joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51ebe20
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov ebx, eax
mov esi, ecx
test edx, edx
je 0x51ebf82
mov cl, byte [edx]
movzx edi, cl
mov eax, edi
shl eax, 4
sub eax, edi
add eax, eax
test cl, cl
je 0x51ebe64
mov edi, eax
mov ebp, eax
shl edi, 5
shr ebp, 3
movsx ecx, cl
add edi, ebp
inc edx
add edi, ecx
mov cl, byte [edx]
xor eax, edi
test cl, cl
jne 0x51ebe46
mov ebp, dword [esp + 0x18]
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
lea edx, [edx + ecx + 0x3a]
xor eax, edx
test esi, esi
je 0x51ebe9a
mov cl, byte [esi]
test cl, cl
je 0x51ebe9a
mov edi, edi
mov edx, eax
mov edi, eax
shl edx, 5
shr edi, 3
movsx ecx, cl
add edx, edi
inc esi
add edx, ecx
mov cl, byte [esi]
xor eax, edx
test cl, cl
jne 0x51ebe80
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
add edx, ecx
xor eax, edx
test ebx, ebx
je 0x51ebedc
mov cl, byte [ebx]
test cl, cl
je 0x51ebecc
mov edx, eax
mov esi, eax
shl edx, 5
shr esi, 3
movsx ecx, cl
add edx, esi
inc ebx
add edx, ecx
mov cl, byte [ebx]
xor eax, edx
test cl, cl
jne 0x51ebeb2
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
lea edx, [edx + ecx + 0x3a]
xor eax, edx
test ebp, ebp
je 0x51ebf02
mov cl, byte [ebp]
test cl, cl
je 0x51ebf02
mov edx, eax
mov esi, eax
shl edx, 5
shr esi, 3
movsx ecx, cl
add edx, esi
inc ebp
add edx, ecx
mov cl, byte [ebp]
xor eax, edx
test cl, cl
jne 0x51ebee7
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
add edx, ecx
xor eax, edx
mov edx, dword [esp + 0x1c]
test edx, edx
je 0x51ebf4a
mov cl, byte [edx]
test cl, cl
je 0x51ebf3a
mov edi, edi
mov esi, eax
mov edi, eax
shl esi, 5
shr edi, 3
movsx ecx, cl
add esi, edi
inc edx
add esi, ecx
mov cl, byte [edx]
xor eax, esi
test cl, cl
jne 0x51ebf20
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
lea edx, [edx + ecx + 0x3a]
xor eax, edx
mov edx, dword [esp + 0x20]
test edx, edx
je 0x51ebf72
mov cl, byte [edx]
test cl, cl
je 0x51ebf72
mov esi, eax
mov edi, eax
shl esi, 5
shr edi, 3
movsx ecx, cl
add esi, edi
inc edx
add esi, ecx
mov cl, byte [edx]
xor eax, esi
test cl, cl
jne 0x51ebf58
mov ecx, dword [esp + 0x14]
xor edx, edx
div dword [ecx + 4]
pop edi
pop esi
pop ebp
pop ebx
mov eax, edx
ret
movzx ecx, byte [esi]
mov eax, ecx
shl eax, 4
sub eax, ecx
add eax, eax
jmp 0x51ebe74

Function at 0x51f0970
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
jle 0x51f09aa
test esi, esi
je 0x51f09aa
xor ecx, ecx
test edx, edx
jle 0x51f0999
push edi
nop
movzx edi, byte [ecx + esi]
add edi, eax
imul edi, edi, 0x401
mov eax, edi
shr edi, 6
inc ecx
xor eax, edi
cmp ecx, edx
jl 0x51f0980
pop edi
lea ecx, [eax + eax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
ret
xor eax, eax
ret
Function at 0x51f09b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
