Function at 0x41bd90
Capabilities:
Access peb ldr_data
Get kernel32 base address
Parse credit card information

Disassembly:
push 0xffffffffffffffff
push 0x56acf0
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5c96a4]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x6c]
mov ecx, dword [esp + 0x68]
mov eax, dword [ecx + 8]
xor edx, edx
mov dword [ebp + 4], eax
mov dword [ebp + 0xc], edx
mov eax, dword [ecx + 8]
mov esi, dword [ecx + 0xc]
mov dword [esp + 0x2c], eax
lea eax, [esi + eax*2]
movzx esi, word [eax]
xor edi, edi
or ebx, 0xffffffff
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edx
mov dword [esp + 0x30], edx
mov dword [esp + 0x20], eax
test si, si
jne 0x41be1d
mov dword [ebp + 8], edx
mov dword [ebp], edx
lea eax, [edx - 2]
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
movzx ebp, si
test ebp, ebp
je 0x41c196
test edi, edi
je 0x41bef2
push ebp
push str.__t_n_r__
call fcn.00540fca
add esp, 8
test eax, eax
je 0x41bf6f
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x68]
sub esi, dword [eax + 0xc]
sar esi, 1
sub esi, edi
test ebx, ebx
jne 0x41be64
lea ecx, [esi + edi - 1]
mov dword [eax], edi
mov dword [eax + 4], ecx
jmp 0x41bee0
mov edi, dword [esp + 0x6c]
mov eax, dword [edi + 0x10]
add edi, 0x10
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
sub eax, esi
or eax, ecx
jge 0x41be8a
push esi
mov ecx, edi
call fcn.00403ba0
mov ecx, dword [esp + 0x68]
mov eax, dword [edi]
lea edx, [esi + esi]
push edx
mov edx, dword [ecx + 0xc]
mov ecx, dword [esp + 0x28]
lea edx, [edx + ecx*2]
push edx
push eax
call fcn.00545960
add esp, 0xc
mov eax, esi
cmp esi, 0xffffffff
jne 0x41bec2
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x41beca
push ecx
push eax
call fcn.00541027
add esp, 8
test eax, eax
jl 0x41c69f
mov ecx, dword [edi]
cmp eax, dword [ecx - 8]
jg 0x41c69f
mov dword [ecx - 0xc], eax
mov ecx, dword [edi]
xor edx, edx
mov word [ecx + eax*2], dx
mov edx, dword [esp + 0x14]
xor edi, edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x28], edi
cmp dword [esp + 0x18], 0
je 0x41c134
cmp ebp, 0x3e
jne 0x41bfda
test dl, 0xc0
jne 0x41bff1
mov eax, dword [esp + 0x68]
mov ebp, dword [esp + 0x20]
sub ebp, dword [eax + 0xc]
mov eax, dword [esp + 0x1c]
sar ebp, 1
mov dword [esp + 0x2c], ebp
cmp eax, 1
jne 0x41bf83
mov dword [esp + 0x18], 0
cmp ebx, eax
jne 0x41bfcc
cmp dword [esp + 0x28], 0x2f
jne 0x41bfcc
mov eax, dword [esp + 0x30]
test eax, eax
je 0x41bf62
push eax
push str.__t_n_r_
call fcn.00540fca
mov edx, dword [esp + 0x1c]
add esp, 8
test eax, eax
je 0x41bfcc
mov eax, dword [esp + 0x6c]
or dword [eax + 0xc], 0x10000
jmp 0x41bfcc
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
add eax, 2
mov dword [esp + 0x20], eax
jmp 0x41c187
cmp ebp, eax
jle 0x41c17e
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
lea eax, [ecx + ecx]
sub esi, eax
