d
je 0x100e17f1
cmp al, 0x7c
je 0x100e17f1
cmp al, 0x5c
je 0x100e17f1
cmp al, 0x5e
je 0x100e17f1
cmp al, 0x5b
je 0x100e17f1
cmp al, 0x5d
je 0x100e17f1
cmp al, 0x60
jne 0x100e1804
cmp al, 0x25
jne 0x100e17fd
add esi, 3
jmp 0x100e1700
add esi, edx
jmp 0x100e1700
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x100e1815
push eax
call dword [0x10438018]
add esp, 4
test byte [edi + 0x24], 2
mov eax, dword [ebx]
je 0x100e182d
mov ecx, esi
sub ecx, eax
push ecx
push eax
call fcn.100d1cd0
add esp, 8
jmp 0x100e183d
mov edx, esi
push 0
sub edx, eax
push edx
push eax
call fcn.100e1260
add esp, 0xc
mov dword [edi + 0x1c], eax
mov eax, dword [edi + 0x28]
test eax, eax
je 0x100e1851
push eax
call dword [0x10438018]
add esp, 4
mov eax, dword [ebx]
mov ecx, esi
sub ecx, eax
push ecx
push eax
call fcn.100d1cd0
add esp, 8
mov dword [edi + 0x28], eax
mov dword [ebx], esi
xor eax, eax
pop esi
ret
Function at 0x100e1870
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, dword [ebx]
mov al, byte [esi]
cmp al, 0x61
jl 0x100e1881
cmp al, 0x7a
jle 0x100e191b
cmp al, 0x41
jl 0x100e188d
cmp al, 0x5a
jle 0x100e191b
cmp al, 0x30
jl 0x100e1899
cmp al, 0x39
jle 0x100e191b
cmp al, 0x2d
je 0x100e191b
cmp al, 0x2e
je 0x100e191b
cmp al, 0x5f
je 0x100e191b
cmp al, 0x7e
je 0x100e191b
cmp al, 0x25
jne 0x100e18ef
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x100e18ba
cmp cl, 0x39
jle 0x100e18ce
cmp cl, 0x61
jl 0x100e18c4
cmp cl, 0x66
jle 0x100e18ce
cmp cl, 0x41
jl 0x100e18ef
cmp cl, 0x46
jg 0x100e18ef
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x100e18db
cmp cl, 0x39
jle 0x100e191b
cmp cl, 0x61
jl 0x100e18e5
cmp cl, 0x66
jle 0x100e191b
cmp cl, 0x41
jl 0x100e18ef
cmp cl, 0x46
jle 0x100e191b
cmp al, 0x21
je 0x100e191b
cmp al, 0x24
je 0x100e191b
cmp al, 0x26
je 0x100e191b
cmp al, 0x28
je 0x100e191b
cmp al, 0x29
je 0x100e191b
cmp al, 0x2a
je 0x100e191b
cmp al, 0x2b
je 0x100e191b
cmp al, 0x2c
je 0x100e191b
cmp al, 0x3b
je 0x100e191b
cmp al, 0x3d
je 0x100e191b
cmp al, 0x3a
jne 0x100e192d
cmp al, 0x25
jne 0x100e1927
add esi, 3
jmp 0x100e1873
inc esi
jmp 0x100e1873
cmp byte [esi], 0x40
jne 0x100e197f
test edi, edi
je 0x100e1979
mov eax, dword [edi + 0x10]
test eax, eax
je 0x100e1947
push eax
call dword [0x10438018]
add esp, 4
test byte [edi + 0x24], 2
mov eax, dword [ebx]
je 0x100e1966
mov ecx, esi
sub ecx, eax
push ecx
push eax
call fcn.100d1cd0
add esp, 8
mov dword [edi + 0x10], eax
mov dword [ebx], esi
xor eax, eax
pop esi
ret
mov edx, esi
push 0
sub edx, eax
push edx
push eax
call fcn.100e1260
add esp, 0xc
mov dword [edi + 0x10], eax
mov dword [ebx], esi
xor eax, eax
pop esi
ret
mov eax, 1
pop esi
ret
Function at 0x100e1990
Capabilities:
Parse credit card information

