Function at 0x403b72
Capabilities:
Parse url
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push edi
push ebx
mov dword [ebp - 0x54], 0
xor ebx, ebx
push 0x1000
call fcn.00401888
mov dword [ebp - 0x40], eax
push 0x1000
call fcn.00401888
mov dword [ebp - 0x48], eax
push 0x1000
call fcn.00401888
mov dword [ebp - 0x44], eax
push 0x1000
call fcn.00401888
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], 0x1000
lea edi, [ebp - 0x3c]
mov ecx, 0x3c
xor eax, eax
rep stosb byte es:[edi], al
mov dword [ebp - 0x3c], 0x3c
push dword [ebp - 0x40]
pop dword [ebp - 0x2c]
push dword [ebp - 0x48]
pop dword [ebp - 0x10]
mov dword [ebp - 0x28], 0xfff
mov dword [ebp - 0xc], 0xfff
lea eax, [ebp - 0x3c]
push eax
push 0x80000000
push 0
push dword [ebp + 8]
call sub.wininet.dll_InternetCrackUrlA
and eax, eax
je 0x403c08
cmp dword [ebp - 0x2c], 0
jne 0x403c0d
jmp 0x403d3f
mov dword [ebp - 0x50], 0xfff
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x44]
push 0x80000000
lea eax, [ebp - 0x3c]
push eax
call sub.wininet.dll_InternetCreateUrlA
and eax, eax
jne 0x403c32
jmp 0x403d3f
mov eax, dword [ebp - 0x48]
mov byte [eax], 0
lea edi, [ebp - 0x3c]
mov ecx, 0x3c
xor eax, eax
rep stosb byte es:[edi], al
mov dword [ebp - 0x3c], 0x3c
push dword [ebp - 0x48]
pop dword [ebp - 0x10]
mov dword [ebp - 0x28], 0xfff
mov dword [ebp - 0xc], 0xfff
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
push dword [ebp - 0x44]
call sub.wininet.dll_InternetCrackUrlA
and eax, eax
je 0x403c79
cmp dword [ebp - 0x2c], 0
jne 0x403c7e
jmp 0x403d3f
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x58]
push 0
call sub.urlmon.dll_ObtainUserAgentString
test eax, eax
js 0x403cae
push dword [ebp - 0x58]
push dword [ebp + 0x10]
push dword [ebp - 0x40]
push dword [ebp - 0x48]
push str.POST__s_HTTP_1.0_r_nHost:__s_r_nAccept:___r_nAccept_Encoding:_identity___q0_r_nAccept_Language:_en_US_r_nContent_Length:__lu_r_nContent_Type:_application_octet_stream_r_nConnection:_close_r_nContent_Encoding:_binary_r_nUser_Agent:__s_r_n_r_n
push dword [ebp - 0x44]
call sub.user32.dll_wsprintfA
add esp, 0x18
jmp 0x403ccc
push str.Mozilla_4.0__compatible__MSIE_8.0__Windows_NT_5.1__Trident_5.0_
push dword [ebp + 0x10]
push dword [ebp - 0x40]
push dword [ebp - 0x48]
push str.POST__s_HTTP_1.0_r_nHost:__s_r_nAccept:___r_nAccept_Encoding:_identity___q0_r_nAccept_Language:_en_US_r_nContent_Length:__lu_r_nContent_Type:_application_octet_stream_r_nConnection:_close_r_nContent_Encoding:_binary_r_nUser_Agent:__s_r_n_r_n
push dword [ebp - 0x44]
call sub.user32.dll_wsprintfA
add esp, 0x18
movzx eax, word [ebp - 0x24]
push eax
push 0
push dword [ebp - 0x40]
call fcn.00403747
and eax, eax
jne 0x403ce1
jmp 0x403d3f
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x4c]
call fcn.00403b44
push dword [ebp - 0x44]
call sub.kernel32.dll_lstrlenA
push eax
push dword [ebp - 0x44]
push dword [ebp - 0x4c]
call fcn.004037cb
and eax, eax
jne 0x403d06
jmp 0x403d37
cmp dword [ebp + 0x10], 0
je 0x403d20
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x4c]
call fcn.004037cb
and eax, eax
jne 0x403d20
jmp 0x403d37
mov ebx, eax
and ebx, ebx
je 0x403d37
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 0x14]
push dword [ebp - 0x4c]
call fcn.004039bf
mov ebx, eax
push dword [ebp - 0x4c]
call sub.wsock32.dll_closesocket
push dword [ebp - 0x40]
call fcn.00401871
push dword [ebp - 0x44]
call fcn.00401871
push dword [ebp - 0x48]
call fcn.00401871
push dword [ebp - 0x58]
call fcn.00401871
cmp dword [ebp - 0x54], 0
je 0x403d6d
push dword [ebp - 0x54]
call fcn.00401871
mov eax, ebx
pop ebx
pop edi
leave
ret 0x10