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x18]
lea eax, [esi + 2]
sub ecx, eax
sub dword [esp + 0x34], 1
je 0x41bfc4
mov dx, word [eax]
mov si, word [ecx + eax]
add eax, 2
cmp dx, si
mov edx, dword [esp + 0x14]
je 0x41bfa5
jmp 0x41c17e
mov dword [esp + 0x18], 0
test dl, 0x20
je 0x41c599
jmp 0x41c17e
cmp ebp, 0x3c
jne 0x41bff1
cmp ebx, 2
je 0x41c6a9
cmp ebx, 0xffffffff
je 0x41c6a9
test bl, 1
je 0x41c107
test dl, 0xc0
je 0x41c051
cmp ebp, 0x22
jne 0x41c027
test dl, dl
jns 0x41c0f9
mov eax, dword [esp + 0x28]
xor edx, 0x80
mov dword [esp + 0x14], edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], ebp
jmp 0x41c17e
cmp ebp, 0x27
jne 0x41c0f9
test dl, 0x40
je 0x41c0f9
mov eax, dword [esp + 0x28]
xor edx, 0x40
mov dword [esp + 0x14], edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], ebp
jmp 0x41c17e
cmp ebp, 0x22
jne 0x41c07d
test edx, 0x100
je 0x41c0f9
mov eax, dword [esp + 0x28]
xor edx, 0x180
mov dword [esp + 0x14], edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], ebp
jmp 0x41c17e
cmp ebp, 0x27
jne 0x41c0a5
test edx, 0x100
je 0x41c0f9
mov eax, dword [esp + 0x28]
xor edx, 0x140
mov dword [esp + 0x14], edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], ebp
jmp 0x41c17e
cmp ebp, 0x3d
jne 0x41c0d3
cmp dword [esp + 0x28], ebp
je 0x41c0d3
test edx, 0x100
jne 0x41c0db
mov eax, dword [esp + 0x28]
xor edx, 0x100
mov dword [esp + 0x14], edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], ebp
jmp 0x41c17e
test edx, 0x100
je 0x41c0f9
push ebp
push str.__t_n_r
call fcn.00540fca
add esp, 8
test eax, eax
jne 0x41c0f5
xor dword [esp + 0x14], 0x100
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], ebp
jmp 0x41c17e
test bl, 0x40
je 0x41c17e
cmp ebp, 0x22
jne 0x41c122
test dl, 0x40
jne 0x41c17e
xor edx, 0x80
mov dword [esp + 0x14], edx
jmp 0x41c17e
cmp ebp, 0x27
jne 0x41c17e
test dl, dl
js 0x41c17e
xor edx, 0x40
mov dword [esp + 0x14], edx
jmp 0x41c17e
test edx, edx
je 0x41c5c5
test dl, 0x10
je 0x41c1da
cmp ebp, 0x3c
je 0x41c6bc
push ebp
push str.__t_n_r
call fcn.00540fca
add esp, 8
test eax, eax
jne 0x41c17a
xor dword [esp + 0x14], 0x10
mov ebx, 2
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], 0x59fbc0
mov edx, dword [esp + 0x14]
add dword [esp + 0x20], 2
mov eax, dword [esp + 0x20]
movzx ebp, word [eax]
test ebp, ebp
jne 0x41be28
mov ecx, dword [esp + 0x68]
sub eax, dword [ecx + 0xc]
sar eax, 1
dec eax
mov ebp, eax
cmp ebx, 4
je 0x41c599
cmp ebx, 2
je 0x41c599
mov eax, 0x59fac0
test dl, 0x20
jne 0x41c62e
cmp ebx, 0x40
je 0x41c62e
cmp ebx, 1
jne 0x41c5ff
mov eax, str.Element_tag
jmp 0x41c633
test dl, 1
je 0x41c312
mov eax, 1
xor edx, eax
mov dword [esp + 0x14], edx
cmp ebp, 0x60
ja 0x41c2ee
cmp ebp, 0x40
jbe 0x41c205
cmp ebp, 0x5b
jb 0x41c2ee
cmp ebp, 0x5f
je 0x41c2ee
cmp ebp, 0x3a
je 0x41c2ee
cmp ebp, 0x2f
jne 0x41c22c
mov dword [esp + 0x18], 0x59fbc4
