joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5904f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, eax
xor eax, eax
push edi
mov edi, ecx
test edx, edx
je 0x59052b
mov cl, byte [edx]
movzx esi, cl
mov eax, esi
shl eax, 4
sub eax, esi
add eax, eax
test cl, cl
je 0x59052b
push ebp
mov esi, eax
mov ebp, eax
shl esi, 5
shr ebp, 3
movsx ecx, cl
add esi, ebp
inc edx
add esi, ecx
mov cl, byte [edx]
xor eax, esi
test cl, cl
jne 0x590510
pop ebp
test edi, edi
je 0x59054f
mov cl, byte [edi]
test cl, cl
je 0x59054f
mov edx, eax
mov esi, eax
shl edx, 5
shr esi, 3
movsx ecx, cl
add edx, esi
inc edi
add edx, ecx
mov cl, byte [edi]
xor eax, edx
test cl, cl
jne 0x590535
test ebx, ebx
je 0x59057a
mov cl, byte [ebx]
test cl, cl
je 0x59057a
lea esp, [esp]
mov edx, eax
mov esi, eax
shl edx, 5
shr esi, 3
movsx ecx, cl
add edx, esi
inc ebx
add edx, ecx
mov cl, byte [ebx]
xor eax, edx
test cl, cl
jne 0x590560
mov ecx, dword [esp + 0x10]
xor edx, edx
div dword [ecx + 4]
pop edi
pop esi
pop ebx
mov eax, edx
ret

Function at 0x590590
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov ebx, eax
mov esi, ecx
test edx, edx
je 0x5906e2
mov cl, byte [edx]
movzx edi, cl
mov eax, edi
shl eax, 4
sub eax, edi
add eax, eax
test cl, cl
je 0x5905d4
mov edi, eax
mov ebp, eax
shl edi, 5
shr ebp, 3
movsx ecx, cl
add edi, ebp
inc edx
add edi, ecx
mov cl, byte [edx]
xor eax, edi
test cl, cl
jne 0x5905b6
mov ebp, dword [esp + 0x18]
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
lea edx, [edx + ecx + 0x3a]
xor eax, edx
test esi, esi
je 0x59060a
mov cl, byte [esi]
test cl, cl
je 0x59060a
mov edi, edi
mov edx, eax
mov edi, eax
shl edx, 5
shr edi, 3
movsx ecx, cl
add edx, edi
inc esi
add edx, ecx
mov cl, byte [esi]
xor eax, edx
test cl, cl
jne 0x5905f0
test ebx, ebx
je 0x59063e
mov cl, byte [ebx]
test cl, cl
je 0x59062e
mov edx, eax
mov esi, eax
shl edx, 5
shr esi, 3
movsx ecx, cl
add edx, esi
inc ebx
add edx, ecx
mov cl, byte [ebx]
xor eax, edx
test cl, cl
jne 0x590614
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
lea edx, [edx + ecx + 0x3a]
xor eax, edx
test ebp, ebp
je 0x59066b
mov cl, byte [ebp]
test cl, cl
je 0x59066b
lea esp, [esp]
mov edx, eax
mov esi, eax
shl edx, 5
shr esi, 3
movsx ecx, cl
add edx, esi
inc ebp
add edx, ecx
mov cl, byte [ebp]
xor eax, edx
test cl, cl
jne 0x590650
mov edx, dword [esp + 0x1c]
test edx, edx
je 0x5906aa
mov cl, byte [edx]
test cl, cl
je 0x59069a
lea esp, [esp]
mov esi, eax
mov edi, eax
shl esi, 5
shr edi, 3
movsx ecx, cl
add esi, edi
inc edx
add esi, ecx
mov cl, byte [edx]
xor eax, esi
test cl, cl
jne 0x590680
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
lea edx, [edx + ecx + 0x3a]
xor eax, edx
mov edx, dword [esp + 0x20]
test edx, edx
je 0x5906d2
mov cl, byte [edx]
test cl, cl
je 0x5906d2
mov esi, eax
mov edi, eax
shl esi, 5
shr edi, 3
movsx ecx, cl
add esi, edi
inc edx
add esi, ecx
mov cl, byte [edx]
xor eax, esi
test cl, cl
jne 0x5906b8
