Function at 0x401840
Capabilities:
Reference http user-agent string

Disassembly:
sub esp, 0x18
push ebx
push esi
mov ebx, dword [esp + 0x24]
push edi
push ebp
mov edi, str.GET__home_HTTP_1.1_r_nHost:_cloud.mail.ru_r_nAccept:_text_html_application_xhtmlxml_application_xml_q0.9_image_avif_image_webp_image_apng___q0.8_application_signed_exchange_vb3_q0.7_r_nAccept_Language:_ru_RU_ru_q0.9_en_US_q0.8_en_q0.7_r_nDnt:_1_r_nSec_Ch_Ua:__Chromium__v_117____Not_ABrand__v_8__r_nSec_Ch_Ua_Mobile:__0_r_nSec_Ch_Ua_Platform:__Windows__r_nSec_Fetch_Dest:_document_r_nSec_Fetch_Mode:_navigate_r_nSec_Fetch_Site:_none_r_nSec_Fetch_User:__1_r_nUpgrade_Insecure_Requests:_1_r_nUser_Agent:_Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_117.0.0.0_Safari_537.36_r_nCookie:
push 1
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov ecx, 0xffffffff
sub eax, eax
mov edx, dword [esp + 0x40]
repne scasb al, byte es:[edi]
mov eax, dword [edx]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
push eax
push ecx
push edx
call sub.SSLEAY32.dll_Ordinal_108
add esp, 0xc
test eax, eax
jg 0x40188d
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x18
ret
lea eax, [esp + 0x14]
mov ecx, dword [esp + 0x34]
push eax
push ecx
push ebx
call fcn.00401080
lea ecx, [esp + 0x24]
mov edx, dword [esp + 0x20]
add esp, 0xc
push ecx
push edx
push eax
push ebx
call fcn.00401370
lea ecx, [esp + 0x28]
add esp, 0x10
push ecx
push 0
push 0x407238
push eax
push ebx
call fcn.00401000
lea ecx, [esp + 0x2c]
mov edx, dword [esp + 0x58]
add esp, 0x14
mov ebp, dword [edx]
push ecx
push 0
push ebp
push eax
push ebx
call fcn.00401000
add esp, 0x14
mov edi, eax
mov byte [esi], 0
lea eax, [esp + 0x10]
push eax
push 0
push str.GET__sdc_fromhttps_3A_2F_2Fe.mail.ru_2Fmessages_2Finbox_3Fauthid_3D
push esi
push ebx
call fcn.00401000
lea ecx, [esp + 0x24]
mov edx, dword [esp + 0x5c]
add esp, 0x14
mov ebp, dword [edx]
push ecx
push 0
push ebp
push eax
push ebx
call fcn.00401000
lea ecx, [esp + 0x24]
add esp, 0x14
push ecx
push 0
push str._26back_3D1_26dwhsplit_3Ds10273.b1ss12743s_26from_3Dlogin_26x_login_auth_3D1_26back_3D1_HTTP_1.1_r_nHost:_auth.mail.ru_r_nAccept:_text_html_application_xhtmlxml_application_xml_q0.9_image_avif_image_webp_image_apng___q0.8_application_signed_exchange_vb3_q0.7_r_nAccept_Language:_ru_RU_ru_q0.9_en_US_q0.8_en_q0.7_r_nConnection:_keep_alive_r_nDnt:_1_r_nReferer:_https:__account.mail.ru__r_nCache_Control:_max_age0_r_nSec_Ch_Ua:__Chromium__v_117____Not_ABrand__v_8__r_nSec_Ch_Ua_Mobile:__0_r_nSec_Ch_Ua_Platform:__Windows__r_nSec_Ch_Ua_Full_Version:__117.0.5938.11__r_nSec_Ch_Ua_Full_Version_List:__Chromium__v_117.0.5938.11____Not_ABrand__v_8.0.0.0__r_nSec_Ch_Ua_Platform_Version:__15.0.0__r_nSec_Fetch_Dest:_document_r_nSec_Fetch_Mode:_navigate_r_nSec_Fetch_Site:_same_site_r_nSec_Fetch_User:__1_r_nUpgrade_Insecure_Requests:_1_r_nUser_Agent:_Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_117.0.0.0_Safari_537.36_r_nCookie:
push eax
push ebx
call fcn.00401000
add esp, 0x14
lea ecx, [esp + 0x10]
push ecx
push 0
push edi
push eax
push ebx
call fcn.00401000
lea ecx, [esp + 0x24]
add esp, 0x14
push ecx
push 0
push str._r_n_r_n
push eax
push ebx
call fcn.00401000
mov esi, dword [esp + 0x64]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x38]
add esp, 0x14
push eax
push ecx
push esi
call sub.SSLEAY32.dll_Ordinal_108
add esp, 0xc
test eax, eax
jg 0x40197c
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x18
ret
