Function at 0x40c83f
Capabilities:
Allocate or change rwx memory
Create http request
Execute shellcode via indirect call
Parse credit card information
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
push edx
push esi
push edi
cmp dword [0x451f8e], 0
je 0x40cadb
cmp dword [0x451f92], 0
jne 0x40cadb
mov dword [0x451f92], 1
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
je 0x40cadf
mov dword [0x45c333], eax
mov edi, dword [ebp + 8]
or edi, edi
je 0x40cadf
cmp dword [ebp + 0xc], 2
je 0x40c8fd
cmp dword [ebp + 0xc], 0
jne 0x40c8ce
push dword [edi + 0xb5]
call fcn.0040cb57
push 0x41a261
push eax
push dword [edi + 0xb9]
push str.http:__194.147.90.72:8080_PlayersBase_v1_IsBanned_ip_sname_skey_s
push 0x45dcbb
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0x14
jmp 0x40c97c
push dword [edi + 0xb5]
call fcn.0040cb57
push 0x41a261
push eax
push dword [ebp + 0x10]
push dword [edi + 0xb9]
push str.http:__194.147.90.72:8080_PlayersBase_v1_BanCheater_ip_sreasonId_dnick_skey_s
push 0x45dcbb
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0x18
jmp 0x40c97c
push 0x45da97
push 0x41a261
push str._s_sPlayersBase3218
push 0x45dcbb
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0x10
push 0x45dcbb
call fcn.0040cb2c
mov ebx, eax
push 0x2500
push 0x45dcbb
call dword [sym.imp.kernel32.dll_RtlZeroMemory]
push 0x41a261
call fcn.0040cb57
mov esi, eax
push eax
call dword [sym.imp.kernel32.dll_lstrlenA]
inc eax
cmp eax, 0x100
ja 0x40c95e
push eax
push esi
push 0x41a261
call dword [sym.imp.kernel32.dll_RtlMoveMemory]
push 0x45da97
push ebx
push 0x41a261
push str.http:__194.147.90.72:8080_PlayersBase_v1_StartSession_srv_skey_dver_s
push 0x45dcbb
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0x14
push 4
push 0x451f96
push 2
push dword [0x45c333]
call dword [sym.imp.WININET.dll_InternetSetOptionA]
push 0
push 0x84000000
push 0
push 0
push 0x45dcbb
push dword [0x45c333]
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
test eax, eax
je 0x40cadf
mov dword [0x45c337], eax
push 0x40
push 0x3000
push 0x100000
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
or eax, eax
je 0x40cadf
mov dword [0x41922c], eax
mov esi, eax
push 0x45dcbb
push 0x1024
push esi
push dword [0x45c337]
call dword [sym.imp.WININET.dll_InternetReadFile]
or eax, eax
je 0x40ca74
or esi, esi
je 0x40ca74
push esi
push str.__BanSyncService:___s_
call dword [0x45cb58]
add esp, 8
cmp dword [ebp + 0xc], 2
je 0x40ca18
cmp byte [esi], 0x31
jne 0x40ca74
jmp 0x40ca74
cmp dword [esi], 0x203a6469
jne 0x40ca39
lea esi, [esi + 4]
push esi
push 0x41a199
push 0x41a261
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0xc
jmp 0x40ca74
mov dword [0x451f8e], 0
call 0x40ca66
inc edx
popal
outsb dx, byte [esi]
push ebx
jns 0x40cabc
arpl word [ebx + 0x65], dx
jb 0x40cac9
jb 0x40ca76
sub eax, 0x73614820
push 0x2079654b
jb 0x40cad5
outsd dx, dword [esi]
jb 0x40ca66
push str.__BanSyncService:___s_
call dword [0x45cb58]
add esp, 8
push 0x8000
add byte [eax], 0
push 0
push dword [0x41922c]
