Function at 0x4147d0
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x987c
call fcn.00444240
mov eax, dword [0x4c8578]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
mov edi, dword [ebp + 0x1c]
mov ebx, ecx
mov dword [ebp - 0x987c], eax
mov eax, dword [ebp + 0x18]
push 0x400
mov dword [ebp - 0x9870], eax
lea eax, [ebp - 0x1a68]
push 0
push eax
mov dword [ebp - 0x9874], ebx
mov dword [ebp - 0x986c], edi
call fcn.00446b20
push 5
lea eax, [ebp - 0xc]
mov dword [ebp - 0x54], 0
push eax
push dword [ebx + 0x2cab4]
xorps xmm0, xmm0
movups xmmword [ebp - 0x74], xmm0
movups xmmword [ebp - 0x64], xmm0
call fcn.00454128
mov ecx, ebx
add esp, 0x18
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x414850
sub ecx, edx
je 0x41539f
push esi
lea eax, [ebx + 0x3e3c]
mov dword [ebp - 0x9878], 0x46c510
push eax
push 0x46fc48
push 0x3ff
lea esi, [ebx + 0x3a3c]
push 0x400
push esi
call fcn.00407cf0
push dword [ebp - 0x987c]
lea eax, [ebp - 0x3c68]
push 0x46fc5c
push 0x400
push eax
call fcn.00419d30
lea eax, [ebp - 0x3c68]
push eax
lea eax, [ebp - 0x4468]
push 0x400
push eax
call fcn.00452e14
add esp, 0x30
lea eax, [ebp - 0x1a68]
mov ecx, 0x53f400
push eax
lea eax, [ebp - 0x4468]
push eax
call fcn.00440d30
mov eax, dword [ebp - 0x9870]
test eax, eax
je 0x414953
push eax
push 0x46fc7c
lea eax, [ebp - 0x7868]
push 0x800
push eax
call fcn.00419d30
lea eax, [ebp - 0x7868]
push eax
lea eax, [ebp - 0x8868]
push 0x800
push eax
call fcn.00452e14
add esp, 0x1c
lea eax, [ebp - 0x4c68]
mov ecx, 0x53f400
push eax
lea eax, [ebp - 0x8868]
push eax
call fcn.00440d30
lea eax, [ebp - 0x4c68]
push eax
lea eax, [ebp - 0x1a68]
push eax
lea eax, [ebp - 0x3468]
push 0x46fca8
push eax
call fcn.0040c780
add esp, 0x10
jmp 0x41496e
lea eax, [ebp - 0x1a68]
push eax
lea eax, [ebp - 0x3468]
push 0x46c878
push eax
call fcn.0040c780
add esp, 0xc
test edi, edi
je 0x414aa3
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414980
mov esi, dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
sub ecx, edx
push 0
push 0
push 0
push 0
sar ecx, 1
push ecx
push edi
push 0
push 0xfde9
call esi
mov edi, eax
push edi
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
push 0
push 0
push edi
mov ebx, eax
push ebx
push 0xffffffffffffffff
push dword [ebp - 0x986c]
push 0
push 0xfde9
call esi
lea eax, [edi + edi*2]
push eax
push 1
call fcn.00449ef9
mov esi, dword [ebp - 0x9874]
add esp, 8
mov ecx, esi
push ebx
mov dword [esi + 0x2cdf4], eax
call fcn.00411220
mov ebx, dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
push 0
push 0
push 0xffffffffffffffff
push dword [esi + 0x2cdf4]
push 0
push 0xfde9
call ebx
mov esi, eax
lea ecx, [esi*2 + 2]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
push esi
mov edi, eax
mov eax, dword [ebp - 0x9874]
push edi
push 0xffffffffffffffff
push dword [eax + 0x2cdf4]
push 0
push 0xfde9
call ebx
push edi
push 0x4706b0
lea eax, [ebp - 0x9868]
push 0x800
push eax
call fcn.00419d30
mov ebx, dword [ebp - 0x9874]
push dword [ebx + 0x2cdf4]
call fcn.00449f04
add esp, 0x14
lea eax, [ebp - 0x5468]
mov ecx, 0x53f400
push eax
lea eax, [ebp - 0x9868]
push eax
call fcn.00440d30
lea eax, [ebp - 0x5468]
push eax
lea eax, [ebp - 0x3468]
push eax
push 0x46fca8
lea eax, [ebp - 0x6868]
push eax
call fcn.0040c780
add esp, 0x10
lea esi, [ebx + 0x3a3c]
jmp 0x414abe
lea eax, [ebp - 0x3468]
push eax
lea eax, [ebp - 0x6868]
push 0x46c878
push eax
call fcn.0040c780
add esp, 0xc
push dword [ebp + 0x14]
lea eax, [ebp - 0x204]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0x46fcb0
push 0xc7
push 0xc8
push eax
call fcn.00407cf0
lea eax, [ebx + 0x423c]
push eax
lea eax, [ebp - 0x2068]
push 0x400
push eax
call fcn.00449d78
lea eax, [ebp - 0x2068]
push 0x400
push eax
call fcn.00453ddb
push 0x400
push 1
call fcn.00449ef9
mov edi, eax
lea eax, [ebp - 0x2068]
push eax
push 0x3ff
push 0x400
push edi
call fcn.00407cf0
add esp, 0x48
lea edx, [ebx + 0x4c94]
cmp dword [ebx + 0x4ac], 0
je 0x414c17
push edi
lea eax, [ebp - 0x2468]
push 0x400
push eax
call fcn.00407d30
add esp, 0xc
lea eax, [ebp - 0x268]
mov ecx, 0x53f400
push 0x64
push eax
push 0x46f9cc
push 0x46f9d0
lea eax, [ebp - 0x2468]
push eax
call fcn.00440660
lea eax, [ebp - 0x268]
push eax
push 0x46ceb4
lea eax, [ebp - 0x13c]
push 0x64
push eax
call fcn.00407d30
lea eax, [ebx + 0x4c94]
push eax
push 0x46ceb4
lea eax, [ebp - 0xd8]
push 0x64
push eax
call fcn.00407d30
lea edx, [ebp - 0xd8]
add esp, 0x20
lea ecx, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x414bc0
sub edx, ecx
lea ecx, [ebp - 0x13c]
lea eax, [ecx + 1]
mov dword [ebp - 0x986c], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x414bd8
sub ecx, dword [ebp - 0x986c]
lea eax, [ebp - 0xd8]
push 0x400
push edi
push edx
push eax
push ecx
lea eax, [ebp - 0x13c]
mov ecx, 0x53f400
push eax
push 0x400
lea eax, [ebp - 0x2468]
push eax
call fcn.00440850
lea edx, [ebx + 0x4c94]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x986c], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x414c22
sub ecx, dword [ebp - 0x986c]
push 0x400
push edi
push ecx
push edx
push 0xf
push 0x46d4e4
push 0x400
push edi
mov ecx, 0x53f400
call fcn.00440850
lea eax, [ebx + 0x4c94]
push eax
push dword [0x502db0]
call fcn.004403a0
lea edx, [ebx + 0x4c30]
add esp, 8
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x986c], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x414c74
sub ecx, dword [ebp - 0x986c]
push 0x400
push edi
push ecx
push edx
push 0x13
push 0x46d4f4
push 0x400
push edi
mov ecx, 0x53f400
call fcn.00440850
lea edx, [ebx + 0x4bcc]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x986c], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x414cb1
sub ecx, dword [ebp - 0x986c]
push 0x400
push edi
push ecx
push edx
push 0x13
push 0x46d51c
push 0x400
push edi
mov ecx, 0x53f400
call fcn.00440850
lea edx, [ebx + 0x4b68]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x986c], eax
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x414cf0
sub ecx, dword [ebp - 0x986c]
push 0x400
push edi
push ecx
push edx
push 0x11
push 0x46d508
push 0x400
push edi
mov ecx, 0x53f400
call fcn.00440850
push 0x46fcdc
push edi
call fcn.00446c80
add esp, 8
test eax, eax
jne 0x414d4d
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x414d33
push 0x400
push edi
sub ecx, edx
push ecx
push esi
push 0x1a
push str.agentidentifierWINCSECB
jmp 0x414d7c
push str.wincaltsecb_
push edi
call fcn.00446c80
add esp, 8
test eax, eax
jne 0x414d8c
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x414d64
push 0x400
push edi
sub ecx, edx
push ecx
push esi
push 0x1b
push str.agentidentifierwincaltsecb