mov ecx, dword [esp + 0x14]
xor edx, edx
div dword [ecx + 4]
pop edi
pop esi
pop ebp
pop ebx
mov eax, edx
ret
movzx ecx, byte [esi]
mov eax, ecx
shl eax, 4
sub eax, ecx
add eax, eax
jmp 0x5905e4
Function at 0x597d80
Capabilities:
Parse credit card information

Disassembly:
mov edx, dword [esi]
mov al, byte [edx]
cmp al, 0x61
jl 0x597d90
cmp al, 0x7a
jle 0x597e50
cmp al, 0x41
jl 0x597d9c
cmp al, 0x5a
jle 0x597e50
cmp al, 0x30
jl 0x597da8
cmp al, 0x39
jle 0x597e50
cmp al, 0x2d
je 0x597e50
cmp al, 0x2e
je 0x597e50
cmp al, 0x5f
je 0x597e50
cmp al, 0x7e
je 0x597e50
cmp al, 0x25
jne 0x597e0e
mov cl, byte [edx + 1]
cmp cl, 0x30
jl 0x597dd9
cmp cl, 0x39
jle 0x597ded
cmp cl, 0x61
jl 0x597de3
cmp cl, 0x66
jle 0x597ded
cmp cl, 0x41
jl 0x597e0e
cmp cl, 0x46
jg 0x597e0e
mov cl, byte [edx + 2]
cmp cl, 0x30
jl 0x597dfa
cmp cl, 0x39
jle 0x597e50
cmp cl, 0x61
jl 0x597e04
cmp cl, 0x66
jle 0x597e50
cmp cl, 0x41
jl 0x597e0e
cmp cl, 0x46
jle 0x597e50
cmp al, 0x21
je 0x597e50
cmp al, 0x24
je 0x597e50
cmp al, 0x26
je 0x597e50
cmp al, 0x28
je 0x597e50
cmp al, 0x29
je 0x597e50
cmp al, 0x2a
je 0x597e50
cmp al, 0x2b
je 0x597e50
cmp al, 0x2c
je 0x597e50
cmp al, 0x3b
je 0x597e50
cmp al, 0x3d
je 0x597e50
cmp al, 0x27
je 0x597e50
cmp al, 0x3a
je 0x597e50
cmp al, 0x40
je 0x597e50
xor eax, eax
cmp dword [esp + 4], eax
sete al
ret
mov al, byte [edx]
cmp al, 0x61
jl 0x597e5e
cmp al, 0x7a
jle 0x597f08
cmp al, 0x41
jl 0x597e6a
cmp al, 0x5a
jle 0x597f08
cmp al, 0x30
jl 0x597e76
cmp al, 0x39
jle 0x597f08
cmp al, 0x2d
je 0x597f08
cmp al, 0x2e
je 0x597f08
cmp al, 0x5f
je 0x597f08
cmp al, 0x7e
je 0x597f08
cmp al, 0x25
jne 0x597ed4
mov cl, byte [edx + 1]
cmp cl, 0x30
jl 0x597e9f
cmp cl, 0x39
jle 0x597eb3
cmp cl, 0x61
jl 0x597ea9
cmp cl, 0x66
jle 0x597eb3
cmp cl, 0x41
jl 0x597ed4
cmp cl, 0x46
jg 0x597ed4
mov cl, byte [edx + 2]
cmp cl, 0x30
jl 0x597ec0
cmp cl, 0x39
jle 0x597f08
cmp cl, 0x61
jl 0x597eca
cmp cl, 0x66
jle 0x597f08
cmp cl, 0x41
jl 0x597ed4
cmp cl, 0x46
jle 0x597f08
cmp al, 0x21
je 0x597f08
cmp al, 0x24
je 0x597f08
cmp al, 0x26
je 0x597f08
cmp al, 0x28
je 0x597f08
cmp al, 0x29
je 0x597f08
cmp al, 0x2a
je 0x597f08
cmp al, 0x2b
je 0x597f08
cmp al, 0x2c
je 0x597f08
cmp al, 0x3b
je 0x597f08
cmp al, 0x3d
je 0x597f08
cmp al, 0x27
je 0x597f08
cmp al, 0x3a
je 0x597f08
cmp al, 0x40
jne 0x597f1e
cmp al, bl
je 0x597f1e
cmp al, 0x25
jne 0x597f18
add edx, 3
jmp 0x597e50
inc edx
jmp 0x597e50
mov dword [esi], edx
xor eax, eax
ret
Function at 0x599120
Capabilities:
Parse credit card information

Disassembly:
test ebx, ebx
jne 0x599128
or eax, 0xffffffff
ret
push esi
mov esi, dword [ebx]
mov edx, 1
mov al, byte [esi]
cmp al, 0x61
jl 0x59913e
cmp al, 0x7a
jle 0x599221
cmp al, 0x41
jl 0x59914a
cmp al, 0x5a
jle 0x599221
cmp al, 0x30
jl 0x599156
cmp al, 0x39
jle 0x599221
cmp al, 0x2d
je 0x599221
cmp al, 0x2e
je 0x599221
cmp al, 0x5f
je 0x599221
cmp al, 0x7e
je 0x599221
cmp al, 0x25
jne 0x5991bc
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x599187