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, dword [eax]
mov al, byte [edi]
mov dword [esp + 0x10], edi
mov ebx, edi
cmp al, 0x5b
jne 0x100e19d5
mov al, byte [edi + 1]
inc edi
cmp al, 0x5d
je 0x100e19bf
test al, al
je 0x100e19c5
mov al, byte [edi + 1]
inc edi
cmp al, 0x5d
jne 0x100e19b3
inc edi
jmp 0x100e1ade
cmp byte [edi], 0x5d
je 0x100e19bf
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
cmp al, 0x30
jl 0x100e1a28
cmp al, 0x39
jg 0x100e1a28
lea esi, [esp + 0x10]
call fcn.100e0160
test eax, eax
jne 0x100e1a28
mov ecx, dword [esp + 0x10]
cmp byte [ecx], 0x2e
jne 0x100e1a28
inc dword [esp + 0x10]
call fcn.100e0160
test eax, eax
jne 0x100e1a28
mov edx, dword [esp + 0x10]
cmp byte [edx], 0x2e
jne 0x100e1a28
call fcn.100e0160
test eax, eax
jne 0x100e1a28
mov eax, dword [esp + 0x10]
cmp byte [eax], 0x2e
jne 0x100e1a28
call fcn.100e0160
test eax, eax
je 0x100e1ada
mov al, byte [edi]
cmp al, 0x61
jl 0x100e1a36
cmp al, 0x7a
jle 0x100e1ac8
cmp al, 0x41
jl 0x100e1a42
cmp al, 0x5a
jle 0x100e1ac8
cmp al, 0x30
jl 0x100e1a4a
cmp al, 0x39
jle 0x100e1ac8
cmp al, 0x2d
je 0x100e1ac8
cmp al, 0x2e
je 0x100e1ac8
cmp al, 0x5f
je 0x100e1ac8
cmp al, 0x7e
je 0x100e1ac8
cmp al, 0x25
jne 0x100e1aa0
mov cl, byte [edi + 1]
cmp cl, 0x30
jl 0x100e1a6b
cmp cl, 0x39
jle 0x100e1a7f
cmp cl, 0x61
jl 0x100e1a75
cmp cl, 0x66
jle 0x100e1a7f
cmp cl, 0x41
jl 0x100e1aa0
cmp cl, 0x46
jg 0x100e1aa0
mov cl, byte [edi + 2]
cmp cl, 0x30
jl 0x100e1a8c
cmp cl, 0x39
jle 0x100e1ac8
cmp cl, 0x61
jl 0x100e1a96
cmp cl, 0x66
jle 0x100e1ac8
cmp cl, 0x41
jl 0x100e1aa0
cmp cl, 0x46
jle 0x100e1ac8
cmp al, 0x21
je 0x100e1ac8
cmp al, 0x24
je 0x100e1ac8
cmp al, 0x26
je 0x100e1ac8
cmp al, 0x28
je 0x100e1ac8
cmp al, 0x29
je 0x100e1ac8
cmp al, 0x2a
je 0x100e1ac8
cmp al, 0x2b
je 0x100e1ac8
cmp al, 0x2c
je 0x100e1ac8
cmp al, 0x3b
je 0x100e1ac8
cmp al, 0x3d
jne 0x100e1ade
cmp al, 0x25
jne 0x100e1ad4
add edi, 3
jmp 0x100e1a28
inc edi
jmp 0x100e1a28
mov edi, dword [esp + 0x10]
xor esi, esi
cmp ebp, esi
je 0x100e1b55
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x100e1af5
push eax
call dword [0x10438018]
add esp, 4
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], esi
cmp eax, esi
je 0x100e1b09
push eax
call dword [0x10438018]
add esp, 4
cmp edi, ebx
je 0x100e1b52
test byte [ebp + 0x24], 2
je 0x100e1b32
mov ecx, edi
sub ecx, ebx
push ecx
push ebx
call fcn.100d1cd0
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 0x24]
add esp, 8
mov dword [eax], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov edx, edi
push esi
sub edx, ebx
push edx
push ebx
call fcn.100e1260
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 0x28]
add esp, 0xc
mov dword [eax], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov dword [ebp + 0xc], esi
mov eax, dword [esp + 0x1c]
mov dword [eax], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x100e1ee0
Capabilities:
Parse credit card information