test edx, edx
jle 0x51f09d9
push ebp
jmp 0x51f09c0
movzx ebp, byte [ecx + edi]
add ebp, eax
imul ebp, ebp, 0x401
mov eax, ebp
shr ebp, 6
inc ecx
xor eax, ebp
cmp ecx, edx
jl 0x51f09c0
pop ebp
add eax, 0x3a
imul eax, eax, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
xor ecx, ecx
test esi, esi
jle 0x51f0a08
nop
movzx edx, byte [ecx + ebx]
add edx, eax
imul edx, edx, 0x401
mov eax, edx
shr edx, 6
inc ecx
xor eax, edx
cmp ecx, esi
jl 0x51f09f0
lea ecx, [eax + eax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
ret
Function at 0x51f7fb0
Capabilities:
Parse credit card information

Disassembly:
mov edx, dword [esi]
mov al, byte [edx]
cmp al, 0x61
jl 0x51f7fc0
cmp al, 0x7a
jle 0x51f8080
cmp al, 0x41
jl 0x51f7fcc
cmp al, 0x5a
jle 0x51f8080
cmp al, 0x30
jl 0x51f7fd8
cmp al, 0x39
jle 0x51f8080
cmp al, 0x2d
je 0x51f8080
cmp al, 0x2e
je 0x51f8080
cmp al, 0x5f
je 0x51f8080
cmp al, 0x7e
je 0x51f8080
cmp al, 0x25
jne 0x51f803e
mov cl, byte [edx + 1]
cmp cl, 0x30
jl 0x51f8009
cmp cl, 0x39
jle 0x51f801d
cmp cl, 0x61
jl 0x51f8013
cmp cl, 0x66
jle 0x51f801d
cmp cl, 0x41
jl 0x51f803e
cmp cl, 0x46
jg 0x51f803e
mov cl, byte [edx + 2]
cmp cl, 0x30
jl 0x51f802a
cmp cl, 0x39
jle 0x51f8080
cmp cl, 0x61
jl 0x51f8034
cmp cl, 0x66
jle 0x51f8080
cmp cl, 0x41
jl 0x51f803e
cmp cl, 0x46
jle 0x51f8080
cmp al, 0x21
je 0x51f8080
cmp al, 0x24
je 0x51f8080
cmp al, 0x26
je 0x51f8080
cmp al, 0x28
je 0x51f8080
cmp al, 0x29
je 0x51f8080
cmp al, 0x2a
je 0x51f8080
cmp al, 0x2b
je 0x51f8080
cmp al, 0x2c
je 0x51f8080
cmp al, 0x3b
je 0x51f8080
cmp al, 0x3d
je 0x51f8080
cmp al, 0x27
je 0x51f8080
cmp al, 0x3a
je 0x51f8080
cmp al, 0x40
je 0x51f8080
xor eax, eax
cmp dword [esp + 4], eax
sete al
ret
mov al, byte [edx]
cmp al, 0x61
jl 0x51f808e
cmp al, 0x7a
jle 0x51f8138
cmp al, 0x41
jl 0x51f809a
cmp al, 0x5a
jle 0x51f8138
cmp al, 0x30
jl 0x51f80a6
cmp al, 0x39
jle 0x51f8138
cmp al, 0x2d
je 0x51f8138
cmp al, 0x2e
je 0x51f8138
cmp al, 0x5f
je 0x51f8138
cmp al, 0x7e
je 0x51f8138
cmp al, 0x25
jne 0x51f8104
mov cl, byte [edx + 1]
cmp cl, 0x30
jl 0x51f80cf
cmp cl, 0x39
jle 0x51f80e3
cmp cl, 0x61
jl 0x51f80d9
cmp cl, 0x66
jle 0x51f80e3
cmp cl, 0x41
jl 0x51f8104
cmp cl, 0x46
jg 0x51f8104
mov cl, byte [edx + 2]
cmp cl, 0x30
jl 0x51f80f0
cmp cl, 0x39
jle 0x51f8138
cmp cl, 0x61
jl 0x51f80fa
cmp cl, 0x66
jle 0x51f8138
cmp cl, 0x41
jl 0x51f8104
cmp cl, 0x46
jle 0x51f8138
cmp al, 0x21
je 0x51f8138
cmp al, 0x24
je 0x51f8138
cmp al, 0x26
je 0x51f8138
cmp al, 0x28
je 0x51f8138
cmp al, 0x29
je 0x51f8138
cmp al, 0x2a
je 0x51f8138
cmp al, 0x2b
je 0x51f8138
cmp al, 0x2c
je 0x51f8138
cmp al, 0x3b
je 0x51f8138
cmp al, 0x3d
je 0x51f8138
cmp al, 0x27
je 0x51f8138
cmp al, 0x3a
je 0x51f8138
cmp al, 0x40
jne 0x51f814e
cmp al, bl
je 0x51f814e
cmp al, 0x25
jne 0x51f8148
