Function at 0x40c8d6
Capabilities:
Allocate or change rwx memory
Create http request
Execute shellcode via indirect call
Parse credit card information
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
push edx
push esi
push edi
cmp dword [0x451f8e], 0
je 0x40cb72
cmp dword [0x451f92], 0
jne 0x40cb72
mov dword [0x451f92], 1
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
je 0x40cb76
mov dword [0x45c2e9], eax
mov edi, dword [ebp + 8]
or edi, edi
je 0x40cb76
cmp dword [ebp + 0xc], 2
je 0x40c994
cmp dword [ebp + 0xc], 0
jne 0x40c965
push dword [edi + 0xb9]
call fcn.0040cbee
push 0x41a261
push eax
push dword [edi + 0xbd]
push str.http:__194.147.90.72:8080_PlayersBase_v1_IsBanned_ip_sname_skey_s
push 0x45dc71
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0x14
jmp 0x40ca13
push dword [edi + 0xb9]
call fcn.0040cbee
push 0x41a261
push eax
push dword [ebp + 0x10]
push dword [edi + 0xbd]
push str.http:__194.147.90.72:8080_PlayersBase_v1_BanCheater_ip_sreasonId_dnick_skey_s
push 0x45dc71
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0x18
jmp 0x40ca13
push 0x45da4d
push 0x41a261
push str._s_sPlayersBase3218
push 0x45dc71
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0x10
push 0x45dc71
call fcn.0040cbc3
mov ebx, eax
push 0x2500
push 0x45dc71
call dword [sym.imp.kernel32.dll_RtlZeroMemory]
push 0x41a261
call fcn.0040cbee
mov esi, eax
push eax
call dword [sym.imp.kernel32.dll_lstrlenA]
inc eax
cmp eax, 0x100
ja 0x40c9f5
push eax
push esi
push 0x41a261
call dword [sym.imp.kernel32.dll_RtlMoveMemory]
push 0x45da4d
push ebx
push 0x41a261
push str.http:__194.147.90.72:8080_PlayersBase_v1_StartSession_srv_skey_dver_s
push 0x45dc71
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0x14
push 4
push 0x451f96
push 2
push dword [0x45c2e9]
call dword [sym.imp.WININET.dll_InternetSetOptionA]
push 0
push 0x84000000
push 0
push 0
push 0x45dc71
push dword [0x45c2e9]
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
test eax, eax
je 0x40cb76
mov dword [0x45c2ed], eax
push 0x40
push 0x3000
push 0x100000
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
or eax, eax
je 0x40cb76
mov dword [0x41922c], eax
mov esi, eax
push 0x45dc71
push 0x1024
push esi
push dword [0x45c2ed]
call dword [sym.imp.WININET.dll_InternetReadFile]
or eax, eax
je 0x40cb0b
or esi, esi
je 0x40cb0b
push esi
push str.__BanSyncService:___s_
call dword [0x45cb0e]
add esp, 8
cmp dword [ebp + 0xc], 2
je 0x40caaf
cmp byte [esi], 0x31
jne 0x40cb0b
jmp 0x40cb0b
cmp dword [esi], 0x203a6469
jne 0x40cad0
lea esi, [esi + 4]
push esi
push 0x41a199
push 0x41a261
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0xc
jmp 0x40cb0b
mov dword [0x451f8e], 0
call 0x40cafd
inc edx
popal
outsb dx, byte [esi]
push ebx
jns 0x40cb53
arpl word [ebx + 0x65], dx
jb 0x40cb60
jb 0x40cb0d
sub eax, 0x73614820
push 0x2079654b
jb 0x40cb6c
outsd dx, dword [esi]
jb 0x40cafd
push str.__BanSyncService:___s_
call dword [0x45cb0e]
add esp, 8
push 0x8000
add byte [eax], 0
push 0
push dword [0x41922c]
