Function at 0x40332f
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.0040c589
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebp - 0x10], 0
push 8
call fcn.0040c589
add esp, 4
mov dword [ebp - 0x14], eax
mov edi, eax
mov esi, 0x4c0f6d
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
push 0x10
call fcn.0040c589
add esp, 4
mov dword [ebp - 0x28], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov eax, 3
mov dword [ebx], eax
mov dword [ebp - 0x2c], 0
push 8
call fcn.0040c589
add esp, 4
mov dword [ebp - 0x30], eax
mov edi, eax
mov esi, 0x4c0f6d
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
cmp dword [ebp + 0x30], 0
mov eax, 0
sete al
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x403445
mov ebx, dword [ebp + 0x2c]
mov eax, dword [ebx]
test eax, eax
je 0x403430
push eax
mov ebx, eax
call fcn.00401004
inc eax
push eax
call fcn.0040c589
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x403441
push ebx
call fcn.0040c58f
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x403458
mov eax, 0x4c0c8d
push eax
push 1
mov ebx, 0x40c810
call fcn.0040c5a1
add esp, 0x10
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x4034b4
push str._r_nAccept_Language:zh_cn_r_nUser_Agent:_Mozilla_5.0__Windows_NT_6.1__WOW64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_50.0.2661.87_Safari_537.36_r_nContent_Type:application_x_www_form_urlencoded
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.Accept:__r_nReferer:
mov ecx, 3
call fcn.0040106f
add esp, 0xc
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4034ab
push ebx
call fcn.0040c58f
add esp, 4
pop eax
mov dword [ebp - 4], eax
jmp 0x40385b
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4034c7
mov eax, 0x4c0c8d
push eax
push 1
mov ebx, 0x40cde0
call fcn.0040c5a1
add esp, 0x10
mov dword [ebp - 0x34], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.accept
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x40350e
mov eax, 0x4c0c8d
push eax
push 4
mov ebx, 0x40cc30
call fcn.0040c5a1
add esp, 0x34
mov dword [ebp - 0x38], eax
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x403534
push ebx
call fcn.0040c58f
add esp, 4
cmp dword [ebp - 0x38], 0xffffffff
jne 0x40356e
push str._r_nAccept:__
push dword [ebp - 4]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40356a
push ebx
call fcn.0040c58f
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x403581
mov eax, 0x4c0c8d
push eax
push 1
mov ebx, 0x40cde0
call fcn.0040c5a1
add esp, 0x10
mov dword [ebp - 0x34], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.referer
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x4035c8
mov eax, 0x4c0c8d
push eax
push 4
mov ebx, 0x40cc30
call fcn.0040c5a1
add esp, 0x34
mov dword [ebp - 0x38], eax
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x4035ee
push ebx
call fcn.0040c58f
add esp, 4
cmp dword [ebp - 0x38], 0xffffffff
jne 0x40362d
mov ebx, dword [ebp + 8]
push dword [ebx]
push str._r_nReferer:
push dword [ebp - 4]
mov ecx, 3
call fcn.0040106f
add esp, 0xc
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x403629
push ebx
call fcn.0040c58f
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x403640
mov eax, 0x4c0c8d
push eax
push 1
mov ebx, 0x40cde0
call fcn.0040c5a1
add esp, 0x10
mov dword [ebp - 0x34], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.accept_language
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x403687
mov eax, 0x4c0c8d
push eax
push 4
mov ebx, 0x40cc30
call fcn.0040c5a1
add esp, 0x34
mov dword [ebp - 0x38], eax
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x4036ad
push ebx
call fcn.0040c58f
add esp, 4
cmp dword [ebp - 0x38], 0xffffffff
jne 0x4036e7
push str._r_nAccept_Language:_zh_cn
push dword [ebp - 4]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4036e3
push ebx
call fcn.0040c58f
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4036fa
mov eax, 0x4c0c8d
push eax
push 1
mov ebx, 0x40cde0
call fcn.0040c5a1
add esp, 0x10
mov dword [ebp - 0x34], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.user_agent
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x403741
mov eax, 0x4c0c8d
push eax
push 4
mov ebx, 0x40cc30
call fcn.0040c5a1
add esp, 0x34
mov dword [ebp - 0x38], eax
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x403767
push ebx
call fcn.0040c58f
add esp, 4
cmp dword [ebp - 0x38], 0xffffffff
jne 0x4037a1
push str._r_nUser_Agent:_Mozilla_5.0__Windows_NT_6.1__WOW64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_50.0.2661.87_Safari_537.36
push dword [ebp - 4]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40379d
push ebx
call fcn.0040c58f
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4037b4
mov eax, 0x4c0c8d
push eax
push 1
mov ebx, 0x40cde0
call fcn.0040c5a1
add esp, 0x10
mov dword [ebp - 0x34], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.content_type
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x4037fb
mov eax, 0x4c0c8d
push eax
push 4
mov ebx, 0x40cc30
call fcn.0040c5a1
add esp, 0x34
mov dword [ebp - 0x38], eax
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x403821
push ebx
call fcn.0040c58f
add esp, 4
cmp dword [ebp - 0x38], 0xffffffff
jne 0x40385b
push str._r_nContent_Type:_application_x_www_form_urlencoded
push dword [ebp - 4]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x403857
push ebx
call fcn.0040c58f
add esp, 4
pop eax
mov dword [ebp - 4], eax
cmp dword [ebp + 0x60], 0
mov eax, 0
sete al
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x403a8c
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.X_Forwarded_For
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4038a5
mov eax, 0x4c0c8d
push eax
push 4
mov ebx, 0x40cc30
call fcn.0040c5a1
add esp, 0x34
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffff
jne 0x4038fa
mov ebx, dword [ebp + 0x5c]
push dword [ebx]
push str._r_nX_Forwarded_For:
push dword [ebp - 4]
mov ecx, 3
call fcn.0040106f
add esp, 0xc
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4038f6
push ebx
call fcn.0040c58f
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.CLIENT_IP
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x40392b
mov eax, 0x4c0c8d
push eax
push 4
mov ebx, 0x40cc30
call fcn.0040c5a1
add esp, 0x34
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffff
jne 0x403980
mov ebx, dword [ebp + 0x5c]
push dword [ebx]
push str._r_nCLIENT_IP:
push dword [ebp - 4]
mov ecx, 3
call fcn.0040106f
add esp, 0xc
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40397c
push ebx
call fcn.0040c58f
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push 0x4c15b2
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4039b1
mov eax, 0x4c0c8d
push eax
push 4
mov ebx, 0x40cc30
call fcn.0040c5a1
add esp, 0x34
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffff
jne 0x403a06
mov ebx, dword [ebp + 0x5c]
push dword [ebx]
push str._r_nVIA:
push dword [ebp - 4]
mov ecx, 3
call fcn.0040106f
add esp, 0xc
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x403a02
push ebx
call fcn.0040c58f
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.REMOTE_ADDR
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x403a37
mov eax, 0x4c0c8d
push eax
push 4
mov ebx, 0x40cc30
call fcn.0040c5a1
add esp, 0x34
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffff
jne 0x403a8c
mov ebx, dword [ebp + 0x5c]
push dword [ebx]
push str._r_nREMOTE_ADDR:
push dword [ebp - 4]
mov ecx, 3
call fcn.0040106f
add esp, 0xc
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x403a88
push ebx
call fcn.0040c58f
add esp, 4
pop eax
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
jl 0x403aa4
cmp dword [ebp + 0xc], 7
jg 0x403aa4
xor eax, eax
jmp 0x403aa9
mov eax, 1
test eax, eax
je 0x403ab8
mov dword [ebp + 0xc], 0
fild dword [ebp + 0xc]
fstp qword [ebp - 0x38]
fld qword [ebp - 0x38]
fadd qword [0x4c1135]
fstp qword [ebp - 0x40]
fld qword [ebp - 0x40]
call fcn.0040118d
cmp eax, 1
jl 0x403adc
cmp eax, 9
jl 0x403af3
push 0xa19
push 0x404a0d0
push 9
call fcn.0040c595
add esp, 0xc
dec eax
call 0x403af9
pop ebx
add ebx, dword [eax*4 + 0x4c1609]
jmp ebx