add edx, 3
jmp 0x51f8080
inc edx
jmp 0x51f8080
mov dword [esi], edx
xor eax, eax
ret
Function at 0x51f9390
Capabilities:
Parse credit card information

Disassembly:
test ebx, ebx
jne 0x51f9398
or eax, 0xffffffff
ret
push esi
mov esi, dword [ebx]
mov edx, 1
mov al, byte [esi]
cmp al, 0x61
jl 0x51f93ae
cmp al, 0x7a
jle 0x51f9491
cmp al, 0x41
jl 0x51f93ba
cmp al, 0x5a
jle 0x51f9491
cmp al, 0x30
jl 0x51f93c6
cmp al, 0x39
jle 0x51f9491
cmp al, 0x2d
je 0x51f9491
cmp al, 0x2e
je 0x51f9491
cmp al, 0x5f
je 0x51f9491
cmp al, 0x7e
je 0x51f9491
cmp al, 0x25
jne 0x51f942c
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x51f93f7
cmp cl, 0x39
jle 0x51f940b
cmp cl, 0x61
jl 0x51f9401
cmp cl, 0x66
jle 0x51f940b
cmp cl, 0x41
jl 0x51f942c
cmp cl, 0x46
jg 0x51f942c
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x51f9418
cmp cl, 0x39
jle 0x51f9491
cmp cl, 0x61
jl 0x51f9422
cmp cl, 0x66
jle 0x51f9491
cmp cl, 0x41
jl 0x51f942c
cmp cl, 0x46
jle 0x51f9491
cmp al, 0x21
je 0x51f9491
cmp al, 0x24
je 0x51f9491
cmp al, 0x26
je 0x51f9491
cmp al, 0x28
je 0x51f9491
cmp al, 0x29
je 0x51f9491
cmp al, 0x2a
je 0x51f9491
cmp al, 0x2b
je 0x51f9491
cmp al, 0x2c
je 0x51f9491
cmp al, 0x3b
je 0x51f9491
cmp al, 0x3d
je 0x51f9491
cmp al, 0x27
je 0x51f9491
cmp al, 0x3a
je 0x51f9491
cmp al, 0x40
je 0x51f9491
cmp al, 0x2f
je 0x51f9491
cmp al, 0x3f
je 0x51f9491
cmp al, 0x5b
je 0x51f9491
cmp al, 0x5d
je 0x51f9491
test edi, edi
je 0x51f94e7
test byte [edi + 0x24], dl
je 0x51f94a4
cmp al, 0x7b
je 0x51f9491
cmp al, 0x7d
je 0x51f9491
cmp al, 0x7c
je 0x51f9491
cmp al, 0x5c
je 0x51f9491
cmp al, 0x5e
je 0x51f9491
cmp al, 0x60
jne 0x51f94a4
cmp al, 0x25
jne 0x51f949d
add esi, 3
jmp 0x51f93a0
add esi, edx
jmp 0x51f93a0
mov eax, dword [edi + 0x20]
test eax, eax
je 0x51f94b5
push eax
call dword [0x53f2e48]
add esp, 4
test byte [edi + 0x24], 2
mov eax, dword [ebx]
je 0x51f94d4
mov ecx, esi
sub ecx, eax
push ecx
push eax
call fcn.051ed350
add esp, 8
mov dword [edi + 0x20], eax
mov dword [ebx], esi
xor eax, eax
pop esi
ret
mov edx, esi
push 0
sub edx, eax
push edx
push eax
call fcn.051f9070
add esp, 0xc
mov dword [edi + 0x20], eax
mov dword [ebx], esi
xor eax, eax
pop esi
ret
Function at 0x51f94f0
Capabilities:
Parse credit card information

Disassembly:
test ebx, ebx
jne 0x51f94f8
or eax, 0xffffffff
ret
push esi
mov esi, dword [ebx]
mov edx, 1
mov al, byte [esi]
cmp al, 0x61
jl 0x51f950e
cmp al, 0x7a
jle 0x51f95f5
cmp al, 0x41
jl 0x51f951a
cmp al, 0x5a
jle 0x51f95f5
cmp al, 0x30
jl 0x51f9526
cmp al, 0x39
jle 0x51f95f5
cmp al, 0x2d
je 0x51f95f5
cmp al, 0x2e
je 0x51f95f5
cmp al, 0x5f
je 0x51f95f5
cmp al, 0x7e
je 0x51f95f5
cmp al, 0x25
jne 0x51f958c
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x51f9557
cmp cl, 0x39
jle 0x51f956b
cmp cl, 0x61
jl 0x51f9561
cmp cl, 0x66
