Function at 0x4081a3
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
xor ecx, ecx
inc ecx
push ecx
cmp ecx, 3
jg 0x408486
push str._wp_admin_theme_install.php
mov ebx, dword [ebp + 8]
push dword [ebx]
mov ecx, 2
call fcn.004013b6
add esp, 8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0
push 0
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0
push 0
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0
push 0
push dword [ebp - 0x20]
push 1
push 0x14
push 1
mov eax, 0x4c2731
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x10]
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x40824e
push ebx
call fcn.0040cd2a
add esp, 4
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x40825e
push ebx
call fcn.0040cd2a
add esp, 4
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x50]
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x408288
push ebx
call fcn.0040cd2a
add esp, 4
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.referer:
mov ecx, 2
call fcn.004013b6
add esp, 8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x18]
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x4082d0
push ebx
call fcn.0040cd2a
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x4082e0
push ebx
call fcn.0040cd2a
add esp, 4
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, str.User_Agent:_Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_125.0.0.0_Safari_537.36
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x18]
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x408316
push ebx
call fcn.0040cd2a
add esp, 4
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x408326
push ebx
call fcn.0040cd2a
add esp, 4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x20]
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x2c]
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x408360
push ebx
call fcn.0040cd2a
add esp, 4
mov dword [ebp - 0x10], 0
push 0
push dword [ebp - 0x10]
mov dword [ebp - 0x14], 0
push 0
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0
push 0
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0
push 0
push dword [ebp - 0x20]
push dword [ebp + 0xc]
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x3c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4083c0
push ebx
call fcn.0040cd2a
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0
push 0
push dword [ebp - 0x10]
mov dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0
push 0
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x20], 0
push 0
push dword [ebp - 0x20]
push 1
mov eax, 0x4c29ec
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push 1
mov eax, str.name__wpnonce__value_
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
call fcn.00407d24
mov dword [ebp - 0x2c], eax
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x40843a
push ebx
call fcn.0040cd2a
add esp, 4
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x40844a
push ebx
call fcn.0040cd2a
add esp, 4
mov eax, dword [ebp - 0x2c]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40845e
push ebx
call fcn.0040cd2a
add esp, 4
pop eax
mov dword [ebp - 8], eax
push 0x4c120e
push dword [ebp - 8]
call fcn.004012ae
add esp, 8
cmp eax, 0
je 0x408480
jmp 0x408486
pop ecx
jmp 0x4081c3
add esp, 4
push 0x4c120e
push dword [ebp - 8]
call fcn.004012ae
add esp, 8
cmp eax, 0
jne 0x4084ac
mov eax, 0
jmp 0x408a2e
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
mov ebx, 6
call fcn.004048cd
push VariantClear
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x4084d5
mov eax, 0x4c120e
push eax
push VariantClear
push 0
push 0x4c2a06
push VariantClear
push 0
push str.______WebKitFormBoundaryTNyuXDH5zybVk0Ad_r_nContent_Disposition:_form_data__name__wpnonce__r_n_r_n
push 6
mov ebx, 0x40dc90
call fcn.0040cd1e
add esp, 0x4c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x408517
push ebx
call fcn.0040cd2a
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
xor ecx, ecx
inc ecx
push ecx
cmp ecx, 3
jg 0x4087ff
push str._wp_admin_update.php_actionupload_theme
mov ebx, dword [ebp + 8]
push dword [ebx]
mov ecx, 2
call fcn.004013b6
add esp, 8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0
push 0
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0
push 0
push dword [ebp - 0x1c]
push 1
push 1
push 1
push 0x14
push 1
mov eax, str.POST
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x10]
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x4085a3
push ebx
call fcn.0040cd2a
add esp, 4
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x4085b3
push ebx
call fcn.0040cd2a
add esp, 4
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x50]
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x4085dd
push ebx
call fcn.0040cd2a
add esp, 4
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.referer:
mov ecx, 2
call fcn.004013b6
add esp, 8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x18]
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x408625
push ebx
call fcn.0040cd2a
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x408635
push ebx
call fcn.0040cd2a
add esp, 4
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, str.Content_type:_multipart_form_data__boundary____WebKitFormBoundaryTNyuXDH5zybVk0Ad
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x18]
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x40866b
push ebx
call fcn.0040cd2a
add esp, 4
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x40867b
push ebx
call fcn.0040cd2a
add esp, 4
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, str.User_Agent:_Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_125.0.0.0_Safari_537.36
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x18]
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x4086b1
push ebx
call fcn.0040cd2a
add esp, 4
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x4086c1
push ebx
call fcn.0040cd2a
add esp, 4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x20]
push VariantClear
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x4086e4
mov eax, 0x4c120e
push eax
push 1
mov ebx, 0x40e010
call fcn.0040cd1e
add esp, 0x10
mov dword [ebp - 0x10], eax
push VariantClear
push 0
push str._r_n______WebKitFormBoundaryTNyuXDH5zybVk0Ad_r_nContent_Disposition:_form_data__name_install_theme_submit__r_n_r_nb
push 1
mov ebx, 0x40e010
call fcn.0040cd1e
add esp, 0x10
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push 0x4c2cb2
push dword [ebp - 0x10]
mov ecx, 3
call fcn.0040814c
add esp, 0xc
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x408746
push ebx
call fcn.0040cd2a
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x408756
push ebx
call fcn.0040cd2a
add esp, 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x30]
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x408777
push ebx
call fcn.0040cd2a
add esp, 4
mov dword [ebp - 0x10], 0
push 0
push dword [ebp - 0x10]
mov dword [ebp - 0x14], 0
push 0
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0
push 0
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0
push 0
push dword [ebp - 0x20]
push dword [ebp + 0xc]
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x3c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4087d7
push ebx
call fcn.0040cd2a
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x4c120e
push dword [ebp - 4]
call fcn.004012ae
add esp, 8
cmp eax, 0
je 0x4087f9
jmp 0x4087ff
pop ecx
jmp 0x40851d
add esp, 4
xor ecx, ecx
inc ecx
push ecx
cmp ecx, 3
jg 0x4089c1
push str._wp_content_themes_myweb_dd.php
mov ebx, dword [ebp + 8]
push dword [ebx]
mov ecx, 2
call fcn.004013b6
add esp, 8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0
push 0
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0
push 0
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0
push 0
push dword [ebp - 0x20]
push 1
push 0x14
push 1
mov eax, 0x4c2731
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x10]
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x40888f
push ebx
call fcn.0040cd2a
add esp, 4
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x40889f
push ebx
call fcn.0040cd2a
add esp, 4
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x50]
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x4088c9
push ebx
call fcn.0040cd2a
add esp, 4
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, str.User_Agent:_Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_125.0.0.0_Safari_537.36
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x18]
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x4088ff
push ebx
call fcn.0040cd2a
add esp, 4
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x40890f
push ebx
call fcn.0040cd2a
add esp, 4
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x2c]
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x408939
push ebx
call fcn.0040cd2a
add esp, 4
mov dword [ebp - 0x10], 0
push 0
push dword [ebp - 0x10]
mov dword [ebp - 0x14], 0
push 0
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0
push 0
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0
push 0
push dword [ebp - 0x20]
push dword [ebp + 0xc]
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x3c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x408999
push ebx
call fcn.0040cd2a
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x4c120e
push dword [ebp - 4]
call fcn.004012ae
add esp, 8
cmp eax, 0
je 0x4089bb
jmp 0x4089c1
pop ecx
jmp 0x408804
add esp, 4
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push VariantClear
push 0
push str.myweb
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4089f5
mov eax, 0x4c120e
push eax
push 4
mov ebx, 0x40d6c0
call fcn.0040cd1e
add esp, 0x34
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x408a24
mov eax, 1
jmp 0x408a2e
mov eax, 0
jmp 0x408a2e
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x408a3f
push ebx
call fcn.0040cd2a
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x408a4f
push ebx
call fcn.0040cd2a
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x408a5f
push ebx
call fcn.0040cd2a
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0xc