push 0x400
push edi
mov ecx, 0x53f400
call fcn.00440850
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x414d91
push 0x400
push edi
sub ecx, edx
push ecx
push esi
push 0x17
push 0x46fd30
push 0x400
push edi
mov ecx, 0x53f400
call fcn.00440850
push 0x400
push edi
push 1
push 0x46c510
push 0x16
push 0x46fd48
push 0x400
push edi
mov ecx, 0x53f400
call fcn.00440850
push 0x400
push edi
push 1
push 0x46c510
push 0x12
push 0x46fd60
push 0x400
push edi
mov ecx, 0x53f400
call fcn.00440850
push 0x400
push edi
push 1
push 0x46c510
push 0x13
push 0x46fd74
push 0x400
push edi
mov ecx, 0x53f400
call fcn.00440850
push 0x46fd88
push 0x400
push edi
call fcn.00449dd2
lea eax, [ebx + 0x4a3c]
push eax
push 0x400
push edi
call fcn.00449dd2
push 0x46fa14
push 0x400
push edi
call fcn.00449dd2
lea eax, [ebx + 0x4aa0]
push eax
push 0x400
push edi
call fcn.00449dd2
push 0x46fd94
push 0x400
push edi
call fcn.00449dd2
push 0x512a14
push 0x400
push edi
call fcn.00449dd2
add esp, 0x48
push 0x46fda4
push 0x400
push edi
call fcn.00449dd2
lea eax, [ebp - 0x74]
push eax
push 0x400
push edi
call fcn.00449dd2
push 0x46fdac
push 0x400
push edi
call fcn.00449dd2
lea eax, [ebp - 0xc]
push eax
push 0x400
push edi
call fcn.00449dd2
add esp, 0x30
mov ecx, 0x53f400
push 0x400
push edi
push 1
push 0x46c510
push 0x16
push 0x46fdb8
push 0x400
push edi
call fcn.00440850
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x414ef6
sub ecx, edx
push 0x46fdb8
lea eax, [ecx + 0x17]
push eax
push edi
call fcn.00449dd2
push 0x400
push 1
call fcn.00449ef9
mov esi, eax
lea ecx, [ebp - 0x204]
add esp, 0x14
mov dword [ebp - 0x9870], esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x414f30
push 0x400
push esi
sub ecx, edx
lea eax, [ebp - 0x204]
push ecx
push eax
push 0x15
push 0x46fdd0
push 0x400
push edi
mov ecx, 0x53f400
call fcn.00440850
push 0
push 0
push 0x46fde8
push 0x46d560
push esi
push 0x400
lea eax, [ebp - 0x1668]
mov ecx, ebx
push eax
call fcn.00413b00
lea ecx, [ebp - 0x1668]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x414f90
sub ecx, edx
lea edx, [ebp - 0x204]
lea eax, [edx + 1]
mov dword [ebp - 0x986c], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x414fa8
sub edx, dword [ebp - 0x986c]
lea eax, [ebp - 0x204]
push eax
lea eax, [edx + 1]
add eax, ecx
push eax
lea eax, [ebp - 0x1668]
push eax
call fcn.00449dd2
add esp, 0xc
lea eax, [ebp - 0x2868]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1668]
push eax
call fcn.00419c00
lea eax, [ebp - 0x2868]
push eax
push 0x46d564
push 0x1ff
lea eax, [ebp - 0x1c68]
push 0x200
push eax
call fcn.00407cf0
add esp, 0x14
lea eax, [ebp - 0x50]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c68]
push eax
call fcn.004164a0
push esi
lea eax, [ebp - 0xa68]
push 0x400
push eax
call fcn.00449d78
push 4
push 0x46d59c
lea eax, [ebp - 0xa68]
push 0x400
push eax
call fcn.00454896
push 0x29
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0xa68]
push 0x400
push eax
call fcn.00454896
lea eax, [ebp - 0xa68]
push eax
push 0x46fdf4
push dword [0x502db0]
call fcn.004403a0
push 7
lea eax, [ebp - 0xa68]
push 0x46ca84
push eax
call fcn.00452b0a
add esp, 0x44
test eax, eax
jne 0x415196
push 0x400
lea eax, [ebp - 0x1268]
mov ecx, 0x53f400
push eax
push 0x46fe24
push 0x46ca84
lea eax, [ebp - 0xa68]