cmp cl, 0x39
jle 0x59919b
cmp cl, 0x61
jl 0x599191
cmp cl, 0x66
jle 0x59919b
cmp cl, 0x41
jl 0x5991bc
cmp cl, 0x46
jg 0x5991bc
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x5991a8
cmp cl, 0x39
jle 0x599221
cmp cl, 0x61
jl 0x5991b2
cmp cl, 0x66
jle 0x599221
cmp cl, 0x41
jl 0x5991bc
cmp cl, 0x46
jle 0x599221
cmp al, 0x21
je 0x599221
cmp al, 0x24
je 0x599221
cmp al, 0x26
je 0x599221
cmp al, 0x28
je 0x599221
cmp al, 0x29
je 0x599221
cmp al, 0x2a
je 0x599221
cmp al, 0x2b
je 0x599221
cmp al, 0x2c
je 0x599221
cmp al, 0x3b
je 0x599221
cmp al, 0x3d
je 0x599221
cmp al, 0x27
je 0x599221
cmp al, 0x3a
je 0x599221
cmp al, 0x40
je 0x599221
cmp al, 0x2f
je 0x599221
cmp al, 0x3f
je 0x599221
cmp al, 0x5b
je 0x599221
cmp al, 0x5d
je 0x599221
test edi, edi
je 0x599277
test byte [edi + 0x24], dl
je 0x599234
cmp al, 0x7b
je 0x599221
cmp al, 0x7d
je 0x599221
cmp al, 0x7c
je 0x599221
cmp al, 0x5c
je 0x599221
cmp al, 0x5e
je 0x599221
cmp al, 0x60
jne 0x599234
cmp al, 0x25
jne 0x59922d
add esi, 3
jmp 0x599130
add esi, edx
jmp 0x599130
mov eax, dword [edi + 0x20]
test eax, eax
je 0x599245
push eax
call dword [0x66e0f8]
add esp, 4
test byte [edi + 0x24], 2
mov eax, dword [ebx]
je 0x599264
mov ecx, esi
sub ecx, eax
push ecx
push eax
call fcn.00579900
add esp, 8
mov dword [edi + 0x20], eax
mov dword [ebx], esi
xor eax, eax
pop esi
ret
mov edx, esi
push 0
sub edx, eax
push edx
push eax
call fcn.00598df0
add esp, 0xc
mov dword [edi + 0x20], eax
mov dword [ebx], esi
xor eax, eax
pop esi
ret
Function at 0x599280
Capabilities:
Parse credit card information

Disassembly:
test ebx, ebx
jne 0x599288
or eax, 0xffffffff
ret
push esi
mov esi, dword [ebx]
mov edx, 1
mov al, byte [esi]
cmp al, 0x61
jl 0x59929e
cmp al, 0x7a
jle 0x599385
cmp al, 0x41
jl 0x5992aa
cmp al, 0x5a
jle 0x599385
cmp al, 0x30
jl 0x5992b6
cmp al, 0x39
jle 0x599385
cmp al, 0x2d
je 0x599385
cmp al, 0x2e
je 0x599385
cmp al, 0x5f
je 0x599385
cmp al, 0x7e
je 0x599385
cmp al, 0x25
jne 0x59931c
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x5992e7
cmp cl, 0x39
jle 0x5992fb
cmp cl, 0x61
jl 0x5992f1
cmp cl, 0x66
jle 0x5992fb
cmp cl, 0x41
jl 0x59931c
cmp cl, 0x46
jg 0x59931c
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x599308
cmp cl, 0x39
jle 0x599385
cmp cl, 0x61
jl 0x599312
cmp cl, 0x66
jle 0x599385
cmp cl, 0x41
jl 0x59931c
cmp cl, 0x46
jle 0x599385
cmp al, 0x21
je 0x599385
cmp al, 0x24
je 0x599385
cmp al, 0x26
je 0x599385
cmp al, 0x28
je 0x599385
cmp al, 0x29
je 0x599385
cmp al, 0x2a
je 0x599385
cmp al, 0x2b
je 0x599385
cmp al, 0x2c
je 0x599385
cmp al, 0x3b
je 0x599385
cmp al, 0x3d
je 0x599385
cmp al, 0x27
je 0x599385
cmp al, 0x3a
je 0x599385
cmp al, 0x40
je 0x599385
cmp al, 0x2f
je 0x599385
cmp al, 0x3f
je 0x599385
test edi, edi
je 0x5993f8
test byte [edi + 0x24], dl
je 0x599398
cmp al, 0x7b
je 0x599385
cmp al, 0x7d
je 0x599385
cmp al, 0x7c
je 0x599385
cmp al, 0x5c
je 0x599385
cmp al, 0x5e
je 0x599385
cmp al, 0x5b
je 0x599385
