Function at 0x10001000
Capabilities:
Reference http user-agent string

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, 0x13f8
push edi
call sub.MSVCRT.dll_malloc
pop ecx
push edi
xor ebx, ebx
mov esi, eax
push ebx
push esi
call sub.MSVCRT.dll_memset
or dword [esi + 0x1c], 0xffffffff
add esp, 0xc
push 4
call fcn.1001e0b2
cmp eax, ebx
pop ecx
je 0x1000104c
mov byte [esp + 0x14], 3
mov byte [esp + 0x15], 3
mov cx, word [esp + 0x14]
mov word [eax], cx
mov byte [eax + 2], 1
mov byte [eax + 3], 1
cmp eax, ebx
mov dword [esi + 0x10], eax
je 0x100015cd
push eax
call fcn.1001a4f5
cmp eax, ebx
pop ecx
mov dword [esi + 0x14], eax
je 0x100015cd
push 0x18
mov byte [eax + 0x121], 1
mov byte [eax + 0x120], bl
mov dword [eax + 0x138], ebx
call sub.MSVCRT.dll_malloc
pop ecx
push 0x18
mov edi, eax
push ebx
push edi
call sub.MSVCRT.dll_memset
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 0x20], edi
push ebx
mov edi, 0x1002c1b1
push edi
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
mov dword [esi + 0x2c], eax
call fcn.10003856
add esp, 0x1c
push ebx
push 0x1002c57c
mov dword [esi + 0x30], eax
call fcn.1000383a
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
mov dword [esi + 0x34], eax
call fcn.10003856
add esp, 0x24
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str._r_nAccept:
mov dword [esi + 0x38], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.text_html___
mov dword [esi + 0x78], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str._r_nAccept_Charset:
mov dword [esi + 0x7c], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
mov dword [esi + 0x84], eax
push ebx
push ebx
push ebx
push ebx
push str.utf_8
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str._r_nAccept_Encoding:
mov dword [esi + 0x88], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.identity__chunked
mov dword [esi + 0x90], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str._r_nAccept_Language:
mov dword [esi + 0x94], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.en_us
mov dword [esi + 0x9c], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str._r_nCache_Control:
mov dword [esi + 0xa0], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.no_cache
mov dword [esi + 0xa8], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str._r_nConnection:
mov dword [esi + 0xac], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
mov dword [esi + 0xb4], eax
push ebx
push ebx
push ebx
push str.Keep_Alive
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str._r_nCookie:
mov dword [esi + 0xb8], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str._r_nContent_Length:
mov dword [esi + 0xc0], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x1002c28c
mov dword [esi + 0xcc], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str._r_nContent_Type:
mov dword [esi + 0xd0], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.application_x_www_form_urlencoded
mov dword [esi + 0xd8], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
mov ebp, str._r_nDate:
push ebp
mov dword [esi + 0xdc], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str._r_nHost:
mov dword [esi + 0xe4], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
mov dword [esi + 0xf0], eax
push ebx
push ebx
push ebx
push str._r_nIf_Modified_Since:
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str._r_nIf_None_Match:
mov dword [esi + 0xfc], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str._r_nReferer:
mov dword [esi + 0x108], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str._r_nUser_Agent:
mov dword [esi + 0x114], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.Mozilla_5.0__Windows_NT_5.1__rv:19.0__Gecko_20100101_Firefox_19.0
mov dword [esi + 0x120], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str._r_n_r_n
mov dword [esi + 0x124], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.HTTP_1.1
mov dword [esi + 0x180], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.HTTP_1.0
mov dword [esi + 0x2ec], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 0x2f4], eax
push ebx
push ebx
push str._r_nCache_Control:
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str._r_nConnection:
mov dword [esi + 0x31c], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str._r_nContent_Length:
mov dword [esi + 0x324], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str._r_nContent_Type:
mov dword [esi + 0x334], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebp
mov dword [esi + 0x33c], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str._r_nETag:
mov dword [esi + 0x344], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str._r_nExpires:
mov dword [esi + 0x374], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str._r_nLast_Modified:
mov dword [esi + 0x37c], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 0x384], eax
push ebx
push str._r_nLocation:
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str._r_nServer:
mov dword [esi + 0x38c], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str._r_nTransfer_Encoding:
mov dword [esi + 0x394], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str._r_nSet_Cookie:
mov dword [esi + 0x3a4], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str._r_nRequest_Protocol:
mov dword [esi + 0x39c], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str._r_nRequest_Host:
mov dword [esi + 0x3b4], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str._r_nRequest_Method:
mov dword [esi + 0x3bc], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str._r_nRequest_Resource:
mov dword [esi + 0x3c4], eax
call fcn.10003856
add esp, 0x1c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 0x3cc], eax
push str._r_nContent_CRC32:
call fcn.10003856
mov dword [esi + 0x3d4], eax
lea eax, [esi + 0x2d8]
add esp, 0x1c
mov dword [esp + 0x14], eax
lea ebp, [esi + 0x40]
mov dword [esp + 0x18], 0x21
cmp dword [ebp - 4], ebx
jne 0x1000154d
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
call fcn.10003856
add esp, 0x1c
mov dword [ebp - 4], eax
cmp dword [ebp], ebx
jne 0x10001564
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
call fcn.10003856
add esp, 0x1c
mov dword [ebp], eax
cmp dword [ebp + 4], ebx
jne 0x1000157b
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
call fcn.10003856
add esp, 0x1c
mov dword [ebp + 4], eax
mov eax, dword [esp + 0x14]
cmp dword [eax - 4], ebx
jne 0x1000159a
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
call fcn.10003856
mov ecx, dword [esp + 0x30]
add esp, 0x1c
mov dword [ecx - 4], eax
mov eax, dword [esp + 0x14]
cmp dword [eax], ebx
jne 0x100015b7
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
call fcn.10003856
mov ecx, dword [esp + 0x30]
add esp, 0x1c
mov dword [ecx], eax
add dword [esp + 0x14], 8
add ebp, 0xc
dec dword [esp + 0x18]
jne 0x10001536
mov eax, esi
jmp 0x100015d6
push esi
call sub.MSVCRT.dll_free
pop ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret