Function at 0x49770d
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xa4
mov eax, dword [0x576784]
mov dword [ebp - 0x84], eax
mov eax, 0
mov dword [ebp - 0xa0], 0
mov eax, 0xffffffff
mov dword [ebp - 0x8c], 0xffffffff
mov eax, 0
mov dword [ebp - 0x58], 0
mov eax, 0
mov dword [ebp - 0x4c], 0
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.OLEAUT32.DLL_VariantInit]
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.OLEAUT32.DLL_VariantInit]
mov eax, 0xb
xchg edx, eax
lea eax, [ebp - 0x30]
mov dword [eax], edx
mov eax, 0
xchg edx, eax
lea eax, [ebp - 0x30]
mov dword [eax + 8], edx
mov eax, dword [ebp + 8]
mov edx, dword [0x570714]
cmp eax, edx
jne 0x4977ad
mov dword [ebp - 0xc], 0x5833c8
mov eax, 0xa
xchg edx, eax
lea eax, [ebp - 0x40]
mov dword [eax], edx
jmp 0x497978
mov eax, dword [ebp + 8]
mov edx, dword [0x570720]
cmp eax, edx
jne 0x4977d1
mov dword [ebp - 0xc], str.HEAD
mov eax, 0xa
xchg edx, eax
lea eax, [ebp - 0x40]
mov dword [eax], edx
jmp 0x497978
xor eax, eax
inc eax
je 0x49796a
mov eax, dword [ebp + 8]
mov edx, dword [0x57071c]
cmp eax, edx
jne 0x4977f3
mov dword [ebp - 0xc], str.POST
jmp 0x49787a
mov eax, dword [0x578740]
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax + 0xc]
mov edx, eax
mov eax, dword [ebp + 8]
shl eax, 4
add eax, edx
sub eax, 0x10
mov dword [ebp - 0xac], eax
push dword [ebp - 0xac]
call fcn.0044e765
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0xac]
call fcn.0042f7c5
mov eax, 7
xchg edx, eax
lea eax, [ebp - 0x6c]
mov dword [eax], edx
mov eax, 0
xchg edx, eax
lea eax, [ebp - 0x6c]
mov dword [eax + 4], edx
mov eax, 0
xchg edx, eax
lea eax, [ebp - 0x6c]
mov dword [eax + 0xc], edx
lea eax, [ebp - 0x6c]
push eax
call fcn.00432dbd
push eax
call dword [sym.imp.MSVCRT.DLL__wcsupr]
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, 0
mov edx, dword [ebp + 0x14]
cmp eax, edx
jne 0x497896
mov eax, 0xa
xchg edx, eax
lea eax, [ebp - 0x40]
mov dword [eax], edx
jmp 0x497968
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0x29
jne 0x497934
push dword [ebp + 0x14]
call fcn.00465bf4
mov dword [ebp - 0xa4], eax
push dword [ebp + 0x14]
call fcn.00465bb3
mov dword [ebp - 0x8c], eax
push dword [ebp - 0x8c]
push 0
push 0x11
call dword [sym.imp.OLEAUT32.DLL_SafeArrayCreateVector]
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0xa0]
call dword [sym.imp.OLEAUT32.DLL_SafeArrayAccessData]
push dword [ebp - 0x8c]
push dword [ebp - 0xa4]
push dword [ebp - 0x58]
call dword [sym.imp.MSVCRT.DLL_memcpy]
add esp, 0xc
push dword [ebp - 0xa0]
call dword [sym.imp.OLEAUT32.DLL_SafeArrayUnaccessData]
mov eax, 0x2000
or eax, 0x11
mov edx, eax
lea eax, [ebp - 0x40]
mov dword [eax], edx
mov eax, dword [ebp - 0xa0]
xchg edx, eax
lea eax, [ebp - 0x40]
mov dword [eax + 8], edx
jmp 0x497968
mov eax, 8
xchg edx, eax
lea eax, [ebp - 0x40]
mov dword [eax], edx
xor eax, eax
push eax
lea eax, [ebp - 0x8c]
push eax
push dword [ebp + 0x14]
call fcn.00432de7
push eax
call dword [sym.imp.OLEAUT32.DLL_SysAllocString]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
xchg edx, eax
lea eax, [ebp - 0x40]