cmp al, 0x5d
je 0x599385
cmp al, 0x60
jne 0x599398
cmp al, 0x25
jne 0x599391
add esi, 3
jmp 0x599290
add esi, edx
jmp 0x599290
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x5993a9
push eax
call dword [0x66e0f8]
add esp, 4
test byte [edi + 0x24], 2
mov eax, dword [ebx]
je 0x5993c1
mov ecx, esi
sub ecx, eax
push ecx
push eax
call fcn.00579900
add esp, 8
jmp 0x5993d1
mov edx, esi
push 0
sub edx, eax
push edx
push eax
call fcn.00598df0
add esp, 0xc
mov dword [edi + 0x1c], eax
mov eax, dword [edi + 0x28]
test eax, eax
je 0x5993e5
push eax
call dword [0x66e0f8]
add esp, 4
mov eax, dword [ebx]
mov ecx, esi
sub ecx, eax
push ecx
push eax
call fcn.00579900
add esp, 8
mov dword [edi + 0x28], eax
mov dword [ebx], esi
xor eax, eax
pop esi
ret
Function at 0x599400
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, dword [ebx]
mov al, byte [esi]
cmp al, 0x61
jl 0x599411
cmp al, 0x7a
jle 0x5994b3
cmp al, 0x41
jl 0x59941d
cmp al, 0x5a
jle 0x5994b3
cmp al, 0x30
jl 0x599429
cmp al, 0x39
jle 0x5994b3
cmp al, 0x2d
je 0x5994b3
cmp al, 0x2e
je 0x5994b3
cmp al, 0x5f
je 0x5994b3
cmp al, 0x7e
je 0x5994b3
cmp al, 0x25
jne 0x599483
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x59944e
cmp cl, 0x39
jle 0x599462
cmp cl, 0x61
jl 0x599458
cmp cl, 0x66
jle 0x599462
cmp cl, 0x41
jl 0x599483
cmp cl, 0x46
jg 0x599483
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x59946f
cmp cl, 0x39
jle 0x5994b3
cmp cl, 0x61
jl 0x599479
cmp cl, 0x66
jle 0x5994b3
cmp cl, 0x41
jl 0x599483
cmp cl, 0x46
jle 0x5994b3
cmp al, 0x21
je 0x5994b3
cmp al, 0x24
je 0x5994b3
cmp al, 0x26
je 0x5994b3
cmp al, 0x28
je 0x5994b3
cmp al, 0x29
je 0x5994b3
cmp al, 0x2a
je 0x5994b3
cmp al, 0x2b
je 0x5994b3
cmp al, 0x2c
je 0x5994b3
cmp al, 0x3b
je 0x5994b3
cmp al, 0x3d
je 0x5994b3
cmp al, 0x27
je 0x5994b3
cmp al, 0x3a
jne 0x5994c5
cmp al, 0x25
jne 0x5994bf
add esi, 3
jmp 0x599403
inc esi
jmp 0x599403
cmp byte [esi], 0x40
jne 0x599517
test edi, edi
je 0x599511
mov eax, dword [edi + 0x10]
test eax, eax
je 0x5994df
push eax
call dword [0x66e0f8]
add esp, 4
test byte [edi + 0x24], 2
mov eax, dword [ebx]
je 0x5994fe
mov ecx, esi
sub ecx, eax
push ecx
push eax
call fcn.00579900
add esp, 8
mov dword [edi + 0x10], eax
mov dword [ebx], esi
xor eax, eax
pop esi
ret
mov edx, esi
push 0
sub edx, eax
push edx
push eax
call fcn.00598df0
add esp, 0xc
mov dword [edi + 0x10], eax
mov dword [ebx], esi
xor eax, eax
pop esi
ret
mov eax, 1
pop esi
ret
Function at 0x599520
Capabilities:
Parse credit card information

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, dword [eax]
mov al, byte [edi]
mov dword [esp + 0x10], edi
mov ebx, edi
cmp al, 0x5b
jne 0x599565
mov al, byte [edi + 1]
inc edi
cmp al, 0x5d
je 0x59954f
test al, al
je 0x599555
mov al, byte [edi + 1]
inc edi
cmp al, 0x5d
jne 0x599543
inc edi
jmp 0x599676
cmp byte [edi], 0x5d
je 0x59954f
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
cmp al, 0x30
jl 0x5995b8
cmp al, 0x39
