Function at 0x405bd0
Capabilities:
Allocate or change rwx memory
Create http request
Execute shellcode via indirect call
Parse credit card information
Read data from internet
Receive data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push ecx
push edx
push esi
push edi
cmp dword [0x4471b8], 0
je 0x405e62
cmp dword [0x4471bc], 1
je 0x405e62
mov dword [0x4471bc], 1
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
je 0x405e66
mov dword [0x450869], eax
mov edi, dword [ebp + 8]
or edi, edi
je 0x405e66
cmp dword [ebp + 0xc], 2
je 0x405c84
cmp dword [ebp + 0xc], 0
jne 0x405c5b
push dword [edi + 0x3c]
call fcn.00405ee0
push 0x411ddf
push eax
push dword [edi + 0x40]
push str.http:__194.147.90.72:8080_PlayersBase_v1_IsBanned_ip_sname_skey_s
push 0x451c4d
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0x14
jmp 0x405d03
push dword [edi + 0x3c]
call fcn.00405ee0
push 0x411ddf
push eax
push dword [ebp + 0x10]
push dword [edi + 0x40]
push str.http:__194.147.90.72:8080_PlayersBase_v1_BanCheater_ip_sreasonId_dnick_skey_s
push 0x451c4d
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0x18
jmp 0x405d03
push 0x451a54
push 0x411ddf
push str._s_sPlayersBase3218
push 0x451c4d
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0x10
push 0x451c4d
call fcn.00405eb3
mov ebx, eax
push 0x2000
push 0x451c4d
call dword [sym.imp.kernel32.dll_RtlZeroMemory]
push 0x411ddf
call fcn.00405ee0
mov esi, eax
push eax
call dword [sym.imp.kernel32.dll_lstrlenA]
inc eax
cmp eax, 0xfa
ja 0x405ce5
push eax
push esi
push 0x411ddf
call dword [sym.imp.kernel32.dll_RtlMoveMemory]
push 0x451a54
push ebx
push 0x411ddf
push str.http:__194.147.90.72:8080_PlayersBase_v1_StartSession_srv_skey_dver_s
push 0x451c4d
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0x14
push 4
push 0x4471c0
push 2
push dword [0x450869]
call dword [sym.imp.WININET.dll_InternetSetOptionA]
push 0
push 0x84000000
push 0
push 0
push 0x451c4d
push dword [0x450869]
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
test eax, eax
je 0x405e66
mov dword [0x45086d], eax
push 0x40
push 0x3000
push 0x100000
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
or eax, eax
je 0x405e66
mov dword [0x41122c], eax
mov esi, eax
push 0x451c4d
push 0x1024
push esi
push dword [0x45086d]
call dword [sym.imp.WININET.dll_InternetReadFile]
or eax, eax
je 0x405dfb
or esi, esi
je 0x405dfb
push esi
push str.__BanSyncService:___s_
call dword [0x450e53]
add esp, 8
cmp dword [ebp + 0xc], 2
je 0x405d9f
cmp byte [esi], 0x31
jne 0x405dfb
jmp 0x405dfb
cmp dword [esi], 0x203a6469
jne 0x405dc0
lea esi, [esi + 4]
push esi
push 0x411c4b
push 0x411ddf
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0xc
jmp 0x405dfb
mov dword [0x4471b8], 0
call 0x405ded
inc edx
popal
outsb dx, byte [esi]
push ebx
jns 0x405e43
arpl word [ebx + 0x65], dx
jb 0x405e50
jb 0x405dfd
sub eax, 0x73614820
push 0x2079654b
jb 0x405e5c
outsd dx, dword [esi]
jb 0x405ded
push str.__BanSyncService:___s_
call dword [0x450e53]
add esp, 8
push 0x8000
add byte [eax], 0
push 0
push dword [0x41122c]
call dword [sym.imp.kernel32.dll_VirtualFree]
push dword [0x45086d]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [0x450869]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp byte [0x451c4d], 0
je 0x405e3f
push 0x2000
push 0x451c4d
call dword [sym.imp.kernel32.dll_RtlZeroMemory]
cmp byte [0x446e90], 0
inc esp
add byte [eax], al
je 0x405e58
push 0x200
push 0x446e90
call dword [sym.imp.kernel32.dll_RtlZeroMemory]
inc esp
add bh, bh
adc eax, sym.imp.kernel32.dll_RtlZeroMemory
mov dword [0x4471bc], 0
inc esp
add byte [eax], al
add byte [eax], al
add byte [ecx], dh
shr bl, 0x44
xor eax, eax
jmp 0x405eaa
mov dword [0x4471bc], 0
call 0x405e97
inc edx
popal
outsb dx, byte [esi]
push ebx
jns 0x405ee9
arpl word [ebx + 0x65], dx
jb 0x405ef6
jb 0x405ea3
sub eax, 0x6e6f6320
outsb dx, byte [esi]
arpl word gs:[ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
and byte [esi + 0x61], ah
imul ebp, dword [ebp + 0x64], 0x71a16800
inc esp
add bh, bh
adc eax, 0x450e53
add esp, 8
les ecx, [eax]
mov eax, 1
pop edi
pop esi
pop edx
pop ecx
pop ebx
leave
ret 0xc
push edi
cmp byte [0x446e90], 0
je 0x405f03
push 0x200
add byte [eax], al
push 0x446e90
call dword [sym.imp.kernel32.dll_RtlZeroMemory]
mov esi, dword [ebp + 8]
dec esi
inc esi
movzx eax, byte [esi]
cmp al, 0
je 0x406085
cmp al, 0x21
je 0x405fec
cmp al, 0x2a
je 0x405fec
cmp al, 0x27
je 0x406028
cmp al, 0x60
je 0x405fec
cmp al, 0x5e
je 0x405fec
cmp al, 0x28
je 0x405fec
cmp al, 0x29
je 0x405fec
cmp al, 0x3b
je 0x405fec
cmp al, 0x3a
je 0x405fec
cmp al, 0x2c
je 0x405fec
cmp al, 0x40
je 0x406028
cmp al, 0x26
je 0x405fec
cmp al, 0x3d
je 0x405fec
cmp al, 0x2b
je 0x405fec
cmp al, 0x24
je 0x405fec
cmp al, 0x2f
je 0x406028
cmp al, 0x3f
je 0x405fec
cmp al, 0x23
je 0x405fec
cmp al, 0x5b
je 0x405fec
cmp al, 0x5d
je 0x405fec
cmp al, 0x40
je 0x405fcd
cmp al, 0x20
je 0x405fcd
cmp al, 0x2d
je 0x405fd2
cmp al, 0x5f
je 0x405fd2
cmp al, 0x2e
je 0x405fd2
cmp al, 0x7e
je 0x405fec
cmp al, 0x7b
je 0x405fec
cmp al, 0x7d
je 0x405fec
cmp al, 0x30
jb 0x406025
cmp al, 0x39
jbe 0x405fd4
cmp al, 0x41
jb 0x406025
cmp al, 0x5a
jbe 0x405fd4
cmp al, 0x61
jb 0x406025
cmp al, 0x7a
ja 0x406025
jmp 0x405fd4
mov eax, 0x2b
lea eax, [eax]
mov edx, eax
push 0x446e90
call fcn.00403276
mov word [eax + 0x446e90], dx
jmp 0x405f07
push eax
push 0x4470a0
push 0x447090
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0xc
lea edx, [0x447090]
mov edx, dword [edx]
push 0x446e90
call fcn.00403276
add byte [eax + 0x446e90], 0x25
mov word [eax + 0x446e91], dx
jmp 0x405f07
lea eax, [eax - 0x30]
push eax
push 0x4470a0
push 0x447090
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0xc
lea edx, [0x447090]
mov edx, dword [edx]
push 0x446e90
call fcn.00403276
mov word [eax + 0x446e90], 0x4425
cmp byte [0x447090], 0x43
mov word [eax + 0x446e92], 0x2530
jne 0x406075
mov word [eax + 0x446e92], 0x2531
lea edx, [edx - 0xb]
mov word [eax + 0x446e94], dx
jmp 0x405f07
lea eax, [0x446e90]
pop edi
pop esi
pop edx
pop ecx
pop ebx
leave
ret 4