call dword [sym.imp.kernel32.dll_VirtualFree]
push dword [0x45c2ed]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [0x45c2e9]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp byte [0x45dc71], 0
je 0x40cb4f
push 0x2500
push 0x45dc71
call dword [sym.imp.kernel32.dll_RtlZeroMemory]
cmp byte [0x451c66], 0
inc ebp
add byte [eax], al
je 0x40cb68
push 0x200
push 0x451c66
call dword [sym.imp.kernel32.dll_RtlZeroMemory]
inc ebp
add bh, bh
adc eax, sym.imp.kernel32.dll_RtlZeroMemory
mov dword [0x451f92], 0
inc ebp
add byte [eax], al
add byte [eax], al
add byte [ecx], dh
shr bl, 0x44
xor eax, eax
jmp 0x40cbba
mov dword [0x451f92], 0
call 0x40cba7
inc edx
popal
outsb dx, byte [esi]
push ebx
jns 0x40cbf9
arpl word [ebx + 0x65], dx
jb 0x40cc06
jb 0x40cbb3
sub eax, 0x6e6f6320
outsb dx, byte [esi]
arpl word gs:[ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
and byte [esi + 0x61], ah
imul ebp, dword [ebp + 0x64], 0x1f776800
inc ebp
add bh, bh
adc eax, 0x45cb0e
add esp, 8
les ecx, [eax]
mov eax, 1
pop edi
pop esi
pop edx
pop ecx
pop ebx
leave
ret 0xc
sbb al, 0x45
add byte [eax], al
je 0x40cc0f
push 0x200
push 0x451c66
call dword [sym.imp.kernel32.dll_RtlZeroMemory]
sbb al, 0x45
add bh, bh
adc eax, sym.imp.kernel32.dll_RtlZeroMemory
mov esi, dword [ebp + 8]
dec esi
inc esi
movzx eax, byte [esi]
cmp al, 0
je 0x40cd91
cmp al, 0x21
je 0x40ccf8
cmp al, 0x2a
je 0x40ccf8
cmp al, 0x27
je 0x40cd34
cmp al, 0x60
je 0x40ccf8
cmp al, 0x5e
je 0x40ccf8
cmp al, 0x28
je 0x40ccf8
cmp al, 0x29
je 0x40ccf8
cmp al, 0x3b
je 0x40ccf8
cmp al, 0x3a
je 0x40ccf8
cmp al, 0x2c
je 0x40ccf8
cmp al, 0x40
je 0x40cd34
cmp al, 0x26
je 0x40ccf8
cmp al, 0x3d
je 0x40ccf8
cmp al, 0x2b
je 0x40ccf8
cmp al, 0x24
je 0x40ccf8
cmp al, 0x2f
je 0x40cd34
cmp al, 0x3f
je 0x40ccf8
cmp al, 0x23
je 0x40ccf8
cmp al, 0x5b
je 0x40ccf8
cmp al, 0x5d
je 0x40ccf8
cmp al, 0x40
je 0x40ccd9
cmp al, 0x20
je 0x40ccd9
cmp al, 0x2d
je 0x40ccde
cmp al, 0x5f
je 0x40ccde
cmp al, 0x2e
je 0x40ccde
cmp al, 0x7e
je 0x40ccf8
cmp al, 0x7b
je 0x40ccf8
cmp al, 0x7d
je 0x40ccf8
cmp al, 0x30
jb 0x40cd31
cmp al, 0x39
jbe 0x40cce0
cmp al, 0x41
jb 0x40cd31
cmp al, 0x5a
jbe 0x40cce0
cmp al, 0x61
jb 0x40cd31
cmp al, 0x7a
ja 0x40cd31
jmp 0x40cce0
mov eax, 0x2b
lea eax, [eax]
mov edx, eax
push 0x451c66
call fcn.0040490e
mov word [eax + 0x451c66], dx
jmp 0x40cc13
push eax
push 0x451e76
push 0x451e66
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0xc
lea edx, [0x451e66]
mov edx, dword [edx]
push 0x451c66
call fcn.0040490e
add byte [eax + 0x451c66], 0x25
mov word [eax + 0x451c67], dx
jmp 0x40cc13
lea eax, [eax - 0x30]
push eax
push 0x451e76
push 0x451e66
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0xc
lea edx, [0x451e66]
mov edx, dword [edx]
push 0x451c66
call fcn.0040490e
mov word [eax + 0x451c66], 0x4425
cmp byte [0x451e66], 0x43
mov word [eax + 0x451c68], 0x2530
jne 0x40cd81
mov word [eax + 0x451c68], 0x2531
lea edx, [edx - 0xb]
mov word [eax + 0x451c6a], dx
jmp 0x40cc13
lea eax, [0x451c66]
pop edi
pop esi
pop edx
pop ecx
pop ebx
leave
ret 4