Function at 0x49b667
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0xe79
sub esp, 0xa4
mov eax, dword [0x624020]
mov dword [ebp - 0x34], eax
mov eax, 0
mov dword [ebp - 0xa0], 0
mov eax, 0xffffffff
mov dword [ebp - 0x9c], 0xffffffff
mov eax, 0
mov dword [ebp - 0x98], 0
mov eax, 0
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x84]
push eax
mov dword [section..data], ebp
call dword [sym.imp.OLEAUT32.DLL_VariantInit]
lea eax, [ebp - 0x94]
push eax
mov dword [section..data], ebp
call dword [sym.imp.OLEAUT32.DLL_VariantInit]
mov eax, 0xb
xchg edx, eax
lea eax, [ebp - 0x84]
mov dword [eax], edx
mov eax, 0
xchg edx, eax
lea eax, [ebp - 0x84]
mov dword [eax + 8], edx
mov eax, dword [ebp + 8]
mov edx, dword [0x61df90]
cmp eax, edx
jne 0x49b727
mov dword [ebp - 0x10], 0x6320e0
mov eax, 0xa
xchg edx, eax
lea eax, [ebp - 0x94]
mov dword [eax], edx
jmp 0x49b91f
mov eax, dword [ebp + 8]
mov edx, dword [0x61df9c]
cmp eax, edx
jne 0x49b74e
mov dword [ebp - 0x10], str.HEAD
mov eax, 0xa
xchg edx, eax
lea eax, [ebp - 0x94]
mov dword [eax], edx
jmp 0x49b91f
xor eax, eax
inc eax
je 0x49b911
mov eax, dword [ebp + 8]
mov edx, dword [0x61df98]
cmp eax, edx
jne 0x49b770
mov dword [ebp - 0x10], str.POST
jmp 0x49b7f4
mov eax, dword [0x6273c0]
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0xc]
mov edx, eax
mov eax, dword [ebp + 8]
shl eax, 4
add eax, edx
sub eax, 0x10
mov dword [ebp - 0x44], eax
push dword [ebp - 0x44]
call fcn.0045079a
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x44]
call fcn.0042fb61
mov eax, 7
xchg edx, eax
lea eax, [ebp - 0x54]
mov dword [eax], edx
mov eax, 0
xchg edx, eax
lea eax, [ebp - 0x54]
mov dword [eax + 4], edx
mov eax, 0
xchg edx, eax
lea eax, [ebp - 0x54]
mov dword [eax + 0xc], edx
lea eax, [ebp - 0x54]
push eax
call fcn.00433261
push eax
mov dword [section..data], ebp
call dword [sym.imp.MSVCRT.DLL__wcsupr]
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, 0
mov edx, dword [ebp + 0x14]
cmp eax, edx
jne 0x49b813
mov eax, 0xa
xchg edx, eax
lea eax, [ebp - 0x94]
mov dword [eax], edx
jmp 0x49b90f
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0x29
jne 0x49b8cf
push dword [ebp + 0x14]
call fcn.0046877c
mov dword [ebp - 0x3c], eax
push dword [ebp + 0x14]
call fcn.0046872c
mov dword [ebp - 0x9c], eax
push dword [ebp - 0x9c]
push 0
push 0x11
mov dword [section..data], ebp
call dword [sym.imp.OLEAUT32.DLL_SafeArrayCreateVector]
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0x98]
push eax
push dword [ebp - 0xa0]
mov dword [section..data], ebp
call dword [sym.imp.OLEAUT32.DLL_SafeArrayAccessData]
push dword [ebp - 0x9c]
push dword [ebp - 0x3c]
push dword [ebp - 0x98]
mov dword [section..data], ebp
call dword [sym.imp.MSVCRT.DLL_memcpy]
add esp, 0xc
push dword [ebp - 0xa0]
mov dword [section..data], ebp
call dword [sym.imp.OLEAUT32.DLL_SafeArrayUnaccessData]
mov eax, 0x2000
or eax, 0x11
mov edx, eax
lea eax, [ebp - 0x94]
mov dword [eax], edx
mov eax, dword [ebp - 0xa0]
xchg edx, eax
lea eax, [ebp - 0x94]
mov dword [eax + 8], edx
jmp 0x49b90f
mov eax, 8
xchg edx, eax
lea eax, [ebp - 0x94]
mov dword [eax], edx
xor eax, eax
push eax
lea eax, [ebp - 0x9c]
push eax
push dword [ebp + 0x14]
call fcn.00433290
push eax
mov dword [section..data], ebp
call dword [sym.imp.OLEAUT32.DLL_SysAllocString]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
xchg edx, eax
lea eax, [ebp - 0x94]
mov dword [eax + 8], edx
jmp 0x49b91f
call 0x49b916
pop eax
push eax
push 0x64
call fcn.00425ba9
mov dword [ebp - 0x14], 0x6320fc
mov eax, 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x64]
push eax
push str.WinHttp.WinHttpRequest.5.1
mov dword [section..data], ebp
call dword [sym.imp.OLE32.DLL_CLSIDFromProgID]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xb0]
cmp eax, 0
jl 0x49b97d
push dword [ebp - 0x14]
push dword [0x625bc8]
push 1
push 0
lea eax, [ebp - 0x64]
push eax
mov dword [section..data], ebp
call dword [sym.imp.OLE32.DLL_CoCreateInstance]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xb0]
cmp eax, 0
jl 0x49ba33
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x10]
mov dword [section..data], ebp
call dword [sym.imp.OLEAUT32.DLL_SysAllocString]
mov dword [ebp - 0x20], eax
push dword [ebp + 0xc]
call fcn.00433261
push eax
mov dword [section..data], ebp
call dword [sym.imp.OLEAUT32.DLL_SysAllocString]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x84]
mov eax, dword [eax + 0xc]
push eax
lea eax, [ebp - 0x84]
mov eax, dword [eax + 8]
push eax
lea eax, [ebp - 0x84]
mov eax, dword [eax + 4]
push eax
lea eax, [ebp - 0x84]
mov eax, dword [eax]
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov dword [section..data], ebp
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x24]
call eax
mov dword [ebp - 0xb0], eax
push dword [ebp - 0x20]
mov dword [section..data], ebp
call dword [sym.imp.OLEAUT32.DLL_SysFreeString]
push dword [ebp - 0x24]
mov dword [section..data], ebp
call dword [sym.imp.OLEAUT32.DLL_SysFreeString]
mov eax, dword [ebp - 0xb0]
cmp eax, 0
jl 0x49bbb3
mov eax, dword [ebp + 0x10]
cmp eax, 0
je 0x49bb25
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0xc]
xchg edx, eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 4]
xchg edx, eax
xchg edx, eax
shl eax, 4
add eax, edx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x30], eax
jmp 0x49bb15
push dword [ebp - 0x2c]
call fcn.00452058
push eax
call fcn.00433261
push eax
mov dword [section..data], ebp
call dword [sym.imp.OLEAUT32.DLL_SysAllocString]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x2c]
add eax, 0x10
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x2c]
call fcn.00433261
push eax
mov dword [section..data], ebp
call dword [sym.imp.OLEAUT32.DLL_SysAllocString]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x2c]
add eax, 0x10
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov dword [section..data], ebp
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x28]
call eax
push dword [ebp - 0x20]
mov dword [section..data], ebp
call dword [sym.imp.OLEAUT32.DLL_SysFreeString]
push dword [ebp - 0x24]
mov dword [section..data], ebp
call dword [sym.imp.OLEAUT32.DLL_SysFreeString]
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x30]
cmp eax, edx
jb 0x49ba8e
jmp 0x49bb64
push str.application_x_www_form_urlencoded
push str.Content_Type
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.0049b5f5
push str.UTF_8
push str.Accept_Charset
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.0049b5f5
push str.Mozilla_5.0__Windows_NT_6.1__Win64__x64_
push str.User_Agent
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.0049b5f5
lea eax, [ebp - 0x94]
mov eax, dword [eax + 0xc]
push eax
lea eax, [ebp - 0x94]
mov eax, dword [eax + 8]
push eax
lea eax, [ebp - 0x94]
mov eax, dword [eax + 4]
push eax
lea eax, [ebp - 0x94]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov dword [section..data], ebp
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x34]
call eax
mov dword [ebp - 0xb0], eax
jmp 0x49bbbb
mov eax, dword [ebp - 0x34]
jmp 0x49be9a
mov eax, 0
mov edx, dword [ebp - 0xa0]
cmp eax, edx
sete al
xor ah, ah
cwde
xor al, 1
cmp eax, 0
je 0x49bbe9
push dword [ebp - 0xa0]
mov dword [section..data], ebp
call dword [sym.imp.OLEAUT32.DLL_SafeArrayDestroy]
mov eax, dword [ebp - 0xb0]
cmp eax, 0
jl 0x49bce5
mov eax, dword [ebp + 0x20]
cmp eax, 0
je 0x49bca8
push 3
call fcn.00443817
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x9c]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov dword [section..data], ebp
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x38]
call eax
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xb0]
cmp eax, 0
jl 0x49bc75
push dword [ebp - 0x9c]
push dword [ebp - 0x38]
call fcn.0044f7ab
lea eax, [ebp - 0x98]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov dword [section..data], ebp
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x30]
call eax
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xb0]
cmp eax, 0
jl 0x49bca8
push dword [ebp - 0x98]
call fcn.0049b433
push eax
push dword [ebp - 0x38]
call fcn.00442d21
push dword [ebp - 0x98]
mov dword [section..data], ebp
call dword [sym.imp.OLEAUT32.DLL_SysFreeString]
mov eax, dword [ebp - 0x1c]
cmp eax, 0
je 0x49bcc1
push dword [ebp - 0x1c]
mov dword [section..data], ebp
call dword [sym.imp.OLEAUT32.DLL_SysFreeString]
lea eax, [ebp - 0x94]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov dword [section..data], ebp
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x44]
call eax
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xb0]
cmp eax, 0
jl 0x49be76
lea eax, [ebp - 0x94]
mov eax, dword [eax + 8]
mov dword [ebp - 0xac], eax
mov eax, 0x2000
or eax, 0x11
push eax
pop edx
xchg edx, eax
lea eax, [ebp - 0x94]
mov eax, dword [eax]
xchg edx, eax
cmp eax, edx
jne 0x49bd41
push dword [ebp - 0xac]
mov dword [section..data], ebp
call dword [sym.imp.OLEAUT32.DLL_SafeArrayGetDim]
mov edx, eax
mov eax, 1
cmp eax, edx
jne 0x49bd41
jmp 0x49bd45
xor eax, eax
jmp 0x49bd48
xor eax, eax
inc eax
cmp eax, 0
je 0x49be35
mov eax, 0
mov dword [ebp - 0xa4], 0
mov eax, 0
mov dword [ebp - 0xa8], 0
lea eax, [ebp - 0xa4]
push eax
push 1
push dword [ebp - 0xac]
mov dword [section..data], ebp
call dword [sym.imp.OLEAUT32.DLL_SafeArrayGetLBound]
lea eax, [ebp - 0xa8]
push eax
push 1
push dword [ebp - 0xac]
mov dword [section..data], ebp
call dword [sym.imp.OLEAUT32.DLL_SafeArrayGetUBound]
lea eax, [ebp - 0x98]
push eax
push dword [ebp - 0xac]
mov dword [section..data], ebp
call dword [sym.imp.OLEAUT32.DLL_SafeArrayAccessData]
mov eax, dword [ebp - 0xa8]
mov edx, dword [ebp - 0xa4]
sub eax, edx
inc eax
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp + 0x18]
cmp eax, 0
je 0x49bdf2
push dword [ebp - 0x9c]
push dword [ebp - 0x98]
call fcn.0046a22e
jmp 0x49be20
mov eax, dword [ebp + 0x1c]
cmp eax, 0
je 0x49be0f
push dword [ebp - 0x9c]
push dword [ebp - 0x98]
call fcn.0049a4f1
jmp 0x49be20
push dword [ebp - 0x9c]
push dword [ebp - 0x98]
call fcn.0049a211
mov dword [ebp - 0x34], eax
push dword [ebp - 0xac]
mov dword [section..data], ebp
call dword [sym.imp.OLEAUT32.DLL_SafeArrayUnaccessData]
lea eax, [ebp - 0x94]
mov eax, dword [eax]
and eax, 0x2000
cmp eax, 0
jle 0x49be5b
push dword [ebp - 0xac]
mov dword [section..data], ebp
call dword [sym.imp.OLEAUT32.DLL_SafeArrayDestroy]
mov eax, dword [ebp + 0x20]
cmp eax, 0
je 0x49be76
push dword [ebp - 0x34]
push dword [ebp - 0x38]
call fcn.00442d21
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
cmp eax, 0
je 0x49be97
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov dword [section..data], ebp
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 8]
call eax
mov eax, dword [ebp - 0x34]
leave
ret 0x1c