Function at 0x4013b0
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x494
mov eax, dword [0x454314]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x3ff
lea eax, [ebp - 0x487]
mov byte [ebp - 0x488], 0
mov esi, ecx
mov ebx, edx
push 0
push eax
mov dword [ebp - 0x48c], esi
call fcn.00423d50
add esp, 0xc
mov byte [ebp - 0x88], 0
lea eax, [ebp - 0x87]
push 0x7f
push 0
push eax
call fcn.00423d50
lea edx, [esi + 0x2c]
add esp, 0xc
mov ecx, edx
lea edi, [ebp - 0x88]
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401415
sub ecx, esi
push edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.00419ce5
add esp, 0xc
lea eax, [ebp - 0x88]
push str.https:__
push eax
call fcn.004195c0
test eax, eax
lea esi, [ebp - 0x80]
push str.http:__
cmove esi, edi
push esi
call fcn.004195c0
add esp, 0x10
test eax, eax
je 0x401460
add esi, 7
push 0x44ad44
push esi
call fcn.004195c0
mov ecx, esi
mov edi, eax
add esp, 8
lea edx, [ecx + 1]
test edi, edi
je 0x4014c0
mov byte [edi], 0
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401480
sub ecx, edx
push esi
lea eax, [ecx + 1]
push eax
push ebx
call fcn.00419ce5
mov ecx, edi
mov byte [edi], 0x2f
add esp, 0xc
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4014a0
sub ecx, edx
lea edx, [ebx + 0x20]
push edi
lea eax, [ecx + 1]
push eax
push edx
call fcn.00419ce5
jmp 0x4014d8
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4014c0
sub ecx, edx
push esi
lea eax, [ecx + 1]
push eax
push ebx
call fcn.00419ce5
mov byte [ebx + 0x20], 0x2f
add esp, 0xc
push 0x44ad48
push ebx
call fcn.004195c0
mov esi, eax
add esp, 8
test esi, esi
je 0x4014f2
mov byte [esi], 0
mov eax, 2
mov ecx, ebx
mov word [ebx + 0x860], ax
call fcn.004040d0
mov ecx, dword [ebp - 0x48c]
mov dword [ebx + 0x864], eax
movzx eax, word [ecx + 8]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebx + 0x862], ax
test esi, esi
je 0x40152a
mov byte [esi], 0x3a
mov esi, dword [ebp - 0x48c]
lea ecx, [esi + 0xcc]
mov edi, ecx
lea edx, [edi + 1]
jmp 0x401540
mov al, byte [edi]
inc edi
test al, al
jne 0x401540
sub edi, edx
jne 0x40155b
mov eax, dword [esi + 0x18]
test eax, eax
je 0x401568
mov edi, eax
mov edx, edi
call fcn.00401340
test edi, edi
jle 0x401568
push str.POST
push 5
jmp 0x40156f
push 0x44ad54
push 4
lea esi, [ebx + 0x40]
push esi
call fcn.00419ce5
add esp, 0xc
lea eax, [ebx + 0x60]
mov dword [ebp - 0x490], eax
lea eax, [ebx + 0x20]
push ebx
mov ebx, dword [ebp - 0x490]
push eax
push esi
push str._s__s_HTTP_1.1_r_nAccept:_text_html_application_xhtmlxml_application_xml_q0.9___q0.8_r_nAccept_Language:_zh_cn_r_nUser_Agent:Mozilla_5.0_compatible_Baiduspider_2.0_http:__www.baidu.com_search_spider.html__r_nHost:__s_r_nConnection:_Keep_Alive_r_n
push ebx
call fcn.004036e0
add esp, 0x14
mov eax, str.POST
mov cl, byte [esi]
cmp cl, byte [eax]
jne 0x4015c3
test cl, cl
je 0x4015bf
mov cl, byte [esi + 1]
cmp cl, byte [eax + 1]
jne 0x4015c3
add esi, 2
add eax, 2
test cl, cl
jne 0x4015a3
xor eax, eax
jmp 0x4015c8
sbb eax, eax
or eax, 1
test eax, eax
jne 0x401623
push str.Content_Type:_application_x_www_form_urlencoded_r_n
push 0x800
push ebx
call fcn.0041a346
mov eax, dword [ebp - 0x48c]
add esp, 0xc
add eax, 0xcc
push eax
push edi
lea eax, [ebp - 0x488]
push str.Content_Length:__d_r_n_r_n_s
push eax
call fcn.00403700
lea eax, [ebp - 0x488]
push eax
push 0x800
push ebx
call fcn.0041a346
add esp, 0x1c
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00418e51
mov esp, ebp
pop ebp
ret
push 0x44ae9c
push 0x800
push ebx
call fcn.0041a346
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00418e51
mov esp, ebp
pop ebp
ret