Function at 0x4016f0
Capabilities:
Reference http user-agent string

Disassembly:
sub esp, 0xc
push ebx
push esi
mov ebx, dword [esp + 0x18]
push edi
push ebp
mov edi, str.GET__login_HTTP_1.1_r_nHost:_account.mail.ru_r_nAccept:_text_html_application_xhtmlxml_application_xml_q0.9_image_avif_image_webp_image_apng___q0.8_application_signed_exchange_vb3_q0.7_r_nAccept_Language:_ru_RU_ru_q0.9_en_US_q0.8_en_q0.7_r_nConnection:_keep_alive_r_nReferer:_https:__account.mail.ru_r_nCache_Control:_max_age0_r_nSec_Ch_Ua:__Chromium__v_117____Not_ABrand__v_8__r_nSec_Ch_Ua_Mobile:__0_r_nSec_Ch_Ua_Platform:__Windows__r_nSec_Fetch_Dest:_document_r_nSec_Fetch_Mode:_navigate_r_nSec_Fetch_Site:_none_r_nSec_Fetch_User:__1_r_nUpgrade_Insecure_Requests:_1_r_nUser_Agent:_Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_117.0.0.0_Safari_537.36_r_n_r_n
push 1
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, dword [esp + 0x28]
push ecx
push str.GET__login_HTTP_1.1_r_nHost:_account.mail.ru_r_nAccept:_text_html_application_xhtmlxml_application_xml_q0.9_image_avif_image_webp_image_apng___q0.8_application_signed_exchange_vb3_q0.7_r_nAccept_Language:_ru_RU_ru_q0.9_en_US_q0.8_en_q0.7_r_nConnection:_keep_alive_r_nReferer:_https:__account.mail.ru_r_nCache_Control:_max_age0_r_nSec_Ch_Ua:__Chromium__v_117____Not_ABrand__v_8__r_nSec_Ch_Ua_Mobile:__0_r_nSec_Ch_Ua_Platform:__Windows__r_nSec_Fetch_Dest:_document_r_nSec_Fetch_Mode:_navigate_r_nSec_Fetch_Site:_none_r_nSec_Fetch_User:__1_r_nUpgrade_Insecure_Requests:_1_r_nUser_Agent:_Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_117.0.0.0_Safari_537.36_r_n_r_n
push esi
call sub.SSLEAY32.dll_Ordinal_108
add esp, 0xc
test eax, eax
jg 0x40173a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret
lea eax, [esp + 0x14]
push eax
push esi
push ebx
call fcn.00401080
mov edi, dword [esp + 0x44]
lea ecx, [esp + 0x24]
mov edx, dword [esp + 0x20]
add esp, 0xc
mov dword [edi], str.lwf60nzg.48u
push ecx
push edx
push eax
push ebx
call fcn.00401370
lea ecx, [esp + 0x20]
add esp, 0x10
mov esi, eax
mov byte [ebp], 0
push ecx
push 0
push str.POST__cgi_bin_auth_HTTP_1.1_r_nHost:_auth.mail.ru_r_nConnection:_keep_alive_r_nAccept:_application_xml__text_xml_____q0.01_r_nAccept_Language:_ru_RU_ru_q0.9_en_US_q0.8_en_q0.7_r_nCache_Control:_max_age0_r_nDnt:_1_r_nOrigin:_https:__account.mail.ru_r_nReferer:_https:__account.mail.ru_r_nSec_Ch_Ua:__Chromium__v_117____Not_ABrand__v_8__r_nSec_Ch_Ua_Full_Version:__117.0.5938.11__r_nSec_Ch_Ua_Full_Version_List:__Chromium__v_117.0.5938.11____Not_ABrand__v_8.0.0.0__r_nSec_Ch_Ua_Mobile:__0_r_nSec_Ch_Ua_Model:____r_nSec_Ch_Ua_Platform:__Windows__r_nSec_Ch_Ua_Platform_Version:__15.0.0__r_nSec_Fetch_Dest:_document_r_nSec_Fetch_Mode:_navigate_r_nSec_Fetch_Site:_same_site_r_nSec_Fetch_User:__1_r_nUpgrade_Insecure_Requests:_1_r_nUser_Agent:_Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_117.0.0.0_Safari_537.36_r_nContent_Type:_application_x_www_form_urlencoded_r_nCookie:
push ebp
push ebx
call fcn.00401000
lea ecx, [esp + 0x24]
add esp, 0x14
push ecx
push 0
push esi
push eax
push ebx
call fcn.00401000
lea ecx, [esp + 0x24]
add esp, 0x14
push ecx
push 0
push str._r_nContent_Length:_372_r_n_r_nusernamevcare14_40mail.ruLoginvcare14_40mail.rupasswordopenssl6421Passwordopenssl6421saveauth1new_auth_form1FromAccountopener_3Daccount_26twoSteps_3D1act_token
push eax
push ebx
call fcn.00401000
add esp, 0x14
mov ebp, eax
lea eax, [esp + 0x10]
push eax
push 0x20
push str.act
push esi
call fcn.0040253c
add esp, 8
add eax, 4
push eax
push ebp
push ebx
call fcn.00401000
lea ecx, [esp + 0x24]
add esp, 0x14
push ecx
push 0
push str.pagehttps_3A_2F_2Fe.mail.ru_2Fmessages_2Finbox_3Fauthid_3D
push eax
push ebx
call fcn.00401000
lea ecx, [esp + 0x24]
add esp, 0x14
mov edx, dword [edi]
push ecx
push 0
push edx
push eax
push ebx
call fcn.00401000
lea ecx, [esp + 0x24]
add esp, 0x14
push ecx
push 0
push str._26back_3D1_26dwhsplit_3Ds10273.b1ss12743s_26from_3Dlogin_26x_login_auth_3D1back1langru_RU
push eax
push ebx
call fcn.00401000
lea ecx, [esp + 0x24]
add esp, 0x14
push ecx
push 0
push str._r_n_r_n
push eax
push ebx
call fcn.00401000
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x44]
mov ebx, dword [esp + 0x48]
add esp, 0x14
mov dword [ecx], edx
pop ebp
pop edi
mov dword [ebx], esi
pop esi
pop ebx
add esp, 0xc
ret