Function at 0x4041e0
Capabilities:
Parse url
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push edi
push ebx
xor ebx, ebx
push 0x1000
call fcn.0040190d
mov dword [ebp - 0x40], eax
push 0x1000
call fcn.0040190d
mov dword [ebp - 0x48], eax
push 0x1000
call fcn.0040190d
mov dword [ebp - 0x44], eax
push 0x1000
call fcn.0040190d
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x58], 0x1000
lea edi, [ebp - 0x3c]
mov ecx, 0x3c
xor eax, eax
rep stosb byte es:[edi], al
mov dword [ebp - 0x3c], 0x3c
push dword [ebp - 0x40]
pop dword [ebp - 0x2c]
push dword [ebp - 0x48]
pop dword [ebp - 0x10]
mov dword [ebp - 0x28], 0xfff
mov dword [ebp - 0xc], 0xfff
lea eax, [ebp - 0x3c]
push eax
push 0x80000000
push 0
push dword [ebp + 8]
call sub.wininet.dll_InternetCrackUrlA
and eax, eax
je 0x40426f
cmp dword [ebp - 0x2c], 0
jne 0x404274
jmp 0x4043a5
mov dword [ebp - 0x50], 0xfff
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x44]
push 0x80000000
lea eax, [ebp - 0x3c]
push eax
call sub.wininet.dll_InternetCreateUrlA
and eax, eax
jne 0x404299
jmp 0x4043a5
mov eax, dword [ebp - 0x48]
mov byte [eax], 0
lea edi, [ebp - 0x3c]
mov ecx, 0x3c
xor eax, eax
rep stosb byte es:[edi], al
mov dword [ebp - 0x3c], 0x3c
push dword [ebp - 0x48]
pop dword [ebp - 0x10]
mov dword [ebp - 0x28], 0xfff
mov dword [ebp - 0xc], 0xfff
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
push dword [ebp - 0x44]
call sub.wininet.dll_InternetCrackUrlA
and eax, eax
je 0x4042e0
cmp dword [ebp - 0x2c], 0
jne 0x4042e5
jmp 0x4043a5
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x54]
push 0
call sub.urlmon.dll_ObtainUserAgentString
test eax, eax
js 0x404315
push dword [ebp - 0x54]
push dword [ebp + 0x10]
push dword [ebp - 0x40]
push dword [ebp - 0x48]
push str.POST__s_HTTP_1.0_r_nHost:__s_r_nAccept:___r_nAccept_Encoding:_identity___q0_r_nAccept_Language:_en_US_r_nContent_Length:__lu_r_nContent_Type:_application_octet_stream_r_nConnection:_close_r_nContent_Encoding:_binary_r_nUser_Agent:__s_r_n_r_n
push dword [ebp - 0x44]
call sub.user32.dll_wsprintfA
add esp, 0x18
jmp 0x404333
push str.Mozilla_4.0__compatible__MSIE_8.0__Windows_NT_5.1__Trident_5.0_
push dword [ebp + 0x10]
push dword [ebp - 0x40]
push dword [ebp - 0x48]
push str.POST__s_HTTP_1.0_r_nHost:__s_r_nAccept:___r_nAccept_Encoding:_identity___q0_r_nAccept_Language:_en_US_r_nContent_Length:__lu_r_nContent_Type:_application_octet_stream_r_nConnection:_close_r_nContent_Encoding:_binary_r_nUser_Agent:__s_r_n_r_n
push dword [ebp - 0x44]
call sub.user32.dll_wsprintfA
add esp, 0x18
movzx eax, word [ebp - 0x24]
push eax
push 0
push dword [ebp - 0x40]
call fcn.00403b23
and eax, eax
jne 0x404348
jmp 0x4043a5
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x4c]
call fcn.004041b2
push dword [ebp - 0x44]
call sub.KERNEL32.DLL_lstrlenA
push eax
push dword [ebp - 0x44]
push dword [ebp - 0x4c]
call fcn.00403ba7
and eax, eax
jne 0x40436d
jmp 0x40439d
cmp dword [ebp + 0x10], 0
je 0x404387
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x4c]
call fcn.00403ba7
and eax, eax
jne 0x404387
jmp 0x40439d
mov ebx, eax
and ebx, ebx
je 0x40439d
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 0x4c]
call fcn.00403d9b
mov ebx, eax
push dword [ebp - 0x4c]
call sub.wsock32.dll_closesocket
push dword [ebp - 0x40]
call fcn.004018f6
push dword [ebp - 0x44]
call fcn.004018f6
push dword [ebp - 0x48]
call fcn.004018f6
push dword [ebp - 0x54]
call fcn.004018f6
mov eax, ebx
pop ebx
pop edi
leave
ret 0x14