jg 0x5995b8
lea esi, [esp + 0x10]
call fcn.00597cf0
test eax, eax
jne 0x5995b8
mov ecx, dword [esp + 0x10]
cmp byte [ecx], 0x2e
jne 0x5995b8
inc dword [esp + 0x10]
call fcn.00597cf0
test eax, eax
jne 0x5995b8
mov edx, dword [esp + 0x10]
cmp byte [edx], 0x2e
jne 0x5995b8
call fcn.00597cf0
test eax, eax
jne 0x5995b8
mov eax, dword [esp + 0x10]
cmp byte [eax], 0x2e
jne 0x5995b8
call fcn.00597cf0
test eax, eax
je 0x599672
mov al, byte [edi]
cmp al, 0x61
jl 0x5995c6
cmp al, 0x7a
jle 0x599660
cmp al, 0x41
jl 0x5995d2
cmp al, 0x5a
jle 0x599660
cmp al, 0x30
jl 0x5995de
cmp al, 0x39
jle 0x599660
cmp al, 0x2d
je 0x599660
cmp al, 0x2e
je 0x599660
cmp al, 0x5f
je 0x599660
cmp al, 0x7e
je 0x599660
cmp al, 0x25
jne 0x599634
mov cl, byte [edi + 1]
cmp cl, 0x30
jl 0x5995ff
cmp cl, 0x39
jle 0x599613
cmp cl, 0x61
jl 0x599609
cmp cl, 0x66
jle 0x599613
cmp cl, 0x41
jl 0x599634
cmp cl, 0x46
jg 0x599634
mov cl, byte [edi + 2]
cmp cl, 0x30
jl 0x599620
cmp cl, 0x39
jle 0x599660
cmp cl, 0x61
jl 0x59962a
cmp cl, 0x66
jle 0x599660
cmp cl, 0x41
jl 0x599634
cmp cl, 0x46
jle 0x599660
cmp al, 0x21
je 0x599660
cmp al, 0x24
je 0x599660
cmp al, 0x26
je 0x599660
cmp al, 0x28
je 0x599660
cmp al, 0x29
je 0x599660
cmp al, 0x2a
je 0x599660
cmp al, 0x2b
je 0x599660
cmp al, 0x2c
je 0x599660
cmp al, 0x3b
je 0x599660
cmp al, 0x3d
je 0x599660
cmp al, 0x27
jne 0x599676
cmp al, 0x25
jne 0x59966c
add edi, 3
jmp 0x5995b8
inc edi
jmp 0x5995b8
mov edi, dword [esp + 0x10]
xor esi, esi
cmp ebp, esi
je 0x5996ed
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x59968d
push eax
call dword [0x66e0f8]
add esp, 4
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], esi
cmp eax, esi
je 0x5996a1
push eax
call dword [0x66e0f8]
add esp, 4
cmp edi, ebx
je 0x5996ea
test byte [ebp + 0x24], 2
je 0x5996ca
mov ecx, edi
sub ecx, ebx
push ecx
push ebx
call fcn.00579900
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 0x24]
add esp, 8
mov dword [eax], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov edx, edi
push esi
sub edx, ebx
push edx
push ebx
call fcn.00598df0
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 0x28]
add esp, 0xc
mov dword [eax], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov dword [ebp + 0xc], esi
mov eax, dword [esp + 0x1c]
mov dword [eax], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x599a70
Capabilities:
Parse credit card information

Disassembly:
push ecx
push esi
mov esi, dword [ebx]
push edi
mov edi, eax
mov al, byte [esi]
mov dword [esp + 8], esi
cmp al, 0x2f
jne 0x599ad8
cmp byte [esi + 1], 0x2f
lea eax, [esp + 8]
push eax
jne 0x599ac4
add esi, 2
mov eax, edi
mov dword [esp + 0xc], esi
call fcn.00599700
add esp, 4
test eax, eax
jne 0x599bd3
lea ecx, [esp + 8]
push ecx
call fcn.00599780
add esp, 4
test eax, eax
jne 0x599bd3
mov edx, dword [esp + 8]
pop edi
mov dword [ebx], edx
pop esi
pop ecx
ret
call fcn.00599820
add esp, 4
test eax, eax
je 0x599bcb
pop edi
pop esi
pop ecx
ret
cmp al, 0x61
