Function at 0x4347c3
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 4], 0
push 0x10
call fcn.004695d4
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebx], 0x568705
push ebx
add ebx, 4
push ebx
push 8
call fcn.004695d4
add esp, 4
pop ebx
push ebx
mov dword [ebx], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
pop ebx
add ebx, 4
push ebx
push 8
call fcn.004695d4
add esp, 4
pop ebx
push ebx
mov dword [ebx], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
pop ebx
add ebx, 4
push ebx
push 0x10
call fcn.004695d4
add esp, 4
pop ebx
push ebx
mov dword [ebx], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov eax, 3
mov dword [ebx], eax
pop ebx
pop ebx
push ebx
mov eax, esp
push eax
call fcn.0042c50b
pop ebx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
push 1
push 1
push 1
push 1
push dword [ebp + 8]
call fcn.0041f518
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push str.http:__ip.yqie.com_vip_search.aspx_searchword
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x4348e5
push ebx
call fcn.004695da
add esp, 4
mov dword [ebp - 0x1c], 0
push 0
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0
push 0
push dword [ebp - 0x20]
mov dword [ebp - 0x24], 0
push 0
push dword [ebp - 0x24]
push 8
call fcn.004695d4
add esp, 4
mov dword [ebp - 0x28], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x2c], 0
push 0
push dword [ebp - 0x2c]
mov dword [ebp - 0x30], 0
push 0
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x34], 0
push 0
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x38], 0
push 0
push dword [ebp - 0x38]
mov dword [ebp - 0x3c], 0
push 0
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x40], 0
push 0
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x44], 0
push 0
push dword [ebp - 0x44]
mov dword [ebp - 0x48], 0
push 0
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x4c], 0
push 0
lea eax, [ebp - 0x4c]
push eax
push 1
mov eax, str.Host:_ip.yqie.com_r_nConnection:_keep_alive_r_nUpgrade_Insecure_Requests:_1_r_nUser_Agent:_Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_87.0.4280.88_Safari_537.36_r_nAccept:_text_html_application_xhtmlxml_application_xml_q0.9_image_avif_image_webp_image_apng___q0.8_application_signed_exchange_vb3_q0.9_r_nReferer:_http:__ip.yqie.com_vip_search.aspx_searchword_E5_8D_97_E9_80_9A_r_nAccept_Language:_zh_CN_zh_q0.9
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x54], 0
push 0
lea eax, [ebp - 0x54]
push eax
push 1
mov eax, str.__gadsID8888b0a949357baa_221f65094ec5004f:T1608626722:RT1608626722:SALNI_MaeoCc9YFc0YfIy4q8hy0au59KOIQ__ASP.NET_SessionIdnpvg4jy1wjxxein1xjdvki0l__Hm_lvt_b81c736a1ec124f39d83f7a0ef3c31aa1608626721_1609550233__CheckCode03265__.ASPXAUTH0D51D303B2EA1DB22D9682A92277D4B4087E7A20F2376F60AD5C0A9E0C8ECD53C52AB3F89700D57F2B682A0E66E8EF07984D500692A0DD38B62A18765798E2B7B4748009B6F79957239B5D351E4C3CD295B5552925E69A90E6C56459D429AC5A81929C03712DCFD6C891307ADBEA28B513FC4CD1__Hm_lpvt_b81c736a1ec124f39d83f7a0ef3c31aa1609550761
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x58]
push eax
mov dword [ebp - 0x5c], 0
push 0
lea eax, [ebp - 0x5c]
push eax
push 1
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0041fde4
mov dword [ebp - 0x60], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x4349f9
push ebx
call fcn.004695da
add esp, 4
mov ebx, dword [ebp - 0x5c]
test ebx, ebx
je 0x434a09
push ebx
call fcn.004695da
add esp, 4
mov ebx, dword [ebp - 0x58]
test ebx, ebx
je 0x434a19
push ebx
call fcn.004695da
add esp, 4
mov ebx, dword [ebp - 0x54]
test ebx, ebx
je 0x434a29
push ebx
call fcn.004695da
add esp, 4
mov ebx, dword [ebp - 0x50]
test ebx, ebx
je 0x434a39
push ebx
call fcn.004695da
add esp, 4
mov ebx, dword [ebp - 0x4c]
test ebx, ebx
je 0x434a49
push ebx
call fcn.004695da
add esp, 4
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x434a59
push ebx
call fcn.004695da
add esp, 4
mov ebx, dword [ebp - 0x3c]
test ebx, ebx
je 0x434a69
push ebx
call fcn.004695da
add esp, 4
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x434a79
push ebx
call fcn.004695da
add esp, 4
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x434a89
push ebx
call fcn.004695da
add esp, 4
mov ebx, dword [ebp - 0x28]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x46ebf0
call fcn.004695ec
add esp, 0x10
call fcn.004695da
add esp, 4
push reloc.WS2_32.dll_getpeername
push 0
mov eax, dword [ebp - 0x60]
test eax, eax
jne 0x434abf
mov eax, 0x5513f4
push eax
push 1
mov ebx, 0x46bbf0
call fcn.004695ec
add esp, 0x10
mov dword [ebp - 0x64], eax
mov ebx, dword [ebp - 0x60]
test ebx, ebx
je 0x434ae5
push ebx
call fcn.004695da
add esp, 4
push 1
push 1
lea eax, [ebp - 0x64]
push eax
call fcn.0042409c
mov dword [ebp - 0x68], eax
mov ebx, dword [ebp - 0x64]
test ebx, ebx
je 0x434b08
push ebx
call fcn.004695da
add esp, 4
mov eax, dword [ebp - 0x68]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x434b1c
push ebx
call fcn.004695da
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 1
push 1
push 1
push 1
push 1
push 0
push 1
push 0
lea eax, [ebp - 4]
push eax
mov eax, str.d.d.d.d
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x434b6d
push ebx
call fcn.004695da
add esp, 4
cmp dword [ebp - 0x18], 1
jne 0x434c2a
lea eax, [ebp - 8]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x18]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x434c1b
mov dword [ebp - 0x14], 0
push 0
push dword [ebp - 0x14]
push dword [ebp - 0xc]
push 1
call fcn.00434c5c
mov dword [ebp - 0x18], eax
push VariantClear
push 0
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x434bc1
mov eax, 0x5513aa
push eax
push 1
mov ebx, 0x46a810
call fcn.004695ec
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x434be7
push ebx
call fcn.004695da
add esp, 4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
jmp 0x434c34
mov eax, 0x5513aa
jmp 0x434c34
mov eax, 0x5513aa
jmp 0x434c34
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x434c45
push ebx
call fcn.004695da
add esp, 4
mov ebx, dword [ebp - 8]
push ebx
mov eax, dword [ebx]
call dword [eax]
call fcn.004695da
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4