Function at 0x10049ed0
Capabilities:
Enumerate pe sections
Validate payment card number using luhn algorithm

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov byte [esp + 0x24], 0
mov eax, dword [esi + 0x18]
lea ebp, [esi + 0x8a0]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x30]
mov dword [eax], 0
mov edi, dword [esp + 0x28]
nop
push ebx
push 0xa
push edi
call sub.VCRUNTIME140.dll_memchr
mov edi, eax
add esp, 0xc
mov eax, dword [esp + 0x28]
test edi, edi
je 0x1004a6cd
sub edi, eax
inc edi
push edi
push eax
push ebp
call fcn.10024dd0
add esp, 0xc
test eax, eax
jne 0x1004a511
mov eax, dword [esp + 0x30]
sub ebx, edi
add dword [esp + 0x28], edi
mov dword [esp + 0x2c], ebx
add dword [eax], edi
cmp dword [esi + 0xc4], 0
jne 0x10049fbd
push ebp
call fcn.10024e30
push ebp
mov ebx, eax
call fcn.10024e40
mov edi, dword [esp + 0x18]
add esp, 8
mov ecx, dword [edi + 0x260]
test dword [ecx + 0x44], 0x40000
je 0x10049f9d
cmp ebx, 5
mov ecx, 5
mov ebp, 2
sbb edi, edi
inc edi
cmp ebx, 5
cmova ebx, ecx
push ebx
push eax
push str.RTSP_
call fcn.10023540
add esp, 0xc
test eax, eax
cmovne ebp, edi
mov edi, dword [esp + 0x10]
jmp 0x10049faa
push ebx
push eax
push esi
call fcn.10049460
add esp, 0xc
mov ebp, eax
cmp ebp, 2
je 0x1004a608
mov ebx, dword [esp + 0x2c]
lea ebp, [esi + 0x8a0]
push ebp
call fcn.10024e40
push ebp
mov dword [esp + 0x1c], eax
call fcn.10024e30
mov edx, dword [esp + 0x1c]
add esp, 8
mov ebp, eax
mov dword [esp + 0x18], ebp
mov cl, byte [edx]
cmp cl, 0xa
je 0x1004a519
cmp cl, 0xd
je 0x1004a519
mov ecx, dword [esi + 0xc4]
mov edi, 4
lea eax, [ecx + 1]
mov dword [esi + 0xc4], eax
test ecx, ecx
jne 0x1004a3d3
mov eax, dword [esp + 0x10]
mov dword [esi + 0xd0], ecx
mov eax, dword [eax + 0x260]
mov eax, dword [eax + 0x44]
test al, 3
je 0x1004a1bc
mov al, byte [edx]
mov edi, edx
test al, al
je 0x1004a040
nop dword [eax]
cmp al, 0x20
je 0x1004a038
cmp al, 9
jne 0x1004a040
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1004a030
push 5
push str.HTTP_
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x1004a0eb
movsx ecx, byte [edi + 5]
mov eax, ecx
sub eax, 0x31
je 0x1004a11c
sub eax, 1
je 0x1004a075
sub eax, 1
jne 0x1004a641
mov al, byte [edi + 6]
cmp al, 0x20
je 0x1004a080
cmp al, 9
jne 0x1004a0eb
lea eax, [ecx - 0x30]
lea eax, [eax + eax*4]
add eax, eax
mov dword [esi + 0xd0], eax
mov cl, byte [edi + 7]
lea eax, [ecx - 0x30]
cmp al, 9
ja 0x1004a0eb
mov bl, byte [edi + 8]
lea eax, [ebx - 0x30]
cmp al, 9
ja 0x1004a0eb
mov dl, byte [edi + 9]
lea eax, [edx - 0x30]
cmp al, 9
ja 0x1004a0eb
movsx eax, cl
lea ecx, [eax + eax*4]
movsx eax, bl
lea eax, [eax + ecx*2]
lea ecx, [eax + eax*4]
movsx eax, dl
lea eax, [eax + ecx*2]
add eax, 0xffffeb30
mov dword [esi + 0xd4], eax