jl 0x599ae4
cmp al, 0x7a
jle 0x599bba
cmp al, 0x41
jl 0x599af0
cmp al, 0x5a
jle 0x599bba
cmp al, 0x30
jl 0x599afc
cmp al, 0x39
jle 0x599bba
cmp al, 0x2d
je 0x599bba
cmp al, 0x2e
je 0x599bba
cmp al, 0x5f
je 0x599bba
cmp al, 0x7e
je 0x599bba
cmp al, 0x25
jne 0x599b62
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x599b2d
cmp cl, 0x39
jle 0x599b41
cmp cl, 0x61
jl 0x599b37
cmp cl, 0x66
jle 0x599b41
cmp cl, 0x41
jl 0x599b62
cmp cl, 0x46
jg 0x599b62
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x599b4e
cmp cl, 0x39
jle 0x599bba
cmp cl, 0x61
jl 0x599b58
cmp cl, 0x66
jle 0x599bba
cmp cl, 0x41
jl 0x599b62
cmp cl, 0x46
jle 0x599bba
cmp al, 0x21
je 0x599bba
cmp al, 0x24
je 0x599bba
cmp al, 0x26
je 0x599bba
cmp al, 0x28
je 0x599bba
cmp al, 0x29
je 0x599bba
cmp al, 0x2a
je 0x599bba
cmp al, 0x2b
je 0x599bba
cmp al, 0x2c
je 0x599bba
cmp al, 0x3b
je 0x599bba
cmp al, 0x3d
je 0x599bba
cmp al, 0x27
je 0x599bba
cmp al, 0x3a
je 0x599bba
cmp al, 0x40
je 0x599bba
test edi, edi
je 0x599bcf
mov eax, dword [edi + 0x18]
test eax, eax
je 0x599bab
push eax
call dword [0x66e0f8]
add esp, 4
mov dword [edi + 0x18], 0
pop edi
mov dword [ebx], esi
xor eax, eax
pop esi
pop ecx
ret
lea ecx, [esp + 8]
push ecx
call fcn.005998f0
add esp, 4
test eax, eax
jne 0x599bd3
mov esi, dword [esp + 8]
mov dword [ebx], esi
xor eax, eax
pop edi
pop esi
pop ecx
ret
Function at 0x599be0
Capabilities:
Parse credit card information

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, eax
mov al, byte [ebx]
cmp al, 0x2f
jne 0x599c41
cmp byte [ebx + 1], al
jne 0x599c29
lea eax, [esp + 0xc]
push eax
add ebx, 2
mov eax, edi
mov dword [esp + 0x10], ebx
call fcn.00599700
add esp, 4
test eax, eax
jne 0x599d80
lea ecx, [esp + 0xc]
push ecx
call fcn.00599780
add esp, 4
test eax, eax
je 0x599d2e
pop edi
pop ebx
ret
lea edx, [esp + 0xc]
push edx
call fcn.00599820
add esp, 4
test eax, eax
je 0x599d2e
pop edi
pop ebx
ret
cmp al, 0x61
jl 0x599c4d
cmp al, 0x7a
jle 0x599d1d
cmp al, 0x41
jl 0x599c59
cmp al, 0x5a
jle 0x599d1d
cmp al, 0x30
jl 0x599c65
cmp al, 0x39
jle 0x599d1d
cmp al, 0x2d
je 0x599d1d
cmp al, 0x2e
je 0x599d1d
cmp al, 0x5f
je 0x599d1d
cmp al, 0x7e
je 0x599d1d
cmp al, 0x25
jne 0x599ccb
mov cl, byte [ebx + 1]
cmp cl, 0x30
jl 0x599c96
cmp cl, 0x39
jle 0x599caa
cmp cl, 0x61
jl 0x599ca0
cmp cl, 0x66
jle 0x599caa
cmp cl, 0x41
jl 0x599ccb
cmp cl, 0x46
jg 0x599ccb
mov cl, byte [ebx + 2]
cmp cl, 0x30
jl 0x599cb7
cmp cl, 0x39
jle 0x599d1d
cmp cl, 0x61
jl 0x599cc1
cmp cl, 0x66
jle 0x599d1d
cmp cl, 0x41
jl 0x599ccb
cmp cl, 0x46
jle 0x599d1d
cmp al, 0x21
je 0x599d1d
cmp al, 0x24
je 0x599d1d
cmp al, 0x26
je 0x599d1d
cmp al, 0x28
je 0x599d1d
cmp al, 0x29
je 0x599d1d
cmp al, 0x2a
je 0x599d1d
cmp al, 0x2b
je 0x599d1d
cmp al, 0x2c
je 0x599d1d
cmp al, 0x3b
je 0x599d1d
cmp al, 0x3d
je 0x599d1d
cmp al, 0x27
je 0x599d1d
cmp al, 0x3a
je 0x599d1d
cmp al, 0x40
je 0x599d1d
test edi, edi
je 0x599d32
mov eax, dword [edi + 0x18]
test eax, eax
je 0x599d14