lea eax, [esp + 0x14]
push eax
push esi
push ebx
call fcn.00401080
mov dword [esp + 0x28], eax
add esp, 0xc
push str.token
push eax
call fcn.0040253c
add esp, 8
test eax, eax
jne 0x4019c6
mov eax, dword [esp + 0x1c]
push 0
push 0x407d94
push eax
mov byte [eax + 0x190], 0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x18
ret
sub eax, dword [esp + 0x1c]
lea esi, [eax + 6]
mov ebp, esi
cmp dword [esp + 0x14], esi
jbe 0x4019e7
mov eax, dword [esp + 0x1c]
cmp byte [ebp + eax], 0x26
je 0x4019e7
inc ebp
cmp dword [esp + 0x14], ebp
ja 0x4019d5
cmp dword [esp + 0x14], ebp
jne 0x4019f7
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x18
ret
sub ebp, esi
lea eax, [ebp + 1]
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
add esi, dword [esp + 0x1c]
mov edi, eax
mov ecx, ebp
mov dword [esp + 0x20], eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x18]
push ecx
mov byte [eax + ebp], 0
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebx
call fcn.00401370
lea ecx, [esp + 0x28]
add esp, 0x10
push ecx
push 0
push 0x407238
push eax
push ebx
call fcn.00401000
lea ecx, [esp + 0x2c]
mov edx, dword [esp + 0x58]
add esp, 0x14
mov ebp, dword [edx]
push ecx
push 0
push ebp
push eax
push ebx
call fcn.00401000
lea ecx, [esp + 0x24]
add esp, 0x14
mov esi, eax
mov eax, dword [esp + 0x24]
push ecx
push 0
push str.GET__sdc_token
mov byte [eax], 0
push eax
push ebx
call fcn.00401000
lea ecx, [esp + 0x24]
add esp, 0x14
push ecx
push 0
mov edx, dword [esp + 0x28]
push edx
push eax
push ebx
call fcn.00401000
lea ecx, [esp + 0x24]
add esp, 0x14
push ecx
push 0
push str.fromhttps_3A_2F_2Fe.mail.ru_2Fmessages_2Finbox_3Fauthid_3D
push eax
push ebx
call fcn.00401000
lea ecx, [esp + 0x24]
mov edx, dword [esp + 0x5c]
add esp, 0x14
mov ebp, dword [edx]
push ecx
push 0
push ebp
push eax
push ebx
call fcn.00401000
lea ecx, [esp + 0x24]
add esp, 0x14
push ecx
push 0
push str._26back_3D1_26dwhsplit_3Ds10273.b1ss12743s_26from_3Dlogin_26x_login_auth_3D1_26back_3D1_HTTP_1.1_r_nHost:_e.mail.ru_r_nAccept:_text_html_application_xhtmlxml_application_xml_q0.9_image_avif_image_webp_image_apng___q0.8_application_signed_exchange_vb3_q0.7_r_nAccept_Language:_ru_RU_ru_q0.9_en_US_q0.8_en_q0.7_r_nConnection:_keep_alive_r_nReferer:_https:__account.mail.ru_r_nCache_Control:_max_age0_r_nSec_Ch_Ua:__Chromium__v_117____Not_ABrand__v_8__r_nSec_Ch_Ua_Mobile:__0_r_nSec_Ch_Ua_Platform:__Windows__r_nSec_Fetch_Dest:_document_r_nSec_Fetch_Mode:_navigate_r_nSec_Fetch_Site:_none_r_nSec_Fetch_User:__1_r_nUpgrade_Insecure_Requests:_1_r_nUser_Agent:_Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_117.0.0.0_Safari_537.36_r_nCookie:
push eax
push ebx
call fcn.00401000
lea ecx, [esp + 0x24]
add esp, 0x14
push ecx
push 0
push esi
push eax
push ebx
call fcn.00401000
lea ecx, [esp + 0x24]
add esp, 0x14
push ecx
push 0
push str._r_n_r_n
push eax
push ebx
call fcn.00401000
mov ecx, dword [esp + 0x48]
add esp, 0x14
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
push esi
push ecx
call sub.SSLEAY32.dll_Ordinal_108
add esp, 0xc
test eax, eax
jg 0x401b30
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x18
ret
lea eax, [esp + 0x14]
mov ecx, dword [esp + 0x34]
push eax
push ecx
push ebx
call fcn.00401080
lea ecx, [esp + 0x24]
mov edx, dword [esp + 0x20]
add esp, 0xc
push ecx
push edx
push eax
push ebx
call fcn.00401370
lea ecx, [esp + 0x28]
add esp, 0x10
push ecx
push 0
push 0x407238
push eax
push ebx
call fcn.00401000
lea ecx, [esp + 0x2c]
mov edx, dword [esp + 0x58]
add esp, 0x14
mov ebp, dword [edx]
push ecx
push 0
push ebp
push eax
push ebx
call fcn.00401000
add esp, 0x14
mov edi, eax
mov byte [esi], 0
lea eax, [esp + 0x10]
push eax
push 0
push str.GET__messages_inbox_authid
push esi
push ebx
call fcn.00401000
lea ecx, [esp + 0x24]
mov edx, dword [esp + 0x5c]
add esp, 0x14
mov ebp, dword [edx]
push ecx
push 0
push ebp
push eax
push ebx
call fcn.00401000
lea ecx, [esp + 0x24]
add esp, 0x14
push ecx
push 0
push str.back1dwhsplits10273.b1ss12743sfromloginx_login_auth1back1_HTTP_1.1_r_nHost:_e.mail.ru_r_nAccept:_text_html_application_xhtmlxml_application_xml_q0.9_image_avif_image_webp_image_apng___q0.8_application_signed_exchange_vb3_q0.7_r_nAccept_Language:_ru_RU_ru_q0.9_en_US_q0.8_en_q0.7_r_nPriority:_u0__i_r_nReferer:_https:__account.mail.ru_r_nCache_Control:_max_age0_r_nSec_Ch_Ua_Full_Version:__117.0.5938.11__r_nSec_Ch_Ua_Full_Version_List:__Chromium__v_117.0.5938.11____Not_ABrand__v_8.0.0.0__r_nSec_Ch_Ua:__Chromium__v_117____Not_ABrand__v_8__r_nSec_Ch_Ua_Mobile:__0_r_nSec_Ch_Ua_Model:____r_nSec_Ch_Ua_Platform:__Windows__r_nSec_Ch_Ua_Platform_Version:__15.0.0__r_nSec_Fetch_Dest:_document_r_nSec_Fetch_Mode:_navigate_r_nSec_Fetch_Site:_same_site_r_nSec_Fetch_User:__1_r_nUpgrade_Insecure_Requests:_1_r_nUser_Agent:_Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_117.0.0.0_Safari_537.36_r_nCookie:
push eax
push ebx
call fcn.00401000
add esp, 0x14
lea ecx, [esp + 0x10]
push ecx
push 0
push edi
push eax
push ebx
call fcn.00401000
lea ecx, [esp + 0x24]
add esp, 0x14
push ecx
push 0
push str._r_n_r_n
push eax
push ebx
call fcn.00401000
mov ecx, dword [esp + 0x48]
add esp, 0x14
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
push esi
push ecx
call sub.SSLEAY32.dll_Ordinal_108
add esp, 0xc
test eax, eax
jg 0x401c19
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x18
ret
lea eax, [esp + 0x14]
mov ecx, dword [esp + 0x34]
push eax
push ecx
push ebx
call fcn.00401080
lea ecx, [esp + 0x24]
mov edx, dword [esp + 0x20]
add esp, 0xc
push ecx
push edx
push eax
push ebx
call fcn.00401370
lea ecx, [esp + 0x28]
add esp, 0x10
push ecx
push 0
push 0x407238
push eax
push ebx
call fcn.00401000
lea ecx, [esp + 0x2c]
mov edx, dword [esp + 0x58]
add esp, 0x14
mov ebp, dword [edx]
push ecx
push 0
push ebp
push eax
push ebx
call fcn.00401000
add esp, 0x14
mov edi, eax
mov byte [esi], 0
lea eax, [esp + 0x10]
push eax
push 0
push str.GET__home_HTTP_1.1_r_nHost:_cloud.mail.ru_r_nAccept:_text_html_application_xhtmlxml_application_xml_q0.9_image_avif_image_webp_image_apng___q0.8_application_signed_exchange_vb3_q0.7_r_nAccept_Language:_ru_RU_ru_q0.9_en_US_q0.8_en_q0.7_r_nDnt:_1_r_nSec_Ch_Ua:__Chromium__v_117____Not_ABrand__v_8__r_nSec_Ch_Ua_Mobile:__0_r_nSec_Ch_Ua_Platform:__Windows__r_nSec_Fetch_Dest:_document_r_nSec_Fetch_Mode:_navigate_r_nSec_Fetch_Site:_none_r_nSec_Fetch_User:__1_r_nUpgrade_Insecure_Requests:_1_r_nUser_Agent:_Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_117.0.0.0_Safari_537.36_r_nCookie:
push esi
push ebx
call fcn.00401000
lea ecx, [esp + 0x24]
add esp, 0x14
push ecx
push 0
push edi
push eax
push ebx
call fcn.00401000
lea ecx, [esp + 0x24]
add esp, 0x14
push ecx
push 0
push str._r_n_r_n
push eax
push ebx
call fcn.00401000
mov ecx, dword [esp + 0x24]
add esp, 0x14
mov edx, dword [esp + 0x40]
mov ebx, dword [esp + 0x44]
mov dword [edx], ecx
pop ebp
mov dword [ebx], edi
pop edi
pop esi
pop ebx
add esp, 0x18
ret