Function at 0x41b340
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa058
call fcn.0044d300
mov eax, dword [0x4d9770]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
mov edi, dword [ebp + 0x1c]
mov ebx, ecx
mov dword [ebp - 0xa058], eax
mov eax, dword [ebp + 0x18]
push 0x400
mov dword [ebp - 0xa04c], eax
lea eax, [ebp - 0x1a44]
push 0
push eax
mov dword [ebp - 0xa050], ebx
mov dword [ebp - 0xa048], edi
call fcn.004500f0
push 5
lea eax, [ebp - 0xc]
push eax
push dword [ebx + 0x33c30]
call fcn.0045fbb9
mov ecx, ebx
add esp, 0x18
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41b3a8
sub ecx, edx
je 0x41c04a
cmp dword [0x52aaec], 0
mov dword [ebp - 0xa054], 0x478714
jne 0x41b3d1
mov ecx, ebx
call fcn.00421ce0
push esi
lea eax, [ebx + 0x33c34]
push eax
push dword [0x52a938]
lea ecx, [ebx + 0x4ef0]
push 0x52a970
push 0x52a8b8
push dword [0x52a96c]
lea eax, [ebp - 0x3c44]
push 0x4a735c
push dword [0x52abf4]
push 0x52a6d8
push 0x561314
push 0x52a93c
push 0x561114
push 0x539f5c
push 0x56110e
push 0x561108
push 0x52a7c8
push 0x52aa60
push 0x4a7088
push 0x514998
push 0x4a735c
push 0x539f44
push str.Microsoft_Edge
push 0
push 0
push 0x52e558
push ecx
push 0x478534
push 0x478534
push dword [0x52aadc]
push dword [0x52aad8]
push str._secure_browser_program_id_:___s____secure_browser_institution_id_:___s____result_program_id_:___s____result_institution_id_:___s____result_id_:___s____candidate_id_:___s____external_registration_id_:___d____registration_id_:___d____browser_:___s____browser_version_:___s____fingerprint_:___s____secure_browser_version_:___s____secure_browser_identifier_:__s____speed_of_processor_:___s_Mhz____type_of_processor_:___s____remote_desktop_detected_:___s____virtual_machine_detected_:___s____active_mac_address_:___s____active_local_ip_address_:___s____wan_ip_address_:___s____mac_address_:___s____model_:___s____network_name_:___ls____machine_id_:___s____operating_system_:___s____os_version_:___s____serial_:___s____system_memory_:___d____uuid_:___s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [ebp - 0x3c44]
push ecx
push str.sessionjson_s
push 0x800
lea eax, [ebx + 0xdad8]
push 0x800
push eax
call fcn.004085a0
add esp, 0x90
lea eax, [ebx + 0x42f0]
lea esi, [ebx + 0x3ef0]
push eax
push 0x47ce30
push 0x3ff
push 0x400
push esi
call fcn.004085a0
push dword [ebp - 0xa058]
lea eax, [ebp - 0x4444]
push 0x47ce44
push 0x400
push eax
call fcn.0040ea20
lea eax, [ebp - 0x4444]
push eax
lea eax, [ebp - 0x4c44]
push 0x400
push eax
call fcn.0045e4b4
add esp, 0x30
lea eax, [ebp - 0x1a44]
mov ecx, 0x5647e0
push eax
lea eax, [ebp - 0x4c44]
push eax
call fcn.00449de0
mov eax, dword [ebp - 0xa04c]
test eax, eax
je 0x41b589
push eax
push 0x47ce74
lea eax, [ebp - 0x8044]
push 0x800
push eax
call fcn.0040ea20
lea eax, [ebp - 0x8044]
push eax
lea eax, [ebp - 0x9044]
push 0x800
push eax
call fcn.0045e4b4
add esp, 0x1c
lea eax, [ebp - 0x5444]
mov ecx, 0x5647e0
push eax
lea eax, [ebp - 0x9044]
push eax
call fcn.00449de0
lea eax, [ebp - 0x5444]
push eax
lea eax, [ebp - 0x1a44]
push eax
lea eax, [ebp - 0x3444]
push 0x47ceac
push eax
call fcn.00422380
add esp, 0x10
jmp 0x41b5a4
lea eax, [ebp - 0x1a44]
push eax
lea eax, [ebp - 0x3444]
push 0x478918
push eax
call fcn.00422380
add esp, 0xc
test edi, edi
je 0x41b6db
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41b5b1
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sub ecx, edx
push 0
push 0
push 0
push 0
sar ecx, 1
push ecx
push edi
push 0
push 0xfde9
call esi
mov edi, eax
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0
push 0
push edi
mov ebx, eax
push ebx
push 0xffffffffffffffff
push dword [ebp - 0xa048]
push 0
push 0xfde9
call esi
lea eax, [edi + edi*2]
push eax
push 1
call fcn.004534b1
mov esi, dword [ebp - 0xa050]
add esp, 8
mov ecx, esi
push ebx
mov dword [esi + 0x3710c], eax
call fcn.00417fa0
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
push 0xffffffffffffffff
push dword [esi + 0x3710c]
push 0
push 0xfde9
call ebx
mov esi, eax
lea ecx, [esi*2 + 2]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
mov edi, eax
mov eax, dword [ebp - 0xa050]
push edi
push 0xffffffffffffffff
push dword [eax + 0x3710c]
push 0
push 0xfde9
call ebx
push edi
push 0x47d6a8
lea eax, [ebp - 0xa044]
push 0x800
push eax
call fcn.0040ea20
mov ebx, dword [ebp - 0xa050]
push dword [ebx + 0x3710c]
call fcn.004534bc
add esp, 0x14
lea eax, [ebp - 0x5c44]
mov ecx, 0x5647e0
push eax
lea eax, [ebp - 0xa044]
push eax
call fcn.00449de0
lea eax, [ebx + 0xdad8]
push eax
lea eax, [ebp - 0x5c44]
push eax
lea eax, [ebp - 0x3444]
push eax
push 0x47cea0
lea eax, [ebp - 0x7044]
push eax
call fcn.00422380
add esp, 0x14
lea esi, [ebx + 0x3ef0]
jmp 0x41b6fd
lea eax, [ebx + 0xdad8]
push eax
lea eax, [ebp - 0x3444]
push eax
lea eax, [ebp - 0x7044]
push 0x47ceac
push eax
call fcn.00422380
add esp, 0x10
push dword [ebp + 0x14]
lea eax, [ebp - 0x1e0]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0x47ceb4
push 0xc7
push 0xc8
push eax
call fcn.004085a0
lea eax, [ebx + 0x46f0]
push eax
lea eax, [ebp - 0x2044]
push 0x400
push eax
call fcn.00453332
lea eax, [ebp - 0x2044]
push 0x400
push eax
call fcn.0045f854
push 0x400
push 1
call fcn.004534b1
mov edi, eax
lea eax, [ebp - 0x2044]
push eax
push 0x3ff
push 0x400
push edi
call fcn.004085a0
add esp, 0x48
lea edx, [ebx + 0x5148]
cmp dword [ebx + 0x4c0], 0
je 0x41b857
push edi
lea eax, [ebp - 0x2444]
push 0x400
push eax
call fcn.004085e0
add esp, 0xc
lea eax, [ebp - 0x244]
mov ecx, 0x5647e0
push 0x64
push eax
push 0x47c8ac
push 0x47c8b0
lea eax, [ebp - 0x2444]
push eax
call fcn.00449710
lea eax, [ebp - 0x244]
push eax
push 0x479330
lea eax, [ebp - 0x118]
push 0x64
push eax
call fcn.004085e0
lea eax, [ebx + 0x5148]
push eax
push 0x479330
lea eax, [ebp - 0xb4]
push 0x64
push eax
call fcn.004085e0
lea edx, [ebp - 0xb4]
add esp, 0x20
lea ecx, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x41b800
sub edx, ecx
lea ecx, [ebp - 0x118]
lea eax, [ecx + 1]
mov dword [ebp - 0xa048], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41b818
sub ecx, dword [ebp - 0xa048]
lea eax, [ebp - 0xb4]
push 0x400
push edi
push edx
push eax
push ecx
lea eax, [ebp - 0x118]
mov ecx, 0x5647e0
push eax
push 0x400
lea eax, [ebp - 0x2444]
push eax
call fcn.00449900
lea edx, [ebx + 0x5148]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0xa048], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41b862
sub ecx, dword [ebp - 0xa048]
push 0x400
push edi
push ecx
push edx
push 0xf
push 0x479d00
push 0x400
push edi
mov ecx, 0x5647e0
call fcn.00449900
lea eax, [ebx + 0x5148]
push eax
push 1
push dword [0x514990]
call fcn.00449450
lea edx, [ebx + 0x50e4]
add esp, 0xc
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0xa048], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41b8b6
sub ecx, dword [ebp - 0xa048]
push 0x400
push edi
push ecx
push edx
push 0x13
push 0x479d10
push 0x400
push edi
mov ecx, 0x5647e0
call fcn.00449900
lea edx, [ebx + 0x5080]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0xa048], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41b8f3
sub ecx, dword [ebp - 0xa048]
push 0x400
push edi
push ecx
push edx
push 0x13
push 0x479d38
push 0x400
push edi
mov ecx, 0x5647e0
call fcn.00449900
lea edx, [ebx + 0x501c]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0xa048], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41b930
sub ecx, dword [ebp - 0xa048]
push 0x400
push edi
push ecx
push edx
push 0x11
push 0x479d24
push 0x400
push edi
mov ecx, 0x5647e0
call fcn.00449900
push 0x47cee0
push edi
call fcn.00450270
add esp, 8
test eax, eax
jne 0x41b98d
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41b973
push 0x400
push edi
sub ecx, edx
push ecx
push esi
push 0x1a
push str.agentidentifierWINCSECB
jmp 0x41b9bc
push str.wincaltsecb_
push edi
call fcn.00450270
add esp, 8
test eax, eax
jne 0x41b9cc
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41b9a4
push 0x400
push edi
sub ecx, edx
push ecx
push esi
push 0x1b
push str.agentidentifierwincaltsecb
push 0x400
push edi
mov ecx, 0x5647e0
call fcn.00449900
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41b9d1
push 0x400
push edi
sub ecx, edx
push ecx
push esi
push 0x17
push 0x47cf34
push 0x400
push edi
mov ecx, 0x5647e0
call fcn.00449900
push 0x400
push edi
push 1
push 0x478714
push 0x16
push 0x47cf4c
push 0x400
push edi
mov ecx, 0x5647e0
call fcn.00449900
push 0x400
push edi
push 1
push 0x478714
push 0x12
push 0x47cf64
push 0x400
push edi
mov ecx, 0x5647e0
call fcn.00449900
push 0x400
push edi
push 1
push 0x478714
push 0x13
push 0x47cf78
push 0x400
push edi
mov ecx, 0x5647e0
call fcn.00449900
push 0x47cf8c
push 0x400
push edi
call fcn.0045338c
lea eax, [ebx + 0x4ef0]
push eax
push 0x400
push edi
call fcn.0045338c
push 0x47c8f4
push 0x400
push edi
call fcn.0045338c
lea eax, [ebx + 0x4f54]
push eax
push 0x400
push edi
call fcn.0045338c
push 0x47cf98
push 0x400
push edi
call fcn.0045338c
push 0x514998
push 0x400
push edi
call fcn.0045338c
add esp, 0x48
push 0x47cfa8
push 0x400
push edi
call fcn.0045338c
lea eax, [ebx + 0x33c34]
push eax
push 0x400
push edi
call fcn.0045338c
push 0x47cfb0
push 0x400
push edi
call fcn.0045338c
lea eax, [ebp - 0xc]
push eax
push 0x400
push edi
call fcn.0045338c
push str.fingerprint
push 0x400
push edi
call fcn.0045338c
push 0x4a735c
push 0x400
push edi
call fcn.0045338c
add esp, 0x48
mov ecx, 0x5647e0
push 0x400
push edi
push 1
push 0x478714
push 0x16
push 0x47cfcc
push 0x400
push edi
call fcn.00449900
mov ecx, edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41bb60
sub ecx, edx
push 0x47cfcc
lea eax, [ecx + 0x17]
push eax
push edi
call fcn.0045338c
push 0x400
push 1
call fcn.004534b1
mov esi, eax
lea ecx, [ebp - 0x1e0]
add esp, 0x14
mov dword [ebp - 0xa04c], esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41bb98
push 0x400
push esi
sub ecx, edx
lea eax, [ebp - 0x1e0]
push ecx
push eax
push 0x15
push 0x47cfe4
push 0x400
push edi
mov ecx, 0x5647e0
call fcn.00449900
push 0
push 0
push 0x47cffc
push 0x479d7c
push esi
push 0x400
lea eax, [ebp - 0x1644]
mov ecx, ebx
push eax
call fcn.0041a6a0
lea ecx, [ebp - 0x1644]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41bbf1
sub ecx, edx
lea edx, [ebp - 0x1e0]
lea eax, [edx + 1]
mov dword [ebp - 0xa048], eax
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x41bc10
sub edx, dword [ebp - 0xa048]
lea eax, [ebp - 0x1e0]
push eax
lea eax, [edx + 1]
add eax, ecx
push eax
lea eax, [ebp - 0x1644]
push eax
call fcn.0045338c
add esp, 0xc
lea eax, [ebp - 0x2844]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1644]
push eax
call fcn.00422290
lea eax, [ebp - 0x2844]
push eax
push 0x479d80
push 0x1ff
lea eax, [ebp - 0x1c44]
push 0x200
push eax
call fcn.004085a0
add esp, 0x14
lea eax, [ebp - 0x50]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c44]
push eax
call fcn.0041d410
push esi
lea eax, [ebp - 0x644]
push 0x400
push eax
call fcn.00453332
push 4
push 0x479db8
lea eax, [ebp - 0x644]
push 0x400
push eax
call fcn.004601d0
push 0x29
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x644]
push 0x400
push eax
call fcn.004601d0
lea eax, [ebp - 0x644]
push eax
push 0x47d008
push 1
push dword [0x514990]
call fcn.00449450
push 7
lea eax, [ebp - 0x644]
push 0x478d2c
push eax
call fcn.0045e09a
add esp, 0x48
test eax, eax
jne 0x41be04
push 0x400
lea eax, [ebp - 0x1244]
mov ecx, 0x5647e0
push eax
push 0x47d038
push 0x478d2c
lea eax, [ebp - 0x644]
push eax
call fcn.00449710
lea eax, [ebp - 0x1244]
push eax
push 0x47d044
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0x10
lea eax, [ebp - 0xa44]
mov ecx, 0x5647e0
push 0x400
push eax
lea eax, [ebp - 0x50]
push eax
push 0x47d038
lea eax, [ebp - 0x644]
push eax
call fcn.00449710
lea eax, [ebp - 0xa44]
push eax
push 0x47d6dc
push 1
push dword [0x514990]
call fcn.00449450
push 0x29
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0xa44]
push 0x3ff
push eax
call fcn.004601d0
lea ecx, [ebp - 0xe44]
add esp, 0x20
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41bda2
sub ecx, edx
push 0x47d038
lea eax, [ecx + 9]
push eax
lea eax, [ebp - 0xe44]
push 0x400
push eax
call fcn.004085a0
lea ecx, [ebp - 0xa44]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41bdd1
sub ecx, edx
lea eax, [ebp - 0xa44]
push ecx
push eax
lea eax, [ebp - 0xe44]
push 0x400
push eax
call fcn.004601d0
lea eax, [ebp - 0xe44]
push eax
push 0x47d6fc
jmp 0x41bf24
push 8
lea eax, [ebp - 0x644]
push 0x478d34
push eax
call fcn.0045e09a
add esp, 0xc
test eax, eax
jne 0x41bf34
push 0x400
lea eax, [ebp - 0x1244]
mov ecx, 0x5647e0
push eax
push 0x47d038
push 0x478d34
lea eax, [ebp - 0x644]
push eax
call fcn.00449710
lea eax, [ebp - 0x1244]
push eax
push 0x47d044
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0x10
lea eax, [ebp - 0xa44]
mov ecx, 0x5647e0
push 0x400
push eax
lea eax, [ebp - 0x50]
push eax
push 0x47d038
lea eax, [ebp - 0x644]
push eax
call fcn.00449710
lea eax, [ebp - 0xa44]
push eax
push 0x47d6dc
push 1
push dword [0x514990]
call fcn.00449450
push 0x29
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0xa44]
push 0x400
push eax
call fcn.004601d0
lea ecx, [ebp - 0xe44]
add esp, 0x20
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41bec7
sub ecx, edx
push 0x47d038
lea eax, [ecx + 9]
push eax
lea eax, [ebp - 0xe44]
push 0x400
push eax
call fcn.004085a0
lea ecx, [ebp - 0xa44]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41bef6
sub ecx, edx
lea eax, [ebp - 0xa44]
push ecx
push eax
lea eax, [ebp - 0xe44]
push 0x400
push eax
call fcn.004601d0
lea eax, [ebp - 0xe44]
push eax
push 0x47d720
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0x20
lea eax, [ebp - 0x7044]
push eax
push 0x47d058
push 1
push dword [0x514990]
call fcn.00449450
push 5
lea eax, [ebp - 0x24]
push eax
push dword [0x5211f0]
call fcn.0045fbb9
push 5
lea eax, [ebp - 0x14]
push eax
push dword [0x5211f4]
call fcn.0045fbb9
push 5
lea eax, [ebp - 0x1c]
push eax
push dword [0x5211f8]
call fcn.0045fbb9
push 0x4a735c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x560890
push 0x55e82c
push 0x534618
push 0x516290
push 0x5162b8
push 0x52c8dc
push 0x4a7088
push 0x514998
push 0x539f44
push 0x515e90
lea esi, [ebx + 0xd6d8]
push str.Mozilla_5.0___s__AppleWebKit_537.36_Chrome_84.0.4147.30_Edg__s__SecureBrowser__s__s__s_s__s__TS__s__UUID__s___s_DKM:_s._s._s__FP__s_
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x74
lea eax, [ebp - 0xa054]
mov ecx, ebx
push eax
lea eax, [ebp - 0x7044]
push eax
lea eax, [ebp - 0xe44]
push eax
push 0x47d074
lea eax, [ebp - 0x1244]
push eax
push esi
call fcn.00421860
pop esi
test eax, eax
je 0x41c00d
push 0x47d0a4
jmp 0x41c012
push 0x47d0c0
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0xc
push edi
call fcn.004534bc
push dword [ebp - 0xa04c]
call fcn.004534bc
add esp, 8
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044d06d
mov esp, ebp
pop ebp
ret 0x18
push 0x47d0e0
push 1
push dword [0x514990]
call fcn.00449450
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
xor eax, eax
pop edi
pop ebx
call fcn.0044d06d
mov esp, ebp
pop ebp
ret 0x18