push eax
call fcn.00440660
lea eax, [ebp - 0x1268]
push eax
push 0x46fe30
push dword [0x502db0]
call fcn.004403a0
add esp, 0xc
lea eax, [ebp - 0x668]
mov ecx, 0x53f400
push 0x400
push eax
lea eax, [ebp - 0x50]
push eax
push 0x46fe24
lea eax, [ebp - 0xa68]
push eax
call fcn.00440660
lea eax, [ebp - 0x668]
push eax
push 0x46fe44
push dword [0x502db0]
call fcn.004403a0
push 0x29
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x668]
push 0x3ff
push eax
call fcn.00454896
lea ecx, [ebp - 0xe68]
add esp, 0x1c
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x415134
sub ecx, edx
push 0x46fe24
lea eax, [ecx + 9]
push eax
lea eax, [ebp - 0xe68]
push 0x400
push eax
call fcn.00407cf0
lea ecx, [ebp - 0x668]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x415163
sub ecx, edx
lea eax, [ebp - 0x668]
push ecx
push eax
lea eax, [ebp - 0xe68]
push 0x400
push eax
call fcn.00454896
lea eax, [ebp - 0xe68]
push eax
push 0x46fe64
jmp 0x4152b2
push 8
lea eax, [ebp - 0xa68]
push 0x46ca8c
push eax
call fcn.00452b0a
add esp, 0xc
test eax, eax
jne 0x4152c0
push 0x400
lea eax, [ebp - 0x1268]
mov ecx, 0x53f400
push eax
push 0x46fe24
push 0x46ca8c
lea eax, [ebp - 0xa68]
push eax
call fcn.00440660
lea eax, [ebp - 0x1268]
push eax
push 0x46fe30
push dword [0x502db0]
call fcn.004403a0
add esp, 0xc
lea eax, [ebp - 0x668]
mov ecx, 0x53f400
push 0x400
push eax
lea eax, [ebp - 0x50]
push eax
push 0x46fe24
lea eax, [ebp - 0xa68]
push eax
call fcn.00440660
lea eax, [ebp - 0x668]
push eax
push 0x46fe44
push dword [0x502db0]
call fcn.004403a0
push 0x29
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x668]
push 0x400
push eax
call fcn.00454896
lea ecx, [ebp - 0xe68]
add esp, 0x1c
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x415255
sub ecx, edx
push 0x46fe24
lea eax, [ecx + 9]
push eax
lea eax, [ebp - 0xe68]
push 0x400
push eax
call fcn.00407cf0
lea ecx, [ebp - 0x668]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x415284
sub ecx, edx
lea eax, [ebp - 0x668]
push ecx
push eax
lea eax, [ebp - 0xe68]
push 0x400
push eax
call fcn.00454896
lea eax, [ebp - 0xe68]
push eax
push 0x46fe88
push dword [0x502db0]
call fcn.004403a0
add esp, 0x1c
lea eax, [ebp - 0x6868]
push eax
push 0x46feac
push dword [0x502db0]
call fcn.004403a0
push 5
lea eax, [ebp - 0x24]
push eax
push dword [0x50a1d4]
call fcn.00454128
push 5
lea eax, [ebp - 0x14]
push eax
push dword [0x50add8]
call fcn.00454128
push 5
lea eax, [ebp - 0x1c]
push eax
push dword [0x50addc]
call fcn.00454128
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x503f78
push 0x511810
push 0x49608c
push 0x512a14
push 0x503b78
lea esi, [ebx + 0x9e68]
push 0x46fec8
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x58
lea eax, [ebp - 0x9878]
mov ecx, ebx
push eax
lea eax, [ebp - 0x6868]
push eax
lea eax, [ebp - 0xe68]
push eax
push 0x46ff3c
lea eax, [ebp - 0x1268]
push eax
push esi
call fcn.004197d0
pop esi
test eax, eax
je 0x415379
push 0x46ff6c
jmp 0x41537e
push 0x46ff88
push dword [0x502db0]
call fcn.004403a0
add esp, 8
push edi
call fcn.00449f04
push dword [ebp - 0x9870]
call fcn.00449f04
jmp 0x4153af
push 0x46ffa8
push dword [0x502db0]
call fcn.004403a0
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
xor eax, eax
pop edi
pop ebx
call fcn.00443fa5
mov esp, ebp
pop ebp
ret 0x18