Function at 0x10002f67
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.100623a9
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebp - 0x10], 0
push 8
call fcn.100623a9
add esp, 4
mov dword [ebp - 0x14], eax
mov edi, eax
mov esi, 0x100f3f5c
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
push 0x10
call fcn.100623a9
add esp, 4
mov dword [ebp - 0x28], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov eax, 3
mov dword [ebx], eax
mov dword [ebp - 0x2c], 0
push 8
call fcn.100623a9
add esp, 4
mov dword [ebp - 0x30], eax
mov edi, eax
mov esi, 0x100f3f5c
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
cmp dword [ebp + 0x30], 0
mov eax, 0
sete al
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x1000307d
mov ebx, dword [ebp + 0x2c]
mov eax, dword [ebx]
test eax, eax
je 0x10003068
push eax
mov ebx, eax
call fcn.10002d8c
inc eax
push eax
call fcn.100623a9
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10003079
push ebx
call fcn.100623af
add esp, 4
pop eax
mov dword [ebp - 4], eax
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10003090
mov eax, 0x100f348f
push eax
push 1
mov ebx, 0x10062890
call fcn.100623c1
add esp, 0x10
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x100030ec
push str._r_nAccept_Language:zh_cn_r_nUser_Agent:_Mozilla_5.0__Windows_NT_6.1__WOW64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_50.0.2661.87_Safari_537.36_r_nContent_Type:application_x_www_form_urlencoded
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.Accept:__r_nReferer:
mov ecx, 3
call fcn.10002df7
add esp, 0xc
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100030e3
push ebx
call fcn.100623af
add esp, 4
pop eax
mov dword [ebp - 4], eax
jmp 0x10003493
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x100030ff
mov eax, 0x100f348f
push eax
push 1
mov ebx, 0x10062db0
call fcn.100623c1
add esp, 0x10
mov dword [ebp - 0x34], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push VariantClear
push 0
push str.accept
push VariantClear
push 0
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x10003146
mov eax, 0x100f348f
push eax
push 4
mov ebx, 0x10062be0
call fcn.100623c1
add esp, 0x34
mov dword [ebp - 0x38], eax
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x1000316c
push ebx
call fcn.100623af
add esp, 4
cmp dword [ebp - 0x38], 0xffffffff
jne 0x100031a6
push str._r_nAccept:__
push dword [ebp - 4]
mov ecx, 2
call fcn.10002df7
add esp, 8
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100031a2
push ebx
call fcn.100623af
add esp, 4
pop eax
mov dword [ebp - 4], eax
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x100031b9
mov eax, 0x100f348f
push eax
push 1
mov ebx, 0x10062db0
call fcn.100623c1
add esp, 0x10
mov dword [ebp - 0x34], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push VariantClear
push 0
push str.referer
push VariantClear
push 0
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x10003200
mov eax, 0x100f348f
push eax
push 4
mov ebx, 0x10062be0
call fcn.100623c1
add esp, 0x34
mov dword [ebp - 0x38], eax
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x10003226
push ebx
call fcn.100623af
add esp, 4
cmp dword [ebp - 0x38], 0xffffffff
jne 0x10003265
mov ebx, dword [ebp + 8]
push dword [ebx]
push str._r_nReferer:
push dword [ebp - 4]
mov ecx, 3
call fcn.10002df7
add esp, 0xc
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10003261
push ebx
call fcn.100623af
add esp, 4
pop eax
mov dword [ebp - 4], eax
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10003278
mov eax, 0x100f348f
push eax
push 1
mov ebx, 0x10062db0
call fcn.100623c1
add esp, 0x10
mov dword [ebp - 0x34], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push VariantClear
push 0
push str.accept_language
push VariantClear
push 0
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x100032bf
mov eax, 0x100f348f
push eax
push 4
mov ebx, 0x10062be0
call fcn.100623c1
add esp, 0x34
mov dword [ebp - 0x38], eax
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x100032e5
push ebx
call fcn.100623af
add esp, 4
cmp dword [ebp - 0x38], 0xffffffff
jne 0x1000331f
push str._r_nAccept_Language:_zh_cn
push dword [ebp - 4]
mov ecx, 2
call fcn.10002df7
add esp, 8
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1000331b
push ebx
call fcn.100623af
add esp, 4
pop eax
mov dword [ebp - 4], eax
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10003332
mov eax, 0x100f348f
push eax
push 1
mov ebx, 0x10062db0
call fcn.100623c1
add esp, 0x10
mov dword [ebp - 0x34], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push VariantClear
push 0
push str.user_agent
push VariantClear
push 0
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x10003379
mov eax, 0x100f348f
push eax
push 4
mov ebx, 0x10062be0
call fcn.100623c1
add esp, 0x34
mov dword [ebp - 0x38], eax
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x1000339f
push ebx
call fcn.100623af
add esp, 4
cmp dword [ebp - 0x38], 0xffffffff
jne 0x100033d9
push str._r_nUser_Agent:_Mozilla_5.0__Windows_NT_6.1__WOW64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_50.0.2661.87_Safari_537.36
push dword [ebp - 4]
mov ecx, 2
call fcn.10002df7
add esp, 8
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100033d5
push ebx
call fcn.100623af
add esp, 4
pop eax
mov dword [ebp - 4], eax
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x100033ec
mov eax, 0x100f348f
push eax
push 1
mov ebx, 0x10062db0
call fcn.100623c1
add esp, 0x10
mov dword [ebp - 0x34], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push VariantClear
push 0
push str.content_type
push VariantClear
push 0
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x10003433
mov eax, 0x100f348f
push eax
push 4
mov ebx, 0x10062be0
call fcn.100623c1
add esp, 0x34
mov dword [ebp - 0x38], eax
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x10003459
push ebx
call fcn.100623af
add esp, 4
cmp dword [ebp - 0x38], 0xffffffff
jne 0x10003493
push str._r_nContent_Type:_application_x_www_form_urlencoded
push dword [ebp - 4]
mov ecx, 2
call fcn.10002df7
add esp, 8
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1000348f
push ebx
call fcn.100623af
add esp, 4
pop eax
mov dword [ebp - 4], eax
cmp dword [ebp + 0x60], 0
mov eax, 0
sete al
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x100036c4
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push VariantClear
push 0
push str.X_Forwarded_For
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x100034dd
mov eax, 0x100f348f
push eax
push 4
mov ebx, 0x10062be0
call fcn.100623c1
add esp, 0x34
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffff
jne 0x10003532
mov ebx, dword [ebp + 0x5c]
push dword [ebx]
push str._r_nX_Forwarded_For:
push dword [ebp - 4]
mov ecx, 3
call fcn.10002df7
add esp, 0xc
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1000352e
push ebx
call fcn.100623af
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push VariantClear
push 0
push str.CLIENT_IP
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10003563
mov eax, 0x100f348f
push eax
push 4
mov ebx, 0x10062be0
call fcn.100623c1
add esp, 0x34
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffff
jne 0x100035b8
mov ebx, dword [ebp + 0x5c]
push dword [ebx]
push str._r_nCLIENT_IP:
push dword [ebp - 4]
mov ecx, 3
call fcn.10002df7
add esp, 0xc
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100035b4
push ebx
call fcn.100623af
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push VariantClear
push 0
push 0x100f3ec2
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x100035e9
mov eax, 0x100f348f
push eax
push 4
mov ebx, 0x10062be0
call fcn.100623c1
add esp, 0x34
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffff
jne 0x1000363e
mov ebx, dword [ebp + 0x5c]
push dword [ebx]
push str._r_nVIA:
push dword [ebp - 4]
mov ecx, 3
call fcn.10002df7
add esp, 0xc
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1000363a
push ebx
call fcn.100623af
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push 0
push 0
push 0
push VariantClear
push 0
push str.REMOTE_ADDR
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x1000366f
mov eax, 0x100f348f
push eax
push 4
mov ebx, 0x10062be0
call fcn.100623c1
add esp, 0x34
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffff
jne 0x100036c4
mov ebx, dword [ebp + 0x5c]
push dword [ebx]
push str._r_nREMOTE_ADDR:
push dword [ebp - 4]
mov ecx, 3
call fcn.10002df7
add esp, 0xc
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100036c0
push ebx
call fcn.100623af
add esp, 4
pop eax
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
jl 0x100036dc
cmp dword [ebp + 0xc], 7
jg 0x100036dc
xor eax, eax
jmp 0x100036e1
mov eax, 1
test eax, eax
je 0x100036f0
mov dword [ebp + 0xc], 0
fild dword [ebp + 0xc]
fstp qword [ebp - 0x38]
fld qword [ebp - 0x38]
fadd qword [0x100f3eea]
fstp qword [ebp - 0x40]
fld qword [ebp - 0x40]
call fcn.10002e53
cmp eax, 1
jl 0x10003714
cmp eax, 9
jl 0x1000372b
push 0xa19
push 0x402e85b
push 9
call fcn.100623bb
add esp, 0xc
dec eax
call 0x10003731
pop ebx
add ebx, dword [eax*4 + 0x100f3f21]
jmp ebx