push eax
call dword [0x66e0f8]
add esp, 4
mov dword [edi + 0x18], 0
jmp 0x599d32
lea eax, [esp + 0xc]
push eax
call fcn.005999b0
add esp, 4
test eax, eax
jne 0x599d80
mov ebx, dword [esp + 0xc]
cmp byte [ebx], 0x3f
jne 0x599d4d
inc ebx
mov dword [esp + 0xc], ebx
lea ebx, [esp + 0xc]
call fcn.00599280
test eax, eax
jne 0x599d80
mov ebx, dword [esp + 0xc]
cmp byte [ebx], 0x23
jne 0x599d68
inc ebx
mov dword [esp + 0xc], ebx
lea ebx, [esp + 0xc]
call fcn.00599120
test eax, eax
jne 0x599d80
mov ebx, dword [esp + 0xc]
cmp byte [ebx], 0
je 0x599d7e
push esi
mov esi, edi
call fcn.00598b00
pop esi
pop edi
mov eax, 1
pop ebx
ret
xor eax, eax
pop edi
pop ebx
ret

Function at 0x59cc10
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov ecx, dword [esp + 0xc]
push 4
mov dword [esi], vtable.Thread.0
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
call fcn.0059ff07
push 0
push 4
push esi
push 0x59cc00
push 0
push 0
mov dword [esi + 0x10], eax
call fcn.005aa260
mov edx, dword [esi + 0x10]
add esp, 0x1c
mov dword [edx], eax
mov eax, esi
pop esi
ret 8

Function at 0x59ccb0
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
cmp dword [eax], 0
jne 0x59ccbf
xor al, al
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x10]
mov dword [esi + 0xc], eax
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
pop esi
ret

Function at 0x59e318
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x66e8b0]
jne 0x59e322
repz ret
jmp fcn.005b0392
Function at 0x5bdb3d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.005aec86
and dword [ebp - 4], 0
cmp dword [0x6792ac], 0
mov ebx, eax
jne 0x5bdbee
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x5bdc9f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x62dfb8
push edi
call esi
test eax, eax
je 0x5bdc9f
push eax
call fcn.005aec14
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x6792ac], eax
call esi
push eax
call fcn.005aec14
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x6792b0], eax
call esi
push eax
call fcn.005aec14
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x6792b4], eax
call esi
push eax
call fcn.005aec14
pop ecx
mov dword [0x6792bc], eax
test eax, eax
je 0x5bdbee
push 0x62df60
push edi
call esi
push eax
call fcn.005aec14
pop ecx
mov dword [0x6792b8], eax
mov eax, dword [0x6792b8]
cmp eax, ebx
je 0x5bdc46
cmp dword [0x6792bc], ebx
je 0x5bdc46
push eax
call fcn.005aec8f
push dword [0x6792bc]
mov esi, eax
call fcn.005aec8f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x5bdc46
test edi, edi
je 0x5bdc46
call esi
test eax, eax
je 0x5bdc3d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x5bdc3d
test byte [ebp - 0xc], 1
jne 0x5bdc46
or dword [ebp + 0x10], 0x200000
jmp 0x5bdc7f
mov eax, dword [0x6792b0]
cmp eax, ebx
je 0x5bdc7f
push eax
call fcn.005aec8f
pop ecx
test eax, eax
je 0x5bdc7f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x5bdc7f
mov eax, dword [0x6792b4]
cmp eax, ebx
je 0x5bdc7f
push eax