mov dword [esp + 0x1c], eax
xor ebx, ebx
jmp 0x41c255
cmp ebp, 0x21
jne 0x41c23d
or edx, 2
mov dword [esp + 0x14], edx
jmp 0x41c17e
cmp ebp, 0x3f
jne 0x41c26d
mov dword [esp + 0x18], 0x59fbc8
mov dword [esp + 0x1c], 2
lea ebx, [ebp - 0x2f]
mov edi, dword [esp + 0x20]
mov ecx, dword [esp + 0x68]
sub edi, dword [ecx + 0xc]
sar edi, 1
add edi, eax
mov dword [esp + 0x24], edi
jmp 0x41c17e
mov edi, dword [esp + 0x6c]
add edi, 0x10
push str.Incorrect
mov ecx, edi
mov dword [esp + 0x1c], 0x59fbc4
mov dword [esp + 0x20], eax
call fcn.004061c0
push str.tag_name_character
mov ecx, edi
call fcn.0041dfc0
mov edx, dword [esp + 0x2c]
push edx
lea esi, [esp + 0x40]
call fcn.0041a090
push eax
lea eax, [esp + 0x40]
push str._at_offset
push eax
mov dword [esp + 0x70], 2
call fcn.0041da40
add esp, 0x10
push eax
mov ecx, edi
mov byte [esp + 0x64], 3
call fcn.0041de90
lea ecx, [esp + 0x38]
call fcn.0041a0e0
or ebx, 0xffffffff
mov ecx, esi
mov dword [esp + 0x60], ebx
call fcn.0041a0e0
mov edi, dword [esp + 0x24]
jmp 0x41c17a
mov edi, dword [esp + 0x20]
mov ecx, dword [esp + 0x68]
sub edi, dword [ecx + 0xc]
mov dword [esp + 0x18], 0x59fbc4
sar edi, 1
mov dword [esp + 0x1c], eax
mov ebx, eax
mov dword [esp + 0x24], edi
jmp 0x41c17e
test dl, 2
je 0x41c400
xor edx, 2
mov dword [esp + 0x14], edx
cmp ebp, 0x2d
jne 0x41c333
or edx, 4
mov dword [esp + 0x14], edx
jmp 0x41c17e
cmp ebp, 0x5b
jne 0x41c349
test dl, 0x20
jne 0x41c35f
or edx, 8
mov dword [esp + 0x14], edx
jmp 0x41c17e
cmp ebp, 0x44
jne 0x41c35f
test dl, 0x20
jne 0x41c35f
or edx, 0x20
mov dword [esp + 0x14], edx
jmp 0x41c17e
push ebp
push 0x59fc10
call fcn.00540fca
add esp, 8
mov dword [esp + 0x18], 0x59fbc4
mov dword [esp + 0x1c], 1
test eax, eax
je 0x41c38b
mov ebx, 0x40
jmp 0x41c17a
mov edi, dword [esp + 0x6c]
add edi, 0x10
push str.Incorrect
mov ecx, edi
call fcn.004061c0
push str.__tag
mov ecx, edi
call fcn.0041dfc0
mov edx, dword [esp + 0x2c]
push edx
lea esi, [esp + 0x48]
call fcn.0041a090
push eax
lea eax, [esp + 0x48]
push str._at_offset
push eax
mov dword [esp + 0x70], 4
call fcn.0041da40
add esp, 0x10
push eax
mov ecx, edi
mov byte [esp + 0x64], 5
call fcn.0041de90
lea ecx, [esp + 0x40]
call fcn.0041a0e0
or ebx, 0xffffffff
mov ecx, esi
mov dword [esp + 0x60], ebx
call fcn.0041a0e0
mov edi, dword [esp + 0x24]
jmp 0x41c17a
test dl, 4
je 0x41c4b2
xor edx, 4
mov dword [esp + 0x14], edx
cmp ebp, 0x2d
jne 0x41c42d
mov dword [esp + 0x18], 0x59fc24
mov dword [esp + 0x1c], 3
lea ebx, [ebp - 0xd]
jmp 0x41c17e
mov edi, dword [esp + 0x6c]
add edi, 0x10
push str.Incorrect
mov ecx, edi
mov dword [esp + 0x1c], 0x59fbc4
mov dword [esp + 0x20], 1
call fcn.004061c0
push str.comment_tag
mov ecx, edi
call fcn.0041dfc0
mov ecx, dword [esp + 0x2c]
push ecx
lea esi, [esp + 0x50]
call fcn.0041a090
push eax
lea edx, [esp + 0x50]
push str._at_offset
push edx
mov dword [esp + 0x70], 6
call fcn.0041da40
add esp, 0x10
push eax
mov ecx, edi
mov byte [esp + 0x64], 7
call fcn.0041de90
lea ecx, [esp + 0x48]
call fcn.0041a0e0
or ebx, 0xffffffff
mov ecx, esi
mov dword [esp + 0x60], ebx
call fcn.0041a0e0
mov edi, dword [esp + 0x24]
jmp 0x41c17a
test dl, 8
je 0x41c564
xor edx, 8
mov dword [esp + 0x14], edx
cmp ebp, 0x43
jne 0x41c4df
mov dword [esp + 0x18], 0x59fc44
mov dword [esp + 0x1c], 3
lea ebx, [ebp - 0x3b]
jmp 0x41c17e
mov edi, dword [esp + 0x6c]
add edi, 0x10
push str.Incorrect
mov ecx, edi
mov dword [esp + 0x1c], 0x59fbc4
mov dword [esp + 0x20], 1
call fcn.004061c0
push 0x59fac0
mov ecx, edi
call fcn.0041dfc0
mov eax, dword [esp + 0x2c]
push eax
lea esi, [esp + 0x58]
call fcn.0041a090
push eax
lea ecx, [esp + 0x58]
push str._at_offset
push ecx
mov dword [esp + 0x70], 8
call fcn.0041da40
add esp, 0x10
push eax
mov ecx, edi
mov byte [esp + 0x64], 9
call fcn.0041de90
lea ecx, [esp + 0x50]
call fcn.0041a0e0
or ebx, 0xffffffff
mov ecx, esi
mov dword [esp + 0x60], ebx
call fcn.0041a0e0
mov edi, dword [esp + 0x24]
jmp 0x41c17a
test dl, 0x20
je 0x41c17e
cmp ebp, 0x3c
jne 0x41c57e
or edx, 1
mov dword [esp + 0x14], edx
jmp 0x41c17e
cmp ebp, 0x3e
jne 0x41c17e
mov ebp, dword [esp + 0x20]
mov eax, dword [esp + 0x68]
sub ebp, dword [eax + 0xc]
mov ebx, 0x40
sar ebp, 1
mov ecx, dword [esp + 0x68]
lea eax, [ebp + 1]
mov dword [ecx + 8], eax
mov ecx, dword [esp + 0x6c]
sub eax, dword [ecx + 4]
mov dword [ecx], ebx
mov dword [ecx + 8], eax
mov eax, ebx
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
cmp ebp, 0x3c
jne 0x41c5d7
mov dword [esp + 0x14], 1
jmp 0x41c17a
push ebp
push str.__t_n_r
mov ebx, 4
call fcn.00540fca
add esp, 8
test eax, eax
je 0x41c165
mov dword [esp + 0x14], 0x10
jmp 0x41c17a
test ebx, ebx
jne 0x41c60a
mov eax, str.Element_end_tag
jmp 0x41c633
cmp ebx, 8
jne 0x41c616
mov eax, str.CDATA_Section
jmp 0x41c633
cmp ebx, 0x10
jne 0x41c622
mov eax, str.Processing_instruction
jmp 0x41c633
cmp ebx, 0x20
jne 0x41c633
mov eax, str.Comment
jmp 0x41c633
mov eax, str.Doctype
mov esi, dword [esp + 0x6c]
lea edi, [esi + 0x10]
push eax
mov ecx, edi
or ebx, 0xffffffff
call fcn.004061c0
mov edx, dword [esi + 4]
push edx
lea esi, [esp + 0x4c]
call fcn.0041a090
push eax
lea eax, [esp + 0x54]
push str._at_offset
push eax
mov dword [esp + 0x70], 0
call fcn.0041da40
add esp, 0x10
push eax
mov ecx, edi
mov byte [esp + 0x64], 1
call fcn.0041de90
lea ecx, [esp + 0x4c]
call fcn.0041a0e0
mov ecx, esi
mov dword [esp + 0x60], ebx
call fcn.0041a0e0
push str._unterminated
mov ecx, edi
call fcn.0041dfc0
jmp 0x41c599
push 0x80070057
call fcn.00403c50
mov ebp, dword [esp + 0x20]
mov ecx, dword [esp + 0x68]
sub ebp, dword [ecx + 0xc]
sar ebp, 1
dec ebp
jmp 0x41c599
mov ebp, dword [esp + 0x20]
mov edx, dword [esp + 0x68]
sub ebp, dword [edx + 0xc]
mov ebx, 4
sar ebp, 1
dec ebp
jmp 0x41c599