Disassembly:
push ecx
push esi
mov esi, dword [ebx]
push edi
mov edi, eax
mov al, byte [esi]
mov dword [esp + 8], esi
cmp al, 0x2f
jne 0x100e1f48
cmp byte [esi + 1], 0x2f
lea eax, [esp + 8]
push eax
jne 0x100e1f34
add esi, 2
mov eax, edi
mov dword [esp + 0xc], esi
call fcn.100e1b70
add esp, 4
test eax, eax
jne 0x100e203f
lea ecx, [esp + 8]
push ecx
call fcn.100e1bf0
add esp, 4
test eax, eax
jne 0x100e203f
mov edx, dword [esp + 8]
pop edi
mov dword [ebx], edx
pop esi
pop ecx
ret
call fcn.100e1c90
add esp, 4
test eax, eax
je 0x100e2037
pop edi
pop esi
pop ecx
ret
cmp al, 0x61
jl 0x100e1f54
cmp al, 0x7a
jle 0x100e2026
cmp al, 0x41
jl 0x100e1f60
cmp al, 0x5a
jle 0x100e2026
cmp al, 0x30
jl 0x100e1f6c
cmp al, 0x39
jle 0x100e2026
cmp al, 0x2d
je 0x100e2026
cmp al, 0x2e
je 0x100e2026
cmp al, 0x5f
je 0x100e2026
cmp al, 0x7e
je 0x100e2026
cmp al, 0x25
jne 0x100e1fd2
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x100e1f9d
cmp cl, 0x39
jle 0x100e1fb1
cmp cl, 0x61
jl 0x100e1fa7
cmp cl, 0x66
jle 0x100e1fb1
cmp cl, 0x41
jl 0x100e1fd2
cmp cl, 0x46
jg 0x100e1fd2
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x100e1fbe
cmp cl, 0x39
jle 0x100e2026
cmp cl, 0x61
jl 0x100e1fc8
cmp cl, 0x66
jle 0x100e2026
cmp cl, 0x41
jl 0x100e1fd2
cmp cl, 0x46
jle 0x100e2026
cmp al, 0x21
je 0x100e2026
cmp al, 0x24
je 0x100e2026
cmp al, 0x26
je 0x100e2026
cmp al, 0x28
je 0x100e2026
cmp al, 0x29
je 0x100e2026
cmp al, 0x2a
je 0x100e2026
cmp al, 0x2b
je 0x100e2026
cmp al, 0x2c
je 0x100e2026
cmp al, 0x3b
je 0x100e2026
cmp al, 0x3d
je 0x100e2026
cmp al, 0x3a
je 0x100e2026
cmp al, 0x40
je 0x100e2026
test edi, edi
je 0x100e203b
mov eax, dword [edi + 0x18]
test eax, eax
je 0x100e2017
push eax
call dword [0x10438018]
add esp, 4
mov dword [edi + 0x18], 0
pop edi
mov dword [ebx], esi
xor eax, eax
pop esi
pop ecx
ret
lea ecx, [esp + 8]
push ecx
call fcn.100e1d60
add esp, 4
test eax, eax
jne 0x100e203f
mov esi, dword [esp + 8]
mov dword [ebx], esi
xor eax, eax
pop edi
pop esi
pop ecx
ret
Function at 0x100e2050
Capabilities:
Parse credit card information

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, eax
mov al, byte [ebx]
cmp al, 0x2f
jne 0x100e20b1
cmp byte [ebx + 1], al
jne 0x100e2099
lea eax, [esp + 0xc]
push eax
add ebx, 2
mov eax, edi
mov dword [esp + 0x10], ebx
call fcn.100e1b70
add esp, 4
test eax, eax
jne 0x100e21ec
lea ecx, [esp + 0xc]
push ecx
call fcn.100e1bf0
add esp, 4
test eax, eax
je 0x100e219a
pop edi
pop ebx
ret
lea edx, [esp + 0xc]
push edx
call fcn.100e1c90
add esp, 4
test eax, eax
je 0x100e219a
pop edi
pop ebx
ret
cmp al, 0x61
jl 0x100e20bd
cmp al, 0x7a
jle 0x100e2189
cmp al, 0x41
jl 0x100e20c9
cmp al, 0x5a
jle 0x100e2189
cmp al, 0x30
jl 0x100e20d5
cmp al, 0x39
jle 0x100e2189
cmp al, 0x2d
je 0x100e2189
cmp al, 0x2e
je 0x100e2189
cmp al, 0x5f
je 0x100e2189
cmp al, 0x7e
je 0x100e2189
cmp al, 0x25
jne 0x100e213b
mov cl, byte [ebx + 1]
cmp cl, 0x30
jl 0x100e2106
cmp cl, 0x39
jle 0x100e211a
cmp cl, 0x61
jl 0x100e2110
cmp cl, 0x66
jle 0x100e211a
cmp cl, 0x41
jl 0x100e213b
cmp cl, 0x46
jg 0x100e213b
mov cl, byte [ebx + 2]
cmp cl, 0x30
jl 0x100e2127
cmp cl, 0x39
jle 0x100e2189
cmp cl, 0x61
jl 0x100e2131
cmp cl, 0x66
jle 0x100e2189
cmp cl, 0x41
jl 0x100e213b
cmp cl, 0x46
jle 0x100e2189
cmp al, 0x21
je 0x100e2189
cmp al, 0x24
je 0x100e2189
cmp al, 0x26
je 0x100e2189
cmp al, 0x28
je 0x100e2189
cmp al, 0x29
je 0x100e2189
cmp al, 0x2a
je 0x100e2189
cmp al, 0x2b
je 0x100e2189
cmp al, 0x2c
je 0x100e2189
cmp al, 0x3b
je 0x100e2189
cmp al, 0x3d
je 0x100e2189
cmp al, 0x3a
je 0x100e2189
cmp al, 0x40
je 0x100e2189
test edi, edi
je 0x100e219e
mov eax, dword [edi + 0x18]
test eax, eax
je 0x100e2180
push eax
call dword [0x10438018]
add esp, 4
mov dword [edi + 0x18], 0
jmp 0x100e219e
lea eax, [esp + 0xc]
push eax
call fcn.100e1e20
add esp, 4
test eax, eax
jne 0x100e21ec
mov ebx, dword [esp + 0xc]
cmp byte [ebx], 0x3f
jne 0x100e21b9
inc ebx
mov dword [esp + 0xc], ebx
lea ebx, [esp + 0xc]
call fcn.100e16f0
test eax, eax
jne 0x100e21ec
mov ebx, dword [esp + 0xc]
cmp byte [ebx], 0x23
jne 0x100e21d4
inc ebx
mov dword [esp + 0xc], ebx
lea ebx, [esp + 0xc]
call fcn.100e1590
test eax, eax
jne 0x100e21ec
mov ebx, dword [esp + 0xc]
cmp byte [ebx], 0
je 0x100e21ea
push esi
mov esi, edi
call fcn.100e0f70
pop esi
pop edi
mov eax, 1
pop ebx
ret
xor eax, eax
pop edi
pop ebx
ret

Function at 0x100e7a20
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x1044d9a0], 0
jne 0x100e7a7e
push 0x1044d9a4
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x100e7a5a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1043855c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x1044d99c], eax
mov dword [0x1044d9a0], 1
ret
cmp dword [0x1044d9a0], 0
jne 0x100e7a7e
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
lea ebx, [ebx]
push 0
call esi
cmp dword [0x1044d9a0], 0
je 0x100e7a70
pop esi
ret
Function at 0x100e7a80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
call fcn.100e7a20
mov eax, dword [0x1043855c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x100e7a9f
mov eax, dword [eax]
test eax, eax
jne 0x100e7b38
push edi
call fcn.100e7920
mov edi, eax
test edi, edi
jne 0x100e7aad
pop edi
ret
push esi
push 0xc
call dword [sym.imp.MSVCR100.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x100e7af2
call fcn.100d2a40
mov esi, eax
call fcn.100d2a80
mov ecx, dword [eax]
mov edx, dword [esi]
push str.xmlGetGlobalState:_out_of_memory_n
push ecx
call edx
lea eax, [edi + 0x1c4]
push eax
call fcn.100ce9f0
push edi
call dword [sym.imp.MSVCR100.dll_free]
add esp, 0x10
pop esi
xor eax, eax
pop edi
ret
push 0x1044d984
mov dword [esi], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x1044d9b0]
test eax, eax
je 0x100e7b0b
mov dword [eax + 4], esi
mov ecx, dword [0x1043855c]
push esi
push ecx
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov dword [0x1044d9b0], esi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0x1044d984
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov eax, edi
pop edi
ret
Function at 0x1010b250
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x30
push ebx
mov ebx, dword [esp + 0x3c]
push ebp
mov ebp, dword [esp + 0x44]
push edi
mov edi, dword [esp + 0x40]
test edi, edi
je 0x1010b293
mov eax, dword [edi + 4]
test eax, eax
je 0x1010b293
push ebp
push ebx
push edi
call eax
add esp, 0xc
test eax, eax
jne 0x1010b293
push ebp
push str.File_write_for__s_refused_n
push eax
push eax
push ebx
call fcn.100ff400
add esp, 0x14
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x30
ret
push esi
push ebp
call fcn.100e4840
mov esi, eax
add esp, 4
test esi, esi
je 0x1010b340
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1010b2be
test al, 0x10
je 0x1010b2be
mov edi, 2
jmp 0x1010b330
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.MSVCR100.dll__stat64i32]
add esp, 8
cmp eax, 0xffffffff
je 0x1010b2d9
mov edi, 1
jmp 0x1010b330
test edi, edi
je 0x1010b312
mov eax, dword [edi + 8]
test eax, eax
je 0x1010b312
push esi
push ebx
push edi
call eax
add esp, 0xc
test eax, eax
jne 0x1010b312
push ebp
push str.Directory_creation_for__s_refused_n
push eax
push eax
push ebx
call fcn.100ff400
push esi
call dword [0x10438018]
add esp, 0x18
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x30
ret
push esi
push ebx
push edi
call fcn.1010b250
mov edi, eax
add esp, 0xc
cmp edi, 1
jne 0x1010b330
push esi
call dword [sym.imp.MSVCR100.dll__mkdir]
add esp, 4
mov edi, eax
push esi
call dword [0x10438018]
add esp, 4
mov eax, edi
test edi, edi
jl 0x1010b345
mov eax, 1
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x1012e970
Capabilities:
Parse credit card information

Disassembly:
push edi
mov edi, eax
mov eax, dword [edi + 4]
cmp byte [eax], 0x5b
jne 0x1012e9be
inc eax
push 3
mov dword [edi + 4], eax
call fcn.1012a830
add esp, 4
mov dword [edi + 0x1c], eax
test eax, eax
je 0x1012e9a5
push edi
call fcn.1012e8b0
mov eax, dword [edi + 4]
add esp, 4
cmp byte [eax], 0x5d
jne 0x1012e9a7
inc eax
mov dword [edi + 4], eax
pop edi
ret
push esi
mov esi, str.xmlFAParseCharClass:___expected
mov edx, edi
mov dword [edi + 8], 0x5aa
call fcn.1012a690
pop esi
pop edi
ret
mov eax, edi
pop edi
jmp fcn.1012e1c0

Function at 0x10131700
Capabilities:
Set socket configuration

Disassembly:
push esi
mov esi, dword [esp + 8]
mov al, byte [esi]
xor edx, edx
mov ecx, esi
test al, al
je 0x10131722
nop
cmp al, 0x2e
jne 0x10131715
inc edx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x10131710
cmp edx, 3
je 0x10131728
xor eax, eax
pop esi
ret 8
push esi
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x10131722
mov ecx, dword [esp + 0xc]
mov dword [ecx], eax
mov eax, 1
pop esi
ret 8

Function at 0x101317d0
Capabilities:
Resolve dns

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
mov dword [esi], 0
push ecx
mov byte [eax], 0
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov ecx, eax
mov dword [esp + 0x1c], ecx
test ecx, ecx
je 0x10131875
cmp word [ecx + 8], 2
push ebx
push ebp
push edi
jne 0x10131845
cmp word [ecx + 0xa], 4
jne 0x10131845
mov edi, dword [ecx + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x10131845
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
lea esp, [esp]
mov edx, dword [eax]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebx
push ebp
call fcn.10131750
mov dword [esi], eax
test eax, eax
je 0x10131869
add edi, 4
lea esi, [eax + 0x1c]
mov eax, dword [edi]
test eax, eax
jne 0x10131820
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx]
mov edx, dword [esp + 0x24]
push 0x400
push ecx
push 0x401
push edx
call dword [sym.imp.MSVCR100.dll_strncpy_s]
add esp, 0x10
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
ret 0x18
pop edi
pop ebp
pop ebx
mov eax, 8
pop esi
ret 0x18
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x10131885.11001
jmp dword [eax*4 + 0x101318a8]
mov eax, 0x2af9
pop esi
ret 0x18
mov eax, 0x2afa
pop esi
ret 0x18
mov eax, 0x2afb
pop esi
ret 0x18