jle 0x51f956b
cmp cl, 0x41
jl 0x51f958c
cmp cl, 0x46
jg 0x51f958c
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x51f9578
cmp cl, 0x39
jle 0x51f95f5
cmp cl, 0x61
jl 0x51f9582
cmp cl, 0x66
jle 0x51f95f5
cmp cl, 0x41
jl 0x51f958c
cmp cl, 0x46
jle 0x51f95f5
cmp al, 0x21
je 0x51f95f5
cmp al, 0x24
je 0x51f95f5
cmp al, 0x26
je 0x51f95f5
cmp al, 0x28
je 0x51f95f5
cmp al, 0x29
je 0x51f95f5
cmp al, 0x2a
je 0x51f95f5
cmp al, 0x2b
je 0x51f95f5
cmp al, 0x2c
je 0x51f95f5
cmp al, 0x3b
je 0x51f95f5
cmp al, 0x3d
je 0x51f95f5
cmp al, 0x27
je 0x51f95f5
cmp al, 0x3a
je 0x51f95f5
cmp al, 0x40
je 0x51f95f5
cmp al, 0x2f
je 0x51f95f5
cmp al, 0x3f
je 0x51f95f5
test edi, edi
je 0x51f9668
test byte [edi + 0x24], dl
je 0x51f9608
cmp al, 0x7b
je 0x51f95f5
cmp al, 0x7d
je 0x51f95f5
cmp al, 0x7c
je 0x51f95f5
cmp al, 0x5c
je 0x51f95f5
cmp al, 0x5e
je 0x51f95f5
cmp al, 0x5b
je 0x51f95f5
cmp al, 0x5d
je 0x51f95f5
cmp al, 0x60
jne 0x51f9608
cmp al, 0x25
jne 0x51f9601
add esi, 3
jmp 0x51f9500
add esi, edx
jmp 0x51f9500
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x51f9619
push eax
call dword [0x53f2e48]
add esp, 4
test byte [edi + 0x24], 2
mov eax, dword [ebx]
je 0x51f9631
mov ecx, esi
sub ecx, eax
push ecx
push eax
call fcn.051ed350
add esp, 8
jmp 0x51f9641
mov edx, esi
push 0
sub edx, eax
push edx
push eax
call fcn.051f9070
add esp, 0xc
mov dword [edi + 0x1c], eax
mov eax, dword [edi + 0x28]
test eax, eax
je 0x51f9655
push eax
call dword [0x53f2e48]
add esp, 4
mov eax, dword [ebx]
mov ecx, esi
sub ecx, eax
push ecx
push eax
call fcn.051ed350
add esp, 8
mov dword [edi + 0x28], eax
mov dword [ebx], esi
xor eax, eax
pop esi
ret
Function at 0x51f9670
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, dword [ebx]
mov al, byte [esi]
cmp al, 0x61
jl 0x51f9681
cmp al, 0x7a
jle 0x51f9723
cmp al, 0x41
jl 0x51f968d
cmp al, 0x5a
jle 0x51f9723
cmp al, 0x30
jl 0x51f9699
cmp al, 0x39
jle 0x51f9723
cmp al, 0x2d
je 0x51f9723
cmp al, 0x2e
je 0x51f9723
cmp al, 0x5f
je 0x51f9723
cmp al, 0x7e
je 0x51f9723
cmp al, 0x25
jne 0x51f96f3
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x51f96be
cmp cl, 0x39
jle 0x51f96d2
cmp cl, 0x61
jl 0x51f96c8
cmp cl, 0x66
jle 0x51f96d2
cmp cl, 0x41
jl 0x51f96f3
cmp cl, 0x46
jg 0x51f96f3
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x51f96df
cmp cl, 0x39
jle 0x51f9723
cmp cl, 0x61
jl 0x51f96e9
cmp cl, 0x66
jle 0x51f9723
cmp cl, 0x41
jl 0x51f96f3
cmp cl, 0x46
jle 0x51f9723
cmp al, 0x21
je 0x51f9723
cmp al, 0x24
je 0x51f9723
cmp al, 0x26
je 0x51f9723
cmp al, 0x28
je 0x51f9723
cmp al, 0x29
je 0x51f9723
cmp al, 0x2a
je 0x51f9723
cmp al, 0x2b
je 0x51f9723
cmp al, 0x2c
je 0x51f9723
cmp al, 0x3b
je 0x51f9723
cmp al, 0x3d
je 0x51f9723
cmp al, 0x27
je 0x51f9723
cmp al, 0x3a
jne 0x51f9735
cmp al, 0x25
jne 0x51f972f
add esi, 3
jmp 0x51f9673
inc esi
jmp 0x51f9673
cmp byte [esi], 0x40
jne 0x51f9787
test edi, edi
je 0x51f9781
mov eax, dword [edi + 0x10]
test eax, eax
je 0x51f974f
push eax
call dword [0x53f2e48]
add esp, 4
test byte [edi + 0x24], 2
mov eax, dword [ebx]
je 0x51f976e
mov ecx, esi
sub ecx, eax
push ecx
push eax
call fcn.051ed350
add esp, 8
mov dword [edi + 0x10], eax
mov dword [ebx], esi
xor eax, eax
pop esi
ret
mov edx, esi
push 0
sub edx, eax
push edx
push eax
call fcn.051f9070
add esp, 0xc
mov dword [edi + 0x10], eax
mov dword [ebx], esi
xor eax, eax
pop esi
ret
mov eax, 1
pop esi
ret
Function at 0x51f9790
Capabilities:
Parse credit card information

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, dword [eax]
mov al, byte [edi]
mov dword [esp + 0x10], edi
mov ebx, edi
cmp al, 0x5b
jne 0x51f97d5
mov al, byte [edi + 1]
inc edi
cmp al, 0x5d
je 0x51f97bf
test al, al
je 0x51f97c5
mov al, byte [edi + 1]
inc edi
cmp al, 0x5d
jne 0x51f97b3
inc edi
jmp 0x51f98e6
cmp byte [edi], 0x5d
je 0x51f97bf
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
cmp al, 0x30
jl 0x51f9828
cmp al, 0x39
jg 0x51f9828
lea esi, [esp + 0x10]
call fcn.051f7f20
test eax, eax
jne 0x51f9828
mov ecx, dword [esp + 0x10]
cmp byte [ecx], 0x2e
jne 0x51f9828
inc dword [esp + 0x10]
call fcn.051f7f20
test eax, eax
jne 0x51f9828
mov edx, dword [esp + 0x10]
cmp byte [edx], 0x2e
jne 0x51f9828
call fcn.051f7f20
test eax, eax
jne 0x51f9828
mov eax, dword [esp + 0x10]
cmp byte [eax], 0x2e
jne 0x51f9828
call fcn.051f7f20
test eax, eax
je 0x51f98e2
mov al, byte [edi]
cmp al, 0x61
jl 0x51f9836
cmp al, 0x7a
jle 0x51f98d0
cmp al, 0x41
jl 0x51f9842
cmp al, 0x5a
jle 0x51f98d0
cmp al, 0x30
jl 0x51f984e
cmp al, 0x39
jle 0x51f98d0
cmp al, 0x2d
je 0x51f98d0
cmp al, 0x2e
je 0x51f98d0
cmp al, 0x5f
je 0x51f98d0
cmp al, 0x7e
je 0x51f98d0
cmp al, 0x25
jne 0x51f98a4
mov cl, byte [edi + 1]
cmp cl, 0x30
jl 0x51f986f
cmp cl, 0x39
jle 0x51f9883
cmp cl, 0x61
jl 0x51f9879
cmp cl, 0x66
jle 0x51f9883
cmp cl, 0x41
jl 0x51f98a4
cmp cl, 0x46
jg 0x51f98a4
mov cl, byte [edi + 2]
cmp cl, 0x30
jl 0x51f9890
cmp cl, 0x39
jle 0x51f98d0
cmp cl, 0x61
jl 0x51f989a
cmp cl, 0x66
jle 0x51f98d0
cmp cl, 0x41
jl 0x51f98a4
cmp cl, 0x46
jle 0x51f98d0
cmp al, 0x21
je 0x51f98d0
cmp al, 0x24
je 0x51f98d0
cmp al, 0x26
je 0x51f98d0
cmp al, 0x28
je 0x51f98d0
cmp al, 0x29
je 0x51f98d0
cmp al, 0x2a
je 0x51f98d0
cmp al, 0x2b
je 0x51f98d0
cmp al, 0x2c
je 0x51f98d0
cmp al, 0x3b
je 0x51f98d0
cmp al, 0x3d
je 0x51f98d0
cmp al, 0x27
jne 0x51f98e6
cmp al, 0x25
jne 0x51f98dc
add edi, 3
jmp 0x51f9828
inc edi
jmp 0x51f9828
mov edi, dword [esp + 0x10]
xor esi, esi
cmp ebp, esi
je 0x51f995d
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x51f98fd
push eax
call dword [0x53f2e48]
add esp, 4
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], esi
cmp eax, esi
je 0x51f9911
push eax
call dword [0x53f2e48]
add esp, 4
cmp edi, ebx
je 0x51f995a
test byte [ebp + 0x24], 2
je 0x51f993a
mov ecx, edi
sub ecx, ebx
push ecx
push ebx
call fcn.051ed350
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 0x24]
add esp, 8
mov dword [eax], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov edx, edi
push esi
sub edx, ebx
push edx
push ebx
call fcn.051f9070
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 0x28]
add esp, 0xc
mov dword [eax], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov dword [ebp + 0xc], esi
mov eax, dword [esp + 0x1c]
mov dword [eax], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x51f9ce0
Capabilities:
Parse credit card information

Disassembly:
push ecx
push esi
mov esi, dword [ebx]
push edi
mov edi, eax
mov al, byte [esi]
mov dword [esp + 8], esi
cmp al, 0x2f
jne 0x51f9d54
cmp byte [esi + 1], 0x2f
lea eax, [esp + 8]
push eax
jne 0x51f9d40
add esi, 2
mov eax, edi
mov dword [esp + 0xc], esi
call fcn.051f9970
add esp, 4
test eax, eax
jne 0x51f9e4f
cmp dword [edi + 0xc], eax
jne 0x51f9d21
mov dword [edi + 0x14], 0xffffffff
lea ecx, [esp + 8]
push ecx
call fcn.051f99f0
add esp, 4
test eax, eax
jne 0x51f9e4f
mov edx, dword [esp + 8]
pop edi
mov dword [ebx], edx
pop esi
pop ecx
ret
call fcn.051f9a90
add esp, 4
test eax, eax
je 0x51f9e47
pop edi
pop esi
pop ecx
ret
cmp al, 0x61
jl 0x51f9d60
cmp al, 0x7a
jle 0x51f9e36
cmp al, 0x41
jl 0x51f9d6c
cmp al, 0x5a
jle 0x51f9e36
cmp al, 0x30
jl 0x51f9d78
cmp al, 0x39
jle 0x51f9e36
cmp al, 0x2d
je 0x51f9e36
cmp al, 0x2e
je 0x51f9e36
cmp al, 0x5f
je 0x51f9e36
cmp al, 0x7e
je 0x51f9e36
cmp al, 0x25
jne 0x51f9dde
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x51f9da9
cmp cl, 0x39
jle 0x51f9dbd
cmp cl, 0x61
jl 0x51f9db3
cmp cl, 0x66
jle 0x51f9dbd
cmp cl, 0x41
jl 0x51f9dde
cmp cl, 0x46
jg 0x51f9dde
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x51f9dca
cmp cl, 0x39
jle 0x51f9e36
cmp cl, 0x61
jl 0x51f9dd4
cmp cl, 0x66
jle 0x51f9e36
cmp cl, 0x41
jl 0x51f9dde
cmp cl, 0x46
jle 0x51f9e36
cmp al, 0x21
je 0x51f9e36
cmp al, 0x24
je 0x51f9e36
cmp al, 0x26
je 0x51f9e36
cmp al, 0x28
je 0x51f9e36
cmp al, 0x29
je 0x51f9e36
cmp al, 0x2a
je 0x51f9e36
cmp al, 0x2b
je 0x51f9e36
cmp al, 0x2c
je 0x51f9e36
cmp al, 0x3b
je 0x51f9e36
cmp al, 0x3d
je 0x51f9e36
cmp al, 0x27
je 0x51f9e36
cmp al, 0x3a
je 0x51f9e36
cmp al, 0x40
je 0x51f9e36
test edi, edi
je 0x51f9e4b
mov eax, dword [edi + 0x18]
test eax, eax
je 0x51f9e27
push eax
call dword [0x53f2e48]
add esp, 4
mov dword [edi + 0x18], 0
pop edi
mov dword [ebx], esi
xor eax, eax
pop esi
pop ecx
ret
lea ecx, [esp + 8]
push ecx
call fcn.051f9b60
add esp, 4
test eax, eax
jne 0x51f9e4f
mov esi, dword [esp + 8]
mov dword [ebx], esi
xor eax, eax