call fcn.005aec8f
pop ecx
test eax, eax
je 0x5bdc7f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x6792ac]
call fcn.005aec8f
pop ecx
test eax, eax
je 0x5bdc9f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x5bdca1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5c84f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x2c
call fcn.005a0b40
push ebx
mov ebx, dword [esp + 0x3c]
test ebx, ebx
jle 0x5c8689
cmp ebx, 0x80
jg 0x5c8689
push ebp
push esi
push edi
mov edi, dword [esp + 0x50]
mov eax, edi
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x1c], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x20], edx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x4c]
push eax
push edi
push edi
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
call fcn.005c8fc0
lea eax, [ebx + 7]
cdq
and edx, 7
add eax, edx
mov ebp, eax
mov eax, dword [esp + 0x60]
add esp, 0xc
sar ebp, 3
test eax, eax
je 0x5c8587
test ebp, ebp
jle 0x5c85cf
mov edx, dword [esp + 0x40]
mov ebx, dword [esp + 0x44]
lea esi, [esp + 0x2c]
sub edx, edi
sub esi, edi
mov ecx, edi
sub ebx, edi
mov al, byte [edx + ecx]
xor al, byte [ecx]
inc ecx
dec ebp
mov byte [esi + ecx - 1], al
mov byte [ebx + ecx - 1], al
jne 0x5c8574
jmp 0x5c85cb
xor esi, esi
test ebp, ebp
jle 0x5c85cf
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x2c]
mov edx, ecx
sub eax, ecx
mov ecx, dword [esp + 0x44]
mov ebx, edi
sub ebx, edx
sub ecx, edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
jmp 0x5c85b1
mov ebx, dword [esp + 0x14]
lea ecx, [esp + esi + 0x2c]
mov dl, byte [eax + ecx]
mov bl, byte [ebx + ecx]
xor bl, dl
mov byte [ecx], dl
mov edx, dword [esp + 0x18]
inc esi
cmp esi, ebp
mov byte [edx + ecx], bl
jl 0x5c85ad
mov ebx, dword [esp + 0x48]
and ebx, reloc.WSOCK32.dll_getsockopt
jns 0x5c85dc
dec ebx
or ebx, 0xfffffff8
inc ebx
mov eax, dword [esp + 0x48]
cdq
and edx, 7
add eax, edx
sar eax, 3
test ebx, ebx
mov dword [esp + 0x14], ebx
jne 0x5c8613
lea eax, [esp + eax + 0x1c]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [edi], ecx
mov ecx, dword [eax + 8]
mov dword [edi + 4], edx
mov edx, dword [eax + 0xc]
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
mov cl, 8
sub cl, bl
mov byte [esp + 0x48], cl
inc edi
lea esi, [esp + eax + 0x1d]
mov ebp, 4
mov al, byte [esi]
mov dl, byte [esi - 1]
mov ecx, ebx
shl dl, cl
mov cl, byte [esp + 0x48]
mov bl, al
shr bl, cl
mov ecx, dword [esp + 0x14]
shl al, cl
mov cl, byte [esp + 0x48]
or dl, bl
mov byte [edi - 1], dl
mov dl, byte [esi + 1]
mov bl, dl
shr bl, cl
add esi, 4
add edi, 4
or al, bl
mov ebx, dword [esp + 0x14]
mov byte [edi - 4], al
mov al, byte [esi - 2]
mov ecx, ebx
shl dl, cl
mov cl, byte [esp + 0x48]
mov byte [esp + 0x13], al
shr al, cl
or dl, al
mov al, byte [esp + 0x13]
mov byte [edi - 3], dl
mov dl, byte [esi - 1]
shr dl, cl
mov ecx, ebx
shl al, cl
or dl, al
dec ebp
mov byte [edi - 2], dl
jne 0x5c8625
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret