Function at 0x44b25d
Capabilities:
Parse credit card information
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
push esi
push edi
mov eax, 0x4beb4c
mov edi, ecx
push eax
mov dword [ebp - 0xc], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov al, byte [edi + 9]
xor esi, esi
cmp dword [ebp + 0x10], esi
setl byte [ebp - 5]
and al, 0x11
cmp byte [ebp - 5], 0
mov byte [ebp - 6], al
jne 0x44b296
test byte [ebp + 0x14], 0x40
je 0x44b29a
mov byte [ebp - 6], 0
and byte [ebp + 0x14], 1
push ebx
push 0x50
pop eax
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x34], eax
call fcn.0043d3c3
or dword [ebp - 0x14], 0xffffffff
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x2c], esi
call fcn.00443dde
mov edi, dword [ebp + 8]
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x30]
jae 0x44b73f
cmp word [edi], 0
je 0x44b73f
lea ecx, [ebp - 0x54]
call fcn.00443ed0
push 0x25
pop esi
cmp word [edi], si
je 0x44b331
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 4]
sar ecx, 1
jmp 0x44b32c
mov ax, word [edi]
test ax, ax
je 0x44b2e3
cmp ax, si
je 0x44b2e3
mov edx, dword [ebp - 4]
mov word [edx], ax
add dword [ebp - 4], 2
inc edi
inc edi
dec ecx
jns 0x44b313
jmp 0x44b2e3
cmp byte [ebp + 0x14], 0
mov dword [ebp - 0x10], edi
je 0x44b4b5
lea edx, [edi + 2]
mov cx, word [edx]
cmp cx, si
jne 0x44b358
mov eax, dword [ebp - 4]
mov word [eax], si
add dword [ebp - 4], 2
add edi, 4
jmp 0x44b2e3
cmp cx, 0x23
jne 0x44b39a
mov eax, dword [ebx + 0x3c]
add edi, 4
test eax, eax
je 0x44b2e0
mov ecx, dword [ebx + 0x38]
mov eax, dword [eax + ecx*4 + 8]
mov cx, word [eax]
test cx, cx
je 0x44b2e0
mov edx, dword [ebp - 4]
mov word [edx], cx
add dword [ebp - 4], 2
inc eax
inc eax
xor ecx, ecx
mov cx, word [eax]
test cx, cx
jne 0x44b37f
jmp 0x44b2e3
cmp cx, 0x2a
jne 0x44b3b6
mov eax, dword [ebx + 0x3c]
add edi, 4
test eax, eax
je 0x44b2e0
mov ecx, dword [ebx + 0x38]
mov dword [ebp - 0x14], ecx
jmp 0x44b3d1
cmp cx, 0x40
jne 0x44b3e5
mov eax, dword [ebx + 0x3c]
add edi, 4
test eax, eax
je 0x44b2e0
mov ebx, dword [ebx + 0x38]
inc ebx
mov dword [ebp - 0x14], ebx
mov ecx, dword [ebp - 0x14]
mov esi, dword [eax + ecx*4]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
jmp 0x44b52d
push ecx
call fcn.00412674
add esp, 4
test al, al
jne 0x44b413
cmp cx, 0x7e
jb 0x44b4b5
xor eax, eax
mov ax, word [edi + 4]
push eax
call fcn.00412674
add esp, 4
test al, al
je 0x44b4b5
and dword [ebp + 8], 0
cmp cx, 0x7e
jb 0x44b422
mov dword [ebp + 8], esi
mov edi, edx
xor ecx, ecx
mov dword [ebp - 0x38], ecx
jmp 0x44b451
push 0
push 0xa
push dword [ebp - 0x38]
push ecx
call fcn.0048f820
mov ecx, eax
mov eax, edx
mov dword [ebp - 0x1c], eax
movzx eax, si
cdq
add ecx, eax
mov eax, dword [ebp - 0x1c]
adc eax, edx
add ecx, 0xffffffd0
adc eax, 0xffffffff
mov dword [ebp - 0x38], eax
inc edi
inc edi
xor esi, esi
mov si, word [edi]
push esi
call fcn.00412674
add esp, 4
test al, al
jne 0x44b429
mov eax, dword [ebx + 0x38]
cdq
cmp dword [ebp - 0x38], edx
ja 0x44b2e0
jb 0x44b47c
cmp ecx, eax
jae 0x44b2e0
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x44b2e0
mov esi, dword [eax + ecx*4]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp dword [ebp + 8], 0
mov ebx, eax
je 0x44b52d
cmp word [esi], 0x22
jne 0x44b52d
cmp word [esi + ebx*2 - 2], 0x22
jne 0x44b4b0
dec ebx
dec ebx
inc esi
inc esi
jmp 0x44b52d
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
push 8
push str._RANDOM_
push edi
call esi
test eax, eax
jne 0x44b4d6
call fcn.00439b48
and edx, 0x7fffffff
jmp 0x44b4f0
push 8
push str.___THIS_
push edi
call esi
test eax, eax
jne 0x44b570
lea eax, [ebx + 0x75bd036]
xor edx, edx
and word [ebp - 0xf8], 0
push edx
push eax
lea eax, [ebp - 0xf8]
push eax
add edi, 0x10
call fcn.004842a0
and word [ebp - 0x56], 0
add esp, 0xc
lea eax, [ebp - 0xf8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
cmp ebx, 1
jge 0x44b527
xor ebx, ebx
lea esi, [ebp - 0xf8]
lea eax, [ebx + 2]
push eax
lea ecx, [ebp - 0x54]
call fcn.00443e55
cmp dword [ebp - 0x14], 0
jl 0x44b54f
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
mov eax, dword [eax + 0x3c]
mov esi, dword [eax + ecx*4]
or dword [ebp - 0x14], 0xffffffff
dec ebx
js 0x44b2e0
lea eax, [ebx + 1]
mov cx, word [esi]
mov edx, dword [ebp - 4]
mov word [edx], cx
add dword [ebp - 4], 2
inc esi
inc esi
dec eax
jne 0x44b559
jmp 0x44b2e0
lea ebx, [edi + 2]
mov edi, ebx
xor eax, eax
jmp 0x44b590
cmp ax, 0x25
je 0x44b598
cmp ax, 0x3d
je 0x44b598
call fcn.004820ac
test al, al
jne 0x44b598
inc edi
inc edi
mov ax, word [edi]
test ax, ax
jne 0x44b579
movsx eax, byte [ebp - 6]
mov esi, edi
sub esi, dword [ebp - 0x10]
mov dword [ebp - 0x24], edi
sar esi, 1
cmp word [edi], 0x25
mov byte [ebp + 0xb], 0
mov dword [ebp - 0x1c], eax
je 0x44b5e1
lea eax, [esi + 2]
push eax
lea ecx, [ebp - 0x54]
call fcn.00443e55
dec esi
js 0x44b2e0
mov eax, dword [ebp - 0x10]
inc esi
mov cx, word [eax]
mov edx, dword [ebp - 4]
mov word [edx], cx
add dword [ebp - 4], 2
inc eax
inc eax
dec esi
jne 0x44b5ca
jmp 0x44b2e0
cmp byte [ebp - 5], 0
jne 0x44b619
mov ax, word [ebx]
cmp ax, 0x26
je 0x44b5fc
cmp byte [ebp - 6], 0
je 0x44b619
cmp ax, 0x5e
je 0x44b619
inc edi
inc edi
cmp word [ebx], 0x26
mov dword [ebp - 0x28], ebx
jne 0x44b69a
inc ebx
inc ebx
mov dword [ebp - 0x1c], 1
jmp 0x44b69a
inc edi
inc edi
cmp word [ebx], 0x5e
jne 0x44b627
inc ebx
inc ebx
mov byte [ebp + 0xb], 8
mov dword [ebp - 0x28], ebx
push dword [ebp - 0x34]
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
and word [esi], 0
and word [eax], 0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
mov dword [ebp - 0x10], eax
jle 0x44b670
cmp word [esi], 0
jne 0x44b670
mov esi, eax
add esi, 0x64
push esi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x34], esi
call fcn.0043d3ea
push esi
mov esi, dword [ebp - 0x18]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24]
mov word [eax], 0x25
cmp word [esi], 0
jne 0x44b70c
cmp byte [ebp + 0xb], 0
jne 0x44b2e0
cmp byte [ebp - 5], 0
mov byte [ebp + 0xb], 1
jne 0x44b2e0
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
and word [esi], 0
push 0xffffffffffffffff
push 0
push dword [ebp - 0x28]
call fcn.00412ddf
test eax, eax
mov word [esi], 0x25
jne 0x44b6d4
cmp dword [ebp - 0x1c], eax
jne 0x44b2e0
cmp byte [ebp + 0xb], al
jne 0x44b2e0
mov byte [ebp + 0xb], 1
jmp 0x44b62a
mov esi, dword [eax]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
lea eax, [ebx + 2]
push eax
lea ecx, [ebp - 0x54]
call fcn.00443e55
dec ebx
js 0x44b2e0
lea eax, [ebx + 1]
mov cx, word [esi]
mov edx, dword [ebp - 4]
mov word [edx], cx
add dword [ebp - 4], 2
inc esi
inc esi
dec eax
jne 0x44b6f5
jmp 0x44b2e0
mov ebx, dword [ebp - 0x10]
lea eax, [ebx + 2]
push eax
lea ecx, [ebp - 0x54]
call fcn.00443e55
dec ebx
mov dword [ebp - 0x10], ebx
js 0x44b2e0
lea eax, [ebx + 1]
mov cx, word [esi]
mov edx, dword [ebp - 4]
mov word [edx], cx
add dword [ebp - 4], 2
inc esi
inc esi
dec eax
jne 0x44b728
jmp 0x44b2e0
and word [eax], 0
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x20]
mov ecx, dword [ebp + 0xc]
sar eax, 1
inc eax
inc eax
push eax
call fcn.0043d3ea
mov esi, dword [ebp - 4]
sub esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x18]
sar esi, 1
call fcn.00437884
mov eax, 0x4beb4c
test eax, eax
pop ebx
je 0x44b777
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
leave
ret 0x10