call dword [sym.imp.kernel32.dll_VirtualFree]
push dword [0x45c337]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [0x45c333]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp byte [0x45dcbb], 0
je 0x40cab8
push 0x2500
push 0x45dcbb
call dword [sym.imp.kernel32.dll_RtlZeroMemory]
cmp byte [0x451c66], 0
inc ebp
add byte [eax], al
je 0x40cad1
push 0x200
push 0x451c66
call dword [sym.imp.kernel32.dll_RtlZeroMemory]
inc ebp
add bh, bh
adc eax, sym.imp.kernel32.dll_RtlZeroMemory
mov dword [0x451f92], 0
inc ebp
add byte [eax], al
add byte [eax], al
add byte [ecx], dh
shr bl, 0x44
xor eax, eax
jmp 0x40cb23
mov dword [0x451f92], 0
call 0x40cb10
inc edx
popal
outsb dx, byte [esi]
push ebx
jns 0x40cb62
arpl word [ebx + 0x65], dx
jb 0x40cb6f
jb 0x40cb1c
sub eax, 0x6e6f6320
outsb dx, byte [esi]
arpl word gs:[ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
and byte [esi + 0x61], ah
imul ebp, dword [ebp + 0x64], 0x1f776800
inc ebp
add bh, bh
adc eax, 0x45cb58
add esp, 8
les ecx, [eax]
mov eax, 1
pop edi
pop esi
pop edx
pop ecx
pop ebx
leave
ret 0xc
sbb al, 0x45
add byte [eax], al
je 0x40cb78
push 0x200
push 0x451c66
call dword [sym.imp.kernel32.dll_RtlZeroMemory]
sbb al, 0x45
add bh, bh
adc eax, sym.imp.kernel32.dll_RtlZeroMemory
mov esi, dword [ebp + 8]
dec esi
inc esi
movzx eax, byte [esi]
cmp al, 0
je 0x40ccfa
cmp al, 0x21
je 0x40cc61
cmp al, 0x2a
je 0x40cc61
cmp al, 0x27
je 0x40cc9d
cmp al, 0x60
je 0x40cc61
cmp al, 0x5e
je 0x40cc61
cmp al, 0x28
je 0x40cc61
cmp al, 0x29
je 0x40cc61
cmp al, 0x3b
je 0x40cc61
cmp al, 0x3a
je 0x40cc61
cmp al, 0x2c
je 0x40cc61
cmp al, 0x40
je 0x40cc9d
cmp al, 0x26
je 0x40cc61
cmp al, 0x3d
je 0x40cc61
cmp al, 0x2b
je 0x40cc61
cmp al, 0x24
je 0x40cc61
cmp al, 0x2f
je 0x40cc9d
cmp al, 0x3f
je 0x40cc61
cmp al, 0x23
je 0x40cc61
cmp al, 0x5b
je 0x40cc61
cmp al, 0x5d
je 0x40cc61
cmp al, 0x40
je 0x40cc42
cmp al, 0x20
je 0x40cc42
cmp al, 0x2d
je 0x40cc47
cmp al, 0x5f
je 0x40cc47
cmp al, 0x2e
je 0x40cc47
cmp al, 0x7e
je 0x40cc61
cmp al, 0x7b
je 0x40cc61
cmp al, 0x7d
je 0x40cc61
cmp al, 0x30
jb 0x40cc9a
cmp al, 0x39
jbe 0x40cc49
cmp al, 0x41
jb 0x40cc9a
cmp al, 0x5a
jbe 0x40cc49
cmp al, 0x61
jb 0x40cc9a
cmp al, 0x7a
ja 0x40cc9a
jmp 0x40cc49
mov eax, 0x2b
lea eax, [eax]
mov edx, eax
push 0x451c66
call fcn.004048a2
mov word [eax + 0x451c66], dx
jmp 0x40cb7c
push eax
push 0x451e76
push 0x451e66
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0xc
lea edx, [0x451e66]
mov edx, dword [edx]
push 0x451c66
call fcn.004048a2
add byte [eax + 0x451c66], 0x25
mov word [eax + 0x451c67], dx
jmp 0x40cb7c
lea eax, [eax - 0x30]
push eax
push 0x451e76
push 0x451e66
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0xc
lea edx, [0x451e66]
mov edx, dword [edx]
push 0x451c66
call fcn.004048a2
mov word [eax + 0x451c66], 0x4425
cmp byte [0x451e66], 0x43
mov word [eax + 0x451c68], 0x2530
jne 0x40ccea
mov word [eax + 0x451c68], 0x2531
lea edx, [edx - 0xb]
mov word [eax + 0x451c6a], dx
jmp 0x40cb7c
lea eax, [0x451c66]
pop edi
pop esi
pop edx
pop ecx
pop ebx
leave
ret 4