mov al, byte [edi + 0xa]
cmp al, 0x20
je 0x1004a294
cmp al, 9
je 0x1004a294
cmp al, 0xa
jl 0x1004a0eb
cmp al, 0xd
jle 0x1004a294
mov ecx, dword [esp + 0x14]
push ebp
push ecx
push esi
call fcn.10049460
add esp, 0xc
cmp eax, 1
jne 0x1004a683
mov dword [esi + 0xd4], 0xc8
mov dword [esi + 0xd0], 0xa
jmp 0x1004a294
cmp byte [edi + 6], 0x2e
jne 0x1004a1a1
mov al, byte [edi + 7]
cmp al, 0x30
je 0x1004a12d
cmp al, 0x31
jne 0x1004a1a1
mov cl, byte [edi + 8]
cmp cl, 0x20
je 0x1004a13a
cmp cl, 9
jne 0x1004a1a1
movsx eax, al
sub eax, 0x26
mov dword [esi + 0xd0], eax
mov cl, byte [edi + 9]
lea eax, [ecx - 0x30]
cmp al, 9
ja 0x1004a1a1
mov bl, byte [edi + 0xa]
lea eax, [ebx - 0x30]
cmp al, 9
ja 0x1004a1a1
mov dl, byte [edi + 0xb]
lea eax, [edx - 0x30]
cmp al, 9
ja 0x1004a1a1
movsx eax, cl
lea ecx, [eax + eax*4]
movsx eax, bl
lea eax, [eax + ecx*2]
lea ecx, [eax + eax*4]
movsx eax, dl
lea eax, [eax + ecx*2]
add eax, 0xffffeb30
mov dword [esi + 0xd4], eax
mov al, byte [edi + 0xc]
cmp al, 0x20
je 0x1004a294
cmp al, 9
je 0x1004a294
sub al, 0xa
cmp al, 3
jbe 0x1004a294
push str.Unsupported_HTTP_1_subversion_in_response
push esi
call fcn.100250b0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
test eax, 0x40000
je 0x1004a683
mov al, byte [edx]
mov edi, edx
test al, al
je 0x1004a1e0
nop
cmp al, 0x20
je 0x1004a1d8
cmp al, 9
jne 0x1004a1e0
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1004a1d0
push 5
push str.RTSP_
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x1004a683
mov al, byte [edi + 5]
sub al, 0x30
cmp al, 9
ja 0x1004a746
cmp byte [edi + 6], 0x2e
jne 0x1004a746
mov al, byte [edi + 7]
sub al, 0x30
cmp al, 9
ja 0x1004a746
mov al, byte [edi + 8]
cmp al, 0x20
je 0x1004a22b
cmp al, 9
jne 0x1004a746
mov cl, byte [edi + 9]
lea eax, [ecx - 0x30]
cmp al, 9
ja 0x1004a746
mov bl, byte [edi + 0xa]
lea eax, [ebx - 0x30]
cmp al, 9
ja 0x1004a746
mov dl, byte [edi + 0xb]
lea eax, [edx - 0x30]
cmp al, 9
ja 0x1004a746
movsx eax, cl
lea ecx, [eax + eax*4]
movsx eax, bl
lea eax, [eax + ecx*2]
lea ecx, [eax + eax*4]
movsx eax, dl
lea eax, [eax + ecx*2]
add eax, 0xffffeb30
mov dword [esi + 0xd4], eax
mov al, byte [edi + 0xc]
cmp al, 0x20
je 0x1004a28a
cmp al, 9
je 0x1004a28a
sub al, 0xa
cmp al, 3
ja 0x1004a746
mov dword [esi + 0xd0], 0xb
mov ecx, dword [esi + 0xd0]
mov eax, ecx
sub eax, 0xa
je 0x1004a2aa
sub eax, 1
jne 0x1004a65c
mov ebx, dword [esp + 0x10]
mov byte [ebx + 0x4d4], cl
mov eax, dword [esi + 0xd4]
mov dword [esi + 0xd38], eax
mov eax, dword [esi + 0xd0]
mov dword [esi + 0xd40], eax
movzx eax, byte [esi + 0xd0]
mov byte [ebx + 0x4d4], al
mov al, byte [esi + 0xd15]
test al, al
je 0x1004a2f2
mov ecx, dword [esi + 0xd0]
movzx eax, al
cmp eax, ecx
jle 0x1004a304
jmp 0x1004a2f8
mov cl, byte [esi + 0xd0]
mov byte [esi + 0xd15], cl
mov ecx, dword [esi + 0xd0]
mov eax, dword [esi + 0xbf8]
or eax, dword [esi + 0xbfc]
je 0x1004a32e
cmp byte [esi + 0xd16], 0
jne 0x1004a32e
cmp dword [esi + 0xd4], 0x1a0
jne 0x1004a32e
mov byte [esi + 0x136], 1
cmp ecx, 0xa
jne 0x1004a34b
push str.HTTP_1.0__assume_close_after_body
push esi
call fcn.10025180
push 1
push ebx
call fcn.10036680
add esp, 0x10
jmp 0x1004a36e
cmp ecx, 0x14
je 0x1004a362
cmp dword [esi + 0xdc], 2
jne 0x1004a36e
cmp dword [esi + 0xd4], 0x65
jne 0x1004a36e
mov eax, dword [ebx + 0x4a8]
mov dword [eax], 2
mov ecx, dword [esi + 0xd4]
lea eax, [ecx - 0x64]
cmp eax, 0x63
setbe al
mov byte [esi + 0x137], al
sub ecx, 0xcc
je 0x1004a39f
sub ecx, 0x64
jne 0x1004a3ce
cmp byte [esi + 0x3b0], cl
je 0x1004a39f
mov byte [esi + 0xdf8], 1
mov dword [esi + 0x88], 0
mov dword [esi + 0x8c], 0
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], 0
mov byte [esi + 0x137], 1
mov edi, 0xc
lea ebp, [esi + 0x8a0]
push ebp
call fcn.10024e40
push ebp
mov ebx, eax
call fcn.10024e30
mov ebp, eax
push ebp
push 0
push ebx
call sub.VCRUNTIME140.dll_memchr
add esp, 0x14
test eax, eax
jne 0x1004a6b1
mov ecx, dword [esi + 0xc4]
cmp ecx, 2
jl 0x1004a42b
mov al, byte [ebx]
cmp al, 0x20
je 0x1004a412
cmp al, 9
jne 0x1004a417
cmp ecx, 2
jg 0x1004a42b
push ebp
push 0x3a
push ebx
call sub.VCRUNTIME140.dll_memchr
add esp, 0xc
test eax, eax
je 0x1004a695
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
push ebx
push ebp
push dword [esp + 0x18]
push esi
call fcn.10047ad0
add esp, 0x10
test eax, eax
jne 0x1004a511
push ebx
push ebp
push 1
push esi
call fcn.10025010
mov eax, dword [esi + 0xd4]
add esp, 0x10
sub eax, 0x64
cmp eax, 0x64
jae 0x1004a468
or edi, 0x20
push ebx
push ebp
push edi
push esi
call fcn.100226c0
add esp, 0x10
test eax, eax
jne 0x1004a511
mov ecx, dword [esi + 0xbc]
mov edx, 0x4b000
add ecx, ebx
cmp ebx, edx
jae 0x1004a4d6
mov eax, dword [esi + 0xd78]
add dword [esi + 0xb8], ebx
add eax, ebx
mov dword [esi + 0xd78], eax
mov dword [esi + 0xbc], ecx
cmp ecx, edx
ja 0x1004a4b9
cmp eax, 0x5dc000
jbe 0x1004a4da
mov edx, 0x5dc000
mov ecx, eax
push edx
push ecx
push str.Too_large_response_headers:__zu____u
push esi
call fcn.100250b0
add esp, 0x10
mov eax, 0x38
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
test ecx, ecx
jne 0x1004a4b9
lea ebp, [esi + 0x8a0]
push ebp
call fcn.10024e50
mov ebx, dword [esp + 0x30]
add esp, 4
test ebx, ebx
jne 0x10049efb
mov al, byte [esp + 0x24]
cmp byte [esi + 0x12d], 0
jne 0x1004a50f
test al, al
jne 0x1004a50f
push ebp
call fcn.10024de0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push ebp
push edx
push 1
push esi
call fcn.10025010
mov eax, dword [esi + 0xd4]
mov ecx, dword [esp + 0x24]
sub eax, 0x64
cmp eax, 0x64
push ebp
sbb eax, eax
and eax, 0x20
push ecx
add eax, 4
push eax
push esi
call fcn.100226c0
add esp, 0x20
test eax, eax
jne 0x1004a511
mov ecx, dword [esi + 0xbc]
mov edx, 0x4b000
add ecx, ebp
cmp ebp, edx
jae 0x1004a58b
mov eax, dword [esi + 0xd78]
add dword [esi + 0xb8], ebp
add eax, ebp
mov dword [esi + 0xd78], eax
mov dword [esi + 0xbc], ecx
cmp ecx, edx
ja 0x1004a4b9
cmp eax, 0x5dc000
ja 0x1004a4b2
jmp 0x1004a593
test ecx, ecx
jne 0x1004a4b9
lea ebp, [esi + 0x8a0]
push ebp
call fcn.10024e50
mov eax, dword [esi + 0xd4]
add esp, 4
sub eax, 0x64
cmp eax, 0x63
ja 0x1004a5b8
mov eax, dword [esi + 0xb8]
jmp 0x1004a5ba
xor eax, eax
mov edi, dword [esp + 0x28]
mov dword [esi + 0xc0], eax
lea eax, [esp + 0x1c]
push eax
push ebx
push edi
push esi
call fcn.100495b0
add esp, 0x10
test eax, eax
jne 0x1004a511
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x1c]
add edi, eax
sub ebx, eax
mov dword [esp + 0x28], edi
add dword [ecx], eax
cmp byte [esi + 0x12d], 0
je 0x1004a4f5
test ebx, ebx
jne 0x10049f00
jmp 0x1004a4f5
push 2
push edi
call fcn.10036680
add esp, 8
cmp byte [edi + 0x4d4], 0xa
jae 0x1004a738
cmp byte [esi + 0x6d5], 0
je 0x1004a75c
mov byte [esi + 0x12d], 0
lea ebp, [esi + 0x8a0]
mov al, 1
jmp 0x1004a4f9
push str.Unsupported_HTTP_version_in_response
push esi
call fcn.100250b0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, ecx
mov ecx, 0xa
cdq
idiv ecx
push edx
push eax
push str.Unsupported_HTTP_version___u._d__in_response
push esi
call fcn.100250b0
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov byte [esi + 0x12d], 0
lea ebp, [esi + 0x8a0]
jmp 0x1004a4f5
mov eax, str.Header_without_colon
push eax
push esi
call fcn.100250b0
add esp, 8
mov eax, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, str.Nul_byte_in_header
push eax
push esi
call fcn.100250b0
add esp, 8
mov eax, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push ebx
push eax
push ebp
call fcn.10024dd0
add esp, 0xc
test eax, eax
jne 0x1004a511
mov eax, dword [esp + 0x30]
add dword [eax], ebx
cmp dword [esi + 0xc4], 0
jne 0x1004a4f5
push ebp
call fcn.10024e30
add esp, 4
push eax
push ebp
call fcn.10024e40
mov ebx, dword [esp + 0x18]
add esp, 4
push eax
push ebx
push esi
call fcn.10049510
add esp, 0x10
cmp eax, 2
jne 0x1004a4f5
push eax
push ebx
mov byte [esi + 0x12d], 0
call fcn.10036680
add esp, 8
cmp byte [ebx + 0x4d4], 0xa
jb 0x1004a753
push str.Invalid_status_line
push esi
call fcn.100250b0
add esp, 8
pop edi
pop esi
pop ebp
mov eax, 8
pop ebx
add esp, 0x10
ret
cmp byte [esi + 0x6d5], 0
jne 0x1004a777
push str.Received_HTTP_0.9_when_not_allowed
push esi
call fcn.100250b0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov al, 1
jmp 0x1004a4f9