Function at 0x406baf
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.005dc81a
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebp - 0x10], 0
push 8
call fcn.005dc81a
add esp, 4
mov dword [ebp - 0x14], eax
mov edi, eax
mov esi, 0x6b42b5
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
push 0x10
call fcn.005dc81a
add esp, 4
mov dword [ebp - 0x28], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov eax, 3
mov dword [ebx], eax
mov dword [ebp - 0x2c], 0
push 8
call fcn.005dc81a
add esp, 4
mov dword [ebp - 0x30], eax
mov edi, eax
mov esi, 0x6b42b5
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
cmp dword [ebp + 0x30], 0
mov eax, 0
sete al
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x406cc5
mov ebx, dword [ebp + 0x2c]
mov eax, dword [ebx]
test eax, eax
je 0x406cb0
push eax
mov ebx, eax
call fcn.00401021
inc eax
push eax
call fcn.005dc81a
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x406cc1
push ebx
call fcn.005dc820
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x406cd8
mov eax, 0x6b4435
push eax
push 1
mov ebx, 0x5dcf40
call fcn.005dc82c
add esp, 0x10
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x406d34
push str._r_nAccept_Language:zh_cn_r_nUser_Agent:_Mozilla_5.0__Windows_NT_6.1__WOW64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_50.0.2661.87_Safari_537.36_r_nContent_Type:application_x_www_form_urlencoded
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.Accept:__r_nReferer:
mov ecx, 3
call fcn.0040108c
add esp, 0xc
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x406d2b
push ebx
call fcn.005dc820
add esp, 4
pop eax
mov dword [ebp - 4], eax
jmp 0x4070db
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x406d47
mov eax, 0x6b4435
push eax
push 1
mov ebx, 0x5dd720
call fcn.005dc82c
add esp, 0x10
mov dword [ebp - 0x34], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.accept
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x406d8e
mov eax, 0x6b4435
push eax
push 4
mov ebx, 0x5dd550
call fcn.005dc82c
add esp, 0x34
mov dword [ebp - 0x38], eax
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x406db4
push ebx
call fcn.005dc820
add esp, 4
cmp dword [ebp - 0x38], 0xffffffff
jne 0x406dee
push str._r_nAccept:__
push dword [ebp - 4]
mov ecx, 2
call fcn.0040108c
add esp, 8
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x406dea
push ebx
call fcn.005dc820
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x406e01
mov eax, 0x6b4435
push eax
push 1
mov ebx, 0x5dd720
call fcn.005dc82c
add esp, 0x10
mov dword [ebp - 0x34], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.referer
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x406e48
mov eax, 0x6b4435
push eax
push 4
mov ebx, 0x5dd550
call fcn.005dc82c
add esp, 0x34
mov dword [ebp - 0x38], eax
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x406e6e
push ebx
call fcn.005dc820
add esp, 4
cmp dword [ebp - 0x38], 0xffffffff
jne 0x406ead
mov ebx, dword [ebp + 8]
push dword [ebx]
push str._r_nReferer:
push dword [ebp - 4]
mov ecx, 3
call fcn.0040108c
add esp, 0xc
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x406ea9
push ebx
call fcn.005dc820
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x406ec0
mov eax, 0x6b4435
push eax
push 1
mov ebx, 0x5dd720
call fcn.005dc82c
add esp, 0x10
mov dword [ebp - 0x34], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.accept_language
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x406f07
mov eax, 0x6b4435
push eax
push 4
mov ebx, 0x5dd550
call fcn.005dc82c
add esp, 0x34
mov dword [ebp - 0x38], eax
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x406f2d
push ebx
call fcn.005dc820
add esp, 4
cmp dword [ebp - 0x38], 0xffffffff
jne 0x406f67
push str._r_nAccept_Language:_zh_cn
push dword [ebp - 4]
mov ecx, 2
call fcn.0040108c
add esp, 8
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x406f63
push ebx
call fcn.005dc820
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x406f7a
mov eax, 0x6b4435
push eax
push 1
mov ebx, 0x5dd720
call fcn.005dc82c
add esp, 0x10
mov dword [ebp - 0x34], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.user_agent
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x406fc1
mov eax, 0x6b4435
push eax
push 4
mov ebx, 0x5dd550
call fcn.005dc82c
add esp, 0x34
mov dword [ebp - 0x38], eax
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x406fe7
push ebx
call fcn.005dc820
add esp, 4
cmp dword [ebp - 0x38], 0xffffffff
jne 0x407021
push str._r_nUser_Agent:_Mozilla_5.0__Windows_NT_6.1__WOW64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_50.0.2661.87_Safari_537.36
push dword [ebp - 4]
mov ecx, 2
call fcn.0040108c
add esp, 8
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40701d
push ebx
call fcn.005dc820
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x407034
mov eax, 0x6b4435
push eax
push 1
mov ebx, 0x5dd720
call fcn.005dc82c
add esp, 0x10
mov dword [ebp - 0x34], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.content_type
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x40707b
mov eax, 0x6b4435
push eax
push 4
mov ebx, 0x5dd550
call fcn.005dc82c
add esp, 0x34
mov dword [ebp - 0x38], eax
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x4070a1
push ebx
call fcn.005dc820
add esp, 4
cmp dword [ebp - 0x38], 0xffffffff
jne 0x4070db
push str._r_nContent_Type:_application_x_www_form_urlencoded
push dword [ebp - 4]
mov ecx, 2
call fcn.0040108c
add esp, 8
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4070d7
push ebx
call fcn.005dc820
add esp, 4
pop eax
mov dword [ebp - 4], eax
cmp dword [ebp + 0x60], 0
mov eax, 0
sete al
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x40730c
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.X_Forwarded_For
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x407125
mov eax, 0x6b4435
push eax
push 4
mov ebx, 0x5dd550
call fcn.005dc82c
add esp, 0x34
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffff
jne 0x40717a
mov ebx, dword [ebp + 0x5c]
push dword [ebx]
push str._r_nX_Forwarded_For:
push dword [ebp - 4]
mov ecx, 3
call fcn.0040108c
add esp, 0xc
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x407176
push ebx
call fcn.005dc820
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.CLIENT_IP
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4071ab
mov eax, 0x6b4435
push eax
push 4
mov ebx, 0x5dd550
call fcn.005dc82c
add esp, 0x34
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffff
jne 0x407200
mov ebx, dword [ebp + 0x5c]
push dword [ebx]
push str._r_nCLIENT_IP:
push dword [ebp - 4]
mov ecx, 3
call fcn.0040108c
add esp, 0xc
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4071fc
push ebx
call fcn.005dc820
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push 0x6b4a4c
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x407231
mov eax, 0x6b4435
push eax
push 4
mov ebx, 0x5dd550
call fcn.005dc82c
add esp, 0x34
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffff
jne 0x407286
mov ebx, dword [ebp + 0x5c]
push dword [ebx]
push str._r_nVIA:
push dword [ebp - 4]
mov ecx, 3
call fcn.0040108c
add esp, 0xc
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x407282
push ebx
call fcn.005dc820
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.REMOTE_ADDR
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4072b7
mov eax, 0x6b4435
push eax
push 4
mov ebx, 0x5dd550
call fcn.005dc82c
add esp, 0x34
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffff
jne 0x40730c
mov ebx, dword [ebp + 0x5c]
push dword [ebx]
push str._r_nREMOTE_ADDR:
push dword [ebp - 4]
mov ecx, 3
call fcn.0040108c
add esp, 0xc
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x407308
push ebx
call fcn.005dc820
add esp, 4
pop eax
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
jl 0x407324
cmp dword [ebp + 0xc], 7
jg 0x407324
xor eax, eax
jmp 0x407329
mov eax, 1
test eax, eax
je 0x407338
mov dword [ebp + 0xc], 0
fild dword [ebp + 0xc]
fstp qword [ebp - 0x38]
fld qword [ebp - 0x38]
fadd qword [0x6b43f1]
fstp qword [ebp - 0x40]
fld qword [ebp - 0x40]
call fcn.004019f6
cmp eax, 1
jl 0x40735c
cmp eax, 9
jl 0x407373
push 0xa19
push 0x413a4c0
push 9
call fcn.005dc826
add esp, 0xc
dec eax
call 0x407379
pop ebx
add ebx, dword [eax*4 + 0x6b4aa3]
jmp ebx