pop edi
pop esi
pop ecx
ret
Function at 0x51f9e60
Capabilities:
Parse credit card information

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, eax
mov al, byte [ebx]
cmp al, 0x2f
jne 0x51f9ec1
cmp byte [ebx + 1], al
jne 0x51f9ea9
lea eax, [esp + 0xc]
push eax
add ebx, 2
mov eax, edi
mov dword [esp + 0x10], ebx
call fcn.051f9970
add esp, 4
test eax, eax
jne 0x51fa000
lea ecx, [esp + 0xc]
push ecx
call fcn.051f99f0
add esp, 4
test eax, eax
je 0x51f9fae
pop edi
pop ebx
ret
lea edx, [esp + 0xc]
push edx
call fcn.051f9a90
add esp, 4
test eax, eax
je 0x51f9fae
pop edi
pop ebx
ret
cmp al, 0x61
jl 0x51f9ecd
cmp al, 0x7a
jle 0x51f9f9d
cmp al, 0x41
jl 0x51f9ed9
cmp al, 0x5a
jle 0x51f9f9d
cmp al, 0x30
jl 0x51f9ee5
cmp al, 0x39
jle 0x51f9f9d
cmp al, 0x2d
je 0x51f9f9d
cmp al, 0x2e
je 0x51f9f9d
cmp al, 0x5f
je 0x51f9f9d
cmp al, 0x7e
je 0x51f9f9d
cmp al, 0x25
jne 0x51f9f4b
mov cl, byte [ebx + 1]
cmp cl, 0x30
jl 0x51f9f16
cmp cl, 0x39
jle 0x51f9f2a
cmp cl, 0x61
jl 0x51f9f20
cmp cl, 0x66
jle 0x51f9f2a
cmp cl, 0x41
jl 0x51f9f4b
cmp cl, 0x46
jg 0x51f9f4b
mov cl, byte [ebx + 2]
cmp cl, 0x30
jl 0x51f9f37
cmp cl, 0x39
jle 0x51f9f9d
cmp cl, 0x61
jl 0x51f9f41
cmp cl, 0x66
jle 0x51f9f9d
cmp cl, 0x41
jl 0x51f9f4b
cmp cl, 0x46
jle 0x51f9f9d
cmp al, 0x21
je 0x51f9f9d
cmp al, 0x24
je 0x51f9f9d
cmp al, 0x26
je 0x51f9f9d
cmp al, 0x28
je 0x51f9f9d
cmp al, 0x29
je 0x51f9f9d
cmp al, 0x2a
je 0x51f9f9d
cmp al, 0x2b
je 0x51f9f9d
cmp al, 0x2c
je 0x51f9f9d
cmp al, 0x3b
je 0x51f9f9d
cmp al, 0x3d
je 0x51f9f9d
cmp al, 0x27
je 0x51f9f9d
cmp al, 0x3a
je 0x51f9f9d
cmp al, 0x40
je 0x51f9f9d
test edi, edi
je 0x51f9fb2
mov eax, dword [edi + 0x18]
test eax, eax
je 0x51f9f94
push eax
call dword [0x53f2e48]
add esp, 4
mov dword [edi + 0x18], 0
jmp 0x51f9fb2
lea eax, [esp + 0xc]
push eax
call fcn.051f9c20
add esp, 4
test eax, eax
jne 0x51fa000
mov ebx, dword [esp + 0xc]
cmp byte [ebx], 0x3f
jne 0x51f9fcd
inc ebx
mov dword [esp + 0xc], ebx
lea ebx, [esp + 0xc]
call fcn.051f94f0
test eax, eax
jne 0x51fa000
mov ebx, dword [esp + 0xc]
cmp byte [ebx], 0x23
jne 0x51f9fe8
inc ebx
mov dword [esp + 0xc], ebx
lea ebx, [esp + 0xc]
call fcn.051f9390
test eax, eax
jne 0x51fa000
mov ebx, dword [esp + 0xc]
cmp byte [ebx], 0
je 0x51f9ffe
push esi
mov esi, edi
call fcn.051f8d80
pop esi
pop edi
mov eax, 1
pop ebx
ret
xor eax, eax
pop edi
pop ebx
ret
Function at 0x5203130
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x56bd0a0], 0
jne 0x520318e
push 0x56bd0a4
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x520316f
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x53f338c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x56bd09c], eax
call fcn.051f0760
mov dword [0x56bd0a0], 1
ret
cmp dword [0x56bd0a0], 0
jne 0x520318e
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop
push 0
call esi
cmp dword [0x56bd0a0], 0
je 0x5203180
pop esi
ret

Function at 0x5203190
Capabilities:
Create thread
Get thread local storage value
Set thread local storage value

Disassembly:
call fcn.05203130
mov eax, dword [0x53f338c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x5203244
push esi
call fcn.05203090
mov esi, eax
test esi, esi
jne 0x52031b7
pop esi
ret
push edi
push 8
call dword [sym.imp.MSVCR90.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
jne 0x52031fc
call fcn.051ed190
mov edi, eax
call fcn.051ed1d0
mov ecx, dword [eax]
mov edx, dword [edi]
push str.xmlGetGlobalState:_out_of_memory_n
push ecx
call edx
lea eax, [esi + 0x1c4]
push eax
call fcn.051eb6f0
push esi
call dword [sym.imp.MSVCR90.dll_free]
add esp, 0x10
pop edi
xor eax, eax
pop esi
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 1
push 0
push edi
mov dword [edi + 4], esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ecx, dword [0x53f338c]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edi
push 0
push 0x52030e0
call dword [sym.imp.MSVCR90.dll__beginthread]
add esp, 0xc
pop ebx
pop edi
mov eax, esi
pop esi
ret

Function at 0x5203690
Capabilities:
Query environment variable

Disassembly:
cmp dword [0x56bd244], 0
je 0x520369d
or eax, 0xffffffff
ret
push esi
push edi
mov dword [0x56bd244], 1
call fcn.05202f10
mov esi, dword [sym.imp.MSVCR90.dll_getenv]
push str.XML_MEM_BREAKPOINT
mov dword [0x56bd254], eax
call esi
mov edi, dword [sym.imp.MSVCR90.dll_sscanf]
add esp, 4
test eax, eax
je 0x52036dd
push 0x56bd25c
push 0x52c38cc
push eax
call edi
add esp, 0xc
push str.XML_MEM_TRACE
call esi
add esp, 4
test eax, eax
je 0x52036fb
push 0x56bd260
push 0x52c38b8
push eax
call edi
add esp, 0xc
pop edi
xor eax, eax
pop esi
ret

Function at 0x520b902
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x53f3c3c]
jne 0x520b90c
repz ret
jmp fcn.0520c253
Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret

Function at 0x44112a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x441139
pop dword [ebp - 0x1c]
mov eax, 0x441139
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x5179e
push 0
mov eax, 0x95a408ad
sub eax, 0x955f55fd
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0xce6c6267
add ecx, 0x3193eb19
xor ebx, ebx
add ebx, eax
mov edx, 0x4e17bae0
sub edx, 0x4dcf2ce0
add edx, dword [ebp - 0x1c]
mov edi, 0xa655f974
xor dword [ebp - 0xc], edx
mov esi, dword [edx]
xor dword [ebp - 0x10], ebx
add esi, edi
xor dword [ebp - 4], 0xcde3b8b8
mov dword [ebx], esi
add dword [ebp - 0x14], edx
add ebx, 4
add edx, 0xec7cf62a
add edx, 0x138309da
loop 0x44118f
add eax, 0x1d366a1
add eax, 0xfe2dc232
mov ebx, eax
add eax, 0x6760691
sub eax, 0x676068c
mov ecx, 0x400000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret