joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100265b0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x138
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x134], eax
push ebx
push ebp
mov ebp, dword [esp + 0x148]
push esi
mov esi, dword [esp + 0x148]
push edi
test esi, esi
jne 0x100265e2
or eax, 0xffffffff
jmp 0x1002670f
test ebp, ebp
jne 0x100265eb
cmp dword [esi + 0xc], ebp
je 0x100265da
push esi
call sym.libxml2.dll_xmlNanoFTPGetConnection
add esp, 4
mov dword [esi + 0x30], eax
cmp eax, 0xffffffff
je 0x100265da
mov ebx, dword [sym.imp.MSVCR90.dll__snprintf]
push str.TYPE_I_r_n
lea eax, [esp + 0x14]
push 0x12c
push eax
call ebx
lea eax, [esp + 0x1c]
add esp, 0xc
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10026620
mov edi, dword [sym.imp.WS2_32.dll_send]
push 0
sub eax, edx
mov edx, dword [esi + 0x2c]
push eax
lea ecx, [esp + 0x18]
push ecx
push edx
call edi
test eax, eax
jge 0x10026667
push str.send_failed
push 9
xor eax, eax
call fcn.10071a30
mov eax, dword [esi + 0x30]
add esp, 8
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
mov dword [esi + 0x30], eax
jmp 0x1002670f
mov eax, esi
call fcn.10024e40
cmp eax, 2
jne 0x100266dc
test ebp, ebp
jne 0x1002668c
mov edx, dword [esi + 0xc]
push edx
push str.RETR__s_r_n
push 0x12c
lea eax, [esp + 0x1c]
push eax
jmp 0x1002669c
push ebp
push str.RETR__s_r_n
push 0x12c
lea ecx, [esp + 0x1c]
push ecx
call ebx
lea eax, [esp + 0x20]
add esp, 0x10
mov byte [esp + 0x13b], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100266b0
sub eax, edx
push 0
push eax
mov eax, dword [esi + 0x2c]
lea edx, [esp + 0x18]
push edx
push eax
call edi
test eax, eax
jge 0x100266ee
push str.send_failed
push 9
xor eax, eax
call fcn.10071a30
add esp, 8
mov ecx, dword [esi + 0x30]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
mov dword [esi + 0x30], eax
jmp 0x1002670f
mov eax, esi
call fcn.10024e40
cmp eax, 1
je 0x1002670c
mov edx, dword [esi + 0x30]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
mov dword [esi + 0x30], eax
jmp 0x1002670f
mov eax, dword [esi + 0x30]
mov ecx, dword [esp + 0x144]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100ca320
add esp, 0x138
ret
Function at 0x10026730
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1120
call fcn.100cad10
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x111c], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], ecx
test esi, esi
jne 0x10026781
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0x111c]
xor ecx, esp
call fcn.100ca320
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x1002678a
cmp dword [esi + 0xc], edi
je 0x1002676a
test ecx, ecx
je 0x1002676a
push eax
push esi
call sym.libxml2.dll_xmlNanoFTPGetSocket
add esp, 8
cmp eax, 0xffffffff
je 0x1002676a
lea ecx, [ecx]
mov eax, dword [esi + 0x30]
mov ecx, 1
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
lea edx, [esp + 0x24]
mov dword [esp + 0x28], eax
push edx
inc eax
push eax
mov dword [esp + 0x28], 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jl 0x10026876
jne 0x10026819
push esi
call sym.libxml2.dll_xmlNanoFTPCheckResponse
add esp, 4
test eax, eax
jl 0x1002689a
cmp eax, 2
jne 0x10026851
mov eax, dword [esi + 0x30]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 0x30], 0xffffffff
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x111c]
xor ecx, esp
call fcn.100ca320
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x30]
push 0
push 0x1000
lea eax, [esp + 0x128]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test edi, edi
jl 0x100268be
mov eax, dword [esp + 8]
push edi
lea edx, [esp + 0x124]
push edx
push eax
call dword [esp + 0x18]
add esp, 0xc
test edi, edi
jne 0x100267a0
push esi
call sym.libxml2.dll_xmlNanoFTPCloseConnection
add esp, 4
pop edi
pop esi
mov ecx, dword [esp + 0x111c]
xor ecx, esp
call fcn.100ca320
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x30]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
mov dword [esi + 0x30], eax
pop edi
pop esi
mov ecx, dword [esp + 0x111c]
xor ecx, esp
call fcn.100ca320
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 0x30]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
mov dword [esi + 0x30], eax
pop edi
pop esi
mov ecx, dword [esp + 0x111c]
xor ecx, esp
call fcn.100ca320
mov esp, ebp
pop ebp
ret
push str.recv_failed
push 9
xor eax, eax
call fcn.10071a30
mov edx, dword [esp + 0x10]
push edi
lea ecx, [esp + 0x12c]
push ecx
push edx
call dword [esp + 0x20]
mov eax, dword [esi + 0x30]
add esp, 0x14
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [esp + 0x1124]
or eax, 0xffffffff
pop edi
mov dword [esi + 0x30], eax
pop esi
xor ecx, esp
call fcn.100ca320
mov esp, ebp
pop ebp
ret
Function at 0x10026910
Capabilities:
Receive data
Receive data on socket

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
jne 0x1002691e
or eax, 0xffffffff
pop edi
ret
mov eax, dword [edi + 0x30]
cmp eax, 0xffffffff
jne 0x1002692a
xor eax, eax
pop edi
ret
mov edx, dword [esp + 0xc]
test edx, edx
je 0x10026919
mov ecx, dword [esp + 0x10]
test ecx, ecx
jle 0x10026926
push esi
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
jg 0x10026968
jge 0x1002695f
push str.recv_failed
push 9
xor eax, eax
call fcn.10071a30
add esp, 8
push edi
call sym.libxml2.dll_xmlNanoFTPCloseConnection
add esp, 4
mov eax, esi
pop esi
pop edi
ret

Function at 0x10026b60
Capabilities:
Resolve dns

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, eax
mov eax, dword [esp + 0x1c]
mov dword [esi], 0
push ecx
mov byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x10026bf5
cmp word [ebx + 8], 2
push edi
jne 0x10026bc5
cmp word [ebx + 0xa], 4
jne 0x10026bc5
mov edi, dword [ebx + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x10026bc5
jmp 0x10026ba0
mov edx, dword [eax]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push edx
push ebp
push eax
push ecx
call fcn.10026ae0
mov dword [esi], eax
test eax, eax
je 0x10026be9
add edi, 4
lea esi, [eax + 0x1c]
mov eax, dword [edi]
test eax, eax
jne 0x10026ba0
mov edx, dword [ebx]
mov eax, dword [esp + 0x20]
push 0x400
push edx
push 0x401
push eax
call dword [sym.imp.MSVCR90.dll_strncpy_s]
add esp, 0x10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
pop edi
pop esi
pop ebp
mov eax, 8
pop ebx
ret 0x10
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x10026c05.11001
jmp dword [eax*4 + 0x10026c30]
pop esi
pop ebp
mov eax, 0x2af9
pop ebx
ret 0x10
pop esi
pop ebp
mov eax, 0x2afa
pop ebx
ret 0x10
pop esi
pop ebp
mov eax, 0x2afb
pop ebx
ret 0x10
Function at 0x10027410
Capabilities:
Get common file path

Disassembly:
sub esp, 0x238
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x234], eax
cmp dword [0x1010c3bc], 0
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], str.getaddrinfo
mov dword [esp + 0x14], 0x10026e60
mov dword [esp + 0x18], str.getnameinfo
mov dword [esp + 0x1c], 0x10027150
mov dword [esp + 0x20], str.freeaddrinfo
mov dword [esp + 0x24], fcn.10026e10
je 0x10027475
movzx eax, word [esp + 0x24c]
mov eax, dword [eax*8 + 0x100fb034]
jmp 0x10027592
push 0x104
lea ecx, [esp + 0x13c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x10027579
mov edi, dword [sym.imp.MSVCR90.dll_strcpy_s]
lea edx, [esp + 0x138]
push edx
lea eax, [esp + 0x2c]
push 0x10c
push eax
call edi
mov ebx, dword [sym.imp.MSVCR90.dll_strcat_s]
push str.ws2_32
lea ecx, [esp + 0x38]
push 0x10c
push ecx
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x18
lea edx, [esp + 0x28]
push edx
call ebp
mov esi, eax
test esi, esi
je 0x100274ee
push str.getaddrinfo
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1002753e
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [esp + 0x138]
push eax
lea ecx, [esp + 0x2c]
push 0x10c
push ecx
call edi
push str.wship6
lea edx, [esp + 0x38]
push 0x10c
push edx
call ebx
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call ebp
mov esi, eax
test esi, esi
je 0x10027579
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x10027544
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x10027579
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edi, edi
mov ecx, dword [esp + edi*8 + 0x10]
push ecx
push esi
call ebx
mov dword [esp + edi*8 + 0x14], eax
test eax, eax
je 0x10027535
inc edi
cmp edi, 3
jl 0x10027546
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov dword [0x100fb034], edx
mov dword [0x100fb03c], eax
mov dword [fcn.10026e10], ecx
movzx edx, word [esp + 0x24c]
mov eax, dword [edx*8 + 0x100fb034]
mov dword [0x1010c3bc], 1
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100ca320
add esp, 0x238
ret 4
Function at 0x10027610
Capabilities:
Initialize winsock library
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x198], eax
cmp dword [0x1010c258], 0
push esi
jne 0x100276a8
lea eax, [esp + 8]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x100276a8
cmp dword [0x1010c25c], eax
jne 0x1002769e
mov esi, dword [sym.imp.MSVCR90.dll_getenv]
push str.no_proxy
mov dword [0x100fbd40], 0x50
call esi
add esp, 4
test eax, eax
je 0x10027679
cmp byte [eax], 0x2a
jne 0x10027679
cmp byte [eax + 1], 0
je 0x1002769e
push str.http_proxy
call esi
add esp, 4
test eax, eax
jne 0x10027695
push str.HTTP_PROXY
call esi
add esp, 4
test eax, eax
je 0x1002769e
push eax
call sym.libxml2.dll_xmlNanoHTTPScanProxy
add esp, 4
mov dword [0x1010c258], 1
mov ecx, dword [esp + 0x19c]
pop esi
xor ecx, esp
call fcn.100ca320
mov esp, ebp
pop ebp
ret

Function at 0x10027a60
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
sub esp, 0x118
push ebx
push ebp
mov ebp, dword [esp + 0x128]
push esi
xor esi, esi
test byte [edi + 0x18], 1
je 0x10027b09
cmp dword [esp + 0x128], esi
je 0x10027b09
test ebp, ebp
jle 0x10027b09
mov ebx, dword [sym.imp.WS2_32.dll_send]
mov ecx, dword [esp + 0x128]
push 0
mov eax, ebp
sub eax, esi
push eax
mov eax, dword [edi + 0x14]
lea edx, [esi + ecx]
push edx
push eax
call ebx
test eax, eax
jle 0x10027ab3
add esi, eax
jmp 0x10027b05
cmp eax, 0xffffffff
jne 0x10027ad0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0xb
je 0x10027ad0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x10027b15
mov eax, dword [edi + 0x14]
lea ecx, [esp + 0x10]
push ecx
push 0
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x28], eax
push 0
inc eax
push eax
mov dword [esp + 0x24], 0x3c
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 1
call dword [sym.imp.WS2_32.dll_select]
cmp esi, ebp
jl 0x10027a93
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret
push str.send_failed_n
push 0xa
xor eax, eax
call fcn.10071a30
add esp, 8
test esi, esi
jne 0x10027b09
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x118
ret
Function at 0x10027b40
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x118
test byte [esi + 0x18], 2
push ebx
push ebp
push edi
je 0x10027caf
cmp dword [esi + 0x24], 0
jne 0x10027b82
push 0xfde8
call dword [sym.libxml2.dll_xmlMallocAtomic]
add esp, 4
mov dword [esi + 0x24], eax
test eax, eax
je 0x10027cbb
mov dword [esi + 0x34], 0xfde8
mov dword [esi + 0x30], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov ecx, dword [esi + 0x24]
mov eax, dword [esi + 0x30]
lea edx, [ecx + 0x1000]
cmp eax, edx
jbe 0x10027bb0
mov edx, dword [esi + 0x2c]
sub edx, eax
push edx
push eax
mov edi, eax
push ecx
sub edi, ecx
call dword [sym.imp.MSVCR90.dll_memmove]
sub dword [esi + 0x30], edi
sub dword [esi + 0x28], edi
add esp, 0xc
sub dword [esi + 0x2c], edi
mov ecx, dword [esi + 0x34]
mov edi, dword [esi + 0x24]
mov eax, dword [esi + 0x2c]
lea edx, [ecx + edi]
lea ebx, [eax + 0x1000]
cmp edx, ebx
jae 0x10027c07
mov ebp, dword [esi + 0x28]
mov ebx, dword [esi + 0x30]
sub eax, edi
mov dword [esp + 0xc], eax
lea eax, [ecx + ecx]
push eax
push edi
sub ebp, edi
sub ebx, edi
mov dword [esi + 0x34], eax
call dword [sym.libxml2.dll_xmlRealloc]
add esp, 8
mov dword [esi + 0x24], eax
test eax, eax
je 0x10027cd5
mov ecx, dword [esp + 0xc]
lea edx, [eax + ecx]
lea ecx, [eax + ebp]
add eax, ebx
mov dword [esi + 0x2c], edx
mov dword [esi + 0x28], ecx
mov dword [esi + 0x30], eax
mov edx, dword [esi + 0x2c]
mov eax, dword [esi + 0x14]
push 0
push 0x1000
push edx
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov dword [esi + 0x38], eax
test eax, eax
jg 0x10027cf9
je 0x10027caf
cmp eax, 0xffffffff
jne 0x10027c60
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2746
jg 0x10027d06
je 0x10027caf
cmp eax, 0xb
je 0x10027c60
cmp eax, 0x2732
jle 0x10027d0d
cmp eax, 0x2734
jg 0x10027d0d
mov eax, dword [esi + 0x14]
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
lea edx, [esp + 0x24]
mov dword [esp + 0x28], eax
push edx
inc eax
push eax
mov dword [esp + 0x24], 0x3c
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 1
jge 0x10027ca5
call dword [sym.imp.MSVCR90.dll__errno]
cmp dword [eax], 4
jne 0x10027caf
test byte [esi + 0x18], 2
jne 0x10027b53
xor eax, eax
pop edi
pop ebp
pop ebx
add esp, 0x118
ret
mov eax, str.allocating_input
call fcn.100275b0
or eax, 0xffffffff
mov dword [esi + 0x38], eax
pop edi
pop ebp
pop ebx
add esp, 0x118
ret
mov eax, str.allocating_input_buffer
call fcn.100275b0
push edi
call dword [sym.libxml2.dll_xmlFree]
add esp, 4
or eax, 0xffffffff
mov dword [esi + 0x38], eax
pop edi
pop ebp
pop ebx
add esp, 0x118
ret
add dword [esi + 0x2c], eax
pop edi
pop ebp
pop ebx
add esp, 0x118
ret
cmp eax, 0x274a
je 0x10027caf
push str.recv_failed_n
push 0xa
xor eax, eax
call fcn.10071a30
add esp, 8
pop edi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x118
ret
Function at 0x100281e0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get socket status
Set socket configuration

Disassembly:
sub esp, 0x224
push esi
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10028215
push str.socket_failed_n
push 0xa
xor eax, eax
call fcn.10071a30
add esp, 8
or eax, esi
pop esi
add esp, 0x224
ret
lea eax, [esp + 0xc]
push eax
push 0x8004667e
push esi
mov dword [esp + 0x18], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov ecx, dword [esp + 0x22c]
inc eax
neg eax
sbb eax, eax
push 0x10
neg eax
push ecx
dec eax
push esi
mov dword [esp + 0x14], eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1002826e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jl 0x10028264
cmp eax, 0x2734
jle 0x1002826e
push str.error_connecting_to_HTTP_server
jmp 0x10028385
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x124]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0
lea edx, [esi + 1]
push edx
mov dword [esp + 0x24], 0x3c
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], 1
mov dword [esp + 0x138], esi
mov dword [esp + 0x134], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x10028380
test eax, eax
je 0x10028379
lea eax, [esp + 0x18]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x100282f6
lea ecx, [esp + 0x120]
push ecx
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x100282f6
push str.select_failed_n
jmp 0x10028385
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0xc]
push eax
push 0x1007
push 0xffff
push esi
mov dword [esp + 0x20], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jge 0x10028339
push str.getsockopt_failed_n
push 0xa
xor eax, eax
call fcn.10071a30
add esp, 8
or eax, 0xffffffff
pop esi
add esp, 0x224
ret
cmp dword [esp + 8], 0
je 0x1002836f
push str.Error_connecting_to_remote_host
push 0xa
xor eax, eax
call fcn.10071a30
add esp, 8
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.MSVCR90.dll__errno]
mov ecx, dword [esp + 8]
mov dword [eax], ecx
or eax, 0xffffffff
pop esi
add esp, 0x224
ret
mov eax, esi
pop esi
add esp, 0x224
ret
push str.Connect_attempt_timed_out
jmp 0x10028385
push str.Connect_failed
push 0xa
xor eax, eax
call fcn.10071a30
add esp, 8
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
add esp, 0x224
ret
Function at 0x10036ad0
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0x24]
mov ecx, dword [eax + 0x10]
push edi
xor edi, edi
cmp byte [ecx], 0x25
jne 0x10036b95
push esi
call sym.libxml2.dll_xmlNextChar
add esp, 4
push esi
call sym.libxml2.dll_xmlParseName
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x10036b13
mov ecx, str.xmlParsePEReference:_no_name_n
lea eax, [edi + 0x44]
call fcn.10029520
pop edi
pop esi
pop ebx
pop ecx
ret
mov edx, dword [esi + 0x24]
mov eax, dword [edx + 0x10]
cmp byte [eax], 0x3b
je 0x10036b2f
push 0x17
xor edi, edi
call fcn.100290d0
add esp, 4
pop edi
pop esi
pop ebx
pop ecx
ret
push esi
call sym.libxml2.dll_xmlNextChar
mov eax, dword [esi]
inc dword [esi + 0x1b8]
add esp, 4
test eax, eax
je 0x10036b57
mov eax, dword [eax + 0x60]
test eax, eax
je 0x10036b57
mov ecx, dword [esi + 4]
push ebx
push ecx
call eax
add esp, 8
mov edi, eax
cmp dword [esi + 0xac], 0xffffffff
je 0x10036b95
test edi, edi
jne 0x10036bb7
cmp dword [esi + 0x1c], 1
je 0x10036b9a
cmp dword [esi + 0x58], edi
jne 0x10036b74
cmp dword [esi + 0x5c], edi
je 0x10036b9a
mov ecx, ebx
mov edi, str.PEReference:____s__not_found_n
mov ebx, 0x1b
mov eax, esi
call fcn.10029590
mov dword [esi + 0x64], 0
mov dword [esi + 0x5c], 1
pop edi
pop esi
pop ebx
pop ecx
ret
mov eax, ebx
mov edx, str.PEReference:____s__not_found_n
mov ecx, 0x1a
call fcn.10029780
mov dword [esi + 0x5c], 1
pop edi
pop esi
pop ebx
pop ecx
ret
mov eax, dword [edi + 0x30]
cmp eax, 4
je 0x10036be3
cmp eax, 5
je 0x10036be3
mov ecx, ebx
mov edi, str.Internal:____s__is_not_a_parameter_entity_n
mov ebx, 0x1b
mov eax, esi
call fcn.10029590
mov dword [esi + 0x5c], 1
pop edi
pop esi
pop ebx
pop ecx
ret
mov edx, dword [esi + 0x24]
cmp dword [edx + 0x28], 0x1002b1a0
push edi
je 0x10036c14
mov eax, esi
call fcn.1002b1b0
add esp, 4
push eax
push esi
call sym.libxml2.dll_xmlPushInput
add esp, 8
test eax, eax
jl 0x10036b95
mov dword [esi + 0x5c], 1
pop edi
pop esi
pop ebx
pop ecx
ret
push esi
call sym.libxml2.dll_xmlNewEntityInputStream
push eax
push esi
call sym.libxml2.dll_xmlPushInput
add esp, 0x10
test eax, eax
jl 0x10036b95
cmp dword [edi + 0x30], 5
jne 0x10036b8e
mov eax, dword [esi + 0x24]
mov eax, dword [eax + 0x10]
cmp byte [eax], 0x3c
jne 0x10036b8e
cmp byte [eax + 1], 0x3f
jne 0x10036b8e
cmp byte [eax + 2], 0x78
jne 0x10036b8e
cmp byte [eax + 3], 0x6d
jne 0x10036b8e
cmp byte [eax + 4], 0x6c
jne 0x10036b8e
mov al, byte [eax + 5]
cmp al, 0x20
je 0x10036c84
cmp al, 9
jb 0x10036c7c
cmp al, 0xa
jbe 0x10036c84
cmp al, 0xd
jne 0x10036b8e
push esi
call sym.libxml2.dll_xmlParseTextDecl
add esp, 4
cmp dword [esi + 0x54], 0x20
jne 0x10036b8e
pop edi
mov dword [esi + 0xac], 0xffffffff
pop esi
pop ebx
pop ecx
ret
Function at 0x10059960
Capabilities:
Create thread
Get thread local storage value
Set thread local storage value

Disassembly:
call fcn.10059ad0
mov eax, dword [0x100faa04]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x10059a52
push esi
call fcn.10059890
mov esi, eax
test esi, esi
jne 0x10059987
pop esi
ret
push ebx
push edi
push 8
call dword [sym.imp.MSVCR90.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
jne 0x10059a0b
call fcn.10059ad0
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call ebx
cmp dword [0x100fbd44], eax
jne 0x100599b6
mov edi, 0x1010c1f8
jmp 0x100599c3
call sym.libxml2.dll_xmlGetGlobalState
mov edi, eax
add edi, 0x17c
call fcn.10059ad0
call ebx
cmp dword [0x100fbd44], eax
jne 0x100599d9
mov eax, 0x100fac24
jmp 0x100599e3
call sym.libxml2.dll_xmlGetGlobalState
add eax, 0x174
mov ecx, dword [edi]
mov edx, dword [eax]
push str.xmlGetGlobalState:_out_of_memory_n
push ecx
call edx
lea eax, [esi + 0x1c4]
push eax
call sym.libxml2.dll_xmlResetError
push esi
call dword [sym.imp.MSVCR90.dll_free]
add esp, 0x10
pop edi
pop ebx
xor eax, eax
pop esi
ret
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 1
push 0
push edi
mov dword [edi + 4], esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ecx, dword [0x100faa04]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edi
push 0
push 0x10059920
call dword [sym.imp.MSVCR90.dll__beginthread]
add esp, 0xc
pop edi
pop ebx
mov eax, esi
pop esi
ret

Function at 0x10059ad0
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x1010c270], 0
jne 0x10059b2e
push 0x1010c274
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x10059b0f
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x100faa04], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x100fbd44], eax
call fcn.1000e640
mov dword [0x1010c270], 1
ret
cmp dword [0x1010c270], 0
jne 0x10059b2e
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop
push 0
call esi
cmp dword [0x1010c270], 0
je 0x10059b20
pop esi
ret
Function at 0x100614f0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x100614fd
xor eax, eax
pop esi
ret
cmp dword [esi], 0
je 0x100614f9
mov eax, dword [esp + 8]
test eax, eax
jne 0x10061513
call dword [sym.imp.MSVCR90.dll___iob_func]
add eax, 0x20
mov ecx, dword [esi]
push eax
mov eax, dword [esi + 4]
push eax
push 1
push ecx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
pop esi
ret

Function at 0x100642f0
Capabilities:
Parse credit card information

Disassembly:
test ebx, ebx
jne 0x100642f8
or eax, 0xffffffff
ret
push esi
mov esi, dword [ebx]
mov edx, 1
mov al, byte [esi]
cmp al, 0x61
jl 0x1006430e
cmp al, 0x7a
jle 0x100643f1
cmp al, 0x41
jl 0x1006431a
cmp al, 0x5a
jle 0x100643f1
cmp al, 0x30
jl 0x10064326
cmp al, 0x39
jle 0x100643f1
cmp al, 0x2d
je 0x100643f1
cmp al, 0x2e
je 0x100643f1
cmp al, 0x5f
je 0x100643f1
cmp al, 0x7e
je 0x100643f1
cmp al, 0x25
jne 0x1006438c
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x10064357
cmp cl, 0x39
jle 0x1006436b
cmp cl, 0x61
jl 0x10064361
cmp cl, 0x66
jle 0x1006436b
cmp cl, 0x41
jl 0x1006438c
cmp cl, 0x46
jg 0x1006438c
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x10064378
cmp cl, 0x39
jle 0x100643f1
cmp cl, 0x61
jl 0x10064382
cmp cl, 0x66
jle 0x100643f1
cmp cl, 0x41
jl 0x1006438c
cmp cl, 0x46
jle 0x100643f1
cmp al, 0x21
je 0x100643f1
cmp al, 0x24
je 0x100643f1
cmp al, 0x26
je 0x100643f1
cmp al, 0x28
je 0x100643f1
cmp al, 0x29
je 0x100643f1
cmp al, 0x2a
je 0x100643f1
cmp al, 0x2b
je 0x100643f1
cmp al, 0x2c
je 0x100643f1
cmp al, 0x3b
je 0x100643f1
cmp al, 0x3d
je 0x100643f1
cmp al, 0x27
je 0x100643f1
cmp al, 0x3a
je 0x100643f1
cmp al, 0x40
je 0x100643f1
cmp al, 0x2f
je 0x100643f1
cmp al, 0x3f
je 0x100643f1
cmp al, 0x5b
je 0x100643f1
cmp al, 0x5d
je 0x100643f1
test edi, edi
je 0x10064447
test byte [edi + 0x24], dl
je 0x10064404
cmp al, 0x7b
je 0x100643f1
cmp al, 0x7d
je 0x100643f1
cmp al, 0x7c
je 0x100643f1
cmp al, 0x5c
je 0x100643f1
cmp al, 0x5e
je 0x100643f1
cmp al, 0x60
jne 0x10064404
cmp al, 0x25
jne 0x100643fd
add esi, 3
jmp 0x10064300
add esi, edx
jmp 0x10064300
mov eax, dword [edi + 0x20]
test eax, eax
je 0x10064415
push eax
call dword [sym.libxml2.dll_xmlFree]
add esp, 4
test byte [edi + 0x24], 2
mov eax, dword [ebx]
je 0x10064434
mov ecx, esi
sub ecx, eax
push ecx
push eax
call sym.libxml2.dll_xmlStrndup
add esp, 8
mov dword [edi + 0x20], eax
mov dword [ebx], esi
xor eax, eax
pop esi
ret
mov edx, esi
push 0
sub edx, eax
push edx
push eax
call sym.libxml2.dll_xmlURIUnescapeString
add esp, 0xc
mov dword [edi + 0x20], eax
mov dword [ebx], esi
xor eax, eax
pop esi
ret