Function at 0x4940af
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xa4
mov eax, dword [0x53d72c]
mov dword [ebp - 0x84], eax
mov eax, 0
mov dword [ebp - 0xa0], 0
mov eax, 0xffffffff
mov dword [ebp - 0x8c], 0xffffffff
mov eax, 0
mov dword [ebp - 0x58], 0
mov eax, 0
mov dword [ebp - 0x4c], 0
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.OLEAUT32.DLL_VariantInit]
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.OLEAUT32.DLL_VariantInit]
mov eax, 0xb
xchg edx, eax
lea eax, [ebp - 0x30]
mov dword [eax], edx
mov eax, 0
xchg edx, eax
lea eax, [ebp - 0x30]
mov dword [eax + 8], edx
mov eax, dword [ebp + 8]
mov edx, dword [0x5376bc]
cmp eax, edx
jne 0x49414f
mov dword [ebp - 0xc], 0x54a860
mov eax, 0xa
xchg edx, eax
lea eax, [ebp - 0x40]
mov dword [eax], edx
jmp 0x49431a
mov eax, dword [ebp + 8]
mov edx, dword [0x5376c8]
cmp eax, edx
jne 0x494173
mov dword [ebp - 0xc], str.HEAD
mov eax, 0xa
xchg edx, eax
lea eax, [ebp - 0x40]
mov dword [eax], edx
jmp 0x49431a
xor eax, eax
inc eax
je 0x49430c
mov eax, dword [ebp + 8]
mov edx, dword [0x5376c4]
cmp eax, edx
jne 0x494195
mov dword [ebp - 0xc], str.POST
jmp 0x49421c
mov eax, dword [0x540a3c]
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax + 0xc]
mov edx, eax
mov eax, dword [ebp + 8]
shl eax, 4
add eax, edx
sub eax, 0x10
mov dword [ebp - 0xac], eax
push dword [ebp - 0xac]
call fcn.0044b10b
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0xac]
call fcn.0042bf0d
mov eax, 7
xchg edx, eax
lea eax, [ebp - 0x6c]
mov dword [eax], edx
mov eax, 0
xchg edx, eax
lea eax, [ebp - 0x6c]
mov dword [eax + 4], edx
mov eax, 0
xchg edx, eax
lea eax, [ebp - 0x6c]
mov dword [eax + 0xc], edx
lea eax, [ebp - 0x6c]
push eax
call fcn.0042f505
push eax
call dword [sym.imp.MSVCRT.DLL__wcsupr]
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, 0
mov edx, dword [ebp + 0x14]
cmp eax, edx
jne 0x494238
mov eax, 0xa
xchg edx, eax
lea eax, [ebp - 0x40]
mov dword [eax], edx
jmp 0x49430a
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0x29
jne 0x4942d6
push dword [ebp + 0x14]
call fcn.0046259a
mov dword [ebp - 0xa4], eax
push dword [ebp + 0x14]
call fcn.00462559
mov dword [ebp - 0x8c], eax
push dword [ebp - 0x8c]
push 0
push 0x11
call dword [sym.imp.OLEAUT32.DLL_SafeArrayCreateVector]
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0xa0]
call dword [sym.imp.OLEAUT32.DLL_SafeArrayAccessData]
push dword [ebp - 0x8c]
push dword [ebp - 0xa4]
push dword [ebp - 0x58]
call dword [sym.imp.MSVCRT.DLL_memcpy]
add esp, 0xc
push dword [ebp - 0xa0]
call dword [sym.imp.OLEAUT32.DLL_SafeArrayUnaccessData]
mov eax, 0x2000
or eax, 0x11
mov edx, eax
lea eax, [ebp - 0x40]
mov dword [eax], edx
mov eax, dword [ebp - 0xa0]
xchg edx, eax
lea eax, [ebp - 0x40]
mov dword [eax + 8], edx
jmp 0x49430a
mov eax, 8
xchg edx, eax
lea eax, [ebp - 0x40]
mov dword [eax], edx
xor eax, eax
push eax
lea eax, [ebp - 0x8c]
push eax
push dword [ebp + 0x14]
call fcn.0042f52f
push eax
call dword [sym.imp.OLEAUT32.DLL_SysAllocString]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
xchg edx, eax
lea eax, [ebp - 0x40]
mov dword [eax + 8], edx
jmp 0x49431a
call 0x494311
pop eax
push eax
push 0x64
call fcn.00421c58
mov dword [ebp - 0x44], 0x54a87c
mov eax, 0
mov dword [ebp - 0x48], 0
lea eax, [ebp - 0x20]
push eax
push str.WinHttp.WinHttpRequest.5.1
call dword [sym.imp.OLE32.DLL_CLSIDFromProgID]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0
jl 0x494363
push dword [ebp - 0x44]
push dword [0x53f27c]
push 1
push 0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.OLE32.DLL_CoCreateInstance]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0
jl 0x4943e5
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
push dword [ebp - 0xc]
call dword [sym.imp.OLEAUT32.DLL_SysAllocString]
mov dword [ebp - 0x50], eax
push dword [ebp + 0xc]
call fcn.0042f505
push eax
call dword [sym.imp.OLEAUT32.DLL_SysAllocString]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x30]
mov eax, dword [eax + 0xc]
push eax
lea eax, [ebp - 0x30]
mov eax, dword [eax + 8]
push eax
lea eax, [ebp - 0x30]
mov eax, dword [eax + 4]
push eax
lea eax, [ebp - 0x30]
mov eax, dword [eax]
push eax
push dword [ebp - 0x54]
push dword [ebp - 0x50]
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 0x24]
call eax
mov dword [ebp - 0x10], eax
push dword [ebp - 0x50]
call dword [sym.imp.OLEAUT32.DLL_SysFreeString]
push dword [ebp - 0x54]
call dword [sym.imp.OLEAUT32.DLL_SysFreeString]
mov eax, dword [ebp - 0x10]
cmp eax, 0
jl 0x494528
mov eax, dword [ebp + 0x10]
cmp eax, 0
je 0x4944af
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax + 0xc]
xchg edx, eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 4]
xchg edx, eax
xchg edx, eax
shl eax, 4
add eax, edx
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x74], eax
jmp 0x4944a3
push dword [ebp - 0x70]
call fcn.0044c8af
push eax
call fcn.0042f505
push eax
call dword [sym.imp.OLEAUT32.DLL_SysAllocString]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x70]
add eax, 0x10
mov dword [ebp - 0x70], eax
push dword [ebp - 0x70]
call fcn.0042f505
push eax
call dword [sym.imp.OLEAUT32.DLL_SysAllocString]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x70]
add eax, 0x10
mov dword [ebp - 0x70], eax
push dword [ebp - 0x50]
push dword [ebp - 0x54]
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 0x28]
call eax
push dword [ebp - 0x50]
call dword [sym.imp.OLEAUT32.DLL_SysFreeString]
push dword [ebp - 0x54]
call dword [sym.imp.OLEAUT32.DLL_SysFreeString]
mov eax, dword [ebp - 0x70]
mov edx, dword [ebp - 0x74]
cmp eax, edx
jb 0x49443a
jmp 0x4944ee
push str.application_x_www_form_urlencoded
push str.Content_Type
push dword [ebp - 0x44]
push dword [ebp - 0x48]
call fcn.00494060
push str.UTF_8
push str.Accept_Charset
push dword [ebp - 0x44]
push dword [ebp - 0x48]
call fcn.00494060
push str.Mozilla_5.0__Windows_NT_6.1__Win64__x64_
push str.User_Agent
push dword [ebp - 0x44]
push dword [ebp - 0x48]
call fcn.00494060
lea eax, [ebp - 0x40]
mov eax, dword [eax + 0xc]
push eax
lea eax, [ebp - 0x40]
mov eax, dword [eax + 8]
push eax
lea eax, [ebp - 0x40]
mov eax, dword [eax + 4]
push eax
lea eax, [ebp - 0x40]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 0x34]
call eax
mov dword [ebp - 0x10], eax
jmp 0x494533
mov eax, dword [ebp - 0x84]
jmp 0x494782
mov eax, 0
mov edx, dword [ebp - 0xa0]
cmp eax, edx
sete al
xor ah, ah
cwde
xor al, 1
cmp eax, 0
je 0x49455b
push dword [ebp - 0xa0]
call dword [sym.imp.OLEAUT32.DLL_SafeArrayDestroy]
mov eax, dword [ebp - 0x10]
cmp eax, 0
jl 0x494624
mov eax, dword [ebp + 0x20]
cmp eax, 0
je 0x4945f9
push 3
call fcn.0043e590
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x8c]
push eax
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 0x38]
call eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0
jl 0x4945d2
push dword [ebp - 0x8c]
push dword [ebp - 0x88]
call fcn.0044a1a4
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 0x30]
call eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0
jl 0x4945f9
push dword [ebp - 0x58]
call fcn.00493ea7
push eax
push dword [ebp - 0x88]
call fcn.0043dafc
push dword [ebp - 0x58]
call dword [sym.imp.OLEAUT32.DLL_SysFreeString]
mov eax, dword [ebp - 0x4c]
cmp eax, 0
je 0x49460c
push dword [ebp - 0x4c]
call dword [sym.imp.OLEAUT32.DLL_SysFreeString]
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 0x44]
call eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0
jl 0x494761
lea eax, [ebp - 0x40]
mov eax, dword [eax + 8]
mov dword [ebp - 0x80], eax
mov eax, 0x2000
or eax, 0x11
push eax
pop edx
xchg edx, eax
lea eax, [ebp - 0x40]
mov eax, dword [eax]
xchg edx, eax
cmp eax, edx
jne 0x49466b
push dword [ebp - 0x80]
call dword [sym.imp.OLEAUT32.DLL_SafeArrayGetDim]
mov edx, eax
mov eax, 1
cmp eax, edx
jne 0x49466b
jmp 0x49466f
xor eax, eax
jmp 0x494672
xor eax, eax
inc eax
cmp eax, 0
je 0x494720
mov eax, 0
mov dword [ebp - 0x78], 0
mov eax, 0
mov dword [ebp - 0x7c], 0
lea eax, [ebp - 0x78]
push eax
push 1
push dword [ebp - 0x80]
call dword [sym.imp.OLEAUT32.DLL_SafeArrayGetLBound]
lea eax, [ebp - 0x7c]
push eax
push 1
push dword [ebp - 0x80]
call dword [sym.imp.OLEAUT32.DLL_SafeArrayGetUBound]
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.OLEAUT32.DLL_SafeArrayAccessData]
mov eax, dword [ebp - 0x7c]
mov edx, dword [ebp - 0x78]
sub eax, edx
inc eax
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp + 0x18]
cmp eax, 0
je 0x4946e9
push dword [ebp - 0x8c]
push dword [ebp - 0x58]
call fcn.00463fa9
jmp 0x494711
mov eax, dword [ebp + 0x1c]
cmp eax, 0
je 0x494703
push dword [ebp - 0x8c]
push dword [ebp - 0x58]
call fcn.00492fd0
jmp 0x494711
push dword [ebp - 0x8c]
push dword [ebp - 0x58]
call fcn.00492d53
mov dword [ebp - 0x84], eax
push dword [ebp - 0x80]
call dword [sym.imp.OLEAUT32.DLL_SafeArrayUnaccessData]
lea eax, [ebp - 0x40]
mov eax, dword [eax]
and eax, 0x2000
cmp eax, 0
jle 0x49473a
push dword [ebp - 0x80]
call dword [sym.imp.OLEAUT32.DLL_SafeArrayDestroy]
mov eax, dword [ebp + 0x20]
cmp eax, 0
je 0x494761
push dword [ebp - 0x84]
push dword [ebp - 0x88]
call fcn.0043dafc
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x48]
cmp eax, 0
je 0x49477c
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 8]
call eax
mov eax, dword [ebp - 0x84]
leave
ret 0x1c