mov dword [eax + 8], edx
jmp 0x497978
call 0x49796f
pop eax
push eax
push 0x64
call fcn.00425689
mov dword [ebp - 0x44], 0x5833e4
mov eax, 0
mov dword [ebp - 0x48], 0
lea eax, [ebp - 0x20]
push eax
push str.WinHttp.WinHttpRequest.5.1
call dword [sym.imp.OLE32.DLL_CLSIDFromProgID]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0
jl 0x4979c1
push dword [ebp - 0x44]
push dword [0x5782d4]
push 1
push 0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.OLE32.DLL_CoCreateInstance]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0
jl 0x497a43
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
push dword [ebp - 0xc]
call dword [sym.imp.OLEAUT32.DLL_SysAllocString]
mov dword [ebp - 0x50], eax
push dword [ebp + 0xc]
call fcn.00432dbd
push eax
call dword [sym.imp.OLEAUT32.DLL_SysAllocString]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x30]
mov eax, dword [eax + 0xc]
push eax
lea eax, [ebp - 0x30]
mov eax, dword [eax + 8]
push eax
lea eax, [ebp - 0x30]
mov eax, dword [eax + 4]
push eax
lea eax, [ebp - 0x30]
mov eax, dword [eax]
push eax
push dword [ebp - 0x54]
push dword [ebp - 0x50]
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 0x24]
call eax
mov dword [ebp - 0x10], eax
push dword [ebp - 0x50]
call dword [sym.imp.OLEAUT32.DLL_SysFreeString]
push dword [ebp - 0x54]
call dword [sym.imp.OLEAUT32.DLL_SysFreeString]
mov eax, dword [ebp - 0x10]
cmp eax, 0
jl 0x497b86
mov eax, dword [ebp + 0x10]
cmp eax, 0
je 0x497b0d
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax + 0xc]
xchg edx, eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 4]
xchg edx, eax
xchg edx, eax
shl eax, 4
add eax, edx
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x74], eax
jmp 0x497b01
push dword [ebp - 0x70]
call fcn.0044ff09
push eax
call fcn.00432dbd
push eax
call dword [sym.imp.OLEAUT32.DLL_SysAllocString]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x70]
add eax, 0x10
mov dword [ebp - 0x70], eax
push dword [ebp - 0x70]
call fcn.00432dbd
push eax
call dword [sym.imp.OLEAUT32.DLL_SysAllocString]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x70]
add eax, 0x10
mov dword [ebp - 0x70], eax
push dword [ebp - 0x50]
push dword [ebp - 0x54]
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 0x28]
call eax
push dword [ebp - 0x50]
call dword [sym.imp.OLEAUT32.DLL_SysFreeString]
push dword [ebp - 0x54]
call dword [sym.imp.OLEAUT32.DLL_SysFreeString]
mov eax, dword [ebp - 0x70]
mov edx, dword [ebp - 0x74]
cmp eax, edx
jb 0x497a98
jmp 0x497b4c
push str.application_x_www_form_urlencoded
push str.Content_Type
push dword [ebp - 0x44]
push dword [ebp - 0x48]
call fcn.004976be
push str.UTF_8
push str.Accept_Charset
push dword [ebp - 0x44]
push dword [ebp - 0x48]
call fcn.004976be
push str.Mozilla_5.0__Windows_NT_6.1__Win64__x64_
push str.User_Agent
push dword [ebp - 0x44]
push dword [ebp - 0x48]
call fcn.004976be
lea eax, [ebp - 0x40]
mov eax, dword [eax + 0xc]
push eax
lea eax, [ebp - 0x40]
mov eax, dword [eax + 8]
push eax
lea eax, [ebp - 0x40]
mov eax, dword [eax + 4]
push eax
lea eax, [ebp - 0x40]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 0x34]
call eax
mov dword [ebp - 0x10], eax
jmp 0x497b91
mov eax, dword [ebp - 0x84]
jmp 0x497de0
mov eax, 0
mov edx, dword [ebp - 0xa0]
cmp eax, edx
sete al
xor ah, ah
cwde
xor al, 1
cmp eax, 0
je 0x497bb9
push dword [ebp - 0xa0]
call dword [sym.imp.OLEAUT32.DLL_SafeArrayDestroy]
mov eax, dword [ebp - 0x10]
cmp eax, 0
jl 0x497c82
mov eax, dword [ebp + 0x20]
cmp eax, 0
je 0x497c57
push 3
call fcn.00441bea
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x8c]
push eax
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 0x38]
call eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0
jl 0x497c30
push dword [ebp - 0x8c]
push dword [ebp - 0x88]
call fcn.0044d7fe
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 0x30]
call eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0
jl 0x497c57
push dword [ebp - 0x58]
call fcn.00497505
push eax
push dword [ebp - 0x88]
call fcn.00441156
push dword [ebp - 0x58]
call dword [sym.imp.OLEAUT32.DLL_SysFreeString]
mov eax, dword [ebp - 0x4c]
cmp eax, 0
je 0x497c6a
push dword [ebp - 0x4c]
call dword [sym.imp.OLEAUT32.DLL_SysFreeString]
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 0x44]
call eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0
jl 0x497dbf
lea eax, [ebp - 0x40]
mov eax, dword [eax + 8]
mov dword [ebp - 0x80], eax
mov eax, 0x2000
or eax, 0x11
push eax
pop edx
xchg edx, eax
lea eax, [ebp - 0x40]
mov eax, dword [eax]
xchg edx, eax
cmp eax, edx
jne 0x497cc9
push dword [ebp - 0x80]
call dword [sym.imp.OLEAUT32.DLL_SafeArrayGetDim]
mov edx, eax
mov eax, 1
cmp eax, edx
jne 0x497cc9
jmp 0x497ccd
xor eax, eax
jmp 0x497cd0
xor eax, eax
inc eax
cmp eax, 0
je 0x497d7e
mov eax, 0
mov dword [ebp - 0x78], 0
mov eax, 0
mov dword [ebp - 0x7c], 0
lea eax, [ebp - 0x78]
push eax
push 1
push dword [ebp - 0x80]
call dword [sym.imp.OLEAUT32.DLL_SafeArrayGetLBound]
lea eax, [ebp - 0x7c]
push eax
push 1
push dword [ebp - 0x80]
call dword [sym.imp.OLEAUT32.DLL_SafeArrayGetUBound]
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.OLEAUT32.DLL_SafeArrayAccessData]
mov eax, dword [ebp - 0x7c]
mov edx, dword [ebp - 0x78]
sub eax, edx
inc eax
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp + 0x18]
cmp eax, 0
je 0x497d47
push dword [ebp - 0x8c]
push dword [ebp - 0x58]
call fcn.00467603
jmp 0x497d6f
mov eax, dword [ebp + 0x1c]
cmp eax, 0
je 0x497d61
push dword [ebp - 0x8c]
push dword [ebp - 0x58]
call fcn.0049662e
jmp 0x497d6f
push dword [ebp - 0x8c]
push dword [ebp - 0x58]
call fcn.004963b1
mov dword [ebp - 0x84], eax
push dword [ebp - 0x80]
call dword [sym.imp.OLEAUT32.DLL_SafeArrayUnaccessData]
lea eax, [ebp - 0x40]
mov eax, dword [eax]
and eax, 0x2000
cmp eax, 0
jle 0x497d98
push dword [ebp - 0x80]
call dword [sym.imp.OLEAUT32.DLL_SafeArrayDestroy]
mov eax, dword [ebp + 0x20]
cmp eax, 0
je 0x497dbf
push dword [ebp - 0x84]
push dword [ebp - 0x88]
call fcn.00441156
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x48]
cmp eax, 0
je 0x497dda
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 8]
call eax
mov eax, dword [ebp - 0x84]
leave
ret 0x1c